442 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# Test tc-police action.5#6# +---------------------------------+7# | H1 (vrf) |8# | + $h1 |9# | | 192.0.2.1/24 |10# | | |11# | | default via 192.0.2.2 |12# +----|----------------------------+13# |14# +----|----------------------------------------------------------------------+15# | SW | |16# | + $rp1 |17# | 192.0.2.2/24 |18# | |19# | 198.51.100.2/24 203.0.113.2/24 |20# | + $rp2 + $rp3 |21# | | | |22# +----|-----------------------------------------|----------------------------+23# | |24# +----|----------------------------+ +----|----------------------------+25# | | default via 198.51.100.2 | | | default via 203.0.113.2 |26# | | | | | |27# | | 198.51.100.1/24 | | | 203.0.113.1/24 |28# | + $h2 | | + $h3 |29# | H2 (vrf) | | H3 (vrf) |30# +---------------------------------+ +---------------------------------+31 32ALL_TESTS="33 police_rx_test34 police_tx_test35 police_shared_test36 police_rx_mirror_test37 police_tx_mirror_test38 police_pps_rx_test39 police_pps_tx_test40 police_mtu_rx_test41 police_mtu_tx_test42"43NUM_NETIFS=644source tc_common.sh45source lib.sh46 47h1_create()48{49 simple_if_init $h1 192.0.2.1/2450 51 ip -4 route add default vrf v$h1 nexthop via 192.0.2.252}53 54h1_destroy()55{56 ip -4 route del default vrf v$h1 nexthop via 192.0.2.257 58 simple_if_fini $h1 192.0.2.1/2459}60 61h2_create()62{63 simple_if_init $h2 198.51.100.1/2464 65 ip -4 route add default vrf v$h2 nexthop via 198.51.100.266 67 tc qdisc add dev $h2 clsact68}69 70h2_destroy()71{72 tc qdisc del dev $h2 clsact73 74 ip -4 route del default vrf v$h2 nexthop via 198.51.100.275 76 simple_if_fini $h2 198.51.100.1/2477}78 79h3_create()80{81 simple_if_init $h3 203.0.113.1/2482 83 ip -4 route add default vrf v$h3 nexthop via 203.0.113.284 85 tc qdisc add dev $h3 clsact86}87 88h3_destroy()89{90 tc qdisc del dev $h3 clsact91 92 ip -4 route del default vrf v$h3 nexthop via 203.0.113.293 94 simple_if_fini $h3 203.0.113.1/2495}96 97router_create()98{99 ip link set dev $rp1 up100 ip link set dev $rp2 up101 ip link set dev $rp3 up102 103 __addr_add_del $rp1 add 192.0.2.2/24104 __addr_add_del $rp2 add 198.51.100.2/24105 __addr_add_del $rp3 add 203.0.113.2/24106 107 tc qdisc add dev $rp1 clsact108 tc qdisc add dev $rp2 clsact109}110 111router_destroy()112{113 tc qdisc del dev $rp2 clsact114 tc qdisc del dev $rp1 clsact115 116 __addr_add_del $rp3 del 203.0.113.2/24117 __addr_add_del $rp2 del 198.51.100.2/24118 __addr_add_del $rp1 del 192.0.2.2/24119 120 ip link set dev $rp3 down121 ip link set dev $rp2 down122 ip link set dev $rp1 down123}124 125police_common_test()126{127 local test_name=$1; shift128 129 RET=0130 131 # Rule to measure bandwidth on ingress of $h2132 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \133 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \134 action drop135 136 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \137 -t udp sp=12345,dp=54321 -p 1000 -c 0 -q &138 139 local t0=$(tc_rule_stats_get $h2 1 ingress .bytes)140 sleep 10141 local t1=$(tc_rule_stats_get $h2 1 ingress .bytes)142 143 local er=$((10 * 1000 * 1000))144 local nr=$(rate $t0 $t1 10)145 local nr_pct=$((100 * (nr - er) / er))146 ((-10 <= nr_pct && nr_pct <= 10))147 check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%."148 149 log_test "$test_name"150 151 { kill %% && wait %%; } 2>/dev/null152 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower153}154 155police_rx_test()156{157 # Rule to police traffic destined to $h2 on ingress of $rp1158 tc filter add dev $rp1 ingress protocol ip pref 1 handle 101 flower \159 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \160 action police rate 10mbit burst 16k conform-exceed drop/ok161 162 police_common_test "police on rx"163 164 tc filter del dev $rp1 ingress protocol ip pref 1 handle 101 flower165}166 167police_tx_test()168{169 # Rule to police traffic