353 lines
10 KiB
Bash
Executable File
353 lines
10 KiB
Bash
Executable File
#!/bin/bash
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
# Copyright 2020 NXP
|
|
|
|
WAIT_TIME=1
|
|
NUM_NETIFS=4
|
|
STABLE_MAC_ADDRS=yes
|
|
lib_dir=$(dirname $0)/../../../net/forwarding
|
|
source $lib_dir/tc_common.sh
|
|
source $lib_dir/lib.sh
|
|
|
|
require_command tcpdump
|
|
|
|
h1=${NETIFS[p1]}
|
|
swp1=${NETIFS[p2]}
|
|
swp2=${NETIFS[p3]}
|
|
h2=${NETIFS[p4]}
|
|
|
|
# Helpers to map a VCAP IS1 and VCAP IS2 lookup and policy to a chain number
|
|
# used by the kernel driver. The numbers are:
|
|
# VCAP IS1 lookup 0: 10000
|
|
# VCAP IS1 lookup 1: 11000
|
|
# VCAP IS1 lookup 2: 12000
|
|
# VCAP IS2 lookup 0 policy 0: 20000
|
|
# VCAP IS2 lookup 0 policy 1: 20001
|
|
# VCAP IS2 lookup 0 policy 255: 20255
|
|
# VCAP IS2 lookup 1 policy 0: 21000
|
|
# VCAP IS2 lookup 1 policy 1: 21001
|
|
# VCAP IS2 lookup 1 policy 255: 21255
|
|
IS1()
|
|
{
|
|
local lookup=$1
|
|
|
|
echo $((10000 + 1000 * lookup))
|
|
}
|
|
|
|
IS2()
|
|
{
|
|
local lookup=$1
|
|
local pag=$2
|
|
|
|
echo $((20000 + 1000 * lookup + pag))
|
|
}
|
|
|
|
ES0()
