summaryrefslogtreecommitdiff
path: root/tests/system-traffic.at
Commit message (Collapse)AuthorAgeFilesLines
* system-traffic: 802.1ad: Add datapath ping tests for CVLANs.Eric Garver2016-10-181-0/+62
| | | | | Signed-off-by: Eric Garver <e@erig.me> Signed-off-by: Joe Stringer <joe@ovn.org>
* system-traffic: Collapse FTP NAT tests.Joe Stringer2016-09-281-137/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | Previously we had the following tests: * FTP with NAT * FTP with NAT (seq-adj) * FTP with NAT 2 Tests 1 and 2 share everything, except use different IP addresses. Test 3 has a different flow table, but shares the topology with 1 and 2. This commit creates macros: * CHECK_FTP_NAT(title, ip, flow_table) * CHECK_FTP_NAT_PRE_RECIRC(title, ip, ip-as-hex) * CHECK_FTP_NAT_POST_RECIRC(title, ip, ip-as-hex) The second macro represents tests 1 and 2, while the third macro represents two variations on test 3: with and without TCP sequence adjustment. By using these macros to declare the tests, much of the code may be reused and shared rather than copying/pasting. As a result, the differences between tests are easier to identify. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* system-traffic: Add FTP NAT test without seqadj.Joe Stringer2016-09-071-2/+81
| | | | | | | | | | | | | The existing FTP with NAT tests all perform NATing from an IP like 10.1.1.1 -> 10.1.1.240, which requires adjusting the length of FTP control messages as they pass through the connection tracker. Occasionally this is a source of kernel bugs, so it is useful to have a regular FTP NAT test between IPs that do not change the message length in FTP control messages (eg, 10.1.1.1 -> 10.1.1.9) to more clearly identify failures in this area. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* system-traffic: Add a bonding test case.Lance Richardson2016-08-311-0/+25
| | | | | | | | | | | Add a test case to check connectivity over an OVS bond, using a Linux bond over veth interfaces. Also added a new macro "ADD_VETH_BOND", modeled after "ADD_VETH", in anticipation of future additional bonding test cases. Signed-off-by: Lance Richardson <lrichard@redhat.com> Signed-off-by: Joe Stringer <joe@ovn.org>
* system-traffic: Don't rely on --field-separator.Joe Stringer2016-08-181-4/+4
| | | | | | | | This is available in GNU awk, but not other awks (eg mawk). Drop this in favour of "ofctl_strip" to produce reliable output. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: William Tu <u9012063@gmail.com>
* system-traffic: Add link-args for ADD_NATIVE_TUNNEL.William Tu2016-08-181-2/+2
| | | | | | | | | | | | Ubuntu 14.04 with kernel 3.13 fails to set a GRE tunnel's mac address after device state is up. The patch first introduces additional args 'link-args' for 'ip link set' and uses it to adds mac address setting in ADD_NATIVE_TUNNEL. As a result, the device could be configured before becoming up state. Note that the original 'link-args' is renamed to 'type-args'. Signed-off-by: William Tu <u9012063@gmail.com> Signed-off-by: Joe Stringer <joe@ovn.org>
* system-traffic: Flush conntrack after debug ping6.Daniele Di Proietto2016-08-051-0/+4
| | | | | | | | | | | | We want to discard any state created by the initial ping6 (used to wait for an available IP address). Otherwise some weird state can show up in the connection tracking tables (such as ICMP connection from link-local addresses). Fixes: e5cf8cce2759("system-tests: Add ping through conntrack test.") Reported-by: Joe Stringer <joe@ovn.org> Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joe@ovn.org>
* system-traffic: Make ping6 vlan test more reliable.Joe Stringer2016-08-051-1/+1
| | | | | | | | | | Previously we checked on the underlying interfaces rather than the vlan interfaces to verify whether IPv6 connectivity is available; occasionally this would fail on some systems. Wait on the VLAN IP instead. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: <diproiettod@vmware.com>
* system-tests: Add ping through conntrack test.Daniele Di Proietto2016-07-291-0/+84
| | | | | Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joe@ovn.org>
* system-tests: Run conntrack tests with userspace.Daniele Di Proietto2016-07-291-3/+29
| | | | | | | | | | | | | | | The userspace connection tracker doesn't support ALGs, frag reassembly or NAT yet, so skip those tests. Also, connection tracking state input from a local port is not possible in userspace. Finally, the userspace datapath checks for the IPv4 header checksum, so fix those in the hardcoded packets. Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joe@ovn.org> Acked-by: Flavio Leitner <fbl@sysclose.org>
* tests: Ignore proxy configuration.Jarno Rajahalme2016-07-291-4/+4
