1437 lines
54 KiB
Bash
Executable File
1437 lines
54 KiB
Bash
Executable File
#!/bin/bash
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# This test is for checking bridge neighbor suppression functionality. The
|
|
# topology consists of two bridges (VTEPs) connected using VXLAN. A single
|
|
# host is connected to each bridge over multiple VLANs. The test checks that
|
|
# ARP/NS messages from the first host are suppressed on the VXLAN port when
|
|
# should.
|
|
#
|
|
# +-----------------------+ +------------------------+
|
|
# | h1 | | h2 |
|
|
# | | | |
|
|
# | + eth0.10 | | + eth0.10 |
|
|
# | | 192.0.2.1/28 | | | 192.0.2.2/28 |
|
|
# | | 2001:db8:1::1/64 | | | 2001:db8:1::2/64 |
|
|
# | | | | | |
|
|
# | | + eth0.20 | | | + eth0.20 |
|
|
# | \ | 192.0.2.17/28 | | \ | 192.0.2.18/28 |
|
|
# | \ | 2001:db8:2::1/64 | | \ | 2001:db8:2::2/64 |
|
|
# | \| | | \| |
|
|
# | + eth0 | | + eth0 |
|
|
# +----|------------------+ +----|-------------------+
|
|
# | |
|
|
# | |
|
|
# +----|-------------------------------+ +----|-------------------------------+
|
|
# | + swp1 + vx0 | | + swp1 + vx0 |
|
|
# | | | | | | | |
|
|
# | | br0 | | | | | |
|
|
# | +------------+-----------+ | | +------------+-----------+ |
|
|
# | | | | | |
|
|
# | | | | | |
|
|
# | +---+---+ | | +---+---+ |
|
|
# | | | | | | | |
|
|
# | | | | | | | |
|
|
# | + + | | + + |
|
|
# | br0.10 br0.20 | | br0.10 br0.20 |
|
|
# | | | |
|
|
# | 192.0.2.33 | | 192.0.2.34 |
|
|
# | + lo | | + lo |
|
|
# | | | |
|
|
# | | | |
|
|
# | 192.0.2.49/28 | | 192.0.2.50/28 |
|
|
# | veth0 +-------+ veth0 |
|
|
# | | | |
|
|
# | sw1 | | sw2 |
|
|
# +------------------------------------+ +------------------------------------+
|
|
|
|
source lib.sh
|
|
ret=0
|
|
|
|
# All tests in this script. Can be overridden with -t option.
|
|
TESTS="
|
|
neigh_suppress_arp
|
|
neigh_suppress_uc_arp
|
|
neigh_suppress_ns
|
|
neigh_suppress_uc_ns
|
|
neigh_vlan_suppress_arp
|
|
neigh_vlan_suppress_ns
|
|
neigh_suppress_arp_probe
|
|
neigh_suppress_dad_ns
|
|
neigh_forward_grat_arp
|
|
neigh_forward_grat_na
|
|
neigh_vlan_forward_grat_arp
|
|
neigh_vlan_forward_grat_na
|
|
"
|
|
VERBOSE=0
|
|
PAUSE_ON_FAIL=no
|
|
PAUSE=no
|
|
|
|
################################################################################
|
|
# Utilities
|
|
|
|
log_test()
|
|
{
|
|
local rc=$1
|
|
local expected=$2
|
|
local msg="$3"
|
|
|
|
if [ ${rc} -eq ${expected} ]; then
|
|
printf "TEST: %-60s [ OK ]\n" "${msg}"
|
|
nsuccess=$((nsuccess+1))
|
|
else
|
|
# shellcheck disable=SC2154
|
|
ret=$(ksft_exit_status_merge "$ret" "$ksft_fail")
|
|
nfail=$((nfail+1))
|
|
printf "TEST: %-60s [FAIL]\n" "${msg}"
|
|
if [ "$VERBOSE" = "1" ]; then
|
|
echo " rc=$rc, expected $expected"
|
|
fi
|
|
|
|
if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
|
|
echo
|
|
echo "hit enter to continue, 'q' to quit"
|
|
read a
|
|
[ "$a" = "q" ] && exit 1
|
|
fi
|
|
fi
|
|
|
|
if [ "${PAUSE}" = "yes" ]; then
|
|
echo
|
|
echo "hit enter to continue, 'q' to quit"
|
|
read a
|
|
[ "$a" = "q" ] && exit 1
|
|
fi
|
|
|
|
[ "$VERBOSE" = "1" ] && echo
|
|
return 0
|
|
}
|
|
|
|
run_cmd()
|
|
{
|
|
local cmd="$1"
|
|
local out
|
|
local stderr="2>/dev/null"
|
|
|
|
if [ "$VERBOSE" = "1" ]; then
|
|
printf "COMMAND: $cmd\n"
|
|
stderr=
|
|
fi
|
|
|
|
out=$(eval $cmd $stderr)
|
|
rc=$?
|
|
if [ "$VERBOSE" = "1" -a -n "$out" ]; then
|
|
echo " $out"
|
|
fi
|
|
|
|
return $rc
|
|
}
|
|
|
|
tc_check_packets()
|
|
{
|
|
local ns=$1; shift
|
|
local id=$1; shift
|
|
local handle=$1; shift
|
|
local count=$1; shift
|
|
local pkts
|
|
|
|
sleep 0.1
|
|
pkts=$(tc -n $ns -j -s filter show $id \
|
|
| jq ".[] | select(.options.handle == $handle) | \
|
|
.options.actions[0].stats.packets")
|
|
[[ $pkts == $count ]]
|
|
}
|
|
|
|
neigh_forward_grat_check()
|
|
{
|
|
if ! bridge link help 2>&1 | grep -q "neigh_forward_grat"; then
|
|
echo "SKIP: iproute2 bridge too old, missing gratuitous ARP/unsolicited NA forwarding control support"
|
|
# shellcheck disable=SC2154
|
|
return "$ksft_skip"
|
|
fi
|
|
}
|
|
|
|
################################################################################
|
|
# Setup
|
|
|
|
setup_topo_ns()
|
|
{
|
|
local ns=$1; shift
|
|
|
|
ip netns exec $ns sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
|
|
ip netns exec $ns sysctl -qw net.ipv6.conf.default.ignore_routes_with_linkdown=1
|
|
ip netns exec $ns sysctl -qw net.ipv6.conf.all.accept_dad=0
|
|
ip netns exec $ns sysctl -qw net.ipv6.conf.default.accept_dad=0
|
|
}
|
|
|
|
setup_topo()
|
|
{
|
|
local ns
|
|
|
|
setup_ns h1 h2 sw1 sw2
|
|
for ns in $h1 $h2 $sw1 $sw2; do
|
|
setup_topo_ns $ns
|
|
done
|
|
|
|
ip -n $h1 link add name eth0 type veth peer name swp1 netns $sw1
|
|
ip -n $sw1 link add name veth0 type veth peer name veth0 netns $sw2
|
|
ip -n $h2 link add name eth0 type veth peer name swp1 netns $sw2
|
|
}
|
|
|
|
setup_host_common()
|
|
{
|
|
local ns=$1; shift
|
|
local v4addr1=$1; shift
|
|
local v4addr2=$1; shift
|
|
local v6addr1=$1; shift
|
|
local v6addr2=$1; shift
|
|
|
|
ip -n $ns link set dev eth0 up
|
|
ip -n $ns link add link eth0 name eth0.10 up type vlan id 10
|
|
ip -n $ns link add link eth0 name eth0.20 up type vlan id 20
|
|
|
|
ip -n $ns address add $v4addr1 dev eth0.10
|
|
ip -n $ns address add $v4addr2 dev eth0.20
|
|
ip -n $ns address add $v6addr1 dev eth0.10
