Skip to content

L
linux
Commit 7a4e0801 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files
Options

Merge branch 'selftests-fib_rule_tests-cleanups-and-new-tests' 

Ido Schimmel says:

====================
selftests: fib_rule_tests: Cleanups and new tests

This patchset performs some cleanups and adds new tests in preparation
for upcoming FIB rule DSCP selector.
====================

Link: https://patch.msgid.link/20240814111005.955359-1-idosch@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 5da65c41 5f1b4f1b
Hide whitespace changes
Inline Side-by-side
Showing with 135 additions and 46 deletions
tools/testing/selftests/net/fib_rule_tests.sh
View file @ 7a4e0801
......@@ -35,18 +35,13 @@ log_test()
local expected=$2
local msg="$3"
$IP rule show | grep -q l3mdev
if [ $? -eq 0 ]; then
msg="$msg (VRF)"
fi
if [ ${rc} -eq ${expected} ]; then
nsuccess=$((nsuccess+1))
printf "\n TEST: %-60s [ OK ]\n" "${msg}"
printf " TEST: %-60s [ OK ]\n" "${msg}"
else
ret=1
nfail=$((nfail+1))
printf "\n TEST: %-60s [FAIL]\n" "${msg}"
printf " TEST: %-60s [FAIL]\n" "${msg}"
if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
echo
echo "hit enter to continue, 'q' to quit"
......@@ -56,14 +51,6 @@ log_test()
fi
}
log_section()
{
echo
echo "######################################################################"
echo "TEST SECTION: $*"
echo "######################################################################"
}
check_nettest()
{
if which nettest > /dev/null 2>&1; then
......@@ -187,12 +174,17 @@ fib_rule6_test_match_n_redirect()
{
local match="$1"
local getmatch="$2"
local description="$3"
local getnomatch="$3"
local description="$4"
local nomatch_description="$5"
$IP -6 rule add $match table $RTABLE
$IP -6 route get $GW_IP6 $getmatch | grep -q "table $RTABLE"
log_test $? 0 "rule6 check: $description"
$IP -6 route get $GW_IP6 $getnomatch 2>&1 | grep -q "table $RTABLE"
log_test $? 1 "rule6 check: $nomatch_description"
fib_rule6_del_by_pref "$match"
log_test $? 0 "rule6 del by pref: $description"
}
......@@ -213,18 +205,27 @@ fib_rule6_test_reject()
fib_rule6_test()
{
local ext_name=$1; shift
local getnomatch
local getmatch
local match
local cnt
echo
echo "IPv6 FIB rule tests $ext_name"
# setup the fib rule redirect route
$IP -6 route add table $RTABLE default via $GW_IP6 dev $DEV onlink
match="oif $DEV"
fib_rule6_test_match_n_redirect "$match" "$match" "oif redirect to table"
getnomatch="oif lo"
fib_rule6_test_match_n_redirect "$match" "$match" "$getnomatch" \
"oif redirect to table" "oif no redirect to table"
match="from $SRC_IP6 iif $DEV"
fib_rule6_test_match_n_redirect "$match" "$match" "iif redirect to table"
getnomatch="from $SRC_IP6 iif lo"
fib_rule6_test_match_n_redirect "$match" "$match" "$getnomatch" \
"iif redirect to table" "iif no redirect to table"
# Reject dsfield (tos) options which have ECN bits set
for cnt in $(seq 1 3); do
......@@ -238,44 +239,72 @@ fib_rule6_test()
# Using option 'tos' instead of 'dsfield' as old iproute2
# versions don't support 'dsfield' in ip rule show.
getmatch="tos $cnt"
getnomatch="tos 0x20"
fib_rule6_test_match_n_redirect "$match" "$getmatch" \
"$getmatch redirect to table"
"$getnomatch" "$getmatch redirect to table" \
"$getnomatch no redirect to table"
done
# Re-test TOS matching, but with input routes since they are handled
# differently from output routes.
match="tos 0x10"
for cnt in "0x10" "0x11" "0x12" "0x13"; do
getmatch="tos $cnt"
getnomatch="tos 0x20"
fib_rule6_test_match_n_redirect "$match" \
"from $SRC_IP6 iif $DEV $getmatch" \
"from $SRC_IP6 iif $DEV $getnomatch" \
"iif $getmatch redirect to table" \
"iif $getnomatch no redirect to table"
done
match="fwmark 0x64"
getmatch="mark 0x64"
fib_rule6_test_match_n_redirect "$match" "$getmatch" "fwmark redirect to table"
getnomatch="mark 0x63"
