mirror of
https://github.com/openvswitch/ovs
synced 2025-10-25 15:07:05 +00:00
9daf23484f
This patch adds a new 128-bit metadata field to the connection tracking
interface. When a label is specified as part of the ct action and the
connection is committed, the value is saved with the current connection.
Subsequent ct lookups with the table specified will expose this metadata
as the "ct_label" field in the flow.
For example, to allow new TCP connections from port 1->2 and only allow
established connections from port 2->1, and to associate a label with
those connections:
table=0,priority=1,action=drop
table=0,arp,action=normal
table=0,in_port=1,tcp,action=ct(commit,exec(set_field:1->ct_label)),2
table=0,in_port=2,ct_state=-trk,tcp,action=ct(table=1)
table=1,in_port=2,ct_state=+trk,ct_label=1,tcp,action=1
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
130 lines
7.5 KiB
Plaintext
130 lines
7.5 KiB
Plaintext
AT_BANNER([dpif-netdev])
|
|
|
|
# Strips out uninteresting parts of flow output, as well as parts
|
|
# that vary from one run to another (e.g., timing and bond actions).
|
|
m4_define([STRIP_XOUT], [[sed '
|
|
s/ufid:[-0-9a-f]* //
|
|
s/used:[0-9]*\.[0-9]*/used:0.0/
|
|
s/actions:.*/actions: <del>/
|
|
s/packets:[0-9]*/packets:0/
|
|
s/bytes:[0-9]*/bytes:0/
|
|
' | sort]])
|
|
m4_define([FILTER_FLOW_INSTALL], [[
|
|
grep 'flow_add' | sed '
|
|
s/.*flow_add: //
|
|
' | sort | uniq]])
|
|
m4_define([FILTER_FLOW_DUMP], [[
|
|
grep 'flow_dump ' | sed '
|
|
s/.*flow_dump //
|
|
s/used:[0-9]*\.[0-9]*/used:0.0/
|
|
' | sort | uniq]])
|
|
m4_define([STRIP_METADATA], [[sed 's/metadata=0x[0-9a-f]*/metadata=0x0/']])
|
|
|
|
AT_SETUP([dpif-netdev - dummy interface])
|
|
# Create br0 with interfaces p1 and p7
|
|
# and br1 with interfaces p2 and p8
|
|
# with p1 and p2 connected via unix domain socket
|
|
OVS_VSWITCHD_START(
|
|
[add-port br0 p1 -- set interface p1 type=dummy options:pstream=punix:$OVS_RUNDIR/p0.sock ofport_request=1 -- \
|
|
add-port br0 p7 -- set interface p7 ofport_request=7 type=dummy -- \
|
|
add-br br1 -- \
|
|
set bridge br1 other-config:hwaddr=aa:66:aa:66:00:00 -- \
|
|
set bridge br1 datapath-type=dummy other-config:datapath-id=1234 \
|
|
fail-mode=secure -- \
|
|
add-port br1 p2 -- set interface p2 type=dummy options:stream=unix:$OVS_RUNDIR/p0.sock ofport_request=2 -- \
|
|
add-port br1 p8 -- set interface p8 ofport_request=8 type=dummy --])
|
|
AT_CHECK([ovs-appctl vlog/set dpif:dbg dpif_netdev:dbg])
|
|
|
|
AT_CHECK([ovs-ofctl add-flow br0 action=normal])
|
|
AT_CHECK([ovs-ofctl add-flow br1 action=normal])
|
|
ovs-appctl time/stop
|
|
ovs-appctl time/warp 5000
|
|
AT_CHECK([ovs-appctl netdev-dummy/receive p7 'in_port(7),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
|
|
AT_CHECK([ovs-appctl netdev-dummy/receive p8 'in_port(8),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=10.0.0.3,dst=10.0.0.4,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
|
|
ovs-appctl time/warp 100
|
|
sleep 1 # wait for forwarders process packets
|
|
|
|
AT_CHECK([cat ovs-vswitchd.log | FILTER_FLOW_INSTALL | STRIP_XOUT], [0], [dnl
|
|
recirc_id=0,ip,in_port=1,vlan_tci=0x0000/0x1fff,dl_src=50:54:00:00:00:0b,dl_dst=50:54:00:00:00:0c,nw_frag=no, actions: <del>
|
|
recirc_id=0,ip,in_port=2,vlan_tci=0x0000/0x1fff,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_frag=no, actions: <del>
|
|
recirc_id=0,ip,in_port=7,vlan_tci=0x0000/0x1fff,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_frag=no, actions: <del>
|
|
recirc_id=0,ip,in_port=8,vlan_tci=0x0000/0x1fff,dl_src=50:54:00:00:00:0b,dl_dst=50:54:00:00:00:0c,nw_frag=no, actions: <del>
|
|
])
|
|
|
|
OVS_VSWITCHD_STOP
|
|
AT_CLEANUP
|
|
|
|
AT_SETUP([dpif-netdev - miss upcall key matches flow_install])
|
|
OVS_VSWITCHD_START(
|
|
[add-port br0 p1 -- set interface p1 type=dummy options:pstream=punix:$OVS_RUNDIR/p0.sock
|
|
set bridge br0 datapath-type=dummy other-config:datapath-id=1234 \
|
|
fail-mode=secure])
|
|
AT_CHECK([ovs-appctl vlog/set dpif:dbg dpif_netdev:dbg])
|
|
|
|
AT_CHECK([ovs-ofctl add-flow br0 action=normal])
|
|
AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
|
|
sleep 1
|
|
|
|
AT_CHECK([cat ovs-vswitchd.log | grep -A 1 'miss upcall' | tail -n 1], [0], [dnl
|
|
skb_priority(0),skb_mark(0),recirc_id(0),dp_hash(0),in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)
|
|
])
|
|
AT_CHECK([cat ovs-vswitchd.log | FILTER_FLOW_INSTALL | STRIP_XOUT], [0], [dnl
|
|
recirc_id=0,ip,in_port=1,vlan_tci=0x0000/0x1fff,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_frag=no, actions: <del>
|
|
])