|
|
ip -n $ns address add $v6addr2 dev eth0.20
|
|
}
|
|
|
|
setup_h1()
|
|
{
|
|
local ns=$h1
|
|
local v4addr1=192.0.2.1/28
|
|
local v4addr2=192.0.2.17/28
|
|
local v6addr1=2001:db8:1::1/64
|
|
local v6addr2=2001:db8:2::1/64
|
|
|
|
setup_host_common $ns $v4addr1 $v4addr2 $v6addr1 $v6addr2
|
|
}
|
|
|
|
setup_h2()
|
|
{
|
|
local ns=$h2
|
|
local v4addr1=192.0.2.2/28
|
|
local v4addr2=192.0.2.18/28
|
|
local v6addr1=2001:db8:1::2/64
|
|
local v6addr2=2001:db8:2::2/64
|
|
|
|
setup_host_common $ns $v4addr1 $v4addr2 $v6addr1 $v6addr2
|
|
}
|
|
|
|
setup_sw_common()
|
|
{
|
|
local ns=$1; shift
|
|
local local_addr=$1; shift
|
|
local remote_addr=$1; shift
|
|
local veth_addr=$1; shift
|
|
local gw_addr=$1; shift
|
|
|
|
ip -n $ns address add $local_addr/32 dev lo
|
|
|
|
ip -n $ns link set dev veth0 up
|
|
ip -n $ns address add $veth_addr/28 dev veth0
|
|
ip -n $ns route add default via $gw_addr
|
|
|
|
ip -n $ns link add name br0 up type bridge vlan_filtering 1 \
|
|
vlan_default_pvid 0 mcast_snooping 0
|
|
|
|
ip -n $ns link add link br0 name br0.10 up type vlan id 10
|
|
bridge -n $ns vlan add vid 10 dev br0 self
|
|
|
|
ip -n $ns link add link br0 name br0.20 up type vlan id 20
|
|
bridge -n $ns vlan add vid 20 dev br0 self
|
|
|
|
ip -n $ns link set dev swp1 up master br0
|
|
bridge -n $ns vlan add vid 10 dev swp1
|
|
bridge -n $ns vlan add vid 20 dev swp1
|
|
|
|
ip -n $ns link add name vx0 up master br0 type vxlan \
|
|
local $local_addr dstport 4789 nolearning external
|
|
bridge -n $ns fdb add 00:00:00:00:00:00 dev vx0 self static \
|
|
dst $remote_addr src_vni 10010
|
|
bridge -n $ns fdb add 00:00:00:00:00:00 dev vx0 self static \
|
|
dst $remote_addr src_vni 10020
|
|
bridge -n $ns link set dev vx0 vlan_tunnel on learning off
|
|
|
|
bridge -n $ns vlan add vid 10 dev vx0
|
|
bridge -n $ns vlan add vid 10 dev vx0 tunnel_info id 10010
|
|
|
|
bridge -n $ns vlan add vid 20 dev vx0
|
|
bridge -n $ns vlan add vid 20 dev vx0 tunnel_info id 10020
|
|
}
|
|
|
|
setup_sw1()
|
|
{
|
|
local ns=$sw1
|
|
local local_addr=192.0.2.33
|
|
local remote_addr=192.0.2.34
|
|
local veth_addr=192.0.2.49
|
|
local gw_addr=192.0.2.50
|
|
|
|
setup_sw_common $ns $local_addr $remote_addr $veth_addr $gw_addr
|
|
}
|
|
|
|
setup_sw2()
|
|
{
|
|
local ns=$sw2
|
|
local local_addr=192.0.2.34
|
|
local remote_addr=192.0.2.33
|
|
local veth_addr=192.0.2.50
|
|
local gw_addr=192.0.2.49
|
|
|
|
setup_sw_common $ns $local_addr $remote_addr $veth_addr $gw_addr
|
|
}
|
|
|
|
setup()
|
|
{
|
|
set -e
|
|
|
|
setup_topo
|
|
setup_h1
|
|
setup_h2
|
|
setup_sw1
|
|
setup_sw2
|
|
|
|
sleep 5
|
|
|
|
set +e
|
|
}
|
|
|
|
cleanup()
|
|
{
|
|
cleanup_ns $h1 $h2 $sw1 $sw2
|
|
}
|
|
|
|
################################################################################
|
|
# Tests
|
|
|
|
neigh_suppress_arp_common()
|
|
{
|
|
local vid=$1; shift
|
|
local sip=$1; shift
|
|
local tip=$1; shift
|
|
local h2_mac
|
|
|
|
echo
|
|
echo "Per-port ARP suppression - VLAN $vid"
|
|
echo "----------------------------------"
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto 0x0806 flower indev swp1 arp_tip $tip arp_sip $sip arp_op request action pass"
|
|
|
|
# Initial state - check that ARP requests are not suppressed and that
|
|
# ARP replies are received.
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"
|
|
log_test $? 0 "arping"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "ARP suppression"
|
|
|
|
# Enable neighbor suppression and check that nothing changes compared
|
|
# to the initial state.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"
|
|
log_test $? 0 "arping"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 2
|
|
log_test $? 0 "ARP suppression"
|
|
|
|
# Install an FDB entry for the remote host and check that nothing
|
|
# changes compared to the initial state.
|
|
h2_mac=$(ip -n $h2 -j -p link show eth0.$vid | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac dev vx0 master static vlan $vid"
|
|
log_test $? 0 "FDB entry installation"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"
|
|
log_test $? 0 "arping"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 3
|
|
log_test $? 0 "ARP suppression"
|
|
|
|
# Install a neighbor on the matching SVI interface and check that ARP
|
|
# requests are suppressed.
|
|
run_cmd "ip -n $sw1 neigh replace $tip lladdr $h2_mac nud permanent dev br0.$vid"
|
|
log_test $? 0 "Neighbor entry installation"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"
|
|
log_test $? 0 "arping"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 3
|
|
log_test $? 0 "ARP suppression"
|
|
|
|
# Take the second host down and check that ARP requests are suppressed
|
|
# and that ARP replies are received.
|
|
run_cmd "ip -n $h2 link set dev eth0.$vid down"
|
|
log_test $? 0 "H2 down"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"
|
|
log_test $? 0 "arping"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 3
|
|
log_test $? 0 "ARP suppression"
|
|
|
|
run_cmd "ip -n $h2 link set dev eth0.$vid up"
|
|
log_test $? 0 "H2 up"
|
|
|
|
# Disable neighbor suppression and check that ARP requests are no
|
|
# longer suppressed.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"
|
|
log_test $? 0 "arping"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 4
|
|
log_test $? 0 "ARP suppression"
