848 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# This test is for checking bridge neighbor suppression functionality. The5# topology consists of two bridges (VTEPs) connected using VXLAN. A single6# host is connected to each bridge over multiple VLANs. The test checks that7# ARP/NS messages from the first host are suppressed on the VXLAN port when8# should.9#10# +-----------------------+ +------------------------+11# | h1 | | h2 |12# | | | |13# | + eth0.10 | | + eth0.10 |14# | | 192.0.2.1/28 | | | 192.0.2.2/28 |15# | | 2001:db8:1::1/64 | | | 2001:db8:1::2/64 |16# | | | | | |17# | | + eth0.20 | | | + eth0.20 |18# | \ | 192.0.2.17/28 | | \ | 192.0.2.18/28 |19# | \ | 2001:db8:2::1/64 | | \ | 2001:db8:2::2/64 |20# | \| | | \| |21# | + eth0 | | + eth0 |22# +----|------------------+ +----|-------------------+23# | |24# | |25# +----|-------------------------------+ +----|-------------------------------+26# | + swp1 + vx0 | | + swp1 + vx0 |27# | | | | | | | |28# | | br0 | | | | | |29# | +------------+-----------+ | | +------------+-----------+ |30# | | | | | |31# | | | | | |32# | +---+---+ | | +---+---+ |33# | | | | | | | |34# | | | | | | | |35# | + + | | + + |36# | br0.10 br0.20 | | br0.10 br0.20 |37# | | | |38# | 192.0.2.33 | | 192.0.2.34 |39# | + lo | | + lo |40# | | | |41# | | | |42# | 192.0.2.49/28 | | 192.0.2.50/28 |43# | veth0 +-------+ veth0 |44# | | | |45# | sw1 | | sw2 |46# +------------------------------------+ +------------------------------------+47 48source lib.sh49ret=050 51# All tests in this script. Can be overridden with -t option.52TESTS="53 neigh_suppress_arp54 neigh_suppress_ns55 neigh_vlan_suppress_arp56 neigh_vlan_suppress_ns57"58VERBOSE=059PAUSE_ON_FAIL=no60PAUSE=no61 62################################################################################63# Utilities64 65log_test()66{67 local rc=$168 local expected=$269 local msg="$3"70 71 if [ ${rc} -eq ${expected} ]; then72 printf "TEST: %-60s [ OK ]\n" "${msg}"73 nsuccess=$((nsuccess+1))74 else75 ret=176 nfail=$((nfail+1))77 printf "TEST: %-60s [FAIL]\n" "${msg}"78 if [ "$VERBOSE" = "1" ]; then79 echo " rc=$rc, expected $expected"80 fi81 82 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then83 echo84 echo "hit enter to continue, 'q' to quit"85 read a86 [ "$a" = "q" ] && exit 187 fi88 fi89 90 if [ "${PAUSE}" = "yes" ]; then91 echo92 echo "hit enter to continue, 'q' to quit"93 read a94 [ "$a" = "q" ] && exit 195 fi96 97 [ "$VERBOSE" = "1" ] && echo98}99 100run_cmd()101{102 local cmd="$1"103 local out104 local stderr="2>/dev/null"105 106 if [ "$VERBOSE" = "1" ]; then107 printf "COMMAND: $cmd\n"108 stderr=109 fi110 111 out=$(eval $cmd $stderr)112 rc=$?113 if [ "$VERBOSE" = "1" -a -n "$out" ]; then114 echo " $out"115 fi116 117 return $rc118}119 120tc_check_packets()121{122 local ns=$1; shift123 local id=$1; shift124 local handle=$1; shift125 local count=$1; shift126 local pkts127 128 sleep 0.1129 pkts=$(tc -n $ns -j -s filter show $id \130 | jq ".[] | select(.options.handle == $handle) | \131 .options.actions[0].stats.packets")132 [[ $pkts == $count ]]133}134 135################################################################################136# Setup137 138setup_topo_ns()139{140 local ns=$1; shift141 142 ip netns exec $ns sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1143 ip netns exec $ns sysctl -qw net.ipv6.conf.default.ignore_routes_with_linkdown=1144 ip netns exec $ns sysctl -qw net.ipv6.conf.all.accept_dad=0145 ip netns exec $ns sysctl -qw net.ipv6.conf.default.accept_dad=0146}147 148setup_topo()149{150 local ns151 152 setup_ns h1 h2 sw1 sw2153 for ns in $h1 $h2 $sw1 $sw2; do154 setup_topo_ns $ns155 done156 157 ip -n $h1 link add name eth0 type veth peer name swp1 netns $sw1158 ip -n $sw1 link add name veth0 type veth peer name veth0 netns $sw2159 ip -n $h2 link add name eth0 type veth peer name swp1 netns $sw2160}161 162setup_host_common()163{164 local ns=$1; shift165 local