mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-30 04:33:00 +02:00
Joachim Wiberg
ddc57ed6ae
When a veth pair has one end in a container and the other in the host
namespace, removing it failed: the container end's teardown deleted the
whole pair, so the host end's own delete then failed ("Cannot find
device") and aborted the teardown, leaving the interface behind.
The host-namespace delete added for the both-ends-in-container case was
emitted for every container veth end. Restrict it to the primary end,
which for a host/container pair is the host end that already deletes the
pair itself.
Extend the container veth tests to remove the pair and verify it is gone,
covering both the single-end (regression) and both-ends teardown paths.
Fixes: #1546
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
119 lines
4.7 KiB
Python
Executable File
119 lines
4.7 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
r"""VETH Pair Between Two Containers
|
|
|
|
Verify that a VETH pair can connect two containers directly, with *both*
|
|
ends handed to containers and neither remaining in the host namespace.
|
|
|
|
....
|
|
.------------. .------------.
|
|
| left | | right |
|
|
| veth0a ===|========= veth ===========|=== veth0b |
|
|
'------------' 10.0.0.1 10.0.0.2 '------------'
|
|
....
|
|
|
|
The pair is created in the host namespace then each end is moved into
|
|
its container when starting up. Connectivity is verified by pinging
|
|
across the pair, from inside one container's network namespace to the
|
|
other end's address.
|
|
|
|
"""
|
|
|
|
import infamy
|
|
from infamy.util import until
|
|
|
|
# Regression test for #941: previously, when both ends of a pair were
|
|
# assigned to a container, neither side created the pair.
|
|
with infamy.Test() as test:
|
|
LEFT, IFACE_LEFT, IP_LEFT = "left", "veth0a", "10.0.0.1"
|
|
RIGHT, IFACE_RIGHT, IP_RIGHT = "right", "veth0b", "10.0.0.2"
|
|
IMAGE = f"oci-archive:{infamy.Container.HTTPD_IMAGE}"
|
|
|
|
with test.step("Set up topology and attach to target DUT"):
|
|
env = infamy.Env()
|
|
target = env.attach("target", "mgmt")
|
|
tgtssh = env.attach("target", "mgmt", "ssh")
|
|
|
|
if not target.has_model("infix-containers"):
|
|
test.skip()
|
|
|
|
with test.step("Create VETH pair with both ends assigned to containers"):
|
|
target.put_config_dicts({
|
|
"ietf-interfaces": {
|
|
"interfaces": {
|
|
"interface": [
|
|
{
|
|
"name": IFACE_LEFT,
|
|
"type": "infix-if-type:veth",
|
|
"enabled": True,
|
|
"infix-interfaces:veth": {"peer": IFACE_RIGHT},
|
|
"ipv4": {
|
|
"address": [{"ip": IP_LEFT, "prefix-length": 24}]
|
|
},
|
|
"container-network": {}
|
|
},
|
|
{
|
|
"name": IFACE_RIGHT,
|
|
"type": "infix-if-type:veth",
|
|
"enabled": True,
|
|
"infix-interfaces:veth": {"peer": IFACE_LEFT},
|
|
"ipv4": {
|
|
"address": [{"ip": IP_RIGHT, "prefix-length": 24}]
|
|
},
|
|
"container-network": {}
|
|
},
|
|
]
|
|
}
|
|
},
|
|
"infix-containers": {
|
|
"containers": {
|
|
"container": [
|
|
{
|
|
"name": LEFT,
|
|
"image": IMAGE,
|
|
"command": "/usr/sbin/httpd -f -v -p 91",
|
|
"network": {"interface": [{"name": IFACE_LEFT}]}
|
|
},
|
|
{
|
|
"name": RIGHT,
|
|
"image": IMAGE,
|
|
"command": "/usr/sbin/httpd -f -v -p 91",
|
|
"network": {"interface": [{"name": IFACE_RIGHT}]}
|
|
},
|
|
]
|
|
}
|
|
}
|
|
})
|
|
|
|
c = infamy.Container(target)
|
|
with test.step("Verify both containers have started"):
|
|
until(lambda: c.running(LEFT), attempts=60)
|
|
until(lambda: c.running(RIGHT), attempts=60)
|
|
|
|
with test.step(f"Verify {LEFT} reaches {RIGHT} over the internal VETH pair"):
|
|
pid = tgtssh.runsh(f"sudo podman inspect --format '{{{{.State.Pid}}}}' {LEFT}").stdout.strip()
|
|
assert pid.isdigit(), f"failed to get pid for container {LEFT}: {pid!r}"
|
|
|
|
def reachable():
|
|
return tgtssh.runsh(f"sudo nsenter -t {pid} -n ping -c 2 -w 5 {IP_RIGHT}").returncode == 0
|
|
|
|
until(reachable, attempts=30)
|
|
|
|
with test.step("Remove containers and VETH pair, verify clean teardown"):
|
|
# Removing a pair with both ends in containers must tear it down
|
|
# cleanly, leaving nothing behind in the host namespace.
|
|
target.delete_xpaths([
|
|
f"/infix-containers:containers/container[name='{LEFT}']",
|
|
f"/infix-containers:containers/container[name='{RIGHT}']",
|
|
f"/ietf-interfaces:interfaces/interface[name='{IFACE_LEFT}']",
|
|
f"/ietf-interfaces:interfaces/interface[name='{IFACE_RIGHT}']",
|
|
])
|
|
|
|
def removed():
|
|
ifaces = target.get_data("/ietf-interfaces:interfaces")["interfaces"]["interface"]
|
|
names = [iface["name"] for iface in ifaces]
|
|
return IFACE_LEFT not in names and IFACE_RIGHT not in names
|
|
|
|
until(removed, attempts=30)
|
|
|
|
test.succeed()
|