selftests/bpf/test_flow_dissector.sh

0001 #!/bin/bash
0002 # SPDX-License-Identifier: GPL-2.0
0003 #
0004 # Load BPF flow dissector and verify it correctly dissects traffic
0005 export TESTNAME=test_flow_dissector
0006 unmount=0
0007
0008 # Kselftest framework requirement - SKIP code is 4.
0009 ksft_skip=4
0010
0011 msg="skip all tests:"
0012 if [ $UID != 0 ]; then
0013         echo $msg please run this as root >&2
0014         exit $ksft_skip
0015 fi
0016
0017 # This test needs to be run in a network namespace with in_netns.sh. Check if
0018 # this is the case and run it with in_netns.sh if it is being run in the root
0019 # namespace.
0020 if [[ -z $(ip netns identify $$) ]]; then
0021         err=0
0022         if bpftool="$(which bpftool)"; then
0023                 echo "Testing global flow dissector..."
0024
0025                 $bpftool prog loadall ./bpf_flow.o /sys/fs/bpf/flow \
0026                         type flow_dissector
0027
0028                 if ! unshare --net $bpftool prog attach pinned \
0029                         /sys/fs/bpf/flow/_dissect flow_dissector; then
0030                         echo "Unexpected unsuccessful attach in namespace" >&2
0031                         err=1
0032                 fi
0033
0034                 $bpftool prog attach pinned /sys/fs/bpf/flow/_dissect \
0035                         flow_dissector
0036
0037                 if unshare --net $bpftool prog attach pinned \
0038                         /sys/fs/bpf/flow/_dissect flow_dissector; then
0039                         echo "Unexpected successful attach in namespace" >&2
0040                         err=1
0041                 fi
0042
0043                 if ! $bpftool prog detach pinned \
0044                         /sys/fs/bpf/flow/_dissect flow_dissector; then
0045                         echo "Failed to detach flow dissector" >&2
0046                         err=1
0047                 fi
0048
0049                 rm -rf /sys/fs/bpf/flow
0050         else
0051                 echo "Skipping root flow dissector test, bpftool not found" >&2
0052         fi
0053
0054         # Run the rest of the tests in a net namespace.
0055         ../net/in_netns.sh "$0" "$@"
0056         err=$(( $err + $? ))
0057
0058         if (( $err == 0 )); then
0059                 echo "selftests: $TESTNAME [PASS]";
0060         else
0061                 echo "selftests: $TESTNAME [FAILED]";
0062         fi
0063
0064         exit $err
0065 fi
0066
0067 # Determine selftest success via shell exit code
0068 exit_handler()
0069 {
0070         set +e
0071
0072         # Cleanup
0073         tc filter del dev lo ingress pref 1337 2> /dev/null
0074         tc qdisc del dev lo ingress 2> /dev/null
0075         ./flow_dissector_load -d 2> /dev/null
0076         if [ $unmount -ne 0 ]; then
0077                 umount bpffs 2> /dev/null
0078         fi
0079 }
0080
0081 # Exit script immediately (well catched by trap handler) if any
0082 # program/thing exits with a non-zero status.
0083 set -e
0084
0085 # (Use 'trap -l' to list meaning of numbers)
0086 trap exit_handler 0 2 3 6 9
0087
0088 # Mount BPF file system
0089 if /bin/mount | grep /sys/fs/bpf > /dev/null; then
0090         echo "bpffs already mounted"
0091 else
0092         echo "bpffs not mounted. Mounting..."
0093         unmount=1
0094         /bin/mount bpffs /sys/fs/bpf -t bpf
0095 fi
0096
0097 # Attach BPF program
0098 ./flow_dissector_load -p bpf_flow.o -s _dissect
0099
0100 # Setup
0101 tc qdisc add dev lo ingress
0102 echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
0103 echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
0104 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter
0105
0106 echo "Testing IPv4..."
0107 # Drops all IP/UDP packets coming from port 9
0108 tc filter add dev lo parent ffff: protocol ip pref 1337 flower ip_proto \
0109         udp src_port 9 action drop
0110
0111 # Send 10 IPv4/UDP packets from port 8. Filter should not drop any.
0112 ./test_flow_dissector -i 4 -f 8
0113 # Send 10 IPv4/UDP packets from port 9. Filter should drop all.
0114 ./test_flow_dissector -i 4 -f 9 -F
0115 # Send 10 IPv4/UDP packets from port 10. Filter should not drop any.
0116 ./test_flow_dissector -i 4 -f 10
0117
0118 echo "Testing IPIP..."
0119 # Send 10 IPv4/IPv4/UDP packets from port 8. Filter should not drop any.
0120 ./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e bare -i 4 \
0121         -D 192.168.0.1 -S 1.1.1.1 -f 8
0122 # Send 10 IPv4/IPv4/UDP packets from port 9. Filter should drop all.
0123 ./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e bare -i 4 \
0124         -D 192.168.0.1 -S 1.1.1.1 -f 9 -F
0125 # Send 10 IPv4/IPv4/UDP packets from port 10. Filter should not drop any.
0126 ./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e bare -i 4 \
0127         -D 192.168.0.1 -S 1.1.1.1 -f 10
0128
0129 echo "Testing IPv4 + GRE..."
0130 # Send 10 IPv4/GRE/IPv4/UDP packets from port 8. Filter should not drop any.
0131 ./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e gre -i 4 \
0132         -D 192.168.0.1 -S 1.1.1.1 -f 8
0133 # Send 10 IPv4/GRE/IPv4/UDP packets from port 9. Filter should drop all.
0134 ./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e gre -i 4 \
0135         -D 192.168.0.1 -S 1.1.1.1 -f 9 -F
0136 # Send 10 IPv4/GRE/IPv4/UDP packets from port 10. Filter should not drop any.
0137 ./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e gre -i 4 \
0138         -D 192.168.0.1 -S 1.1.1.1 -f 10
0139
0140 tc filter del dev lo ingress pref 1337
0141
0142 echo "Testing port range..."
0143 # Drops all IP/UDP packets coming from port 8-10
0144 tc filter add dev lo parent ffff: protocol ip pref 1337 flower ip_proto \
0145         udp src_port 8-10 action drop
0146
0147 # Send 10 IPv4/UDP packets from port 7. Filter should not drop any.
0148 ./test_flow_dissector -i 4 -f 7
0149 # Send 10 IPv4/UDP packets from port 9. Filter should drop all.
0150 ./test_flow_dissector -i 4 -f 9 -F
0151 # Send 10 IPv4/UDP packets from port 11. Filter should not drop any.
0152 ./test_flow_dissector -i 4 -f 11
0153
0154 tc filter del dev lo ingress pref 1337
0155
0156 echo "Testing IPv6..."
0157 # Drops all IPv6/UDP packets coming from port 9
0158 tc filter add dev lo parent ffff: protocol ipv6 pref 1337 flower ip_proto \
0159         udp src_port 9 action drop
0160
0161 # Send 10 IPv6/UDP packets from port 8. Filter should not drop any.
0162 ./test_flow_dissector -i 6 -f 8
0163 # Send 10 IPv6/UDP packets from port 9. Filter should drop all.
0164 ./test_flow_dissector -i 6 -f 9 -F
0165 # Send 10 IPv6/UDP packets from port 10. Filter should not drop any.
0166 ./test_flow_dissector -i 6 -f 10
0167
0168 exit 0