| | | | | | | | As any proxy configuration may ruin kernel testsuite tests, it is better to ignore all proxy configuration. Suggested-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* conntrack: Track ICMP type and code.Daniele Di Proietto2016-07-271-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | From the connection tracker perspective, an ICMP connection is a tuple identified by source ip address, destination ip address and ICMP id. While this allows basic ICMP traffic (pings) to work, it doesn't take into account the icmp type: the connection tracker will allow requests/replies in any directions. This is improved by making the ICMP type and code part of the connection tuple. An ICMP echo request packet from A to B, will create a connection that matches ICMP echo request from A to B and ICMP echo replies from B to A. The same is done for timestamp and info request/replies, and for ICMPv6. A new modules conntrack-icmp is implemented, to allow only "request" types to create new connections. Also, since they're tracked in both userspace and kernel implementations, ICMP type and code are always printed in ct-dpif (a few testcase are updated as a consequence). Reported-by: Subramani Paramasivam <subramani.paramasivam@wipro.com> Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joe@ovn.org>
* system-traffic: Fix up FTP tests.Joe Stringer2016-07-211-4/+4
| | | | | | | | | | | | Prior to commit b87a5aacefe2 ("datapath: Fix cached ct with helper."), we were relying on automatic helpers to ensure that FTP connections were tracked correctly, regardless of the flows that existed in the datapath. Now, we can drop the automatic helpers in the root namespace and still have related connections work correctly. Also, the ALG should only be specified when committing the connection. Update the rules. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* system-traffic: Remove unnecessary priorities.Joe Stringer2016-07-211-17/+17
| | | | | Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* system-traffic: Update tests in flat tables.Joe Stringer2016-07-211-30/+37
| | | | | | | | | | A few of the earlier tests were written with all flows in a single flat table. While this is a possible way to write your flows to use connection tracking, it's easier to understand if the processing proceeds forward from one table to the next. Update these tests. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* system-traffic: Remove datapath specific tests and macro.William Tu2016-07-141-12/+1
| | | | | | | | | We generally try to keep the testsuite independent of the underlying datapath. This patch removes the datapath-specific tests and macros. Tested-at: https://travis-ci.org/williamtu/ovs-travis/builds/141642065 Signed-off-by: William Tu <u9012063@gmail.com> Signed-off-by: Joe Stringer <joe@ovn.org>
* system-traffic: Use NC_EOF_OPT in truncate tests.Joe Stringer2016-07-111-7/+7
| | | | | | | | | | | | | | NC_EOF_OPT should always be passed to netcat in system-traffic tests when invoking netcat to send a single packet that does not expect a response. While on typical fedora/RH based distributions the default behaviour is to send the packet then return, there are multiple other implementations of netcat that do not do this (for example, those used by Debian and Ubuntu by default). For these alternative implementations, we provide $NC_EOF_OPT to ensure that netcat simply sends the packet then returns immediately. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
* system-traffic: Remove basic connectivity tests.Joe Stringer2016-06-271-33/+0
| | | | | | | | | | | | | | | For many of the tests, we would first execute a "basic connectivity check" to validate the sanity of the setup before running the test traffic which probes the actual OVS behaviour. However, by running traffic through the rules prior to running the test, it is more likely that the traffic hits datapath flows and doesn't test the "execute" path (from userspace to kernel). This can hide some classes of bugs. The first few tests in system-traffic already check the basic sanity of the environment, so these redundant pieces are unnecessary. Remove them. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jesse Gross <jesse@kernel.org>
* ofp-actions: Add truncate action.William Tu2016-06-241-0/+247
| | | | | | | | | | | | | | | | | | | | | | | | | | The patch adds a new action to support packet truncation. The new action is formatted as 'output(port=n,max_len=m)', as output to port n, with packet size being MIN(original_size, m). One use case is to enable port mirroring to send smaller packets to the destination port so that only useful packet information is mirrored/copied, saving some performance overhead of copying entire packet payload. Example use case is below as well as shown in the testcases: - Output to port 1 with max_len 100 bytes. - The output packet size on port 1 will be MIN(original_packet_size, 100). # ovs-ofctl add-flow br0 'actions=output(port=1,max_len=100)' - The scope of max_len is limited to output action itself. The following packet size of output:1 and output:2 will be intact. # ovs-ofctl add-flow br0 \ 'actions=output(port=1,max_len=100),output:1,output:2' - The Datapath actions shows: # Datapath actions: trunc(100),1,1,2 Tested-at: https://travis-ci.org/williamtu/ovs-travis/builds/140037134 Signed-off-by: William Tu <u9012063@gmail.com> Acked-by: Pravin B Shelar <pshelar@ovn.org>