|
|
|
|
# Take the second host down and check that ARP requests are not
|
|
# suppressed and that ARP replies are not received.
|
|
run_cmd "ip -n $h2 link set dev eth0.$vid down"
|
|
log_test $? 0 "H2 down"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip -I eth0.$vid $tip"
|
|
log_test $? 1 "arping"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 5
|
|
log_test $? 0 "ARP suppression"
|
|
}
|
|
|
|
neigh_suppress_arp()
|
|
{
|
|
local vid=10
|
|
local sip=192.0.2.1
|
|
local tip=192.0.2.2
|
|
|
|
neigh_suppress_arp_common $vid $sip $tip
|
|
|
|
vid=20
|
|
sip=192.0.2.17
|
|
tip=192.0.2.18
|
|
neigh_suppress_arp_common $vid $sip $tip
|
|
}
|
|
|
|
neigh_suppress_uc_arp_common()
|
|
{
|
|
local vid=$1; shift
|
|
local sip=$1; shift
|
|
local tip=$1; shift
|
|
local tmac
|
|
|
|
echo
|
|
echo "Unicast ARP, per-port ARP suppression - VLAN $vid"
|
|
echo "-----------------------------------------------"
|
|
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
tmac=$(ip -n $h2 -j -p link show eth0.$vid | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $tmac dev vx0 master static vlan $vid"
|
|
run_cmd "ip -n $sw1 neigh replace $tip lladdr $tmac nud permanent dev br0.$vid"
|
|
|
|
run_cmd "tc -n $h1 qdisc replace dev eth0.$vid clsact"
|
|
run_cmd "tc -n $h1 filter replace dev eth0.$vid ingress pref 1 handle 101 proto arp flower arp_sip $tip arp_op reply action pass"
|
|
|
|
run_cmd "tc -n $h2 qdisc replace dev eth0.$vid clsact"
|
|
run_cmd "tc -n $h2 filter replace dev eth0.$vid egress pref 1 handle 101 proto arp flower arp_tip $sip arp_op reply action pass"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn eth0.$vid -c 1 -a own -b $tmac -t arp 'request sip=$sip, tip=$tip, tmac=$tmac' -q"
|
|
tc_check_packets $h1 "dev eth0.$vid ingress" 101 1
|
|
log_test $? 0 "Unicast ARP, suppression on, h1 filter"
|
|
tc_check_packets $h2 "dev eth0.$vid egress" 101 1
|
|
log_test $? 0 "Unicast ARP, suppression on, h2 filter"
|
|
}
|
|
|
|
neigh_suppress_uc_arp()
|
|
{
|
|
local vid=10
|
|
local sip=192.0.2.1
|
|
local tip=192.0.2.2
|
|
|
|
neigh_suppress_uc_arp_common $vid $sip $tip
|
|
|
|
vid=20
|
|
sip=192.0.2.17
|
|
tip=192.0.2.18
|
|
neigh_suppress_uc_arp_common $vid $sip $tip
|
|
}
|
|
|
|
neigh_suppress_ns_common()
|
|
{
|
|
local vid=$1; shift
|
|
local saddr=$1; shift
|
|
local daddr=$1; shift
|
|
local maddr=$1; shift
|
|
local h2_mac
|
|
|
|
echo
|
|
echo "Per-port NS suppression - VLAN $vid"
|
|
echo "---------------------------------"
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $maddr src_ip $saddr type 135 code 0 action pass"
|
|
|
|
# Initial state - check that NS messages are not suppressed and that ND
|
|
# messages are received.
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"
|
|
log_test $? 0 "ndisc6"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "NS suppression"
|
|
|
|
# Enable neighbor suppression and check that nothing changes compared
|
|
# to the initial state.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"
|
|
log_test $? 0 "ndisc6"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 2
|
|
log_test $? 0 "NS suppression"
|
|
|
|
# Install an FDB entry for the remote host and check that nothing
|
|
# changes compared to the initial state.
|
|
h2_mac=$(ip -n $h2 -j -p link show eth0.$vid | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac dev vx0 master static vlan $vid"
|
|
log_test $? 0 "FDB entry installation"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"
|
|
log_test $? 0 "ndisc6"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 3
|
|
log_test $? 0 "NS suppression"
|
|
|
|
# Install a neighbor on the matching SVI interface and check that NS
|
|
# messages are suppressed.
|
|
run_cmd "ip -n $sw1 neigh replace $daddr lladdr $h2_mac nud permanent dev br0.$vid"
|
|
log_test $? 0 "Neighbor entry installation"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"
|
|
log_test $? 0 "ndisc6"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 3
|
|
log_test $? 0 "NS suppression"
|
|
|
|
# Take the second host down and check that NS messages are suppressed
|
|
# and that ND messages are received.
|
|
run_cmd "ip -n $h2 link set dev eth0.$vid down"
|
|
log_test $? 0 "H2 down"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"
|
|
log_test $? 0 "ndisc6"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 3
|
|
log_test $? 0 "NS suppression"
|
|
|
|
run_cmd "ip -n $h2 link set dev eth0.$vid up"
|
|
log_test $? 0 "H2 up"
|
|
|
|
# Disable neighbor suppression and check that NS messages are no longer
|
|
# suppressed.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"
|
|
log_test $? 0 "ndisc6"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 4
|
|
log_test $? 0 "NS suppression"
|
|
|
|
# Take the second host down and check that NS messages are not
|
|
# suppressed and that ND messages are not received.
|
|
run_cmd "ip -n $h2 link set dev eth0.$vid down"
|
|
log_test $? 0 "H2 down"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr -w 5000 $daddr eth0.$vid"
|
|
log_test $? 2 "ndisc6"
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 5
|
|
log_test $? 0 "NS suppression"
|
|
}
|
|
|
|
neigh_suppress_ns()
|
|
{
|
|
local vid=10
|
|
local saddr=2001:db8:1::1
|
|
local daddr=2001:db8:1::2
|
|
local maddr=ff02::1:ff00:2
|
|
|
|
neigh_suppress_ns_common $vid $saddr $daddr $maddr
|
|
|
|
vid=20
|
|
saddr=2001:db8:2::1
|
|
daddr=2001:db8:2::2
|
|
maddr=ff02::1:ff00:2
|
|
|
|
neigh_suppress_ns_common $vid $saddr $daddr $maddr
|
|
}
|
|
|
|
icmpv6_header_get()
|
|
{
|
|
local csum=$1; shift
|
|
local tip=$1; shift
|
|
local type
|
|
local p
|
|
|
|
# Type 135 (Neighbor Solicitation), hex format
|
|
type="87"
|
|
p=$(:
|
|
)"$type:"$( : ICMPv6.type
|
|
)"00:"$( : ICMPv6.code
|
|
)"$csum:"$( : ICMPv6.checksum
|
|
)"00:00:00:00:"$( : Reserved
|
|
)"$tip:"$( : Target Address
|
|
)
|
|
echo $p
|
|
}
|
|
|
|
icmpv6_na_header_get()
