netdev - Re: [RFC PATCH net-next 00/12] selftests: forwarding: Add VRF-based tests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Jan 2018 13:14:56 -0700
From:   David Ahern <dsahern@...il.com>
To:     Ido Schimmel <idosch@...lanox.com>, netdev@...r.kernel.org,
        linux-kselftest@...r.kernel.org
Cc:     davem@...emloft.net, shuah@...nel.org, nikolay@...ulusnetworks.com,
        roopa@...ulusnetworks.com, andy@...yhouse.net, jiri@...lanox.com,
        mlxsw@...lanox.com, saeedm@...lanox.com, tariqt@...lanox.com,
        jhs@...atatu.com, lucasb@...atatu.com, f.fainelli@...il.com,
        vivien.didelot@...oirfairelinux.com, andrew@...n.ch,
        jakub.kicinski@...ronome.com, simon.horman@...ronome.com
Subject: Re: [RFC PATCH net-next 00/12] selftests: forwarding: Add VRF-based
 tests

On 1/15/18 12:18 PM, Ido Schimmel wrote:
> One of the nice things about network namespaces is that they allow one
> to easily create and test complex environments.
> 
> Unfortunately, these namespaces can not be used with actual switching
> ASICs, as their ports can not be migrated to other network namespaces
> (NETIF_F_NETNS_LOCAL) and most of them probably do not support the
> L1-separation provided by namespaces.
> 
> However, a similar kind of flexibility can be achieved by using VRFs and
> by looping the switch ports together. For example:
> 
>                              br0
>                               +
>                vrf-h1         |           vrf-h2
>                  +        +---+----+        +
>                  |        |        |        |
>     192.0.2.1/24 +        +        +        + 192.0.2.2/24
>                swp1     swp2     swp3     swp4
>                  +        +        +        +
>                  |        |        |        |
>                  +--------+        +--------+
> 
> The VRFs act as lightweight namespaces representing hosts connected to
> the switch.
> 
> This approach for testing switch ASICs has several advantages over the
> traditional method that requires multiple physical machines, to name a
> few:
> 
> 1. Only the device under test (DUT) is being tested without noise from
> other system.
> 
> 2. Ability to easily provision complex topologies. Testing bridging
> between 4-ports LAGs or 8-way ECMP requires many physical links that are
> not always available. With the VRF-based approach one merely needs to
> loopback more ports.
> 
> These tests are written with switch ASICs in mind, but they can be run
> on any Linux box using veth pairs to emulate physical loopbacks.
> 
> Feedback is is welcome. Particularly regarding the best location for
> these tests (e.g., current location, tools/testing/selftests/net).
> 

Awesome. Thanks for working on this.

A couple of feature requests:
1. an option to pause on any error to allow inspection of the setup

2. an option to configure the system and leave it in that state (ie,
don't trap exit and run cleanup). By extension, an option is needed to
do cleanup only.

This framework will be very useful.