tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh - linux - Git at Google

 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 #
 # Test devlink-trap L3 drops functionality over mlxsw. Each registered L3 drop
 # packet trap is tested to make sure it is triggered under the right
 # conditions.

 # +---------------------------------+
 # | H1 (vrf)                        |
 # |    + $h1                        |
 # |    | 192.0.2.1/24               |
 # |    | 2001:db8:1::1/64           |
 # |    |                            |
 # |    |  default via 192.0.2.2     |
 # |    |  default via 2001:db8:1::2 |
 # +----|----------------------------+
 #      |
 # +----|----------------------------------------------------------------------+
 # | SW |                                                                      |
 # |    + $rp1                                                                 |
 # |        192.0.2.2/24                                                       |
 # |        2001:db8:1::2/64                                                   |
 # |                                                                           |
 # |        2001:db8:2::2/64                                                   |
 # |        198.51.100.2/24                                                    |
 # |    + $rp2                                                                 |
 # |    |                                                                      |
 # +----|----------------------------------------------------------------------+
 #      |
 # +----|----------------------------+
 # |    |  default via 198.51.100.2  |
 # |    |  default via 2001:db8:2::2 |
 # |    |                            |
 # |    | 2001:db8:2::1/64           |
 # |    | 198.51.100.1/24            |
 # |    + $h2                        |
 # | H2 (vrf)                        |
 # +---------------------------------+

 lib_dir=$(dirname $0)/../../../net/forwarding

 ALL_TESTS="
 	non_ip_test
 	uc_dip_over_mc_dmac_test
 	dip_is_loopback_test
 	sip_is_mc_test
 	sip_is_loopback_test
 	ip_header_corrupted_test
 	ipv4_sip_is_limited_bc_test
 	ipv6_mc_dip_reserved_scope_test
 	ipv6_mc_dip_interface_local_scope_test
 	blackhole_route_test
 	irif_disabled_test
 	erif_disabled_test
 	blackhole_nexthop_test
 "

 NUM_NETIFS=4
 source $lib_dir/lib.sh
 source $lib_dir/tc_common.sh
 source $lib_dir/devlink_lib.sh

 h1_create()
 {
 	simple_if_init $h1 192.0.2.1/24 2001:db8:1::1/64

 	ip -4 route add default vrf v$h1 nexthop via 192.0.2.2
 	ip -6 route add default vrf v$h1 nexthop via 2001:db8:1::2
 }

 h1_destroy()
 {
 	ip -6 route del default vrf v$h1 nexthop via 2001:db8:1::2
 	ip -4 route del default vrf v$h1 nexthop via 192.0.2.2

 	simple_if_fini $h1 192.0.2.1/24 2001:db8:1::1/64
 }

 h2_create()
 {
 	simple_if_init $h2 $h2_ipv4/24 $h2_ipv6/64

 	ip -4 route add default vrf v$h2 nexthop via 198.51.100.2
 	ip -6 route add default vrf v$h2 nexthop via 2001:db8:2::2
 }

 h2_destroy()
 {
 	ip -6 route del default vrf v$h2 nexthop via 2001:db8:2::2
 	ip -4 route del default vrf v$h2 nexthop via 198.51.100.2

 	simple_if_fini $h2 $h2_ipv4/24 $h2_ipv6/64
 }

 router_create()
 {
 	ip link set dev $rp1 up
 	ip link set dev $rp2 up

 	tc qdisc add dev $rp2 clsact

 	__addr_add_del $rp1 add 192.0.2.2/24 2001:db8:1::2/64
 	__addr_add_del $rp2 add 198.51.100.2/24 2001:db8:2::2/64
 }

 router_destroy()
 {
 	__addr_add_del $rp2 del 198.51.100.2/24 2001:db8:2::2/64
 	__addr_add_del $rp1 del 192.0.2.2/24 2001:db8:1::2/64

 	tc qdisc del dev $rp2 clsact

 	ip link set dev $rp2 down
 	ip link set dev $rp1 down
 }

 setup_prepare()
 {
 	h1=${NETIFS[p1]}
 	rp1=${NETIFS[p2]}

 	rp2=${NETIFS[p3]}
 	h2=${NETIFS[p4]}

 	h1mac=$(mac_get $h1)
 	rp1mac=$(mac_get $rp1)

 	h1_ipv4=192.0.2.1
 	h2_ipv4=198.51.100.1
 	h1_ipv6=2001:db8:1::1
 	h2_ipv6=2001:db8:2::1

 	vrf_prepare
 	forwarding_enable

 	h1_create
 	h2_create

 	router_create
 }

 cleanup()
 {
 	pre_cleanup

 	router_destroy

 	h2_destroy
 	h1_destroy

 	forwarding_restore
 	vrf_cleanup
 }

 ping_check()
 {
 	trap_name=$1; shift

 	devlink_trap_action_set $trap_name "trap"
 	ping_do $h1 $h2_ipv4
 	check_err $? "Packets that should not be trapped were trapped"
 	devlink_trap_action_set $trap_name "drop"
 }

 non_ip_test()
 {
 	local trap_name="non_ip"
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
 		flower dst_ip $h2_ipv4 action drop