|
|
{
|
|
local csum=$1; shift
|
|
local tip=$1; shift
|
|
|
|
# Type 136 (Neighbor Advertisement), hex format, Override flag set,
|
|
# Solicited flag clear (unsolicited NA).
|
|
# ICMPv6.type : ICMPv6.code : ICMPv6.checksum : Flags : Target Address
|
|
echo "88:00:$csum:20:00:00:00:$tip:"
|
|
}
|
|
|
|
neigh_suppress_uc_ns_common()
|
|
{
|
|
local vid=$1; shift
|
|
local sip=$1; shift
|
|
local dip=$1; shift
|
|
local full_dip=$1; shift
|
|
local csum=$1; shift
|
|
local tmac
|
|
|
|
echo
|
|
echo "Unicast NS, per-port NS suppression - VLAN $vid"
|
|
echo "---------------------------------------------"
|
|
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
tmac=$(ip -n $h2 -j -p link show eth0.$vid | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $tmac dev vx0 master static vlan $vid"
|
|
run_cmd "ip -n $sw1 -6 neigh replace $dip lladdr $tmac nud permanent dev br0.$vid"
|
|
|
|
run_cmd "tc -n $h1 qdisc replace dev eth0.$vid clsact"
|
|
run_cmd "tc -n $h1 filter replace dev eth0.$vid ingress pref 1 handle 101 proto ipv6 flower ip_proto icmpv6 src_ip $dip type 136 code 0 action pass"
|
|
|
|
run_cmd "tc -n $h2 qdisc replace dev eth0.$vid clsact"
|
|
run_cmd "tc -n $h2 filter replace dev eth0.$vid egress pref 1 handle 101 proto ipv6 flower ip_proto icmpv6 dst_ip $sip type 136 code 0 action pass"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a own -b $tmac -A $sip -B $dip -t ip hop=255,next=58,payload=$(icmpv6_header_get $csum $full_dip) -q"
|
|
tc_check_packets $h1 "dev eth0.$vid ingress" 101 1
|
|
log_test $? 0 "Unicast NS, suppression on, h1 filter"
|
|
tc_check_packets $h2 "dev eth0.$vid egress" 101 1
|
|
log_test $? 0 "Unicast NS, suppression on, h2 filter"
|
|
}
|
|
|
|
neigh_suppress_uc_ns()
|
|
{
|
|
local vid=10
|
|
local saddr=2001:db8:1::1
|
|
local daddr=2001:db8:1::2
|
|
local full_daddr=20:01:0d:b8:00:01:00:00:00:00:00:00:00:00:00:02
|
|
local csum="ef:79"
|
|
|
|
neigh_suppress_uc_ns_common $vid $saddr $daddr $full_daddr $csum
|
|
|
|
vid=20
|
|
saddr=2001:db8:2::1
|
|
daddr=2001:db8:2::2
|
|
full_daddr=20:01:0d:b8:00:02:00:00:00:00:00:00:00:00:00:02
|
|
csum="ef:76"
|
|
|
|
neigh_suppress_uc_ns_common $vid $saddr $daddr $full_daddr $csum
|
|
}
|
|
|
|
neigh_vlan_suppress_arp()
|
|
{
|
|
local vid1=10
|
|
local vid2=20
|
|
local sip1=192.0.2.1
|
|
local sip2=192.0.2.17
|
|
local tip1=192.0.2.2
|
|
local tip2=192.0.2.18
|
|
local h2_mac1
|
|
local h2_mac2
|
|
|
|
echo
|
|
echo "Per-{Port, VLAN} ARP suppression"
|
|
echo "--------------------------------"
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto 0x0806 flower indev swp1 arp_tip $tip1 arp_sip $sip1 arp_op request action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto 0x0806 flower indev swp1 arp_tip $tip2 arp_sip $sip2 arp_op request action pass"
|
|
|
|
h2_mac1=$(ip -n $h2 -j -p link show eth0.$vid1 | jq -r '.[]["address"]')
|
|
h2_mac2=$(ip -n $h2 -j -p link show eth0.$vid2 | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac1 dev vx0 master static vlan $vid1"
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac2 dev vx0 master static vlan $vid2"
|
|
run_cmd "ip -n $sw1 neigh replace $tip1 lladdr $h2_mac1 nud permanent dev br0.$vid1"
|
|
run_cmd "ip -n $sw1 neigh replace $tip2 lladdr $h2_mac2 nud permanent dev br0.$vid2"
|
|
|
|
# Enable per-{Port, VLAN} neighbor suppression and check that ARP
|
|
# requests are not suppressed and that ARP replies are received.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress on\""
|
|
log_test $? 0 "\"neigh_vlan_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"
|
|
log_test $? 0 "arping (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"
|
|
log_test $? 0 "arping (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "ARP suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 1
|
|
log_test $? 0 "ARP suppression (VLAN $vid2)"
|
|
|
|
# Enable neighbor suppression on VLAN 10 and check that only on this
|
|
# VLAN ARP requests are suppressed.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid1)"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid2 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid2)"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"
|
|
log_test $? 0 "arping (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"
|
|
log_test $? 0 "arping (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "ARP suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 2
|
|
log_test $? 0 "ARP suppression (VLAN $vid2)"
|
|
|
|
# Enable neighbor suppression on the port and check that it has no
|
|
# effect compared to previous state.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"
|
|
log_test $? 0 "arping (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"
|
|
log_test $? 0 "arping (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "ARP suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 3
|
|
log_test $? 0 "ARP suppression (VLAN $vid2)"
|
|
|
|
# Disable neighbor suppression on the port and check that it has no
|
|
# effect compared to previous state.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"
|
|
log_test $? 0 "arping (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"
|
|
log_test $? 0 "arping (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "ARP suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 4
|
|
log_test $? 0 "ARP suppression (VLAN $vid2)"
|
|
|
|
# Disable neighbor suppression on VLAN 10 and check that ARP requests
|
|
# are no longer suppressed on this VLAN.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"
|
|
log_test $? 0 "arping (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"
|
|
log_test $? 0 "arping (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 2
|
|
log_test $? 0 "ARP suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 5
|
|
log_test $? 0 "ARP suppression (VLAN $vid2)"
|
|
|
|
# Disable per-{Port, VLAN} neighbor suppression, enable neighbor
|
|
# suppression on the port and check that on both VLANs ARP requests are
|
|
# suppressed.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress off\""
|
|
log_test $? 0 "\"neigh_vlan_suppress\" is off"
|
|
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip1 -I eth0.$vid1 $tip1"
|
|
log_test $? 0 "arping (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 arping -q -b -c 1 -w 5 -s $sip2 -I eth0.$vid2 $tip2"
|
|
log_test $? 0 "arping (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 2
|
|
log_test $? 0 "ARP suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 5
|
|
log_test $? 0 "ARP suppression (VLAN $vid2)"
|
|
}
|
|
|
|
neigh_vlan_suppress_ns()
|
|
{
|
|
local vid1=10
|
|
local vid2=20
|
|
local saddr1=2001:db8:1::1
|
|
local saddr2=2001:db8:2::1
|
|
