0001
0002
0003
0004 ALL_TESTS="gact_drop_and_ok_test mirred_egress_redirect_test \
0005 mirred_egress_mirror_test matchall_mirred_egress_mirror_test \
0006 gact_trap_test mirred_egress_to_ingress_test"
0007 NUM_NETIFS=4
0008 source tc_common.sh
0009 source lib.sh
0010
0011 tcflags="skip_hw"
0012
0013 h1_create()
0014 {
0015 simple_if_init $h1 192.0.2.1/24
0016 tc qdisc add dev $h1 clsact
0017 }
0018
0019 h1_destroy()
0020 {
0021 tc qdisc del dev $h1 clsact
0022 simple_if_fini $h1 192.0.2.1/24
0023 }
0024
0025 h2_create()
0026 {
0027 simple_if_init $h2 192.0.2.2/24
0028 tc qdisc add dev $h2 clsact
0029 }
0030
0031 h2_destroy()
0032 {
0033 tc qdisc del dev $h2 clsact
0034 simple_if_fini $h2 192.0.2.2/24
0035 }
0036
0037 switch_create()
0038 {
0039 simple_if_init $swp1 192.0.2.2/24
0040 tc qdisc add dev $swp1 clsact
0041
0042 simple_if_init $swp2 192.0.2.1/24
0043 }
0044
0045 switch_destroy()
0046 {
0047 simple_if_fini $swp2 192.0.2.1/24
0048
0049 tc qdisc del dev $swp1 clsact
0050 simple_if_fini $swp1 192.0.2.2/24
0051 }
0052
0053 mirred_egress_test()
0054 {
0055 local action=$1
0056 local protocol=$2
0057 local classifier=$3
0058 local classifier_args=$4
0059
0060 RET=0
0061
0062 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
0063 dst_ip 192.0.2.2 action drop
0064
0065 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
0066 -t ip -q
0067
0068 tc_check_packets "dev $h2 ingress" 101 1
0069 check_fail $? "Matched without redirect rule inserted"
0070
0071 tc filter add dev $swp1 ingress protocol $protocol pref 1 handle 101 \
0072 $classifier $tcflags $classifier_args \
0073 action mirred egress $action dev $swp2
0074
0075 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
0076 -t ip -q
0077
0078 tc_check_packets "dev $h2 ingress" 101 1
0079 check_err $? "Did not match incoming $action packet"
0080
0081 tc filter del dev $swp1 ingress protocol $protocol pref 1 handle 101 \
0082 $classifier
0083 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
0084
0085 log_test "mirred egress $classifier $action ($tcflags)"
0086 }
0087
0088 gact_drop_and_ok_test()
0089 {
0090 RET=0
0091
0092 tc filter add dev $swp1 ingress protocol ip pref 2 handle 102 flower \
0093 $tcflags dst_ip 192.0.2.2 action drop
0094
0095 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
0096 -t ip -q
0097
0098 tc_check_packets "dev $swp1 ingress" 102 1
0099 check_err $? "Packet was not dropped"
0100
0101 tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \
0102 $tcflags dst_ip 192.0.2.2 action ok
0103
0104 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
0105 -t ip -q
0106
0107 tc_check_packets "dev $swp1 ingress" 101 1
0108 check_err $? "Did not see passed packet"
0109
0110 tc_check_packets "dev $swp1 ingress" 102 2
0111 check_fail $? "Packet was dropped and it should not reach here"
0112
0113 tc filter del dev $swp1 ingress protocol ip pref 2 handle 102 flower
0114 tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower
0115
0116 log_test "gact drop and ok ($tcflags)"
0117 }
0118
0119 gact_trap_test()
0120 {
0121 RET=0
0122
0123 if [[ "$tcflags" != "skip_sw" ]]; then
0124 return 0;
0125 fi
0126
0127 tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \
0128 skip_hw dst_ip 192.0.2.2 action drop
0129 tc filter add dev $swp1 ingress protocol ip pref 3 handle 103 flower \
0130 $tcflags dst_ip 192.0.2.2 action mirred egress redirect \
0131 dev $swp2
0132
0133 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
0134 -t ip -q
0135
0136 tc_check_packets "dev $swp1 ingress" 101 1
0137 check_fail $? "Saw packet without trap rule inserted"
0138
