363 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03 4ALL_TESTS="gact_drop_and_ok_test mirred_egress_redirect_test \5 mirred_egress_mirror_test matchall_mirred_egress_mirror_test \6 gact_trap_test mirred_egress_to_ingress_test \7 mirred_egress_to_ingress_tcp_test \8 ingress_2nd_vlan_push egress_2nd_vlan_push"9NUM_NETIFS=410source tc_common.sh11source lib.sh12 13require_command ncat14 15tcflags="skip_hw"16 17h1_create()18{19 simple_if_init $h1 192.0.2.1/2420 tc qdisc add dev $h1 clsact21}22 23h1_destroy()24{25 tc qdisc del dev $h1 clsact26 simple_if_fini $h1 192.0.2.1/2427}28 29h2_create()30{31 simple_if_init $h2 192.0.2.2/2432 tc qdisc add dev $h2 clsact33}34 35h2_destroy()36{37 tc qdisc del dev $h2 clsact38 simple_if_fini $h2 192.0.2.2/2439}40 41switch_create()42{43 simple_if_init $swp1 192.0.2.2/2444 tc qdisc add dev $swp1 clsact45 46 simple_if_init $swp2 192.0.2.1/2447}48 49switch_destroy()50{51 simple_if_fini $swp2 192.0.2.1/2452 53 tc qdisc del dev $swp1 clsact54 simple_if_fini $swp1 192.0.2.2/2455}56 57mirred_egress_test()58{59 local action=$160 local protocol=$261 local classifier=$362 local classifier_args=$463 64 RET=065 66 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \67 dst_ip 192.0.2.2 action drop68 69 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \70 -t ip -q71 72 tc_check_packets "dev $h2 ingress" 101 173 check_fail $? "Matched without redirect rule inserted"74 75 tc filter add dev $swp1 ingress protocol $protocol pref 1 handle 101 \76 $classifier $tcflags $classifier_args \77 action mirred egress $action dev $swp278 79 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \80 -t ip -q81 82 tc_check_packets "dev $h2 ingress" 101 183 check_err $? "Did not match incoming $action packet"84 85 tc filter del dev $swp1 ingress protocol $protocol pref 1 handle 101 \86 $classifier87 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower88 89 log_test "mirred egress $classifier $action ($tcflags)"90}91 92gact_drop_and_ok_test()93{94 RET=095 96 tc filter add dev $swp1 ingress protocol ip pref 2 handle 102 flower \97 $tcflags dst_ip 192.0.2.2 action drop98 99 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \100 -t ip -q101 102 tc_check_packets "dev $swp1 ingress" 102 1103 check_err $? "Packet was not dropped"104 105 tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \106 $tcflags dst_ip 192.0.2.2 action ok107 108 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \109 -t ip -q110 111 tc_check_packets "dev $swp1 ingress" 101 1112 check_err $? "Did not see passed packet"113 114 tc_check_packets "dev $swp1 ingress" 102 2115 check_fail $? "Packet was dropped and it should not reach here"116 117 tc filter del dev $swp1 ingress protocol ip pref 2 handle 102 flower118 tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower119 120 log_test "gact drop and ok ($tcflags)"121}122 123gact_trap_test()124{125 RET=0126 127 if [[ "$tcflags" != "skip_sw" ]]; then128 return 0;129 fi130 131 tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \132 skip_hw dst_ip 192.0.2.2 action drop133 tc filter add dev $swp1 ingress protocol ip pref 3 handle 103 flower \134 $tcflags dst_ip 192.0.2.2 action mirred egress redirect \135 dev $swp2136 137 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \138 -t ip -q139 140 tc_check_packets "dev $swp1 ingress" 101 1141 check_fail $? "Saw packet without trap rule inserted"142 143 tc filter add dev $swp1 ingress protocol ip pref 2 handle 102 flower \144 $tcflags dst_ip 192.0.2.2 action trap145 146 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \147 -t ip -q148 149 tc_check_packets "dev $swp1 ingress" 102 1150 check_err $? "Packet was not trapped"151 152 tc_check_packets "dev $swp1 ingress" 101 1153 check_err $? "Did not see trapped packet"154 155 tc filter del dev $swp1 ingress protocol ip pref 3 handle 103 flower156 tc filter del dev $swp1 ingress protocol ip pref 2 handle 102 flower157 tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower158 159 log_test "trap ($tcflags)"160}161 162mirred_egress_to_ingress_test()163{164 RET=0165 166 tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \167 ip_proto icmp src_ip 192.0.2.1 dst_ip 192.0.2.2 type 8 action \168 ct commit nat src addr 192.0.2.2 pipe \169 ct clear pipe \170 ct commit nat dst addr 192.0.2.1 pipe \171 mirred ingress redirect dev $h1172 173 tc filter add dev $swp1 protocol ip pref 11 handle 111 ingress flower \174 ip_proto icmp src_ip 192.0.2.1 dst_ip 192.0.2.2 type 8 action drop175 tc filter add dev $swp1 protocol ip pref 12 handle 112 ingress flower \176 ip_proto icmp src_ip 192.0.2.1 dst_ip 192.0.2.2 type 0 action pass177 178 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \179 -t icmp "ping,id=42,seq=10" -q180 181 tc_check_packets "dev $h1 egress" 100 1182 check_err $? "didn't mirror first packet"183 184 tc_check_packets "dev $swp1 ingress" 111 1185 check_fail $? "didn't redirect first packet"186 tc_check_packets "dev $swp1 ingress" 112 1187 check_err $? "didn't receive reply to first packet"188 189 ping 192.0.2.2 -I$h1 -c1 -w1 -q 1>/dev/null 2>&1190 191 tc_check_packets "dev $h1 egress" 100 2192 check_err $? "didn't mirror second packet"193 tc_check_packets "dev $swp1 ingress" 111 1194 check_fail $? "didn't redirect second packet"195 tc_check_packets "dev $swp1 ingress" 112 2196 check_err $? "didn't receive reply to second packet"197 198 tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower199 tc filter del dev $swp1 ingress protocol ip pref 11 handle 111 flower200 tc filter del dev $swp1 ingress protocol ip pref 12 handle 112 flower201 202 log_test "mirred_egress_to_ingress ($tcflags)"203}204 205mirred_egress_to_ingress_tcp_test()206{207 mirred_e2i_tf1=$(mktemp) mirred_e2i_tf2=$(mktemp)208 209 RET=0210 dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$mirred_e2i_tf1211 tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \212 $tcflags ip_proto tcp src_ip 192.0.2.1 dst_ip 192.0.2.2 \213 action ct commit nat src addr 192.0.2.2 pipe \214 action ct clear pipe \215 action ct commit nat dst addr 192.0.2.1 pipe \216 action ct clear pipe \217 action skbedit ptype host pipe \218 action mirred ingress redirect dev $h1219 tc filter add dev $h1 protocol ip pref 101 handle 101 egress flower \220 $tcflags ip_proto icmp \221 action mirred ingress redirect dev $h1222 tc filter add dev $h1 protocol ip pref 102 handle 102 ingress flower \223 ip_proto icmp \224 action drop225 226 ip vrf exec v$h1 ncat --recv-only -w10 -l -p 12345 -o $mirred_e2i_tf2 &227 local rpid=$!228 ip vrf exec v$h1 ncat -w1 --send-only 192.0.2.2 12345 <$mirred_e2i_tf1229 wait -n $rpid230 cmp -s $mirred_e2i_tf1 $mirred_e2i_tf2231 check_err $? "server output check failed"232 233 $MZ $h1 -c 10 -p 64 -a $h1mac -b $h1mac -A 192.0.2.1 -B 192.0.2.1 \234 -t icmp "ping,id=42,seq=5" -q235 tc_check_packets "dev $h1 egress" 101 10236 check_err $? "didn't mirred redirect ICMP"237 tc_check_packets "dev $h1 ingress" 102 10238 check_err $? "didn't drop mirred ICMP"239 240 tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower241 tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower242 tc filter del dev $h1 ingress protocol ip pref 102 handle 102 flower243 244 rm -f $mirred_e2i_tf1 $mirred_e2i_tf2245 log_test "mirred_egress_to_ingress_tcp ($tcflags)"246}247 248ingress_2nd_vlan_push()249{250 tc filter add dev $swp1 ingress pref 20 chain 0 handle 20 flower \251 $tcflags num_of_vlans 1 \252 action vlan push id 100 protocol 0x8100 action goto chain 5253 tc filter add dev $swp1 ingress pref 30 chain 5 handle 30 flower \254 $tcflags num_of_vlans 2 \255 cvlan_ethtype 0x800 action pass256 257 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \258 -t ip -Q 10 -q259 260 tc_check_packets "dev $swp1 ingress" 30 1261 check_err $? "No double-vlan packets received"262 263 tc filter del dev $swp1 ingress pref 20 chain 0 handle 20 flower264 tc filter del dev $swp1 ingress pref 30 chain 5 handle 30 flower265 266 log_test "ingress_2nd_vlan_push ($tcflags)"267}268 269egress_2nd_vlan_push()270{271 tc filter add dev $h1 egress pref 20 chain 0 handle 20 flower \272 $tcflags num_of_vlans 0 \273 action vlan push id 10 protocol 0x8100 \274 pipe action vlan push id 100 protocol 0x8100 action goto chain 5275 tc filter add dev $h1 egress pref 30 chain 5 handle 30 flower \276 $tcflags num_of_vlans 2 \277 cvlan_ethtype 0x800 action pass278 279 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \280 -t ip -q281 282 tc_check_packets "dev $h1 egress" 30 1283 check_err $? "No double-vlan packets received"284 285 tc filter del dev $h1 egress pref 20 chain 0 handle 20 flower286 tc filter del dev $h1 egress pref 30 chain 5 handle 30 flower287 288 log_test "egress_2nd_vlan_push ($tcflags)"289}290 291setup_prepare()292{293 h1=${NETIFS[p1]}294 swp1=${NETIFS[p2]}295 296 swp2=${NETIFS[p3]}297 h2=${NETIFS[p4]}298 299 h1mac=$(mac_get $h1)300 h2mac=$(mac_get $h2)301 302 swp1origmac=$(mac_get $swp1)303 swp2origmac=$(mac_get $swp2)304 ip link set $swp1 address $h2mac305 ip link set $swp2 address $h1mac306 307 vrf_prepare308 309 h1_create310 h2_create311 switch_create312}313 314cleanup()315{316 local tf317 318 pre_cleanup319 320 switch_destroy321 h2_destroy322 h1_destroy323 324 vrf_cleanup325 326 ip link set $swp2 address $swp2origmac327 ip link set $swp1 address $swp1origmac328 329 for tf in $mirred_e2i_tf1 $mirred_e2i_tf2; do rm -f $tf; done330}331 332mirred_egress_redirect_test()333{334 mirred_egress_test "redirect" "ip" "flower" "dst_ip 192.0.2.2"335}336 337mirred_egress_mirror_test()338{339 mirred_egress_test "mirror" "ip" "flower" "dst_ip 192.0.2.2"340}341 342matchall_mirred_egress_mirror_test()343{344 mirred_egress_test "mirror" "all" "matchall" ""345}346 347trap cleanup EXIT348 349setup_prepare350setup_wait351 352tests_run353 354tc_offload_check355if [[ $? -ne 0 ]]; then356 log_info "Could not test offloaded functionality"357else358 tcflags="skip_sw"359 tests_run360fi361 362exit $EXIT_STATUS363