A filter on a block of tunnel keys must match a key inside the block and
no key outside it. It must also dump its mask. A second filter proves that
the frame outside the block reaches the device.
When tc does not know the mask or a device refuses it under skip_sw, the
test only logs this. Reporting a skip would turn the exit status of the
whole script into a skip.
Signed-off-by: Alexandre Cassen <redacted>
---
.../selftests/net/forwarding/tc_flower.sh | 57 +++++++++++++++++++
1 file changed, 57 insertions(+)
diff --git a/tools/testing/selftests/net/forwarding/tc_flower.sh b/tools/testing/selftests/net/forwarding/tc_flower.sh
index b58909a93112..9d9f109ab895 100755
--- a/tools/testing/selftests/net/forwarding/tc_flower.sh
+++ b/tools/testing/selftests/net/forwarding/tc_flower.sh
@@ -3,6 +3,7 @@
ALL_TESTS="match_dst_mac_test match_src_mac_test match_dst_ip_test \
match_src_ip_test match_ip_flags_test match_pcp_test match_vlan_test \
+ match_enc_key_id_mask_test \
match_ip_tos_test match_indev_test match_ip_ttl_test
match_mpls_label_test \
match_mpls_tc_test match_mpls_bos_test match_mpls_ttl_test \
@@ -280,6 +281,62 @@ match_vlan_test()
log_test "VLAN match ($tcflags)"
}
+enc_key_id_mask_check()
+{
+ tc filter show dev gt-ex ingress pref 1 | grep -q "enc_key_id 256/0xf00"
+ check_err $? "Did not dump the mask"
+
+ $MZ gt1 -c 1 -p 64 -a "$(mac_get gt1)" -b $h2mac -t ip -q
+
+ tc_check_packets "dev gt-ex ingress" 101 1
+ check_err $? "Did not match a key inside the mask"
+
+ $MZ gt2 -c 1 -p 64 -a "$(mac_get gt2)" -b $h2mac -t ip -q
+
+ tc_check_packets "dev gt-ex ingress" 102 1
+ check_err $? "Did not receive the key outside the mask"
+
+ tc_check_packets "dev gt-ex ingress" 101 1
+ check_err $? "Matched a key outside the mask"
+
+ log_test "enc_key_id mask match ($tcflags)"
+}
+
+match_enc_key_id_mask_test()
+{
+ RET=0
+
+ if ! tc filter add dev $h2 ingress flower help 2>&1 | grep -q MASKED-KEY-ID; then
+ echo "SKIP: iproute2 too old; tc is missing the enc_key_id mask"
+ return 0
+ fi
+
+ tunnel_create gt1 gretap 192.0.2.1 192.0.2.2 dev $h1 key 300
+ tunnel_create gt2 gretap 192.0.2.1 192.0.2.2 dev $h1 key 600
+ ip link set dev gt1 master v$h1
+ ip link set dev gt2 master v$h1
+ ip link add gt-ex type gretap external # To collect tunnel info
+ ip link set dev gt-ex up
+ ip link set dev gt-ex master v$h2
+ tc qdisc add dev gt-ex clsact
+
+ # A device may refuse a partial mask but software must take it
+ tc filter add dev gt-ex ingress protocol ip pref 1 handle 101 flower \
+ $tcflags enc_key_id 256/0xf00 action drop
+ if [[ $? -ne 0 && $tcflags == "skip_sw" ]]; then
+ log_info "Device refuses the enc_key_id mask"
+ else
+ tc filter add dev gt-ex ingress protocol ip pref 2 handle 102 \
+ flower $tcflags enc_key_id 600 action drop
+ enc_key_id_mask_check
+ fi
+
+ tc qdisc del dev gt-ex clsact
+ tunnel_destroy gt-ex
+ tunnel_destroy gt2
+ tunnel_destroy gt1
+}
+
match_ip_tos_test()
{
RET=0--
2.43.0