1*3edf5f66SRoopa Prabhu#!/bin/bash 2*3edf5f66SRoopa Prabhu# SPDX-License-Identifier: GPL-2.0 3*3edf5f66SRoopa Prabhu 4*3edf5f66SRoopa Prabhu# This test is for checking the VXLAN vni filtering api and 5*3edf5f66SRoopa Prabhu# datapath. 6*3edf5f66SRoopa Prabhu# It simulates two hypervisors running two VMs each using four network 7*3edf5f66SRoopa Prabhu# six namespaces: two for the HVs, four for the VMs. Each VM is 8*3edf5f66SRoopa Prabhu# connected to a separate bridge. The VM's use overlapping vlans and 9*3edf5f66SRoopa Prabhu# hence the separate bridge domain. Each vxlan device is a collect 10*3edf5f66SRoopa Prabhu# metadata device with vni filtering and hence has the ability to 11*3edf5f66SRoopa Prabhu# terminate configured vni's only. 12*3edf5f66SRoopa Prabhu 13*3edf5f66SRoopa Prabhu# +--------------------------------+ +------------------------------------+ 14*3edf5f66SRoopa Prabhu# | vm-11 netns | | vm-21 netns | 15*3edf5f66SRoopa Prabhu# | | | | 16*3edf5f66SRoopa Prabhu# |+------------+ +-------------+ | |+-------------+ +----------------+ | 17*3edf5f66SRoopa Prabhu# ||veth-11.10 | |veth-11.20 | | ||veth-21.10 | | veth-21.20 | | 18*3edf5f66SRoopa Prabhu# ||10.0.10.11/24 |10.0.20.11/24| | ||10.0.10.21/24| | 10.0.20.21/24 | | 19*3edf5f66SRoopa Prabhu# |+------|-----+ +|------------+ | |+-----------|-+ +---|------------+ | 20*3edf5f66SRoopa Prabhu# | | | | | | | | 21*3edf5f66SRoopa Prabhu# | | | | | +------------+ | 22*3edf5f66SRoopa Prabhu# | +------------+ | | | veth-21 | | 23*3edf5f66SRoopa Prabhu# | | veth-11 | | | | | | 24*3edf5f66SRoopa Prabhu# | | | | | +-----|------+ | 25*3edf5f66SRoopa Prabhu# | +-----|------+ | | | | 26*3edf5f66SRoopa Prabhu# | | | | | | 27*3edf5f66SRoopa Prabhu# +------------|-------------------+ +---------------|--------------------+ 28*3edf5f66SRoopa Prabhu# +------------|-----------------------------------------|-------------------+ 29*3edf5f66SRoopa Prabhu# | +-----|------+ +-----|------+ | 30*3edf5f66SRoopa Prabhu# | |vethhv-11 | |vethhv-21 | | 31*3edf5f66SRoopa Prabhu# | +----|-------+ +-----|------+ | 32*3edf5f66SRoopa Prabhu# | +---|---+ +---|--+ | 33*3edf5f66SRoopa Prabhu# | | br1 | | br2 | | 34*3edf5f66SRoopa Prabhu# | +---|---+ +---|--+ | 35*3edf5f66SRoopa Prabhu# | +---|----+ +---|--+ | 36*3edf5f66SRoopa Prabhu# | | vxlan1| |vxlan2| | 37*3edf5f66SRoopa Prabhu# | +--|-----+ +--|---+ | 38*3edf5f66SRoopa Prabhu# | | | | 39*3edf5f66SRoopa Prabhu# | | +---------------------+ | | 40*3edf5f66SRoopa Prabhu# | | |veth0 | | | 41*3edf5f66SRoopa Prabhu# | +---------|172.16.0.1/24 -----------+ | 42*3edf5f66SRoopa Prabhu# | |2002:fee1::1/64 | | 43*3edf5f66SRoopa Prabhu# | hv-1 netns +--------|------------+ | 44*3edf5f66SRoopa Prabhu# +-----------------------------|--------------------------------------------+ 45*3edf5f66SRoopa Prabhu# | 46*3edf5f66SRoopa Prabhu# +-----------------------------|--------------------------------------------+ 47*3edf5f66SRoopa Prabhu# | hv-2 netns +--------|-------------+ | 48*3edf5f66SRoopa Prabhu# | | veth0 | | 49*3edf5f66SRoopa Prabhu# | +------| 172.16.0.2/24 |---+ | 50*3edf5f66SRoopa Prabhu# | | | 2002:fee1::2/64 | | | 51*3edf5f66SRoopa Prabhu# | | | | | | 52*3edf5f66SRoopa Prabhu# | | +----------------------+ | - | 53*3edf5f66SRoopa Prabhu# | | | | 54*3edf5f66SRoopa Prabhu# | +-|-------+ +--------|-+ | 55*3edf5f66SRoopa Prabhu# | | vxlan1 | | vxlan2 | | 56*3edf5f66SRoopa Prabhu# | +----|----+ +---|------+ | 57*3edf5f66SRoopa Prabhu# | +--|--+ +-|---+ | 58*3edf5f66SRoopa Prabhu# | | br1 | | br2 | | 59*3edf5f66SRoopa Prabhu# | +--|--+ +--|--+ | 60*3edf5f66SRoopa Prabhu# | +-----|-------+ +----|-------+ | 61*3edf5f66SRoopa Prabhu# | | vethhv-12 | |vethhv-22 | | 62*3edf5f66SRoopa Prabhu# | +------|------+ +-------|----+ | 63*3edf5f66SRoopa Prabhu# +-----------------|----------------------------|---------------------------+ 64*3edf5f66SRoopa Prabhu# | | 65*3edf5f66SRoopa Prabhu# +-----------------|-----------------+ +--------|---------------------------+ 