90b9566aa5
This tests the capability of switch ports to filter out undesired traffic. Different drivers are expected to have different capabilities here (so some may fail and some may pass), yet the test still has some value, for example to check for regressions. There are 2 kinds of failures, one is when a packet which should have been accepted isn't (and that should be fixed), and the other "failure" (as reported by the test) is when a packet could have been filtered out (for being unnecessary) yet it was received. The bridge driver fares particularly badly at this test: TEST: br0: Unicast IPv4 to primary MAC address [ OK ] TEST: br0: Unicast IPv4 to macvlan MAC address [ OK ] TEST: br0: Unicast IPv4 to unknown MAC address [FAIL] reception succeeded, but should have failed TEST: br0: Unicast IPv4 to unknown MAC address, promisc [ OK ] TEST: br0: Unicast IPv4 to unknown MAC address, allmulti [FAIL] reception succeeded, but should have failed TEST: br0: Multicast IPv4 to joined group [ OK ] TEST: br0: Multicast IPv4 to unknown group [FAIL] reception succeeded, but should have failed TEST: br0: Multicast IPv4 to unknown group, promisc [ OK ] TEST: br0: Multicast IPv4 to unknown group, allmulti [ OK ] TEST: br0: Multicast IPv6 to joined group [ OK ] TEST: br0: Multicast IPv6 to unknown group [FAIL] reception succeeded, but should have failed TEST: br0: Multicast IPv6 to unknown group, promisc [ OK ] TEST: br0: Multicast IPv6 to unknown group, allmulti [ OK ] mainly because it does not implement IFF_UNICAST_FLT. Yet I still think having the test (with the failures) is useful in case somebody wants to tackle that problem in the future, to make an easy before-and-after comparison. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
---|---|---|
.. | ||
.gitignore | ||
bridge_igmp.sh | ||
bridge_locked_port.sh | ||
bridge_mdb.sh | ||
bridge_mld.sh | ||
bridge_port_isolation.sh | ||
bridge_sticky_fdb.sh | ||
bridge_vlan_aware.sh | ||
bridge_vlan_mcast.sh | ||
bridge_vlan_unaware.sh | ||
config | ||
custom_multipath_hash.sh | ||
devlink_lib.sh | ||
dual_vxlan_bridge.sh | ||
ethtool_extended_state.sh | ||
ethtool_lib.sh | ||
ethtool.sh | ||
fib_offload_lib.sh | ||
forwarding.config.sample | ||
gre_custom_multipath_hash.sh | ||
gre_inner_v4_multipath.sh | ||
gre_inner_v6_multipath.sh | ||
gre_multipath_nh_res.sh | ||
gre_multipath_nh.sh | ||
gre_multipath.sh | ||
hw_stats_l3.sh | ||
ip6_forward_instats_vrf.sh | ||
ip6gre_custom_multipath_hash.sh | ||
ip6gre_flat_key.sh | ||
ip6gre_flat_keys.sh | ||
ip6gre_flat.sh | ||
ip6gre_hier_key.sh | ||
ip6gre_hier_keys.sh | ||
ip6gre_hier.sh | ||
ip6gre_inner_v4_multipath.sh | ||
ip6gre_inner_v6_multipath.sh | ||
ip6gre_lib.sh | ||
ipip_flat_gre_key.sh | ||
ipip_flat_gre_keys.sh | ||
ipip_flat_gre.sh | ||
ipip_hier_gre_key.sh | ||
ipip_hier_gre_keys.sh | ||
ipip_hier_gre.sh | ||
ipip_lib.sh | ||
lib.sh | ||
local_termination.sh | ||
loopback.sh | ||
Makefile | ||
mirror_gre_bound.sh | ||
mirror_gre_bridge_1d_vlan.sh | ||
mirror_gre_bridge_1d.sh | ||
mirror_gre_bridge_1q_lag.sh | ||
mirror_gre_bridge_1q.sh | ||
mirror_gre_changes.sh | ||
mirror_gre_flower.sh | ||
mirror_gre_lag_lacp.sh | ||
mirror_gre_lib.sh | ||
mirror_gre_neigh.sh | ||
mirror_gre_nh.sh | ||