v4addr1=$1; shift166 local v4addr2=$1; shift167 local v6addr1=$1; shift168 local v6addr2=$1; shift169 170 ip -n $ns link set dev eth0 up171 ip -n $ns link add link eth0 name eth0.10 up type vlan id 10172 ip -n $ns link add link eth0 name eth0.20 up type vlan id 20173 174 ip -n $ns address add $v4addr1 dev eth0.10175 ip -n $ns address add $v4addr2 dev eth0.20176 ip -n $ns address add $v6addr1 dev eth0.10177 ip -n $ns address add $v6addr2 dev eth0.20178}179 180setup_h1()181{182 local ns=$h1183 local v4addr1=192.0.2.1/28184 local v4addr2=192.0.2.17/28185 local v6addr1=2001:db8:1::1/64186 local v6addr2=2001:db8:2::1/64187 188 setup_host_common $ns $v4addr1 $v4addr2 $v6addr1 $v6addr2189}190 191setup_h2()192{193 local ns=$h2194 local v4addr1=192.0.2.2/28195 local v4addr2=192.0.2.18/28196 local v6addr1=2001:db8:1::2/64197 local v6addr2=2001:db8:2::2/64198 199 setup_host_common $ns $v4addr1 $v4addr2 $v6addr1 $v6addr2200}201 202setup_sw_common()203{204 local ns=$1; shift205 local local_addr=$1; shift206 local remote_addr=$1; shift207 local veth_addr=$1; shift208 local gw_addr=$1; shift209 210 ip -n $ns address add $local_addr/32 dev lo211 212 ip -n $ns link set dev veth0 up213 ip -n $ns address add $veth_addr/28 dev veth0214 ip -n $ns route add default via $gw_addr215 216 ip -n $ns link add name br0 up type bridge vlan_filtering 1 \217 vlan_default_pvid 0 mcast_snooping 0218 219 ip -n $ns link add link br0 name br0.10 up type vlan id 10220 bridge -n $ns vlan add vid 10 dev br0 self221 222 ip -n $ns link add link br0 name br0.20 up type vlan id 20223 bridge -n $ns vlan add vid 20 dev br0 self224 225 ip -n $ns link set dev swp1 up master br0226 bridge -n $ns vlan add vid 10 dev swp1227 bridge -n $ns vlan add vid 20 dev swp1228 229 ip -n $ns link add name vx0 up master br0 type vxlan \230 local $local_addr dstport 4789 nolearning external231 bridge -n $ns fdb add 00:00:00:00:00:00 dev vx0 self static \232 dst $remote_addr src_vni 10010233 bridge -n $ns fdb add 00:00:00:00:00:00 dev vx0 self static \234 dst $remote_addr src_vni 10020235 bridge -n $ns link set dev vx0 vlan_tunnel on learning off236 237 bridge -n $ns vlan add vid 10 dev vx0238 bridge -n $ns vlan add vid 10 dev vx0 tunnel_info id 10010239 240 bridge -n $ns vlan add vid 20 dev vx0241 bridge -n $ns vlan add vid 20 dev vx0 tunnel_info id 10020242}243 244setup_sw1()245{246 local ns=$sw1247 local local_addr=192.0.2.33248 local remote_addr=192.0.2.34249 local veth_addr=192.0.2.49250 local gw_addr=192.0.2.50251 252 setup_sw_common $ns $local_addr $remote_addr $veth_addr $gw_addr253}254 255setup_sw2()256{257 local ns=$sw2258 local local_addr=192.0.2.34259 local remote_addr=192.0.2.33260 local veth_addr=192.0.2.50261 local gw_addr=192.0.2.49262 263 setup_sw_common $ns $local_addr $remote_addr $veth_addr $gw_addr264}265 266setup()267{268 set -e269 270 setup_topo271 setup_h1272 setup_h2273 setup_sw1274 setup_sw2275 276 sleep 5277 278 set +e279}280 281cleanup()282{283 cleanup_ns $h1 $h2 $sw1 $sw2284}285 286################################################################################287# Tests288 289neigh_suppress_arp_common()290{291 local vid=$1; shift292 local sip=$1; shift293 local tip=$1; shift294 local h2_mac295 296 echo297 echo "Per-port ARP suppression - VLAN $vid"298 echo "----------------------------------"299 300 run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"301 run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto 0x0806 flower indev swp1 arp_tip $tip arp_sip $sip arp_op request action pass"302 303 # Initial state - check that ARP requests are not suppressed and that304 # ARP replies are received.305 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"306 log_test $? 0 "arping"307 tc_check_packets $sw1 "dev vx0 egress" 101 1308 log_test $? 0 "ARP suppression"309 310 # Enable neighbor suppression and check that nothing changes compared311 # to the initial state.312 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"313 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""314 log_test $? 