 	# Generate non-IP packets to the router
 	$MZ $h1 -c 0 -p 100 -d 1msec -B $h2_ipv4 -q "$rp1mac $h1mac \
 		00:00 de:ad:be:ef" &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "Non IP"

 	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
 }

 __uc_dip_over_mc_dmac_test()
 {
 	local desc=$1; shift
 	local proto=$1; shift
 	local dip=$1; shift
 	local flags=${1:-""}; shift
 	local trap_name="uc_dip_over_mc_dmac"
 	local dmac=01:02:03:04:05:06
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
 		flower ip_proto udp src_port 54321 dst_port 12345 action drop

 	# Generate IP packets with a unicast IP and a multicast destination MAC
 	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $dmac \
 		-B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "Unicast destination IP over multicast destination MAC: $desc"

 	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
 }

 uc_dip_over_mc_dmac_test()
 {
 	__uc_dip_over_mc_dmac_test "IPv4" "ip" $h2_ipv4
 	__uc_dip_over_mc_dmac_test "IPv6" "ipv6" $h2_ipv6 "-6"
 }

 __sip_is_loopback_test()
 {
 	local desc=$1; shift
 	local proto=$1; shift
 	local sip=$1; shift
 	local dip=$1; shift
 	local flags=${1:-""}; shift
 	local trap_name="sip_is_loopback_address"
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
 		flower src_ip $sip action drop

 	# Generate packets with loopback source IP
 	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -A $sip \
 		-b $rp1mac -B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "Source IP is loopback address: $desc"

 	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
 }

 sip_is_loopback_test()
 {
 	__sip_is_loopback_test "IPv4" "ip" "127.0.0.0/8" $h2_ipv4
 	__sip_is_loopback_test "IPv6" "ipv6" "::1" $h2_ipv6 "-6"
 }

 __dip_is_loopback_test()
 {
 	local desc=$1; shift
 	local proto=$1; shift
 	local dip=$1; shift
 	local flags=${1:-""}; shift
 	local trap_name="dip_is_loopback_address"
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
 		flower dst_ip $dip action drop

 	# Generate packets with loopback destination IP
 	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $rp1mac \
 		-B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "Destination IP is loopback address: $desc"

 	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
 }

 dip_is_loopback_test()
 {
 	__dip_is_loopback_test "IPv4" "ip" "127.0.0.0/8"
 	__dip_is_loopback_test "IPv6" "ipv6" "::1" "-6"
 }

 __sip_is_mc_test()
 {
 	local desc=$1; shift
 	local proto=$1; shift
 	local sip=$1; shift
 	local dip=$1; shift
 	local flags=${1:-""}; shift
 	local trap_name="sip_is_mc"
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
 		flower src_ip $sip action drop

 	# Generate packets with multicast source IP
 	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -A $sip \
 		-b $rp1mac -B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "Source IP is multicast: $desc"

 	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
 }

 sip_is_mc_test()
 {
 	__sip_is_mc_test "IPv4" "ip" "239.1.1.1" $h2_ipv4
 	__sip_is_mc_test "IPv6" "ipv6" "FF02::2" $h2_ipv6 "-6"
 }

 ipv4_sip_is_limited_bc_test()
 {
 	local trap_name="ipv4_sip_is_limited_bc"
 	local sip=255.255.255.255
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
 		flower src_ip $sip action drop

 	# Generate packets with limited broadcast source IP
 	$MZ $h1 -t udp "sp=54321,dp=12345" -c 0 -p 100 -A $sip -b $rp1mac \
 		-B $h2_ipv4 -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "IPv4 source IP is limited broadcast"

 	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
 }

 ipv4_payload_get()
 {
 	local ipver=$1; shift
 	local ihl=$1; shift
 	local checksum=$1; shift

 	p=$(:
 		)"08:00:"$(                   : ETH type
 		)"$ipver"$(                   : IP version
 		)"$ihl:"$(                    : IHL
 		)"00:"$(		      : IP TOS
 		)"00:F4:"$(                   : IP total length
 		)"00:00:"$(                   : IP identification
 		)"20:00:"$(                   : IP flags + frag off
 		)"30:"$(                      : IP TTL
 		)"01:"$(                      : IP proto
 		)"$checksum:"$(               : IP header csum
 		)"$h1_ipv4:"$(                : IP saddr
 	        )"$h2_ipv4:"$(                : IP daddr
 		)
 	echo $p
 }

