| #!/bin/bash |
| # SPDX-License-Identifier: GPL-2.0 |
| |
| # +-----------------------+ +----------------------+ |
| # | H1 (vrf) | | H2 (vrf) | |
| # | + $h1 | | $h2 + | |
| # | | 192.0.2.1/28 | | 192.0.2.2/28 | | |
| # | | 2001:db8:1::1/64 | | 2001:db8:1::2/64 | | |
| # +----|------------------+ +------------------|---+ |
| # | | |
| # +----|-------------------------------------------------------------------|---+ |
| # | SW | | | |
| # | +-|-------------------------------------------------------------------|-+ | |
| # | | + $swp1 BR $swp2 + | | |
| # | +-----------------------------------------------------------------------+ | |
| # +----------------------------------------------------------------------------+ |
| |
| ALL_TESTS=" |
| test_port_range_ipv4_udp |
| test_port_range_ipv4_tcp |
| test_port_range_ipv6_udp |
| test_port_range_ipv6_tcp |
| " |
| |
| NUM_NETIFS=4 |
| source lib.sh |
| source tc_common.sh |
| |
| h1_create() |
| { |
| simple_if_init $h1 192.0.2.1/28 2001:db8:1::1/64 |
| } |
| |
| h1_destroy() |
| { |
| simple_if_fini $h1 192.0.2.1/28 2001:db8:1::1/64 |
| } |
| |
| h2_create() |
| { |
| simple_if_init $h2 192.0.2.2/28 2001:db8:1::2/64 |
| } |
| |
| h2_destroy() |
| { |
| simple_if_fini $h2 192.0.2.2/28 2001:db8:1::2/64 |
| } |
| |
| switch_create() |
| { |
| ip link add name br1 type bridge |
| ip link set dev $swp1 master br1 |
| ip link set dev $swp1 up |
| ip link set dev $swp2 master br1 |
| ip link set dev $swp2 up |
| ip link set dev br1 up |
| |
| tc qdisc add dev $swp1 clsact |
| tc qdisc add dev $swp2 clsact |
| } |
| |
| switch_destroy() |
| { |
| tc qdisc del dev $swp2 clsact |
| tc qdisc del dev $swp1 clsact |
| |
| ip link set dev br1 down |
| ip link set dev $swp2 down |
| ip link set dev $swp2 nomaster |
| ip link set dev $swp1 down |
| ip link set dev $swp1 nomaster |
| ip link del dev br1 |
| } |
| |
| __test_port_range() |
| { |
| local proto=$1; shift |
| local ip_proto=$1; shift |
| local sip=$1; shift |
| local dip=$1; shift |
| local mode=$1; shift |
| local name=$1; shift |
| local dmac=$(mac_get $h2) |
| local smac=$(mac_get $h1) |
| local sport_min=100 |
| local sport_max=200 |
| local sport_mid=$((sport_min + (sport_max - sport_min) / 2)) |
| local dport_min=300 |
| local dport_max=400 |
| local dport_mid=$((dport_min + (dport_max - dport_min) / 2)) |
| |
| RET=0 |
| |
| tc filter add dev $swp1 ingress protocol $proto handle 101 pref 1 \ |
| flower src_ip $sip dst_ip $dip ip_proto $ip_proto \ |
| src_port $sport_min-$sport_max \ |
| dst_port $dport_min-$dport_max \ |
| action pass |
| tc filter add dev $swp2 egress protocol $proto handle 101 pref 1 \ |
| flower src_ip $sip dst_ip $dip ip_proto $ip_proto \ |
| src_port $sport_min-$sport_max \ |
| dst_port $dport_min-$dport_max \ |
| action drop |
| |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$sport_min,dp=$dport_min" |
| tc_check_packets "dev $swp1 ingress" 101 1 |
| check_err $? "Ingress filter not hit with minimum ports" |
| tc_check_packets "dev $swp2 egress" 101 1 |
| check_err $? "Egress filter not hit with minimum ports" |
| |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$sport_mid,dp=$dport_mid" |
| tc_check_packets "dev $swp1 ingress" 101 2 |
| check_err $? "Ingress filter not hit with middle ports" |
| tc_check_packets "dev $swp2 egress" 101 2 |
| check_err $? "Egress filter not hit with middle ports" |
| |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$sport_max,dp=$dport_max" |
| tc_check_packets "dev $swp1 ingress" 101 3 |
| check_err $? "Ingress filter not hit with maximum ports" |
| tc_check_packets "dev $swp2 egress" 101 3 |
| check_err $? "Egress filter not hit with maximum ports" |
| |
| # Send traffic when both ports are out of range and when only one port |
| # is out of range. |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$((sport_min - 1)),dp=$dport_min" |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$((sport_max + 1)),dp=$dport_min" |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$sport_min,dp=$((dport_min - 1))" |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$sport_min,dp=$((dport_max + 1))" |
| $MZ $mode $h1 -c 1 -q -p 100 -a $smac -b $dmac -A $sip -B $dip \ |
| -t $ip_proto "sp=$((sport_max + 1)),dp=$((dport_max + 1))" |
| tc_check_packets "dev $swp1 ingress" 101 3 |
| check_err $? "Ingress filter was hit when should not" |
| tc_check_packets "dev $swp2 egress" 101 3 |
| check_err $? "Egress filter was hit when should not" |
| |
| tc filter del dev $swp2 egress protocol $proto pref 1 handle 101 flower |
| tc filter del dev $swp1 ingress protocol $proto pref 1 handle 101 flower |
| |
| log_test "Port range matching - $name" |
| } |
| |
| test_port_range_ipv4_udp() |
| { |
| local proto=ipv4 |
| local ip_proto=udp |
| local sip=192.0.2.1 |
| local dip=192.0.2.2 |
| local mode="-4" |
| local name="IPv4 UDP" |
| |
| __test_port_range $proto $ip_proto $sip $dip $mode "$name" |
| } |
| |
| test_port_range_ipv4_tcp() |
| { |
| local proto=ipv4 |
| local ip_proto=tcp |
| local sip=192.0.2.1 |
| local dip=192.0.2.2 |
| local mode="-4" |
| local name="IPv4 TCP" |
| |
| __test_port_range $proto $ip_proto $sip $dip $mode "$name" |
| } |
| |
| test_port_range_ipv6_udp() |
| { |
| local proto=ipv6 |
| local ip_proto=udp |
| local sip=2001:db8:1::1 |
| local dip=2001:db8:1::2 |
| local mode="-6" |
| local name="IPv6 UDP" |
| |
| __test_port_range $proto $ip_proto $sip $dip $mode "$name" |
| } |
| |
| test_port_range_ipv6_tcp() |
| { |
| local proto=ipv6 |
| local ip_proto=tcp |
| local sip=2001:db8:1::1 |
| local dip=2001:db8:1::2 |
| local mode="-6" |
| local name="IPv6 TCP" |
| |
| __test_port_range $proto $ip_proto $sip $dip $mode "$name" |
| } |
| |
| setup_prepare() |
| { |
| h1=${NETIFS[p1]} |
| swp1=${NETIFS[p2]} |
| |
| swp2=${NETIFS[p3]} |
| h2=${NETIFS[p4]} |
| |
| vrf_prepare |
| h1_create |
| h2_create |
| switch_create |
| } |
| |
| cleanup() |
| { |
| pre_cleanup |
| |
| switch_destroy |
| h2_destroy |
| h1_destroy |
| vrf_cleanup |
| } |
| |
| trap cleanup EXIT |
| |
| setup_prepare |
| setup_wait |
| |
| tests_run |
| |
| exit $EXIT_STATUS |
