1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# Copyright (c) 2019 David Ahern <dsahern@gmail.com>. All rights reserved. 5# 6# IPv4 and IPv6 functional tests focusing on VRF and routing lookups 7# for various permutations: 8# 1. icmp, tcp, udp and netfilter 9# 2. client, server, no-server 10# 3. global address on interface 11# 4. global address on 'lo' 12# 5. remote and local traffic 13# 6. VRF and non-VRF permutations 14# 15# Setup: 16# ns-A | ns-B 17# No VRF case: 18# [ lo ] [ eth1 ]---|---[ eth1 ] [ lo ] 19# remote address 20# VRF case: 21# [ red ]---[ eth1 ]---|---[ eth1 ] [ lo ] 22# 23# ns-A: 24# eth1: 172.16.1.1/24, 2001:db8:1::1/64 25# lo: 127.0.0.1/8, ::1/128 26# 172.16.2.1/32, 2001:db8:2::1/128 27# red: 127.0.0.1/8, ::1/128 28# 172.16.3.1/32, 2001:db8:3::1/128 29# 30# ns-B: 31# eth1: 172.16.1.2/24, 2001:db8:1::2/64 32# lo2: 127.0.0.1/8, ::1/128 33# 172.16.2.2/32, 2001:db8:2::2/128 34# 35# ns-A to ns-C connection - only for VRF and same config 36# as ns-A to ns-B 37# 38# server / client nomenclature relative to ns-A 39 40source lib.sh 41 42PATH=$PWD:$PWD/tools/testing/selftests/net:$PATH 43 44VERBOSE=0 45 46NSA_DEV=eth1 47NSA_DEV2=eth2 48NSB_DEV=eth1 49NSC_DEV=eth2 50VRF=red 51VRF_TABLE=1101 52 53# IPv4 config 54NSA_IP=172.16.1.1 55NSB_IP=172.16.1.2 56VRF_IP=172.16.3.1 57NS_NET=172.16.1.0/24 58 59# IPv6 config 60NSA_IP6=2001:db8:1::1 61NSB_IP6=2001:db8:1::2 62VRF_IP6=2001:db8:3::1 63NS_NET6=2001:db8:1::/120 64 65NSA_LO_IP=172.16.2.1 66NSB_LO_IP=172.16.2.2 67NSA_LO_IP6=2001:db8:2::1 68NSB_LO_IP6=2001:db8:2::2 69 70# non-local addresses for freebind tests 71NL_IP=172.17.1.1 72NL_IP6=2001:db8:4::1 73 74# multicast and broadcast addresses 75MCAST_IP=224.0.0.1 76BCAST_IP=255.255.255.255 77 78MD5_PW=abc123 79MD5_WRONG_PW=abc1234 80 81MCAST=ff02::1 82# set after namespace create 83NSA_LINKIP6= 84NSB_LINKIP6= 85 86which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping) 87 88# Check if FIPS mode is enabled 89if [ -f /proc/sys/crypto/fips_enabled ]; then 90 fips_enabled=`cat /proc/sys/crypto/fips_enabled` 91else 92 fips_enabled=0 93fi 94 95################################################################################ 96# utilities 97 98log_test() 99{ 100 log_test_expected "$1" "$2" "$3" 101 102 kill_procs 103} 104 105log_test_addr() 106{ 107 local addr=$1 108 local rc=$2 109 local expected=$3 110 local msg="$4" 111 local astr 112 113 astr=$(addr2str ${addr}) 114 log_test $rc $expected "$msg - ${astr}" 115} 116 117log_section() 118{ 119 echo 120 echo "###########################################################################" 121 echo "$*" 122 echo "###########################################################################" 123 echo 124} 125 126log_subsection() 127{ 128 echo 129 echo "#################################################################" 130 echo "$*" 131 echo 132} 133 134log_start() 135{ 136 # make sure we have no test instances running 137 kill_procs 138 139 if [ "${VERBOSE}" = "1" ]; then 140 echo 141 echo "#######################################################" 142 fi 143} 144 145log_debug() 146{ 147 if [ "${VERBOSE}" = "1" ]; then 148 echo 149 echo "$*" 150 echo 151 fi 152} 153 154show_hint() 155{ 156 if [ "${VERBOSE}" = "1" ]; then 157 echo "HINT: $*" 158 echo 159 fi 160} 161 162kill_procs() 163{ 164 killall nettest ping ping6 >/dev/null 2>&1 165 slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"' 166} 167 168set_ping_group() 169{ 170 if [ "$VERBOSE" = "1" ]; then 171 echo "COMMAND: ${NSA_CMD} sysctl -q -w net.ipv4.ping_group_range='0 2147483647'" 172 fi 173 174 ${NSA_CMD} sysctl -q -w net.ipv4.ping_group_range='0 2147483647' 175} 176 177do_run_cmd() 178{ 179 local cmd="$*" 180 local out 181 182 if [ "$VERBOSE" = "1" ]; then 183 echo "COMMAND: ${cmd}" 184 fi 185 186 out=$($cmd 2>&1) 187 rc=$? 188 if [ "$VERBOSE" = "1" -a -n "$out" ]; then 189 echo "$out" 190 fi 191 192 return $rc 193} 194 195run_cmd() 196{ 197 do_run_cmd ${NSA_CMD} $* 198} 199 200run_cmd_nsb() 201{ 202 do_run_cmd ${NSB_CMD} $* 203} 204 205run_cmd_nsc() 206{ 207 do_run_cmd ${NSC_CMD} $* 208} 209 210setup_cmd() 211{ 212 local cmd="$*" 213 local rc 214 215 run_cmd ${cmd} 216 rc=$? 217 if [ $rc -ne 0 ]; then 218 # show user the command if not done so already 219 if [ "$VERBOSE" = "0" ]; then 220 echo "setup command: $cmd" 221 fi 222 echo "failed. stopping tests" 223 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 224 echo 225 echo "hit enter to continue" 226 read a 227 fi 228 exit $rc 229 fi 230} 231 232setup_cmd_nsb() 233{ 234 local cmd="$*" 235 local rc 236 237 run_cmd_nsb ${cmd} 238 rc=$? 239 if [ $rc -ne 0 ]; then 240 # show user the command if not done so already 241 if [ "$VERBOSE" = "0" ]; then 242 echo "setup command: $cmd" 243 fi 244 echo "failed. stopping tests" 245 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 246 echo 247 echo "hit enter to continue" 248 read a 249 fi 250 exit $rc 251 fi 252} 253 254setup_cmd_nsc() 255{ 256 local cmd="$*" 257 local rc 258 259 run_cmd_nsc ${cmd} 260 rc=$? 261 if [ $rc -ne 0 ]; then 262 # show user the command if not done so already 263 if [ "$VERBOSE" = "0" ]; then 264 echo "setup command: $cmd" 265 fi 266 echo "failed. stopping tests" 267 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 268 echo 269 echo "hit enter to continue" 270 read a 271 fi 272 exit $rc 273 fi 274} 275 276# set sysctl values in NS-A 277set_sysctl() 278{ 279 echo "SYSCTL: $*" 280 echo 281 run_cmd sysctl -q -w $* 282} 283 284# get sysctl values in NS-A 285get_sysctl() 286{ 287 ${NSA_CMD} sysctl -n $* 288} 289 290################################################################################ 291# Setup for tests 292 293addr2str() 294{ 295 case "$1" in 296 127.0.0.1) echo "loopback";; 297 ::1) echo "IPv6 loopback";; 298 299 ${BCAST_IP}) echo "broadcast";; 300 ${MCAST_IP}) echo "multicast";; 301 302 ${NSA_IP}) echo "ns-A IP";; 303 ${NSA_IP6}) echo "ns-A IPv6";; 304 ${NSA_LO_IP}) echo "ns-A loopback IP";; 305 ${NSA_LO_IP6}) echo "ns-A loopback IPv6";; 306 ${NSA_LINKIP6}|${NSA_LINKIP6}%*) echo "ns-A IPv6 LLA";; 307 308 ${NSB_IP}) echo "ns-B IP";; 309 ${NSB_IP6}) echo "ns-B IPv6";; 310 ${NSB_LO_IP}) echo "ns-B loopback IP";; 311 ${NSB_LO_IP6}) echo "ns-B loopback IPv6";; 312 ${NSB_LINKIP6}|${NSB_LINKIP6}%*) echo "ns-B IPv6 LLA";; 313 314 ${NL_IP}) echo "nonlocal IP";; 315 ${NL_IP6}) echo "nonlocal IPv6";; 316 317 ${VRF_IP}) echo "VRF IP";; 318 ${VRF_IP6}) echo "VRF IPv6";; 319 320 ${MCAST}%*) echo "multicast IP";; 321 322 *) echo "unknown";; 323 esac 324} 325 326get_linklocal() 327{ 328 local ns=$1 329 local dev=$2 330 local addr 331 332 addr=$(ip -netns ${ns} -6 -br addr show dev ${dev} | \ 333 awk '{ 334 for (i = 3; i <= NF; ++i) { 335 if ($i ~ /^fe80/) 336 print $i 337 } 338 }' 339 ) 340 addr=${addr/\/*} 341 342 [ -z "$addr" ] && return 1 343 344 echo $addr 345 346 return 0 347} 348 349################################################################################ 350# create namespaces and vrf 351 352create_vrf() 353{ 354 local ns=$1 355 local vrf=$2 356 local table=$3 357 local addr=$4 358 local addr6=$5 359 360 ip -netns ${ns} link add ${vrf} type vrf table ${table} 361 ip -netns ${ns} link set ${vrf} up 362 ip -netns ${ns} route add vrf ${vrf} unreachable default metric 8192 363 ip -netns ${ns} -6 route add vrf ${vrf} unreachable default metric 8192 364 365 ip -netns ${ns} addr add 127.0.0.1/8 dev ${vrf} 366 ip -netns ${ns} -6 addr add ::1 dev ${vrf} nodad 367 if [ "${addr}" != "-" ]; then 368 ip -netns ${ns} addr add dev ${vrf} ${addr} 369 fi 370 if [ "${addr6}" != "-" ]; then 371 ip -netns ${ns} -6 addr add dev ${vrf} ${addr6} 372 fi 373 374 ip -netns ${ns} ru del pref 0 375 ip -netns ${ns} ru add pref 32765 from all lookup local 376 ip -netns ${ns} -6 ru del pref 0 377 ip -netns ${ns} -6 ru add pref 32765 from all lookup local 378} 379 380create_ns() 381{ 382 local ns=$1 383 local addr=$2 384 local addr6=$3 385 386 if [ "${addr}" != "-" ]; then 387 ip -netns ${ns} addr add dev lo ${addr} 388 fi 389 if [ "${addr6}" != "-" ]; then 390 ip -netns ${ns} -6 addr add dev lo ${addr6} 391 fi 392 393 ip -netns ${ns} ro add unreachable default metric 8192 394 ip -netns ${ns} -6 ro add unreachable default metric 8192 395 396 ip netns exec ${ns} sysctl -qw net.ipv4.ip_forward=1 397 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1 398 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1 399 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1 400 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0 401 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0 402} 403 404# create veth pair to connect namespaces and apply addresses. 405connect_ns() 406{ 407 local ns1=$1 408 local ns1_dev=$2 409 local ns1_addr=$3 410 local ns1_addr6=$4 411 local ns2=$5 412 local ns2_dev=$6 413 local ns2_addr=$7 414 local ns2_addr6=$8 415 416 ip -netns ${ns1} li add ${ns1_dev} type veth peer name tmp 417 ip -netns ${ns1} li set ${ns1_dev} up 418 ip -netns ${ns1} li set tmp netns ${ns2} name ${ns2_dev} 419 ip -netns ${ns2} li set ${ns2_dev} up 420 421 if [ "${ns1_addr}" != "-" ]; then 422 ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr} 423 ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr} 424 fi 425 426 if [ "${ns1_addr6}" != "-" ]; then 427 ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr6} 428 ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr6} 429 fi 430} 431 432cleanup() 433{ 434 # explicit cleanups to check those code paths 435 ip netns | grep -q ${NSA} 436 if [ $? -eq 0 ]; then 437 ip -netns ${NSA} link delete ${VRF} 438 ip -netns ${NSA} ro flush table ${VRF_TABLE} 439 440 ip -netns ${NSA} addr flush dev ${NSA_DEV} 441 ip -netns ${NSA} -6 addr flush dev ${NSA_DEV} 442 ip -netns ${NSA} link set dev ${NSA_DEV} down 443 ip -netns ${NSA} link del dev ${NSA_DEV} 444 445 ip netns pids ${NSA} | xargs kill 2>/dev/null 446 cleanup_ns ${NSA} 447 fi 448 449 ip netns pids ${NSB} | xargs kill 2>/dev/null 450 ip netns pids ${NSC} | xargs kill 2>/dev/null 451 cleanup_ns ${NSB} ${NSC} 452} 453 454cleanup_vrf_dup() 455{ 456 ip link del ${NSA_DEV2} >/dev/null 2>&1 457 ip netns pids ${NSC} | xargs kill 2>/dev/null 458 ip netns del ${NSC} >/dev/null 2>&1 459} 460 461setup_vrf_dup() 462{ 463 # some VRF tests use ns-C which has the same config as 464 # ns-B but for a device NOT in the VRF 465 setup_ns NSC 466 NSC_CMD="ip netns exec ${NSC}" 467 create_ns ${NSC} "-" "-" 468 connect_ns ${NSA} ${NSA_DEV2} ${NSA_IP}/24 ${NSA_IP6}/64 \ 469 ${NSC} ${NSC_DEV} ${NSB_IP}/24 ${NSB_IP6}/64 470} 471 472setup() 473{ 474 local with_vrf=${1} 475 476 # make sure we are starting with a clean slate 477 kill_procs 478 cleanup 2>/dev/null 479 480 log_debug "Configuring network namespaces" 481 set -e 482 483 setup_ns NSA NSB 484 NSA_CMD="ip netns exec ${NSA}" 485 NSB_CMD="ip netns exec ${NSB}" 486 487 create_ns ${NSA} ${NSA_LO_IP}/32 ${NSA_LO_IP6}/128 488 create_ns ${NSB} ${NSB_LO_IP}/32 ${NSB_LO_IP6}/128 489 connect_ns ${NSA} ${NSA_DEV} ${NSA_IP}/24 ${NSA_IP6}/64 \ 490 ${NSB} ${NSB_DEV} ${NSB_IP}/24 ${NSB_IP6}/64 491 492 NSA_LINKIP6=$(get_linklocal ${NSA} ${NSA_DEV}) 493 NSB_LINKIP6=$(get_linklocal ${NSB} ${NSB_DEV}) 494 495 # tell ns-A how to get to remote addresses of ns-B 496 if [ "${with_vrf}" = "yes" ]; then 497 create_vrf ${NSA} ${VRF} ${VRF_TABLE} ${VRF_IP} ${VRF_IP6} 498 499 ip -netns ${NSA} link set dev ${NSA_DEV} vrf ${VRF} 500 ip -netns ${NSA} ro add vrf ${VRF} ${NSB_LO_IP}/32 via ${NSB_IP} dev ${NSA_DEV} 501 ip -netns ${NSA} -6 ro add vrf ${VRF} ${NSB_LO_IP6}/128 via ${NSB_IP6} dev ${NSA_DEV} 502 503 ip -netns ${NSB} ro add ${VRF_IP}/32 via ${NSA_IP} dev ${NSB_DEV} 504 ip -netns ${NSB} -6 ro add ${VRF_IP6}/128 via ${NSA_IP6} dev ${NSB_DEV} 505 else 506 ip -netns ${NSA} ro add ${NSB_LO_IP}/32 via ${NSB_IP} dev ${NSA_DEV} 507 ip -netns ${NSA} ro add ${NSB_LO_IP6}/128 via ${NSB_IP6} dev ${NSA_DEV} 508 fi 509 510 511 # tell ns-B how to get to remote addresses of ns-A 512 ip -netns ${NSB} ro add ${NSA_LO_IP}/32 via ${NSA_IP} dev ${NSB_DEV} 513 ip -netns ${NSB} ro add ${NSA_LO_IP6}/128 via ${NSA_IP6} dev ${NSB_DEV} 514 515 set +e 516 517 sleep 1 518} 519 520setup_lla_only() 521{ 522 # make sure we are starting with a clean slate 523 kill_procs 524 cleanup 2>/dev/null 525 526 log_debug "Configuring network namespaces" 527 set -e 528 529 setup_ns NSA NSB NSC 530 NSA_CMD="ip netns exec ${NSA}" 531 NSB_CMD="ip netns exec ${NSB}" 532 NSC_CMD="ip netns exec ${NSC}" 533 create_ns ${NSA} "-" "-" 534 create_ns ${NSB} "-" "-" 535 create_ns ${NSC} "-" "-" 536 connect_ns ${NSA} ${NSA_DEV} "-" "-" \ 537 ${NSB} ${NSB_DEV} "-" "-" 538 connect_ns ${NSA} ${NSA_DEV2} "-" "-" \ 539 ${NSC} ${NSC_DEV} "-" "-" 540 541 NSA_LINKIP6=$(get_linklocal ${NSA} ${NSA_DEV}) 542 NSB_LINKIP6=$(get_linklocal ${NSB} ${NSB_DEV}) 543 NSC_LINKIP6=$(get_linklocal ${NSC} ${NSC_DEV}) 544 545 create_vrf ${NSA} ${VRF} ${VRF_TABLE} "-" "-" 546 ip -netns ${NSA} link set dev ${NSA_DEV} vrf ${VRF} 547 ip -netns ${NSA} link set dev ${NSA_DEV2} vrf ${VRF} 548 549 set +e 550 551 sleep 1 552} 553 554################################################################################ 555# IPv4 556 557ipv4_ping_novrf() 558{ 559 local a 560 561 # 562 # out 563 # 564 for a in ${NSB_IP} ${NSB_LO_IP} 565 do 566 log_start 567 run_cmd ping -c1 -w1 ${a} 568 log_test_addr ${a} $? 0 "ping out" 569 570 log_start 571 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 572 log_test_addr ${a} $? 0 "ping out, device bind" 573 574 log_start 575 run_cmd ping -c1 -w1 -I ${NSA_LO_IP} ${a} 576 log_test_addr ${a} $? 0 "ping out, address bind" 577 done 578 579 # 580 # out, but don't use gateway if peer is not on link 581 # 582 a=${NSB_IP} 583 log_start 584 run_cmd ping -c 1 -w 1 -r ${a} 585 log_test_addr ${a} $? 0 "ping out (don't route), peer on link" 586 587 a=${NSB_LO_IP} 588 log_start 589 show_hint "Fails since peer is not on link" 590 run_cmd ping -c 1 -w 1 -r ${a} 591 log_test_addr ${a} $? 1 "ping out (don't route), peer not on link" 592 593 # 594 # in 595 # 596 for a in ${NSA_IP} ${NSA_LO_IP} 597 do 598 log_start 599 run_cmd_nsb ping -c1 -w1 ${a} 600 log_test_addr ${a} $? 0 "ping in" 601 done 602 603 # 604 # local traffic 605 # 606 for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1 607 do 608 log_start 609 run_cmd ping -c1 -w1 ${a} 610 log_test_addr ${a} $? 0 "ping local" 611 done 612 613 # 614 # local traffic, socket bound to device 615 # 616 # address on device 617 a=${NSA_IP} 618 log_start 619 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 620 log_test_addr ${a} $? 0 "ping local, device bind" 621 622 # loopback addresses not reachable from device bind 623 # fails in a really weird way though because ipv4 special cases 624 # route lookups with oif set. 625 for a in ${NSA_LO_IP} 127.0.0.1 626 do 627 log_start 628 show_hint "Fails since address on loopback device is out of device scope" 629 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 630 log_test_addr ${a} $? 