mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-05 15:13:02 +02:00
Joachim Wiberg
674fd6c396
Previously at least one end of a veth pair had to remain in the host namespace, because that end created and destroyed the pair. Assigning both ends to containers left no one to create it. Select a deterministic primary end so exactly one side creates the pair. When the primary is itself a container interface, create the pair in the host namespace before the container starts; CNI host-device then moves each end into its container. Teardown is deferred to the container removal script so the pair does not linger and block re-creation. Drop the now-obsolete limitation notes from the documentation and YANG, and add a regression test connecting two containers over a veth pair. Fixes: #941 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
102 lines
3.9 KiB
Python
Executable File
102 lines
3.9 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
r"""VETH Pair Between Two Containers
|
|
|
|
Verify that a VETH pair can connect two containers directly, with *both*
|
|
ends handed to containers and neither remaining in the host namespace.
|
|
|
|
....
|
|
.------------. .------------.
|
|
| left | | right |
|
|
| veth0a ===|========= veth ===========|=== veth0b |
|
|
'------------' 10.0.0.1 10.0.0.2 '------------'
|
|
....
|
|
|
|
The pair is created in the host namespace then each end is moved into
|
|
its container when starting up. Connectivity is verified by pinging
|
|
across the pair, from inside one container's network namespace to the
|
|
other end's address.
|
|
|
|
"""
|
|
|
|
import infamy
|
|
from infamy.util import until
|
|
|
|
# Regression test for #941: previously, when both ends of a pair were
|
|
# assigned to a container, neither side created the pair.
|
|
with infamy.Test() as test:
|
|
LEFT, IFACE_LEFT, IP_LEFT = "left", "veth0a", "10.0.0.1"
|
|
RIGHT, IFACE_RIGHT, IP_RIGHT = "right", "veth0b", "10.0.0.2"
|
|
IMAGE = f"oci-archive:{infamy.Container.HTTPD_IMAGE}"
|
|
|
|
with test.step("Set up topology and attach to target DUT"):
|
|
env = infamy.Env()
|
|
target = env.attach("target", "mgmt")
|
|
tgtssh = env.attach("target", "mgmt", "ssh")
|
|
|
|
if not target.has_model("infix-containers"):
|
|
test.skip()
|
|
|
|
with test.step("Create VETH pair with both ends assigned to containers"):
|
|
target.put_config_dicts({
|
|
"ietf-interfaces": {
|
|
"interfaces": {
|
|
"interface": [
|
|
{
|
|
"name": IFACE_LEFT,
|
|
"type": "infix-if-type:veth",
|
|
"enabled": True,
|
|
"infix-interfaces:veth": {"peer": IFACE_RIGHT},
|
|
"ipv4": {
|
|
"address": [{"ip": IP_LEFT, "prefix-length": 24}]
|
|
},
|
|
"container-network": {}
|
|
},
|
|
{
|
|
"name": IFACE_RIGHT,
|
|
"type": "infix-if-type:veth",
|
|
"enabled": True,
|
|
"infix-interfaces:veth": {"peer": IFACE_LEFT},
|
|
"ipv4": {
|
|
"address": [{"ip": IP_RIGHT, "prefix-length": 24}]
|
|
},
|
|
"container-network": {}
|
|
},
|
|
]
|
|
}
|
|
},
|
|
"infix-containers": {
|
|
"containers": {
|
|
"container": [
|
|
{
|
|
"name": LEFT,
|
|
"image": IMAGE,
|
|
"command": "/usr/sbin/httpd -f -v -p 91",
|
|
"network": {"interface": [{"name": IFACE_LEFT}]}
|
|
},
|
|
{
|
|
"name": RIGHT,
|
|
"image": IMAGE,
|
|
"command": "/usr/sbin/httpd -f -v -p 91",
|
|
"network": {"interface": [{"name": IFACE_RIGHT}]}
|
|
},
|
|
]
|
|
}
|
|
}
|
|
})
|
|
|
|
c = infamy.Container(target)
|
|
with test.step("Verify both containers have started"):
|
|
until(lambda: c.running(LEFT), attempts=60)
|
|
until(lambda: c.running(RIGHT), attempts=60)
|
|
|
|
with test.step(f"Verify {LEFT} reaches {RIGHT} over the internal VETH pair"):
|
|
pid = tgtssh.runsh(f"sudo podman inspect --format '{{{{.State.Pid}}}}' {LEFT}").stdout.strip()
|
|
assert pid.isdigit(), f"failed to get pid for container {LEFT}: {pid!r}"
|
|
|
|
def reachable():
|
|
return tgtssh.runsh(f"sudo nsenter -t {pid} -n ping -c 2 -w 5 {IP_RIGHT}").returncode == 0
|
|
|
|
until(reachable, attempts=30)
|
|
|
|
test.succeed()
|