 __ipv4_header_corrupted_test()
 {
 	local desc=$1; shift
 	local ipver=$1; shift
 	local ihl=$1; shift
 	local checksum=$1; shift
 	local trap_name="ip_header_corrupted"
 	local payload
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
 		flower dst_ip $h2_ipv4 action drop

 	payload=$(ipv4_payload_get $ipver $ihl $checksum)

 	# Generate packets with corrupted IP header
 	$MZ $h1 -c 0 -d 1msec -a $h1mac -b $rp1mac -q p=$payload &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "IP header corrupted: $desc: IPv4"

 	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
 }

 ipv6_payload_get()
 {
 	local ipver=$1; shift

 	p=$(:
 		)"86:DD:"$(                  : ETH type
 		)"$ipver"$(                  : IP version
 		)"0:0:"$(                    : Traffic class
 		)"0:00:00:"$(		     : Flow label
 		)"00:00:"$(                  : Payload length
 		)"01:"$(                     : Next header
 		)"04:"$(                     : Hop limit
 		)"$h1_ipv6:"$(      	     : IP saddr
 		)"$h2_ipv6:"$(               : IP daddr
 		)
 	echo $p
 }

 __ipv6_header_corrupted_test()
 {
 	local desc=$1; shift
 	local ipver=$1; shift
 	local trap_name="ip_header_corrupted"
 	local payload
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
 		flower dst_ip $h2_ipv4 action drop

 	payload=$(ipv6_payload_get $ipver)

 	# Generate packets with corrupted IP header
 	$MZ $h1 -c 0 -d 1msec -a $h1mac -b $rp1mac -q p=$payload &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "IP header corrupted: $desc: IPv6"

 	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
 }

 ip_header_corrupted_test()
 {
 	# Each test uses one wrong value. The three values below are correct.
 	local ipv="4"
 	local ihl="5"
 	local checksum="00:F4"

 	__ipv4_header_corrupted_test "wrong IP version" 5 $ihl $checksum
 	__ipv4_header_corrupted_test "wrong IHL" $ipv 4 $checksum
 	__ipv4_header_corrupted_test "wrong checksum" $ipv $ihl "00:00"
 	__ipv6_header_corrupted_test "wrong IP version" 5
 }

 ipv6_mc_dip_reserved_scope_test()
 {
 	local trap_name="ipv6_mc_dip_reserved_scope"
 	local dip=FF00::
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol ipv6 pref 1 handle 101 \
 		flower dst_ip $dip action drop

 	# Generate packets with reserved scope destination IP
 	$MZ $h1 -6 -t udp "sp=54321,dp=12345" -c 0 -p 100 -b \
 		"33:33:00:00:00:00" -B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "IPv6 multicast destination IP reserved scope"

 	devlink_trap_drop_cleanup $mz_pid $rp2 "ipv6" 1 101
 }

 ipv6_mc_dip_interface_local_scope_test()
 {
 	local trap_name="ipv6_mc_dip_interface_local_scope"
 	local dip=FF01::
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	tc filter add dev $rp2 egress protocol ipv6 pref 1 handle 101 \
 		flower dst_ip $dip action drop

 	# Generate packets with interface local scope destination IP
 	$MZ $h1 -6 -t udp "sp=54321,dp=12345" -c 0 -p 100 -b \
 		"33:33:00:00:00:00" -B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101

 	log_test "IPv6 multicast destination IP interface-local scope"

 	devlink_trap_drop_cleanup $mz_pid $rp2 "ipv6" 1 101
 }

 __blackhole_route_test()
 {
 	local flags=$1; shift
 	local subnet=$1; shift
 	local proto=$1; shift
 	local dip=$1; shift
 	local ip_proto=${1:-"icmp"}; shift
 	local trap_name="blackhole_route"
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	ip -$flags route add blackhole $subnet
 	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
 		flower skip_hw dst_ip $dip ip_proto $ip_proto action drop

 	# Generate packets to the blackhole route
 	$MZ $h1 -$flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $rp1mac \
 		-B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101
 	log_test "Blackhole route: IPv$flags"

 	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
 	ip -$flags route del blackhole $subnet
 }

 blackhole_route_test()
 {
 	__blackhole_route_test "4" "198.51.100.0/30" "ip" $h2_ipv4
 	__blackhole_route_test "6" "2001:db8:2::/120" "ipv6" $h2_ipv6 "icmpv6"
 }

 irif_disabled_test()
 {
 	local trap_name="irif_disabled"
 	local t0_packets t0_bytes
 	local t1_packets t1_bytes
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	devlink_trap_action_set $trap_name "trap"

