188 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03 4MY_DIR=$(dirname $0)5# Details on the bpf prog6BPF_CGRP2_ARRAY_NAME='test_cgrp2_array_pin'7BPF_PROG="$MY_DIR/test_cgrp2_tc.bpf.o"8BPF_SECTION='filter'9 10[ -z "$TC" ] && TC='tc'11[ -z "$IP" ] && IP='ip'12 13# Names of the veth interface, net namespace...etc.14HOST_IFC='ve'15NS_IFC='vens'16NS='ns'17 18find_mnt() {19 cat /proc/mounts | \20 awk '{ if ($3 == "'$1'" && mnt == "") { mnt = $2 }} END { print mnt }'21}22 23# Init cgroup2 vars24init_cgrp2_vars() {25 CGRP2_ROOT=$(find_mnt cgroup2)26 if [ -z "$CGRP2_ROOT" ]27 then28 CGRP2_ROOT='/mnt/cgroup2'29 MOUNT_CGRP2="yes"30 fi31 CGRP2_TC="$CGRP2_ROOT/tc"32 CGRP2_TC_LEAF="$CGRP2_TC/leaf"33}34 35# Init bpf fs vars36init_bpf_fs_vars() {37 local bpf_fs_root=$(find_mnt bpf)38 [ -n "$bpf_fs_root" ] || return -139 BPF_FS_TC_SHARE="$bpf_fs_root/tc/globals"40}41 42setup_cgrp2() {43 case $1 in44 start)45 if [ "$MOUNT_CGRP2" == 'yes' ]46 then47 [ -d $CGRP2_ROOT ] || mkdir -p $CGRP2_ROOT48 mount -t cgroup2 none $CGRP2_ROOT || return $?49 fi50 mkdir -p $CGRP2_TC_LEAF51 ;;52 *)53 rmdir $CGRP2_TC_LEAF && rmdir $CGRP2_TC54 [ "$MOUNT_CGRP2" == 'yes' ] && umount $CGRP2_ROOT55 ;;56 esac57}58 59setup_bpf_cgrp2_array() {60 local bpf_cgrp2_array="$BPF_FS_TC_SHARE/$BPF_CGRP2_ARRAY_NAME"61 case $1 in62 start)63 $MY_DIR/test_cgrp2_array_pin -U $bpf_cgrp2_array -v $CGRP2_TC64 ;;65 *)66 [ -d "$BPF_FS_TC_SHARE" ] && rm -f $bpf_cgrp2_array67 ;;68 esac69}70 71setup_net() {72 case $1 in73 start)74 $IP link add $HOST_IFC type veth peer name $NS_IFC || return $?75 $IP link set dev $HOST_IFC up || return $?76 sysctl -q net.ipv6.conf.$HOST_IFC.disable_ipv6=077 sysctl -q net.ipv6.conf.$HOST_IFC.accept_dad=078 79 $IP netns add $NS || return $?80 $IP link set dev $NS_IFC netns $NS || return $?81 $IP -n $NS link set dev $NS_IFC up || return $?82 $IP netns exec $NS sysctl -q net.ipv6.conf.$NS_IFC.disable_ipv6=083 $IP netns exec $NS sysctl -q net.ipv6.conf.$NS_IFC.accept_dad=084 $TC qdisc add dev $HOST_IFC clsact || return $?85 $TC filter add dev $HOST_IFC egress bpf da obj $BPF_PROG sec $BPF_SECTION || return $?86 ;;87 *)88 $IP netns del $NS89 $IP link del $HOST_IFC90 ;;91 esac92}93 94run_in_cgrp() {95 # Fork another bash and move it under the specified cgroup.96 # It makes the cgroup cleanup easier at the end of the test.97 cmd='echo $$ > '98 cmd="$cmd $1/cgroup.procs; exec $2"99 bash -c "$cmd"100}101 102do_test() {103 run_in_cgrp $CGRP2_TC_LEAF "ping -6 -c3 ff02::1%$HOST_IFC >& /dev/null"104 local dropped=$($TC -s qdisc show dev $HOST_IFC | tail -3 | \105 awk '/drop/{print substr($7, 0, index($7, ",")-1)}')106 if [[ $dropped -eq 0 ]]107 then108 echo "FAIL"109 return 1110 else111 echo "Successfully filtered $dropped packets"112 return 0113 fi114}115 116do_exit() {117 if [ "$DEBUG" == "yes" ] && [ "$MODE" != 'cleanuponly' ]118 then119 echo "------ DEBUG ------"120 echo "mount: "; mount | grep -E '(cgroup2|bpf)'; echo121 echo "$CGRP2_TC_LEAF: "; ls -l $CGRP2_TC_LEAF; echo122 if [ -d "$BPF_FS_TC_SHARE" ]123 then124 echo "$BPF_FS_TC_SHARE: "; ls -l $BPF_FS_TC_SHARE; echo125 fi126 echo "Host net:"127 $IP netns128 $IP link show dev $HOST_IFC129 $IP -6 a show dev $HOST_IFC130 $TC -s qdisc show dev $HOST_IFC131 echo132 echo "$NS net:"133 $IP -n $NS link show dev $NS_IFC134 $IP -n $NS -6 link show dev $NS_IFC135 echo "------ DEBUG ------"136 echo137 fi138 139 if [ "$MODE" != 'nocleanup' ]140 then141 setup_net stop142 setup_bpf_cgrp2_array stop143 setup_cgrp2 stop144 fi145}146 147init_cgrp2_vars148init_bpf_fs_vars149 150while [[ $# -ge 1 ]]151do152 a="$1"153 case $a in154 debug)155 DEBUG='yes'156 shift 1157 ;;158 cleanup-only)159 MODE='cleanuponly'160 shift 1161 ;;162 no-cleanup)163 MODE='nocleanup'164 shift 1165 ;;166 *)167 echo "test_cgrp2_tc [debug] [cleanup-only | no-cleanup]"168 echo " debug: Print cgrp and network setup details at the end of the test"169 echo " cleanup-only: Try to cleanup things from last test. No test will be run"170 echo " no-cleanup: Run the test but don't do cleanup at the end"171 echo "[Note: If no arg is given, it will run the test and do cleanup at the end]"172 echo173 exit -1174 ;;175 esac176done177 178trap do_exit 0179 180[ "$MODE" == 'cleanuponly' ] && exit181 182setup_cgrp2 start || exit $?183setup_net start || exit $?184init_bpf_fs_vars || exit $?185setup_bpf_cgrp2_array start || exit $?186do_test187echo188