local daddr1=2001:db8:1::2
|
|
local daddr2=2001:db8:2::2
|
|
local maddr=ff02::1:ff00:2
|
|
local h2_mac1
|
|
local h2_mac2
|
|
|
|
echo
|
|
echo "Per-{Port, VLAN} NS suppression"
|
|
echo "-------------------------------"
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $maddr src_ip $saddr1 type 135 code 0 action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $maddr src_ip $saddr2 type 135 code 0 action pass"
|
|
|
|
h2_mac1=$(ip -n $h2 -j -p link show eth0.$vid1 | jq -r '.[]["address"]')
|
|
h2_mac2=$(ip -n $h2 -j -p link show eth0.$vid2 | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac1 dev vx0 master static vlan $vid1"
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac2 dev vx0 master static vlan $vid2"
|
|
run_cmd "ip -n $sw1 neigh replace $daddr1 lladdr $h2_mac1 nud permanent dev br0.$vid1"
|
|
run_cmd "ip -n $sw1 neigh replace $daddr2 lladdr $h2_mac2 nud permanent dev br0.$vid2"
|
|
|
|
# Enable per-{Port, VLAN} neighbor suppression and check that NS
|
|
# messages are not suppressed and that ND messages are received.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress on\""
|
|
log_test $? 0 "\"neigh_vlan_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"
|
|
log_test $? 0 "ndisc6 (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"
|
|
log_test $? 0 "ndisc6 (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "NS suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 1
|
|
log_test $? 0 "NS suppression (VLAN $vid2)"
|
|
|
|
# Enable neighbor suppression on VLAN 10 and check that only on this
|
|
# VLAN NS messages are suppressed.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid1)"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid2 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid2)"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"
|
|
log_test $? 0 "ndisc6 (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"
|
|
log_test $? 0 "ndisc6 (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "NS suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 2
|
|
log_test $? 0 "NS suppression (VLAN $vid2)"
|
|
|
|
# Enable neighbor suppression on the port and check that it has no
|
|
# effect compared to previous state.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"
|
|
log_test $? 0 "ndisc6 (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"
|
|
log_test $? 0 "ndisc6 (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "NS suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 3
|
|
log_test $? 0 "NS suppression (VLAN $vid2)"
|
|
|
|
# Disable neighbor suppression on the port and check that it has no
|
|
# effect compared to previous state.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"
|
|
log_test $? 0 "ndisc6 (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"
|
|
log_test $? 0 "ndisc6 (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 1
|
|
log_test $? 0 "NS suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 4
|
|
log_test $? 0 "NS suppression (VLAN $vid2)"
|
|
|
|
# Disable neighbor suppression on VLAN 10 and check that NS messages
|
|
# are no longer suppressed on this VLAN.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"
|
|
log_test $? 0 "ndisc6 (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"
|
|
log_test $? 0 "ndisc6 (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 2
|
|
log_test $? 0 "NS suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 5
|
|
log_test $? 0 "NS suppression (VLAN $vid2)"
|
|
|
|
# Disable per-{Port, VLAN} neighbor suppression, enable neighbor
|
|
# suppression on the port and check that on both VLANs NS messages are
|
|
# suppressed.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress off\""
|
|
log_test $? 0 "\"neigh_vlan_suppress\" is off"
|
|
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr1 -w 5000 $daddr1 eth0.$vid1"
|
|
log_test $? 0 "ndisc6 (VLAN $vid1)"
|
|
run_cmd "ip netns exec $h1 ndisc6 -q -r 1 -s $saddr2 -w 5000 $daddr2 eth0.$vid2"
|
|
log_test $? 0 "ndisc6 (VLAN $vid2)"
|
|
|
|
tc_check_packets $sw1 "dev vx0 egress" 101 2
|
|
log_test $? 0 "NS suppression (VLAN $vid1)"
|
|
tc_check_packets $sw1 "dev vx0 egress" 102 5
|
|
log_test $? 0 "NS suppression (VLAN $vid2)"
|
|
}
|
|
|
|
neigh_suppress_arp_probe()
|
|
{
|
|
local vid=10
|
|
local tip=192.0.2.2
|
|
local h2_mac
|
|
|
|
echo
|
|
echo "Per-port ARP probe suppression"
|
|
echo "------------------------------"
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto 0x0806 flower indev swp1 arp_tip $tip arp_sip 0.0.0.0 arp_op request action pass"
|
|
|
|
# Initial state - check that ARP probes are not suppressed.
|
|
run_cmd "ip netns exec $h1 arping -D -q -c 1 -w 5 -I eth0.$vid $tip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "ARP probe suppression"
|
|
|
|
# Enable neighbor suppression and check that nothing changes.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 arping -D -q -c 1 -w 5 -I eth0.$vid $tip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 2
|
|
log_test $? 0 "ARP probe suppression"
|
|
|
|
# Install FDB and a neighbor and check that ARP probes are suppressed.
|
|
h2_mac=$(ip -n "$h2" -j -p link show eth0."$vid" | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac dev vx0 master static vlan $vid"
|
|
run_cmd "ip -n $sw1 neigh replace $tip lladdr $h2_mac nud permanent dev br0.$vid"
|
|
log_test $? 0 "FDB and neighbor entry installation"
|
|
|
|
run_cmd "ip netns exec $h1 arping -D -q -c 1 -w 5 -I eth0.$vid $tip"
|
|
log_test $? 1 "arping"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 2
|
|
log_test $? 0 "ARP probe suppression"
|
|
|
|
# Remove the neighbor entry and check that ARP probes are not suppressed.
|
|
run_cmd "ip -n $sw1 neigh del $tip dev br0.$vid"
|
|
log_test $? 0 "neighbor removal"
|
|
|
|
run_cmd "ip netns exec $h1 arping -D -q -c 1 -w 5 -I eth0.$vid $tip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 3
|
|
log_test $? 0 "ARP probe suppression"
|
|
|
|
# Disable neighbor suppression.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 arping -D -q -c 1 -w 5 -I eth0.$vid $tip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 4
|
|
log_test $? 0 "ARP probe suppression"
|
|
}
|
|
|
|
neigh_suppress_dad_ns()
|
|
{
|
|
local vid=10
|
|
local tip=2001:db8:1::99
|
|
local mcast=ff02::1:ff00:99
|
|
local dmac=33:33:ff:00:00:99
|
|
local full_tip=20:01:0d:b8:00:01:00:00:00:00:00:00:00:00:00:99
|
|
local csum="4b:bc"
|
|
local smac
|
|
local tmac
|
|
|
|
echo
|
|
echo "Per-port DAD NS suppression"
|
|
echo "---------------------------"
|
|
|
|
smac=$(ip -n "$h1" -j -p link show eth0."$vid" | jq -r '.[]["address"]')
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $mcast src_ip :: type 135 code 0 action pass"