 	# When RIF of a physical port ("Sub-port RIF") is destroyed, we first
 	# block the STP of the {Port, VLAN} so packets cannot get into the RIF.
 	# Using bridge enables us to see this trap because when bridge is
 	# destroyed, there is a small time window that packets can go into the
 	# RIF, while it is disabled.
 	ip link add dev br0 type bridge
 	ip link set dev $rp1 master br0
 	ip address flush dev $rp1
 	__addr_add_del br0 add 192.0.2.2/24
 	ip li set dev br0 up

 	t0_packets=$(devlink_trap_rx_packets_get $trap_name)
 	t0_bytes=$(devlink_trap_rx_bytes_get $trap_name)

 	# Generate packets to h2 through br0 RIF that will be removed later
 	$MZ $h1 -t udp "sp=54321,dp=12345" -c 0 -p 100 -a own -b $rp1mac \
 		-B $h2_ipv4 -q &
 	mz_pid=$!

 	# Wait before removing br0 RIF to allow packets to go into the bridge.
 	sleep 1

 	# Flushing address will dismantle the RIF
 	ip address flush dev br0

 	t1_packets=$(devlink_trap_rx_packets_get $trap_name)
 	t1_bytes=$(devlink_trap_rx_bytes_get $trap_name)

 	if [[ $t0_packets -eq $t1_packets && $t0_bytes -eq $t1_bytes ]]; then
 		check_err 1 "Trap stats idle when packets should be trapped"
 	fi

 	log_test "Ingress RIF disabled"

 	kill $mz_pid && wait $mz_pid &> /dev/null
 	ip link set dev $rp1 nomaster
 	__addr_add_del $rp1 add 192.0.2.2/24 2001:db8:1::2/64
 	ip link del dev br0 type bridge
 	devlink_trap_action_set $trap_name "drop"
 }

 erif_disabled_test()
 {
 	local trap_name="erif_disabled"
 	local t0_packets t0_bytes
 	local t1_packets t1_bytes
 	local mz_pid

 	RET=0

 	ping_check $trap_name

 	devlink_trap_action_set $trap_name "trap"
 	ip link add dev br0 type bridge
 	ip add flush dev $rp1
 	ip link set dev $rp1 master br0
 	__addr_add_del br0 add 192.0.2.2/24
 	ip link set dev br0 up

 	t0_packets=$(devlink_trap_rx_packets_get $trap_name)
 	t0_bytes=$(devlink_trap_rx_bytes_get $trap_name)

 	rp2mac=$(mac_get $rp2)

 	# Generate packets that should go out through br0 RIF that will be
 	# removed later
 	$MZ $h2 -t udp "sp=54321,dp=12345" -c 0 -p 100 -a own -b $rp2mac \
 		-B 192.0.2.1 -q &
 	mz_pid=$!

 	sleep 5
 	# Unlinking the port from the bridge will disable the RIF associated
 	# with br0 as it is no longer an upper of any mlxsw port.
 	ip link set dev $rp1 nomaster

 	t1_packets=$(devlink_trap_rx_packets_get $trap_name)
 	t1_bytes=$(devlink_trap_rx_bytes_get $trap_name)

 	if [[ $t0_packets -eq $t1_packets && $t0_bytes -eq $t1_bytes ]]; then
 		check_err 1 "Trap stats idle when packets should be trapped"
 	fi

 	log_test "Egress RIF disabled"

 	kill $mz_pid && wait $mz_pid &> /dev/null
 	__addr_add_del $rp1 add 192.0.2.2/24 2001:db8:1::2/64
 	ip link del dev br0 type bridge
 	devlink_trap_action_set $trap_name "drop"
 }

 __blackhole_nexthop_test()
 {
 	local flags=$1; shift
 	local subnet=$1; shift
 	local proto=$1; shift
 	local dip=$1; shift
 	local trap_name="blackhole_nexthop"
 	local mz_pid

 	RET=0

 	ip -$flags nexthop add id 1 blackhole
 	ip -$flags route add $subnet nhid 1
 	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
 		flower skip_hw dst_ip $dip ip_proto udp action drop

 	# Generate packets to the blackhole nexthop
 	$MZ $h1 -$flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $rp1mac \
 		-B $dip -d 1msec -q &
 	mz_pid=$!

 	devlink_trap_drop_test $trap_name $rp2 101
 	log_test "Blackhole nexthop: IPv$flags"

 	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
 	ip -$flags route del $subnet
 	ip -$flags nexthop del id 1
 }

 blackhole_nexthop_test()
 {
 	__blackhole_nexthop_test "4" "198.51.100.0/30" "ip" $h2_ipv4
 	__blackhole_nexthop_test "6" "2001:db8:2::/120" "ipv6" $h2_ipv6
 }

 trap cleanup EXIT

 setup_prepare
 setup_wait

 tests_run

 exit $EXIT_STATUS
	#!/bin/bash
	# SPDX-License-Identifier: GPL-2.0
	#
	# Test devlink-trap L3 drops functionality over mlxsw. Each registered L3 drop
	# packet trap is tested to make sure it is triggered under the right
	# conditions.

