selftests: openvswitch: Test ICMP related matches work with SNAT

Add a test case for regression in openvswitch nat that was fixed by
commit e6345d2824a3 ("netfilter: nf_nat: fix action not being set for
all ct states").

Link: https://lore.kernel.org/netdev/20231221224311.130319-1-brad@faucet.nz/
Link: https://mail.openvswitch.org/pipermail/ovs-dev/2024-January/410476.html
Suggested-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: Brad Cowie <brad@faucet.nz>
Tested-by: Aaron Conole <aconole@redhat.com>
Acked-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh
index f8499d4c87f3f763e774619666e00ce6a17d333b..87b80bee6df4074d63f537db06478f92ff81b3bc 100755 (executable)
--- a/tools/testing/selftests/net/openvswitch/openvswitch.sh
+++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh
@@ -17,6 +17,7 @@ tests="
        ct_connect_v4                           ip4-ct-xon: Basic ipv4 tcp connection using ct
        connect_v4                              ip4-xon: Basic ipv4 ping between two NS
        nat_connect_v4                          ip4-nat-xon: Basic ipv4 tcp connection via NAT
+       nat_related_v4                          ip4-nat-related: ICMP related matches work with SNAT
        netlink_checks                          ovsnl: validate netlink attrs and settings
        upcall_interfaces                       ovs: test the upcall interfaces
        drop_reason                             drop: test drop reasons are emitted"
@@ -473,6 +474,67 @@ test_nat_connect_v4 () {
        return 0
 }
 
+# nat_related_v4 test
+#  - client->server ip packets go via SNAT
+#  - client solicits ICMP destination unreachable packet from server
+#  - undo NAT for ICMP reply and test dst ip has been updated
+test_nat_related_v4 () {
+       which nc >/dev/null 2>/dev/null || return $ksft_skip
+
+       sbx_add "test_nat_related_v4" || return $?
+
+       ovs_add_dp "test_nat_related_v4" natrelated4 || return 1
+       info "create namespaces"
+       for ns in client server; do
+               ovs_add_netns_and_veths "test_nat_related_v4" "natrelated4" "$ns" \
+                       "${ns:0:1}0" "${ns:0:1}1" || return 1
+       done
+
+       ip netns exec client ip addr add 172.31.110.10/24 dev c1
+       ip netns exec client ip link set c1 up
+       ip netns exec server ip addr add 172.31.110.20/24 dev s1
+       ip netns exec server ip link set s1 up
+
+       ip netns exec server ip route add 192.168.0.20/32 via 172.31.110.10
+
+       # Allow ARP
+       ovs_add_flow "test_nat_related_v4" natrelated4 \
+               "in_port(1),eth(),eth_type(0x0806),arp()" "2" || return 1
+       ovs_add_flow "test_nat_related_v4" natrelated4 \
+               "in_port(2),eth(),eth_type(0x0806),arp()" "1" || return 1
+
+       # Allow IP traffic from client->server, rewrite source IP with SNAT to 192.168.0.20
+       ovs_add_flow "test_nat_related_v4" natrelated4 \
+               "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=172.31.110.20)" \
+               "ct(commit,nat(src=192.168.0.20)),recirc(0x1)" || return 1
+       ovs_add_flow "test_nat_related_v4" natrelated4 \
+               "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4()" \
+               "2" || return 1
+
+       # Allow related ICMP responses back from server and undo NAT to restore original IP
+       # Drop any ICMP related packets where dst ip hasn't been restored back to original IP
+       ovs_add_flow "test_nat_related_v4" natrelated4 \
+               "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
+               "ct(commit,nat),recirc(0x2)" || return 1
+       ovs_add_flow "test_nat_related_v4" natrelated4 \
+               "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(src=172.31.110.20,dst=172.31.110.10,proto=1),icmp()" \
+               "1" || return 1
+       ovs_add_flow "test_nat_related_v4" natrelated4 \
+               "recirc_id(0x2),ct_state(+rel+trk),in_port(2),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20,proto=1),icmp()" \
+               "drop" || return 1
+
+       # Solicit destination unreachable response from server
+       ovs_sbx "test_nat_related_v4" ip netns exec client \
+               bash -c "echo a | nc -u -w 1 172.31.110.20 10000"
+
+       # Check to make sure no packets matched the drop rule with incorrect dst ip
+       python3 "$ovs_base/ovs-dpctl.py" dump-flows natrelated4 \
+               | grep "drop" | grep "packets:0" >/dev/null || return 1
+
+       info "done..."
+       return 0
+}
+
 # netlink_validation
 # - Create a dp
 # - check no warning with "old version" simulation