Acked-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Mark Michelson <mmichels@redhat.com>

There are some bugs in the netcat-openbsd version shipped with Ubuntu
20.04.  Switch to nmap-ncat to avoid system tests that will be added
by upcoming commits fail in CI.

One example:

1. Start a TCP connection from IP1:port-x to IP2:port-y.
2. Start a TCP connection from IP1:port-x to IP3:port-z.

netcat-openbsd fails with:
  nc: bind failed: Address already in use

Acked-by: Mark D. Gray <mark.d.gray@redhat.com>
Signed-off-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
(cherry picked from commit f6bd743c)

br-int and br-ex are patched together by ovn-controller.  They must have
the same datapath type.  I.e., it won't work if br-int uses the netdev
(userspace) datapath and br-ext uses the system (kernel) datapath;
system is the default.  This ensures the datapath type is properly set
for the br-ext bridge.

a8362ff8

 ("northd: Fix the missing force_snat_for_lb flows when router_ip is configured.")
Acked-by: Mark D. Gray <mark.d.gray@redhat.com>
Signed-off-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
(cherry picked from commit c3339514)

Bump the OVS submodule to include the following patches:
  dd0f59783e39 ("ofproto: Fix potential NULL dereference in ofproto_get_datapath_cap().")
  a4b04276ab59 ("ofproto: Fix potential NULL dereference in ofproto_ct_*_zone_timeout_policy().")

The two commits above fix crashes in ovs-vswitchd when OVS datapath
types are configured with unsupported values and OVSDB Datapath tables
exist for those datapath types.  OVN self tests actually test with
invalid datapath types and an upcoming commit will update the
ovn-controller code to always create OVSDB Datapath tables.  Without
the two OVS fixes, ovs-vswitchd would crash, causing the OVN tests to
fail.

Acked-by: Mark D. Gray <mark.d.gray@redhat.com>
Signed-off-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
(cherry picked from commit 4f70bacc)

Signed-off-by: Vladislav Odintsov <odivlad@gmail.com>
Acked-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
(cherry picked from commit aedf54c4)

Before this patch ovn-controller-vtep created Mcast_Macs_Remote
record for each Port Binding in the ovn Logical Switch, to which
vtep Logical Switch was attached.
With this patch there is only one Mcast_Macs_Remote record per datapath.
Physical Locator set is created every time when physical locators for
associated datapath are changed. Next, this newly-created physical
locator set is updated in the MMR record.

Signed-off-by: Vladislav Odintsov <odivlad@gmail.com>
Acked-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
(cherry picked from commit 8d950009)

There's no need to allocate a logical flow structure if we're going to
merge it to an existing one that refers to a datapath group.

This saves a lot of xstrdup() calls followed immediately by free().

Reported-at: https://bugzilla.redhat.com/1962818


Signed-off-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
(cherry picked from commit d299a255)

This is benign but AddressSanitizer was complaining about it:

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7fa93cd6d667 in __interceptor_malloc (/lib64/libasan.so.6+0xb0667)
    #1 0x1be8d3e in xmalloc__ lib/util.c:137
    #2 0x1be8e1a in xmalloc lib/util.c:172
    #3 0x1b799d3 in json_create lib/json.c:1451
    #4 0x1b74314 in json_integer_create lib/json.c:263
    #5 0x1b7d38a in jsonrpc_create_id lib/jsonrpc.c:563
    #6 0x1b7d3a5 in jsonrpc_create_request lib/jsonrpc.c:570
    #7 0x1b8d851 in ovsdb_cs_send_transaction lib/ovsdb-cs.c:1376
    #8 0x40b017 in northd_send_output_only_data_request northd/ovn-northd-ddlog.c:290
    #9 0x40c802 in northd_run northd/ovn-northd-ddlog.c:568
    #10 0x410225 in main northd/ovn-northd-ddlog.c:1289
    #11 0x7fa93c4a9081 in __libc_start_main ../csu/libc-start.c:308

Signed-off-by: Dumitru Ceara <dceara@redhat.com>
Acked-by: Ben Pfaff <blp@ovn.org>

Much like the 4 HV, 1 LS, 1 LR test, this one was also having issues
where the pcap file would not be reset before attempting to capture
packets. Therefore, the pcap file would be reset after having captured
packets we were expecting to see.

Therefore, this patch does similarly to 879ebc8c

, in that it adds the
following:
* Ensure that pcap file is reset before continuing
* Ensure that HA flows are installed before testing packets.

Signed-off-by: Mark Michelson <mmichels@redhat.com>
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1941061


Acked-by: Ben Pfaff <blp@ovn.org>

Add some checking to "4 HV, 3 LS, 2 LR, packet test with HA distributed
router gateway port".

Signed-off-by: Mark Michelson <mmichels@redhat.com>
Acked-by: Ben Pfaff <blp@ovn.org>

The test fails quite often for ddlog because of tunnel keys mismatch when
checking OpenFlow dumps. It is possible to allocate different keys in
different runs because multiple NB changes can be handled by northd in a
single iteration - it fails more often in ddlog probably because there
is some more latency for northd-ddlog to start processing the changes,
but it doesn't affect correctness. So this patch fixes it by ignoring
the tunnel keys when comparing the flows.