66*3edf5f66SRoopa Prabhu# | +-------|---+ | | +--|---------+ | 67*3edf5f66SRoopa Prabhu# | | veth-12 | | | |veth-22 | | 68*3edf5f66SRoopa Prabhu# | +-|--------|+ | | +--|--------|+ | 69*3edf5f66SRoopa Prabhu# | | | | | | | | 70*3edf5f66SRoopa Prabhu# |+----------|--+ +---|-----------+ | |+-------|-----+ +|---------------+ | 71*3edf5f66SRoopa Prabhu# ||veth-12.10 | |veth-12.20 | | ||veth-22.10 | |veth-22.20 | | 72*3edf5f66SRoopa Prabhu# ||10.0.10.12/24| |10.0.20.12/24 | | ||10.0.10.22/24| |10.0.20.22/24 | | 73*3edf5f66SRoopa Prabhu# |+-------------+ +---------------+ | |+-------------+ +----------------+ | 74*3edf5f66SRoopa Prabhu# | | | | 75*3edf5f66SRoopa Prabhu# | | | | 76*3edf5f66SRoopa Prabhu# | vm-12 netns | |vm-22 netns | 77*3edf5f66SRoopa Prabhu# +-----------------------------------+ +------------------------------------+ 78*3edf5f66SRoopa Prabhu# 79*3edf5f66SRoopa Prabhu# 80*3edf5f66SRoopa Prabhu# This test tests the new vxlan vnifiltering api 81*3edf5f66SRoopa Prabhu 82*3edf5f66SRoopa Prabhuret=0 83*3edf5f66SRoopa Prabhu# Kselftest framework requirement - SKIP code is 4. 84*3edf5f66SRoopa Prabhuksft_skip=4 85*3edf5f66SRoopa Prabhu 86*3edf5f66SRoopa Prabhu# all tests in this script. Can be overridden with -t option 87*3edf5f66SRoopa PrabhuTESTS=" 88*3edf5f66SRoopa Prabhu vxlan_vnifilter_api 89*3edf5f66SRoopa Prabhu vxlan_vnifilter_datapath 90*3edf5f66SRoopa Prabhu vxlan_vnifilter_datapath_pervni 91*3edf5f66SRoopa Prabhu vxlan_vnifilter_datapath_mgroup 92*3edf5f66SRoopa Prabhu vxlan_vnifilter_datapath_mgroup_pervni 93*3edf5f66SRoopa Prabhu vxlan_vnifilter_metadata_and_traditional_mix 94*3edf5f66SRoopa Prabhu" 95*3edf5f66SRoopa PrabhuVERBOSE=0 96*3edf5f66SRoopa PrabhuPAUSE_ON_FAIL=no 97*3edf5f66SRoopa PrabhuPAUSE=no 98*3edf5f66SRoopa Prabhu 99*3edf5f66SRoopa Prabhuwhich ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping) 100*3edf5f66SRoopa Prabhu 101*3edf5f66SRoopa Prabhulog_test() 102*3edf5f66SRoopa Prabhu{ 103*3edf5f66SRoopa Prabhu local rc=$1 104*3edf5f66SRoopa Prabhu local expected=$2 105*3edf5f66SRoopa Prabhu local msg="$3" 106*3edf5f66SRoopa Prabhu 107*3edf5f66SRoopa Prabhu if [ ${rc} -eq ${expected} ]; then 108*3edf5f66SRoopa Prabhu printf " TEST: %-60s [ OK ]\n" "${msg}" 109*3edf5f66SRoopa Prabhu nsuccess=$((nsuccess+1)) 110*3edf5f66SRoopa Prabhu else 111*3edf5f66SRoopa Prabhu ret=1 112*3edf5f66SRoopa Prabhu nfail=$((nfail+1)) 113*3edf5f66SRoopa Prabhu printf " TEST: %-60s [FAIL]\n" "${msg}" 114*3edf5f66SRoopa Prabhu if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 115*3edf5f66SRoopa Prabhu echo 116*3edf5f66SRoopa Prabhu echo "hit enter to continue, 'q' to quit" 117*3edf5f66SRoopa Prabhu read a 118*3edf5f66SRoopa Prabhu [ "$a" = "q" ] && exit 1 119*3edf5f66SRoopa Prabhu fi 120*3edf5f66SRoopa Prabhu fi 121*3edf5f66SRoopa Prabhu 122*3edf5f66SRoopa Prabhu if [ "${PAUSE}" = "yes" ]; then 123*3edf5f66SRoopa Prabhu echo 124*3edf5f66SRoopa Prabhu echo "hit enter to continue, 'q' to quit" 125*3edf5f66SRoopa Prabhu read a 126*3edf5f66SRoopa Prabhu [ "$a" = "q" ] && exit 1 127*3edf5f66SRoopa Prabhu fi 128*3edf5f66SRoopa Prabhu} 129*3edf5f66SRoopa Prabhu 130*3edf5f66SRoopa Prabhurun_cmd() 131*3edf5f66SRoopa Prabhu{ 132*3edf5f66SRoopa Prabhu local cmd="$1" 133*3edf5f66SRoopa Prabhu local out 134*3edf5f66SRoopa Prabhu local stderr="2>/dev/null" 135*3edf5f66SRoopa Prabhu 136*3edf5f66SRoopa Prabhu if [ "$VERBOSE" = "1" ]; then 137*3edf5f66SRoopa Prabhu printf "COMMAND: $cmd\n" 138*3edf5f66SRoopa Prabhu stderr= 139*3edf5f66SRoopa Prabhu fi 140*3edf5f66SRoopa Prabhu 141*3edf5f66SRoopa Prabhu out=$(eval $cmd $stderr) 142*3edf5f66SRoopa Prabhu rc=$? 143*3edf5f66SRoopa Prabhu if [ "$VERBOSE" = "1" -a -n "$out" ]; then 144*3edf5f66SRoopa Prabhu echo " $out" 145*3edf5f66SRoopa Prabhu fi 146*3edf5f66SRoopa Prabhu 147*3edf5f66SRoopa Prabhu return $rc 148*3edf5f66SRoopa Prabhu} 149*3edf5f66SRoopa Prabhu 150*3edf5f66SRoopa Prabhucheck_hv_connectivity() { 151*3edf5f66SRoopa Prabhu ip netns exec hv-1 ping -c 1 -W 1 $1 &>/dev/null 152*3edf5f66SRoopa Prabhu sleep 1 153*3edf5f66SRoopa Prabhu ip netns exec hv-1 ping -c 1 -W 1 $2 &>/dev/null 154*3edf5f66SRoopa Prabhu 155*3edf5f66SRoopa Prabhu return $? 