1 #!/bin/bash
2 # SPDX-License-Identifier: GPL-2.0
3
4 ALL_TESTS="match_dst_mac_test match_src_mac_test match_dst_ip_test \
5 match_src_ip_test match_ip_flags_test match_pcp_test match_vlan_test \
6 match_ip_tos_test match_indev_test match_ip_ttl_test
7 match_mpls_label_test \
8 match_mpls_tc_test match_mpls_bos_test match_mpls_ttl_test \
9 match_mpls_lse_test"
10 NUM_NETIFS=2
11 source tc_common.sh
12 source lib.sh
13
14 tcflags="skip_hw"
15
16 h1_create()
17 {
18 simple_if_init $h1 192.0.2.1/24 198.51.100.1/24
19 }
20
21 h1_destroy()
22 {
23 simple_if_fini $h1 192.0.2.1/24 198.51.100.1/24
24 }
25
26 h2_create()
27 {
28 simple_if_init $h2 192.0.2.2/24 198.51.100.2/24
29 tc qdisc add dev $h2 clsact
30 }
31
32 h2_destroy()
33 {
34 tc qdisc del dev $h2 clsact
35 simple_if_fini $h2 192.0.2.2/24 198.51.100.2/24
36 }
37
38 match_dst_mac_test()
39 {
40 local dummy_mac=de:ad:be:ef:aa:aa
41
42 RET=0
43
44 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
45 $tcflags dst_mac $dummy_mac action drop
46 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
47 $tcflags dst_mac $h2mac action drop
48
49 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
50 -t ip -q
51
52 tc_check_packets "dev $h2 ingress" 101 1
53 check_fail $? "Matched on a wrong filter"
54
55 tc_check_packets "dev $h2 ingress" 102 0
56 check_fail $? "Did not match on correct filter"
57
58 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
59 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
60
61 log_test "dst_mac match ($tcflags)"
62 }
63
64 match_src_mac_test()
65 {
66 local dummy_mac=de:ad:be:ef:aa:aa
67
68 RET=0
69
70 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
71 $tcflags src_mac $dummy_mac action drop
72 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
73 $tcflags src_mac $h1mac action drop
74
75 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
76 -t ip -q
77
78 tc_check_packets "dev $h2 ingress" 101 1
79 check_fail $? "Matched on a wrong filter"
80
81 tc_check_packets "dev $h2 ingress" 102 0
82 check_fail $? "Did not match on correct filter"
83
84 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
85 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
86
87 log_test "src_mac match ($tcflags)"
88 }
89
90 match_dst_ip_test()
91 {
92 RET=0
93
94 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
95 $tcflags dst_ip 198.51.100.2 action drop
96 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
97 $tcflags dst_ip 192.0.2.2 action drop
98 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
99 $tcflags dst_ip 192.0.2.0/24 action drop
100
101 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
102 -t ip -q
103
104 tc_check_packets "dev $h2 ingress" 101 1
105 check_fail $? "Matched on a wrong filter"
106
107 tc_check_packets "dev $h2 ingress" 102 1
108 check_err $? "Did not match on correct filter"
109
110 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
111
112 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
113 -t ip -q
114
115 tc_check_packets "dev $h2 ingress" 103 1
116 check_err $? "Did not match on correct filter with mask"
117
118 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
119 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
120
121 log_test "dst_ip match ($tcflags)"
122 }
123
124 match_src_ip_test()
125 {
126 RET=0
127
128 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
129 $tcflags src_ip 198.51.100.1 action drop
130 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
131 $tcflags src_ip 192.0.2.1 action drop
132 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
133 $tcflags src_ip 192.0.2.0/24 action drop
134
135 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
136 -t ip -q
137
138 tc_check_packets "dev $h2 ingress" 101 1
139 check_fail $? "Matched on a wrong filter"
140
141 tc_check_packets "dev $h2 ingress" 102 1
142 check_err $? "Did not match on correct filter"
143