mirror_gre_topo_lib.sh | ||
mirror_gre_vlan_bridge_1q.sh | ||
mirror_gre_vlan.sh | ||
mirror_gre.sh | ||
mirror_lib.sh | ||
mirror_topo_lib.sh | ||
mirror_vlan.sh | ||
no_forwarding.sh | ||
pedit_dsfield.sh | ||
pedit_ip.sh | ||
pedit_l4port.sh | ||
q_in_vni_ipv6.sh | ||
q_in_vni.sh | ||
README | ||
router_bridge_vlan.sh | ||
router_bridge.sh | ||
router_broadcast.sh | ||
router_mpath_nh_res.sh | ||
router_mpath_nh.sh | ||
router_multicast.sh | ||
router_multipath.sh | ||
router_nh.sh | ||
router_vid_1.sh | ||
router.sh | ||
sch_ets_core.sh | ||
sch_ets_tests.sh | ||
sch_ets.sh | ||
sch_red.sh | ||
sch_tbf_core.sh | ||
sch_tbf_ets.sh | ||
sch_tbf_etsprio.sh | ||
sch_tbf_prio.sh | ||
sch_tbf_root.sh | ||
skbedit_priority.sh | ||
tc_actions.sh | ||
tc_chains.sh | ||
tc_common.sh | ||
tc_flower_router.sh | ||
tc_flower.sh | ||
tc_mpls_l2vpn.sh | ||
tc_police.sh | ||
tc_shblocks.sh | ||
tc_vlan_modify.sh | ||
vxlan_asymmetric_ipv6.sh | ||
vxlan_asymmetric.sh | ||
vxlan_bridge_1d_ipv6.sh | ||
vxlan_bridge_1d_port_8472_ipv6.sh | ||
vxlan_bridge_1d_port_8472.sh | ||
vxlan_bridge_1d.sh | ||
vxlan_bridge_1q_ipv6.sh | ||
vxlan_bridge_1q_port_8472_ipv6.sh | ||
vxlan_bridge_1q_port_8472.sh | ||
vxlan_bridge_1q.sh | ||
vxlan_symmetric_ipv6.sh | ||
vxlan_symmetric.sh |
Motivation ========== One of the nice things about network namespaces is that they allow one to easily create and test complex environments. Unfortunately, these namespaces can not be used with actual switching ASICs, as their ports can not be migrated to other network namespaces (NETIF_F_NETNS_LOCAL) and most of them probably do not support the L1-separation provided by namespaces. However, a similar kind of flexibility can be achieved by using VRFs and by looping the switch ports together. For example: br0 + vrf-h1 | vrf-h2 + +---+----+ + | | | | 192.0.2.1/24 + + + + 192.0.2.2/24 swp1 swp2 swp3 swp4 + + + + | | | | +--------+ +--------+ The VRFs act as lightweight namespaces representing hosts connected to the switch. This approach for testing switch ASICs has several advantages over the traditional method that requires multiple physical machines, to name a few: 1. Only the device under test (DUT) is being tested without noise from other system. 2. Ability to easily provision complex topologies. Testing bridging between 4-ports LAGs or 8-way ECMP requires many physical links that are not always available. With the VRF-based approach one merely needs to loopback more ports. These tests are written with switch ASICs in mind, but they can be run on any Linux box using veth pairs to emulate physical loopbacks. Guidelines for Writing Tests ============================ o Where possible, reuse an existing topology for different tests instead of recreating the same topology. o Tests that use anything but the most trivial topologies should include an ASCII art showing the topology. o Where possible, IPv6 and IPv4 addresses shall conform to RFC 3849 and RFC 5737, respectively. o Where possible, tests shall be written so that they can be reused by multiple topologies and added to lib.sh. o Checks shall be added to lib.sh for any external dependencies. o Code shall be checked using ShellCheck [1] prior to submission. 1. https://www.shellcheck.net/