blob: f02d83e945767c9d9f626f503534fc1fdd060e3a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
|
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# Test a "one-armed router" [1] scenario. Packets forwarded between H1 and H2
# should be forwarded by the ASIC, but also trapped so that ICMP redirect
# packets could be potentially generated.
#
# 1. https://en.wikipedia.org/wiki/One-armed_router
#
# +---------------------------------+
# | H1 (vrf) |
# | + $h1 |
# | | 192.0.2.1/24 |
# | | 2001:db8:1::1/64 |
# | | |
# | | default via 192.0.2.2 |
# | | default via 2001:db8:1::2 |
# +----|----------------------------+
# |
# +----|----------------------------------------------------------------------+
# | SW | |
# | +--|--------------------------------------------------------------------+ |
# | | + $swp1 BR0 (802.1d) | |
# | | | |
# | | 192.0.2.2/24 | |
# | | 2001:db8:1::2/64 | |
# | | 198.51.100.2/24 | |
# | | 2001:db8:2::2/64 | |
# | | | |
# | | + $swp2 | |
# | +--|--------------------------------------------------------------------+ |
# | | |
# +----|----------------------------------------------------------------------+
# |
# +----|----------------------------+
# | | default via 198.51.100.2 |
# | | default via 2001:db8:2::2 |
# | | |
# | | 2001:db8:2::1/64 |
# | | 198.51.100.1/24 |
# | + $h2 |
# | H2 (vrf) |
# +---------------------------------+
lib_dir=$(dirname $0)/../../../net/forwarding
ALL_TESTS="ping_ipv4 ping_ipv6 fwd_mark_ipv4 fwd_mark_ipv6"
NUM_NETIFS=4
source $lib_dir/tc_common.sh
source $lib_dir/lib.sh
h1_create()
{
simple_if_init $h1 192.0.2.1/24 2001:db8:1::1/64
ip -4 route add default vrf v$h1 nexthop via 192.0.2.2
ip -6 route add default vrf v$h1 nexthop via 2001:db8:1::2
}
h1_destroy()
{
ip -6 route del default vrf v$h1 nexthop via 2001:db8:1::2
ip -4 route del default vrf v$h1 nexthop via 192.0.2.2
simple_if_fini $h1 192.0.2.1/24 2001:db8:1::1/64
}
h2_create()
{
simple_if_init $h2 198.51.100.1/24 2001:db8:2::1/64
ip -4 route add default vrf v$h2 nexthop via 198.51.100.2
ip -6 route add default vrf v$h2 nexthop via 2001:db8:2::2
}
h2_destroy()
{
ip -6 route del default vrf v$h2 nexthop via 2001:db8:2::2
ip -4 route del default vrf v$h2 nexthop via 198.51.100.2
simple_if_fini $h2 198.51.100.1/24 2001:db8:2::1/64
}
switch_create()
{
ip link add name br0 type bridge mcast_snooping 0
ip link set dev br0 up
ip link set dev $swp1 master br0
ip link set dev $swp1 up
ip link set dev $swp2 master br0
ip link set dev $swp2 up
tc qdisc add dev $swp1 clsact
tc qdisc add dev $swp2 clsact
__addr_add_del br0 add 192.0.2.2/24 2001:db8:1::2/64
__addr_add_del br0 add 198.51.100.2/24 2001:db8:2::2/64
}
switch_destroy()
{
__addr_add_del br0 del 198.51.100.2/24 2001:db8:2::2/64
__addr_add_del br0 del 192.0.2.2/24 2001:db8:1::2/64
tc qdisc del dev $swp2 clsact
tc qdisc del dev $swp1 clsact
ip link set dev $swp2 down
ip link set dev $swp2 nomaster
ip link set dev $swp1 down
ip link set dev $swp1 nomaster
ip link set dev br0 down
ip link del dev br0
}
ping_ipv4()
{
ping_test $h1 198.51.100.1 ": h1->h2"
}
ping_ipv6()
{
ping6_test $h1 2001:db8:2::1 ": h1->h2"
}
fwd_mark_ipv4()
{
# Transmit packets from H1 to H2 and make sure they are trapped at
# swp1 due to loopback error, but only forwarded by the ASIC through
# swp2
tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \
skip_hw dst_ip 198.51.100.1 ip_proto udp dst_port 52768 \
action pass
tc filter add dev $swp2 egress protocol ip pref 1 handle 101 flower \
skip_hw dst_ip 198.51.100.1 ip_proto udp dst_port 52768 \
action pass
tc filter add dev $swp2 egress protocol ip pref 2 handle 102 flower \
skip_sw dst_ip 198.51.100.1 ip_proto udp dst_port 52768 \
action pass
ip vrf exec v$h1 $MZ $h1 -c 10 -d 100msec -p 64 -A 192.0.2.1 \
-B 198.51.100.1 -t udp dp=52768,sp=42768 -q
RET=0
tc_check_packets "dev $swp1 ingress" 101 10
check_err $?