144 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
145
146 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
147 -t ip -q
148
149 tc_check_packets "dev $h2 ingress" 103 1
150 check_err $? "Did not match on correct filter with mask"
151
152 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
153 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
154
155 log_test "src_ip match ($tcflags)"
156 }
157
158 match_ip_flags_test()
159 {
160 RET=0
161
162 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
163 $tcflags ip_flags frag action continue
164 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
165 $tcflags ip_flags firstfrag action continue
166 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
167 $tcflags ip_flags nofirstfrag action continue
168 tc filter add dev $h2 ingress protocol ip pref 4 handle 104 flower \
169 $tcflags ip_flags nofrag action drop
170
171 $MZ $h1 -c 1 -p 1000 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
172 -t ip "frag=0" -q
173
174 tc_check_packets "dev $h2 ingress" 101 1
175 check_fail $? "Matched on wrong frag filter (nofrag)"
176
177 tc_check_packets "dev $h2 ingress" 102 1
178 check_fail $? "Matched on wrong firstfrag filter (nofrag)"
179
180 tc_check_packets "dev $h2 ingress" 103 1
181 check_err $? "Did not match on nofirstfrag filter (nofrag) "
182
183 tc_check_packets "dev $h2 ingress" 104 1
184 check_err $? "Did not match on nofrag filter (nofrag)"
185
186 $MZ $h1 -c 1 -p 1000 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
187 -t ip "frag=0,mf" -q
188
189 tc_check_packets "dev $h2 ingress" 101 1
190 check_err $? "Did not match on frag filter (1stfrag)"
191
192 tc_check_packets "dev $h2 ingress" 102 1
193 check_err $? "Did not match fistfrag filter (1stfrag)"
194
195 tc_check_packets "dev $h2 ingress" 103 1
196 check_err $? "Matched on wrong nofirstfrag filter (1stfrag)"
197
198 tc_check_packets "dev $h2 ingress" 104 1
199 check_err $? "Match on wrong nofrag filter (1stfrag)"
200
201 $MZ $h1 -c 1 -p 1000 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
202 -t ip "frag=256,mf" -q
203 $MZ $h1 -c 1 -p 1000 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
204 -t ip "frag=256" -q
205
206 tc_check_packets "dev $h2 ingress" 101 3
207 check_err $? "Did not match on frag filter (no1stfrag)"
208
209 tc_check_packets "dev $h2 ingress" 102 1
210 check_err $? "Matched on wrong firstfrag filter (no1stfrag)"
211
212 tc_check_packets "dev $h2 ingress" 103 3
213 check_err $? "Did not match on nofirstfrag filter (no1stfrag)"
214
215 tc_check_packets "dev $h2 ingress" 104 1
216 check_err $? "Matched on nofrag filter (no1stfrag)"
217
218 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
219 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
220 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
221 tc filter del dev $h2 ingress protocol ip pref 4 handle 104 flower
222
223 log_test "ip_flags match ($tcflags)"
224 }
225
226 match_pcp_test()
227 {
228 RET=0
229
230 vlan_create $h2 85 v$h2 192.0.2.11/24
231
232 tc filter add dev $h2 ingress protocol 802.1q pref 1 handle 101 \
233 flower vlan_prio 6 $tcflags dst_mac $h2mac action drop
234 tc filter add dev $h2 ingress protocol 802.1q pref 2 handle 102 \
235 flower vlan_prio 7 $tcflags dst_mac $h2mac action drop
236
237 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -B 192.0.2.11 -Q 7:85 -t ip -q
238 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -B 192.0.2.11 -Q 0:85 -t ip -q
239
240 tc_check_packets "dev $h2 ingress" 101 0
241 check_err $? "Matched on specified PCP when should not"
242
243 tc_check_packets "dev $h2 ingress" 102 1
244 check_err $? "Did not match on specified PCP"
245
246 tc filter del dev $h2 ingress protocol 802.1q pref 2 handle 102 flower
247 tc filter del dev $h2 ingress protocol 802.1q pref 1 handle 101 flower
248
249 vlan_destroy $h2 85
250
251 log_test "PCP match ($tcflags)"
252 }
253