1 "ping local, device bind" 631 done 632 633 # 634 # ip rule blocks reachability to remote address 635 # 636 log_start 637 setup_cmd ip rule add pref 32765 from all lookup local 638 setup_cmd ip rule del pref 0 from all lookup local 639 setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit 640 setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit 641 642 a=${NSB_LO_IP} 643 run_cmd ping -c1 -w1 ${a} 644 log_test_addr ${a} $? 2 "ping out, blocked by rule" 645 646 # NOTE: ipv4 actually allows the lookup to fail and yet still create 647 # a viable rtable if the oif (e.g., bind to device) is set, so this 648 # case succeeds despite the rule 649 # run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 650 651 a=${NSA_LO_IP} 652 log_start 653 show_hint "Response generates ICMP (or arp request is ignored) due to ip rule" 654 run_cmd_nsb ping -c1 -w1 ${a} 655 log_test_addr ${a} $? 1 "ping in, blocked by rule" 656 657 [ "$VERBOSE" = "1" ] && echo 658 setup_cmd ip rule del pref 32765 from all lookup local 659 setup_cmd ip rule add pref 0 from all lookup local 660 setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit 661 setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit 662 663 # 664 # route blocks reachability to remote address 665 # 666 log_start 667 setup_cmd ip route replace unreachable ${NSB_LO_IP} 668 setup_cmd ip route replace unreachable ${NSB_IP} 669 670 a=${NSB_LO_IP} 671 run_cmd ping -c1 -w1 ${a} 672 log_test_addr ${a} $? 2 "ping out, blocked by route" 673 674 # NOTE: ipv4 actually allows the lookup to fail and yet still create 675 # a viable rtable if the oif (e.g., bind to device) is set, so this 676 # case succeeds despite not having a route for the address 677 # run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 678 679 a=${NSA_LO_IP} 680 log_start 681 show_hint "Response is dropped (or arp request is ignored) due to ip route" 682 run_cmd_nsb ping -c1 -w1 ${a} 683 log_test_addr ${a} $? 1 "ping in, blocked by route" 684 685 # 686 # remove 'remote' routes; fallback to default 687 # 688 log_start 689 setup_cmd ip ro del ${NSB_LO_IP} 690 691 a=${NSB_LO_IP} 692 run_cmd ping -c1 -w1 ${a} 693 log_test_addr ${a} $? 2 "ping out, unreachable default route" 694 695 # NOTE: ipv4 actually allows the lookup to fail and yet still create 696 # a viable rtable if the oif (e.g., bind to device) is set, so this 697 # case succeeds despite not having a route for the address 698 # run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 699} 700 701ipv4_ping_vrf() 702{ 703 local a 704 705 # should default on; does not exist on older kernels 706 set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null 707 708 # 709 # out 710 # 711 for a in ${NSB_IP} ${NSB_LO_IP} 712 do 713 log_start 714 run_cmd ping -c1 -w1 -I ${VRF} ${a} 715 log_test_addr ${a} $? 0 "ping out, VRF bind" 716 717 log_start 718 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 719 log_test_addr ${a} $? 0 "ping out, device bind" 720 721 log_start 722 run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${NSA_IP} ${a} 723 log_test_addr ${a} $? 0 "ping out, vrf device + dev address bind" 724 725 log_start 726 run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${VRF_IP} ${a} 727 log_test_addr ${a} $? 0 "ping out, vrf device + vrf address bind" 728 done 729 730 # 731 # in 732 # 733 for a in ${NSA_IP} ${VRF_IP} 734 do 735 log_start 736 run_cmd_nsb ping -c1 -w1 ${a} 737 log_test_addr ${a} $? 0 "ping in" 738 done 739 740 # 741 # local traffic, local address 742 # 743 for a in ${NSA_IP} ${VRF_IP} 127.0.0.1 744 do 745 log_start 746 show_hint "Source address should be ${a}" 747 run_cmd ping -c1 -w1 -I ${VRF} ${a} 748 log_test_addr ${a} $? 0 "ping local, VRF bind" 749 done 750 751 # 752 # local traffic, socket bound to device 753 # 754 # address on device 755 a=${NSA_IP} 756 log_start 757 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 758 log_test_addr ${a} $? 0 "ping local, device bind" 759 760 # vrf device is out of scope 761 for a in ${VRF_IP} 127.0.0.1 762 do 763 log_start 764 show_hint "Fails since address on vrf device is out of device scope" 765 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 766 log_test_addr ${a} $? 2 "ping local, device bind" 767 done 768 769 # 770 # ip rule blocks address 771 # 772 log_start 773 setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit 774 setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit 775 776 a=${NSB_LO_IP} 777 run_cmd ping -c1 -w1 -I ${VRF} ${a} 778 log_test_addr ${a} $? 2 "ping out, vrf bind, blocked by rule" 779 780 log_start 781 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 782 log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule" 783 784 a=${NSA_LO_IP} 785 log_start 786 show_hint "Response lost due to ip rule" 787 run_cmd_nsb ping -c1 -w1 ${a} 788 log_test_addr ${a} $? 1 "ping in, blocked by rule" 789 790 [ "$VERBOSE" = "1" ] && echo 791 setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit 792 setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit 793 794 # 795 # remove 'remote' routes; fallback to default 796 # 797 log_start 798 setup_cmd ip ro del vrf ${VRF} ${NSB_LO_IP} 799 800 a=${NSB_LO_IP} 801 run_cmd ping -c1 -w1 -I ${VRF} ${a} 802 log_test_addr ${a} $? 2 "ping out, vrf bind, unreachable route" 803 804 log_start 805 run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a} 806 log_test_addr ${a} $? 2 "ping out, device bind, unreachable route" 807 808 a=${NSA_LO_IP} 809 log_start 810 show_hint "Response lost by unreachable route" 811 run_cmd_nsb ping -c1 -w1 ${a} 812 log_test_addr ${a} $? 1 "ping in, unreachable route" 813} 814 815ipv4_ping() 816{ 817 log_section "IPv4 ping" 818 819 log_subsection "No VRF" 820 setup 821 set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null 822 ipv4_ping_novrf 823 setup 824 set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null 825 ipv4_ping_novrf 826 setup 827 set_ping_group 828 ipv4_ping_novrf 829 830 log_subsection "With VRF" 831 setup "yes" 832 ipv4_ping_vrf 833 setup "yes" 834 set_ping_group 835 ipv4_ping_vrf 836} 837 838################################################################################ 839# IPv4 TCP 840 841# 842# MD5 tests without VRF 843# 844ipv4_tcp_md5_novrf() 845{ 846 # 847 # single address 848 # 849 850 # basic use case 851 log_start 852 run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} & 853 wait_local_port_listen ${NSA} 12345 tcp 854 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 855 log_test $? 0 "MD5: Single address config" 856 857 # client sends MD5, server not configured 858 log_start 859 show_hint "Should timeout due to MD5 mismatch" 860 run_cmd nettest -s & 861 wait_local_port_listen ${NSA} 12345 tcp 862 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 863 log_test $? 2 "MD5: Server no config, client uses password" 864 865 # wrong password 866 log_start 867 show_hint "Should timeout since client uses wrong password" 868 run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} & 869 wait_local_port_listen ${NSA} 12345 tcp 870 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 871 log_test $? 2 "MD5: Client uses wrong password" 872 873 # client from different address 874 log_start 875 show_hint "Should timeout due to MD5 mismatch" 876 run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} & 877 wait_local_port_listen ${NSA} 12345 tcp 878 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 879 log_test $? 2 "MD5: Client address does not match address configured with password" 880 881 # 882 # MD5 extension - prefix length 883 # 884 885 # client in prefix 886 log_start 887 run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & 888 wait_local_port_listen ${NSA} 12345 tcp 889 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 890 log_test $? 0 "MD5: Prefix config" 891 892 # client in prefix, wrong password 893 log_start 894 show_hint "Should timeout since client uses wrong password" 895 run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & 896 wait_local_port_listen ${NSA} 12345 tcp 897 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 898 log_test $? 2 "MD5: Prefix config, client uses wrong password" 899 900 # client outside of prefix 901 log_start 902 show_hint "Should timeout due to MD5 mismatch" 903 run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & 904 wait_local_port_listen ${NSA} 12345 tcp 905 run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW} 906 log_test $? 2 "MD5: Prefix config, client address not in configured prefix" 907} 908 909# 910# MD5 tests with VRF 911# 912ipv4_tcp_md5() 913{ 914 # 915 # single address 916 # 917 918 # basic use case 919 log_start 920 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & 921 wait_local_port_listen ${NSA} 12345 tcp 922 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 923 log_test $? 0 "MD5: VRF: Single address config" 924 925 # client sends MD5, server not configured 926 log_start 927 show_hint "Should timeout since server does not have MD5 auth" 928 run_cmd nettest -s -I ${VRF} & 929 wait_local_port_listen ${NSA} 12345 tcp 930 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 931 log_test $? 2 "MD5: VRF: Server no config, client uses password" 932 933 # wrong password 934 log_start 935 show_hint "Should timeout since client uses wrong password" 936 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & 937 wait_local_port_listen ${NSA} 12345 tcp 938 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 939 log_test $? 2 "MD5: VRF: Client uses wrong password" 940 941 # client from different address 942 log_start 943 show_hint "Should timeout since server config differs from client" 944 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} & 945 wait_local_port_listen ${NSA} 12345 tcp 946 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 947 log_test $? 2 "MD5: VRF: Client address does not match address configured with password" 948 949 # 950 # MD5 extension - prefix length 951 # 952 953 # client in prefix 954 log_start 955 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & 956 wait_local_port_listen ${NSA} 12345 tcp 957 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 958 log_test $? 0 "MD5: VRF: Prefix config" 959 960 # client in prefix, wrong password 961 log_start 962 show_hint "Should timeout since client uses wrong password" 963 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & 964 wait_local_port_listen ${NSA} 12345 tcp 965 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 966 log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password" 967 968 # client outside of prefix 969 log_start 970 show_hint "Should timeout since client address is outside of prefix" 971 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & 972 wait_local_port_listen ${NSA} 12345 tcp 973 run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW} 974 log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix" 975 976 # 977 # duplicate config between default VRF and a VRF 978 # 979 980 log_start 981 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & 982 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & 983 wait_local_port_listen ${NSA} 12345 tcp 984 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 985 log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF" 986 987 log_start 988 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & 989 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & 990 wait_local_port_listen ${NSA} 12345 tcp 991 run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 992 log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF" 993 994 log_start 995 show_hint "Should timeout since client in default VRF uses VRF password" 996 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & 997 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & 998 wait_local_port_listen ${NSA} 12345 tcp 999 run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} 1000 log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw" 1001 1002 log_start 1003 show_hint "Should timeout since client in VRF uses default VRF password" 1004 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & 1005 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & 1006 wait_local_port_listen ${NSA} 12345 tcp 1007 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 1008 log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw" 1009 1010 log_start 1011 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & 1012 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & 1013 wait_local_port_listen ${NSA} 12345 tcp 1014 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 1015 log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF" 1016 1017 log_start 1018 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & 1019 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & 1020 wait_local_port_listen ${NSA} 12345 tcp 1021 run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 1022 log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF" 1023 1024 log_start 1025 show_hint "Should timeout since client in default VRF uses VRF password" 1026 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & 1027 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & 1028 wait_local_port_listen ${NSA} 12345 tcp 1029 run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} 1030 log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw" 1031 1032 log_start 1033 show_hint "Should timeout since client in VRF uses default VRF password" 1034 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & 1035 run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & 1036 wait_local_port_listen ${NSA} 12345 tcp 1037 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} 1038 log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw" 1039 1040 # 1041 # negative tests 1042 # 1043 log_start 1044 run_cmd nettest -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NSB_IP} 1045 log_test $? 1 "MD5: VRF: Device must be a VRF - single address" 1046 1047 log_start 1048 run_cmd nettest -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NS_NET} 1049 log_test $? 