206 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03 4ALL_TESTS="unreachable_chain_test gact_goto_chain_test create_destroy_chain \5 template_filter_fits"6NUM_NETIFS=27source tc_common.sh8source lib.sh9 10tcflags="skip_hw"11 12h1_create()13{14 simple_if_init $h1 192.0.2.1/2415}16 17h1_destroy()18{19 simple_if_fini $h1 192.0.2.1/2420}21 22h2_create()23{24 simple_if_init $h2 192.0.2.2/2425 tc qdisc add dev $h2 clsact26}27 28h2_destroy()29{30 tc qdisc del dev $h2 clsact31 simple_if_fini $h2 192.0.2.2/2432}33 34unreachable_chain_test()35{36 RET=037 38 tc filter add dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \39 flower $tcflags dst_mac $h2mac action drop40 41 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \42 -t ip -q43 44 tc_check_packets "dev $h2 ingress" 1101 145 check_fail $? "matched on filter in unreachable chain"46 47 tc filter del dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \48 flower49 50 log_test "unreachable chain ($tcflags)"51}52 53gact_goto_chain_test()54{55 RET=056 57 tc filter add dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \58 flower $tcflags dst_mac $h2mac action drop59 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \60 $tcflags dst_mac $h2mac action drop61 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \62 $tcflags dst_mac $h2mac action goto chain 163 64 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \65 -t ip -q66 67 tc_check_packets "dev $h2 ingress" 102 168 check_fail $? "Matched on a wrong filter"69 70 tc_check_packets "dev $h2 ingress" 101 171 check_err $? "Did not match on correct filter with goto chain action"72 73 tc_check_packets "dev $h2 ingress" 1101 174 check_err $? "Did not match on correct filter in chain 1"75 76 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower77 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower78 tc filter del dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \79 flower80 81 log_test "gact goto chain ($tcflags)"82}83 84create_destroy_chain()85{86 RET=087 88 tc chain add dev $h2 ingress89 check_err $? "Failed to create default chain"90 91 output="$(tc -j chain get dev $h2 ingress)"92 check_err $? "Failed to get default chain"93 94 echo $output | jq -e ".[] | select(.chain == 0)" &> /dev/null95 check_err $? "Unexpected output for default chain"96 97 tc chain add dev $h2 ingress chain 198 check_err $? "Failed to create chain 1"99 100 output="$(tc -j chain get dev $h2 ingress chain 1)"101 check_err $? "Failed to get chain 1"102 103 echo $output | jq -e ".[] | select(.chain == 1)" &> /dev/null104 check_err $? "Unexpected output for chain 1"105 106 output="$(tc -j chain show dev $h2 ingress)"107 check_err $? "Failed to dump chains"108 109 echo $output | jq -e ".[] | select(.chain == 0)" &> /dev/null110 check_err $? "Can't find default chain in dump"111 112 echo $output | jq -e ".[] | select(.chain == 1)" &> /dev/null113 check_err $? "Can't find chain 1 in dump"114 115 tc chain del dev $h2 ingress116 check_err $? "Failed to destroy default chain"117 118 tc chain del dev $h2 ingress chain 1119 check_err $? "Failed to destroy chain 1"120 121 log_test "create destroy chain"122}123 124template_filter_fits()125{126 RET=0127 128 tc chain add dev $h2 ingress protocol ip \129 flower dst_mac 00:00:00:00:00:00/FF:FF:FF:FF:FF:FF &> /dev/null130 tc chain add dev $h2 ingress chain 1 protocol ip \131 flower src_mac 00:00:00:00:00:00/FF:FF:FF:FF:FF:FF &> /dev/null132 133 tc filter add dev $h2 ingress protocol ip pref 1 handle 1101 \134 flower dst_mac $h2mac action drop135 check_err $? "Failed to insert filter which fits template"136 137 tc filter add dev $h2 ingress protocol ip pref 1 handle 1102 \138 flower src_mac $h2mac action drop &> /dev/null139 check_fail $? "Incorrectly succeeded to insert filter which does not template"140 141 tc filter add dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \142 flower src_mac $h2mac action drop143 check_err $? "Failed to insert filter which fits template"144 145 tc filter add dev $h2 ingress chain 1 protocol ip pref 1 handle 1102 \146 flower dst_mac $h2mac action drop &> /dev/null147 check_fail $? "Incorrectly succeeded to insert filter which does not template"148 149 tc filter del dev $h2 ingress chain 1 protocol ip pref 1 handle 1102 \150 flower &> /dev/null151 tc filter del dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \152 flower &> /dev/null153 154 tc filter del dev $h2 ingress protocol ip pref 1 handle 1102 \155 flower &> /dev/null156 tc filter del dev $h2 ingress protocol ip pref 1 handle 1101 \157 flower &> /dev/null158 159 tc chain del dev $h2 ingress chain 1160 tc chain del dev $h2 ingress161 162 log_test "template filter fits"163}164 165setup_prepare()166{167 h1=${NETIFS[p1]}168 h2=${NETIFS[p2]}169 h1mac=$(mac_get $h1)170 h2mac=$(mac_get $h2)171 172 vrf_prepare173 174 h1_create175 h2_create176}177 178cleanup()179{180 pre_cleanup181 182 h2_destroy183 h1_destroy184 185 vrf_cleanup186}187 188check_tc_chain_support189 190trap cleanup EXIT191 192setup_prepare193setup_wait194 195tests_run196 197tc_offload_check198if [[ $? -ne 0 ]]; then199 log_info "Could not test offloaded functionality"200else201 tcflags="skip_sw"202 tests_run203fi204 205exit $EXIT_STATUS206