* tests: Clear TCP state from conntrack dumps.Jarno Rajahalme2016-06-201-71/+71
| | | | | | | | When the TCP state is not important it is better ignore it. This makes test cases more robust w.r.t. kernel versions and timing. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Jesse Gross <jesse@kernel.org>
* ofp-actions: Allow conntrack action in group buckets.Jarno Rajahalme2016-05-241-0/+172
| | | | | | | | | | | Conntrack action used in group buckets lets us do simple load-balancing. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> [guru@ovn.org updated the commit message and made a small change to the test output format] Signed-off-by: Gurucharan Shetty <guru@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Wait for availability of ftpd.Joe Stringer2016-05-101-0/+5
| | | | | | | | | | Some FTP tests had intermittent failures because the FTP daemons might not load before the testsuite script iterated to running the client. Add checks after launching FTP daemons to make these tests more resilient. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* system-traffic: Wait for IPv6 connectivity.Joe Stringer2016-05-101-16/+34
| | | | | | | | | | | | | | Several of the tests have race conditions where the next step in the test may run before the kernel actually provides IPv6 connectivity. This causes intermittent testsuite failures. Some existing tests would even sleep in an attempt to mitigate this issue. Improve the resilience of these tests by waiting until IPv6 or FTP connectivity are ready. This speeds the testsuite up by a couple of percent. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Jarno Rajahalme <jarno@ovn.org>
* system-tests: Add tcp simple test.Daniele Di Proietto2016-04-261-0/+20
| | | | | | | | | Useful to test the datapath ability to forward tcp packets without the complexity of connection tracking. Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joe@ovn.org> Acked-by: Flavio Leitner <fbl@sysclose.org>
* ofproto-dpif-xlate: xlate ct_{mark, label} correctly.Joe Stringer2016-04-221-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | When translating multiple ct actions in a row which include modification of ct_mark or ct_labels, these fields could be incorrectly translated into datapath actions, resulting in modification of these fields for entries when the OpenFlow rules didn't actually specify the change. For instance, the following OpenFlow actions: ct(zone=1,commit,exec(set_field(1->ct_mark))),ct(zone=2,table=1),... Would translate into the datapath actions: ct(zone=1,commit,mark=1),ct(zone=2,mark=1),recirc(...),... This commit fixes the issue by zeroing the wildcards for these fields prior to performing nested actions translation (and restoring afterwards). As such, these fields do not hold both the match and the field modification values at the same time. As a result, the ct_mark and ct_labels don't leak from one ct action to the next. Fixes: 8e53fe8cf7a1 ("Add connection tracking mark support.") Fixes: 9daf23484fb1 ("Add connection tracking label support.") Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Add basic geneve tunnel sanity test.Joe Stringer2016-04-221-0/+41
| | | | | Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* system-traffic: Add basic gre tunnel sanity test.Joe Stringer2016-04-221-0/+40
| | | | | Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* system-traffic: Fix IPv6 frag vxlan check.Joe Stringer2016-04-221-1/+1
| | | | | | | | | This was missed before somehow, which would cause the test to fail (rather than being skipped) if iproute2 didn't support setting the vxlan dstport on the kernel tunnel device. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* ofproto-dpif-xlate: Generate bitmasks in set_field.Joe Stringer2016-04-151-0/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, whenever a set_field() action was executed, the entire field would become masked and the entire field replaced, regardless of the mask specified in the set_field() action. In most cases this is fine, although it may lead to more specific wildcards than strictly necessary. However, in a particular case with connection tracking actions it could lead to the wrong behaviour. Unlike most OpenFlow fields, the ct_{mark,labels} fields are typically unknown until the ct(...,recirc_table=N,...) action is executed however the packet may actually belong to a connection which has a nonzero value for one of these fields. This can lead to the wrong behaviour with flows such as the following: in_port=1,ip,actions=ct(commit,exec(set_field(0x1/0x1->ct_mark))),2 in_port=2,ip,actions=ct(commit,exec(set_field(0x2/0x2->ct_mark))),1 Connections flowing through these actions will always update the ct_mark field stored within the conntrack table. However, rather than modifying only the specified bits (0x1 in one direction, 0x2 in the other), the entire ct_mark field will be replaced. Such connections will constantly toggle the value of ct_mark between 0x1 and 0x2, rather than becoming 0x3 and keeping that value. This commit fixes the issue by ensuring that set_field actions only modify the modified bits in the wildcards, rather than masking the entire field. Fixes: 8e53fe8cf7a1 ("Add connection tracking mark support.") Fixes: 9daf23484fb1 ("Add connection tracking label support.") Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Use better names for OVS vxlan ports.Joe Stringer2016-04-131-2/+2
| | | | | Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Fix packet-in format for tests.Joe Stringer2016-04-071-4/+4
| | | | | | | | | | Since continuations were introduced, the system-traffic tests which use OpenFlow monitors to check the results of datapath execution have been failing, because the new PACKET_IN2 format is used rather than PACKET_IN. Switch the expected output over to PACKET_IN2. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* system-traffic: Add IPv6-over-vxlan-over-IPv4 tests.Joe Stringer2016-02-161-0/+57
| | | | | Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Add IP fragmentation expiry tests.Joe Stringer2016-02-161-0/+79
| | | | | | | | | | | These tests indirectly trigger the kernel IP fragment expiry code by ensuring that not all fragments are assembled. This reproduces the bug that was fixed in the following commit: bf1f0d35ceb9 datapath: Fix IPv6 fragment expiry crash. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Make vxlan frag test more reliable.Joe Stringer2016-02-161-2/+2
| | | | | | | | | | | | | | | | Depending on the kernel version in use, the nf_conntrack module may register hooks for each namespace and execute conntrack prior to passing packets to OVS (or not). In cases where this happens, the previous flow table in this test would trust the local stack's connection tracking and use it rather than sending packets through conntrack itself (and therefore handling IP defragmentation/fragmentation). This patch revealed two fatal datapath bugs, fixed by these commits: 86c2eb45fd82 datapath: Fix panic sending IP frags over tunnels. 792e5ed750ce datapath: inet: frag: Always orphan skbs inside ip_defrag(). Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Fix typo in IPv6 tests.Joe Stringer2016-02-161-2/+2
| | | | | Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: use appropriate nc options for installed versionLance Richardson2016-01-251-4/+2
| | | | | | | | | | | | | | | | | Test cases using netcat ("ICMP related" and "ICMP related with NAT") currently fail on systems using the nmap version of nc because this version does not support the -q command-line option. Fix this by detecting which version of netcat is is in use and using the "--send-only" command-line option when the nmap flavor is detected, and using "-q 1" otherwise (openbsd and traditional versions). Tested via "make check-kernel" on RHEL7 (nmap version of nc), Debian 8.2 (openbsd version of nc), and Ubuntu 14.04 ("traditional" nc). Signed-off-by: Lance Richardson <lrichard@redhat.com> Signed-off-by: Joe Stringer <joe@ovn.org>
* Revert "system-traffic: Remove netcat from ICMP test."Lance Richardson2016-01-251-15/+4
| | | | | | | | | Revert previous workaround for netcat portability issue. This reverts commit dc55e9465511dee6c12dbf0edb4ce2d9af57cb15. Signed-off-by: Lance Richardson <lrichard@redhat.com> Signed-off-by: Joe Stringer <joe@ovn.org>
* system-traffic: Skip all vxlan tests if unsupported.Joe Stringer2015-12-231-2/+2
| | | | | | | | | | | The vxlan tests require a new enough 'ip' tool to configure native VXLAN tunnels on the host kernel (as well as a new enough kernel). If this isn't available, simply skip the test. This commit makes the cases where this is checked consistent. Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org> Acked-by: Russell Bryant <russell@ovn.org>
* system-traffic: Use 'dpctl/dump-conntrack' for NAT tests.Daniele Di Proietto2015-12-211-25/+27
| | | | | Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joe@ovn.org>
* system-traffic: use `dpctl/*conntrack` instead of `conntrack` tool.Daniele Di Proietto2015-12-211-60/+65
