netdev - Re: [PATCH net-next v4 3/3] selftests: net: add tc flower cfm test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 30 Apr 2023 18:37:40 +0200
From:   Zahari Doychev <zahari.doychev@...ux.com>
To:     Ido Schimmel <idosch@...sch.org>
Cc:     netdev@...r.kernel.org, jhs@...atatu.com, xiyou.wangcong@...il.com,
        jiri@...nulli.us, davem@...emloft.net, edumazet@...gle.com,
        kuba@...nel.org, pabeni@...hat.com, hmehrtens@...linear.com,
        aleksander.lobakin@...el.com, simon.horman@...igine.com,
        Zahari Doychev <zdoychev@...linear.com>
Subject: Re: [PATCH net-next v4 3/3] selftests: net: add tc flower cfm test

> > +tcflags="skip_hw"
> > +

[...]

> > +h1_create()
> > +{
> > +	simple_if_init $h1 192.0.2.1/24 198.51.100.1/24
> 
> The IP address are not used in the test. Can be omitted.
> 
> > +}
> > +
> > +h1_destroy()
> > +{
> > +	simple_if_fini $h1 192.0.2.1/24 198.51.100.1/24
> > +}
> > +
> > +h2_create()
> > +{
> > +	simple_if_init $h2 192.0.2.2/24 198.51.100.2/24
> > +	tc qdisc add dev $h2 clsact
> > +}
> > +
> > +h2_destroy()
> > +{
> > +	tc qdisc del dev $h2 clsact
> > +	simple_if_fini $h2 192.0.2.2/24 198.51.100.2/24
> > +}
> > +
> > +cfm_mdl_opcode()
> > +{
> > +	local mdl=$1
> > +	local op=$2
> > +	local flags=$3
> > +	local tlv_offset=$4
> 
> If you use something like:
> 
> local mdl=$1; shift
> local op=$1; shift
> 
> Then minimal changes are required if the order changes
> 
> > +
> > +	printf "%02x %02x %02x %02x"    \
> > +		   $((mdl << 5))             \
> > +		   $((op & 0xff))             \
> > +		   $((flags & 0xff)) \
> > +		   $tlv_offset
> > +}
> 
> See mldv2_is_in_get() in tools/testing/selftests/net/forwarding/lib.sh
> and related functions for a more readable way to achieve the above.
> 
> > +
> > +match_cfm_opcode()
> > +{
> > +	local ethtype="89 02"; readonly ethtype
> > +	RET=0
> > +
> > +	tc filter add dev $h2 ingress protocol cfm pref 1 handle 101 \
> > +	   flower cfm op 47 action drop
> > +	tc filter add dev $h2 ingress protocol cfm pref 2 handle 102 \
> > +	   flower cfm op 43 action drop
> 
> Both filters can use the same preference since the same mask is used.
> 
> > +
> > +	pkt="$ethtype $(cfm_mdl_opcode 7 47 0 4)"
> > +	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
> > +	pkt="$ethtype $(cfm_mdl_opcode 6 5 0 4)"
> > +	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
> > +
> > +	tc_check_packets "dev $h2 ingress" 101 1
> > +	check_err $? "Did not match on correct opcode"
> > +
> > +	tc_check_packets "dev $h2 ingress" 102 0
> > +	check_err $? "Matched on the wrong opcode"
> 
> For good measures you can send a packet with opcode 43 and check that
> only 102 is hit.
> 
> > +
> > +	tc filter del dev $h2 ingress protocol cfm pref 1 handle 101 flower
> > +	tc filter del dev $h2 ingress protocol cfm pref 2 handle 102 flower
> > +
> > +	log_test "CFM opcode match test"
> > +}
> > +
> > +match_cfm_level()
> > +{
> > +	local ethtype="89 02"; readonly ethtype
> > +	RET=0
> > +
> > +	tc filter add dev $h2 ingress protocol cfm pref 1 handle 101 \
> > +	   flower cfm mdl 5 action drop
> > +	tc filter add dev $h2 ingress protocol cfm pref 2 handle 102 \
> > +	   flower cfm mdl 3 action drop
> > +	tc filter add dev $h2 ingress protocol cfm pref 3 handle 103 \
> > +	   flower cfm mdl 0 action drop
> 
> Same comment about the preference.
> 
> > +
> > +	pkt="$ethtype $(cfm_mdl_opcode 5 42 0 4)"
> > +	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
> > +	pkt="$ethtype $(cfm_mdl_opcode 6 1 0 4)"
> > +	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
> > +	pkt="$ethtype $(cfm_mdl_opcode 0 1 0 4)"
> > +	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac "$pkt" -q
> > +
> > +	tc_check_packets "dev $h2 ingress" 101 1
> > +	check_err $? "Did not match on correct level"
> > +
> > +	tc_check_packets "dev $h2 ingress" 102 0
> > +	check_err $? "Matched on the wrong level"
> > +
> > +	tc_check_packets "dev $h2 ingress" 103 1
> > +	check_err $? "Did not match on correct level"
> > +
> > +	tc filter del dev $h2 ingress protocol cfm pref 1 handle 101 flower
> > +	tc filter del dev $h2 ingress protocol cfm pref 2 handle 102 flower
> > +	tc filter del dev $h2 ingress protocol cfm pref 3 handle 103 flower
> > +
> > +	log_test "CFM level match test"
> > +}
> > +
> > +match_cfm_level_and_opcode()
> > +{
> > +	local ethtype="89 02"; readonly ethtype
> > +	RET=0
> > +
> > +	tc filter add dev $h2 ingress protocol cfm pref 1 handle 101 \
> > +	   flower cfm mdl 5 op 41 action drop
> > +	tc filter add dev $h2 ingress protocol cfm pref 2 handle 102 \
> > +	   flower cfm mdl 7 op 42 action drop
> 
> Likewise
> 
> > +

I will handle your comments in the next version.

thanks,
Zahari

[...]