1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3 4# IPsec over bonding offload test: 5# 6# +----------------+ 7# | bond0 | 8# | | | 9# | eth0 eth1 | 10# +---+-------+----+ 11# 12# We use netdevsim instead of physical interfaces 13#------------------------------------------------------------------- 14# Example commands 15# ip x s add proto esp src 192.0.2.1 dst 192.0.2.2 \ 16# spi 0x07 mode transport reqid 0x07 replay-window 32 \ 17# aead 'rfc4106(gcm(aes))' 1234567890123456dcba 128 \ 18# sel src 192.0.2.1/24 dst 192.0.2.2/24 19# offload dev bond0 dir out 20# ip x p add dir out src 192.0.2.1/24 dst 192.0.2.2/24 \ 21# tmpl proto esp src 192.0.2.1 dst 192.0.2.2 \ 22# spi 0x07 mode transport reqid 0x07 23# 24#------------------------------------------------------------------- 25 26lib_dir=$(dirname "$0") 27# shellcheck disable=SC1091 28source "$lib_dir"/../../../net/lib.sh 29srcip=192.0.2.1 30dstip=192.0.2.2 31ipsec0=/sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec 32ipsec1=/sys/kernel/debug/netdevsim/netdevsim0/ports/1/ipsec 33active_slave="" 34 35# shellcheck disable=SC2317 36active_slave_changed() 37{ 38 local old_active_slave=$1 39 local new_active_slave 40 41 # shellcheck disable=SC2154 42 new_active_slave=$(ip -n "${ns}" -d -j link show bond0 | \ 43 jq -r ".[].linkinfo.info_data.active_slave") 44 [ "$new_active_slave" != "$old_active_slave" ] && [ "$new_active_slave" != "null" ] 45} 46 47test_offload() 48{ 49 # use ping to exercise the Tx path 50 ip netns exec "$ns" ping -I bond0 -c 3 -W 1 -i 0 "$dstip" >/dev/null 51 52 active_slave=$(ip -n "${ns}" -d -j link show bond0 | \ 53 jq -r ".[].linkinfo.info_data.active_slave") 54 55 if [ "$active_slave" = "$nic0" ]; then 56 sysfs=$ipsec0 57 elif [ "$active_slave" = "$nic1" ]; then 58 sysfs=$ipsec1 59 else 60 check_err 1 "bond_ipsec_offload invalid active_slave $active_slave" 61 fi 62 63 # The tx/rx order in sysfs may changed after failover 64 grep -q "SA count=2 tx=3" "$sysfs" && grep -q "tx ipaddr=$dstip" "$sysfs" 65 check_err $? "incorrect tx count with link ${active_slave}" 66 67 log_test bond_ipsec_offload "active_slave ${active_slave}" 68} 69 70setup_env() 71{ 72 if ! mount | grep -q debugfs; then 73 mount -t debugfs none /sys/kernel/debug/ &> /dev/null 74 defer umount /sys/kernel/debug/ 75 76 fi 77 78 # setup netdevsim since dummy/veth dev doesn't have offload support 79 if [ ! -w /sys/bus/netdevsim/new_device ] ; then 80 if ! modprobe -q netdevsim; then 81 echo "SKIP: can't load netdevsim for ipsec offload" 82 # shellcheck disable=SC2154 83 exit "$ksft_skip" 84 fi 85 defer modprobe -r netdevsim 86 fi 87 88 setup_ns ns 89 defer cleanup_ns "$ns" 90} 91 92setup_bond() 93{ 94 ip -n "$ns" link add bond0 type bond mode active-backup miimon 100 95 ip -n "$ns" addr add "$srcip/24" dev bond0 96 ip -n "$ns" link set bond0 up 97 98 echo "0 2" | ip netns exec "$ns" tee /sys/bus/netdevsim/new_device >/dev/null 99 nic0=$(ip netns exec "$ns" ls /sys/bus/netdevsim/devices/netdevsim0/net | head -n 1) 100 nic1=$(ip netns exec "$ns" ls /sys/bus/netdevsim/devices/netdevsim0/net | tail -n 1) 101 ip -n "$ns" link set "$nic0" master bond0 102 ip -n "$ns" link set "$nic1" master bond0 103 104 # we didn't create a peer, make sure we can Tx by adding a permanent 105 # neighbour this need to be added after enslave 106 ip -n "$ns" neigh add "$dstip" dev bond0 lladdr 00:11:22:33:44:55 107 108 # create offloaded SAs, both in and out 109 ip -n "$ns" x p add dir out src "$srcip/24" dst "$dstip/24" \ 110 tmpl proto esp src "$srcip" dst "$dstip" spi 9 \ 111 mode transport reqid 42 112 113 ip -n "$ns" x p add dir in src "$dstip/24" dst "$srcip/24" \ 114 tmpl proto esp src "$dstip" dst "$srcip" spi 9 \ 115 mode transport reqid 42 116 117 ip -n "$ns" x s add proto esp src "$srcip" dst "$dstip" spi 9 \ 118 mode transport reqid 42 aead "rfc4106(gcm(aes))" \ 119 0x3132333435363738393031323334353664636261 128 \ 120 sel src "$srcip/24" dst "$dstip/24" \ 121 offload dev bond0 dir out 122 123 ip -n "$ns" x s add proto esp src "$dstip" dst "$srcip" spi 9 \ 124 mode transport reqid 42 aead "rfc4106(gcm(aes))" \ 125 0x3132333435363738393031323334353664636261 128 \ 126 sel src "$dstip/24" dst "$srcip/24" \ 127 offload dev bond0 dir in 128 129 # does offload show up in ip output 130 lines=$(ip -n "$ns" x s list | grep -c "crypto offload parameters: dev bond0 dir") 131 if [ "$lines" -ne 2 ] ; then 132 check_err 1 "bond_ipsec_offload SA offload missing from list output" 133 fi 134} 135 136trap defer_scopes_cleanup EXIT 137setup_env 138setup_bond 139 140# start Offload testing 141test_offload 142 143# do failover and re-test 144ip -n "$ns" link set "$active_slave" down 145slowwait 5 active_slave_changed "$active_slave" 146test_offload 147 148# make sure offload get removed from driver 149ip -n "$ns" x s flush 150ip -n "$ns" x p flush 151line0=$(grep -c "SA count=0" "$ipsec0") 152line1=$(grep -c "SA count=0" "$ipsec1") 153[ "$line0" -ne 1 ] || [ "$line1" -ne 1 ] 154check_fail $? "bond_ipsec_offload SA not removed from driver" 155 156exit "$EXIT_STATUS" 157