Acked-by: Mark Michelson <mmichels@redhat.com>
Signed-off-by: Han Zhou <hzhou@ovn.org>

The test case fails quite often because of timing. When nb_cfg_timestamp
is updated in SB DB it may not be updated immediately in NB's
hv_cfg_timestamp. This patch use "wait_column" to wait.

Acked-by: Mark Michelson <mmichels@redhat.com>
Signed-off-by: Han Zhou <hzhou@ovn.org>

This test fails for ovn-northd-ddlog because of the RBAC role when using
the SSL connection. RBAC is not the purpose of the test case, so this
patch fixes it without enabling RBAC.

Acked-by: Mark Michelson <mmichels@redhat.com>
Signed-off-by: Han Zhou <hzhou@ovn.org>

'iface->id' is NULL at this point, so the message is always the same:

   "Interface (null) create."

Fixes: 5c337192

 ("if-status: Add OVS interface status management module.")
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Mark Michelson <mmichels@redhat.com>

When SB port-group (per DP) is deleted and added back and the
notification to ovn-controller include both operations in a reversed
order, the current change handler in ovn-controller would end up
deleting the SB port-group in the local cache, which in turn result in
missing flows, and even worse it can result in crash if runtime data
handler is triggered later because we asserts the SB PG should be
equivalent to the local cache.

This patch fixes it by always handling deletion for tracked PG changes,
just like how we are handling other tracked changes in I-P (e.g.
logical_flow). A test case is crafted to cover such scenario.

Fixes: 0cfeba6b

 ("ovn-controller: Fix port group conjunction flow explosion problem.")
Acked-by: Mark Michelson <mmichels@redhat.com>
Signed-off-by: Han Zhou <hzhou@ovn.org>

It's complex and probably impossible to split returning traffic for
allow-related ACLs from stateless traffic, we don't fully implement
ACL priority for allow-stateless rules. Meaning, allow-stateless rules
always take precedence over stateful rules regardless of their
relative priority order.

This patch documents this behavior and covers it with explicit test
cases.

Signed-off-by: Ihar Hrachyshka <ihrachys@redhat.com>
Signed-off-by: Han Zhou <hzhou@ovn.org>

Utilities like ovn-sbctl sometimes need to retry their transactions
because of races.  For this reason, instead of sending user output
directly to stdout, they buffer it until the transaction succeeds.
Some of the ovn-sbctl commands didn't do this properly, so they would
output multiple times upon a race.  Another way to see the problem
was to use daemon mode, in which the output written directly with
printf() would not appear at all, since the daemon's stdout is not
connected to ovn-sbctl's stdout.

Signed-off-by: Ben Pfaff <blp@ovn.org>
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1965780


Reported-by: Alexey Roytman <aroytman@redhat.com>
Acked-by: Numan Siddique <numans@ovn.org>

Signed-off-by: Mark Michelson <mmichels@redhat.com>

Signed-off-by: Mark Michelson <mmichels@redhat.com>

In Autotest, [xyz] just expands to xyz.  To get [xyz] in output, we
need [[xyz]] in input.

I spotted this based on "expr" reporting an error in testsuite output.

Signed-off-by: Ben Pfaff <blp@ovn.org>

The "(northbound|southbound) database reconnection" tests had
dp-groups=yes variants but they were unconditionally skipped at runtime.
There's no point in having them, so this commit drops them.

This changes the changes of the tests without datapath groups to have
"dp-groups=no" in their names.  That seems like an OK change to me,
but it can easily be reverted if people don't like it.

Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Dumitru Ceara <dceara@redhat.com>

By being able to start up ovn-northd-ddlog in a paused state, we can
produce a recording for use in debugging without having to restart one
of the real ovn-northd-ddlog processes or disturbing the system.

Signed-off-by: Ben Pfaff <blp@ovn.org>
CC: Ihar Hrachyshka <ihrachys@redhat.com>
Acked-by: Dumitru Ceara <dceara@redhat.com>

Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Dumitru Ceara <dceara@redhat.com>

When setting monitor conditions ovsdb_cs_db_set_condition() returns the
sequence number when it is expected that all updates that correspond to
the new condition have been received.  This sequence number is used by
ovn-controller to determine whether a monitor condition change is
already in flight.  If that's the case ovn-controller waits until all
in-flight condition changes have been processed before propagating the
SB_Global.nb_cfg value to the chassis record.

This is part of the "ovn-nbctl --wait=hv sync" implementation which, as
far as I know, is not used actively by any CMS but is, however, used by
OVN self tests.

Bump the OVS submodule version to include b5bb044fbe4c ("ovsdb-cs:
Consider all tables when computing expected cond seqno.") which fixes a
bug in ovsdb_cs_db_set_condition().  Without it, the returned expected
sequence number was wrong, leading to occasional test failures in the
OVN test suite.

Signed-off-by: Dumitru Ceara <dceara@redhat.com>
Acked-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Numan Siddique <numans@ovn.org>