179 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# Load BPF flow dissector and verify it correctly dissects traffic5 6BPF_FILE="bpf_flow.bpf.o"7export TESTNAME=test_flow_dissector8unmount=09 10# Kselftest framework requirement - SKIP code is 4.11ksft_skip=412 13msg="skip all tests:"14if [ $UID != 0 ]; then15 echo $msg please run this as root >&216 exit $ksft_skip17fi18 19# This test needs to be run in a network namespace with in_netns.sh. Check if20# this is the case and run it with in_netns.sh if it is being run in the root21# namespace.22if [[ -z $(ip netns identify $$) ]]; then23 err=024 if bpftool="$(which bpftool)"; then25 echo "Testing global flow dissector..."26 27 $bpftool prog loadall $BPF_FILE /sys/fs/bpf/flow \28 type flow_dissector29 30 if ! unshare --net $bpftool prog attach pinned \31 /sys/fs/bpf/flow/_dissect flow_dissector; then32 echo "Unexpected unsuccessful attach in namespace" >&233 err=134 fi35 36 $bpftool prog attach pinned /sys/fs/bpf/flow/_dissect \37 flow_dissector38 39 if unshare --net $bpftool prog attach pinned \40 /sys/fs/bpf/flow/_dissect flow_dissector; then41 echo "Unexpected successful attach in namespace" >&242 err=143 fi44 45 if ! $bpftool prog detach pinned \46 /sys/fs/bpf/flow/_dissect flow_dissector; then47 echo "Failed to detach flow dissector" >&248 err=149 fi50 51 rm -rf /sys/fs/bpf/flow52 else53 echo "Skipping root flow dissector test, bpftool not found" >&254 fi55 56 # Run the rest of the tests in a net namespace.57 ../net/in_netns.sh "$0" "$@"58 err=$(( $err + $? ))59 60 if (( $err == 0 )); then61 echo "selftests: $TESTNAME [PASS]";62 else63 echo "selftests: $TESTNAME [FAILED]";64 fi65 66 exit $err67fi68 69# Determine selftest success via shell exit code70exit_handler()71{72 set +e73 74 # Cleanup75 tc filter del dev lo ingress pref 1337 2> /dev/null76 tc qdisc del dev lo ingress 2> /dev/null77 ./flow_dissector_load -d 2> /dev/null78 if [ $unmount -ne 0 ]; then79 umount bpffs 2> /dev/null80 fi81}82 83# Exit script immediately (well catched by trap handler) if any84# program/thing exits with a non-zero status.85set -e86 87# (Use 'trap -l' to list meaning of numbers)88trap exit_handler 0 2 3 6 989 90# Mount BPF file system91if /bin/mount | grep /sys/fs/bpf > /dev/null; then92 echo "bpffs already mounted"93else94 echo "bpffs not mounted. Mounting..."95 unmount=196 /bin/mount bpffs /sys/fs/bpf -t bpf97fi98 99# Attach BPF program100./flow_dissector_load -p $BPF_FILE -s _dissect101 102# Setup103tc qdisc add dev lo ingress104echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter105echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter106echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter107 108echo "Testing IPv4..."109# Drops all IP/UDP packets coming from port 9110tc filter add dev lo parent ffff: protocol ip pref 1337 flower ip_proto \111 udp src_port 9 action drop112 113# Send 10 IPv4/UDP packets from port 8. Filter should not drop any.114./test_flow_dissector -i 4 -f 8115# Send 10 IPv4/UDP packets from port 9. Filter should drop all.116./test_flow_dissector -i 4 -f 9 -F117# Send 10 IPv4/UDP packets from port 10. Filter should not drop any.118./test_flow_dissector -i 4 -f 10119 120echo "Testing IPv4 from 127.0.0.127 (fallback to generic dissector)..."121# Send 10 IPv4/UDP packets from port 8. Filter should not drop any.122./test_flow_dissector -i 4 -S 127.0.0.127 -f 8123# Send 10 IPv4/UDP packets from port 9. Filter should drop all.124./test_flow_dissector -i 4 -S 127.0.0.127 -f 9 -F125# Send 10 IPv4/UDP packets from port 10. Filter should not drop any.126./test_flow_dissector -i 4 -S 127.0.0.127 -f 10127 128echo "Testing IPIP..."129# Send 10 IPv4/IPv4/UDP packets from port 8. Filter should not drop any.130./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e bare -i 4 \131 -D 192.168.0.1 -S 1.1.1.1 -f 8132# Send 10 IPv4/IPv4/UDP packets from port 9. Filter should drop all.133./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e bare -i 4 \134 -D 192.168.0.1 -S 1.1.1.1 -f 9 -F135# Send 10 IPv4/IPv4/UDP packets from port 10. Filter should not drop any.136./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e bare -i 4 \137 -D 192.168.0.1 -S 1.1.1.1 -f 10138 139echo "Testing IPv4 + GRE..."140# Send 10 IPv4/GRE/IPv4/UDP packets from port 8. Filter should not drop any.141./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e gre -i 4 \142 -D 192.168.0.1 -S 1.1.1.1 -f 8143# Send 10 IPv4/GRE/IPv4/UDP packets from port 9. Filter should drop all.144./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e gre -i 4 \145 -D 192.168.0.1 -S 1.1.1.1 -f 9 -F146# Send 10 IPv4/GRE/IPv4/UDP packets from port 10. Filter should not drop any.147./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e gre -i 4 \148 -D 192.168.0.1 -S 1.1.1.1 -f 10149 150tc filter del dev lo ingress pref 1337151 152echo "Testing port range..."153# Drops all IP/UDP packets coming from port 8-10154tc filter add dev lo parent ffff: protocol ip pref 1337 flower ip_proto \155 udp src_port 8-10 action drop156 157# Send 10 IPv4/UDP packets from port 7. Filter should not drop any.158./test_flow_dissector -i 4 -f 7159# Send 10 IPv4/UDP packets from port 9. Filter should drop all.160./test_flow_dissector -i 4 -f 9 -F161# Send 10 IPv4/UDP packets from port 11. Filter should not drop any.162./test_flow_dissector -i 4 -f 11163 164tc filter del dev lo ingress pref 1337165 166echo "Testing IPv6..."167# Drops all IPv6/UDP packets coming from port 9168tc filter add dev lo parent ffff: protocol ipv6 pref 1337 flower ip_proto \169 udp src_port 9 action drop170 171# Send 10 IPv6/UDP packets from port 8. Filter should not drop any.172./test_flow_dissector -i 6 -f 8173# Send 10 IPv6/UDP packets from port 9. Filter should drop all.174./test_flow_dissector -i 6 -f 9 -F175# Send 10 IPv6/UDP packets from port 10. Filter should not drop any.176./test_flow_dissector -i 6 -f 10177 178exit 0179