Check supported DP features in initialization

pkg/agent/agent.go

@@ -41,7 +41,9 @@ import (
 	"antrea.io/antrea/pkg/agent/route"
 	"antrea.io/antrea/pkg/agent/types"
 	"antrea.io/antrea/pkg/agent/util"
+	"antrea.io/antrea/pkg/features"
 	"antrea.io/antrea/pkg/ovs/ovsconfig"
+	"antrea.io/antrea/pkg/ovs/ovsctl"
 	"antrea.io/antrea/pkg/util/env"
 	"antrea.io/antrea/pkg/util/k8s"
 )
@@ -129,6 +131,10 @@ func (i *Initializer) setupOVSBridge() error {
 		return err
 	}
 
+	if err := i.validateSupportedDPFeatures(); err != nil {
+		return err
+	}
+
 	if err := i.prepareOVSBridge(); err != nil {
 		return err
 	}
@@ -150,6 +156,35 @@ func (i *Initializer) setupOVSBridge() error {
 	return nil
 }
 
+func (i *Initializer) validateSupportedDPFeatures() error {
+	gotFeatures, err := ovsctl.NewClient(i.ovsBridge).GetDPFeatures()
+	if err != nil {
+		return err
+	}
+	// Basic requirements.
+	requiredFeatures := []ovsctl.DPFeature{
+		ovsctl.CTStateFeature,
+		ovsctl.CTZoneFeature,
+		ovsctl.CTMarkFeature,
+		ovsctl.CTLabelFeature,
+	}
+	// AntreaProxy requires CTStateNAT feature.
+	if features.DefaultFeatureGate.Enabled(features.AntreaProxy) {
+		requiredFeatures = append(requiredFeatures, ovsctl.CTStateNATFeature)
+	}
+
+	for _, feature := range requiredFeatures {
+		supported, found := gotFeatures[feature]
+		if !found {
+			return fmt.Errorf("the required OVS DP feature '%s' support is unknown", feature)
+		}
+		if !supported {
+			return fmt.Errorf("the required OVS DP feature '%s' is not supported", feature)
+		}
+	}
+	return nil
+}
+
 // initInterfaceStore initializes InterfaceStore with all OVS ports retrieved
 // from the OVS bridge.
 func (i *Initializer) initInterfaceStore() error {

pkg/ovs/ovsctl/appctl.go

@@ -15,10 +15,13 @@
 package ovsctl
 
 import (
+	"bufio"
 	"bytes"
 	"fmt"
 	"net"
 	"strings"
+
+	"k8s.io/klog/v2"
 )
 
 // Shell exits with 127 if the command to execute is not found.
@@ -33,12 +36,34 @@ var (
 	nonIPDLTypes = []string{"arp", "rarp", "dl_type="}
 )
 
+type DPFeature string
+
+const (
+	CTStateFeature    DPFeature = "CT state"
+	CTZoneFeature     DPFeature = "CT zone"
+	CTMarkFeature     DPFeature = "CT mark"
+	CTLabelFeature    DPFeature = "CT label"
+	CTStateNATFeature DPFeature = "CT state NAT"
+)
+
+var knownFeatures = map[DPFeature]struct{}{
+	CTStateFeature:    {},
+	CTZoneFeature:     {},
+	CTMarkFeature:     {},
+	CTLabelFeature:    {},
+	CTStateNATFeature: {},
+}
+
 type ovsCtlClient struct {
 	bridge string
+	// To allow injection for testing.
+	runAppCtl func(cmd string, needsBridge bool, args ...string) ([]byte, *ExecError)
 }
 
 func NewClient(bridge string) *ovsCtlClient {
-	return &ovsCtlClient{bridge}
+	client := &ovsCtlClient{bridge: bridge}
+	client.runAppCtl = client.RunAppctlCmd
+	return client
 }
 
 func newBadRequestError(msg string) BadRequestError {
@@ -138,7 +163,7 @@ func getNwDstKey(ip net.IP) (string, string) {
 }
 
