Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 | #!/bin/bash # SPDX-License-Identifier: GPL-2.0 # # Test tc-police action. # # +---------------------------------+ # | H1 (vrf) | # | + $h1 | # | | 192.0.2.1/24 | # | | | # | | default via 192.0.2.2 | # +----|----------------------------+ # | # +----|----------------------------------------------------------------------+ # | SW | | # | + $rp1 | # | 192.0.2.2/24 | # | | # | 198.51.100.2/24 203.0.113.2/24 | # | + $rp2 + $rp3 | # | | | | # +----|-----------------------------------------|----------------------------+ # | | # +----|----------------------------+ +----|----------------------------+ # | | default via 198.51.100.2 | | | default via 203.0.113.2 | # | | | | | | # | | 198.51.100.1/24 | | | 203.0.113.1/24 | # | + $h2 | | + $h3 | # | H2 (vrf) | | H3 (vrf) | # +---------------------------------+ +---------------------------------+ ALL_TESTS=" police_rx_test police_tx_test police_shared_test police_rx_mirror_test police_tx_mirror_test police_mtu_rx_test police_mtu_tx_test " NUM_NETIFS=6 source tc_common.sh source lib.sh h1_create() { simple_if_init $h1 192.0.2.1/24 ip -4 route add default vrf v$h1 nexthop via 192.0.2.2 } h1_destroy() { ip -4 route del default vrf v$h1 nexthop via 192.0.2.2 simple_if_fini $h1 192.0.2.1/24 } h2_create() { simple_if_init $h2 198.51.100.1/24 ip -4 route add default vrf v$h2 nexthop via 198.51.100.2 tc qdisc add dev $h2 clsact } h2_destroy() { tc qdisc del dev $h2 clsact ip -4 route del default vrf v$h2 nexthop via 198.51.100.2 simple_if_fini $h2 198.51.100.1/24 } h3_create() { simple_if_init $h3 203.0.113.1/24 ip -4 route add default vrf v$h3 nexthop via 203.0.113.2 tc qdisc add dev $h3 clsact } h3_destroy() { tc qdisc del dev $h3 clsact ip -4 route del default vrf v$h3 nexthop via 203.0.113.2 simple_if_fini $h3 203.0.113.1/24 } router_create() { ip link set dev $rp1 up ip link set dev $rp2 up ip link set dev $rp3 up __addr_add_del $rp1 add 192.0.2.2/24 __addr_add_del $rp2 add 198.51.100.2/24 __addr_add_del $rp3 add 203.0.113.2/24 tc qdisc add dev $rp1 clsact tc qdisc add dev $rp2 clsact } router_destroy() { tc qdisc del dev $rp2 clsact tc qdisc del dev $rp1 clsact __addr_add_del $rp3 del 203.0.113.2/24 __addr_add_del $rp2 del 198.51.100.2/24 __addr_add_del $rp1 del 192.0.2.2/24 ip link set dev $rp3 down ip link set dev $rp2 down ip link set dev $rp1 down } police_common_test() { local test_name=$1; shift RET=0 # Rule to measure bandwidth on ingress of $h2 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action drop mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \ -t udp sp=12345,dp=54321 -p 1000 -c 0 -q & local t0=$(tc_rule_stats_get $h2 1 ingress .bytes) sleep 10 local t1=$(tc_rule_stats_get $h2 1 ingress .bytes) local er=$((80 * 1000 * 1000)) local nr=$(rate $t0 $t1 10) local nr_pct=$((100 * (nr - er) / er)) ((-10 <= nr_pct && nr_pct <= 10)) check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%." log_test "$test_name" { kill %% && wait %%; } 2>/dev/null tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower } police_rx_test() { # Rule to police traffic destined to $h2 on ingress of $rp1 tc filter add dev $rp1 ingress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action police rate 80mbit burst 16k conform-exceed drop/ok police_common_test "police on rx" tc filter del dev $rp1 ingress protocol ip pref 1 handle 101 flower } police_tx_test() { # Rule to police traffic destined to $h2 on egress of $rp2 tc filter add dev $rp2 egress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action police rate 80mbit burst 16k conform-exceed drop/ok police_common_test "police on tx" tc filter del dev $rp2 egress protocol ip pref 1 handle 101 flower } police_shared_common_test() { local dport=$1; shift local test_name=$1; shift RET=0 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \ -t udp sp=12345,dp=$dport -p 1000 -c 0 -q & local t0=$(tc_rule_stats_get $h2 1 ingress .bytes) sleep 10 local t1=$(tc_rule_stats_get $h2 1 ingress .bytes) local er=$((80 * 1000 * 1000)) local nr=$(rate $t0 $t1 10) local nr_pct=$((100 * (nr - er) / er)) ((-10 <= nr_pct && nr_pct <= 10)) check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%." log_test "$test_name" { kill %% && wait %%; } 2>/dev/null } police_shared_test() { # Rule to measure bandwidth on ingress of $h2 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp src_port 12345 \ action drop # Rule to police traffic destined to $h2 on ingress of $rp1 tc filter add dev $rp1 ingress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action police rate 80mbit burst 16k conform-exceed drop/ok \ index 10 # Rule to police a different flow destined to $h2 on egress of $rp2 # using same policer tc filter add dev $rp2 egress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 22222 \ action police index 10 police_shared_common_test 54321 "police with shared policer - rx" police_shared_common_test 22222 "police with shared policer - tx" tc filter del dev $rp2 egress protocol ip pref 1 handle 101 flower tc filter del dev $rp1 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower } police_mirror_common_test() { local pol_if=$1; shift local dir=$1; shift local test_name=$1; shift RET=0 # Rule to measure bandwidth on ingress of $h2 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action drop # Rule to measure bandwidth of mirrored traffic on ingress of $h3 tc filter add dev $h3 ingress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action drop # Rule to police traffic destined to $h2 and mirror to $h3 tc filter add dev $pol_if $dir protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action police rate 80mbit burst 16k conform-exceed drop/pipe \ action mirred egress mirror dev $rp3 mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \ -t udp sp=12345,dp=54321 -p 1000 -c 0 -q & local t0=$(tc_rule_stats_get $h2 1 ingress .bytes) sleep 10 local t1=$(tc_rule_stats_get $h2 1 ingress .bytes) local er=$((80 * 1000 * 1000)) local nr=$(rate $t0 $t1 10) local nr_pct=$((100 * (nr - er) / er)) ((-10 <= nr_pct && nr_pct <= 10)) check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%." local t0=$(tc_rule_stats_get $h3 1 ingress .bytes) sleep 10 local t1=$(tc_rule_stats_get $h3 1 ingress .bytes) local er=$((80 * 1000 * 1000)) local nr=$(rate $t0 $t1 10) local nr_pct=$((100 * (nr - er) / er)) ((-10 <= nr_pct && nr_pct <= 10)) check_err $? "Expected rate $(humanize $er), got $(humanize $nr), which is $nr_pct% off. Required accuracy is +-10%." log_test "$test_name" { kill %% && wait %%; } 2>/dev/null tc filter del dev $pol_if $dir protocol ip pref 1 handle 101 flower tc filter del dev $h3 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower } police_rx_mirror_test() { police_mirror_common_test $rp1 ingress "police rx and mirror" } police_tx_mirror_test() { police_mirror_common_test $rp2 egress "police tx and mirror" } police_mtu_common_test() { RET=0 local test_name=$1; shift local dev=$1; shift local direction=$1; shift tc filter add dev $dev $direction protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action police mtu 1042 conform-exceed drop/ok # to count "conform" packets tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ dst_ip 198.51.100.1 ip_proto udp dst_port 54321 \ action drop mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \ -t udp sp=12345,dp=54321 -p 1001 -c 10 -q mausezahn $h1 -a own -b $(mac_get $rp1) -A 192.0.2.1 -B 198.51.100.1 \ -t udp sp=12345,dp=54321 -p 1000 -c 3 -q tc_check_packets "dev $dev $direction" 101 13 check_err $? "wrong packet counter" # "exceed" packets local overlimits_t0=$(tc_rule_stats_get ${dev} 1 ${direction} .overlimits) test ${overlimits_t0} = 10 check_err $? "wrong overlimits, expected 10 got ${overlimits_t0}" # "conform" packets tc_check_packets "dev $h2 ingress" 101 3 check_err $? "forwarding error" tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower tc filter del dev $dev $direction protocol ip pref 1 handle 101 flower log_test "$test_name" } police_mtu_rx_test() { police_mtu_common_test "police mtu (rx)" $rp1 ingress } police_mtu_tx_test() { police_mtu_common_test "police mtu (tx)" $rp2 egress } setup_prepare() { h1=${NETIFS[p1]} rp1=${NETIFS[p2]} rp2=${NETIFS[p3]} h2=${NETIFS[p4]} rp3=${NETIFS[p5]} h3=${NETIFS[p6]} vrf_prepare forwarding_enable h1_create h2_create h3_create router_create } cleanup() { pre_cleanup router_destroy h3_destroy h2_destroy h1_destroy forwarding_restore vrf_cleanup } trap cleanup EXIT setup_prepare setup_wait tests_run exit $EXIT_STATUS |