	# +---------------------------------+
	# \| H1 (vrf) \|
	# \| + $h1 \|
	# \| \| 192.0.2.1/24 \|
	# \| \| 2001:db8:1::1/64 \|
	# \| \| \|
	# \| \| default via 192.0.2.2 \|
	# \| \| default via 2001:db8:1::2 \|
	# +----\|----------------------------+
	# \|
	# +----\|----------------------------------------------------------------------+
	# \| SW \| \|
	# \| + $rp1 \|
	# \| 192.0.2.2/24 \|
	# \| 2001:db8:1::2/64 \|
	# \| \|
	# \| 2001:db8:2::2/64 \|
	# \| 198.51.100.2/24 \|
	# \| + $rp2 \|
	# \| \| \|
	# +----\|----------------------------------------------------------------------+
	# \|
	# +----\|----------------------------+
	# \| \| default via 198.51.100.2 \|
	# \| \| default via 2001:db8:2::2 \|
	# \| \| \|
	# \| \| 2001:db8:2::1/64 \|
	# \| \| 198.51.100.1/24 \|
	# \| + $h2 \|
	# \| H2 (vrf) \|
	# +---------------------------------+

	lib_dir=$(dirname $0)/../../../net/forwarding

	ALL_TESTS="
	non_ip_test
	uc_dip_over_mc_dmac_test
	dip_is_loopback_test
	sip_is_mc_test
	sip_is_loopback_test
	ip_header_corrupted_test
	ipv4_sip_is_limited_bc_test
	ipv6_mc_dip_reserved_scope_test
	ipv6_mc_dip_interface_local_scope_test
	blackhole_route_test
	irif_disabled_test
	erif_disabled_test
	blackhole_nexthop_test
	"

	NUM_NETIFS=4
	source $lib_dir/lib.sh
	source $lib_dir/tc_common.sh
	source $lib_dir/devlink_lib.sh

	h1_create()
	{
	simple_if_init $h1 192.0.2.1/24 2001:db8:1::1/64

	ip -4 route add default vrf v$h1 nexthop via 192.0.2.2
	ip -6 route add default vrf v$h1 nexthop via 2001:db8:1::2
	}

	h1_destroy()
	{
	ip -6 route del default vrf v$h1 nexthop via 2001:db8:1::2
	ip -4 route del default vrf v$h1 nexthop via 192.0.2.2

	simple_if_fini $h1 192.0.2.1/24 2001:db8:1::1/64
	}

	h2_create()
	{
	simple_if_init $h2 $h2_ipv4/24 $h2_ipv6/64

	ip -4 route add default vrf v$h2 nexthop via 198.51.100.2
	ip -6 route add default vrf v$h2 nexthop via 2001:db8:2::2
	}

	h2_destroy()
	{
	ip -6 route del default vrf v$h2 nexthop via 2001:db8:2::2
	ip -4 route del default vrf v$h2 nexthop via 198.51.100.2

	simple_if_fini $h2 $h2_ipv4/24 $h2_ipv6/64
	}

	router_create()
	{
	ip link set dev $rp1 up
	ip link set dev $rp2 up

	tc qdisc add dev $rp2 clsact

	__addr_add_del $rp1 add 192.0.2.2/24 2001:db8:1::2/64
	__addr_add_del $rp2 add 198.51.100.2/24 2001:db8:2::2/64
	}

	router_destroy()
	{
	__addr_add_del $rp2 del 198.51.100.2/24 2001:db8:2::2/64
	__addr_add_del $rp1 del 192.0.2.2/24 2001:db8:1::2/64

	tc qdisc del dev $rp2 clsact

	ip link set dev $rp2 down
	ip link set dev $rp1 down
	}

	setup_prepare()
	{
	h1=${NETIFS[p1]}
	rp1=${NETIFS[p2]}

	rp2=${NETIFS[p3]}
	h2=${NETIFS[p4]}

	h1mac=$(mac_get $h1)
	rp1mac=$(mac_get $rp1)

	h1_ipv4=192.0.2.1
	h2_ipv4=198.51.100.1
	h1_ipv6=2001:db8:1::1
	h2_ipv6=2001:db8:2::1

	vrf_prepare
	forwarding_enable

	h1_create
	h2_create

	router_create
	}

	cleanup()
	{
	pre_cleanup

	router_destroy

	h2_destroy
	h1_destroy

	forwarding_restore
	vrf_cleanup
	}

	ping_check()
	{
	trap_name=$1; shift

	devlink_trap_action_set $trap_name "trap"
	ping_do $h1 $h2_ipv4
	check_err $? "Packets that should not be trapped were trapped"
	devlink_trap_action_set $trap_name "drop"
	}

	non_ip_test()
	{
	local trap_name="non_ip"
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
	flower dst_ip $h2_ipv4 action drop