0 "\"neigh_suppress\" is on"315 316 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"317 log_test $? 0 "arping"318 tc_check_packets $sw1 "dev vx0 egress" 101 2319 log_test $? 0 "ARP suppression"320 321 # Install an FDB entry for the remote host and check that nothing322 # changes compared to the initial state.323 h2_mac=$(ip -n $h2 -j -p link show eth0.$vid | jq -r '.[]["address"]')324 run_cmd "bridge -n $sw1 fdb replace $h2_mac dev vx0 master static vlan $vid"325 log_test $? 0 "FDB entry installation"326 327 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"328 log_test $? 0 "arping"329 tc_check_packets $sw1 "dev vx0 egress" 101 3330 log_test $? 0 "ARP suppression"331 332 # Install a neighbor on the matching SVI interface and check that ARP333 # requests are suppressed.334 run_cmd "ip -n $sw1 neigh replace $tip lladdr $h2_mac nud permanent dev br0.$vid"335 log_test $? 0 "Neighbor entry installation"336 337 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"338 log_test $? 0 "arping"339 tc_check_packets $sw1 "dev vx0 egress" 101 3340 log_test $? 0 "ARP suppression"341 342 # Take the second host down and check that ARP requests are suppressed343 # and that ARP replies are received.344 run_cmd "ip -n $h2 link set dev eth0.$vid down"345 log_test $? 0 "H2 down"346 347 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"348 log_test $? 0 "arping"349 tc_check_packets $sw1 "dev vx0 egress" 101 3350 log_test $? 0 "ARP suppression"351 352 run_cmd "ip -n $h2 link set dev eth0.$vid up"353 log_test $? 0 "H2 up"354 355 # Disable neighbor suppression and check that ARP requests are no356 # longer suppressed.357 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"358 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""359 log_test $? 0 "\"neigh_suppress\" is off"360 361 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"362 log_test $? 0 "arping"363 tc_check_packets $sw1 "dev vx0 egress" 101 4364 log_test $? 0 "ARP suppression"365 366 # Take the second host down and check that ARP requests are not367 # suppressed and that ARP replies are not received.368 run_cmd "ip -n $h2 link set dev eth0.$vid down"369 log_test $? 0 "H2 down"370 371 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"372 log_test $? 1 "arping"373 tc_check_packets $sw1 "dev vx0 egress" 101 5374 log_test $? 0 "ARP suppression"375}376 377neigh_suppress_arp()378{379 local vid=10380 local sip=192.0.2.1381 local tip=192.0.2.2382 383 neigh_suppress_arp_common $vid $sip $tip384 385 vid=20386 sip=192.0.2.17387 tip=192.0.2.18388 neigh_suppress_arp_common $vid $sip $tip389}390 391neigh_suppress_ns_common()392{393 local vid=$1; shift394 local saddr=$1; shift395 local daddr=$1; shift396 local maddr=$1; shift397 local h2_mac398 399 echo400 echo "Per-port NS suppression - VLAN $vid"401 echo "---------------------------------"402 403 run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"404 run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $maddr src_ip $saddr type 135 code 0 action pass"405 406 # Initial state - check that NS messages are not suppressed and that ND407 # messages are received.408 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"409 log_test $? 0 "ndisc6"410 tc_check_packets $sw1 "dev vx0 egress" 101 1411 log_test $? 0 "NS suppression"412 413 # Enable neighbor suppression and check that nothing changes compared414 # to the initial state.415 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"416 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""417 log_test $? 0 "\"neigh_suppress\" is on"418 419 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"420 log_test $? 0 "ndisc6"421 tc_check_packets $sw1 "dev vx0 egress" 101 2422 log_test $? 0 "NS suppression"423 424 # Install an FDB entry for the remote host and check that nothing425 # changes compared to the initial state.426 h2_mac=$(ip -n $h2 -j -p link show eth0.