log_test "fwd mark: trapping IPv4 packets due to LBERROR"
RET=0
tc_check_packets "dev $swp2 egress" 101 0
check_err $?
log_test "fwd mark: forwarding IPv4 packets in software"
RET=0
tc_check_packets "dev $swp2 egress" 102 10
check_err $?
log_test "fwd mark: forwarding IPv4 packets in hardware"
tc filter del dev $swp2 egress protocol ip pref 2 handle 102 flower
tc filter del dev $swp2 egress protocol ip pref 1 handle 101 flower
tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower
}
fwd_mark_ipv6()
{
tc filter add dev $swp1 ingress protocol ipv6 pref 1 handle 101 flower \
skip_hw dst_ip 2001:db8:2::1 ip_proto udp dst_port 52768 \
action pass
tc filter add dev $swp2 egress protocol ipv6 pref 1 handle 101 flower \
skip_hw dst_ip 2001:db8:2::1 ip_proto udp dst_port 52768 \
action pass
tc filter add dev $swp2 egress protocol ipv6 pref 2 handle 102 flower \
skip_sw dst_ip 2001:db8:2::1 ip_proto udp dst_port 52768 \
action pass
ip vrf exec v$h1 $MZ $h1 -6 -c 10 -d 100msec -p 64 -A 2001:db8:1::1 \
-B 2001:db8:2::1 -t udp dp=52768,sp=42768 -q
RET=0
tc_check_packets "dev $swp1 ingress" 101 10
check_err $?
log_test "fwd mark: trapping IPv6 packets due to LBERROR"
RET=0
tc_check_packets "dev $swp2 egress" 101 0
check_err $?
log_test "fwd mark: forwarding IPv6 packets in software"
RET=0
tc_check_packets "dev $swp2 egress" 102 10
check_err $?
log_test "fwd mark: forwarding IPv6 packets in hardware"
tc filter del dev $swp2 egress protocol ipv6 pref 2 handle 102 flower
tc filter del dev $swp2 egress protocol ipv6 pref 1 handle 101 flower
tc filter del dev $swp1 ingress protocol ipv6 pref 1 handle 101 flower
}
setup_prepare()
{
h1=${NETIFS[p1]}
swp1=${NETIFS[p2]}
swp2=${NETIFS[p3]}
h2=${NETIFS[p4]}
vrf_prepare
forwarding_enable
sysctl_set net.ipv4.conf.all.accept_redirects 0
sysctl_set net.ipv6.conf.all.accept_redirects 0
h1_create
h2_create
switch_create
}
cleanup()
{
pre_cleanup
switch_destroy
h2_destroy
h1_destroy
sysctl_restore net.ipv6.conf.all.accept_redirects
sysctl_restore net.ipv4.conf.all.accept_redirects
forwarding_restore
vrf_cleanup
}
trap cleanup EXIT
setup_prepare
setup_wait
tests_run
exit $EXIT_STATUS
|