	# Generate non-IP packets to the router
	$MZ $h1 -c 0 -p 100 -d 1msec -B $h2_ipv4 -q "$rp1mac $h1mac \
	00:00 de:ad:be:ef" &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "Non IP"

	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
	}

	__uc_dip_over_mc_dmac_test()
	{
	local desc=$1; shift
	local proto=$1; shift
	local dip=$1; shift
	local flags=${1:-""}; shift
	local trap_name="uc_dip_over_mc_dmac"
	local dmac=01:02:03:04:05:06
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
	flower ip_proto udp src_port 54321 dst_port 12345 action drop

	# Generate IP packets with a unicast IP and a multicast destination MAC
	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $dmac \
	-B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "Unicast destination IP over multicast destination MAC: $desc"

	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
	}

	uc_dip_over_mc_dmac_test()
	{
	__uc_dip_over_mc_dmac_test "IPv4" "ip" $h2_ipv4
	__uc_dip_over_mc_dmac_test "IPv6" "ipv6" $h2_ipv6 "-6"
	}

	__sip_is_loopback_test()
	{
	local desc=$1; shift
	local proto=$1; shift
	local sip=$1; shift
	local dip=$1; shift
	local flags=${1:-""}; shift
	local trap_name="sip_is_loopback_address"
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
	flower src_ip $sip action drop

	# Generate packets with loopback source IP
	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -A $sip \
	-b $rp1mac -B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "Source IP is loopback address: $desc"

	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
	}

	sip_is_loopback_test()
	{
	__sip_is_loopback_test "IPv4" "ip" "127.0.0.0/8" $h2_ipv4
	__sip_is_loopback_test "IPv6" "ipv6" "::1" $h2_ipv6 "-6"
	}

	__dip_is_loopback_test()
	{
	local desc=$1; shift
	local proto=$1; shift
	local dip=$1; shift
	local flags=${1:-""}; shift
	local trap_name="dip_is_loopback_address"
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
	flower dst_ip $dip action drop

	# Generate packets with loopback destination IP
	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $rp1mac \
	-B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "Destination IP is loopback address: $desc"

	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
	}

	dip_is_loopback_test()
	{
	__dip_is_loopback_test "IPv4" "ip" "127.0.0.0/8"
	__dip_is_loopback_test "IPv6" "ipv6" "::1" "-6"
	}

	__sip_is_mc_test()
	{
	local desc=$1; shift
	local proto=$1; shift
	local sip=$1; shift
	local dip=$1; shift
	local flags=${1:-""}; shift
	local trap_name="sip_is_mc"
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
	flower src_ip $sip action drop

	# Generate packets with multicast source IP
	$MZ $h1 $flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -A $sip \
	-b $rp1mac -B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "Source IP is multicast: $desc"

	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
	}

	sip_is_mc_test()
	{
	__sip_is_mc_test "IPv4" "ip" "239.1.1.1" $h2_ipv4
	__sip_is_mc_test "IPv6" "ipv6" "FF02::2" $h2_ipv6 "-6"
	}

	ipv4_sip_is_limited_bc_test()
	{
	local trap_name="ipv4_sip_is_limited_bc"
	local sip=255.255.255.255
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
	flower src_ip $sip action drop

	# Generate packets with limited broadcast source IP
	$MZ $h1 -t udp "sp=54321,dp=12345" -c 0 -p 100 -A $sip -b $rp1mac \
	-B $h2_ipv4 -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "IPv4 source IP is limited broadcast"

	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
	}

	ipv4_payload_get()
	{
	local ipver=$1; shift
	local ihl=$1; shift
	local checksum=$1; shift

	p=$(:
	)"08:00:"$( : ETH type
	)"$ipver"$( : IP version
	)"$ihl:"$( : IHL
	)"00:"$( : IP TOS
	)"00:F4:"$( : IP total length
	)"00:00:"$( : IP identification
	)"20:00:"$( : IP flags + frag off
	)"30:"$( : IP TTL
	)"01:"$( : IP proto
	)"$checksum:"$( : IP header csum
	)"$h1_ipv4:"$( : IP saddr
	)"$h2_ipv4:"$( : IP daddr
	)
	echo $p
	}

