GNU Wget 1.25.0 contains commit c419542d956a ("Fix CVE-2024-10524"),
which changed scheme-less URL handling. When it prepends http://, that
release prints a diagnostic directly to stderr. This bypasses the -o
log file used by these tests and makes checks which expect empty stderr
fail.Upstream changed the diagnostic to verbose logging five days later in commit d98df6621219. That fix is newer than the 1.25.0 release packaged by NixOS. The current OVN Ubuntu and Fedora CI images do not expose the problem: they use GNU Wget 1.21.4 and the Wget2 compatibility command, respectively. These inputs are HTTP URLs, so specify their scheme instead of relying on Wget to infer it. This also avoids depending on whether a particular Wget release reports the inference on stderr. Assisted-by: Codex gpt-5.6-sol high Signed-off-by: Ihar Hrachyshka <[email protected]> Acked-by: Han Zhou <[email protected]> --- tests/system-ovn.at | 68 ++++++++++++++++++++++----------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/tests/system-ovn.at b/tests/system-ovn.at index ae9c52afd..f9e69f264 100644 --- a/tests/system-ovn.at +++ b/tests/system-ovn.at @@ -1400,7 +1400,7 @@ check ovn-nbctl --wait=hv sync OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.1) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -1419,7 +1419,7 @@ dnl in 0.3% of cases, so run a few times. OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.1) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -1432,7 +1432,7 @@ dnl Should work with the virtual IP 30.0.0.3 address through NAT dnl Each server should have at least one connection. OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.3 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.3 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.3) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -1445,7 +1445,7 @@ dnl Test load-balancing that includes L4 ports in NAT. dnl Each server should have at least one connection. OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.2) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -1467,7 +1467,7 @@ dnl Test load-balancing that includes L4 ports in NAT. dnl Each server should have at least one connection. OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.2) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -1894,7 +1894,7 @@ dnl Test load-balancing that includes L4 ports in NAT. dnl Each server should have at least one connection. OVS_WAIT_FOR_OUTPUT([ for i in $(seq 1 20); do - NS_EXEC([foo1], [wget 30.0.0.1:8080 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([foo1], [wget http://30.0.0.1:8080 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.1) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -1929,7 +1929,7 @@ AT_CHECK([ovs-appctl dpctl/flush-conntrack]) # Each server should have at least one connection. OVS_WAIT_FOR_OUTPUT([ for i in $(seq 1 20); do - NS_EXEC([foo1], [wget 30.0.0.1:8080 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([foo1], [wget http://30.0.0.1:8080 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.1) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -2093,7 +2093,7 @@ OVS_START_L7([foo4], [http]) dnl Should work with the virtual IP address through NAT OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 10`; do - NS_EXEC([foo1], [wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([foo1], [wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -2107,7 +2107,7 @@ tcp,orig=(src=192.168.1.2,dst=30.0.0.1,sport=<cleared>,dport=<cleared>),reply=(s dnl Test load-balancing that includes L4 ports in NAT. OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 10`; do - NS_EXEC([foo1], [wget 30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([foo1], [wget http://30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -2347,7 +2347,7 @@ check ovs-appctl dpctl/flush-conntrack dnl Should work with the virtual IP address through NAT OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -2361,7 +2361,7 @@ check ovs-appctl dpctl/flush-conntrack OVS_WAIT_FOR_OUTPUT([ dnl Test load-balancing that includes L4 ports in NAT. for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -2410,7 +2410,7 @@ tcp,orig=(src=172.16.1.2,dst=192.168.2.2,sport=<cleared>,dport=<cleared>),reply= dnl Test load-balancing that includes L4 ports in NAT. OVS_WAIT_FOR_OUTPUT_UNQUOTED([ for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -2451,7 +2451,7 @@ tcp,orig=(src=172.16.1.2,dst=192.168.2.2,sport=<cleared>,dport=<cleared>),reply= OVS_WAIT_FOR_OUTPUT_UNQUOTED([ for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -2536,7 +2536,7 @@ check ovn-nbctl --wait=hv sync for i in $(seq 1 5); do echo Request $i - NS_CHECK_EXEC([client], [wget 172.16.1.100 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_CHECK_EXEC([client], [wget http://172.16.1.100 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done # Now send the traffic from client to the VIP - 172.16.1.150 @@ -2545,7 +2545,7 @@ check ovn-nbctl --wait=hv sync for i in $(seq 1 5); do echo Request $i - NS_CHECK_EXEC([client], [wget 172.16.1.150 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_CHECK_EXEC([client], [wget http://172.16.1.150 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done OVN_CLEANUP_CONTROLLER([hv1]) @@ -2851,7 +2851,7 @@ tcp,orig=(src=172.16.1.3,dst=192.168.2.2,sport=<cleared>,dport=<cleared>),reply= OVS_WAIT_FOR_OUTPUT_UNQUOTED([ for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -3227,7 +3227,7 @@ tcp,orig=(src=fd72::3,dst=fd12::2,sport=<cleared>,dport=<cleared>),reply=(src=fd OVS_WAIT_FOR_OUTPUT_UNQUOTED([ for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) NS_EXEC([alice16], [wget http://[[fd30::1]] -t 5 -T 1 --retry-connrefused -v -o wget${i}_6.log]) done @@ -3355,7 +3355,7 @@ OVS_START_L7([bar1], [http]) dnl Should work with the virtual IP address through NAT OVS_WAIT_FOR_OUTPUT_UNQUOTED([ for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 172.16.1.10 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://172.16.1.10 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -3368,7 +3368,7 @@ tcp,orig=(src=172.16.1.2,dst=172.16.1.10,sport=<cleared>,dport=<cleared>),reply= dnl Test load-balancing that includes L4 ports in NAT. OVS_WAIT_FOR_OUTPUT_UNQUOTED([ for i in `seq 1 10`; do - NS_EXEC([alice1], [wget 172.16.1.11:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([alice1], [wget http://172.16.1.11:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done dnl Each server should have at least one connection. @@ -4927,7 +4927,7 @@ OVS_WAIT_UNTIL( #dnl Each server should have at least one connection. OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 10`; do - NS_EXEC([sw0-p2], [wget 10.0.0.10 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_EXEC([sw0-p2], [wget http://10.0.0.10 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.0.0.10) | \ @@ -4952,7 +4952,7 @@ ovs-appctl dpctl/flush-conntrack # From sw0-p2 send traffic to vip - 10.0.0.10 for i in `seq 1 20`; do echo Request $i - NS_CHECK_EXEC([sw0-p2], [wget 10.0.0.10 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_CHECK_EXEC([sw0-p2], [wget http://10.0.0.10 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(10.0.0.10) | \ @@ -8546,7 +8546,7 @@ wait_for_ports_up # Start webservers in 'sw1-p1' OVS_START_L7([sw1p1], [http]) -AT_CHECK([ip netns exec sw0p1 wget 20.0.0.3 -t 3 -T 1], [0], [ignore], [ignore]) +AT_CHECK([ip netns exec sw0p1 wget http://20.0.0.3 -t 3 -T 1], [0], [ignore], [ignore]) # Clear the apply-after-lb option for the ACL check ovn-nbctl acl-del sw1 from-lport 1001 'inport == "sw1p1" && ip4' @@ -8554,7 +8554,7 @@ check ovn-nbctl acl-add sw1 from-lport 1001 'inport == "sw1p1" && ip4' drop check ovn-nbctl --wait=hv sync -AT_CHECK([ip netns exec sw0p1 wget 20.0.0.3 -t 3 -T 1], [0], [ignore], [ignore]) +AT_CHECK([ip netns exec sw0p1 wget http://20.0.0.3 -t 3 -T 1], [0], [ignore], [ignore]) OVN_CLEANUP_CONTROLLER([hv1]) @@ -10015,7 +10015,7 @@ zone_id=$(ovn-appctl -t ovn-controller ct-zone-list | grep foo1 | cut -d ' ' -f2 OVS_START_L7([bar1], [http]) -AT_CHECK([ip netns exec foo1 wget 192.168.2.2 -t 3 -T 1], [0], [ignore], [ignore]) +AT_CHECK([ip netns exec foo1 wget http://192.168.2.2 -t 3 -T 1], [0], [ignore], [ignore]) # check conntrack zone has tcp entry AT_CHECK([ovs-appctl dpctl/dump-conntrack