254 match_vlan_test()
255 {
256 RET=0
257
258 vlan_create $h2 85 v$h2 192.0.2.11/24
259 vlan_create $h2 75 v$h2 192.0.2.10/24
260
261 tc filter add dev $h2 ingress protocol 802.1q pref 1 handle 101 \
262 flower vlan_id 75 $tcflags action drop
263 tc filter add dev $h2 ingress protocol 802.1q pref 2 handle 102 \
264 flower vlan_id 85 $tcflags action drop
265
266 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -B 192.0.2.11 -Q 0:85 -t ip -q
267
268 tc_check_packets "dev $h2 ingress" 101 0
269 check_err $? "Matched on specified VLAN when should not"
270
271 tc_check_packets "dev $h2 ingress" 102 1
272 check_err $? "Did not match on specified VLAN"
273
274 tc filter del dev $h2 ingress protocol 802.1q pref 2 handle 102 flower
275 tc filter del dev $h2 ingress protocol 802.1q pref 1 handle 101 flower
276
277 vlan_destroy $h2 75
278 vlan_destroy $h2 85
279
280 log_test "VLAN match ($tcflags)"
281 }
282
283 match_ip_tos_test()
284 {
285 RET=0
286
287 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
288 $tcflags dst_ip 192.0.2.2 ip_tos 0x20 action drop
289 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
290 $tcflags dst_ip 192.0.2.2 ip_tos 0x18 action drop
291
292 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
293 -t ip tos=18 -q
294
295 tc_check_packets "dev $h2 ingress" 101 1
296 check_fail $? "Matched on a wrong filter (0x18)"
297
298 tc_check_packets "dev $h2 ingress" 102 1
299 check_err $? "Did not match on correct filter (0x18)"
300
301 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
302 -t ip tos=20 -q
303
304 tc_check_packets "dev $h2 ingress" 102 2
305 check_fail $? "Matched on a wrong filter (0x20)"
306
307 tc_check_packets "dev $h2 ingress" 101 1
308 check_err $? "Did not match on correct filter (0x20)"
309
310 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
311 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
312
313 log_test "ip_tos match ($tcflags)"
314 }
315
316 match_ip_ttl_test()
317 {
318 RET=0
319
320 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
321 $tcflags dst_ip 192.0.2.2 ip_ttl 63 action drop
322 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
323 $tcflags dst_ip 192.0.2.2 action drop
324
325 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
326 -t ip "ttl=63" -q
327
328 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
329 -t ip "ttl=63,mf,frag=256" -q
330
331 tc_check_packets "dev $h2 ingress" 102 1
332 check_fail $? "Matched on the wrong filter (no check on ttl)"
333
334 tc_check_packets "dev $h2 ingress" 101 2
335 check_err $? "Did not match on correct filter (ttl=63)"
336
337 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
338 -t ip "ttl=255" -q
339
340 tc_check_packets "dev $h2 ingress" 101 3
341 check_fail $? "Matched on a wrong filter (ttl=63)"
342
343 tc_check_packets "dev $h2 ingress" 102 1
344 check_err $? "Did not match on correct filter (no check on ttl)"
345
346 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
347 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
348
349 log_test "ip_ttl match ($tcflags)"
350 }
351
352 match_indev_test()
353 {
354 RET=0
355
356 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
357 $tcflags indev $h1 dst_mac $h2mac action drop
358 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
359 $tcflags indev $h2 dst_mac $h2mac action drop
360
361 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
362 -t ip -q
363
364 tc_check_packets "dev $h2 ingress" 101 1
365 check_fail $? "Matched on a wrong filter"
366
367 tc_check_packets "dev $h2 ingress" 102 1
368 check_err $? "Did not match on correct filter"
369
370 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
371 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
372
373 log_test "indev match ($tcflags)"
374 }
375
376 # Unfortunately, mausezahn can't build MPLS headers when used in L2
377 # mode, so we have this function to build Label Stack Entries.