	__ipv4_header_corrupted_test()
	{
	local desc=$1; shift
	local ipver=$1; shift
	local ihl=$1; shift
	local checksum=$1; shift
	local trap_name="ip_header_corrupted"
	local payload
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
	flower dst_ip $h2_ipv4 action drop

	payload=$(ipv4_payload_get $ipver $ihl $checksum)

	# Generate packets with corrupted IP header
	$MZ $h1 -c 0 -d 1msec -a $h1mac -b $rp1mac -q p=$payload &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "IP header corrupted: $desc: IPv4"

	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
	}

	ipv6_payload_get()
	{
	local ipver=$1; shift

	p=$(:
	)"86:DD:"$( : ETH type
	)"$ipver"$( : IP version
	)"0:0:"$( : Traffic class
	)"0:00:00:"$( : Flow label
	)"00:00:"$( : Payload length
	)"01:"$( : Next header
	)"04:"$( : Hop limit
	)"$h1_ipv6:"$( : IP saddr
	)"$h2_ipv6:"$( : IP daddr
	)
	echo $p
	}

	__ipv6_header_corrupted_test()
	{
	local desc=$1; shift
	local ipver=$1; shift
	local trap_name="ip_header_corrupted"
	local payload
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol ip pref 1 handle 101 \
	flower dst_ip $h2_ipv4 action drop

	payload=$(ipv6_payload_get $ipver)

	# Generate packets with corrupted IP header
	$MZ $h1 -c 0 -d 1msec -a $h1mac -b $rp1mac -q p=$payload &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "IP header corrupted: $desc: IPv6"

	devlink_trap_drop_cleanup $mz_pid $rp2 "ip" 1 101
	}

	ip_header_corrupted_test()
	{
	# Each test uses one wrong value. The three values below are correct.
	local ipv="4"
	local ihl="5"
	local checksum="00:F4"

	__ipv4_header_corrupted_test "wrong IP version" 5 $ihl $checksum
	__ipv4_header_corrupted_test "wrong IHL" $ipv 4 $checksum
	__ipv4_header_corrupted_test "wrong checksum" $ipv $ihl "00:00"
	__ipv6_header_corrupted_test "wrong IP version" 5
	}

	ipv6_mc_dip_reserved_scope_test()
	{
	local trap_name="ipv6_mc_dip_reserved_scope"
	local dip=FF00::
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol ipv6 pref 1 handle 101 \
	flower dst_ip $dip action drop

	# Generate packets with reserved scope destination IP
	$MZ $h1 -6 -t udp "sp=54321,dp=12345" -c 0 -p 100 -b \
	"33:33:00:00:00:00" -B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "IPv6 multicast destination IP reserved scope"

	devlink_trap_drop_cleanup $mz_pid $rp2 "ipv6" 1 101
	}

	ipv6_mc_dip_interface_local_scope_test()
	{
	local trap_name="ipv6_mc_dip_interface_local_scope"
	local dip=FF01::
	local mz_pid

	RET=0

	ping_check $trap_name

	tc filter add dev $rp2 egress protocol ipv6 pref 1 handle 101 \
	flower dst_ip $dip action drop

	# Generate packets with interface local scope destination IP
	$MZ $h1 -6 -t udp "sp=54321,dp=12345" -c 0 -p 100 -b \
	"33:33:00:00:00:00" -B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101

	log_test "IPv6 multicast destination IP interface-local scope"

	devlink_trap_drop_cleanup $mz_pid $rp2 "ipv6" 1 101
	}

	__blackhole_route_test()
	{
	local flags=$1; shift
	local subnet=$1; shift
	local proto=$1; shift
	local dip=$1; shift
	local ip_proto=${1:-"icmp"}; shift
	local trap_name="blackhole_route"
	local mz_pid

	RET=0

	ping_check $trap_name

	ip -$flags route add blackhole $subnet
	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
	flower skip_hw dst_ip $dip ip_proto $ip_proto action drop

	# Generate packets to the blackhole route
	$MZ $h1 -$flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $rp1mac \
	-B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101
	log_test "Blackhole route: IPv$flags"

	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
	ip -$flags route del blackhole $subnet
	}

	blackhole_route_test()
	{
	__blackhole_route_test "4" "198.51.100.0/30" "ip" $h2_ipv4
	__blackhole_route_test "6" "2001:db8:2::/120" "ipv6" $h2_ipv6 "icmpv6"
	}

	irif_disabled_test()
	{
	local trap_name="irif_disabled"
	local t0_packets t0_bytes
	local t1_packets t1_bytes
	local mz_pid

	RET=0

	ping_check $trap_name

	devlink_trap_action_set $trap_name "trap"