|
|
|
|
# Initial state - check that DAD NS are not suppressed.
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A :: -B $mcast -t ip hop=255,next=58,payload=$(icmpv6_header_get "$csum" "$full_tip") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "DAD NS suppression"
|
|
|
|
# Enable neighbor suppression and check that nothing changes.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A :: -B $mcast -t ip hop=255,next=58,payload=$(icmpv6_header_get "$csum" "$full_tip") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 2
|
|
log_test $? 0 "DAD NS suppression"
|
|
|
|
# Install FDB and a neighbor and check that DAD NS are suppressed
|
|
# and that a proxy NA is sent back to h1.
|
|
tmac=$(ip -n "$h2" -j -p link show eth0."$vid" | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $tmac dev vx0 master static vlan $vid"
|
|
run_cmd "ip -n $sw1 -6 neigh replace $tip lladdr $tmac nud permanent dev br0.$vid"
|
|
log_test $? 0 "FDB and neighbor entry installation"
|
|
|
|
run_cmd "tc -n $h1 qdisc replace dev eth0.$vid clsact"
|
|
run_cmd "tc -n $h1 filter replace dev eth0.$vid ingress pref 1 handle 101 proto ipv6 flower ip_proto icmpv6 dst_ip ff02::1 src_ip $tip type 136 code 0 action pass"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A :: -B $mcast -t ip hop=255,next=58,payload=$(icmpv6_header_get "$csum" "$full_tip") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 2
|
|
log_test $? 0 "DAD NS suppression"
|
|
tc_check_packets "$h1" "dev eth0.$vid ingress" 101 1
|
|
log_test $? 0 "DAD NS proxy NA reply"
|
|
|
|
# Remove the neighbor entry and check that DAD NS are not suppressed.
|
|
run_cmd "ip -n $sw1 -6 neigh del $tip dev br0.$vid"
|
|
log_test $? 0 "neighbor removal"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A :: -B $mcast -t ip hop=255,next=58,payload=$(icmpv6_header_get "$csum" "$full_tip") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 3
|
|
log_test $? 0 "DAD NS suppression"
|
|
|
|
# Disable neighbor suppression.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress off\""
|
|
log_test $? 0 "\"neigh_suppress\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A :: -B $mcast -t ip hop=255,next=58,payload=$(icmpv6_header_get "$csum" "$full_tip") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 4
|
|
log_test $? 0 "DAD NS suppression"
|
|
}
|
|
|
|
neigh_forward_grat_arp()
|
|
{
|
|
local vid=10
|
|
local sip=192.0.2.1
|
|
local tip=$sip
|
|
local h2_ip=192.0.2.2
|
|
local h2_mac
|
|
|
|
neigh_forward_grat_check || return $?
|
|
|
|
echo
|
|
echo "Gratuitous ARP forwarding"
|
|
echo "-------------------------"
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto 0x0806 flower indev swp1 arp_tip $tip arp_sip $sip arp_op request action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto 0x0806 flower indev swp1 arp_tip $h2_ip arp_sip $sip arp_op request action pass"
|
|
|
|
h2_mac=$(ip -n "$h2" -j -p link show eth0."$vid" | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac dev vx0 master static vlan $vid"
|
|
run_cmd "ip -n $sw1 neigh replace $tip lladdr $h2_mac nud permanent dev br0.$vid"
|
|
run_cmd "ip -n $sw1 neigh replace $h2_ip lladdr $h2_mac nud permanent dev br0.$vid"
|
|
|
|
# Enable neighbor suppression. Gratuitous ARP should be suppressed by
|
|
# default (neigh_forward_grat defaults to off).
|
|
run_cmd "ip -n $sw1 link set dev vx0 type bridge_slave neigh_suppress on"
|
|
run_cmd "ip -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
# Send gratuitous ARP (sip == tip) and check it's suppressed.
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid $tip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 0
|
|
log_test $? 0 "Gratuitous ARP suppression"
|
|
|
|
# Explicitly enable neigh_forward_grat and verify gratuitous ARP is
|
|
# now forwarded.
|
|
run_cmd "ip -n $sw1 link set dev vx0 type bridge_slave neigh_forward_grat on"
|
|
run_cmd "ip -n $sw1 -d link show dev vx0 | grep \"neigh_forward_grat on\""
|
|
log_test $? 0 "\"neigh_forward_grat\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid $tip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "Gratuitous ARP forwarding"
|
|
|
|
# Verify that regular (non-gratuitous) ARP requests are still
|
|
# suppressed when neigh_forward_grat is enabled.
|
|
run_cmd "ip netns exec $h1 arping -c 1 -w 5 -I eth0.$vid $h2_ip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 102 0
|
|
log_test $? 0 "Regular ARP suppression with \"neigh_forward_grat\" on"
|
|
|
|
# Disable neigh_forward_grat and verify suppression resumes.
|
|
run_cmd "ip -n $sw1 link set dev vx0 type bridge_slave neigh_forward_grat off"
|
|
run_cmd "ip -n $sw1 -d link show dev vx0 | grep \"neigh_forward_grat off\""
|
|
log_test $? 0 "\"neigh_forward_grat\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid $tip"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "Gratuitous ARP suppression"
|
|
}
|
|
|
|
# neigh_forward_grat_arp() uses 'ip link' interface, and neigh_forward_grat_na()
|
|
# uses 'bridge link' interface to exercise both paths.
|
|
neigh_forward_grat_na()
|
|
{
|
|
local vid=10
|
|
local saddr=2001:db8:1::1
|
|
local daddr=ff02::1
|
|
local h2_addr=2001:db8:1::2
|
|
local h2_maddr=ff02::1:ff00:2
|
|
local full_addr=20:01:0d:b8:00:01:00:00:00:00:00:00:00:00:00:01
|
|
local h2_full_addr=20:01:0d:b8:00:01:00:00:00:00:00:00:00:00:00:02
|
|
local csum="fd:32"
|
|
local csum_ns="1f:2f"
|
|
local dmac=33:33:00:00:00:01
|
|
local h2_dmac=33:33:ff:00:00:02
|
|
local h2_mac
|
|
local smac
|
|
|
|
neigh_forward_grat_check || return $?