 func (c *ovsCtlClient) runTracing(flow string) (string, error) {
-	out, execErr := c.RunAppctlCmd("ofproto/trace", true, flow)
+	out, execErr := c.runAppCtl("ofproto/trace", true, flow)
 	if execErr != nil {
 		return "", execErr
 	}
@@ -166,3 +191,39 @@ func (c *ovsCtlClient) RunAppctlCmd(cmd string, needsBridge bool, args ...string
 	}
 	return out, nil
 }
+
+func (c *ovsCtlClient) GetDPFeatures() (map[DPFeature]bool, error) {
+	cmd := "dpif/show-dp-features"
+	out, err := c.runAppCtl(cmd, true)
+	if err != nil {
+		return nil, fmt.Errorf("error listing DP features: %v", err)
+	}
+	scanner := bufio.NewScanner(strings.NewReader(string(out)))
+	scanner.Split(bufio.ScanLines)
+	features := map[DPFeature]bool{}
+	for scanner.Scan() {
+		line := scanner.Text()
+		fields := strings.Split(line, ":")
+		if len(fields) != 2 {
+			klog.InfoS("Unexpected output from dpif/show-dp-features", "line", line)
+			continue
+		}
+		feature := DPFeature(strings.TrimSpace(fields[0]))
+		_, known := knownFeatures[feature]
+		if !known {
+			continue
+		}
+		value := strings.TrimSpace(fields[1])
+		var supported bool
+		if value == "Yes" {
+			supported = true
+		} else if value == "No" {
+			supported = false
+		} else {
+			klog.InfoS("Unexpected non boolean value", "feature", feature, "value", value)
+			continue
+		}
+		features[feature] = supported
+	}
+	return features, nil
+}

pkg/ovs/ovsctl/appctl_test.go

@@ -0,0 +1,112 @@
+// Copyright 2021 Antrea Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ovsctl
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOvsCtlClientGetDPFeatures(t *testing.T) {
+	tests := []struct {
+		name   string
+		output string
+		want   map[DPFeature]bool
+	}{
+		{
+			name: "fully supported",
+			output: `Masked set action: Yes
+Tunnel push pop: No
+Ufid: Yes
+Truncate action: Yes
+Clone action: No
+Sample nesting: 10
+Conntrack eventmask: Yes
+Conntrack clear: Yes
+Max dp_hash algorithm: 0
+Check pkt length action: No
+Conntrack timeout policy: No
+Explicit Drop action: No
+Optimized Balance TCP mode: No
+Max VLAN headers: 2
+Max MPLS depth: 1
+Recirc: Yes
+CT state: Yes
+CT zone: Yes
+CT mark: Yes
+CT label: Yes
+CT state NAT: Yes
+CT orig tuple: Yes
+CT orig tuple for IPv6: Yes
+IPv6 ND Extension: No`,
+			want: map[DPFeature]bool{
+				CTStateFeature:    true,
+				CTZoneFeature:     true,
+				CTMarkFeature:     true,
+				CTLabelFeature:    true,
+				CTStateNATFeature: true,
+			},
+		},
+		{
+			name: "partially supported",
+			output: `Masked set action: Yes
+Tunnel push pop: No
+Ufid: Yes
+Truncate action: No
+Clone action: No
+Sample nesting: 3
+Conntrack eventmask: No
+Conntrack clear: No
+Max dp_hash algorithm: 0
+Check pkt length action: No
+Conntrack timeout policy: No
+Explicit Drop action: No
+Optimized Balance TCP mode: No
+Max VLAN headers: 1
+Max MPLS depth: 1
+Recirc: Yes
+CT state: Yes
+CT zone: Yes
+CT mark: Yes
+CT label: Yes
+CT state NAT: No
+CT orig tuple: No
+CT orig tuple for IPv6: No
+IPv6 ND Extension: No`,
+			want: map[DPFeature]bool{
+				CTStateFeature:    true,
+				CTZoneFeature:     true,
+				CTMarkFeature:     true,
+				CTLabelFeature:    true,
+				CTStateNATFeature: false,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &ovsCtlClient{
+				bridge: "br-int",
+				runAppCtl: func(cmd string, needsBridge bool, args ...string) ([]byte, *ExecError) {
+					return []byte(tt.output), nil
+				},
+			}
+			got, err := c.GetDPFeatures()
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

pkg/ovs/ovsctl/interface.go

@@ -54,6 +54,8 @@ type OVSCtlClient interface {
 	// RunAppctlCmd executes "ovs-appctl" command and returns the outputs.
 	// Some commands are bridge specific and some are not. Passing a bool to distinguish that.
 	RunAppctlCmd(cmd string, needsBridge bool, args ...string) ([]byte, *ExecError)
+	// GetDPFeatures executes "ovs-appctl dpif/show-dp-features" to check supported DP features.
+	GetDPFeatures() (map[DPFeature]bool, error)
 }
 
 type BadRequestError string