zone=$zone_id | \ @@ -10027,7 +10027,7 @@ tcp,orig=(src=192.168.1.2,dst=192.168.2.2,sport=<cleared>,dport=<cleared>),reply AT_CHECK([ovs-appctl dpctl/flush-conntrack]) # now check with VIP -AT_CHECK([ip netns exec foo1 wget 30.30.30.30 -t 3 -T 1], [0], [ignore], [ignore]) +AT_CHECK([ip netns exec foo1 wget http://30.30.30.30 -t 3 -T 1], [0], [ignore], [ignore]) # check conntrack zone has tcp entry AT_CHECK([ovs-appctl dpctl/dump-conntrack zone=$zone_id | \ @@ -10045,7 +10045,7 @@ check ovn-nbctl ls-lb-del foo lb1 check ovn-nbctl acl-add foo from-lport 1 1 allow-stateless check ovn-nbctl --wait=hv acl-add foo to-lport 1 1 allow-stateless -AT_CHECK([ip netns exec foo1 wget 192.168.2.2 -t 3 -T 1], [0], [ignore], [ignore]) +AT_CHECK([ip netns exec foo1 wget http://192.168.2.2 -t 3 -T 1], [0], [ignore], [ignore]) # check conntrack zone has no tcp entry AT_CHECK([ovs-appctl dpctl/dump-conntrack zone=$zone_id | \ @@ -10546,13 +10546,13 @@ tcp,orig=(src=192.168.1.2,dst=30.0.0.1,sport=<cleared>,dport=<cleared>),reply=(s OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.1) | sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [LB1_CT_ENTRIES]) OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.2:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.2) | sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl tcp,orig=(src=192.168.1.2,dst=30.0.0.2,sport=<cleared>,dport=<cleared>),reply=(src=172.16.1.2,dst=192.168.1.2,sport=<cleared>,dport=<cleared>),zone=<cleared>,mark=2,protoinfo=(state=<cleared>) @@ -10562,7 +10562,7 @@ tcp,orig=(src=192.168.1.2,dst=30.0.0.2,sport=<cleared>,dport=<cleared>),reply=(s OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.3 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.3 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.3) | sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl tcp,orig=(src=192.168.1.2,dst=30.0.0.3,sport=<cleared>,dport=<cleared>),reply=(src=172.16.1.2,dst=192.168.1.2,sport=<cleared>,dport=<cleared>),zone=<cleared>,mark=2,protoinfo=(state=<cleared>) @@ -10629,7 +10629,7 @@ check ovn-nbctl ls-lb-add foo lb1 OVS_WAIT_FOR_OUTPUT([ for i in `seq 1 20`; do - ip netns exec foo1 wget 30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; + ip netns exec foo1 wget http://30.0.0.1 -t 5 -T 1 --retry-connrefused -v -o wget$i.log; done ovs-appctl dpctl/dump-conntrack | FORMAT_CT(30.0.0.1) | sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [LB1_CT_ENTRIES]) @@ -11893,7 +11893,7 @@ NS_CHECK_EXEC([ln], [ip route add 192.168.0.0/24 via 10.0.0.1]) OVS_START_L7([sw-vm1], [http]) -NS_CHECK_EXEC([ln], [wget 172.16.0.1 -t 5 -T 1 --retry-connrefused -v -o wget.log]) +NS_CHECK_EXEC([ln], [wget http://172.16.0.1 -t 5 -T 1 --retry-connrefused -v -o wget.log]) AT_CHECK([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(172.16.0.1) | \ sed -e 's/zone=[[0-9]]*/zone=<cleared>/'], [0], [dnl @@ -12037,7 +12037,7 @@ check ovn-nbctl --wait=hv sync for i in $(seq 1 5); do echo Request $i - NS_CHECK_EXEC([public-vm], [wget 172.16.1.150 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_CHECK_EXEC([public-vm], [wget http://172.16.1.150 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done OVS_WAIT_FOR_OUTPUT([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(172.16.1.150) | wc -l ], [0], [dnl @@ -12057,7 +12057,7 @@ check ovn-nbctl --wait=hv sync for i in $(seq 1 5); do echo Request $i - NS_CHECK_EXEC([public-vm], [wget 172.16.1.151 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_CHECK_EXEC([public-vm], [wget http://172.16.1.151 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done OVS_WAIT_FOR_OUTPUT([ovs-appctl dpctl/dump-conntrack | FORMAT_CT(172.16.1.151) | wc -l ], [0], [dnl @@ -17731,7 +17731,7 @@ NETNS_START_TCPDUMP([bar1], [-neei bar1 src 20.0.0.2 and tcp], [bar1]) check ovs-appctl dpctl/flush-conntrack for i in $(seq 20); do - NS_CHECK_EXEC([alice1], [wget 172.16.1.1:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) + NS_CHECK_EXEC([alice1], [wget http://172.16.1.1:8000 -t 5 -T 1 --retry-connrefused -v -o wget$i.log]) done OVS_WAIT_UNTIL([ -- 2.54.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