| | | | | | | | | | | | | | | | Often in the tests we inspect the conntrack tables with the 'conntrack' command line utility. Since this may not always be available, and since these tests are supposed to run with the upcoming userspace connection tracker, it is better to use the newly implemented dpctl command. Due to the tcp state mapping done in tcp_state_coalesce(), SYN_RECV is replaced by ESTABLISHED in four places in the testsuite. The rest of the changes are just done to match the formatting style. Also, check the conntrack entries for the IPv6 HTTP test. Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com> Acked-by: Joe Stringer <joe@ovn.org>
* conntrack: Add support for NAT.Jarno Rajahalme2015-11-251-2/+561
| | | | | | | | | | | | | Extend OVS conntrack interface to cover NAT. New nested NAT action may be included with a CT action. A bare NAT action only mangles existing connections. If a NAT action with src or dst range attribute is included, new (non-committed) connections are mangled according to the NAT attributes. This work extends on a branch by Thomas Graf at https://github.com/tgraf/ovs/tree/nat. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-tests: Add IPv6 FTP system test.Jarno Rajahalme2015-11-251-0/+50
| | | | Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Joe Stringer <joe@ovn.org>
* system-traffic: Add internal port conntrack tests.Joe Stringer2015-11-241-0/+40
| | | | | | | | | Add an additional test that ensures that when receiving packets from internal ports that reside in a foreign namespace, the conntrack information is not populated in the flow. Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* system-traffic: Remove netcat from ICMP test.Joe Stringer2015-11-241-4/+15
| | | | | | | | | Netcat is different on each platform I tried (Debian, Ubuntu, RHEL), so rather than handling version differences it's better to just do the same test with some hardcoded packets. Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* system-tests: Use '--bundle'Jarno Rajahalme2015-11-241-31/+30
| | | | | | | | | Use OpenFlow bundles for setting up flow tables. This has the benefit that when debugging test failures, no packet gets processed by partially set-up flow table, which may seem confusing. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-tests: Make bridge creation more consistent.Jarno Rajahalme2015-11-241-60/+45
| | | | | | | | | Create all bridges with the same set of supported OpenFlow protocols and fail-safe-mode secure, so that each test explicitly specifies flow handling. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
* system-traffic: Add resubmit conntrack test.Russell Bryant2015-11-111-0/+39
| | | | | | | | This tests that resubmits return as expected when conntrack is used with recirculation to another table. Signed-off-by: Russell Bryant <rbryant@redhat.com> Signed-off-by: Joe Stringer <joestringer@nicira.com>
* system-traffic: Add ct tests using local stack.Joe Stringer2015-10-131-0/+118
| | | | | | | | | | When interacting with the local stack, the kernel may provide packets with existing ct state as they ingress OVS. These tests check that we are able to connection-track such packets successfully in non-zero zones, using slightly more realistic pipelines. Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Daniele Di Proietto <diproiettod@vmware.com>
* dpif-netlink: Allow MRU packet attribute.Andy Zhou2015-10-131-0/+221
| | | | | | | | | | | | | | | | | | User space now may receive re-assembled IP fragments. The user space netlink handler can now accept packets with the new OVS_PACKET_ATTR_MRU attribute. This allows the kernel to assemble fragmented packets for the duration of OpenFlow processing, then re-fragment at output time. Most notably this occurs for packets that are sent through the connection tracker. Note that the MRU attribute is not exported at the OpenFlow layer. As such, if packets are reassembled by conntrack and subsequently sent to the controller, then OVS has no way to re-serialize the packets to their original size. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
* Add support for connection tracking helper/ALGs.Joe Stringer2015-10-131-0/+145
| | | | | | | | | | | | | | | | | | | | This patch adds support for specifying a "helper" or ALG to assist connection tracking for protocols that consist of multiple streams. Initially, only support for FTP is included. Below is an example set of flows to allow FTP control connections from port 1->2 to establish active data connections in the reverse direction: table=0,priority=1,action=drop table=0,arp,action=normal table=0,in_port=1,tcp,action=ct(alg=ftp,commit),2 table=0,in_port=2,tcp,ct_state=-trk,action=ct(table=1) table=1,in_port=2,tcp,ct_state=+trk+est,action=1 table=1,in_port=2,tcp,ct_state=+trk+rel,action=ct(commit),1 Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
View Lorry Controller Status