1 "MD5: VRF: Device must be a VRF - prefix" 1050 1051 test_ipv4_md5_vrf__vrf_server__no_bind_ifindex 1052 test_ipv4_md5_vrf__global_server__bind_ifindex0 1053} 1054 1055test_ipv4_md5_vrf__vrf_server__no_bind_ifindex() 1056{ 1057 log_start 1058 show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX" 1059 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & 1060 wait_local_port_listen ${NSA} 12345 tcp 1061 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 1062 log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection" 1063 1064 log_start 1065 show_hint "Binding both the socket and the key is not required but it works" 1066 run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & 1067 wait_local_port_listen ${NSA} 12345 tcp 1068 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 1069 log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection" 1070} 1071 1072test_ipv4_md5_vrf__global_server__bind_ifindex0() 1073{ 1074 # This particular test needs tcp_l3mdev_accept=1 for Global server to accept VRF connections 1075 local old_tcp_l3mdev_accept 1076 old_tcp_l3mdev_accept=$(get_sysctl net.ipv4.tcp_l3mdev_accept) 1077 set_sysctl net.ipv4.tcp_l3mdev_accept=1 1078 1079 log_start 1080 run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & 1081 wait_local_port_listen ${NSA} 12345 tcp 1082 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 1083 log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection" 1084 1085 log_start 1086 run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & 1087 wait_local_port_listen ${NSA} 12345 tcp 1088 run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} 1089 log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection" 1090 log_start 1091 1092 run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & 1093 wait_local_port_listen ${NSA} 12345 tcp 1094 run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} 1095 log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection" 1096 1097 log_start 1098 run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & 1099 wait_local_port_listen ${NSA} 12345 tcp 1100 run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} 1101 log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection" 1102 1103 # restore value 1104 set_sysctl net.ipv4.tcp_l3mdev_accept="$old_tcp_l3mdev_accept" 1105} 1106 1107ipv4_tcp_dontroute() 1108{ 1109 local syncookies=$1 1110 local nsa_syncookies 1111 local nsb_syncookies 1112 local a 1113 1114 # 1115 # Link local connection tests (SO_DONTROUTE). 1116 # Connections should succeed only when the remote IP address is 1117 # on link (doesn't need to be routed through a gateway). 1118 # 1119 1120 nsa_syncookies=$(ip netns exec "${NSA}" sysctl -n net.ipv4.tcp_syncookies) 1121 nsb_syncookies=$(ip netns exec "${NSB}" sysctl -n net.ipv4.tcp_syncookies) 1122 ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} 1123 ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} 1124 1125 # Test with eth1 address (on link). 1126 1127 a=${NSB_IP} 1128 log_start 1129 do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -r ${a} --client-dontroute 1130 log_test_addr ${a} $? 0 "SO_DONTROUTE client, syncookies=${syncookies}" 1131 1132 a=${NSB_IP} 1133 log_start 1134 do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -r ${a} --server-dontroute 1135 log_test_addr ${a} $? 0 "SO_DONTROUTE server, syncookies=${syncookies}" 1136 1137 # Test with loopback address (routed). 1138 # 1139 # The client would use the eth1 address as source IP by default. 1140 # Therefore, we need to use the -c option here, to force the use of the 1141 # routed (loopback) address as source IP (so that the server will try 1142 # to respond to a routed address and not a link local one). 1143 1144 a=${NSB_LO_IP} 1145 log_start 1146 show_hint "Should fail 'Network is unreachable' since server is not on link" 1147 do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -c "${NSA_LO_IP}" -r ${a} --client-dontroute 1148 log_test_addr ${a} $? 1 "SO_DONTROUTE client, syncookies=${syncookies}" 1149 1150 a=${NSB_LO_IP} 1151 log_start 1152 show_hint "Should timeout since server cannot respond (client is not on link)" 1153 do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -c "${NSA_LO_IP}" -r ${a} --server-dontroute 1154 log_test_addr ${a} $? 2 "SO_DONTROUTE server, syncookies=${syncookies}" 1155 1156 ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${nsb_syncookies} 1157 ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${nsa_syncookies} 1158} 1159 1160ipv4_tcp_novrf() 1161{ 1162 local a 1163 1164 # 1165 # server tests 1166 # 1167 for a in ${NSA_IP} ${NSA_LO_IP} 1168 do 1169 log_start 1170 run_cmd nettest -s & 1171 wait_local_port_listen ${NSA} 12345 tcp 1172 run_cmd_nsb nettest -r ${a} 1173 log_test_addr ${a} $? 0 "Global server" 1174 done 1175 1176 a=${NSA_IP} 1177 log_start 1178 run_cmd nettest -s -I ${NSA_DEV} & 1179 wait_local_port_listen ${NSA} 12345 tcp 1180 run_cmd_nsb nettest -r ${a} 1181 log_test_addr ${a} $? 0 "Device server" 1182 1183 # verify TCP reset sent and received 1184 for a in ${NSA_IP} ${NSA_LO_IP} 1185 do 1186 log_start 1187 show_hint "Should fail 'Connection refused' since there is no server" 1188 run_cmd_nsb nettest -r ${a} 1189 log_test_addr ${a} $? 1 "No server" 1190 done 1191 1192 # 1193 # client 1194 # 1195 for a in ${NSB_IP} ${NSB_LO_IP} 1196 do 1197 log_start 1198 run_cmd_nsb nettest -s & 1199 wait_local_port_listen ${NSB} 12345 tcp 1200 run_cmd nettest -r ${a} -0 ${NSA_IP} 1201 log_test_addr ${a} $? 0 "Client" 1202 1203 log_start 1204 run_cmd_nsb nettest -s & 1205 wait_local_port_listen ${NSB} 12345 tcp 1206 run_cmd nettest -r ${a} -d ${NSA_DEV} 1207 log_test_addr ${a} $? 0 "Client, device bind" 1208 1209 log_start 1210 show_hint "Should fail 'Connection refused'" 1211 run_cmd nettest -r ${a} 1212 log_test_addr ${a} $? 1 "No server, unbound client" 1213 1214 log_start 1215 show_hint "Should fail 'Connection refused'" 1216 run_cmd nettest -r ${a} -d ${NSA_DEV} 1217 log_test_addr ${a} $? 1 "No server, device client" 1218 done 1219 1220 # 1221 # local address tests 1222 # 1223 for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1 1224 do 1225 log_start 1226 run_cmd nettest -s & 1227 wait_local_port_listen ${NSA} 12345 tcp 1228 run_cmd nettest -r ${a} -0 ${a} -1 ${a} 1229 log_test_addr ${a} $? 0 "Global server, local connection" 1230 done 1231 1232 a=${NSA_IP} 1233 log_start 1234 run_cmd nettest -s -I ${NSA_DEV} & 1235 wait_local_port_listen ${NSA} 12345 tcp 1236 run_cmd nettest -r ${a} -0 ${a} 1237 log_test_addr ${a} $? 0 "Device server, unbound client, local connection" 1238 1239 for a in ${NSA_LO_IP} 127.0.0.1 1240 do 1241 log_start 1242 show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" 1243 run_cmd nettest -s -I ${NSA_DEV} & 1244 wait_local_port_listen ${NSA} 12345 tcp 1245 run_cmd nettest -r ${a} 1246 log_test_addr ${a} $? 1 "Device server, unbound client, local connection" 1247 done 1248 1249 a=${NSA_IP} 1250 log_start 1251 run_cmd nettest -s & 1252 wait_local_port_listen ${NSA} 12345 tcp 1253 run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV} 1254 log_test_addr ${a} $? 0 "Global server, device client, local connection" 1255 1256 for a in ${NSA_LO_IP} 127.0.0.1 1257 do 1258 log_start 1259 show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" 1260 run_cmd nettest -s & 1261 wait_local_port_listen ${NSA} 12345 tcp 1262 run_cmd nettest -r ${a} -d ${NSA_DEV} 1263 log_test_addr ${a} $? 1 "Global server, device client, local connection" 1264 done 1265 1266 a=${NSA_IP} 1267 log_start 1268 run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & 1269 wait_local_port_listen ${NSA} 12345 tcp 1270 run_cmd nettest -d ${NSA_DEV} -r ${a} -0 ${a} 1271 log_test_addr ${a} $? 0 "Device server, device client, local connection" 1272 1273 log_start 1274 show_hint "Should fail 'Connection refused'" 1275 run_cmd nettest -d ${NSA_DEV} -r ${a} 1276 log_test_addr ${a} $? 1 "No server, device client, local conn" 1277 1278 [ "$fips_enabled" = "1" ] || ipv4_tcp_md5_novrf 1279 1280 ipv4_tcp_dontroute 0 1281 ipv4_tcp_dontroute 2 1282} 1283 1284ipv4_tcp_vrf() 1285{ 1286 local a 1287 1288 # disable global server 1289 log_subsection "Global server disabled" 1290 1291 set_sysctl net.ipv4.tcp_l3mdev_accept=0 1292 1293 # 1294 # server tests 1295 # 1296 for a in ${NSA_IP} ${VRF_IP} 1297 do 1298 log_start 1299 show_hint "Should fail 'Connection refused' since global server with VRF is disabled" 1300 run_cmd nettest -s & 1301 wait_local_port_listen ${NSA} 12345 tcp 1302 run_cmd_nsb nettest -r ${a} 1303 log_test_addr ${a} $? 1 "Global server" 1304 1305 log_start 1306 run_cmd nettest -s -I ${VRF} -3 ${VRF} & 1307 wait_local_port_listen ${NSA} 12345 tcp 1308 run_cmd_nsb nettest -r ${a} 1309 log_test_addr ${a} $? 0 "VRF server" 1310 1311 log_start 1312 run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & 1313 wait_local_port_listen ${NSA} 12345 tcp 1314 run_cmd_nsb nettest -r ${a} 1315 log_test_addr ${a} $? 0 "Device server" 1316 1317 # verify TCP reset received 1318 log_start 1319 show_hint "Should fail 'Connection refused' since there is no server" 1320 run_cmd_nsb nettest -r ${a} 1321 log_test_addr ${a} $? 1 "No server" 1322 done 1323 1324 # local address tests 1325 # (${VRF_IP} and 127.0.0.1 both timeout) 1326 a=${NSA_IP} 1327 log_start 1328 show_hint "Should fail 'Connection refused' since global server with VRF is disabled" 1329 run_cmd nettest -s & 1330 wait_local_port_listen ${NSA} 12345 tcp 1331 run_cmd nettest -r ${a} -d ${NSA_DEV} 1332 log_test_addr ${a} $? 1 "Global server, local connection" 1333 1334 # run MD5 tests 1335 if [ "$fips_enabled" = "0" ]; then 1336 setup_vrf_dup 1337 ipv4_tcp_md5 1338 cleanup_vrf_dup 1339 fi 1340 1341 # 1342 # enable VRF global server 1343 # 1344 log_subsection "VRF Global server enabled" 1345 set_sysctl net.ipv4.tcp_l3mdev_accept=1 1346 1347 for a in ${NSA_IP} ${VRF_IP} 1348 do 1349 log_start 1350 show_hint "client socket should be bound to VRF" 1351 run_cmd nettest -s -3 ${VRF} & 1352 wait_local_port_listen ${NSA} 12345 tcp 1353 run_cmd_nsb nettest -r ${a} 1354 log_test_addr ${a} $? 0 "Global server" 1355 1356 log_start 1357 show_hint "client socket should be bound to VRF" 1358 run_cmd nettest -s -I ${VRF} -3 ${VRF} & 1359 wait_local_port_listen ${NSA} 12345 tcp 1360 run_cmd_nsb nettest -r ${a} 1361 log_test_addr ${a} $? 0 "VRF server" 1362 1363 # verify TCP reset received 1364 log_start 1365 show_hint "Should fail 'Connection refused'" 1366 run_cmd_nsb nettest -r ${a} 1367 log_test_addr ${a} $? 1 "No server" 1368 done 1369 1370 a=${NSA_IP} 1371 log_start 1372 show_hint "client socket should be bound to device" 1373 run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & 1374 wait_local_port_listen ${NSA} 12345 tcp 1375 run_cmd_nsb nettest -r ${a} 1376 log_test_addr ${a} $? 0 "Device server" 1377 1378 # local address tests 1379 for a in ${NSA_IP} ${VRF_IP} 1380 do 1381 log_start 1382 show_hint "Should fail 'Connection refused' since client is not bound to VRF" 1383 run_cmd nettest -s -I ${VRF} & 1384 wait_local_port_listen ${NSA} 12345 tcp 1385 run_cmd nettest -r ${a} 1386 log_test_addr ${a} $? 1 "Global server, local connection" 1387 done 1388 1389 # 1390 # client 1391 # 1392 for a in ${NSB_IP} ${NSB_LO_IP} 1393 do 1394 log_start 1395 run_cmd_nsb nettest -s & 1396 wait_local_port_listen ${NSB} 12345 tcp 1397 run_cmd nettest -r ${a} -d ${VRF} 1398 log_test_addr ${a} $? 0 "Client, VRF bind" 1399 1400 log_start 1401 run_cmd_nsb nettest -s & 1402 wait_local_port_listen ${NSB} 12345 tcp 1403 run_cmd nettest -r ${a} -d ${NSA_DEV} 1404 log_test_addr ${a} $? 0 "Client, device bind" 1405 1406 log_start 1407 show_hint "Should fail 'Connection refused'" 1408 run_cmd nettest -r ${a} -d ${VRF} 1409 log_test_addr ${a} $? 1 "No server, VRF client" 1410 1411 log_start 1412 show_hint "Should fail 'Connection refused'" 1413 run_cmd nettest -r ${a} -d ${NSA_DEV} 1414 log_test_addr ${a} $? 1 "No server, device client" 1415 done 1416 1417 for a in ${NSA_IP} ${VRF_IP} 127.0.0.1 1418 do 1419 log_start 1420 run_cmd nettest -s -I ${VRF} -3 ${VRF} & 1421 wait_local_port_listen ${NSA} 12345 tcp 1422 run_cmd nettest -r ${a} -d ${VRF} -0 ${a} 1423 log_test_addr ${a} $? 0 "VRF server, VRF client, local connection" 1424 done 1425 1426 a=${NSA_IP} 1427 log_start 1428 run_cmd nettest -s -I ${VRF} -3 ${VRF} & 1429 wait_local_port_listen ${NSA} 12345 tcp 1430 run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a} 1431 log_test_addr ${a} $? 0 "VRF server, device client, local connection" 1432 1433 log_start 1434 show_hint "Should fail 'No route to host' since client is out of VRF scope" 1435 run_cmd nettest -s -I ${VRF} & 1436 wait_local_port_listen ${NSA} 12345 tcp 1437 run_cmd nettest -r ${a} 1438 log_test_addr ${a} $? 1 "VRF server, unbound client, local connection" 1439 1440 log_start 1441 run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & 1442 wait_local_port_listen ${NSA} 12345 tcp 1443 run_cmd nettest -r ${a} -d ${VRF} -0 ${a} 1444 log_test_addr ${a} $? 0 "Device server, VRF client, local connection" 1445 1446 log_start 1447 run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & 1448 wait_local_port_listen ${NSA} 12345 tcp 1449 run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a} 1450 log_test_addr ${a} $? 0 "Device server, device client, local connection" 1451} 1452 1453ipv4_tcp() 1454{ 1455 log_section "IPv4/TCP" 1456 log_subsection "No VRF" 1457 setup 1458 1459 # tcp_l3mdev_accept should have no affect without VRF; 1460 # run tests with it enabled and disabled to verify 1461 log_subsection "tcp_l3mdev_accept disabled" 1462 set_sysctl net.ipv4.tcp_l3mdev_accept=0 1463 ipv4_tcp_novrf 1464 log_subsection "tcp_l3mdev_accept enabled" 1465 set_sysctl net.ipv4.tcp_l3mdev_accept=1 1466 ipv4_tcp_novrf 1467 1468 log_subsection "With VRF" 1469 setup "yes" 1470 ipv4_tcp_vrf 1471} 1472 1473################################################################################ 1474# IPv4 UDP 1475 1476ipv4_udp_novrf() 1477{ 1478 local a 1479 1480 # 1481 # server tests 1482 # 1483 for a in ${NSA_IP} ${NSA_LO_IP} 1484 do 1485 log_start 1486 run_cmd nettest -D -s -3 ${NSA_DEV} & 1487 wait_local_port_listen ${NSA} 12345 udp 1488 run_cmd_nsb nettest -D -r ${a} 1489 log_test_addr ${a} $? 0 "Global server" 1490 1491 log_start 1492 show_hint "Should fail 'Connection refused' since there is no server" 1493 run_cmd_nsb nettest -D -r ${a} 1494 log_test_addr ${a} $? 1 "No server" 1495 done 1496 1497 a=${NSA_IP} 1498 log_start 1499 run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 1500 wait_local_port_listen ${NSA} 12345 udp 1501 run_cmd_nsb nettest -D -r ${a} 1502 log_test_addr ${a} $? 0 "Device server" 1503 1504 # 1505 # client 1506 # 1507 for a in ${NSB_IP} ${NSB_LO_IP} 1508 do 1509 log_start 1510 run_cmd_nsb nettest -D -s & 1511 wait_local_port_listen ${NSB} 12345 udp 1512 run_cmd nettest -D -r ${a} -0 ${NSA_IP} 1513 log_test_addr ${a} $? 0 "Client" 1514 1515 log_start 1516 run_cmd_nsb nettest -D -s & 1517 wait_local_port_listen ${NSB} 12345 udp 1518 run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP} 1519 log_test_addr ${a} $? 0 "Client, device bind" 1520 1521 log_start 1522 run_cmd_nsb nettest -D -s & 1523 wait_local_port_listen ${NSB} 12345 udp 1524 run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP} 1525 log_test_addr ${a} $? 0 "Client, device send via cmsg" 1526 1527 log_start 1528 run_cmd_nsb nettest -D -s & 1529 wait_local_port_listen ${NSB} 12345 udp 1530 run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} 1531 log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF" 1532 1533 log_start 1534 run_cmd_nsb nettest -D -s & 1535 wait_local_port_listen ${NSB} 12345 udp 1536 run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U 1537 log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()" 1538 1539 1540 log_start 1541 show_hint "Should fail 'Connection refused'" 1542 run_cmd nettest -D -r ${a} 1543 log_test_addr ${a} $? 