| #!/bin/bash |
| # SPDX-License-Identifier: GPL-2.0 |
| # |
| # Test that blackhole routes are marked as offloaded and that packets hitting |
| # them are dropped by the ASIC and not by the kernel. |
| # |
| # +---------------------------------+ |
| # | H1 (vrf) | |
| # | + $h1 | |
| # | | 192.0.2.1/24 | |
| # | | 2001:db8:1::1/64 | |
| # | | | |
| # | | default via 192.0.2.2 | |
| # | | default via 2001:db8:1::2 | |
| # +----|----------------------------+ |
| # | |
| # +----|----------------------------------------------------------------------+ |
| # | SW | | |
| # | + $rp1 | |
| # | 192.0.2.2/24 | |
| # | 2001:db8:1::2/64 | |
| # | | |
| # | 2001:db8:2::2/64 | |
| # | 198.51.100.2/24 | |
| # | + $rp2 | |
| # | | | |
| # +----|----------------------------------------------------------------------+ |
| # | |
| # +----|----------------------------+ |
| # | | default via 198.51.100.2 | |
| # | | default via 2001:db8:2::2 | |
| # | | | |
| # | | 2001:db8:2::1/64 | |
| # | | 198.51.100.1/24 | |
| # | + $h2 | |
| # | H2 (vrf) | |
| # +---------------------------------+ |
| |
| lib_dir=$(dirname $0)/../../../net/forwarding |
| |
| ALL_TESTS=" |
| ping_ipv4 |
| ping_ipv6 |
| blackhole_ipv4 |
| blackhole_ipv6 |
| " |
| NUM_NETIFS=4 |
| : ${TIMEOUT:=20000} # ms |
| source $lib_dir/tc_common.sh |
| source $lib_dir/lib.sh |
| |
| h1_create() |
| { |
| simple_if_init $h1 192.0.2.1/24 2001:db8:1::1/64 |
| |
| ip -4 route add default vrf v$h1 nexthop via 192.0.2.2 |
| ip -6 route add default vrf v$h1 nexthop via 2001:db8:1::2 |
| } |
| |
| h1_destroy() |
| { |
| ip -6 route del default vrf v$h1 nexthop via 2001:db8:1::2 |
| ip -4 route del default vrf v$h1 nexthop via 192.0.2.2 |
| |
| simple_if_fini $h1 192.0.2.1/24 2001:db8:1::1/64 |
| } |
| |
| h2_create() |
| { |
| simple_if_init $h2 198.51.100.1/24 2001:db8:2::1/64 |
| |
| ip -4 route add default vrf v$h2 nexthop via 198.51.100.2 |
| ip -6 route add default vrf v$h2 nexthop via 2001:db8:2::2 |
| } |
| |
| h2_destroy() |
| { |
| ip -6 route del default vrf v$h2 nexthop via 2001:db8:2::2 |
| ip -4 route del default vrf v$h2 nexthop via 198.51.100.2 |
| |
| simple_if_fini $h2 198.51.100.1/24 2001:db8:2::1/64 |
| } |
| |
| router_create() |
| { |
| ip link set dev $rp1 up |
| ip link set dev $rp2 up |
| |
| tc qdisc add dev $rp1 clsact |
| |
| __addr_add_del $rp1 add 192.0.2.2/24 2001:db8:1::2/64 |
| __addr_add_del $rp2 add 198.51.100.2/24 2001:db8:2::2/64 |
| } |
| |
| router_destroy() |
| { |
| __addr_add_del $rp2 del 198.51.100.2/24 2001:db8:2::2/64 |
| __addr_add_del $rp1 del 192.0.2.2/24 2001:db8:1::2/64 |
| |
| tc qdisc del dev $rp1 clsact |
| |
| ip link set dev $rp2 down |
| ip link set dev $rp1 down |
| } |
| |
| ping_ipv4() |
| { |
| ping_test $h1 198.51.100.1 ": h1->h2" |
| } |
| |
| ping_ipv6() |
| { |
| ping6_test $h1 2001:db8:2::1 ": h1->h2" |
| } |
| |
| blackhole_ipv4() |
| { |
| # Transmit packets from H1 to H2 and make sure they are dropped by the |
| # ASIC and not by the kernel |
| RET=0 |
| |
| ip -4 route add blackhole 198.51.100.0/30 |
| tc filter add dev $rp1 ingress protocol ip pref 1 handle 101 flower \ |
| skip_hw dst_ip 198.51.100.1 src_ip 192.0.2.1 ip_proto icmp \ |
| action pass |
| |
| busywait "$TIMEOUT" wait_for_offload ip -4 route show 198.51.100.0/30 |
| check_err $? "route not marked as offloaded when should" |
| |
| ping_do $h1 198.51.100.1 |
| check_fail $? "ping passed when should not" |
| |
| tc_check_packets "dev $rp1 ingress" 101 0 |
| check_err $? "packets trapped and not dropped by ASIC" |
| |
| log_test "IPv4 blackhole route" |
| |
| tc filter del dev $rp1 ingress protocol ip pref 1 handle 101 flower |
| ip -4 route del blackhole 198.51.100.0/30 |
| } |
| |
| blackhole_ipv6() |
| { |
| RET=0 |
| |
| ip -6 route add blackhole 2001:db8:2::/120 |
| tc filter add dev $rp1 ingress protocol ipv6 pref 1 handle 101 flower \ |
| skip_hw dst_ip 2001:db8:2::1 src_ip 2001:db8:1::1 \ |
| ip_proto icmpv6 action pass |
| |
| busywait "$TIMEOUT" wait_for_offload ip -6 route show 2001:db8:2::/120 |
| check_err $? "route not marked as offloaded when should" |
| |
| ping6_do $h1 2001:db8:2::1 |
| check_fail $? "ping passed when should not" |
| |
| tc_check_packets "dev $rp1 ingress" 101 0 |
| check_err $? "packets trapped and not dropped by ASIC" |
| |
| log_test "IPv6 blackhole route" |
| |
| tc filter del dev $rp1 ingress protocol ipv6 pref 1 handle 101 flower |
| ip -6 route del blackhole 2001:db8:2::/120 |
| } |
| |
| setup_prepare() |
| { |
| h1=${NETIFS[p1]} |
| rp1=${NETIFS[p2]} |
| |
| rp2=${NETIFS[p3]} |
| h2=${NETIFS[p4]} |
| |
| vrf_prepare |
| forwarding_enable |
| |
| h1_create |
| h2_create |
| router_create |
| } |
| |
| cleanup() |
| { |
| pre_cleanup |
| |
| router_destroy |
| h2_destroy |
| h1_destroy |
| |
| forwarding_restore |
| vrf_cleanup |
| } |
| |
| trap cleanup EXIT |
| |
| setup_prepare |
| setup_wait |
| |
| tests_run |
| |
| exit $EXIT_STATUS |