|
|
{
|
|
echo 0
|
|
}
|
|
|
|
# The Ocelot switches have a fixed ingress pipeline composed of:
|
|
#
|
|
# +----------------------------------------------+ +-----------------------------------------+
|
|
# | VCAP IS1 | | VCAP IS2 |
|
|
# | | | |
|
|
# | +----------+ +----------+ +----------+ | | +----------+ +----------+ |
|
|
# | | Lookup 0 | | Lookup 1 | | Lookup 2 | | --+------> PAG 0: | Lookup 0 | -> | Lookup 1 | |
|
|
# | +----------+ -> +----------+ -> +----------+ | | | +----------+ +----------+ |
|
|
# | |key&action| |key&action| |key&action| | | | |key&action| |key&action| |
|
|
# | |key&action| |key&action| |key&action| | | | | .. | | .. | |
|
|
# | | .. | | .. | | .. | | | | +----------+ +----------+ |
|
|
# | +----------+ +----------+ +----------+ | | | |
|
|
# | selects PAG | | | +----------+ +----------+ |
|
|
# +----------------------------------------------+ +------> PAG 1: | Lookup 0 | -> | Lookup 1 | |
|
|
# | | +----------+ +----------+ |
|
|
# | | |key&action| |key&action| |
|
|
# | | | .. | | .. | |
|
|
# | | +----------+ +----------+ |
|
|
# | | ... |
|
|
# | | |
|
|
# | | +----------+ +----------+ |
|
|
# +----> PAG 254: | Lookup 0 | -> | Lookup 1 | |
|
|
# | | +----------+ +----------+ |
|
|
# | | |key&action| |key&action| |
|
|
# | | | .. | | .. | |
|
|
# | | +----------+ +----------+ |
|
|
# | | |
|
|
# | | +----------+ +----------+ |
|
|
# +----> PAG 255: | Lookup 0 | -> | Lookup 1 | |
|
|
# | +----------+ +----------+ |
|
|
# | |key&action| |key&action| |
|
|
# | | .. | | .. | |
|
|
# | +----------+ +----------+ |
|
|
# +-----------------------------------------+
|
|
#
|
|
# Both the VCAP IS1 (Ingress Stage 1) and IS2 (Ingress Stage 2) are indexed
|
|
# (looked up) multiple times: IS1 3 times, and IS2 2 times. Each filter
|
|
# (key and action pair) can be configured to only match during the first, or
|
|
# second, etc, lookup.
|
|
#
|
|
# During one TCAM lookup, the filter processing stops at the first entry that
|
|
# matches, then the pipeline jumps to the next lookup.
|
|
# The driver maps each individual lookup of each individual ingress TCAM to a
|
|
# separate chain number. For correct rule offloading, it is mandatory that each
|
|
# filter installed in one TCAM is terminated by a non-optional GOTO action to
|
|
# the next lookup from the fixed pipeline.
|
|
#
|
|
# A chain can only be used if there is a GOTO action correctly set up from the
|
|
# prior lookup in the processing pipeline. Setting up all chains is not
|
|
# mandatory.
|
|
|
|
# NOTE: VCAP IS1 currently uses only S1_NORMAL half keys and VCAP IS2
|
|
# dynamically chooses between MAC_ETYPE, ARP, IP4_TCP_UDP, IP4_OTHER, which are
|
|
# all half keys as well.
|
|
|
|
create_tcam_skeleton()
|
|
{
|
|
local eth=$1
|
|
|
|
tc qdisc add dev $eth clsact
|
|
|
|
# VCAP IS1 is the Ingress Classification TCAM and can offload the
|
|
# following actions:
|
|
# - skbedit priority
|
|
# - vlan pop
|
|
# - vlan modify
|
|
# - goto (only in lookup 2, the last IS1 lookup)
|
|
tc filter add dev $eth ingress chain 0 pref 49152 flower \
|
|
skip_sw action goto chain $(IS1 0)
|
|
tc filter add dev $eth ingress chain $(IS1 0) pref 49152 \
|
|
flower skip_sw action goto chain $(IS1 1)
|
|
tc filter add dev $eth ingress chain $(IS1 1) pref 49152 \
|
|
flower skip_sw action goto chain $(IS1 2)
|
|
tc filter add dev $eth ingress chain $(IS1 2) pref 49152 \
|
|
flower skip_sw action goto chain $(IS2 0 0)
|
|
|
|
# VCAP IS2 is the Security Enforcement ingress TCAM and can offload the
|
|
# following actions:
|
|
# - trap
|
|
# - drop
|
|
# - police
|
|
# The two VCAP IS2 lookups can be segmented into up to 256 groups of
|
|
# rules, called Policies. A Policy is selected through the Policy
|
|
# Association Group (PAG) action of VCAP IS1 (which is the
|
|
# GOTO offload).
|
|
tc filter add dev $eth ingress chain $(IS2 0 0) pref 49152 \
|
|
flower skip_sw action goto chain $(IS2 1 0)
|
|
}
|
|
|
|
setup_prepare()
|
|
{
|
|
ip link set $swp1 up
|
|
ip link set $swp2 up
|
|
ip link set $h2 up
|
|
ip link set $h1 up
|
|
|
|
create_tcam_skeleton $swp1
|
|
|
|
ip link add br0 type bridge
|
|
ip link set $swp1 master br0
|
|
ip link set $swp2 master br0
|
|
ip link set br0 up
|
|
|
|
ip link add link $h1 name $h1.100 type vlan id 100
|
|
ip link set $h1.100 up
|
|
|
|
ip link add link $h1 name $h1.200 type vlan id 200
|
|
ip link set $h1.200 up
|
|
|
|
tc filter add dev $swp1 ingress chain $(IS1 1) pref 1 \
|
|