$vid | jq -r '.[]["address"]')427 run_cmd "bridge -n $sw1 fdb replace $h2_mac dev vx0 master static vlan $vid"428 log_test $? 0 "FDB entry installation"429 430 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"431 log_test $? 0 "ndisc6"432 tc_check_packets $sw1 "dev vx0 egress" 101 3433 log_test $? 0 "NS suppression"434 435 # Install a neighbor on the matching SVI interface and check that NS436 # messages are suppressed.437 run_cmd "ip -n $sw1 neigh replace $daddr lladdr $h2_mac nud permanent dev br0.$vid"438 log_test $? 0 "Neighbor entry installation"439 440 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"441 log_test $? 0 "ndisc6"442 tc_check_packets $sw1 "dev vx0 egress" 101 3443 log_test $? 0 "NS suppression"444 445 # Take the second host down and check that NS messages are suppressed446 # and that ND messages are received.447 run_cmd "ip -n $h2 link set dev eth0.$vid down"448 log_test $? 0 "H2 down"449 450 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"451 log_test $? 0 "ndisc6"452 tc_check_packets $sw1 "dev vx0 egress" 101 3453 log_test $? 0 "NS suppression"454 455 run_cmd "ip -n $h2 link set dev eth0.$vid up"456 log_test $? 0 "H2 up"457 458 # Disable neighbor suppression and check that NS messages are no longer459 # suppressed.460 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"461 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""462 log_test $? 0 "\"neigh_suppress\" is off"463 464 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"465 log_test $? 0 "ndisc6"466 tc_check_packets $sw1 "dev vx0 egress" 101 4467 log_test $? 0 "NS suppression"468 469 # Take the second host down and check that NS messages are not470 # suppressed and that ND messages are not received.471 run_cmd "ip -n $h2 link set dev eth0.$vid down"472 log_test $? 0 "H2 down"473 474 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"475 log_test $? 2 "ndisc6"476 tc_check_packets $sw1 "dev vx0 egress" 101 5477 log_test $? 0 "NS suppression"478}479 480neigh_suppress_ns()481{482 local vid=10483 local saddr=2001:db8:1::1484 local daddr=2001:db8:1::2485 local maddr=ff02::1:ff00:2486 487 neigh_suppress_ns_common $vid $saddr $daddr $maddr488 489 vid=20490 saddr=2001:db8:2::1491 daddr=2001:db8:2::2492 maddr=ff02::1:ff00:2493 494 neigh_suppress_ns_common $vid $saddr $daddr $maddr495}496 497neigh_vlan_suppress_arp()498{499 local vid1=10500 local vid2=20501 local sip1=192.0.2.1502 local sip2=192.0.2.17503 local tip1=192.0.2.2504 local tip2=192.0.2.18505 local h2_mac1506 local h2_mac2507 508 echo509 echo "Per-{Port, VLAN} ARP suppression"510 echo "--------------------------------"511 512 run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"513 run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto 0x0806 flower indev swp1 arp_tip $tip1 arp_sip $sip1 arp_op request action pass"514 run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto 0x0806 flower indev swp1 arp_tip $tip2 arp_sip $sip2 arp_op request action pass"515 516 h2_mac1=$(ip -n $h2 -j -p link show eth0.$vid1 | jq -r '.[]["address"]')517 h2_mac2=$(ip -n $h2 -j -p link show eth0.$vid2 | jq -r '.[]["address"]')518 run_cmd "bridge -n $sw1 fdb replace $h2_mac1 dev vx0 master static vlan $vid1"519 run_cmd "bridge -n $sw1 fdb replace $h2_mac2 dev vx0 master static vlan $vid2"520 run_cmd "ip -n $sw1 neigh replace $tip1 lladdr $h2_mac1 nud permanent dev br0.$vid1"521 run_cmd "ip -n $sw1 neigh replace $tip2 lladdr $h2_mac2 nud permanent dev br0.$vid2"522 523 # Enable per-{Port, VLAN} neighbor suppression and check that ARP524 # requests are not suppressed and that ARP replies are received.525 run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress on"526 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress on\""527 log_test $? 0 "\"neigh_vlan_suppress\" is on"528 529 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"530 log_test $? 