As it turns out, the setup with a 802.1D bridge in combination with
VLAN uppers stacked on the bridge ports is not possible to support
on mv88e6xxx ports.
Enable VLAN filtering to ensure proper isolation of the locally
terminated VLANs.
This will fail on a system running a vanilla kernel, where the dut's
ports are backed by mv88e6xxx, because:
1. The ports are attached to the same bridge, and are thus in the same
PVT group.
2. Creation of the VLAN uppers causes the DSA layer to add both ports
to the same VTU entry.
As a result, hardware behaves as if both ports had been configured as
tagged members of VLAN 10, instead of just terminating incoming
traffic locally.
Add this test to catch hardware which behaves in this way.
- Verify that broadcast packets are also properly moved accross the
bridge, i.e. the broadcast packets sent from vlan interface VLAN10
do not reach VLAN20
Fixes#773
This patch adds latest symlinks to the curiOS containers to make system
upgrades easier. I.e., a user can now reference the bundled image with:
set image oci-archive:/lib/oci/curios-httpd-latest.tar.gz
So that when they upgrade to the latest Infix, which might include an
update of curiOS httpd, they will get a seamless upgrade also of the
container(s) running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is to workaround #807. To test automatic router id selection
a new test is required, which sets interfaces and activate ospf in
separete NETCONF/RESTCONF query.
Initially done as a workaround for the MACVLAN create/remove race. But
even though the old version of this test now works, this refactor
provides better test step descriptions, making it easier to follow for
anyone looking to manually verify the functionality.
This is a specialized namespace, containing two ports,
which (hopefully) acts as completely transparent "bump-on-the-wire"
bridge.
Useful in scenarios where you want to test what happens when the flow
of packets between two nodes is disrupted. E.g., for testing fail-over
behavior in dynamic routing protocols, L2 redundancy, VRRP etc.
Now that we're using the `passthru` mode of MACVLANs, it seems we can
rely on the parent interface's promiscuity going down to 0 as an
indication that the kernel has completed the removal of the interface,
and will accept the creation of a new one.
When used as a context manager, __exit__ will be called even though
__enter__ might throw an exception half way through. So there is no
guarantee that the instance is on the cleanup list when we get to
stop().
This mode let's us receive all packets from the parent device, which
is automatically set in promiscuous mode, and let's the MACVLAN
transmit packets with any SA, which we need to implement a TPMR (or a
bridge or anything else we might dream up)
This is needed to create namespaces with MACVLANs from different
parent interfaces. The first consumer will be a Two-Port Mac
Relay (TPMR), so that we can control the flow of packets between two
nodes.
Story time:
In the days of yore, we generated PCAPs using tcpdump, which will
flush any buffered packets to its output file on reception of
SIGUSR2. Therefore we sent a USR2 before terminating the capture.
At some point, we switched over to use tshark to capture packets for
us, but the SIGUSR2 sayed in place.
It turns out, tshark will just die on USR2, abandoning the dumpcap
child it has created, which means the enclosing network namespace
can't be properly torn down.
Therefore:
Remove skip sending USR2 and just send TERM directly.
Make show interfaces container aware. This is done by looking though
all podman containers for interfaces and looking up there info from
network namespaces on the main system / hypervisor.
Interfaces controlled by containers are clearly marked in the "show
interfaces" output, with a single gray row. Telling the user that they
belong to one or more named containers. The user can then run "show
interface name NAME" on interfaces owned by containers, which provided
some additional info, such as mac address and stat counters.
The patch also add support for printing veth peers which are owned by
containers.
Lastly, the patch also adds test cases for this functionality.
Signed-off-by: Richard Alpe <richard@bit42.se>
This will facilitate running infix tests from external projects:
- eliminate the need for an external topology.dot.in file
- eliminate the requirement to manually provide external image name
Fixes#763
SVG is a plain text file, better to see why it changed
than binary PNG. Also fix#744 by adding infix/OEM hash
to test specification
Signed-off-by: Mattias Walström <lazzer@gmail.com>