protocol 802.1Q flower skip_sw vlan_id 100 \
|
|
action vlan pop \
|
|
action goto chain $(IS1 2)
|
|
|
|
tc filter add dev $swp1 egress chain $(ES0) pref 1 \
|
|
flower skip_sw indev $swp2 \
|
|
action vlan push protocol 802.1Q id 100
|
|
|
|
tc filter add dev $swp1 ingress chain $(IS1 0) pref 2 \
|
|
protocol ipv4 flower skip_sw src_ip 10.1.1.2 \
|
|
action skbedit priority 7 \
|
|
action goto chain $(IS1 1)
|
|
|
|
tc filter add dev $swp1 ingress chain $(IS2 0 0) pref 1 \
|
|
protocol ipv4 flower skip_sw ip_proto udp dst_port 5201 \
|
|
action police rate 50mbit burst 64k conform-exceed drop/pipe \
|
|
action goto chain $(IS2 1 0)
|
|
}
|
|
|
|
cleanup()
|
|
{
|
|
ip link del $h1.200
|
|
ip link del $h1.100
|
|
tc qdisc del dev $swp1 clsact
|
|
ip link del br0
|
|
}
|
|
|
|
test_vlan_pop()
|
|
{
|
|
local h1_mac=$(mac_get $h1)
|
|
local h2_mac=$(mac_get $h2)
|
|
|
|
RET=0
|
|
|
|
tcpdump_start $h2
|
|
|
|
# Work around Mausezahn VLAN builder bug
|
|
# (https://github.com/netsniff-ng/netsniff-ng/issues/225) by using
|
|
# an 8021q upper
|
|
$MZ $h1.100 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip
|
|
|
|
sleep 1
|
|
|
|
tcpdump_stop $h2
|
|
|
|
tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, ethertype IPv4"
|
|
check_err "$?" "untagged reception"
|
|
|
|
tcpdump_cleanup $h2
|
|
|
|
log_test "VLAN pop"
|
|
}
|
|
|
|
test_vlan_push()
|
|
{
|
|
local h1_mac=$(mac_get $h1)
|
|
local h2_mac=$(mac_get $h2)
|
|
|
|
RET=0
|
|
|
|
tcpdump_start $h1.100
|
|
|
|
$MZ $h2 -q -c 1 -p 64 -a $h2_mac -b $h1_mac -t ip
|
|
|
|
sleep 1
|
|
|
|
tcpdump_stop $h1.100
|
|
|
|
tcpdump_show $h1.100 | grep -q "$h2_mac > $h1_mac"
|
|
check_err "$?" "tagged reception"
|
|
|
|
tcpdump_cleanup $h1.100
|
|
|
|
log_test "VLAN push"
|
|
}
|
|
|
|
test_vlan_ingress_modify()
|
|
{
|
|
local h1_mac=$(mac_get $h1)
|
|
local h2_mac=$(mac_get $h2)
|
|
|
|
RET=0
|
|
|
|
ip link set br0 type bridge vlan_filtering 1
|
|
bridge vlan add dev $swp1 vid 200
|
|
bridge vlan add dev $swp1 vid 300
|
|
bridge vlan add dev $swp2 vid 300
|
|
|
|
tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \
|
|
protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \
|
|
action vlan modify id 300 \
|
|
action goto chain $(IS2 0 0)
|
|
|
|
tcpdump_start $h2
|
|
|
|
$MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip
|
|
|
|
sleep 1
|
|
|
|
tcpdump_stop $h2
|
|
|
|
tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300"
|
|
check_err "$?" "tagged reception"
|
|
|
|
tcpdump_cleanup $h2
|
|
|
|
tc filter del dev $swp1 ingress chain $(IS1 2) pref 3
|
|
|
|
bridge vlan del dev $swp1 vid 200
|
|
bridge vlan del dev $swp1 vid 300
|
|
bridge vlan del dev $swp2 vid 300
|
|
ip link set br0 type bridge vlan_filtering 0
|
|
|
|
log_test "Ingress VLAN modification"
|
|
}
|
|
|
|
test_vlan_egress_modify()
|
|
{
|
|
local h1_mac=$(mac_get $h1)
|
|
local h2_mac=$(mac_get $h2)
|
|
|
|
RET=0
|
|
|
|
tc qdisc add dev $swp2 clsact
|
|
|
|
ip link set br0 type bridge vlan_filtering 1
|
|
bridge vlan add dev $swp1 vid 200
|
|
bridge vlan add dev $swp2 vid 200
|
|
|
|
tc filter add dev $swp2 egress chain $(ES0) pref 3 \
|
|
protocol 802.1Q flower skip_sw vlan_id 200 vlan_prio 0 \
|
|
action vlan modify id 300 priority 7
|
|
|
|
tcpdump_start $h2
|
|
|
|
$MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip
|
|
|
|
sleep 1
|
|
|
|
tcpdump_stop $h2
|
|
|
|
tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300"
|
|
check_err "$?" "tagged reception"
|
|
|
|
tcpdump_cleanup $h2
|
|
|
|
tc filter del dev $swp2 egress chain $(ES0) pref 3
|
|
tc qdisc del dev $swp2 clsact
|
|
|
|
bridge vlan del dev $swp1 vid 200
|
|
bridge vlan del dev $swp2 vid 200
|
|
ip link set br0 type bridge vlan_filtering 0
|
|
|
|
log_test "Egress VLAN modification"
|
|
}
|
|
|
|
test_skbedit_priority()
|
|
{
|
|
local h1_mac=$(mac_get $h1)
|
|
local h2_mac=$(mac_get $h2)
|
|
local num_pkts=100
|
|
|
|
before=$(ethtool_stats_get $swp1 'rx_green_prio_7')
|
|
|
|
$MZ $h1 -q -c $num_pkts -p 64 -a $h1_mac -b $h2_mac -t ip -A 10.1.1.2
|
|
|
|
after=$(ethtool_stats_get $swp1 'rx_green_prio_7')
|
|
|
|
if [ $((after - before)) = $num_pkts ]; then
|
|
RET=0
|
|
else
|
|
RET=1
|
|
fi
|
|
|
|
log_test "Frame prioritization"
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
|
|
ALL_TESTS="
|
|
test_vlan_pop
|
|
test_vlan_push
|
|
test_vlan_ingress_modify
|
|
test_vlan_egress_modify
|
|
test_skbedit_priority
|
|
"
|
|
|
|
setup_prepare
|
|
setup_wait
|
|
|
|
tests_run
|
|
|
|
exit $EXIT_STATUS
|