156*3edf5f66SRoopa Prabhu} 157*3edf5f66SRoopa Prabhu 158*3edf5f66SRoopa Prabhucheck_vm_connectivity() { 159*3edf5f66SRoopa Prabhu run_cmd "ip netns exec vm-11 ping -c 1 -W 1 10.0.10.12" 160*3edf5f66SRoopa Prabhu log_test $? 0 "VM connectivity over $1 (ipv4 default rdst)" 161*3edf5f66SRoopa Prabhu 162*3edf5f66SRoopa Prabhu run_cmd "ip netns exec vm-21 ping -c 1 -W 1 10.0.10.22" 163*3edf5f66SRoopa Prabhu log_test $? 0 "VM connectivity over $1 (ipv6 default rdst)" 164*3edf5f66SRoopa Prabhu} 165*3edf5f66SRoopa Prabhu 166*3edf5f66SRoopa Prabhucleanup() { 167*3edf5f66SRoopa Prabhu ip link del veth-hv-1 2>/dev/null || true 168*3edf5f66SRoopa Prabhu ip link del vethhv-11 vethhv-12 vethhv-21 vethhv-22 2>/dev/null || true 169*3edf5f66SRoopa Prabhu 170*3edf5f66SRoopa Prabhu for ns in hv-1 hv-2 vm-11 vm-21 vm-12 vm-22 vm-31 vm-32; do 171*3edf5f66SRoopa Prabhu ip netns del $ns 2>/dev/null || true 172*3edf5f66SRoopa Prabhu done 173*3edf5f66SRoopa Prabhu} 174*3edf5f66SRoopa Prabhu 175*3edf5f66SRoopa Prabhutrap cleanup EXIT 176*3edf5f66SRoopa Prabhu 177*3edf5f66SRoopa Prabhusetup-hv-networking() { 178*3edf5f66SRoopa Prabhu hv=$1 179*3edf5f66SRoopa Prabhu local1=$2 180*3edf5f66SRoopa Prabhu mask1=$3 181*3edf5f66SRoopa Prabhu local2=$4 182*3edf5f66SRoopa Prabhu mask2=$5 183*3edf5f66SRoopa Prabhu 184*3edf5f66SRoopa Prabhu ip netns add hv-$hv 185*3edf5f66SRoopa Prabhu ip link set veth-hv-$hv netns hv-$hv 186*3edf5f66SRoopa Prabhu ip -netns hv-$hv link set veth-hv-$hv name veth0 187*3edf5f66SRoopa Prabhu ip -netns hv-$hv addr add $local1/$mask1 dev veth0 188*3edf5f66SRoopa Prabhu ip -netns hv-$hv addr add $local2/$mask2 dev veth0 189*3edf5f66SRoopa Prabhu ip -netns hv-$hv link set veth0 up 190*3edf5f66SRoopa Prabhu} 191*3edf5f66SRoopa Prabhu 192*3edf5f66SRoopa Prabhu# Setups a "VM" simulated by a netns an a veth pair 193*3edf5f66SRoopa Prabhu# example: setup-vm <hvid> <vmid> <brid> <VATTRS> <mcast_for_bum> 194*3edf5f66SRoopa Prabhu# VATTRS = comma separated "<vlan>-<v[46]>-<localip>-<remoteip>-<VTYPE>-<vxlandstport>" 195*3edf5f66SRoopa Prabhu# VTYPE = vxlan device type. "default = traditional device, metadata = metadata device 196*3edf5f66SRoopa Prabhu# vnifilter = vnifiltering device, 197*3edf5f66SRoopa Prabhu# vnifilterg = vnifiltering device with per vni group/remote" 198*3edf5f66SRoopa Prabhu# example: 199*3edf5f66SRoopa Prabhu# setup-vm 1 11 1 \ 200*3edf5f66SRoopa Prabhu# 10-v4-172.16.0.1-239.1.1.100-vnifilterg,20-v4-172.16.0.1-239.1.1.100-vnifilterg 1 201*3edf5f66SRoopa Prabhu# 202*3edf5f66SRoopa Prabhusetup-vm() { 203*3edf5f66SRoopa Prabhu hvid=$1 204*3edf5f66SRoopa Prabhu vmid=$2 205*3edf5f66SRoopa Prabhu brid=$3 206*3edf5f66SRoopa Prabhu vattrs=$4 207*3edf5f66SRoopa Prabhu mcast=$5 208*3edf5f66SRoopa Prabhu lastvxlandev="" 209*3edf5f66SRoopa Prabhu 210*3edf5f66SRoopa Prabhu # create bridge 211*3edf5f66SRoopa Prabhu ip -netns hv-$hvid link add br$brid type bridge vlan_filtering 1 vlan_default_pvid 0 \ 212*3edf5f66SRoopa Prabhu mcast_snooping 0 213*3edf5f66SRoopa Prabhu ip -netns hv-$hvid link set br$brid up 214*3edf5f66SRoopa Prabhu 215*3edf5f66SRoopa Prabhu # create vm namespace and interfaces and connect to hypervisor 216*3edf5f66SRoopa Prabhu # namespace 217*3edf5f66SRoopa Prabhu ip netns add vm-$vmid 218*3edf5f66SRoopa Prabhu hvvethif="vethhv-$vmid" 219*3edf5f66SRoopa Prabhu vmvethif="veth-$vmid" 220*3edf5f66SRoopa Prabhu ip link add $hvvethif type veth peer name $vmvethif 221*3edf5f66SRoopa Prabhu ip link set $hvvethif netns hv-$hvid 222*3edf5f66SRoopa Prabhu ip link set $vmvethif netns vm-$vmid 223*3edf5f66SRoopa Prabhu ip -netns hv-$hvid link set $hvvethif up 224*3edf5f66SRoopa Prabhu ip -netns vm-$vmid link set $vmvethif up 225*3edf5f66SRoopa Prabhu ip -netns hv-$hvid link set $hvvethif master br$brid 226*3edf5f66SRoopa