378 mpls_lse()
379 {
380 local label=$1
381 local tc=$2
382 local bos=$3
383 local ttl=$4
384
385 printf "%02x %02x %02x %02x" \
386 $((label >> 12)) \
387 $((label >> 4 & 0xff)) \
388 $((((label & 0xf) << 4) + (tc << 1) + bos)) \
389 $ttl
390 }
391
392 match_mpls_label_test()
393 {
394 local ethtype="88 47"; readonly ethtype
395 local pkt
396
397 RET=0
398
399 check_tc_mpls_support $h2 || return 0
400
401 tc filter add dev $h2 ingress protocol mpls_uc pref 1 handle 101 \
402 flower $tcflags mpls_label 0 action drop
403 tc filter add dev $h2 ingress protocol mpls_uc pref 2 handle 102 \
404 flower $tcflags mpls_label 1048575 action drop
405
406 pkt="$ethtype $(mpls_lse 1048575 0 1 255)"
407 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
408
409 tc_check_packets "dev $h2 ingress" 101 1
410 check_fail $? "Matched on a wrong filter (1048575)"
411
412 tc_check_packets "dev $h2 ingress" 102 1
413 check_err $? "Did not match on correct filter (1048575)"
414
415 pkt="$ethtype $(mpls_lse 0 0 1 255)"
416 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
417
418 tc_check_packets "dev $h2 ingress" 102 2
419 check_fail $? "Matched on a wrong filter (0)"
420
421 tc_check_packets "dev $h2 ingress" 101 1
422 check_err $? "Did not match on correct filter (0)"
423
424 tc filter del dev $h2 ingress protocol mpls_uc pref 2 handle 102 flower
425 tc filter del dev $h2 ingress protocol mpls_uc pref 1 handle 101 flower
426
427 log_test "mpls_label match ($tcflags)"
428 }
429
430 match_mpls_tc_test()
431 {
432 local ethtype="88 47"; readonly ethtype
433 local pkt
434
435 RET=0
436
437 check_tc_mpls_support $h2 || return 0
438
439 tc filter add dev $h2 ingress protocol mpls_uc pref 1 handle 101 \
440 flower $tcflags mpls_tc 0 action drop
441 tc filter add dev $h2 ingress protocol mpls_uc pref 2 handle 102 \
442 flower $tcflags mpls_tc 7 action drop
443
444 pkt="$ethtype $(mpls_lse 0 7 1 255)"
445 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
446
447 tc_check_packets "dev $h2 ingress" 101 1
448 check_fail $? "Matched on a wrong filter (7)"
449
450 tc_check_packets "dev $h2 ingress" 102 1
451 check_err $? "Did not match on correct filter (7)"
452
453 pkt="$ethtype $(mpls_lse 0 0 1 255)"
454 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
455
456 tc_check_packets "dev $h2 ingress" 102 2
457 check_fail $? "Matched on a wrong filter (0)"
458
459 tc_check_packets "dev $h2 ingress" 101 1
460 check_err $? "Did not match on correct filter (0)"
461
462 tc filter del dev $h2 ingress protocol mpls_uc pref 2 handle 102 flower
463 tc filter del dev $h2 ingress protocol mpls_uc pref 1 handle 101 flower
464
465 log_test "mpls_tc match ($tcflags)"
466 }
467
468 match_mpls_bos_test()
469 {
470 local ethtype="88 47"; readonly ethtype
471 local pkt
472
473 RET=0
474
475 check_tc_mpls_support $h2 || return 0
476
477 tc filter add dev $h2 ingress protocol mpls_uc pref 1 handle 101 \
478 flower $tcflags mpls_bos 0 action drop
479 tc filter add dev $h2 ingress protocol mpls_uc pref 2 handle 102 \
480 flower $tcflags mpls_bos 1 action drop
481
482 pkt="$ethtype $(mpls_lse 0 0 1 255)"
483 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
484
485 tc_check_packets "dev $h2 ingress" 101 1
486 check_fail $? "Matched on a wrong filter (1)"
487
488 tc_check_packets "dev $h2 ingress" 102 1
489 check_err $? "Did not match on correct filter (1)"
490
491 # Need to add a second label to properly mark the Bottom of Stack
492 pkt="$ethtype $(mpls_lse 0 0 0 255) $(mpls_lse 0 0 1 255)"
493 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
494
495 tc_check_packets "dev $h2 ingress" 102 2
496 check_fail $? "Matched on a wrong filter (0)"
497
498 tc_check_packets "dev $h2 ingress" 101 1
499 check_err $? "Did not match on correct filter (0)"
500
501 tc filter del dev $h2 ingress protocol mpls_uc pref 2 handle 102 flower