0 "arping (VLAN $vid1)"531 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"532 log_test $? 0 "arping (VLAN $vid2)"533 534 tc_check_packets $sw1 "dev vx0 egress" 101 1535 log_test $? 0 "ARP suppression (VLAN $vid1)"536 tc_check_packets $sw1 "dev vx0 egress" 102 1537 log_test $? 0 "ARP suppression (VLAN $vid2)"538 539 # Enable neighbor suppression on VLAN 10 and check that only on this540 # VLAN ARP requests are suppressed.541 run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress on"542 run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress on\""543 log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid1)"544 run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid2 | grep \"neigh_suppress off\""545 log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid2)"546 547 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"548 log_test $? 0 "arping (VLAN $vid1)"549 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"550 log_test $? 0 "arping (VLAN $vid2)"551 552 tc_check_packets $sw1 "dev vx0 egress" 101 1553 log_test $? 0 "ARP suppression (VLAN $vid1)"554 tc_check_packets $sw1 "dev vx0 egress" 102 2555 log_test $? 0 "ARP suppression (VLAN $vid2)"556 557 # Enable neighbor suppression on the port and check that it has no558 # effect compared to previous state.559 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"560 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""561 log_test $? 0 "\"neigh_suppress\" is on"562 563 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"564 log_test $? 0 "arping (VLAN $vid1)"565 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"566 log_test $? 0 "arping (VLAN $vid2)"567 568 tc_check_packets $sw1 "dev vx0 egress" 101 1569 log_test $? 0 "ARP suppression (VLAN $vid1)"570 tc_check_packets $sw1 "dev vx0 egress" 102 3571 log_test $? 0 "ARP suppression (VLAN $vid2)"572 573 # Disable neighbor suppression on the port and check that it has no574 # effect compared to previous state.575 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"576 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""577 log_test $? 0 "\"neigh_suppress\" is off"578 579 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"580 log_test $? 0 "arping (VLAN $vid1)"581 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"582 log_test $? 0 "arping (VLAN $vid2)"583 584 tc_check_packets $sw1 "dev vx0 egress" 101 1585 log_test $? 0 "ARP suppression (VLAN $vid1)"586 tc_check_packets $sw1 "dev vx0 egress" 102 4587 log_test $? 0 "ARP suppression (VLAN $vid2)"588 589 # Disable neighbor suppression on VLAN 10 and check that ARP requests590 # are no longer suppressed on this VLAN.591 run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress off"592 run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress off\""593 log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid1)"594 595 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"596 log_test $? 0 "arping (VLAN $vid1)"597 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"598 log_test $? 0 "arping (VLAN $vid2)"599 600 tc_check_packets $sw1 "dev vx0 egress" 101 2601 log_test $? 0 "ARP suppression (VLAN $vid1)"602 tc_check_packets $sw1 "dev vx0 egress" 102 5603 log_test $? 0 "ARP suppression (VLAN $vid2)"604 605 # Disable per-{Port, VLAN} neighbor suppression, enable neighbor606 # suppression on the port and check that on both VLANs ARP requests are607 # suppressed.608 run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress off"609 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress off\""610 log_test $? 0 "\"neigh_vlan_suppress\" is off"611 612 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"613 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""614 log_test $? 0 "\"neigh_suppress\" is on"615 616 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"617 log_test $? 0 "arping (VLAN $vid1)"618 run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"619 log_test $? 0 "arping (VLAN $vid2)"620 621 tc_check_packets $sw1 "dev vx0 egress" 101 2622 log_test $? 