1 "No server, unbound client" 1544 1545 log_start 1546 show_hint "Should fail 'Connection refused'" 1547 run_cmd nettest -D -r ${a} -d ${NSA_DEV} 1548 log_test_addr ${a} $? 1 "No server, device client" 1549 done 1550 1551 # 1552 # local address tests 1553 # 1554 for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1 1555 do 1556 log_start 1557 run_cmd nettest -D -s & 1558 wait_local_port_listen ${NSA} 12345 udp 1559 run_cmd nettest -D -r ${a} -0 ${a} -1 ${a} 1560 log_test_addr ${a} $? 0 "Global server, local connection" 1561 done 1562 1563 a=${NSA_IP} 1564 log_start 1565 run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & 1566 wait_local_port_listen ${NSA} 12345 udp 1567 run_cmd nettest -D -r ${a} 1568 log_test_addr ${a} $? 0 "Device server, unbound client, local connection" 1569 1570 for a in ${NSA_LO_IP} 127.0.0.1 1571 do 1572 log_start 1573 show_hint "Should fail 'Connection refused' since address is out of device scope" 1574 run_cmd nettest -s -D -I ${NSA_DEV} & 1575 wait_local_port_listen ${NSA} 12345 udp 1576 run_cmd nettest -D -r ${a} 1577 log_test_addr ${a} $? 1 "Device server, unbound client, local connection" 1578 done 1579 1580 a=${NSA_IP} 1581 log_start 1582 run_cmd nettest -s -D & 1583 wait_local_port_listen ${NSA} 12345 udp 1584 run_cmd nettest -D -d ${NSA_DEV} -r ${a} 1585 log_test_addr ${a} $? 0 "Global server, device client, local connection" 1586 1587 log_start 1588 run_cmd nettest -s -D & 1589 wait_local_port_listen ${NSA} 12345 udp 1590 run_cmd nettest -D -d ${NSA_DEV} -C -r ${a} 1591 log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection" 1592 1593 log_start 1594 run_cmd nettest -s -D & 1595 wait_local_port_listen ${NSA} 12345 udp 1596 run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} 1597 log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection" 1598 1599 log_start 1600 run_cmd nettest -s -D & 1601 wait_local_port_listen ${NSA} 12345 udp 1602 run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U 1603 log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" 1604 1605 1606 # IPv4 with device bind has really weird behavior - it overrides the 1607 # fib lookup, generates an rtable and tries to send the packet. This 1608 # causes failures for local traffic at different places 1609 for a in ${NSA_LO_IP} 127.0.0.1 1610 do 1611 log_start 1612 show_hint "Should fail since addresses on loopback are out of device scope" 1613 run_cmd nettest -D -s & 1614 wait_local_port_listen ${NSA} 12345 udp 1615 run_cmd nettest -D -r ${a} -d ${NSA_DEV} 1616 log_test_addr ${a} $? 2 "Global server, device client, local connection" 1617 1618 log_start 1619 show_hint "Should fail since addresses on loopback are out of device scope" 1620 run_cmd nettest -D -s & 1621 wait_local_port_listen ${NSA} 12345 udp 1622 run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C 1623 log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection" 1624 1625 log_start 1626 show_hint "Should fail since addresses on loopback are out of device scope" 1627 run_cmd nettest -D -s & 1628 wait_local_port_listen ${NSA} 12345 udp 1629 run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S 1630 log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" 1631 1632 log_start 1633 show_hint "Should fail since addresses on loopback are out of device scope" 1634 run_cmd nettest -D -s & 1635 wait_local_port_listen ${NSA} 12345 udp 1636 run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U 1637 log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" 1638 1639 1640 done 1641 1642 a=${NSA_IP} 1643 log_start 1644 run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} & 1645 wait_local_port_listen ${NSA} 12345 udp 1646 run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a} 1647 log_test_addr ${a} $? 0 "Device server, device client, local conn" 1648 1649 log_start 1650 run_cmd nettest -D -d ${NSA_DEV} -r ${a} 1651 log_test_addr ${a} $? 2 "No server, device client, local conn" 1652 1653 # 1654 # Link local connection tests (SO_DONTROUTE). 1655 # Connections should succeed only when the remote IP address is 1656 # on link (doesn't need to be routed through a gateway). 1657 # 1658 1659 a=${NSB_IP} 1660 log_start 1661 do_run_cmd nettest -B -D -N "${NSA}" -O "${NSB}" -r ${a} --client-dontroute 1662 log_test_addr ${a} $? 0 "SO_DONTROUTE client" 1663 1664 a=${NSB_LO_IP} 1665 log_start 1666 show_hint "Should fail 'Network is unreachable' since server is not on link" 1667 do_run_cmd nettest -B -D -N "${NSA}" -O "${NSB}" -r ${a} --client-dontroute 1668 log_test_addr ${a} $? 1 "SO_DONTROUTE client" 1669} 1670 1671ipv4_udp_vrf() 1672{ 1673 local a 1674 1675 # disable global server 1676 log_subsection "Global server disabled" 1677 set_sysctl net.ipv4.udp_l3mdev_accept=0 1678 1679 # 1680 # server tests 1681 # 1682 for a in ${NSA_IP} ${VRF_IP} 1683 do 1684 log_start 1685 show_hint "Fails because ingress is in a VRF and global server is disabled" 1686 run_cmd nettest -D -s & 1687 wait_local_port_listen ${NSA} 12345 udp 1688 run_cmd_nsb nettest -D -r ${a} 1689 log_test_addr ${a} $? 1 "Global server" 1690 1691 log_start 1692 run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} & 1693 wait_local_port_listen ${NSA} 12345 udp 1694 run_cmd_nsb nettest -D -r ${a} 1695 log_test_addr ${a} $? 0 "VRF server" 1696 1697 log_start 1698 run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 1699 wait_local_port_listen ${NSA} 12345 udp 1700 run_cmd_nsb nettest -D -r ${a} 1701 log_test_addr ${a} $? 0 "Enslaved device server" 1702 1703 log_start 1704 show_hint "Should fail 'Connection refused' since there is no server" 1705 run_cmd_nsb nettest -D -r ${a} 1706 log_test_addr ${a} $? 1 "No server" 1707 1708 log_start 1709 show_hint "Should fail 'Connection refused' since global server is out of scope" 1710 run_cmd nettest -D -s & 1711 wait_local_port_listen ${NSA} 12345 udp 1712 run_cmd nettest -D -d ${VRF} -r ${a} 1713 log_test_addr ${a} $? 1 "Global server, VRF client, local connection" 1714 done 1715 1716 a=${NSA_IP} 1717 log_start 1718 run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & 1719 wait_local_port_listen ${NSA} 12345 udp 1720 run_cmd nettest -D -d ${VRF} -r ${a} 1721 log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" 1722 1723 log_start 1724 run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & 1725 wait_local_port_listen ${NSA} 12345 udp 1726 run_cmd nettest -D -d ${NSA_DEV} -r ${a} 1727 log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection" 1728 1729 a=${NSA_IP} 1730 log_start 1731 run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & 1732 wait_local_port_listen ${NSA} 12345 udp 1733 run_cmd nettest -D -d ${VRF} -r ${a} 1734 log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" 1735 1736 log_start 1737 run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & 1738 wait_local_port_listen ${NSA} 12345 udp 1739 run_cmd nettest -D -d ${NSA_DEV} -r ${a} 1740 log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn" 1741 1742 # enable global server 1743 log_subsection "Global server enabled" 1744 set_sysctl net.ipv4.udp_l3mdev_accept=1 1745 1746 # 1747 # server tests 1748 # 1749 for a in ${NSA_IP} ${VRF_IP} 1750 do 1751 log_start 1752 run_cmd nettest -D -s -3 ${NSA_DEV} & 1753 wait_local_port_listen ${NSA} 12345 udp 1754 run_cmd_nsb nettest -D -r ${a} 1755 log_test_addr ${a} $? 0 "Global server" 1756 1757 log_start 1758 run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} & 1759 wait_local_port_listen ${NSA} 12345 udp 1760 run_cmd_nsb nettest -D -r ${a} 1761 log_test_addr ${a} $? 0 "VRF server" 1762 1763 log_start 1764 run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 1765 wait_local_port_listen ${NSA} 12345 udp 1766 run_cmd_nsb nettest -D -r ${a} 1767 log_test_addr ${a} $? 0 "Enslaved device server" 1768 1769 log_start 1770 show_hint "Should fail 'Connection refused'" 1771 run_cmd_nsb nettest -D -r ${a} 1772 log_test_addr ${a} $? 1 "No server" 1773 done 1774 1775 # 1776 # client tests 1777 # 1778 log_start 1779 run_cmd_nsb nettest -D -s & 1780 wait_local_port_listen ${NSB} 12345 udp 1781 run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP} 1782 log_test $? 0 "VRF client" 1783 1784 log_start 1785 run_cmd_nsb nettest -D -s & 1786 wait_local_port_listen ${NSB} 12345 udp 1787 run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP} 1788 log_test $? 0 "Enslaved device client" 1789 1790 # negative test - should fail 1791 log_start 1792 show_hint "Should fail 'Connection refused'" 1793 run_cmd nettest -D -d ${VRF} -r ${NSB_IP} 1794 log_test $? 1 "No server, VRF client" 1795 1796 log_start 1797 show_hint "Should fail 'Connection refused'" 1798 run_cmd nettest -D -d ${NSA_DEV} -r ${NSB_IP} 1799 log_test $? 1 "No server, enslaved device client" 1800 1801 # 1802 # local address tests 1803 # 1804 a=${NSA_IP} 1805 log_start 1806 run_cmd nettest -D -s -3 ${NSA_DEV} & 1807 wait_local_port_listen ${NSA} 12345 udp 1808 run_cmd nettest -D -d ${VRF} -r ${a} 1809 log_test_addr ${a} $? 0 "Global server, VRF client, local conn" 1810 1811 log_start 1812 run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & 1813 wait_local_port_listen ${NSA} 12345 udp 1814 run_cmd nettest -D -d ${VRF} -r ${a} 1815 log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" 1816 1817 log_start 1818 run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & 1819 wait_local_port_listen ${NSA} 12345 udp 1820 run_cmd nettest -D -d ${NSA_DEV} -r ${a} 1821 log_test_addr ${a} $? 0 "VRF server, device client, local conn" 1822 1823 log_start 1824 run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & 1825 wait_local_port_listen ${NSA} 12345 udp 1826 run_cmd nettest -D -d ${VRF} -r ${a} 1827 log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" 1828 1829 log_start 1830 run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & 1831 wait_local_port_listen ${NSA} 12345 udp 1832 run_cmd nettest -D -d ${NSA_DEV} -r ${a} 1833 log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn" 1834 1835 for a in ${VRF_IP} 127.0.0.1 1836 do 1837 log_start 1838 run_cmd nettest -D -s -3 ${VRF} & 1839 wait_local_port_listen ${NSA} 12345 udp 1840 run_cmd nettest -D -d ${VRF} -r ${a} 1841 log_test_addr ${a} $? 0 "Global server, VRF client, local conn" 1842 done 1843 1844 for a in ${VRF_IP} 127.0.0.1 1845 do 1846 log_start 1847 run_cmd nettest -s -D -I ${VRF} -3 ${VRF} & 1848 wait_local_port_listen ${NSA} 12345 udp 1849 run_cmd nettest -D -d ${VRF} -r ${a} 1850 log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" 1851 done 1852 1853 # negative test - should fail 1854 # verifies ECONNREFUSED 1855 for a in ${NSA_IP} ${VRF_IP} 127.0.0.1 1856 do 1857 log_start 1858 show_hint "Should fail 'Connection refused'" 1859 run_cmd nettest -D -d ${VRF} -r ${a} 1860 log_test_addr ${a} $? 1 "No server, VRF client, local conn" 1861 done 1862} 1863 1864ipv4_udp() 1865{ 1866 log_section "IPv4/UDP" 1867 log_subsection "No VRF" 1868 1869 setup 1870 1871 # udp_l3mdev_accept should have no affect without VRF; 1872 # run tests with it enabled and disabled to verify 1873 log_subsection "udp_l3mdev_accept disabled" 1874 set_sysctl net.ipv4.udp_l3mdev_accept=0 1875 ipv4_udp_novrf 1876 log_subsection "udp_l3mdev_accept enabled" 1877 set_sysctl net.ipv4.udp_l3mdev_accept=1 1878 ipv4_udp_novrf 1879 1880 log_subsection "With VRF" 1881 setup "yes" 1882 ipv4_udp_vrf 1883} 1884 1885################################################################################ 1886# IPv4 address bind 1887# 1888# verifies ability or inability to bind to an address / device 1889 1890ipv4_addr_bind_novrf() 1891{ 1892 # 1893 # raw socket 1894 # 1895 for a in ${NSA_IP} ${NSA_LO_IP} 1896 do 1897 log_start 1898 run_cmd nettest -s -R -P icmp -l ${a} -b 1899 log_test_addr ${a} $? 0 "Raw socket bind to local address" 1900 1901 log_start 1902 run_cmd nettest -s -R -P icmp -l ${a} -I ${NSA_DEV} -b 1903 log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind" 1904 done 1905 1906 # 1907 # tests for nonlocal bind 1908 # 1909 a=${NL_IP} 1910 log_start 1911 run_cmd nettest -s -R -f -l ${a} -b 1912 log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address" 1913 1914 log_start 1915 run_cmd nettest -s -f -l ${a} -b 1916 log_test_addr ${a} $? 0 "TCP socket bind to nonlocal address" 1917 1918 log_start 1919 run_cmd nettest -s -D -P icmp -f -l ${a} -b 1920 log_test_addr ${a} $? 0 "ICMP socket bind to nonlocal address" 1921 1922 # 1923 # check that ICMP sockets cannot bind to broadcast and multicast addresses 1924 # 1925 a=${BCAST_IP} 1926 log_start 1927 run_cmd nettest -s -D -P icmp -l ${a} -b 1928 log_test_addr ${a} $? 1 "ICMP socket bind to broadcast address" 1929 1930 a=${MCAST_IP} 1931 log_start 1932 run_cmd nettest -s -D -P icmp -l ${a} -b 1933 log_test_addr ${a} $? 1 "ICMP socket bind to multicast address" 1934 1935 # 1936 # tcp sockets 1937 # 1938 a=${NSA_IP} 1939 log_start 1940 run_cmd nettest -c ${a} -r ${NSB_IP} -t1 -b 1941 log_test_addr ${a} $? 0 "TCP socket bind to local address" 1942 1943 log_start 1944 run_cmd nettest -c ${a} -r ${NSB_IP} -d ${NSA_DEV} -t1 -b 1945 log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind" 1946 1947 # Sadly, the kernel allows binding a socket to a device and then 1948 # binding to an address not on the device. The only restriction 1949 # is that the address is valid in the L3 domain. So this test 1950 # passes when it really should not 1951 #a=${NSA_LO_IP} 1952 #log_start 1953 #show_hint "Should fail with 'Cannot assign requested address'" 1954 #run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b 1955 #log_test_addr ${a} $? 1 "TCP socket bind to out of scope local address" 1956} 1957 1958ipv4_addr_bind_vrf() 1959{ 1960 # 1961 # raw socket 1962 # 1963 for a in ${NSA_IP} ${VRF_IP} 1964 do 1965 log_start 1966 show_hint "Socket not bound to VRF, but address is in VRF" 1967 run_cmd nettest -s -R -P icmp -l ${a} -b 1968 log_test_addr ${a} $? 1 "Raw socket bind to local address" 1969 1970 log_start 1971 run_cmd nettest -s -R -P icmp -l ${a} -I ${NSA_DEV} -b 1972 log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind" 1973 log_start 1974 run_cmd nettest -s -R -P icmp -l ${a} -I ${VRF} -b 1975 log_test_addr ${a} $? 0 "Raw socket bind to local address after VRF bind" 1976 done 1977 1978 a=${NSA_LO_IP} 1979 log_start 1980 show_hint "Address on loopback is out of VRF scope" 1981 run_cmd nettest -s -R -P icmp -l ${a} -I ${VRF} -b 1982 log_test_addr ${a} $? 1 "Raw socket bind to out of scope address after VRF bind" 1983 1984 # 1985 # tests for nonlocal bind 1986 # 1987 a=${NL_IP} 1988 log_start 1989 run_cmd nettest -s -R -f -l ${a} -I ${VRF} -b 1990 log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address after VRF bind" 1991 1992 log_start 1993 run_cmd nettest -s -f -l ${a} -I ${VRF} -b 1994 log_test_addr ${a} $? 0 "TCP socket bind to nonlocal address after VRF bind" 1995 1996 log_start 1997 run_cmd nettest -s -D -P icmp -f -l ${a} -I ${VRF} -b 1998 log_test_addr ${a} $? 