|
|
|
|
echo
|
|
echo "Unsolicited NA forwarding"
|
|
echo "-------------------------"
|
|
|
|
smac=$(ip -n "$h1" -j -p link show eth0."$vid" | jq -r '.[]["address"]')
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $daddr src_ip $saddr type 136 code 0 action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $h2_maddr src_ip $saddr type 135 code 0 action pass"
|
|
|
|
h2_mac=$(ip -n "$h2" -j -p link show eth0."$vid" | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac dev vx0 master static vlan $vid"
|
|
run_cmd "ip -n $sw1 neigh replace $saddr lladdr $h2_mac nud permanent dev br0.$vid"
|
|
run_cmd "ip -n $sw1 neigh replace $h2_addr lladdr $h2_mac nud permanent dev br0.$vid"
|
|
|
|
# Enable neighbor suppression. Unsolicited NA should be suppressed by
|
|
# default (neigh_forward_grat defaults to off).
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on"
|
|
|
|
# Send unsolicited NA and check it's suppressed.
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A $saddr -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum" "$full_addr") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 0
|
|
log_test $? 0 "Unsolicited NA suppression"
|
|
|
|
# Explicitly enable neigh_forward_grat and verify unsolicited NA is
|
|
# now forwarded.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_forward_grat on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_forward_grat on\""
|
|
log_test $? 0 "\"neigh_forward_grat\" is on"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A $saddr -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum" "$full_addr") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "Unsolicited NA forwarding"
|
|
|
|
# Verify that solicited NS messages are still suppressed when
|
|
# neigh_forward_grat is enabled.
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $h2_dmac -A $saddr -B $h2_maddr -t ip hop=255,next=58,payload=$(icmpv6_header_get "$csum_ns" "$h2_full_addr") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 102 0
|
|
log_test $? 0 "Solicited NS suppression with \"neigh_forward_grat\" on"
|
|
|
|
# Disable neigh_forward_grat and verify suppression resumes.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_forward_grat off"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_forward_grat off\""
|
|
log_test $? 0 "\"neigh_forward_grat\" is off"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid -c 1 -a $smac -b $dmac -A $saddr -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum" "$full_addr") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "Unsolicited NA suppression"
|
|
}
|
|
|
|
neigh_vlan_forward_grat_arp()
|
|
{
|
|
local vid1=10
|
|
local vid2=20
|
|
local sip1=192.0.2.1
|
|
local sip2=192.0.2.17
|
|
local h2_ip1=192.0.2.2
|
|
local h2_mac1
|
|
local h2_mac2
|
|
|
|
neigh_forward_grat_check || return $?
|
|
|
|
echo
|
|
echo "Per-VLAN gratuitous ARP forwarding"
|
|
echo "----------------------------------"
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto 0x0806 flower indev swp1 arp_tip $sip1 arp_sip $sip1 arp_op request action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto 0x0806 flower indev swp1 arp_tip $sip2 arp_sip $sip2 arp_op request action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 103 proto 0x0806 flower indev swp1 arp_tip $h2_ip1 arp_sip $sip1 arp_op request action pass"
|
|
|
|
h2_mac1=$(ip -n "$h2" -j -p link show eth0."$vid1" | jq -r '.[]["address"]')
|
|
h2_mac2=$(ip -n "$h2" -j -p link show eth0."$vid2" | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac1 dev vx0 master static vlan $vid1"
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac2 dev vx0 master static vlan $vid2"
|
|
run_cmd "ip -n $sw1 neigh replace $sip1 lladdr $h2_mac1 nud permanent dev br0.$vid1"
|
|
run_cmd "ip -n $sw1 neigh replace $sip2 lladdr $h2_mac2 nud permanent dev br0.$vid2"
|
|
run_cmd "ip -n $sw1 neigh replace $h2_ip1 lladdr $h2_mac1 nud permanent dev br0.$vid1"
|
|
|
|
# Enable per-{Port, VLAN} neighbor suppression.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress on\""
|
|
log_test $? 0 "\"neigh_vlan_suppress\" is on"
|
|
|
|
# Enable neighbor suppression on VLAN 10. Gratuitous ARP should be
|
|
# suppressed by default on VLAN 10 (neigh_forward_grat defaults to off)
|
|
# but not on VLAN 20.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid1 $sip1"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 0
|
|
log_test $? 0 "Gratuitous ARP suppression (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid2 $sip2"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 102 1
|
|
log_test $? 0 "Gratuitous ARP forwarding (VLAN $vid2)"
|
|
|
|
# Enable neigh_forward_grat on VLAN 10 and verify gratuitous ARP is
|
|
# now forwarded.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_forward_grat on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_forward_grat on\""
|
|
log_test $? 0 "\"neigh_forward_grat\" is on (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid1 $sip1"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "Gratuitous ARP forwarding (VLAN $vid1)"
|
|
|
|
# Verify that regular (non-gratuitous) ARP requests on VLAN $vid1 are
|
|
# still suppressed when neigh_forward_grat is enabled.
|
|
run_cmd "ip netns exec $h1 arping -c 1 -w 5 -I eth0.$vid1 $h2_ip1"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 103 0
|
|
log_test $? 0 "Regular ARP suppression with \"neigh_forward_grat\" on (VLAN $vid1)"
|
|
|
|
# Enable neighbor suppression on VLAN 20 (neigh_forward_grat defaults to
|
|
# off), and verify gratuitous ARP is suppressed on VLAN 20.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid2 dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid2 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid2)"
|
|
|
|
# VLAN 10 should still forward (neigh_forward_grat is on).
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid1 $sip1"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 2
|
|
log_test $? 0 "Gratuitous ARP forwarding (VLAN $vid1)"
|
|
|
|
# VLAN 20 should suppress (neigh_forward_grat defaults to off).
|
|
run_cmd "ip netns exec $h1 arping -U -c 1 -w 5 -I eth0.$vid2 $sip2"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 102 1
|
|
log_test $? 0 "Gratuitous ARP suppression (VLAN $vid2)"
|
|
}
|
|
|
|
neigh_vlan_forward_grat_na()
|
|
{
|
|
local vid1=10
|
|
local vid2=20
|
|
local saddr1=2001:db8:1::1
|
|
local daddr=ff02::1
|
|
local h2_addr1=2001:db8:1::2
|
|
local h2_maddr1=ff02::1:ff00:2
|
|
local full_addr1=20:01:0d:b8:00:01:00:00:00:00:00:00:00:00:00:01
|
|
local h2_full_addr1=20:01:0d:b8:00:01:00:00:00:00:00:00:00:00:00:02
|
|
local csum1="fd:32"
|
|
local csum_ns1="1f:2f"
|
|
local saddr2=2001:db8:2::1
|
|
local full_addr2=20:01:0d:b8:00:02:00:00:00:00:00:00:00:00:00:01
|
|
local csum2="fd:30"
|
|
local dmac=33:33:00:00:00:01
|
|
local h2_dmac1=33:33:ff:00:00:02
|
|
local h2_mac1
|
|
local h2_mac2
|
|
local smac
|
|
|
|
neigh_forward_grat_check || return $?