502 tc filter del dev $h2 ingress protocol mpls_uc pref 1 handle 101 flower
503
504 log_test "mpls_bos match ($tcflags)"
505 }
506
507 match_mpls_ttl_test()
508 {
509 local ethtype="88 47"; readonly ethtype
510 local pkt
511
512 RET=0
513
514 check_tc_mpls_support $h2 || return 0
515
516 tc filter add dev $h2 ingress protocol mpls_uc pref 1 handle 101 \
517 flower $tcflags mpls_ttl 0 action drop
518 tc filter add dev $h2 ingress protocol mpls_uc pref 2 handle 102 \
519 flower $tcflags mpls_ttl 255 action drop
520
521 pkt="$ethtype $(mpls_lse 0 0 1 255)"
522 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
523
524 tc_check_packets "dev $h2 ingress" 101 1
525 check_fail $? "Matched on a wrong filter (255)"
526
527 tc_check_packets "dev $h2 ingress" 102 1
528 check_err $? "Did not match on correct filter (255)"
529
530 pkt="$ethtype $(mpls_lse 0 0 1 0)"
531 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
532
533 tc_check_packets "dev $h2 ingress" 102 2
534 check_fail $? "Matched on a wrong filter (0)"
535
536 tc_check_packets "dev $h2 ingress" 101 1
537 check_err $? "Did not match on correct filter (0)"
538
539 tc filter del dev $h2 ingress protocol mpls_uc pref 2 handle 102 flower
540 tc filter del dev $h2 ingress protocol mpls_uc pref 1 handle 101 flower
541
542 log_test "mpls_ttl match ($tcflags)"
543 }
544
545 match_mpls_lse_test()
546 {
547 local ethtype="88 47"; readonly ethtype
548 local pkt
549
550 RET=0
551
552 check_tc_mpls_lse_stats $h2 || return 0
553
554 # Match on first LSE (minimal values for each field)
555 tc filter add dev $h2 ingress protocol mpls_uc pref 1 handle 101 \
556 flower $tcflags mpls lse depth 1 label 0 action continue
557 tc filter add dev $h2 ingress protocol mpls_uc pref 2 handle 102 \
558 flower $tcflags mpls lse depth 1 tc 0 action continue
559 tc filter add dev $h2 ingress protocol mpls_uc pref 3 handle 103 \
560 flower $tcflags mpls lse depth 1 bos 0 action continue
561 tc filter add dev $h2 ingress protocol mpls_uc pref 4 handle 104 \
562 flower $tcflags mpls lse depth 1 ttl 0 action continue
563
564 # Match on second LSE (maximal values for each field)
565 tc filter add dev $h2 ingress protocol mpls_uc pref 5 handle 105 \
566 flower $tcflags mpls lse depth 2 label 1048575 action continue
567 tc filter add dev $h2 ingress protocol mpls_uc pref 6 handle 106 \
568 flower $tcflags mpls lse depth 2 tc 7 action continue
569 tc filter add dev $h2 ingress protocol mpls_uc pref 7 handle 107 \
570 flower $tcflags mpls lse depth 2 bos 1 action continue
571 tc filter add dev $h2 ingress protocol mpls_uc pref 8 handle 108 \
572 flower $tcflags mpls lse depth 2 ttl 255 action continue
573
574 # Match on LSE depth
575 tc filter add dev $h2 ingress protocol mpls_uc pref 9 handle 109 \
576 flower $tcflags mpls lse depth 1 action continue
577 tc filter add dev $h2 ingress protocol mpls_uc pref 10 handle 110 \
578 flower $tcflags mpls lse depth 2 action continue
579 tc filter add dev $h2 ingress protocol mpls_uc pref 11 handle 111 \
580 flower $tcflags mpls lse depth 3 action continue
581
582 # Base packet, matched by all filters (except for stack depth 3)
583 pkt="$ethtype $(mpls_lse 0 0 0 0) $(mpls_lse 1048575 7 1 255)"
584 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
585
586 # Make a variant of the above packet, with a non-matching value
587 # for each LSE field
588
589 # Wrong label at depth 1
590 pkt="$ethtype $(mpls_lse 1 0 0 0) $(mpls_lse 1048575 7 1 255)"
591 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
592
593 # Wrong TC at depth 1
594 pkt="$ethtype $(mpls_lse 0 1 0 0) $(mpls_lse 1048575 7 1 255)"
595 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
596
597 # Wrong BOS at depth 1 (not adding a second LSE here since BOS is set
598 # in the first label, so anything that'd follow wouldn't be considered)