Prabhu 227*3edf5f66SRoopa Prabhu # configure VM vlan/vni filtering on hypervisor 228*3edf5f66SRoopa Prabhu for vmap in $(echo $vattrs | cut -d "," -f1- --output-delimiter=' ') 229*3edf5f66SRoopa Prabhu do 230*3edf5f66SRoopa Prabhu local vid=$(echo $vmap | awk -F'-' '{print ($1)}') 231*3edf5f66SRoopa Prabhu local family=$(echo $vmap | awk -F'-' '{print ($2)}') 232*3edf5f66SRoopa Prabhu local localip=$(echo $vmap | awk -F'-' '{print ($3)}') 233*3edf5f66SRoopa Prabhu local group=$(echo $vmap | awk -F'-' '{print ($4)}') 234*3edf5f66SRoopa Prabhu local vtype=$(echo $vmap | awk -F'-' '{print ($5)}') 235*3edf5f66SRoopa Prabhu local port=$(echo $vmap | awk -F'-' '{print ($6)}') 236*3edf5f66SRoopa Prabhu 237*3edf5f66SRoopa Prabhu ip -netns vm-$vmid link add name $vmvethif.$vid link $vmvethif type vlan id $vid 238*3edf5f66SRoopa Prabhu ip -netns vm-$vmid addr add 10.0.$vid.$vmid/24 dev $vmvethif.$vid 239*3edf5f66SRoopa Prabhu ip -netns vm-$vmid link set $vmvethif.$vid up 240*3edf5f66SRoopa Prabhu 241*3edf5f66SRoopa Prabhu tid=$vid 242*3edf5f66SRoopa Prabhu vxlandev="vxlan$brid" 243*3edf5f66SRoopa Prabhu vxlandevflags="" 244*3edf5f66SRoopa Prabhu 245*3edf5f66SRoopa Prabhu if [[ -n $vtype && $vtype == "metadata" ]]; then 246*3edf5f66SRoopa Prabhu vxlandevflags="$vxlandevflags external" 247*3edf5f66SRoopa Prabhu elif [[ -n $vtype && $vtype == "vnifilter" || $vtype == "vnifilterg" ]]; then 248*3edf5f66SRoopa Prabhu vxlandevflags="$vxlandevflags external vnifilter" 249*3edf5f66SRoopa Prabhu tid=$((vid+brid)) 250*3edf5f66SRoopa Prabhu else 251*3edf5f66SRoopa Prabhu vxlandevflags="$vxlandevflags id $tid" 252*3edf5f66SRoopa Prabhu vxlandev="vxlan$tid" 253*3edf5f66SRoopa Prabhu fi 254*3edf5f66SRoopa Prabhu 255*3edf5f66SRoopa Prabhu if [[ -n $vtype && $vtype != "vnifilterg" ]]; then 256*3edf5f66SRoopa Prabhu if [[ -n "$group" && "$group" != "null" ]]; then 257*3edf5f66SRoopa Prabhu if [ $mcast -eq 1 ]; then 258*3edf5f66SRoopa Prabhu vxlandevflags="$vxlandevflags group $group" 259*3edf5f66SRoopa Prabhu else 260*3edf5f66SRoopa Prabhu vxlandevflags="$vxlandevflags remote $group" 261*3edf5f66SRoopa Prabhu fi 262*3edf5f66SRoopa Prabhu fi 263*3edf5f66SRoopa Prabhu fi 264*3edf5f66SRoopa Prabhu 265*3edf5f66SRoopa Prabhu if [[ -n "$port" && "$port" != "default" ]]; then 266*3edf5f66SRoopa Prabhu vxlandevflags="$vxlandevflags dstport $port" 267*3edf5f66SRoopa Prabhu fi 268*3edf5f66SRoopa Prabhu 269*3edf5f66SRoopa Prabhu # create vxlan device 270*3edf5f66SRoopa Prabhu if [ "$vxlandev" != "$lastvxlandev" ]; then 271*3edf5f66SRoopa Prabhu ip -netns hv-$hvid link add $vxlandev type vxlan local $localip $vxlandevflags dev veth0 2>/dev/null 272*3edf5f66SRoopa Prabhu ip -netns hv-$hvid link set $vxlandev master br$brid 273*3edf5f66SRoopa Prabhu ip -netns hv-$hvid link set $vxlandev up 274*3edf5f66SRoopa Prabhu lastvxlandev=$vxlandev 275*3edf5f66SRoopa Prabhu fi 276*3edf5f66SRoopa Prabhu 277*3edf5f66SRoopa Prabhu # add vlan 278*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid vlan add vid $vid dev $hvvethif 279*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid vlan add vid $vid pvid dev $vxlandev 280*3edf5f66SRoopa Prabhu 281*3edf5f66SRoopa Prabhu # Add bridge vni filter for tx 282*3edf5f66SRoopa Prabhu if [[ -n $vtype && $vtype == "metadata" || $vtype == "vnifilter" || $vtype == "vnifilterg" ]]; then 283*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid link set dev $vxlandev vlan_tunnel on 284*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid vlan add dev $vxlandev vid $vid tunnel_info id $tid 285*3edf5f66SRoopa Prabhu fi 286*3edf5f66SRoopa Prabhu 287*3edf5f66SRoopa Prabhu if [[ -n $vtype && $vtype == "metadata" ]]; then 288*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid fdb add 00:00:00:00:00:00 dev $vxlandev \ 289*3edf5f66SRoopa Prabhu src_vni $tid vni $tid dst $group self 290*3edf5f66SRoopa Prabhu elif [[ -n $vtype && $vtype == "vnifilter" ]]; then 291*3edf5f66SRoopa Prabhu # Add per vni rx filter