0 "ARP suppression (VLAN $vid1)"623 tc_check_packets $sw1 "dev vx0 egress" 102 5624 log_test $? 0 "ARP suppression (VLAN $vid2)"625}626 627neigh_vlan_suppress_ns()628{629 local vid1=10630 local vid2=20631 local saddr1=2001:db8:1::1632 local saddr2=2001:db8:2::1633 local daddr1=2001:db8:1::2634 local daddr2=2001:db8:2::2635 local maddr=ff02::1:ff00:2636 local h2_mac1637 local h2_mac2638 639 echo640 echo "Per-{Port, VLAN} NS suppression"641 echo "-------------------------------"642 643 run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"644 run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $maddr src_ip $saddr1 type 135 code 0 action pass"645 run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $maddr src_ip $saddr2 type 135 code 0 action pass"646 647 h2_mac1=$(ip -n $h2 -j -p link show eth0.$vid1 | jq -r '.[]["address"]')648 h2_mac2=$(ip -n $h2 -j -p link show eth0.$vid2 | jq -r '.[]["address"]')649 run_cmd "bridge -n $sw1 fdb replace $h2_mac1 dev vx0 master static vlan $vid1"650 run_cmd "bridge -n $sw1 fdb replace $h2_mac2 dev vx0 master static vlan $vid2"651 run_cmd "ip -n $sw1 neigh replace $daddr1 lladdr $h2_mac1 nud permanent dev br0.$vid1"652 run_cmd "ip -n $sw1 neigh replace $daddr2 lladdr $h2_mac2 nud permanent dev br0.$vid2"653 654 # Enable per-{Port, VLAN} neighbor suppression and check that NS655 # messages are not suppressed and that ND messages are received.656 run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress on"657 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress on\""658 log_test $? 0 "\"neigh_vlan_suppress\" is on"659 660 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"661 log_test $? 0 "ndisc6 (VLAN $vid1)"662 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"663 log_test $? 0 "ndisc6 (VLAN $vid2)"664 665 tc_check_packets $sw1 "dev vx0 egress" 101 1666 log_test $? 0 "NS suppression (VLAN $vid1)"667 tc_check_packets $sw1 "dev vx0 egress" 102 1668 log_test $? 0 "NS suppression (VLAN $vid2)"669 670 # Enable neighbor suppression on VLAN 10 and check that only on this671 # VLAN NS messages are suppressed.672 run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress on"673 run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress on\""674 log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid1)"675 run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid2 | grep \"neigh_suppress off\""676 log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid2)"677 678 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"679 log_test $? 0 "ndisc6 (VLAN $vid1)"680 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"681 log_test $? 0 "ndisc6 (VLAN $vid2)"682 683 tc_check_packets $sw1 "dev vx0 egress" 101 1684 log_test $? 0 "NS suppression (VLAN $vid1)"685 tc_check_packets $sw1 "dev vx0 egress" 102 2686 log_test $? 0 "NS suppression (VLAN $vid2)"687 688 # Enable neighbor suppression on the port and check that it has no689 # effect compared to previous state.690 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"691 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""692 log_test $? 0 "\"neigh_suppress\" is on"693 694 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"695 log_test $? 0 "ndisc6 (VLAN $vid1)"696 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"697 log_test $? 0 "ndisc6 (VLAN $vid2)"698 699 tc_check_packets $sw1 "dev vx0 egress" 101 1700 log_test $? 0 "NS suppression (VLAN $vid1)"701 tc_check_packets $sw1 "dev vx0 egress" 102 3702 log_test $? 0 "NS suppression (VLAN $vid2)"703 704 # Disable neighbor suppression on the port and check that it has no705 # effect compared to previous state.706 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"707 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""708 log_test $? 0 "\"neigh_suppress\" is off"709 710 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"711 log_test $? 