destined to $h2 on egress of $rp2170 tc filter add dev $rp2 egress protocol ip pref 1 handle 101 flower \171 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \172 action police rate 10mbit burst 16k conform-exceed drop/ok173 174 police_common_test "police on tx"175 176 tc filter del dev $rp2 egress protocol ip pref 1 handle 101 flower177}178 179police_shared_common_test()180{181 local dport=$1; shift182 local test_name=$1; shift183 184 RET=0185 186 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \187 -t udp sp=12345,dp=$dport -p 1000 -c 0 -q &188 189 local t0=$(tc_rule_stats_get $h2 1 ingress .bytes)190 sleep 10191 local t1=$(tc_rule_stats_get $h2 1 ingress .bytes)192 193 local er=$((10 * 1000 * 1000))194 local nr=$(rate $t0 $t1 10)195 local nr_pct=$((100 * (nr - er) / er))196 ((-10 <= nr_pct && nr_pct <= 10))197 check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%."198 199 log_test "$test_name"200 201 { kill %% && wait %%; } 2>/dev/null202}203 204police_shared_test()205{206 # Rule to measure bandwidth on ingress of $h2207 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \208 dst_ip 198.51.100.1 ip_proto udp src_port 12345 \209 action drop210 211 # Rule to police traffic destined to $h2 on ingress of $rp1212 tc filter add dev $rp1 ingress protocol ip pref 1 handle 101 flower \213 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \214 action police rate 10mbit burst 16k conform-exceed drop/ok \215 index 10216 217 # Rule to police a different flow destined to $h2 on egress of $rp2218 # using same policer219 tc filter add dev $rp2 egress protocol ip pref 1 handle 101 flower \220 dst_ip 198.51.100.1 ip_proto udp dst_port 22222 \221 action police index 10222 223 police_shared_common_test 54321 "police with shared policer - rx"224 225 police_shared_common_test 22222 "police with shared policer - tx"226 227 tc filter del dev $rp2 egress protocol ip pref 1 handle 101 flower228 tc filter del dev $rp1 ingress protocol ip pref 1 handle 101 flower229 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower230}231 232police_mirror_common_test()233{234 local pol_if=$1; shift235 local dir=$1; shift236 local test_name=$1; shift237 238 RET=0239 240 # Rule to measure bandwidth on ingress of $h2241 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \242 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \243 action drop244 245 # Rule to measure bandwidth of mirrored traffic on ingress of $h3246 tc filter add dev $h3 ingress protocol ip pref 1 handle 101 flower \247 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \248 action drop249 250 # Rule to police traffic destined to $h2 and mirror to $h3251 tc filter add dev $pol_if $dir protocol ip pref 1 handle 101 flower \252 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \253 action police rate 10mbit burst 16k conform-exceed drop/pipe \254 action mirred egress mirror dev $rp3255 256 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \257 -t udp sp=12345,dp=54321 -p 1000 -c 0 -q &258 259 local t0=$(tc_rule_stats_get $h2 1 ingress .bytes)260 sleep 10261 local t1=$(tc_rule_stats_get $h2 1 ingress .bytes)262 263 local er=$((10 * 1000 * 1000))264 local nr=$(rate $t0 $t1 10)265 local nr_pct=$((100 * (nr - er) / er))266 ((-10 <= nr_pct && nr_pct <= 10))267 check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%."268 269 local t0=$(tc_rule_stats_get $h3 1 ingress .bytes)270 sleep 10271 local t1=$(tc_rule_stats_get $h3 1 ingress .bytes)272 273 local er=$((10 * 1000 * 1000))274 local nr=$(rate $t0 $t1 10)275 local nr_pct=$((100 * (nr - er) / er))276 ((-10 <= nr_pct && nr_pct <= 10))277 check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%."278 279 log_test "$test_name"280 281 { kill %% && wait %%; } 2>/dev/null282 tc filter del dev $pol_if $dir protocol ip pref 1 handle 101 flower283 tc filter del dev $h3 ingress protocol ip pref 1 handle 101 flower284 