with 'bridge vni' api 292*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid vni add dev $vxlandev vni $tid 293*3edf5f66SRoopa Prabhu elif [[ -n $vtype && $vtype == "vnifilterg" ]]; then 294*3edf5f66SRoopa Prabhu # Add per vni group config with 'bridge vni' api 295*3edf5f66SRoopa Prabhu if [ -n "$group" ]; then 296*3edf5f66SRoopa Prabhu if [ $mcast -eq 1 ]; then 297*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid vni add dev $vxlandev vni $tid group $group 298*3edf5f66SRoopa Prabhu else 299*3edf5f66SRoopa Prabhu bridge -netns hv-$hvid vni add dev $vxlandev vni $tid remote $group 300*3edf5f66SRoopa Prabhu fi 301*3edf5f66SRoopa Prabhu fi 302*3edf5f66SRoopa Prabhu fi 303*3edf5f66SRoopa Prabhu done 304*3edf5f66SRoopa Prabhu} 305*3edf5f66SRoopa Prabhu 306*3edf5f66SRoopa Prabhusetup_vnifilter_api() 307*3edf5f66SRoopa Prabhu{ 308*3edf5f66SRoopa Prabhu ip link add veth-host type veth peer name veth-testns 309*3edf5f66SRoopa Prabhu ip netns add testns 310*3edf5f66SRoopa Prabhu ip link set veth-testns netns testns 311*3edf5f66SRoopa Prabhu} 312*3edf5f66SRoopa Prabhu 313*3edf5f66SRoopa Prabhucleanup_vnifilter_api() 314*3edf5f66SRoopa Prabhu{ 315*3edf5f66SRoopa Prabhu ip link del veth-host 2>/dev/null || true 316*3edf5f66SRoopa Prabhu ip netns del testns 2>/dev/null || true 317*3edf5f66SRoopa Prabhu} 318*3edf5f66SRoopa Prabhu 319*3edf5f66SRoopa Prabhu# tests vxlan filtering api 320*3edf5f66SRoopa Prabhuvxlan_vnifilter_api() 321*3edf5f66SRoopa Prabhu{ 322*3edf5f66SRoopa Prabhu hv1addr1="172.16.0.1" 323*3edf5f66SRoopa Prabhu hv2addr1="172.16.0.2" 324*3edf5f66SRoopa Prabhu hv1addr2="2002:fee1::1" 325*3edf5f66SRoopa Prabhu hv2addr2="2002:fee1::2" 326*3edf5f66SRoopa Prabhu localip="172.16.0.1" 327*3edf5f66SRoopa Prabhu group="239.1.1.101" 328*3edf5f66SRoopa Prabhu 329*3edf5f66SRoopa Prabhu cleanup_vnifilter_api &>/dev/null 330*3edf5f66SRoopa Prabhu setup_vnifilter_api 331*3edf5f66SRoopa Prabhu 332*3edf5f66SRoopa Prabhu # Duplicate vni test 333*3edf5f66SRoopa Prabhu # create non-vnifiltering traditional vni device 334*3edf5f66SRoopa Prabhu run_cmd "ip -netns testns link add vxlan100 type vxlan id 100 local $localip dev veth-testns dstport 4789" 335*3edf5f66SRoopa Prabhu log_test $? 0 "Create traditional vxlan device" 336*3edf5f66SRoopa Prabhu 337*3edf5f66SRoopa Prabhu # create vni filtering device 338*3edf5f66SRoopa Prabhu run_cmd "ip -netns testns link add vxlan-ext1 type vxlan vnifilter local $localip dev veth-testns dstport 4789" 339*3edf5f66SRoopa Prabhu log_test $? 1 "Cannot create vnifilter device without external flag" 340*3edf5f66SRoopa Prabhu 341*3edf5f66SRoopa Prabhu run_cmd "ip -netns testns link add vxlan-ext1 type vxlan external vnifilter local $localip dev veth-testns dstport 4789" 342*3edf5f66SRoopa Prabhu log_test $? 0 "Creating external vxlan device with vnifilter flag" 343*3edf5f66SRoopa Prabhu 344*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext1 vni 100" 345*3edf5f66SRoopa Prabhu log_test $? 0 "Cannot set in-use vni id on vnifiltering device" 346*3edf5f66SRoopa Prabhu 347*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext1 vni 200" 348*3edf5f66SRoopa Prabhu log_test $? 0 "Set new vni id on vnifiltering device" 349*3edf5f66SRoopa Prabhu 350*3edf5f66SRoopa Prabhu run_cmd "ip -netns testns link add vxlan-ext2 type vxlan external vnifilter local $localip dev veth-testns dstport 4789" 351*3edf5f66SRoopa Prabhu log_test $? 0 "Create second external vxlan device with vnifilter flag" 352*3edf5f66SRoopa Prabhu 353*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext2 vni 200" 354*3edf5f66SRoopa Prabhu log_test $? 255 "Cannot set in-use vni id on vnifiltering device" 355*3edf5f66SRoopa Prabhu 356*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext2 vni 300" 357*3edf5f66SRoopa Prabhu log_test $? 0 "Set new vni id on vnifiltering device" 358*3edf5f66SRoopa Prabhu 359*3edf5f66SRoopa Prabhu # check in bridge vni show 360*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext2 vni 300" 361*3edf5f66SRoopa Prabhu log_test $? 