0 "ICMP socket bind to nonlocal address after VRF bind" 1999 2000 # 2001 # check that ICMP sockets cannot bind to broadcast and multicast addresses 2002 # 2003 a=${BCAST_IP} 2004 log_start 2005 run_cmd nettest -s -D -P icmp -l ${a} -I ${VRF} -b 2006 log_test_addr ${a} $? 1 "ICMP socket bind to broadcast address after VRF bind" 2007 2008 a=${MCAST_IP} 2009 log_start 2010 run_cmd nettest -s -D -P icmp -l ${a} -I ${VRF} -b 2011 log_test_addr ${a} $? 1 "ICMP socket bind to multicast address after VRF bind" 2012 2013 # 2014 # tcp sockets 2015 # 2016 for a in ${NSA_IP} ${VRF_IP} 2017 do 2018 log_start 2019 run_cmd nettest -s -l ${a} -I ${VRF} -t1 -b 2020 log_test_addr ${a} $? 0 "TCP socket bind to local address" 2021 2022 log_start 2023 run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b 2024 log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind" 2025 done 2026 2027 a=${NSA_LO_IP} 2028 log_start 2029 show_hint "Address on loopback out of scope for VRF" 2030 run_cmd nettest -s -l ${a} -I ${VRF} -t1 -b 2031 log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for VRF" 2032 2033 log_start 2034 show_hint "Address on loopback out of scope for device in VRF" 2035 run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b 2036 log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for device bind" 2037} 2038 2039ipv4_addr_bind() 2040{ 2041 log_section "IPv4 address binds" 2042 2043 log_subsection "No VRF" 2044 setup 2045 set_ping_group 2046 ipv4_addr_bind_novrf 2047 2048 log_subsection "With VRF" 2049 setup "yes" 2050 set_ping_group 2051 ipv4_addr_bind_vrf 2052} 2053 2054################################################################################ 2055# IPv4 runtime tests 2056 2057ipv4_rt() 2058{ 2059 local desc="$1" 2060 local varg="$2" 2061 local with_vrf="yes" 2062 local a 2063 2064 # 2065 # server tests 2066 # 2067 for a in ${NSA_IP} ${VRF_IP} 2068 do 2069 log_start 2070 run_cmd nettest ${varg} -s & 2071 wait_local_port_listen ${NSA} 12345 tcp 2072 run_cmd_nsb nettest ${varg} -r ${a} & 2073 sleep 3 2074 run_cmd ip link del ${VRF} 2075 sleep 1 2076 log_test_addr ${a} 0 0 "${desc}, global server" 2077 2078 setup ${with_vrf} 2079 done 2080 2081 for a in ${NSA_IP} ${VRF_IP} 2082 do 2083 log_start 2084 run_cmd nettest ${varg} -s -I ${VRF} & 2085 wait_local_port_listen ${NSA} 12345 tcp 2086 run_cmd_nsb nettest ${varg} -r ${a} & 2087 sleep 3 2088 run_cmd ip link del ${VRF} 2089 sleep 1 2090 log_test_addr ${a} 0 0 "${desc}, VRF server" 2091 2092 setup ${with_vrf} 2093 done 2094 2095 a=${NSA_IP} 2096 log_start 2097 run_cmd nettest ${varg} -s -I ${NSA_DEV} & 2098 wait_local_port_listen ${NSA} 12345 tcp 2099 run_cmd_nsb nettest ${varg} -r ${a} & 2100 sleep 3 2101 run_cmd ip link del ${VRF} 2102 sleep 1 2103 log_test_addr ${a} 0 0 "${desc}, enslaved device server" 2104 2105 setup ${with_vrf} 2106 2107 # 2108 # client test 2109 # 2110 log_start 2111 run_cmd_nsb nettest ${varg} -s & 2112 wait_local_port_listen ${NSB} 12345 tcp 2113 run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} & 2114 sleep 3 2115 run_cmd ip link del ${VRF} 2116 sleep 1 2117 log_test_addr ${a} 0 0 "${desc}, VRF client" 2118 2119 setup ${with_vrf} 2120 2121 log_start 2122 run_cmd_nsb nettest ${varg} -s & 2123 wait_local_port_listen ${NSB} 12345 tcp 2124 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} & 2125 sleep 3 2126 run_cmd ip link del ${VRF} 2127 sleep 1 2128 log_test_addr ${a} 0 0 "${desc}, enslaved device client" 2129 2130 setup ${with_vrf} 2131 2132 # 2133 # local address tests 2134 # 2135 for a in ${NSA_IP} ${VRF_IP} 2136 do 2137 log_start 2138 run_cmd nettest ${varg} -s & 2139 wait_local_port_listen ${NSA} 12345 tcp 2140 run_cmd nettest ${varg} -d ${VRF} -r ${a} & 2141 sleep 3 2142 run_cmd ip link del ${VRF} 2143 sleep 1 2144 log_test_addr ${a} 0 0 "${desc}, global server, VRF client, local" 2145 2146 setup ${with_vrf} 2147 done 2148 2149 for a in ${NSA_IP} ${VRF_IP} 2150 do 2151 log_start 2152 run_cmd nettest ${varg} -I ${VRF} -s & 2153 wait_local_port_listen ${NSA} 12345 tcp 2154 run_cmd nettest ${varg} -d ${VRF} -r ${a} & 2155 sleep 3 2156 run_cmd ip link del ${VRF} 2157 sleep 1 2158 log_test_addr ${a} 0 0 "${desc}, VRF server and client, local" 2159 2160 setup ${with_vrf} 2161 done 2162 2163 a=${NSA_IP} 2164 log_start 2165 2166 run_cmd nettest ${varg} -s & 2167 wait_local_port_listen ${NSA} 12345 tcp 2168 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & 2169 sleep 3 2170 run_cmd ip link del ${VRF} 2171 sleep 1 2172 log_test_addr ${a} 0 0 "${desc}, global server, enslaved device client, local" 2173 2174 setup ${with_vrf} 2175 2176 log_start 2177 run_cmd nettest ${varg} -I ${VRF} -s & 2178 wait_local_port_listen ${NSA} 12345 tcp 2179 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & 2180 sleep 3 2181 run_cmd ip link del ${VRF} 2182 sleep 1 2183 log_test_addr ${a} 0 0 "${desc}, VRF server, enslaved device client, local" 2184 2185 setup ${with_vrf} 2186 2187 log_start 2188 run_cmd nettest ${varg} -I ${NSA_DEV} -s & 2189 wait_local_port_listen ${NSA} 12345 tcp 2190 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & 2191 sleep 3 2192 run_cmd ip link del ${VRF} 2193 sleep 1 2194 log_test_addr ${a} 0 0 "${desc}, enslaved device server and client, local" 2195} 2196 2197ipv4_ping_rt() 2198{ 2199 local with_vrf="yes" 2200 local a 2201 2202 for a in ${NSA_IP} ${VRF_IP} 2203 do 2204 log_start 2205 run_cmd_nsb ping -f ${a} & 2206 sleep 3 2207 run_cmd ip link del ${VRF} 2208 sleep 1 2209 log_test_addr ${a} 0 0 "Device delete with active traffic - ping in" 2210 2211 setup ${with_vrf} 2212 done 2213 2214 a=${NSB_IP} 2215 log_start 2216 run_cmd ping -f -I ${VRF} ${a} & 2217 sleep 3 2218 run_cmd ip link del ${VRF} 2219 sleep 1 2220 log_test_addr ${a} 0 0 "Device delete with active traffic - ping out" 2221} 2222 2223ipv4_runtime() 2224{ 2225 log_section "Run time tests - ipv4" 2226 2227 setup "yes" 2228 ipv4_ping_rt 2229 2230 setup "yes" 2231 ipv4_rt "TCP active socket" "-n -1" 2232 2233 setup "yes" 2234 ipv4_rt "TCP passive socket" "-i" 2235} 2236 2237################################################################################ 2238# IPv6 2239 2240ipv6_ping_novrf() 2241{ 2242 local a 2243 2244 # should not have an impact, but make a known state 2245 set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null 2246 2247 # 2248 # out 2249 # 2250 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV} 2251 do 2252 log_start 2253 run_cmd ${ping6} -c1 -w1 ${a} 2254 log_test_addr ${a} $? 0 "ping out" 2255 done 2256 2257 for a in ${NSB_IP6} ${NSB_LO_IP6} 2258 do 2259 log_start 2260 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2261 log_test_addr ${a} $? 0 "ping out, device bind" 2262 2263 log_start 2264 run_cmd ${ping6} -c1 -w1 -I ${NSA_LO_IP6} ${a} 2265 log_test_addr ${a} $? 0 "ping out, loopback address bind" 2266 done 2267 2268 # 2269 # in 2270 # 2271 for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV} ${MCAST}%${NSB_DEV} 2272 do 2273 log_start 2274 run_cmd_nsb ${ping6} -c1 -w1 ${a} 2275 log_test_addr ${a} $? 0 "ping in" 2276 done 2277 2278 # 2279 # local traffic, local address 2280 # 2281 for a in ${NSA_IP6} ${NSA_LO_IP6} ::1 ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV} 2282 do 2283 log_start 2284 run_cmd ${ping6} -c1 -w1 ${a} 2285 log_test_addr ${a} $? 0 "ping local, no bind" 2286 done 2287 2288 for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV} 2289 do 2290 log_start 2291 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2292 log_test_addr ${a} $? 0 "ping local, device bind" 2293 done 2294 2295 for a in ${NSA_LO_IP6} ::1 2296 do 2297 log_start 2298 show_hint "Fails since address on loopback is out of device scope" 2299 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2300 log_test_addr ${a} $? 2 "ping local, device bind" 2301 done 2302 2303 for a in ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSA_DEV} ${NSA_IP6} 2304 do 2305 log_start 2306 run_cmd ${ping6} -c1 -w1 -I ::1 ${a} 2307 log_test_addr ${a} $? 0 "ping local, from localhost" 2308 done 2309 2310 # 2311 # ip rule blocks address 2312 # 2313 log_start 2314 setup_cmd ip -6 rule add pref 32765 from all lookup local 2315 setup_cmd ip -6 rule del pref 0 from all lookup local 2316 setup_cmd ip -6 rule add pref 50 to ${NSB_LO_IP6} prohibit 2317 setup_cmd ip -6 rule add pref 51 from ${NSB_IP6} prohibit 2318 2319 a=${NSB_LO_IP6} 2320 run_cmd ${ping6} -c1 -w1 ${a} 2321 log_test_addr ${a} $? 2 "ping out, blocked by rule" 2322 2323 log_start 2324 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2325 log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule" 2326 2327 a=${NSA_LO_IP6} 2328 log_start 2329 show_hint "Response lost due to ip rule" 2330 run_cmd_nsb ${ping6} -c1 -w1 ${a} 2331 log_test_addr ${a} $? 1 "ping in, blocked by rule" 2332 2333 setup_cmd ip -6 rule add pref 0 from all lookup local 2334 setup_cmd ip -6 rule del pref 32765 from all lookup local 2335 setup_cmd ip -6 rule del pref 50 to ${NSB_LO_IP6} prohibit 2336 setup_cmd ip -6 rule del pref 51 from ${NSB_IP6} prohibit 2337 2338 # 2339 # route blocks reachability to remote address 2340 # 2341 log_start 2342 setup_cmd ip -6 route del ${NSB_LO_IP6} 2343 setup_cmd ip -6 route add unreachable ${NSB_LO_IP6} metric 10 2344 setup_cmd ip -6 route add unreachable ${NSB_IP6} metric 10 2345 2346 a=${NSB_LO_IP6} 2347 run_cmd ${ping6} -c1 -w1 ${a} 2348 log_test_addr ${a} $? 2 "ping out, blocked by route" 2349 2350 log_start 2351 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2352 log_test_addr ${a} $? 2 "ping out, device bind, blocked by route" 2353 2354 a=${NSA_LO_IP6} 2355 log_start 2356 show_hint "Response lost due to ip route" 2357 run_cmd_nsb ${ping6} -c1 -w1 ${a} 2358 log_test_addr ${a} $? 1 "ping in, blocked by route" 2359 2360 2361 # 2362 # remove 'remote' routes; fallback to default 2363 # 2364 log_start 2365 setup_cmd ip -6 ro del unreachable ${NSB_LO_IP6} 2366 setup_cmd ip -6 ro del unreachable ${NSB_IP6} 2367 2368 a=${NSB_LO_IP6} 2369 run_cmd ${ping6} -c1 -w1 ${a} 2370 log_test_addr ${a} $? 2 "ping out, unreachable route" 2371 2372 log_start 2373 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2374 log_test_addr ${a} $? 2 "ping out, device bind, unreachable route" 2375} 2376 2377ipv6_ping_vrf() 2378{ 2379 local a 2380 2381 # should default on; does not exist on older kernels 2382 set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null 2383 2384 # 2385 # out 2386 # 2387 for a in ${NSB_IP6} ${NSB_LO_IP6} 2388 do 2389 log_start 2390 run_cmd ${ping6} -c1 -w1 -I ${VRF} ${a} 2391 log_test_addr ${a} $? 0 "ping out, VRF bind" 2392 done 2393 2394 for a in ${NSB_LINKIP6}%${VRF} ${MCAST}%${VRF} 2395 do 2396 log_start 2397 show_hint "Fails since VRF device does not support linklocal or multicast" 2398 run_cmd ${ping6} -c1 -w1 ${a} 2399 log_test_addr ${a} $? 1 "ping out, VRF bind" 2400 done 2401 2402 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV} 2403 do 2404 log_start 2405 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2406 log_test_addr ${a} $? 0 "ping out, device bind" 2407 done 2408 2409 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} 2410 do 2411 log_start 2412 run_cmd ip vrf exec ${VRF} ${ping6} -c1 -w1 -I ${VRF_IP6} ${a} 2413 log_test_addr ${a} $? 0 "ping out, vrf device+address bind" 2414 done 2415 2416 # 2417 # in 2418 # 2419 for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV} ${MCAST}%${NSB_DEV} 2420 do 2421 log_start 2422 run_cmd_nsb ${ping6} -c1 -w1 ${a} 2423 log_test_addr ${a} $? 0 "ping in" 2424 done 2425 2426 a=${NSA_LO_IP6} 2427 log_start 2428 show_hint "Fails since loopback address is out of VRF scope" 2429 run_cmd_nsb ${ping6} -c1 -w1 ${a} 2430 log_test_addr ${a} $? 1 "ping in" 2431 2432 # 2433 # local traffic, local address 2434 # 2435 for a in ${NSA_IP6} ${VRF_IP6} ::1 2436 do 2437 log_start 2438 show_hint "Source address should be ${a}" 2439 run_cmd ${ping6} -c1 -w1 -I ${VRF} ${a} 2440 log_test_addr ${a} $? 0 "ping local, VRF bind" 2441 done 2442 2443 for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV} 2444 do 2445 log_start 2446 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2447 log_test_addr ${a} $? 0 "ping local, device bind" 2448 done 2449 2450 # LLA to GUA - remove ipv6 global addresses from ns-B 2451 setup_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV} 2452 setup_cmd_nsb ip -6 addr del ${NSB_LO_IP6}/128 dev lo 2453 setup_cmd_nsb ip -6 ro add ${NSA_IP6}/128 via ${NSA_LINKIP6} dev ${NSB_DEV} 2454 2455 for a in ${NSA_IP6} ${VRF_IP6} 2456 do 2457 log_start 2458 run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6} 2459 log_test_addr ${a} $? 0 "ping in, LLA to GUA" 2460 done 2461 2462 setup_cmd_nsb ip -6 ro del ${NSA_IP6}/128 via ${NSA_LINKIP6} dev ${NSB_DEV} 2463 setup_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV} 2464 setup_cmd_nsb ip -6 addr add ${NSB_LO_IP6}/128 dev lo 2465 2466 # 2467 # ip rule blocks address 2468 # 2469 log_start 2470 setup_cmd ip -6 rule add pref 50 to ${NSB_LO_IP6} prohibit 2471 setup_cmd ip -6 rule add pref 51 from ${NSB_IP6} prohibit 2472 2473 a=${NSB_LO_IP6} 2474 run_cmd ${ping6} -c1 -w1 ${a} 2475 log_test_addr ${a} $? 2 "ping out, blocked by rule" 2476 2477 log_start 2478 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2479 log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule" 2480 2481 a=${NSA_LO_IP6} 2482 log_start 2483 show_hint "Response lost due to ip rule" 2484 run_cmd_nsb ${ping6} -c1 -w1 ${a} 2485 log_test_addr ${a} $? 1 "ping in, blocked by rule" 2486 2487 log_start 2488 setup_cmd ip -6 rule del pref 50 to ${NSB_LO_IP6} prohibit 2489 setup_cmd ip -6 rule del pref 51 from ${NSB_IP6} prohibit 2490 2491 # 2492 # remove 'remote' routes; fallback to default 2493 # 2494 log_start 2495 setup_cmd ip -6 ro del ${NSB_LO_IP6} vrf ${VRF} 2496 2497 a=${NSB_LO_IP6} 2498 run_cmd ${ping6} -c1 -w1 ${a} 2499 log_test_addr ${a} $? 2 "ping out, unreachable route" 2500 2501 log_start 2502 run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a} 2503 log_test_addr ${a} $? 2 "ping out, device bind, unreachable route" 2504 2505 ip -netns ${NSB} -6 ro del ${NSA_LO_IP6} 2506 a=${NSA_LO_IP6} 2507 log_start 2508 run_cmd_nsb ${ping6} -c1 -w1 ${a} 2509 log_test_addr ${a} $? 2 "ping in, unreachable route" 2510} 2511 2512ipv6_ping() 2513{ 2514 log_section "IPv6 ping" 2515 2516 log_subsection "No VRF" 2517 setup 2518 ipv6_ping_novrf 2519 setup 2520 set_ping_group 2521 ipv6_ping_novrf 2522 2523 log_subsection "With VRF" 2524 setup "yes" 2525 ipv6_ping_vrf 2526 setup "yes" 2527 set_ping_group 2528 ipv6_ping_vrf 2529} 2530 2531################################################################################ 2532# IPv6 TCP 2533 2534# 2535# MD5 tests without VRF 2536# 2537ipv6_tcp_md5_novrf() 2538{ 2539 # 2540 # single address 2541 # 2542 2543 # basic use case 2544 log_start 2545 run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} & 2546 wait_local_port_listen ${NSA} 12345 tcp 2547 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2548 log_test $? 