|
|
|
|
echo
|
|
echo "Per-VLAN unsolicited NA forwarding"
|
|
echo "----------------------------------"
|
|
|
|
smac=$(ip -n "$h1" -j -p link show eth0."$vid1" | jq -r '.[]["address"]')
|
|
|
|
run_cmd "tc -n $sw1 qdisc replace dev vx0 clsact"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 101 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $daddr src_ip $saddr1 type 136 code 0 action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 102 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $daddr src_ip $saddr2 type 136 code 0 action pass"
|
|
run_cmd "tc -n $sw1 filter replace dev vx0 egress pref 1 handle 103 proto ipv6 flower indev swp1 ip_proto icmpv6 dst_ip $h2_maddr1 src_ip $saddr1 type 135 code 0 action pass"
|
|
|
|
h2_mac1=$(ip -n "$h2" -j -p link show eth0."$vid1" | jq -r '.[]["address"]')
|
|
h2_mac2=$(ip -n "$h2" -j -p link show eth0."$vid2" | jq -r '.[]["address"]')
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac1 dev vx0 master static vlan $vid1"
|
|
run_cmd "bridge -n $sw1 fdb replace $h2_mac2 dev vx0 master static vlan $vid2"
|
|
run_cmd "ip -n $sw1 neigh replace $saddr1 lladdr $h2_mac1 nud permanent dev br0.$vid1"
|
|
run_cmd "ip -n $sw1 neigh replace $saddr2 lladdr $h2_mac2 nud permanent dev br0.$vid2"
|
|
run_cmd "ip -n $sw1 neigh replace $h2_addr1 lladdr $h2_mac1 nud permanent dev br0.$vid1"
|
|
|
|
# Enable per-{Port, VLAN} neighbor suppression.
|
|
run_cmd "bridge -n $sw1 link set dev vx0 neigh_vlan_suppress on"
|
|
run_cmd "bridge -n $sw1 -d link show dev vx0 | grep \"neigh_vlan_suppress on\""
|
|
log_test $? 0 "\"neigh_vlan_suppress\" is on"
|
|
|
|
# Enable neighbor suppression on VLAN 10. Unsolicited NA should be
|
|
# suppressed by default on VLAN 10 (neigh_forward_grat defaults to off)
|
|
# but not on VLAN 20.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid1 -c 1 -a $smac -b $dmac -A $saddr1 -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum1" "$full_addr1") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 0
|
|
log_test $? 0 "Unsolicited NA suppression (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid2 -c 1 -a $smac -b $dmac -A $saddr2 -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum2" "$full_addr2") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 102 1
|
|
log_test $? 0 "Unsolicited NA forwarding (VLAN $vid2)"
|
|
|
|
# Enable neigh_forward_grat on VLAN 10 and verify unsolicited NA is
|
|
# now forwarded.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid1 dev vx0 neigh_forward_grat on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid1 | grep \"neigh_forward_grat on\""
|
|
log_test $? 0 "\"neigh_forward_grat\" is on (VLAN $vid1)"
|
|
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid1 -c 1 -a $smac -b $dmac -A $saddr1 -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum1" "$full_addr1") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 1
|
|
log_test $? 0 "Unsolicited NA forwarding (VLAN $vid1)"
|
|
|
|
# Verify that solicited NS messages on VLAN $vid1 are still suppressed
|
|
# when neigh_forward_grat is enabled.
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid1 -c 1 -a $smac -b $h2_dmac1 -A $saddr1 -B $h2_maddr1 -t ip hop=255,next=58,payload=$(icmpv6_header_get "$csum_ns1" "$h2_full_addr1") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 103 0
|
|
log_test $? 0 "Solicited NS suppression with \"neigh_forward_grat\" on (VLAN $vid1)"
|
|
|
|
# Enable neighbor suppression on VLAN 20 (neigh_forward_grat defaults to
|
|
# off), and verify unsolicited NA is suppressed on VLAN 20.
|
|
run_cmd "bridge -n $sw1 vlan set vid $vid2 dev vx0 neigh_suppress on"
|
|
run_cmd "bridge -n $sw1 -d vlan show dev vx0 vid $vid2 | grep \"neigh_suppress on\""
|
|
log_test $? 0 "\"neigh_suppress\" is on (VLAN $vid2)"
|
|
|
|
# VLAN 10 should still forward (neigh_forward_grat is on).
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid1 -c 1 -a $smac -b $dmac -A $saddr1 -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum1" "$full_addr1") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 101 2
|
|
log_test $? 0 "Unsolicited NA forwarding (VLAN $vid1)"
|
|
|
|
# VLAN 20 should suppress (neigh_forward_grat defaults to off).
|
|
run_cmd "ip netns exec $h1 mausezahn -6 eth0.$vid2 -c 1 -a $smac -b $dmac -A $saddr2 -B $daddr -t ip hop=255,next=58,payload=$(icmpv6_na_header_get "$csum2" "$full_addr2") -q"
|
|
tc_check_packets "$sw1" "dev vx0 egress" 102 1
|
|
log_test $? 0 "Unsolicited NA suppression (VLAN $vid2)"
|
|
}
|
|
|
|
################################################################################
|
|
# Usage
|
|
|
|
usage()
|
|
{
|
|
cat <<EOF
|
|
usage: ${0##*/} OPTS
|
|
|
|
-t <test> Test(s) to run (default: all)
|
|
(options: $TESTS)
|
|
-p Pause on fail
|
|
-P Pause after each test before cleanup
|
|
-v Verbose mode (show commands and output)
|
|
EOF
|
|
}
|
|
|
|
################################################################################
|
|
# Main
|
|
|
|
trap cleanup EXIT
|
|
|
|
while getopts ":t:pPvh" opt; do
|
|
case $opt in
|
|
t) TESTS=$OPTARG;;
|
|
p) PAUSE_ON_FAIL=yes;;
|
|
P) PAUSE=yes;;
|
|
v) VERBOSE=$(($VERBOSE + 1));;
|
|
h) usage; exit 0;;
|
|
*) usage; exit 1;;
|
|
esac
|
|
done
|
|
|
|
# Make sure we don't pause twice.
|
|
[ "${PAUSE}" = "yes" ] && PAUSE_ON_FAIL=no
|
|
|
|
if [ "$(id -u)" -ne 0 ];then
|
|
echo "SKIP: Need root privileges"
|
|
exit $ksft_skip;
|
|
fi
|
|
|
|
if [ ! -x "$(command -v ip)" ]; then
|
|
echo "SKIP: Could not run test without ip tool"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
if [ ! -x "$(command -v bridge)" ]; then
|
|
echo "SKIP: Could not run test without bridge tool"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
if [ ! -x "$(command -v tc)" ]; then
|
|
echo "SKIP: Could not run test without tc tool"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
if [ ! -x "$(command -v arping)" ]; then
|
|
echo "SKIP: Could not run test without arping tool"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
if [ ! -x "$(command -v ndisc6)" ]; then
|
|
echo "SKIP: Could not run test without ndisc6 tool"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
if [ ! -x "$(command -v jq)" ]; then
|
|
echo "SKIP: Could not run test without jq tool"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
if [ ! -x "$(command -v mausezahn)" ]; then
|
|
echo "SKIP: Could not run test without mausezahn tool"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
bridge link help 2>&1 | grep -q "neigh_vlan_suppress"
|
|
if [ $? -ne 0 ]; then
|
|
echo "SKIP: iproute2 bridge too old, missing per-VLAN neighbor suppression support"
|
|
exit $ksft_skip
|
|
fi
|
|
|
|
# Start clean.
|
|
cleanup
|
|
|
|
for t in $TESTS
|
|
do
|
|
setup
|
|
$t
|
|
ret=$(ksft_exit_status_merge "$ret" $?)
|
|
cleanup
|
|
done
|
|
|
|
if [ "$TESTS" != "none" ]; then
|
|
printf "\nTests passed: %3d\n" ${nsuccess}
|
|
printf "Tests failed: %3d\n" ${nfail}
|
|
fi
|
|
|
|
exit $ret
|