diff mbox series

[ovs-dev,RFC,3/3] tests: Check for logical flow processing when ACL reject rule is hit

Message ID 20180518165537.32002-4-jkbs@redhat.com
State RFC
Headers show
Series ovn: Observe and check for effects of incremental processing | expand

Commit Message

Jakub Sitnicki May 18, 2018, 4:55 p.m. UTC
With incremental processing packet-ins handling in the ovn-controller
should not trigger logical flow processing. One such case of packet-in
handling is ovn-controller generating ICMP/TCP reset packets due to use
of ACL reject action. Ensure that logical flow processing is not
happening by watching coverage counters.

Signed-off-by: Jakub Sitnicki <jkbs@redhat.com>
---
 tests/ovn.at | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Han Zhou May 21, 2018, 11:23 p.m. UTC | #1
On Fri, May 18, 2018 at 9:55 AM, Jakub Sitnicki <jkbs@redhat.com> wrote:
>
> With incremental processing packet-ins handling in the ovn-controller
> should not trigger logical flow processing. One such case of packet-in
> handling is ovn-controller generating ICMP/TCP reset packets due to use
> of ACL reject action. Ensure that logical flow processing is not
> happening by watching coverage counters.
>
> Signed-off-by: Jakub Sitnicki <jkbs@redhat.com>
> ---
>  tests/ovn.at | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/tests/ovn.at b/tests/ovn.at
> index 4a5316510..18d2ab692 100644
> --- a/tests/ovn.at
> +++ b/tests/ovn.at
> @@ -9556,6 +9556,10 @@ ovn-nbctl --log acl-add sw0 from-lport 1000
"inport == \"sw0-p11\"" reject
>  ovn-nbctl --log acl-add sw0 from-lport 1000 "inport == \"sw0-p21\""
reject
>  OVS_WAIT_UNTIL([test 3 = $(ovn-sbctl lflow-list | grep 'icmp4 {' | wc
-l)])
>
> +for i in 1 2 3; do
> +    count_before="$(as hv$i ovs-appctl -t ovn-controller
coverage/read-count lflow_run) $count_before"
> +done
> +
>  test_ip_packet 11 1 000000000011 000000000021 $(ip_to_hex 192 168 1 11)
$(ip_to_hex 192 168 1 21) 0000 7d8d fcfe
>  test_ip_packet 21 2 000000000021 000000000011 $(ip_to_hex 192 168 1 21)
$(ip_to_hex 192 168 1 11) 0000 7d8d fcfe
>  test_ip_packet 31 3 000000000031 000000000012 $(ip_to_hex 192 168 1 31)
$(ip_to_hex 192 168 1 12) 0000 7d82 fcfe
> @@ -9568,8 +9572,12 @@ test_tcp_syn_packet 31 3 000000000031 000000000012
$(ip_to_hex 192 168 1 31) $(i
>
>  for i in 1 2 3; do
>      OVN_CHECK_PACKETS([hv$i/vif${i}1-tx.pcap], [vif${i}1.expected])
> +    count_after="$(as hv$i ovs-appctl -t ovn-controller
coverage/read-count lflow_run) $count_after"
>  done
>
> +# Check that hitting reject rule doesn't trigger lflow processing
> +AT_CHECK([test X"$count_before" = X"$count_after"], [0])
> +
>  OVN_CLEANUP([hv1], [hv2], [hv3])
>  AT_CLEANUP
>
> --
> 2.14.3
>

Acked-by: Han Zhou <hzhou8@ebay.com>
diff mbox series

Patch

diff --git a/tests/ovn.at b/tests/ovn.at
index 4a5316510..18d2ab692 100644
--- a/tests/ovn.at
+++ b/tests/ovn.at
@@ -9556,6 +9556,10 @@  ovn-nbctl --log acl-add sw0 from-lport 1000 "inport == \"sw0-p11\"" reject
 ovn-nbctl --log acl-add sw0 from-lport 1000 "inport == \"sw0-p21\"" reject
 OVS_WAIT_UNTIL([test 3 = $(ovn-sbctl lflow-list | grep 'icmp4 {' | wc -l)])
 
+for i in 1 2 3; do
+    count_before="$(as hv$i ovs-appctl -t ovn-controller coverage/read-count lflow_run) $count_before"
+done
+
 test_ip_packet 11 1 000000000011 000000000021 $(ip_to_hex 192 168 1 11) $(ip_to_hex 192 168 1 21) 0000 7d8d fcfe
 test_ip_packet 21 2 000000000021 000000000011 $(ip_to_hex 192 168 1 21) $(ip_to_hex 192 168 1 11) 0000 7d8d fcfe
 test_ip_packet 31 3 000000000031 000000000012 $(ip_to_hex 192 168 1 31) $(ip_to_hex 192 168 1 12) 0000 7d82 fcfe
@@ -9568,8 +9572,12 @@  test_tcp_syn_packet 31 3 000000000031 000000000012 $(ip_to_hex 192 168 1 31) $(i
 
 for i in 1 2 3; do
     OVN_CHECK_PACKETS([hv$i/vif${i}1-tx.pcap], [vif${i}1.expected])
+    count_after="$(as hv$i ovs-appctl -t ovn-controller coverage/read-count lflow_run) $count_after"
 done
 
+# Check that hitting reject rule doesn't trigger lflow processing
+AT_CHECK([test X"$count_before" = X"$count_after"], [0])
+
 OVN_CLEANUP([hv1], [hv2], [hv3])
 AT_CLEANUP