0 "MD5: Single address config" 2549 2550 # client sends MD5, server not configured 2551 log_start 2552 show_hint "Should timeout due to MD5 mismatch" 2553 run_cmd nettest -6 -s & 2554 wait_local_port_listen ${NSA} 12345 tcp 2555 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2556 log_test $? 2 "MD5: Server no config, client uses password" 2557 2558 # wrong password 2559 log_start 2560 show_hint "Should timeout since client uses wrong password" 2561 run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} & 2562 wait_local_port_listen ${NSA} 12345 tcp 2563 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2564 log_test $? 2 "MD5: Client uses wrong password" 2565 2566 # client from different address 2567 log_start 2568 show_hint "Should timeout due to MD5 mismatch" 2569 run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} & 2570 wait_local_port_listen ${NSA} 12345 tcp 2571 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2572 log_test $? 2 "MD5: Client address does not match address configured with password" 2573 2574 # 2575 # MD5 extension - prefix length 2576 # 2577 2578 # client in prefix 2579 log_start 2580 run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & 2581 wait_local_port_listen ${NSA} 12345 tcp 2582 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2583 log_test $? 0 "MD5: Prefix config" 2584 2585 # client in prefix, wrong password 2586 log_start 2587 show_hint "Should timeout since client uses wrong password" 2588 run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & 2589 wait_local_port_listen ${NSA} 12345 tcp 2590 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2591 log_test $? 2 "MD5: Prefix config, client uses wrong password" 2592 2593 # client outside of prefix 2594 log_start 2595 show_hint "Should timeout due to MD5 mismatch" 2596 run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & 2597 wait_local_port_listen ${NSA} 12345 tcp 2598 run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW} 2599 log_test $? 2 "MD5: Prefix config, client address not in configured prefix" 2600} 2601 2602# 2603# MD5 tests with VRF 2604# 2605ipv6_tcp_md5() 2606{ 2607 # 2608 # single address 2609 # 2610 2611 # basic use case 2612 log_start 2613 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & 2614 wait_local_port_listen ${NSA} 12345 tcp 2615 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2616 log_test $? 0 "MD5: VRF: Single address config" 2617 2618 # client sends MD5, server not configured 2619 log_start 2620 show_hint "Should timeout since server does not have MD5 auth" 2621 run_cmd nettest -6 -s -I ${VRF} & 2622 wait_local_port_listen ${NSA} 12345 tcp 2623 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2624 log_test $? 2 "MD5: VRF: Server no config, client uses password" 2625 2626 # wrong password 2627 log_start 2628 show_hint "Should timeout since client uses wrong password" 2629 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & 2630 wait_local_port_listen ${NSA} 12345 tcp 2631 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2632 log_test $? 2 "MD5: VRF: Client uses wrong password" 2633 2634 # client from different address 2635 log_start 2636 show_hint "Should timeout since server config differs from client" 2637 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} & 2638 wait_local_port_listen ${NSA} 12345 tcp 2639 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2640 log_test $? 2 "MD5: VRF: Client address does not match address configured with password" 2641 2642 # 2643 # MD5 extension - prefix length 2644 # 2645 2646 # client in prefix 2647 log_start 2648 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & 2649 wait_local_port_listen ${NSA} 12345 tcp 2650 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2651 log_test $? 0 "MD5: VRF: Prefix config" 2652 2653 # client in prefix, wrong password 2654 log_start 2655 show_hint "Should timeout since client uses wrong password" 2656 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & 2657 wait_local_port_listen ${NSA} 12345 tcp 2658 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2659 log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password" 2660 2661 # client outside of prefix 2662 log_start 2663 show_hint "Should timeout since client address is outside of prefix" 2664 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & 2665 wait_local_port_listen ${NSA} 12345 tcp 2666 run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW} 2667 log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix" 2668 2669 # 2670 # duplicate config between default VRF and a VRF 2671 # 2672 2673 log_start 2674 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & 2675 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & 2676 wait_local_port_listen ${NSA} 12345 tcp 2677 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2678 log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF" 2679 2680 log_start 2681 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & 2682 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & 2683 wait_local_port_listen ${NSA} 12345 tcp 2684 run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2685 log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF" 2686 2687 log_start 2688 show_hint "Should timeout since client in default VRF uses VRF password" 2689 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & 2690 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & 2691 wait_local_port_listen ${NSA} 12345 tcp 2692 run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2693 log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw" 2694 2695 log_start 2696 show_hint "Should timeout since client in VRF uses default VRF password" 2697 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & 2698 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & 2699 wait_local_port_listen ${NSA} 12345 tcp 2700 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2701 log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw" 2702 2703 log_start 2704 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & 2705 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & 2706 wait_local_port_listen ${NSA} 12345 tcp 2707 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2708 log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF" 2709 2710 log_start 2711 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & 2712 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & 2713 wait_local_port_listen ${NSA} 12345 tcp 2714 run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2715 log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF" 2716 2717 log_start 2718 show_hint "Should timeout since client in default VRF uses VRF password" 2719 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & 2720 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & 2721 wait_local_port_listen ${NSA} 12345 tcp 2722 run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW} 2723 log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw" 2724 2725 log_start 2726 show_hint "Should timeout since client in VRF uses default VRF password" 2727 run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & 2728 run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & 2729 wait_local_port_listen ${NSA} 12345 tcp 2730 run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} 2731 log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw" 2732 2733 # 2734 # negative tests 2735 # 2736 log_start 2737 run_cmd nettest -6 -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NSB_IP6} 2738 log_test $? 1 "MD5: VRF: Device must be a VRF - single address" 2739 2740 log_start 2741 run_cmd nettest -6 -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NS_NET6} 2742 log_test $? 1 "MD5: VRF: Device must be a VRF - prefix" 2743 2744} 2745 2746ipv6_tcp_novrf() 2747{ 2748 local a 2749 2750 # 2751 # server tests 2752 # 2753 for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV} 2754 do 2755 log_start 2756 run_cmd nettest -6 -s & 2757 wait_local_port_listen ${NSA} 12345 tcp 2758 run_cmd_nsb nettest -6 -r ${a} 2759 log_test_addr ${a} $? 0 "Global server" 2760 done 2761 2762 # verify TCP reset received 2763 for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV} 2764 do 2765 log_start 2766 show_hint "Should fail 'Connection refused'" 2767 run_cmd_nsb nettest -6 -r ${a} 2768 log_test_addr ${a} $? 1 "No server" 2769 done 2770 2771 # 2772 # client 2773 # 2774 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} 2775 do 2776 log_start 2777 run_cmd_nsb nettest -6 -s & 2778 wait_local_port_listen ${NSB} 12345 tcp 2779 run_cmd nettest -6 -r ${a} 2780 log_test_addr ${a} $? 0 "Client" 2781 done 2782 2783 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} 2784 do 2785 log_start 2786 run_cmd_nsb nettest -6 -s & 2787 wait_local_port_listen ${NSB} 12345 tcp 2788 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} 2789 log_test_addr ${a} $? 0 "Client, device bind" 2790 done 2791 2792 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} 2793 do 2794 log_start 2795 show_hint "Should fail 'Connection refused'" 2796 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} 2797 log_test_addr ${a} $? 1 "No server, device client" 2798 done 2799 2800 # 2801 # local address tests 2802 # 2803 for a in ${NSA_IP6} ${NSA_LO_IP6} ::1 2804 do 2805 log_start 2806 run_cmd nettest -6 -s & 2807 wait_local_port_listen ${NSA} 12345 tcp 2808 run_cmd nettest -6 -r ${a} 2809 log_test_addr ${a} $? 0 "Global server, local connection" 2810 done 2811 2812 a=${NSA_IP6} 2813 log_start 2814 run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & 2815 wait_local_port_listen ${NSA} 12345 tcp 2816 run_cmd nettest -6 -r ${a} -0 ${a} 2817 log_test_addr ${a} $? 0 "Device server, unbound client, local connection" 2818 2819 for a in ${NSA_LO_IP6} ::1 2820 do 2821 log_start 2822 show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" 2823 run_cmd nettest -6 -s -I ${NSA_DEV} & 2824 wait_local_port_listen ${NSA} 12345 tcp 2825 run_cmd nettest -6 -r ${a} 2826 log_test_addr ${a} $? 1 "Device server, unbound client, local connection" 2827 done 2828 2829 a=${NSA_IP6} 2830 log_start 2831 run_cmd nettest -6 -s & 2832 wait_local_port_listen ${NSA} 12345 tcp 2833 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} 2834 log_test_addr ${a} $? 0 "Global server, device client, local connection" 2835 2836 for a in ${NSA_LO_IP6} ::1 2837 do 2838 log_start 2839 show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" 2840 run_cmd nettest -6 -s & 2841 wait_local_port_listen ${NSA} 12345 tcp 2842 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} 2843 log_test_addr ${a} $? 1 "Global server, device client, local connection" 2844 done 2845 2846 for a in ${NSA_IP6} ${NSA_LINKIP6} 2847 do 2848 log_start 2849 run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & 2850 wait_local_port_listen ${NSA} 12345 tcp 2851 run_cmd nettest -6 -d ${NSA_DEV} -r ${a} 2852 log_test_addr ${a} $? 0 "Device server, device client, local conn" 2853 done 2854 2855 for a in ${NSA_IP6} ${NSA_LINKIP6} 2856 do 2857 log_start 2858 show_hint "Should fail 'Connection refused'" 2859 run_cmd nettest -6 -d ${NSA_DEV} -r ${a} 2860 log_test_addr ${a} $? 1 "No server, device client, local conn" 2861 done 2862 2863 [ "$fips_enabled" = "1" ] || ipv6_tcp_md5_novrf 2864} 2865 2866ipv6_tcp_vrf() 2867{ 2868 local a 2869 2870 # disable global server 2871 log_subsection "Global server disabled" 2872 2873 set_sysctl net.ipv4.tcp_l3mdev_accept=0 2874 2875 # 2876 # server tests 2877 # 2878 for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV} 2879 do 2880 log_start 2881 show_hint "Should fail 'Connection refused' since global server with VRF is disabled" 2882 run_cmd nettest -6 -s & 2883 wait_local_port_listen ${NSA} 12345 tcp 2884 run_cmd_nsb nettest -6 -r ${a} 2885 log_test_addr ${a} $? 1 "Global server" 2886 done 2887 2888 for a in ${NSA_IP6} ${VRF_IP6} 2889 do 2890 log_start 2891 run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & 2892 wait_local_port_listen ${NSA} 12345 tcp 2893 run_cmd_nsb nettest -6 -r ${a} 2894 log_test_addr ${a} $? 0 "VRF server" 2895 done 2896 2897 # link local is always bound to ingress device 2898 a=${NSA_LINKIP6}%${NSB_DEV} 2899 log_start 2900 run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} & 2901 wait_local_port_listen ${NSA} 12345 tcp 2902 run_cmd_nsb nettest -6 -r ${a} 2903 log_test_addr ${a} $? 0 "VRF server" 2904 2905 for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV} 2906 do 2907 log_start 2908 run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & 2909 wait_local_port_listen ${NSA} 12345 tcp 2910 run_cmd_nsb nettest -6 -r ${a} 2911 log_test_addr ${a} $? 0 "Device server" 2912 done 2913 2914 # verify TCP reset received 2915 for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV} 2916 do 2917 log_start 2918 show_hint "Should fail 'Connection refused'" 2919 run_cmd_nsb nettest -6 -r ${a} 2920 log_test_addr ${a} $? 1 "No server" 2921 done 2922 2923 # local address tests 2924 a=${NSA_IP6} 2925 log_start 2926 show_hint "Should fail 'Connection refused' since global server with VRF is disabled" 2927 run_cmd nettest -6 -s & 2928 wait_local_port_listen ${NSA} 12345 tcp 2929 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} 2930 log_test_addr ${a} $? 1 "Global server, local connection" 2931 2932 # run MD5 tests 2933 if [ "$fips_enabled" = "0" ]; then 2934 setup_vrf_dup 2935 ipv6_tcp_md5 2936 cleanup_vrf_dup 2937 fi 2938 2939 # 2940 # enable VRF global server 2941 # 2942 log_subsection "VRF Global server enabled" 2943 set_sysctl net.ipv4.tcp_l3mdev_accept=1 2944 2945 for a in ${NSA_IP6} ${VRF_IP6} 2946 do 2947 log_start 2948 run_cmd nettest -6 -s -3 ${VRF} & 2949 wait_local_port_listen ${NSA} 12345 tcp 2950 run_cmd_nsb nettest -6 -r ${a} 2951 log_test_addr ${a} $? 0 "Global server" 2952 done 2953 2954 for a in ${NSA_IP6} ${VRF_IP6} 2955 do 2956 log_start 2957 run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & 2958 wait_local_port_listen ${NSA} 12345 tcp 2959 run_cmd_nsb nettest -6 -r ${a} 2960 log_test_addr ${a} $? 0 "VRF server" 2961 done 2962 2963 # For LLA, child socket is bound to device 2964 a=${NSA_LINKIP6}%${NSB_DEV} 2965 log_start 2966 run_cmd nettest -6 -s -3 ${NSA_DEV} & 2967 wait_local_port_listen ${NSA} 12345 tcp 2968 run_cmd_nsb nettest -6 -r ${a} 2969 log_test_addr ${a} $? 0 "Global server" 2970 2971 log_start 2972 run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} & 2973 wait_local_port_listen ${NSA} 12345 tcp 2974 run_cmd_nsb nettest -6 -r ${a} 2975 log_test_addr ${a} $? 0 "VRF server" 2976 2977 for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSB_DEV} 2978 do 2979 log_start 2980 run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & 2981 wait_local_port_listen ${NSA} 12345 tcp 2982 run_cmd_nsb nettest -6 -r ${a} 2983 log_test_addr ${a} $? 