fib_rule6_test_match_n_redirect "$match" "$getmatch" "$getnomatch" \
"fwmark redirect to table" "fwmark no redirect to table"
fib_check_iproute_support "uidrange" "uid"
if [ $? -eq 0 ]; then
match="uidrange 100-100"
getmatch="uid 100"
fib_rule6_test_match_n_redirect "$match" "$getmatch" "uid redirect to table"
getnomatch="uid 101"
fib_rule6_test_match_n_redirect "$match" "$getmatch" \
"$getnomatch" "uid redirect to table" \
"uid no redirect to table"
fi
fib_check_iproute_support "sport" "sport"
if [ $? -eq 0 ]; then
match="sport 666 dport 777"
fib_rule6_test_match_n_redirect "$match" "$match" "sport and dport redirect to table"
getnomatch="sport 667 dport 778"
fib_rule6_test_match_n_redirect "$match" "$match" \
"$getnomatch" "sport and dport redirect to table" \
"sport and dport no redirect to table"
fi
fib_check_iproute_support "ipproto" "ipproto"
if [ $? -eq 0 ]; then
match="ipproto tcp"
fib_rule6_test_match_n_redirect "$match" "$match" "ipproto match"
getnomatch="ipproto udp"
fib_rule6_test_match_n_redirect "$match" "$match" \
"$getnomatch" "ipproto tcp match" "ipproto udp no match"
fi
fib_check_iproute_support "ipproto" "ipproto"
if [ $? -eq 0 ]; then
match="ipproto ipv6-icmp"
fib_rule6_test_match_n_redirect "$match" "$match" "ipproto ipv6-icmp match"
getnomatch="ipproto tcp"
fib_rule6_test_match_n_redirect "$match" "$match" \
"$getnomatch" "ipproto ipv6-icmp match" \
"ipproto ipv6-tcp no match"
fi
}
fib_rule6_vrf_test()
{
setup_vrf
fib_rule6_test
fib_rule6_test "- with VRF"
cleanup_vrf
}
......@@ -285,6 +314,9 @@ fib_rule6_connect_test()
{
local dsfield
echo
echo "IPv6 FIB rule connect tests"
if ! check_nettest; then
echo "SKIP: Could not run test without nettest tool"
return
......@@ -306,6 +338,16 @@ fib_rule6_connect_test()
log_test $? 0 "rule6 dsfield tcp connect (dsfield ${dsfield})"
done
# Check that UDP and TCP connections fail when using a DS Field that
# does not match the previously configured FIB rule.
nettest -q -6 -B -t 5 -N $testns -O $peerns -U -D \
-Q 0x20 -l 2001:db8::1:11 -r 2001:db8::1:11
log_test $? 1 "rule6 dsfield udp no connect (dsfield 0x20)"
nettest -q -6 -B -t 5 -N $testns -O $peerns -Q 0x20 \
-l 2001:db8::1:11 -r 2001:db8::1:11
log_test $? 1 "rule6 dsfield tcp no connect (dsfield 0x20)"
$IP -6 rule del dsfield 0x04 table $RTABLE_PEER
cleanup_peer
}
......@@ -326,12 +368,17 @@ fib_rule4_test_match_n_redirect()
{
local match="$1"
local getmatch="$2"
local description="$3"
local getnomatch="$3"
local description="$4"
local nomatch_description="$5"
$IP rule add $match table $RTABLE
$IP route get $GW_IP4 $getmatch | grep -q "table $RTABLE"
log_test $? 0 "rule4 check: $description"
$IP route get $GW_IP4 $getnomatch 2>&1 | grep -q "table $RTABLE"
log_test $? 1 "rule4 check: $nomatch_description"
fib_rule4_del_by_pref "$match"
log_test $? 0 "rule4 del by pref: $description"
}
......@@ -352,23 +399,31 @@ fib_rule4_test_reject()
fib_rule4_test()
{
local ext_name=$1; shift
local getnomatch
local getmatch
local match
local cnt
echo
echo "IPv4 FIB rule tests $ext_name"
# setup the fib rule redirect route
$IP route add table $RTABLE default via $GW_IP4 dev $DEV onlink
match="oif $DEV"
fib_rule4_test_match_n_redirect "$match" "$match" "oif redirect to table"
getnomatch="oif lo"
fib_rule4_test_match_n_redirect "$match" "$match" "$getnomatch" \
"oif redirect to table" "oif no redirect to table"
# need enable forwarding and disable rp_filter temporarily as all the
# addresses are in the same subnet and egress device == ingress device.
# Enable forwarding and disable rp_filter as all the addresses are in
# the same subnet and egress device == ingress device.
ip netns exec $testns sysctl -qw net.ipv4.ip_forward=1
ip netns exec $testns sysctl -qw net.ipv4.conf.$DEV.rp_filter=0
match="from $SRC_IP iif $DEV"