599 pkt="$ethtype $(mpls_lse 0 0 1 0)"
600 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
601
602 # Wrong TTL at depth 1
603 pkt="$ethtype $(mpls_lse 0 0 0 1) $(mpls_lse 1048575 7 1 255)"
604 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
605
606 # Wrong label at depth 2
607 pkt="$ethtype $(mpls_lse 0 0 0 0) $(mpls_lse 1048574 7 1 255)"
608 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
609
610 # Wrong TC at depth 2
611 pkt="$ethtype $(mpls_lse 0 0 0 0) $(mpls_lse 1048575 6 1 255)"
612 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
613
614 # Wrong BOS at depth 2 (adding a third LSE here since BOS isn't set in
615 # the second label)
616 pkt="$ethtype $(mpls_lse 0 0 0 0) $(mpls_lse 1048575 7 0 255)"
617 pkt="$pkt $(mpls_lse 0 0 1 255)"
618 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
619
620 # Wrong TTL at depth 2
621 pkt="$ethtype $(mpls_lse 0 0 0 0) $(mpls_lse 1048575 7 1 254)"
622 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
623
624 # Filters working at depth 1 should match all packets but one
625
626 tc_check_packets "dev $h2 ingress" 101 8
627 check_err $? "Did not match on correct filter"
628
629 tc_check_packets "dev $h2 ingress" 102 8
630 check_err $? "Did not match on correct filter"
631
632 tc_check_packets "dev $h2 ingress" 103 8
633 check_err $? "Did not match on correct filter"
634
635 tc_check_packets "dev $h2 ingress" 104 8
636 check_err $? "Did not match on correct filter"
637
638 # Filters working at depth 2 should match all packets but two (because
639 # of the test packet where the label stack depth is just one)
640
641 tc_check_packets "dev $h2 ingress" 105 7
642 check_err $? "Did not match on correct filter"
643
644 tc_check_packets "dev $h2 ingress" 106 7
645 check_err $? "Did not match on correct filter"
646
647 tc_check_packets "dev $h2 ingress" 107 7
648 check_err $? "Did not match on correct filter"
649
650 tc_check_packets "dev $h2 ingress" 108 7
651 check_err $? "Did not match on correct filter"
652
653 # Finally, verify the filters that only match on LSE depth
654
655 tc_check_packets "dev $h2 ingress" 109 9
656 check_err $? "Did not match on correct filter"
657
658 tc_check_packets "dev $h2 ingress" 110 8
659 check_err $? "Did not match on correct filter"
660
661 tc_check_packets "dev $h2 ingress" 111 1
662 check_err $? "Did not match on correct filter"
663
664 tc filter del dev $h2 ingress protocol mpls_uc pref 11 handle 111 flower
665 tc filter del dev $h2 ingress protocol mpls_uc pref 10 handle 110 flower
666 tc filter del dev $h2 ingress protocol mpls_uc pref 9 handle 109 flower
667 tc filter del dev $h2 ingress protocol mpls_uc pref 8 handle 108 flower
668 tc filter del dev $h2 ingress protocol mpls_uc pref 7 handle 107 flower
669 tc filter del dev $h2 ingress protocol mpls_uc pref 6 handle 106 flower
670 tc filter del dev $h2 ingress protocol mpls_uc pref 5 handle 105 flower
671 tc filter del dev $h2 ingress protocol mpls_uc pref 4 handle 104 flower
672 tc filter del dev $h2 ingress protocol mpls_uc pref 3 handle 103 flower
673 tc filter del dev $h2 ingress protocol mpls_uc pref 2 handle 102 flower
674 tc filter del dev $h2 ingress protocol mpls_uc pref 1 handle 101 flower
675
676 log_test "mpls lse match ($tcflags)"
677 }
678
679 setup_prepare()
680 {
681 h1=${NETIFS[p1]}
682 h2=${NETIFS[p2]}
683 h1mac=$(mac_get $h1)
684 h2mac=$(mac_get $h2)
685
686 vrf_prepare
687
688 h1_create
689 h2_create
690 }
691
692 cleanup()
693 {
694 pre_cleanup
695
696 h2_destroy
697 h1_destroy
698
699 vrf_cleanup
700 }
701
702 trap cleanup EXIT
703
704 setup_prepare
705 setup_wait
706
707 tests_run
708
709 tc_offload_check
710 if [[ $? -ne 0 ]]; then
711 log_info "Could not test offloaded functionality"
712 else
713 tcflags="skip_sw"
714 tests_run
715 fi
716
717 exit $EXIT_STATUS
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.