0 "Device server" 2984 done 2985 2986 # verify TCP reset received 2987 for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV} 2988 do 2989 log_start 2990 show_hint "Should fail 'Connection refused'" 2991 run_cmd_nsb nettest -6 -r ${a} 2992 log_test_addr ${a} $? 1 "No server" 2993 done 2994 2995 # local address tests 2996 for a in ${NSA_IP6} ${VRF_IP6} 2997 do 2998 log_start 2999 show_hint "Fails 'Connection refused' since client is not in VRF" 3000 run_cmd nettest -6 -s -I ${VRF} & 3001 wait_local_port_listen ${NSA} 12345 tcp 3002 run_cmd nettest -6 -r ${a} 3003 log_test_addr ${a} $? 1 "Global server, local connection" 3004 done 3005 3006 3007 # 3008 # client 3009 # 3010 for a in ${NSB_IP6} ${NSB_LO_IP6} 3011 do 3012 log_start 3013 run_cmd_nsb nettest -6 -s & 3014 wait_local_port_listen ${NSB} 12345 tcp 3015 run_cmd nettest -6 -r ${a} -d ${VRF} 3016 log_test_addr ${a} $? 0 "Client, VRF bind" 3017 done 3018 3019 a=${NSB_LINKIP6} 3020 log_start 3021 show_hint "Fails since VRF device does not allow linklocal addresses" 3022 run_cmd_nsb nettest -6 -s & 3023 wait_local_port_listen ${NSB} 12345 tcp 3024 run_cmd nettest -6 -r ${a} -d ${VRF} 3025 log_test_addr ${a} $? 1 "Client, VRF bind" 3026 3027 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6} 3028 do 3029 log_start 3030 run_cmd_nsb nettest -6 -s & 3031 wait_local_port_listen ${NSB} 12345 tcp 3032 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} 3033 log_test_addr ${a} $? 0 "Client, device bind" 3034 done 3035 3036 for a in ${NSB_IP6} ${NSB_LO_IP6} 3037 do 3038 log_start 3039 show_hint "Should fail 'Connection refused'" 3040 run_cmd nettest -6 -r ${a} -d ${VRF} 3041 log_test_addr ${a} $? 1 "No server, VRF client" 3042 done 3043 3044 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6} 3045 do 3046 log_start 3047 show_hint "Should fail 'Connection refused'" 3048 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} 3049 log_test_addr ${a} $? 1 "No server, device client" 3050 done 3051 3052 for a in ${NSA_IP6} ${VRF_IP6} ::1 3053 do 3054 log_start 3055 run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & 3056 wait_local_port_listen ${NSA} 12345 tcp 3057 run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a} 3058 log_test_addr ${a} $? 0 "VRF server, VRF client, local connection" 3059 done 3060 3061 a=${NSA_IP6} 3062 log_start 3063 run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & 3064 wait_local_port_listen ${NSA} 12345 tcp 3065 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} 3066 log_test_addr ${a} $? 0 "VRF server, device client, local connection" 3067 3068 a=${NSA_IP6} 3069 log_start 3070 show_hint "Should fail since unbound client is out of VRF scope" 3071 run_cmd nettest -6 -s -I ${VRF} & 3072 wait_local_port_listen ${NSA} 12345 tcp 3073 run_cmd nettest -6 -r ${a} 3074 log_test_addr ${a} $? 1 "VRF server, unbound client, local connection" 3075 3076 log_start 3077 run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & 3078 wait_local_port_listen ${NSA} 12345 tcp 3079 run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a} 3080 log_test_addr ${a} $? 0 "Device server, VRF client, local connection" 3081 3082 for a in ${NSA_IP6} ${NSA_LINKIP6} 3083 do 3084 log_start 3085 run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & 3086 wait_local_port_listen ${NSA} 12345 tcp 3087 run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} 3088 log_test_addr ${a} $? 0 "Device server, device client, local connection" 3089 done 3090} 3091 3092ipv6_tcp() 3093{ 3094 log_section "IPv6/TCP" 3095 log_subsection "No VRF" 3096 setup 3097 3098 # tcp_l3mdev_accept should have no affect without VRF; 3099 # run tests with it enabled and disabled to verify 3100 log_subsection "tcp_l3mdev_accept disabled" 3101 set_sysctl net.ipv4.tcp_l3mdev_accept=0 3102 ipv6_tcp_novrf 3103 log_subsection "tcp_l3mdev_accept enabled" 3104 set_sysctl net.ipv4.tcp_l3mdev_accept=1 3105 ipv6_tcp_novrf 3106 3107 log_subsection "With VRF" 3108 setup "yes" 3109 ipv6_tcp_vrf 3110} 3111 3112################################################################################ 3113# IPv6 UDP 3114 3115ipv6_udp_novrf() 3116{ 3117 local a 3118 3119 # 3120 # server tests 3121 # 3122 for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSB_DEV} 3123 do 3124 log_start 3125 run_cmd nettest -6 -D -s -3 ${NSA_DEV} & 3126 wait_local_port_listen ${NSA} 12345 udp 3127 run_cmd_nsb nettest -6 -D -r ${a} 3128 log_test_addr ${a} $? 0 "Global server" 3129 3130 log_start 3131 run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3132 wait_local_port_listen ${NSA} 12345 udp 3133 run_cmd_nsb nettest -6 -D -r ${a} 3134 log_test_addr ${a} $? 0 "Device server" 3135 done 3136 3137 a=${NSA_LO_IP6} 3138 log_start 3139 run_cmd nettest -6 -D -s -3 ${NSA_DEV} & 3140 wait_local_port_listen ${NSA} 12345 udp 3141 run_cmd_nsb nettest -6 -D -r ${a} 3142 log_test_addr ${a} $? 0 "Global server" 3143 3144 # should fail since loopback address is out of scope for a device 3145 # bound server, but it does not - hence this is more documenting 3146 # behavior. 3147 #log_start 3148 #show_hint "Should fail since loopback address is out of scope" 3149 #run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3150 wait_local_port_listen ${NSA} 12345 udp 3151 #run_cmd_nsb nettest -6 -D -r ${a} 3152 #log_test_addr ${a} $? 1 "Device server" 3153 3154 # negative test - should fail 3155 for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV} 3156 do 3157 log_start 3158 show_hint "Should fail 'Connection refused' since there is no server" 3159 run_cmd_nsb nettest -6 -D -r ${a} 3160 log_test_addr ${a} $? 1 "No server" 3161 done 3162 3163 # 3164 # client 3165 # 3166 for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} 3167 do 3168 log_start 3169 run_cmd_nsb nettest -6 -D -s & 3170 wait_local_port_listen ${NSB} 12345 udp 3171 run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6} 3172 log_test_addr ${a} $? 0 "Client" 3173 3174 log_start 3175 run_cmd_nsb nettest -6 -D -s & 3176 wait_local_port_listen ${NSB} 12345 udp 3177 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6} 3178 log_test_addr ${a} $? 0 "Client, device bind" 3179 3180 log_start 3181 run_cmd_nsb nettest -6 -D -s & 3182 wait_local_port_listen ${NSB} 12345 udp 3183 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6} 3184 log_test_addr ${a} $? 0 "Client, device send via cmsg" 3185 3186 log_start 3187 run_cmd_nsb nettest -6 -D -s & 3188 wait_local_port_listen ${NSB} 12345 udp 3189 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6} 3190 log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF" 3191 3192 log_start 3193 show_hint "Should fail 'Connection refused'" 3194 run_cmd nettest -6 -D -r ${a} 3195 log_test_addr ${a} $? 1 "No server, unbound client" 3196 3197 log_start 3198 show_hint "Should fail 'Connection refused'" 3199 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} 3200 log_test_addr ${a} $? 1 "No server, device client" 3201 done 3202 3203 # 3204 # local address tests 3205 # 3206 for a in ${NSA_IP6} ${NSA_LO_IP6} ::1 3207 do 3208 log_start 3209 run_cmd nettest -6 -D -s & 3210 wait_local_port_listen ${NSA} 12345 udp 3211 run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a} 3212 log_test_addr ${a} $? 0 "Global server, local connection" 3213 done 3214 3215 a=${NSA_IP6} 3216 log_start 3217 run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & 3218 wait_local_port_listen ${NSA} 12345 udp 3219 run_cmd nettest -6 -D -r ${a} 3220 log_test_addr ${a} $? 0 "Device server, unbound client, local connection" 3221 3222 for a in ${NSA_LO_IP6} ::1 3223 do 3224 log_start 3225 show_hint "Should fail 'Connection refused' since address is out of device scope" 3226 run_cmd nettest -6 -s -D -I ${NSA_DEV} & 3227 wait_local_port_listen ${NSA} 12345 udp 3228 run_cmd nettest -6 -D -r ${a} 3229 log_test_addr ${a} $? 1 "Device server, local connection" 3230 done 3231 3232 a=${NSA_IP6} 3233 log_start 3234 run_cmd nettest -6 -s -D & 3235 wait_local_port_listen ${NSA} 12345 udp 3236 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3237 log_test_addr ${a} $? 0 "Global server, device client, local connection" 3238 3239 log_start 3240 run_cmd nettest -6 -s -D & 3241 wait_local_port_listen ${NSA} 12345 udp 3242 run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a} 3243 log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection" 3244 3245 log_start 3246 run_cmd nettest -6 -s -D & 3247 wait_local_port_listen ${NSA} 12345 udp 3248 run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a} 3249 log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection" 3250 3251 for a in ${NSA_LO_IP6} ::1 3252 do 3253 log_start 3254 show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" 3255 run_cmd nettest -6 -D -s & 3256 wait_local_port_listen ${NSA} 12345 udp 3257 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} 3258 log_test_addr ${a} $? 1 "Global server, device client, local connection" 3259 3260 log_start 3261 show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" 3262 run_cmd nettest -6 -D -s & 3263 wait_local_port_listen ${NSA} 12345 udp 3264 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C 3265 log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection" 3266 3267 log_start 3268 show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" 3269 run_cmd nettest -6 -D -s & 3270 wait_local_port_listen ${NSA} 12345 udp 3271 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S 3272 log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" 3273 3274 log_start 3275 show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" 3276 run_cmd nettest -6 -D -s & 3277 wait_local_port_listen ${NSA} 12345 udp 3278 run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U 3279 log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" 3280 done 3281 3282 a=${NSA_IP6} 3283 log_start 3284 run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} & 3285 wait_local_port_listen ${NSA} 12345 udp 3286 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a} 3287 log_test_addr ${a} $? 0 "Device server, device client, local conn" 3288 3289 log_start 3290 show_hint "Should fail 'Connection refused'" 3291 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3292 log_test_addr ${a} $? 1 "No server, device client, local conn" 3293 3294 # LLA to GUA 3295 run_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV} 3296 run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV} 3297 log_start 3298 run_cmd nettest -6 -s -D & 3299 wait_local_port_listen ${NSA} 12345 udp 3300 run_cmd_nsb nettest -6 -D -r ${NSA_IP6} 3301 log_test $? 0 "UDP in - LLA to GUA" 3302 3303 run_cmd_nsb ip -6 ro del ${NSA_IP6}/128 dev ${NSB_DEV} 3304 run_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV} nodad 3305} 3306 3307ipv6_udp_vrf() 3308{ 3309 local a 3310 3311 # disable global server 3312 log_subsection "Global server disabled" 3313 set_sysctl net.ipv4.udp_l3mdev_accept=0 3314 3315 # 3316 # server tests 3317 # 3318 for a in ${NSA_IP6} ${VRF_IP6} 3319 do 3320 log_start 3321 show_hint "Should fail 'Connection refused' since global server is disabled" 3322 run_cmd nettest -6 -D -s & 3323 wait_local_port_listen ${NSA} 12345 udp 3324 run_cmd_nsb nettest -6 -D -r ${a} 3325 log_test_addr ${a} $? 1 "Global server" 3326 done 3327 3328 for a in ${NSA_IP6} ${VRF_IP6} 3329 do 3330 log_start 3331 run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & 3332 wait_local_port_listen ${NSA} 12345 udp 3333 run_cmd_nsb nettest -6 -D -r ${a} 3334 log_test_addr ${a} $? 0 "VRF server" 3335 done 3336 3337 for a in ${NSA_IP6} ${VRF_IP6} 3338 do 3339 log_start 3340 run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3341 wait_local_port_listen ${NSA} 12345 udp 3342 run_cmd_nsb nettest -6 -D -r ${a} 3343 log_test_addr ${a} $? 0 "Enslaved device server" 3344 done 3345 3346 # negative test - should fail 3347 for a in ${NSA_IP6} ${VRF_IP6} 3348 do 3349 log_start 3350 show_hint "Should fail 'Connection refused' since there is no server" 3351 run_cmd_nsb nettest -6 -D -r ${a} 3352 log_test_addr ${a} $? 1 "No server" 3353 done 3354 3355 # 3356 # local address tests 3357 # 3358 for a in ${NSA_IP6} ${VRF_IP6} 3359 do 3360 log_start 3361 show_hint "Should fail 'Connection refused' since global server is disabled" 3362 run_cmd nettest -6 -D -s & 3363 wait_local_port_listen ${NSA} 12345 udp 3364 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3365 log_test_addr ${a} $? 1 "Global server, VRF client, local conn" 3366 done 3367 3368 for a in ${NSA_IP6} ${VRF_IP6} 3369 do 3370 log_start 3371 run_cmd nettest -6 -D -I ${VRF} -s & 3372 wait_local_port_listen ${NSA} 12345 udp 3373 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3374 log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" 3375 done 3376 3377 a=${NSA_IP6} 3378 log_start 3379 show_hint "Should fail 'Connection refused' since global server is disabled" 3380 run_cmd nettest -6 -D -s & 3381 wait_local_port_listen ${NSA} 12345 udp 3382 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3383 log_test_addr ${a} $? 1 "Global server, device client, local conn" 3384 3385 log_start 3386 run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & 3387 wait_local_port_listen ${NSA} 12345 udp 3388 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3389 log_test_addr ${a} $? 0 "VRF server, device client, local conn" 3390 3391 log_start 3392 run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3393 wait_local_port_listen ${NSA} 12345 udp 3394 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3395 log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" 3396 3397 log_start 3398 run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3399 wait_local_port_listen ${NSA} 12345 udp 3400 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3401 log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn" 3402 3403 # disable global server 3404 log_subsection "Global server enabled" 3405 set_sysctl net.ipv4.udp_l3mdev_accept=1 3406 3407 # 3408 # server tests 3409 # 3410 for a in ${NSA_IP6} ${VRF_IP6} 3411 do 3412 log_start 3413 run_cmd nettest -6 -D -s -3 ${NSA_DEV} & 3414 wait_local_port_listen ${NSA} 12345 udp 3415 run_cmd_nsb nettest -6 -D -r ${a} 3416 log_test_addr ${a} $? 0 "Global server" 3417 done 3418 3419 for a in ${NSA_IP6} ${VRF_IP6} 3420 do 3421 log_start 3422 run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & 3423 wait_local_port_listen ${NSA} 12345 udp 3424 run_cmd_nsb nettest -6 -D -r ${a} 3425 log_test_addr ${a} $? 0 "VRF server" 3426 done 3427 3428 for a in ${NSA_IP6} ${VRF_IP6} 3429 do 3430 log_start 3431 run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3432 wait_local_port_listen ${NSA} 12345 udp 3433 run_cmd_nsb nettest -6 -D -r ${a} 3434 log_test_addr ${a} $? 0 "Enslaved device server" 3435 done 3436 3437 # negative test - should fail 3438 for a in ${NSA_IP6} ${VRF_IP6} 3439 do 3440 log_start 3441 run_cmd_nsb nettest -6 -D -r ${a} 3442 log_test_addr ${a} $? 