|
|
|
|
# Now, the same again without megaflows.
|
|
AT_CHECK([ovs-appctl upcall/disable-megaflows], [0], [megaflows disabled
|
|
])
|
|
AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
|
|
sleep 1
|
|
|
|
AT_CHECK([cat ovs-vswitchd.log | grep -A 1 'miss upcall' | tail -n 1], [0], [dnl
|
|
skb_priority(0),skb_mark(0),recirc_id(0),dp_hash(0),in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)
|
|
])
|
|
AT_CHECK([cat ovs-vswitchd.log | FILTER_FLOW_INSTALL | STRIP_XOUT], [0], [dnl
|
|
pkt_mark=0,recirc_id=0,dp_hash=0,skb_priority=0,ct_state=0,ct_zone=0,ct_mark=0,ct_label=0,icmp,in_port=1,vlan_tci=0x0000,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_src=10.0.0.2,nw_dst=10.0.0.1,nw_tos=0,nw_ecn=0,nw_ttl=64,icmp_type=8,icmp_code=0, actions: <del>
|
|
recirc_id=0,ip,in_port=1,vlan_tci=0x0000/0x1fff,dl_src=50:54:00:00:00:09,dl_dst=50:54:00:00:00:0a,nw_frag=no, actions: <del>
|
|
])
|
|
|
|
OVS_VSWITCHD_STOP
|
|
AT_CLEANUP
|
|
|
|
AT_SETUP([dpif-netdev - miss upcall key matches flow_dump])
|
|
OVS_VSWITCHD_START(
|
|
[add-port br0 p1 -- set interface p1 type=dummy options:pstream=punix:$OVS_RUNDIR/p0.sock
|
|
set bridge br0 datapath-type=dummy other-config:datapath-id=1234 \
|
|
fail-mode=secure])
|
|
AT_CHECK([ovs-appctl upcall/disable-ufid], [0], [Datapath dumping tersely using UFID disabled
|
|
], [])
|
|
AT_CHECK([ovs-appctl vlog/set dpif:dbg dpif_netdev:dbg])
|
|
|
|
AT_CHECK([ovs-ofctl add-flow br0 action=normal])
|
|
AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
|
|
sleep 1
|
|
|
|
AT_CHECK([cat ovs-vswitchd.log | grep -A 1 'miss upcall' | tail -n 1], [0], [dnl
|
|
skb_priority(0),skb_mark(0),recirc_id(0),dp_hash(0),in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)
|
|
])
|
|
AT_CHECK([cat ovs-vswitchd.log | FILTER_FLOW_DUMP | STRIP_XOUT], [0], [dnl
|
|
skb_priority(0/0),skb_mark(0/0),recirc_id(0),dp_hash(0/0),in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2/0.0.0.0,dst=10.0.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:0, bytes:0, used:never, actions: <del>
|
|
])
|
|
|
|
# Now, the same again without megaflows.
|
|
AT_CHECK([ovs-appctl upcall/disable-megaflows], [0], [megaflows disabled
|
|
])
|
|
AT_CHECK([ovs-appctl upcall/disable-ufid], [0], [Datapath dumping tersely using UFID disabled
|
|
], [])
|
|
AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
|
|
sleep 1
|
|
|
|
AT_CHECK([cat ovs-vswitchd.log | grep -A 1 'miss upcall' | tail -n 1], [0], [dnl
|
|
skb_priority(0),skb_mark(0),recirc_id(0),dp_hash(0),in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)
|
|
])
|
|
AT_CHECK([cat ovs-vswitchd.log | FILTER_FLOW_DUMP | STRIP_XOUT], [0], [dnl
|
|
skb_priority(0),skb_mark(0),recirc_id(0),dp_hash(0),in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2,dst=10.0.0.1,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0), packets:0, bytes:0, used:never, actions: <del>
|
|
skb_priority(0/0),skb_mark(0/0),recirc_id(0),dp_hash(0/0),in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.0.0.2/0.0.0.0,dst=10.0.0.1/0.0.0.0,proto=1/0,tos=0/0,ttl=64/0,frag=no),icmp(type=8/0,code=0/0), packets:0, bytes:0, used:never, actions: <del>
|
|
])
|
|
|
|
OVS_VSWITCHD_STOP
|
|
AT_CLEANUP
|