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower285}286 287police_rx_mirror_test()288{289 police_mirror_common_test $rp1 ingress "police rx and mirror"290}291 292police_tx_mirror_test()293{294 police_mirror_common_test $rp2 egress "police tx and mirror"295}296 297police_pps_common_test()298{299 local test_name=$1; shift300 301 RET=0302 303 # Rule to measure bandwidth on ingress of $h2304 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \305 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \306 action drop307 308 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \309 -t udp sp=12345,dp=54321 -p 1000 -c 0 -q &310 311 local t0=$(tc_rule_stats_get $h2 1 ingress .packets)312 sleep 10313 local t1=$(tc_rule_stats_get $h2 1 ingress .packets)314 315 local er=$((2000))316 local nr=$(packets_rate $t0 $t1 10)317 local nr_pct=$((100 * (nr - er) / er))318 ((-10 <= nr_pct && nr_pct <= 10))319 check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%."320 321 log_test "$test_name"322 323 { kill %% && wait %%; } 2>/dev/null324 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower325}326 327police_pps_rx_test()328{329 # Rule to police traffic destined to $h2 on ingress of $rp1330 tc filter add dev $rp1 ingress protocol ip pref 1 handle 101 flower \331 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \332 action police pkts_rate 2000 pkts_burst 400 conform-exceed drop/ok333 334 police_pps_common_test "police pps on rx"335 336 tc filter del dev $rp1 ingress protocol ip pref 1 handle 101 flower337}338 339police_pps_tx_test()340{341 # Rule to police traffic destined to $h2 on egress of $rp2342 tc filter add dev $rp2 egress protocol ip pref 1 handle 101 flower \343 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \344 action police pkts_rate 2000 pkts_burst 400 conform-exceed drop/ok345 346 police_pps_common_test "police pps on tx"347 348 tc filter del dev $rp2 egress protocol ip pref 1 handle 101 flower349}350 351police_mtu_common_test() {352 RET=0353 354 local test_name=$1; shift355 local dev=$1; shift356 local direction=$1; shift357 358 tc filter add dev $dev $direction protocol ip pref 1 handle 101 flower \359 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \360 action police mtu 1042 conform-exceed drop/ok361 362 # to count "conform" packets363 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \364 dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \365 action drop366 367 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \368 -t udp sp=12345,dp=54321 -p 1001 -c 10 -q369 370 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \371 -t udp sp=12345,dp=54321 -p 1000 -c 3 -q372 373 tc_check_packets "dev $dev $direction" 101 13374 check_err $? "wrong packet counter"375 376 # "exceed" packets377 local overlimits_t0=$(tc_rule_stats_get ${dev} 1 ${direction} .overlimits)378 test ${overlimits_t0} = 10379 check_err $? "wrong overlimits, expected 10 got ${overlimits_t0}"380 381 # "conform" packets382 tc_check_packets "dev $h2 ingress" 101 3383 check_err $? "forwarding error"384 385 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower386 tc filter del dev $dev $direction protocol ip pref 1 handle 101 flower387 388 log_test "$test_name"389}390 391police_mtu_rx_test()392{393 police_mtu_common_test "police mtu (rx)" $rp1 ingress394}395 396police_mtu_tx_test()397{398 police_mtu_common_test "police mtu (tx)" $rp2 egress399}400 401setup_prepare()402{403 h1=${NETIFS[p1]}404 rp1=${NETIFS[p2]}405 406 rp2=${NETIFS[p3]}407 h2=${NETIFS[p4]}408 409 rp3=${NETIFS[p5]}410 h3=${NETIFS[p6]}411 412 vrf_prepare413 forwarding_enable414 415 h1_create416 h2_create417 h3_create418 router_create419}420 421cleanup()422{423 pre_cleanup424 425 router_destroy426 h3_destroy427 h2_destroy428 h1_destroy429 430 forwarding_restore431 vrf_cleanup432}433 434trap cleanup EXIT435 436setup_prepare437setup_wait438 439tests_run440 441exit $EXIT_STATUS442