0139 tc filter add dev $swp1 ingress protocol ip pref 2 handle 102 flower \
0140 $tcflags dst_ip 192.0.2.2 action trap
0141
0142 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
0143 -t ip -q
0144
0145 tc_check_packets "dev $swp1 ingress" 102 1
0146 check_err $? "Packet was not trapped"
0147
0148 tc_check_packets "dev $swp1 ingress" 101 1
0149 check_err $? "Did not see trapped packet"
0150
0151 tc filter del dev $swp1 ingress protocol ip pref 3 handle 103 flower
0152 tc filter del dev $swp1 ingress protocol ip pref 2 handle 102 flower
0153 tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower
0154
0155 log_test "trap ($tcflags)"
0156 }
0157
0158 mirred_egress_to_ingress_test()
0159 {
0160 RET=0
0161
0162 tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \
0163 ip_proto icmp src_ip 192.0.2.1 dst_ip 192.0.2.2 type 8 action \
0164 ct commit nat src addr 192.0.2.2 pipe \
0165 ct clear pipe \
0166 ct commit nat dst addr 192.0.2.1 pipe \
0167 mirred ingress redirect dev $h1
0168
0169 tc filter add dev $swp1 protocol ip pref 11 handle 111 ingress flower \
0170 ip_proto icmp src_ip 192.0.2.1 dst_ip 192.0.2.2 type 8 action drop
0171 tc filter add dev $swp1 protocol ip pref 12 handle 112 ingress flower \
0172 ip_proto icmp src_ip 192.0.2.1 dst_ip 192.0.2.2 type 0 action pass
0173
0174 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
0175 -t icmp "ping,id=42,seq=10" -q
0176
0177 tc_check_packets "dev $h1 egress" 100 1
0178 check_err $? "didn't mirror first packet"
0179
0180 tc_check_packets "dev $swp1 ingress" 111 1
0181 check_fail $? "didn't redirect first packet"
0182 tc_check_packets "dev $swp1 ingress" 112 1
0183 check_err $? "didn't receive reply to first packet"
0184
0185 ping 192.0.2.2 -I$h1 -c1 -w1 -q 1>/dev/null 2>&1
0186
0187 tc_check_packets "dev $h1 egress" 100 2
0188 check_err $? "didn't mirror second packet"
0189 tc_check_packets "dev $swp1 ingress" 111 1
0190 check_fail $? "didn't redirect second packet"
0191 tc_check_packets "dev $swp1 ingress" 112 2
0192 check_err $? "didn't receive reply to second packet"
0193
0194 tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower
0195 tc filter del dev $swp1 ingress protocol ip pref 11 handle 111 flower
0196 tc filter del dev $swp1 ingress protocol ip pref 12 handle 112 flower
0197
0198 log_test "mirred_egress_to_ingress ($tcflags)"
0199 }
0200
0201 setup_prepare()
0202 {
0203 h1=${NETIFS[p1]}
0204 swp1=${NETIFS[p2]}
0205
0206 swp2=${NETIFS[p3]}
0207 h2=${NETIFS[p4]}
0208
0209 h1mac=$(mac_get $h1)
0210 h2mac=$(mac_get $h2)
0211
0212 swp1origmac=$(mac_get $swp1)
0213 swp2origmac=$(mac_get $swp2)
0214 ip link set $swp1 address $h2mac
0215 ip link set $swp2 address $h1mac
0216
0217 vrf_prepare
0218
0219 h1_create
0220 h2_create
0221 switch_create
0222 }
0223
0224 cleanup()
0225 {
0226 pre_cleanup
0227
0228 switch_destroy
0229 h2_destroy
0230 h1_destroy
0231
0232 vrf_cleanup
0233
0234 ip link set $swp2 address $swp2origmac
0235 ip link set $swp1 address $swp1origmac
0236 }
0237
0238 mirred_egress_redirect_test()
0239 {
0240 mirred_egress_test "redirect" "ip" "flower" "dst_ip 192.0.2.2"
0241 }
0242
0243 mirred_egress_mirror_test()
0244 {
0245 mirred_egress_test "mirror" "ip" "flower" "dst_ip 192.0.2.2"
0246 }
0247
0248 matchall_mirred_egress_mirror_test()
0249 {
0250 mirred_egress_test "mirror" "all" "matchall" ""
0251 }
0252
0253 trap cleanup EXIT
0254
0255 setup_prepare
0256 setup_wait
0257
0258 tests_run
0259
0260 tc_offload_check
0261 if [[ $? -ne 0 ]]; then
0262 log_info "Could not test offloaded functionality"
0263 else
0264 tcflags="skip_sw"
0265 tests_run
0266 fi
0267
0268 exit $EXIT_STATUS