0 "Update vni id on vnifiltering device" 362*3edf5f66SRoopa Prabhu 363*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext2 vni 400" 364*3edf5f66SRoopa Prabhu log_test $? 0 "Add new vni id on vnifiltering device" 365*3edf5f66SRoopa Prabhu 366*3edf5f66SRoopa Prabhu # add multicast group per vni 367*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext1 vni 200 group $group" 368*3edf5f66SRoopa Prabhu log_test $? 0 "Set multicast group on existing vni" 369*3edf5f66SRoopa Prabhu 370*3edf5f66SRoopa Prabhu # add multicast group per vni 371*3edf5f66SRoopa Prabhu run_cmd "bridge -netns testns vni add dev vxlan-ext2 vni 300 group $group" 372*3edf5f66SRoopa Prabhu log_test $? 0 "Set multicast group on existing vni" 373*3edf5f66SRoopa Prabhu 374*3edf5f66SRoopa Prabhu # set vnifilter on an existing external vxlan device 375*3edf5f66SRoopa Prabhu run_cmd "ip -netns testns link set dev vxlan-ext1 type vxlan external vnifilter" 376*3edf5f66SRoopa Prabhu log_test $? 2 "Cannot set vnifilter flag on a device" 377*3edf5f66SRoopa Prabhu 378*3edf5f66SRoopa Prabhu # change vxlan vnifilter flag 379*3edf5f66SRoopa Prabhu run_cmd "ip -netns testns link set dev vxlan-ext1 type vxlan external novnifilter" 380*3edf5f66SRoopa Prabhu log_test $? 2 "Cannot unset vnifilter flag on a device" 381*3edf5f66SRoopa Prabhu} 382*3edf5f66SRoopa Prabhu 383*3edf5f66SRoopa Prabhu# Sanity test vnifilter datapath 384*3edf5f66SRoopa Prabhu# vnifilter vnis inherit BUM group from 385*3edf5f66SRoopa Prabhu# vxlan device 386*3edf5f66SRoopa Prabhuvxlan_vnifilter_datapath() 387*3edf5f66SRoopa Prabhu{ 388*3edf5f66SRoopa Prabhu hv1addr1="172.16.0.1" 389*3edf5f66SRoopa Prabhu hv2addr1="172.16.0.2" 390*3edf5f66SRoopa Prabhu hv1addr2="2002:fee1::1" 391*3edf5f66SRoopa Prabhu hv2addr2="2002:fee1::2" 392*3edf5f66SRoopa Prabhu 393*3edf5f66SRoopa Prabhu ip link add veth-hv-1 type veth peer name veth-hv-2 394*3edf5f66SRoopa Prabhu setup-hv-networking 1 $hv1addr1 24 $hv1addr2 64 $hv2addr1 $hv2addr2 395*3edf5f66SRoopa Prabhu setup-hv-networking 2 $hv2addr1 24 $hv2addr2 64 $hv1addr1 $hv1addr2 396*3edf5f66SRoopa Prabhu 397*3edf5f66SRoopa Prabhu check_hv_connectivity hv2addr1 hv2addr2 398*3edf5f66SRoopa Prabhu 399*3edf5f66SRoopa Prabhu setup-vm 1 11 1 10-v4-$hv1addr1-$hv2addr1-vnifilter,20-v4-$hv1addr1-$hv2addr1-vnifilter 0 400*3edf5f66SRoopa Prabhu setup-vm 1 21 2 10-v6-$hv1addr2-$hv2addr2-vnifilter,20-v6-$hv1addr2-$hv2addr2-vnifilter 0 401*3edf5f66SRoopa Prabhu 402*3edf5f66SRoopa Prabhu setup-vm 2 12 1 10-v4-$hv2addr1-$hv1addr1-vnifilter,20-v4-$hv2addr1-$hv1addr1-vnifilter 0 403*3edf5f66SRoopa Prabhu setup-vm 2 22 2 10-v6-$hv2addr2-$hv1addr2-vnifilter,20-v6-$hv2addr2-$hv1addr2-vnifilter 0 404*3edf5f66SRoopa Prabhu 405*3edf5f66SRoopa Prabhu check_vm_connectivity "vnifiltering vxlan" 406*3edf5f66SRoopa Prabhu} 407*3edf5f66SRoopa Prabhu 408*3edf5f66SRoopa Prabhu# Sanity test vnifilter datapath 409*3edf5f66SRoopa Prabhu# with vnifilter per vni configured BUM 410*3edf5f66SRoopa Prabhu# group/remote 411*3edf5f66SRoopa Prabhuvxlan_vnifilter_datapath_pervni() 412*3edf5f66SRoopa Prabhu{ 413*3edf5f66SRoopa Prabhu hv1addr1="172.16.0.1" 414*3edf5f66SRoopa Prabhu hv2addr1="172.16.0.2" 415*3edf5f66SRoopa Prabhu hv1addr2="2002:fee1::1" 416*3edf5f66SRoopa Prabhu hv2addr2="2002:fee1::2" 417*3edf5f66SRoopa Prabhu 418*3edf5f66SRoopa Prabhu ip link add veth-hv-1 type veth peer name veth-hv-2 419*3edf5f66SRoopa Prabhu setup-hv-networking 1 $hv1addr1 24 $hv1addr2 64 420*3edf5f66SRoopa Prabhu setup-hv-networking 2 $hv2addr1 24 $hv2addr2 64 421*3edf5f66SRoopa Prabhu 422*3edf5f66SRoopa Prabhu check_hv_connectivity hv2addr1 hv2addr2 423*3edf5f66SRoopa Prabhu 424*3edf5f66SRoopa Prabhu setup-vm 1 11 1 10-v4-$hv1addr1-$hv2addr1-vnifilterg,20-v4-$hv1addr1-$hv2addr1-vnifilterg 0 425*3edf5f66SRoopa Prabhu setup-vm 1 21 2 10-v6-$hv1addr2-$hv2addr2-vnifilterg,20-v6-$hv1addr2-$hv2addr2-vnifilterg 0 426*3edf5f66SRoopa Prabhu 427*3edf5f66SRoopa Prabhu setup-vm 