	# When RIF of a physical port ("Sub-port RIF") is destroyed, we first
	# block the STP of the {Port, VLAN} so packets cannot get into the RIF.
	# Using bridge enables us to see this trap because when bridge is
	# destroyed, there is a small time window that packets can go into the
	# RIF, while it is disabled.
	ip link add dev br0 type bridge
	ip link set dev $rp1 master br0
	ip address flush dev $rp1
	__addr_add_del br0 add 192.0.2.2/24
	ip li set dev br0 up

	t0_packets=$(devlink_trap_rx_packets_get $trap_name)
	t0_bytes=$(devlink_trap_rx_bytes_get $trap_name)

	# Generate packets to h2 through br0 RIF that will be removed later
	$MZ $h1 -t udp "sp=54321,dp=12345" -c 0 -p 100 -a own -b $rp1mac \
	-B $h2_ipv4 -q &
	mz_pid=$!

	# Wait before removing br0 RIF to allow packets to go into the bridge.
	sleep 1

	# Flushing address will dismantle the RIF
	ip address flush dev br0

	t1_packets=$(devlink_trap_rx_packets_get $trap_name)
	t1_bytes=$(devlink_trap_rx_bytes_get $trap_name)

	if [[ $t0_packets -eq $t1_packets && $t0_bytes -eq $t1_bytes ]]; then
	check_err 1 "Trap stats idle when packets should be trapped"
	fi

	log_test "Ingress RIF disabled"

	kill $mz_pid && wait $mz_pid &> /dev/null
	ip link set dev $rp1 nomaster
	__addr_add_del $rp1 add 192.0.2.2/24 2001:db8:1::2/64
	ip link del dev br0 type bridge
	devlink_trap_action_set $trap_name "drop"
	}

	erif_disabled_test()
	{
	local trap_name="erif_disabled"
	local t0_packets t0_bytes
	local t1_packets t1_bytes
	local mz_pid

	RET=0

	ping_check $trap_name

	devlink_trap_action_set $trap_name "trap"
	ip link add dev br0 type bridge
	ip add flush dev $rp1
	ip link set dev $rp1 master br0
	__addr_add_del br0 add 192.0.2.2/24
	ip link set dev br0 up

	t0_packets=$(devlink_trap_rx_packets_get $trap_name)
	t0_bytes=$(devlink_trap_rx_bytes_get $trap_name)

	rp2mac=$(mac_get $rp2)

	# Generate packets that should go out through br0 RIF that will be
	# removed later
	$MZ $h2 -t udp "sp=54321,dp=12345" -c 0 -p 100 -a own -b $rp2mac \
	-B 192.0.2.1 -q &
	mz_pid=$!

	sleep 5
	# Unlinking the port from the bridge will disable the RIF associated
	# with br0 as it is no longer an upper of any mlxsw port.
	ip link set dev $rp1 nomaster

	t1_packets=$(devlink_trap_rx_packets_get $trap_name)
	t1_bytes=$(devlink_trap_rx_bytes_get $trap_name)

	if [[ $t0_packets -eq $t1_packets && $t0_bytes -eq $t1_bytes ]]; then
	check_err 1 "Trap stats idle when packets should be trapped"
	fi

	log_test "Egress RIF disabled"

	kill $mz_pid && wait $mz_pid &> /dev/null
	__addr_add_del $rp1 add 192.0.2.2/24 2001:db8:1::2/64
	ip link del dev br0 type bridge
	devlink_trap_action_set $trap_name "drop"
	}

	__blackhole_nexthop_test()
	{
	local flags=$1; shift
	local subnet=$1; shift
	local proto=$1; shift
	local dip=$1; shift
	local trap_name="blackhole_nexthop"
	local mz_pid

	RET=0

	ip -$flags nexthop add id 1 blackhole
	ip -$flags route add $subnet nhid 1
	tc filter add dev $rp2 egress protocol $proto pref 1 handle 101 \
	flower skip_hw dst_ip $dip ip_proto udp action drop

	# Generate packets to the blackhole nexthop
	$MZ $h1 -$flags -t udp "sp=54321,dp=12345" -c 0 -p 100 -b $rp1mac \
	-B $dip -d 1msec -q &
	mz_pid=$!

	devlink_trap_drop_test $trap_name $rp2 101
	log_test "Blackhole nexthop: IPv$flags"

	devlink_trap_drop_cleanup $mz_pid $rp2 $proto 1 101
	ip -$flags route del $subnet
	ip -$flags nexthop del id 1
	}

	blackhole_nexthop_test()
	{
	__blackhole_nexthop_test "4" "198.51.100.0/30" "ip" $h2_ipv4
	__blackhole_nexthop_test "6" "2001:db8:2::/120" "ipv6" $h2_ipv6
	}

	trap cleanup EXIT

	setup_prepare
	setup_wait

	tests_run

	exit $EXIT_STATUS