fib_rule4_test_match_n_redirect "$match" "$match" "iif redirect to table"
ip netns exec $testns sysctl -qw net.ipv4.ip_forward=0
getnomatch="from $SRC_IP iif lo"
fib_rule4_test_match_n_redirect "$match" "$match" "$getnomatch" \
"iif redirect to table" "iif no redirect to table"
# Reject dsfield (tos) options which have ECN bits set
for cnt in $(seq 1 3); do
......@@ -382,44 +437,73 @@ fib_rule4_test()
# Using option 'tos' instead of 'dsfield' as old iproute2
# versions don't support 'dsfield' in ip rule show.
getmatch="tos $cnt"
getnomatch="tos 0x20"
fib_rule4_test_match_n_redirect "$match" "$getmatch" \
"$getmatch redirect to table"
"$getnomatch" "$getmatch redirect to table" \
"$getnomatch no redirect to table"
done
# Re-test TOS matching, but with input routes since they are handled
# differently from output routes.
match="tos 0x10"
for cnt in "0x10" "0x11" "0x12" "0x13"; do
getmatch="tos $cnt"
getnomatch="tos 0x20"
fib_rule4_test_match_n_redirect "$match" \
"from $SRC_IP iif $DEV $getmatch" \
"from $SRC_IP iif $DEV $getnomatch" \
"iif $getmatch redirect to table" \
"iif $getnomatch no redirect to table"
done
match="fwmark 0x64"
getmatch="mark 0x64"
fib_rule4_test_match_n_redirect "$match" "$getmatch" "fwmark redirect to table"
getnomatch="mark 0x63"
fib_rule4_test_match_n_redirect "$match" "$getmatch" "$getnomatch" \
"fwmark redirect to table" "fwmark no redirect to table"
fib_check_iproute_support "uidrange" "uid"
if [ $? -eq 0 ]; then
match="uidrange 100-100"
getmatch="uid 100"
fib_rule4_test_match_n_redirect "$match" "$getmatch" "uid redirect to table"
getnomatch="uid 101"
fib_rule4_test_match_n_redirect "$match" "$getmatch" \
"$getnomatch" "uid redirect to table" \
"uid no redirect to table"
fi
fib_check_iproute_support "sport" "sport"
if [ $? -eq 0 ]; then
match="sport 666 dport 777"
fib_rule4_test_match_n_redirect "$match" "$match" "sport and dport redirect to table"
getnomatch="sport 667 dport 778"
fib_rule4_test_match_n_redirect "$match" "$match" \
"$getnomatch" "sport and dport redirect to table" \
"sport and dport no redirect to table"
fi
fib_check_iproute_support "ipproto" "ipproto"
if [ $? -eq 0 ]; then
match="ipproto tcp"
fib_rule4_test_match_n_redirect "$match" "$match" "ipproto tcp match"
getnomatch="ipproto udp"
fib_rule4_test_match_n_redirect "$match" "$match" \
"$getnomatch" "ipproto tcp match" \
"ipproto udp no match"
fi
fib_check_iproute_support "ipproto" "ipproto"
if [ $? -eq 0 ]; then
match="ipproto icmp"
fib_rule4_test_match_n_redirect "$match" "$match" "ipproto icmp match"
getnomatch="ipproto tcp"
fib_rule4_test_match_n_redirect "$match" "$match" \
"$getnomatch" "ipproto icmp match" \
"ipproto tcp no match"
fi
}
fib_rule4_vrf_test()
{
setup_vrf
fib_rule4_test
fib_rule4_test "- with VRF"
cleanup_vrf
}
......@@ -429,6 +513,9 @@ fib_rule4_connect_test()
{
local dsfield
echo
echo "IPv4 FIB rule connect tests"
if ! check_nettest; then
echo "SKIP: Could not run test without nettest tool"
return
......@@ -450,17 +537,19 @@ fib_rule4_connect_test()
log_test $? 0 "rule4 dsfield tcp connect (dsfield ${dsfield})"
done
# Check that UDP and TCP connections fail when using a DS Field that
# does not match the previously configured FIB rule.
nettest -q -B -t 5 -N $testns -O $peerns -D -U -Q 0x20 \
-l 198.51.100.11 -r 198.51.100.11
log_test $? 1 "rule4 dsfield udp no connect (dsfield 0x20)"
nettest -q -B -t 5 -N $testns -O $peerns -Q 0x20 \
-l 198.51.100.11 -r 198.51.100.11
log_test $? 1 "rule4 dsfield tcp no connect (dsfield 0x20)"
$IP -4 rule del dsfield 0x04 table $RTABLE_PEER
cleanup_peer
}
run_fibrule_tests()
{
log_section "IPv4 fib rule"
fib_rule4_test
log_section "IPv6 fib rule"
fib_rule6_test
}
################################################################################
# usage
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7