From de17a44f3588d34b6dfd76a6369c73dc8995db10 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 25 Jan 2016 10:58:31 +0000 Subject: [PATCH] Fix fragmentation test The assumptions on which this test was based were violated by the introduction of fast datapath. A new rule is required to block fast datapath traffic, to ensure that sleeve is selected for forwarding; the rules must also be moved from the FORWARD chain to INPUT as the router now runs in the host netns (NB we use INPUT instead of OUTPUT as the latter results in sleeve receiving an 'operation not permitted' udpv4 write error when it tries to send a packet that is too big, rather than the packet just being silently dropped as required) --- test/105_frag_2_test.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/test/105_frag_2_test.sh b/test/105_frag_2_test.sh index bb898b28..3c42ba98 100755 --- a/test/105_frag_2_test.sh +++ b/test/105_frag_2_test.sh @@ -8,7 +8,8 @@ C2=10.2.1.71 # 700 = Linux's minimum PMTU (552) + weave framing overheads # (currently about 60, but we leave some margin). That way the PMTUs # seen by containers is still >= 552. -drop_large_udp_packets="FORWARD -p udp --destination-port 6783 -m length '!' --length 0:700 -j DROP" +drop_large_sleeve_packets="INPUT -p udp --destination-port 6783 -m length '!' --length 0:700 -j DROP" +drop_large_fastdp_packets="INPUT -p udp --destination-port 6784 -m length '!' --length 0:700 -j DROP" start_suite "PMTU discovery and packet fragmentation" @@ -18,7 +19,8 @@ weave_on $HOST2 launch start_container $HOST1 $C1/24 --name=c1 start_container $HOST2 $C2/24 --name=c2 -run_on $HOST2 "sudo iptables -I $drop_large_udp_packets" +run_on $HOST1 "sudo iptables -I $drop_large_sleeve_packets" +run_on $HOST1 "sudo iptables -I $drop_large_fastdp_packets" assert_raises "weave_on $HOST2 connect $HOST1" sleep 35 # give weave time to discover the PMTU @@ -28,6 +30,7 @@ sleep 35 # give weave time to discover the PMTU exec_on $HOST2 c2 $PING -s 10000 $C1 1>/dev/null 2>&1 || true assert_raises "exec_on $HOST2 c2 $PING -s 10000 $C1" -run_on $HOST2 "sudo iptables -D $drop_large_udp_packets" +run_on $HOST1 "sudo iptables -D $drop_large_fastdp_packets" +run_on $HOST1 "sudo iptables -D $drop_large_sleeve_packets" end_suite