From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org C32D5826B0 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 865238266C MIME-Version: 1.0 Date: Thu, 22 Sep 2022 22:35:02 +0200 From: netdev@kapio-technology.com In-Reply-To: References: <5cee059b65f6f7671e099150f9da79c1@kapio-technology.com> <8dfc9b525f084fa5ad55019f4418a35e@kapio-technology.com> <20220908112044.czjh3xkzb4r27ohq@skbuf> <152c0ceadefbd742331c340bec2f50c0@kapio-technology.com> <20220911001346.qno33l47i6nvgiwy@skbuf> <15ee472a68beca4a151118179da5e663@kapio-technology.com> <086704ce7f323cc1b3cca78670b42095@kapio-technology.com> Message-ID: Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Bridge] [PATCH v5 net-next 6/6] selftests: forwarding: add test of MAC-Auth Bypass to locked port tests List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Ido Schimmel Cc: Andrew Lunn , Alexandre Belloni , Nikolay Aleksandrov , Kurt Kanzenbach , Eric Dumazet , linux-kselftest@vger.kernel.org, Shuah Khan , Ivan Vecera , Florian Fainelli , Daniel Borkmann , bridge@lists.linux-foundation.org, linux-arm-kernel@lists.infradead.org, Roopa Prabhu , kuba@kernel.org, Paolo Abeni , Vivien Didelot , Woojung Huh , Landen Chao , Jiri Pirko , Christian Marangi , Hauke Mehrtens , Sean Wang , DENG Qingfang , Claudiu Manoil , linux-mediatek@lists.infradead.org, Matthias Brugger , Yuwei Wang , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, UNGLinuxDriver@microchip.com, Vladimir Oltean , davem@davemloft.net On 2022-09-21 09:15, Ido Schimmel wrote: > On Tue, Sep 20, 2022 at 11:29:12PM +0200, netdev@kapio-technology.com > wrote: >> I have made a blackhole selftest, which looks like this: >> >> test_blackhole_fdb() >> { >> RET=0 >> >> check_blackhole_fdb_support || return 0 >> >> tcpdump_start $h2 >> $MZ $h1 -q -t udp -a $h1 -b $h2 > > I don't think you can give an interface name to '-a' and '-b'? > >> tcpdump_stop >> tcpdump_show | grep -q udp >> check_err $? "test_blackhole_fdb: No packet seen on initial" >> tcpdump_cleanup >> >> bridge fdb add `mac_get $h2` dev br0 blackhole >> bridge fdb show dev br0 | grep -q "blackhole" > > Make this grep more specific so that we are sure it is the entry user > space installed. Something like this: > > bridge fdb get `mac_get $h2` br br0 | grep -q blackhole > >> check_err $? "test_blackhole_fdb: No blackhole FDB entry >> found" >> >> tcpdump_start $h2 >> $MZ $h1 -q -t udp -a $h1 -b $h2 >> tcpdump_stop >> tcpdump_show | grep -q udp >> check_fail $? "test_blackhole_fdb: packet seen with blackhole >> fdb >> entry" >> tcpdump_cleanup > > The tcpdump filter is not specific enough. It can catch other UDP > packets (e.g., multicast) being received by $h2. Anyway, to be sure the > feature works as expected we need to make sure that the packets are not > even egressing $swp2. Checking that they are not received by $h2 is not > enough. See this (untested) suggestion [1] that uses a tc filter on the > egress of $swp2. > >> >> bridge fdb del `mac_get $h2` dev br0 blackhole >> bridge fdb show dev br0 | grep -q "blackhole" >> check_fail $? "test_blackhole_fdb: Blackhole FDB entry not >> deleted" >> >> tcpdump_start $h2 >> $MZ $h1 -q -t udp -a $h1 -b $h2 >> tcpdump_stop >> tcpdump_show | grep -q udp >> check_err $? "test_blackhole_fdb: No packet seen after >> removing >> blackhole FDB entry" >> tcpdump_cleanup >> >> log_test "Blackhole FDB entry test" >> } >> >> the setup is simple and is the same as in bridge_sticky_fdb.sh. >> >> Does the test look sound or is there obvious mistakes? > > [1] > blackhole_fdb() > { > RET=0 > > tc filter add dev $swp2 egress protocol ip pref 1 handle 1 flower \ > dst_ip 192.0.2.2 ip_proto udp dst_port 12345 action pass > > $MZ $h1 -c 1 -p 128 -t udp "sp=54321,dp=12345" \ > -a own -b `mac_get $h2` -A 192.0.2.1 -B 192.0.2.2 -q > > tc_check_packets "dev $swp2 egress" 1 1 > check_err $? "Packet not seen on egress before adding blackhole entry" > > bridge fdb add `mac_get $h2` dev br0 blackhole > bridge fdb get `mac_get $h2` br br0 | grep -q blackhole > check_err $? "Blackhole entry not found" > > $MZ $h1 -c 1 -p 128 -t udp "sp=54321,dp=12345" \ > -a own -b `mac_get $h2` -A 192.0.2.1 -B 192.0.2.2 -q > > tc_check_packets "dev $swp2 egress" 1 1 > check_err $? "Packet seen on egress after adding blackhole entry" > > # Check blackhole entries can be replaced. > bridge fdb replace `mac_get $h2` dev $swp2 master static > bridge fdb get `mac_get $h2` br br0 | grep -q blackhole > check_fail $? "Blackhole entry found after replacement" > > $MZ $h1 -c 1 -p 128 -t udp "sp=54321,dp=12345" \ > -a own -b `mac_get $h2` -A 192.0.2.1 -B 192.0.2.2 -q > > tc_check_packets "dev $swp2 egress" 1 2 > check_err $? "Packet not seen on egress after replacing blackhole > entry" > > bridge fdb del `mac_get $h2` dev $swp2 master static > tc filter del dev $swp2 egress protocol ip pref 1 handle 1 flower > > log_test "Blackhole FDB entry" > } Thx, looks good. I have tried to run the test as far as I can manually, but I don't seem to have 'busywait' in the system, which tc_check_packets() depends on, and I couldn't find any 'busywait' in Buildroot.