2 12 1 10-v4-$hv2addr1-$hv1addr1-vnifilterg,20-v4-$hv2addr1-$hv1addr1-vnifilterg 0 428*3edf5f66SRoopa Prabhu setup-vm 2 22 2 10-v6-$hv2addr2-$hv1addr2-vnifilterg,20-v6-$hv2addr2-$hv1addr2-vnifilterg 0 429*3edf5f66SRoopa Prabhu 430*3edf5f66SRoopa Prabhu check_vm_connectivity "vnifiltering vxlan pervni remote" 431*3edf5f66SRoopa Prabhu} 432*3edf5f66SRoopa Prabhu 433*3edf5f66SRoopa Prabhu 434*3edf5f66SRoopa Prabhuvxlan_vnifilter_datapath_mgroup() 435*3edf5f66SRoopa Prabhu{ 436*3edf5f66SRoopa Prabhu hv1addr1="172.16.0.1" 437*3edf5f66SRoopa Prabhu hv2addr1="172.16.0.2" 438*3edf5f66SRoopa Prabhu hv1addr2="2002:fee1::1" 439*3edf5f66SRoopa Prabhu hv2addr2="2002:fee1::2" 440*3edf5f66SRoopa Prabhu group="239.1.1.100" 441*3edf5f66SRoopa Prabhu group6="ff07::1" 442*3edf5f66SRoopa Prabhu 443*3edf5f66SRoopa Prabhu ip link add veth-hv-1 type veth peer name veth-hv-2 444*3edf5f66SRoopa Prabhu setup-hv-networking 1 $hv1addr1 24 $hv1addr2 64 445*3edf5f66SRoopa Prabhu setup-hv-networking 2 $hv2addr1 24 $hv2addr2 64 446*3edf5f66SRoopa Prabhu 447*3edf5f66SRoopa Prabhu check_hv_connectivity hv2addr1 hv2addr2 448*3edf5f66SRoopa Prabhu 449*3edf5f66SRoopa Prabhu setup-vm 1 11 1 10-v4-$hv1addr1-$group-vnifilter,20-v4-$hv1addr1-$group-vnifilter 1 450*3edf5f66SRoopa Prabhu setup-vm 1 21 2 "10-v6-$hv1addr2-$group6-vnifilter,20-v6-$hv1addr2-$group6-vnifilter" 1 451*3edf5f66SRoopa Prabhu 452*3edf5f66SRoopa Prabhu setup-vm 2 12 1 10-v4-$hv2addr1-$group-vnifilter,20-v4-$hv2addr1-$group-vnifilter 1 453*3edf5f66SRoopa Prabhu setup-vm 2 22 2 10-v6-$hv2addr2-$group6-vnifilter,20-v6-$hv2addr2-$group6-vnifilter 1 454*3edf5f66SRoopa Prabhu 455*3edf5f66SRoopa Prabhu check_vm_connectivity "vnifiltering vxlan mgroup" 456*3edf5f66SRoopa Prabhu} 457*3edf5f66SRoopa Prabhu 458*3edf5f66SRoopa Prabhuvxlan_vnifilter_datapath_mgroup_pervni() 459*3edf5f66SRoopa Prabhu{ 460*3edf5f66SRoopa Prabhu hv1addr1="172.16.0.1" 461*3edf5f66SRoopa Prabhu hv2addr1="172.16.0.2" 462*3edf5f66SRoopa Prabhu hv1addr2="2002:fee1::1" 463*3edf5f66SRoopa Prabhu hv2addr2="2002:fee1::2" 464*3edf5f66SRoopa Prabhu group="239.1.1.100" 465*3edf5f66SRoopa Prabhu group6="ff07::1" 466*3edf5f66SRoopa Prabhu 467*3edf5f66SRoopa Prabhu ip link add veth-hv-1 type veth peer name veth-hv-2 468*3edf5f66SRoopa Prabhu setup-hv-networking 1 $hv1addr1 24 $hv1addr2 64 469*3edf5f66SRoopa Prabhu setup-hv-networking 2 $hv2addr1 24 $hv2addr2 64 470*3edf5f66SRoopa Prabhu 471*3edf5f66SRoopa Prabhu check_hv_connectivity hv2addr1 hv2addr2 472*3edf5f66SRoopa Prabhu 473*3edf5f66SRoopa Prabhu setup-vm 1 11 1 10-v4-$hv1addr1-$group-vnifilterg,20-v4-$hv1addr1-$group-vnifilterg 1 474*3edf5f66SRoopa Prabhu setup-vm 1 21 2 10-v6-$hv1addr2-$group6-vnifilterg,20-v6-$hv1addr2-$group6-vnifilterg 1 475*3edf5f66SRoopa Prabhu 476*3edf5f66SRoopa Prabhu setup-vm 2 12 1 10-v4-$hv2addr1-$group-vnifilterg,20-v4-$hv2addr1-$group-vnifilterg 1 477*3edf5f66SRoopa Prabhu setup-vm 2 22 2 10-v6-$hv2addr2-$group6-vnifilterg,20-v6-$hv2addr2-$group6-vnifilterg 1 478*3edf5f66SRoopa Prabhu 479*3edf5f66SRoopa Prabhu check_vm_connectivity "vnifiltering vxlan pervni mgroup" 480*3edf5f66SRoopa Prabhu} 481*3edf5f66SRoopa Prabhu 482*3edf5f66SRoopa Prabhuvxlan_vnifilter_metadata_and_traditional_mix() 483*3edf5f66SRoopa Prabhu{ 484*3edf5f66SRoopa Prabhu hv1addr1="172.16.0.1" 485*3edf5f66SRoopa Prabhu hv2addr1="172.16.0.2" 486*3edf5f66SRoopa Prabhu hv1addr2="2002:fee1::1" 487*3edf5f66SRoopa Prabhu hv2addr2="2002:fee1::2" 488*3edf5f66SRoopa Prabhu 489*3edf5f66SRoopa Prabhu ip link add veth-hv-1 type veth peer name veth-hv-2 490*3edf5f66SRoopa Prabhu setup-hv-networking 1 $hv1addr1 24 $hv1addr2 64 491*3edf5f66SRoopa Prabhu setup-hv-networking 2 $hv2addr1 24 $hv2addr2 64 492*3edf5f66SRoopa Prabhu 493*3edf5f66SRoopa Prabhu check_hv_connectivity hv2addr1 hv2addr2 494*3edf5f66SRoopa Prabhu 495*3edf5f66SRoopa Prabhu setup-vm 1 11 1 10-v4-$hv1addr1-$hv2addr1-vnifilter,20-v4-$hv1addr1-$hv2addr1-vnifilter 0 496*3edf5f66SRoopa Prabhu setup-vm 1 21 2 