0 "ndisc6 (VLAN $vid1)"712 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"713 log_test $? 0 "ndisc6 (VLAN $vid2)"714 715 tc_check_packets $sw1 "dev vx0 egress" 101 1716 log_test $? 0 "NS suppression (VLAN $vid1)"717 tc_check_packets $sw1 "dev vx0 egress" 102 4718 log_test $? 0 "NS suppression (VLAN $vid2)"719 720 # Disable neighbor suppression on VLAN 10 and check that NS messages721 # are no longer suppressed on this VLAN.722 run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress off"723 run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress off\""724 log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid1)"725 726 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"727 log_test $? 0 "ndisc6 (VLAN $vid1)"728 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"729 log_test $? 0 "ndisc6 (VLAN $vid2)"730 731 tc_check_packets $sw1 "dev vx0 egress" 101 2732 log_test $? 0 "NS suppression (VLAN $vid1)"733 tc_check_packets $sw1 "dev vx0 egress" 102 5734 log_test $? 0 "NS suppression (VLAN $vid2)"735 736 # Disable per-{Port, VLAN} neighbor suppression, enable neighbor737 # suppression on the port and check that on both VLANs NS messages are738 # suppressed.739 run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress off"740 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress off\""741 log_test $? 0 "\"neigh_vlan_suppress\" is off"742 743 run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"744 run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""745 log_test $? 0 "\"neigh_suppress\" is on"746 747 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"748 log_test $? 0 "ndisc6 (VLAN $vid1)"749 run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"750 log_test $? 0 "ndisc6 (VLAN $vid2)"751 752 tc_check_packets $sw1 "dev vx0 egress" 101 2753 log_test $? 0 "NS suppression (VLAN $vid1)"754 tc_check_packets $sw1 "dev vx0 egress" 102 5755 log_test $? 0 "NS suppression (VLAN $vid2)"756}757 758################################################################################759# Usage760 761usage()762{763 cat <<EOF764usage: ${0##*/} OPTS765 766 -t <test> Test(s) to run (default: all)767 (options: $TESTS)768 -p Pause on fail769 -P Pause after each test before cleanup770 -v Verbose mode (show commands and output)771EOF772}773 774################################################################################775# Main776 777trap cleanup EXIT778 779while getopts ":t:pPvh" opt; do780 case $opt in781 t) TESTS=$OPTARG;;782 p) PAUSE_ON_FAIL=yes;;783 P) PAUSE=yes;;784 v) VERBOSE=$(($VERBOSE + 1));;785 h) usage; exit 0;;786 *) usage; exit 1;;787 esac788done789 790# Make sure we don't pause twice.791[ "${PAUSE}" = "yes" ] && PAUSE_ON_FAIL=no792 793if [ "$(id -u)" -ne 0 ];then794 echo "SKIP: Need root privileges"795 exit $ksft_skip;796fi797 798if [ ! -x "$(command -v ip)" ]; then799 echo "SKIP: Could not run test without ip tool"800 exit $ksft_skip801fi802 803if [ ! -x "$(command -v bridge)" ]; then804 echo "SKIP: Could not run test without bridge tool"805 exit $ksft_skip806fi807 808if [ ! -x "$(command -v tc)" ]; then809 echo "SKIP: Could not run test without tc tool"810 exit $ksft_skip811fi812 813if [ ! -x "$(command -v arping)" ]; then814 echo "SKIP: Could not run test without arping tool"815 exit $ksft_skip816fi817 818if [ ! -x "$(command -v ndisc6)" ]; then819 echo "SKIP: Could not run test without ndisc6 tool"820 exit $ksft_skip821fi822 823if [ ! -x "$(command -v jq)" ]; then824 echo "SKIP: Could not run test without jq tool"825 exit $ksft_skip826fi827 828bridge link help 2>&1 | grep -q "neigh_vlan_suppress"829if [ $? -ne 0 ]; then830 echo "SKIP: iproute2 bridge too old, missing per-VLAN neighbor suppression support"831 exit $ksft_skip832fi833 834# Start clean.835cleanup836 837for t in $TESTS838do839 setup; $t; cleanup;840done841 842if [ "$TESTS" != "none" ]; then843 printf "\nTests passed: %3d\n" ${nsuccess}844 printf "Tests failed: %3d\n" ${nfail}845fi846 847exit $ret848