10-v6-$hv1addr2-$hv2addr2-vnifilter,20-v6-$hv1addr2-$hv2addr2-vnifilter 0 497*3edf5f66SRoopa Prabhu setup-vm 1 31 3 30-v4-$hv1addr1-$hv2addr1-default-4790,40-v6-$hv1addr2-$hv2addr2-default-4790,50-v4-$hv1addr1-$hv2addr1-metadata-4791 0 498*3edf5f66SRoopa Prabhu 499*3edf5f66SRoopa Prabhu 500*3edf5f66SRoopa Prabhu setup-vm 2 12 1 10-v4-$hv2addr1-$hv1addr1-vnifilter,20-v4-$hv2addr1-$hv1addr1-vnifilter 0 501*3edf5f66SRoopa Prabhu setup-vm 2 22 2 10-v6-$hv2addr2-$hv1addr2-vnifilter,20-v6-$hv2addr2-$hv1addr2-vnifilter 0 502*3edf5f66SRoopa Prabhu setup-vm 2 32 3 30-v4-$hv2addr1-$hv1addr1-default-4790,40-v6-$hv2addr2-$hv1addr2-default-4790,50-v4-$hv2addr1-$hv1addr1-metadata-4791 0 503*3edf5f66SRoopa Prabhu 504*3edf5f66SRoopa Prabhu check_vm_connectivity "vnifiltering vxlan pervni remote mix" 505*3edf5f66SRoopa Prabhu 506*3edf5f66SRoopa Prabhu # check VM connectivity over traditional/non-vxlan filtering vxlan devices 507*3edf5f66SRoopa Prabhu run_cmd "ip netns exec vm-31 ping -c 1 -W 1 10.0.30.32" 508*3edf5f66SRoopa Prabhu log_test $? 0 "VM connectivity over traditional vxlan (ipv4 default rdst)" 509*3edf5f66SRoopa Prabhu 510*3edf5f66SRoopa Prabhu run_cmd "ip netns exec vm-31 ping -c 1 -W 1 10.0.40.32" 511*3edf5f66SRoopa Prabhu log_test $? 0 "VM connectivity over traditional vxlan (ipv6 default rdst)" 512*3edf5f66SRoopa Prabhu 513*3edf5f66SRoopa Prabhu run_cmd "ip netns exec vm-31 ping -c 1 -W 1 10.0.50.32" 514*3edf5f66SRoopa Prabhu log_test $? 0 "VM connectivity over metadata nonfiltering vxlan (ipv4 default rdst)" 515*3edf5f66SRoopa Prabhu} 516*3edf5f66SRoopa Prabhu 517*3edf5f66SRoopa Prabhuwhile getopts :t:pP46hv o 518*3edf5f66SRoopa Prabhudo 519*3edf5f66SRoopa Prabhu case $o in 520*3edf5f66SRoopa Prabhu t) TESTS=$OPTARG;; 521*3edf5f66SRoopa Prabhu p) PAUSE_ON_FAIL=yes;; 522*3edf5f66SRoopa Prabhu P) PAUSE=yes;; 523*3edf5f66SRoopa Prabhu v) VERBOSE=$(($VERBOSE + 1));; 524*3edf5f66SRoopa Prabhu h) usage; exit 0;; 525*3edf5f66SRoopa Prabhu *) usage; exit 1;; 526*3edf5f66SRoopa Prabhu esac 527*3edf5f66SRoopa Prabhudone 528*3edf5f66SRoopa Prabhu 529*3edf5f66SRoopa Prabhu# make sure we don't pause twice 530*3edf5f66SRoopa Prabhu[ "${PAUSE}" = "yes" ] && PAUSE_ON_FAIL=no 531*3edf5f66SRoopa Prabhu 532*3edf5f66SRoopa Prabhuif [ "$(id -u)" -ne 0 ];then 533*3edf5f66SRoopa Prabhu echo "SKIP: Need root privileges" 534*3edf5f66SRoopa Prabhu exit $ksft_skip; 535*3edf5f66SRoopa Prabhufi 536*3edf5f66SRoopa Prabhu 537*3edf5f66SRoopa Prabhuif [ ! -x "$(command -v ip)" ]; then 538*3edf5f66SRoopa Prabhu echo "SKIP: Could not run test without ip tool" 539*3edf5f66SRoopa Prabhu exit $ksft_skip 540*3edf5f66SRoopa Prabhufi 541*3edf5f66SRoopa Prabhu 542*3edf5f66SRoopa Prabhuip link help vxlan 2>&1 | grep -q "vnifilter" 543*3edf5f66SRoopa Prabhuif [ $? -ne 0 ]; then 544*3edf5f66SRoopa Prabhu echo "SKIP: iproute2 too old, missing vxlan dev vnifilter setting" 545*3edf5f66SRoopa Prabhu sync 546*3edf5f66SRoopa Prabhu exit $ksft_skip 547*3edf5f66SRoopa Prabhufi 548*3edf5f66SRoopa Prabhu 549*3edf5f66SRoopa Prabhubridge vni help 2>&1 | grep -q "Usage: bridge vni" 550*3edf5f66SRoopa Prabhuif [ $? -ne 0 ]; then 551*3edf5f66SRoopa Prabhu echo "SKIP: iproute2 bridge lacks vxlan vnifiltering support" 552*3edf5f66SRoopa Prabhu exit $ksft_skip 553*3edf5f66SRoopa Prabhufi 554*3edf5f66SRoopa Prabhu 555*3edf5f66SRoopa Prabhu# start clean 556*3edf5f66SRoopa Prabhucleanup &> /dev/null 557*3edf5f66SRoopa Prabhu 558*3edf5f66SRoopa Prabhufor t in $TESTS 559*3edf5f66SRoopa Prabhudo 560*3edf5f66SRoopa Prabhu case $t in 561*3edf5f66SRoopa Prabhu none) setup; exit 0;; 562*3edf5f66SRoopa Prabhu *) $t; cleanup;; 563*3edf5f66SRoopa Prabhu esac 564*3edf5f66SRoopa Prabhudone 565*3edf5f66SRoopa Prabhu 566*3edf5f66SRoopa Prabhuif [ "$TESTS" != "none" ]; then 567*3edf5f66SRoopa Prabhu printf "\nTests passed: %3d\n" ${nsuccess} 568*3edf5f66SRoopa Prabhu printf "Tests failed: %3d\n" ${nfail} 569*3edf5f66SRoopa Prabhufi 570*3edf5f66SRoopa Prabhu 571*3edf5f66SRoopa Prabhuexit $ret 572