1 "No server" 3443 done 3444 3445 # 3446 # client tests 3447 # 3448 log_start 3449 run_cmd_nsb nettest -6 -D -s & 3450 wait_local_port_listen ${NSB} 12345 udp 3451 run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6} 3452 log_test $? 0 "VRF client" 3453 3454 # negative test - should fail 3455 log_start 3456 run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6} 3457 log_test $? 1 "No server, VRF client" 3458 3459 log_start 3460 run_cmd_nsb nettest -6 -D -s & 3461 wait_local_port_listen ${NSB} 12345 udp 3462 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6} 3463 log_test $? 0 "Enslaved device client" 3464 3465 # negative test - should fail 3466 log_start 3467 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6} 3468 log_test $? 1 "No server, enslaved device client" 3469 3470 # 3471 # local address tests 3472 # 3473 a=${NSA_IP6} 3474 log_start 3475 run_cmd nettest -6 -D -s -3 ${NSA_DEV} & 3476 wait_local_port_listen ${NSA} 12345 udp 3477 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3478 log_test_addr ${a} $? 0 "Global server, VRF client, local conn" 3479 3480 #log_start 3481 run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & 3482 wait_local_port_listen ${NSA} 12345 udp 3483 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3484 log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" 3485 3486 3487 a=${VRF_IP6} 3488 log_start 3489 run_cmd nettest -6 -D -s -3 ${VRF} & 3490 wait_local_port_listen ${NSA} 12345 udp 3491 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3492 log_test_addr ${a} $? 0 "Global server, VRF client, local conn" 3493 3494 log_start 3495 run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} & 3496 wait_local_port_listen ${NSA} 12345 udp 3497 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3498 log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" 3499 3500 # negative test - should fail 3501 for a in ${NSA_IP6} ${VRF_IP6} 3502 do 3503 log_start 3504 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3505 log_test_addr ${a} $? 1 "No server, VRF client, local conn" 3506 done 3507 3508 # device to global IP 3509 a=${NSA_IP6} 3510 log_start 3511 run_cmd nettest -6 -D -s -3 ${NSA_DEV} & 3512 wait_local_port_listen ${NSA} 12345 udp 3513 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3514 log_test_addr ${a} $? 0 "Global server, device client, local conn" 3515 3516 log_start 3517 run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & 3518 wait_local_port_listen ${NSA} 12345 udp 3519 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3520 log_test_addr ${a} $? 0 "VRF server, device client, local conn" 3521 3522 log_start 3523 run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3524 wait_local_port_listen ${NSA} 12345 udp 3525 run_cmd nettest -6 -D -d ${VRF} -r ${a} 3526 log_test_addr ${a} $? 0 "Device server, VRF client, local conn" 3527 3528 log_start 3529 run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & 3530 wait_local_port_listen ${NSA} 12345 udp 3531 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3532 log_test_addr ${a} $? 0 "Device server, device client, local conn" 3533 3534 log_start 3535 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} 3536 log_test_addr ${a} $? 1 "No server, device client, local conn" 3537 3538 3539 # link local addresses 3540 log_start 3541 run_cmd nettest -6 -D -s & 3542 wait_local_port_listen ${NSA} 12345 udp 3543 run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6} 3544 log_test $? 0 "Global server, linklocal IP" 3545 3546 log_start 3547 run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6} 3548 log_test $? 1 "No server, linklocal IP" 3549 3550 3551 log_start 3552 run_cmd_nsb nettest -6 -D -s & 3553 wait_local_port_listen ${NSB} 12345 udp 3554 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6} 3555 log_test $? 0 "Enslaved device client, linklocal IP" 3556 3557 log_start 3558 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6} 3559 log_test $? 1 "No server, device client, peer linklocal IP" 3560 3561 3562 log_start 3563 run_cmd nettest -6 -D -s & 3564 wait_local_port_listen ${NSA} 12345 udp 3565 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6} 3566 log_test $? 0 "Enslaved device client, local conn - linklocal IP" 3567 3568 log_start 3569 run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6} 3570 log_test $? 1 "No server, device client, local conn - linklocal IP" 3571 3572 # LLA to GUA 3573 run_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV} 3574 run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV} 3575 log_start 3576 run_cmd nettest -6 -s -D & 3577 wait_local_port_listen ${NSA} 12345 udp 3578 run_cmd_nsb nettest -6 -D -r ${NSA_IP6} 3579 log_test $? 0 "UDP in - LLA to GUA" 3580 3581 run_cmd_nsb ip -6 ro del ${NSA_IP6}/128 dev ${NSB_DEV} 3582 run_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV} nodad 3583} 3584 3585ipv6_udp() 3586{ 3587 # should not matter, but set to known state 3588 set_sysctl net.ipv4.udp_early_demux=1 3589 3590 log_section "IPv6/UDP" 3591 log_subsection "No VRF" 3592 setup 3593 3594 # udp_l3mdev_accept should have no affect without VRF; 3595 # run tests with it enabled and disabled to verify 3596 log_subsection "udp_l3mdev_accept disabled" 3597 set_sysctl net.ipv4.udp_l3mdev_accept=0 3598 ipv6_udp_novrf 3599 log_subsection "udp_l3mdev_accept enabled" 3600 set_sysctl net.ipv4.udp_l3mdev_accept=1 3601 ipv6_udp_novrf 3602 3603 log_subsection "With VRF" 3604 setup "yes" 3605 ipv6_udp_vrf 3606} 3607 3608################################################################################ 3609# IPv6 address bind 3610 3611ipv6_addr_bind_novrf() 3612{ 3613 # 3614 # raw socket 3615 # 3616 for a in ${NSA_IP6} ${NSA_LO_IP6} 3617 do 3618 log_start 3619 run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -b 3620 log_test_addr ${a} $? 0 "Raw socket bind to local address" 3621 3622 log_start 3623 run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${NSA_DEV} -b 3624 log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind" 3625 done 3626 3627 # 3628 # raw socket with nonlocal bind 3629 # 3630 a=${NL_IP6} 3631 log_start 3632 run_cmd nettest -6 -s -R -P icmp -f -l ${a} -I ${NSA_DEV} -b 3633 log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address" 3634 3635 # 3636 # tcp sockets 3637 # 3638 a=${NSA_IP6} 3639 log_start 3640 run_cmd nettest -6 -s -l ${a} -t1 -b 3641 log_test_addr ${a} $? 0 "TCP socket bind to local address" 3642 3643 log_start 3644 run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b 3645 log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind" 3646 3647 # Sadly, the kernel allows binding a socket to a device and then 3648 # binding to an address not on the device. So this test passes 3649 # when it really should not 3650 a=${NSA_LO_IP6} 3651 log_start 3652 show_hint "Technically should fail since address is not on device but kernel allows" 3653 run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b 3654 log_test_addr ${a} $? 0 "TCP socket bind to out of scope local address" 3655} 3656 3657ipv6_addr_bind_vrf() 3658{ 3659 # 3660 # raw socket 3661 # 3662 for a in ${NSA_IP6} ${VRF_IP6} 3663 do 3664 log_start 3665 run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${VRF} -b 3666 log_test_addr ${a} $? 0 "Raw socket bind to local address after vrf bind" 3667 3668 log_start 3669 run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${NSA_DEV} -b 3670 log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind" 3671 done 3672 3673 a=${NSA_LO_IP6} 3674 log_start 3675 show_hint "Address on loopback is out of VRF scope" 3676 run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${VRF} -b 3677 log_test_addr ${a} $? 1 "Raw socket bind to invalid local address after vrf bind" 3678 3679 # 3680 # raw socket with nonlocal bind 3681 # 3682 a=${NL_IP6} 3683 log_start 3684 run_cmd nettest -6 -s -R -P icmp -f -l ${a} -I ${VRF} -b 3685 log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address after VRF bind" 3686 3687 # 3688 # tcp sockets 3689 # 3690 # address on enslaved device is valid for the VRF or device in a VRF 3691 for a in ${NSA_IP6} ${VRF_IP6} 3692 do 3693 log_start 3694 run_cmd nettest -6 -s -l ${a} -I ${VRF} -t1 -b 3695 log_test_addr ${a} $? 0 "TCP socket bind to local address with VRF bind" 3696 done 3697 3698 a=${NSA_IP6} 3699 log_start 3700 run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b 3701 log_test_addr ${a} $? 0 "TCP socket bind to local address with device bind" 3702 3703 # Sadly, the kernel allows binding a socket to a device and then 3704 # binding to an address not on the device. The only restriction 3705 # is that the address is valid in the L3 domain. So this test 3706 # passes when it really should not 3707 a=${VRF_IP6} 3708 log_start 3709 show_hint "Technically should fail since address is not on device but kernel allows" 3710 run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b 3711 log_test_addr ${a} $? 0 "TCP socket bind to VRF address with device bind" 3712 3713 a=${NSA_LO_IP6} 3714 log_start 3715 show_hint "Address on loopback out of scope for VRF" 3716 run_cmd nettest -6 -s -l ${a} -I ${VRF} -t1 -b 3717 log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for VRF" 3718 3719 log_start 3720 show_hint "Address on loopback out of scope for device in VRF" 3721 run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b 3722 log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for device bind" 3723 3724} 3725 3726ipv6_addr_bind() 3727{ 3728 log_section "IPv6 address binds" 3729 3730 log_subsection "No VRF" 3731 setup 3732 ipv6_addr_bind_novrf 3733 3734 log_subsection "With VRF" 3735 setup "yes" 3736 ipv6_addr_bind_vrf 3737} 3738 3739################################################################################ 3740# IPv6 runtime tests 3741 3742ipv6_rt() 3743{ 3744 local desc="$1" 3745 local varg="-6 $2" 3746 local with_vrf="yes" 3747 local a 3748 3749 # 3750 # server tests 3751 # 3752 for a in ${NSA_IP6} ${VRF_IP6} 3753 do 3754 log_start 3755 run_cmd nettest ${varg} -s & 3756 wait_local_port_listen ${NSA} 12345 tcp 3757 run_cmd_nsb nettest ${varg} -r ${a} & 3758 sleep 3 3759 run_cmd ip link del ${VRF} 3760 sleep 1 3761 log_test_addr ${a} 0 0 "${desc}, global server" 3762 3763 setup ${with_vrf} 3764 done 3765 3766 for a in ${NSA_IP6} ${VRF_IP6} 3767 do 3768 log_start 3769 run_cmd nettest ${varg} -I ${VRF} -s & 3770 wait_local_port_listen ${NSA} 12345 tcp 3771 run_cmd_nsb nettest ${varg} -r ${a} & 3772 sleep 3 3773 run_cmd ip link del ${VRF} 3774 sleep 1 3775 log_test_addr ${a} 0 0 "${desc}, VRF server" 3776 3777 setup ${with_vrf} 3778 done 3779 3780 for a in ${NSA_IP6} ${VRF_IP6} 3781 do 3782 log_start 3783 run_cmd nettest ${varg} -I ${NSA_DEV} -s & 3784 wait_local_port_listen ${NSA} 12345 tcp 3785 run_cmd_nsb nettest ${varg} -r ${a} & 3786 sleep 3 3787 run_cmd ip link del ${VRF} 3788 sleep 1 3789 log_test_addr ${a} 0 0 "${desc}, enslaved device server" 3790 3791 setup ${with_vrf} 3792 done 3793 3794 # 3795 # client test 3796 # 3797 log_start 3798 run_cmd_nsb nettest ${varg} -s & 3799 wait_local_port_listen ${NSB} 12345 tcp 3800 run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} & 3801 sleep 3 3802 run_cmd ip link del ${VRF} 3803 sleep 1 3804 log_test 0 0 "${desc}, VRF client" 3805 3806 setup ${with_vrf} 3807 3808 log_start 3809 run_cmd_nsb nettest ${varg} -s & 3810 wait_local_port_listen ${NSB} 12345 tcp 3811 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} & 3812 sleep 3 3813 run_cmd ip link del ${VRF} 3814 sleep 1 3815 log_test 0 0 "${desc}, enslaved device client" 3816 3817 setup ${with_vrf} 3818 3819 3820 # 3821 # local address tests 3822 # 3823 for a in ${NSA_IP6} ${VRF_IP6} 3824 do 3825 log_start 3826 run_cmd nettest ${varg} -s & 3827 wait_local_port_listen ${NSA} 12345 tcp 3828 run_cmd nettest ${varg} -d ${VRF} -r ${a} & 3829 sleep 3 3830 run_cmd ip link del ${VRF} 3831 sleep 1 3832 log_test_addr ${a} 0 0 "${desc}, global server, VRF client" 3833 3834 setup ${with_vrf} 3835 done 3836 3837 for a in ${NSA_IP6} ${VRF_IP6} 3838 do 3839 log_start 3840 run_cmd nettest ${varg} -I ${VRF} -s & 3841 wait_local_port_listen ${NSA} 12345 tcp 3842 run_cmd nettest ${varg} -d ${VRF} -r ${a} & 3843 sleep 3 3844 run_cmd ip link del ${VRF} 3845 sleep 1 3846 log_test_addr ${a} 0 0 "${desc}, VRF server and client" 3847 3848 setup ${with_vrf} 3849 done 3850 3851 a=${NSA_IP6} 3852 log_start 3853 run_cmd nettest ${varg} -s & 3854 wait_local_port_listen ${NSA} 12345 tcp 3855 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & 3856 sleep 3 3857 run_cmd ip link del ${VRF} 3858 sleep 1 3859 log_test_addr ${a} 0 0 "${desc}, global server, device client" 3860 3861 setup ${with_vrf} 3862 3863 log_start 3864 run_cmd nettest ${varg} -I ${VRF} -s & 3865 wait_local_port_listen ${NSA} 12345 tcp 3866 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & 3867 sleep 3 3868 run_cmd ip link del ${VRF} 3869 sleep 1 3870 log_test_addr ${a} 0 0 "${desc}, VRF server, device client" 3871 3872 setup ${with_vrf} 3873 3874 log_start 3875 run_cmd nettest ${varg} -I ${NSA_DEV} -s & 3876 wait_local_port_listen ${NSA} 12345 tcp 3877 run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & 3878 sleep 3 3879 run_cmd ip link del ${VRF} 3880 sleep 1 3881 log_test_addr ${a} 0 0 "${desc}, device server, device client" 3882} 3883 3884ipv6_ping_rt() 3885{ 3886 local with_vrf="yes" 3887 local a 3888 3889 a=${NSA_IP6} 3890 log_start 3891 run_cmd_nsb ${ping6} -f ${a} & 3892 sleep 3 3893 run_cmd ip link del ${VRF} 3894 sleep 1 3895 log_test_addr ${a} 0 0 "Device delete with active traffic - ping in" 3896 3897 setup ${with_vrf} 3898 3899 log_start 3900 run_cmd ${ping6} -f ${NSB_IP6} -I ${VRF} & 3901 sleep 1 3902 run_cmd ip link del ${VRF} 3903 sleep 1 3904 log_test_addr ${a} 0 0 "Device delete with active traffic - ping out" 3905} 3906 3907ipv6_runtime() 3908{ 3909 log_section "Run time tests - ipv6" 3910 3911 setup "yes" 3912 ipv6_ping_rt 3913 3914 setup "yes" 3915 ipv6_rt "TCP active socket" "-n -1" 3916 3917 setup "yes" 3918 ipv6_rt "TCP passive socket" "-i" 3919 3920 setup "yes" 3921 ipv6_rt "UDP active socket" "-D -n -1" 3922} 3923 3924################################################################################ 3925# netfilter blocking connections 3926 3927netfilter_tcp_reset() 3928{ 3929 local a 3930 3931 for a in ${NSA_IP} ${VRF_IP} 3932 do 3933 log_start 3934 run_cmd nettest -s & 3935 wait_local_port_listen ${NSA} 12345 tcp 3936 run_cmd_nsb nettest -r ${a} 3937 log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx" 3938 done 3939} 3940 3941netfilter_icmp() 3942{ 3943 local stype="$1" 3944 local arg 3945 local a 3946 3947 [ "${stype}" = "UDP" ] && arg="-D" 3948 3949 for a in ${NSA_IP} ${VRF_IP} 3950 do 3951 log_start 3952 run_cmd nettest ${arg} -s & 3953 wait_local_port_listen ${NSA} 12345 tcp 3954 run_cmd_nsb nettest ${arg} -r ${a} 3955 log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach" 3956 done 3957} 3958 3959ipv4_netfilter() 3960{ 3961 log_section "IPv4 Netfilter" 3962 log_subsection "TCP reset" 3963 3964 setup "yes" 3965 run_cmd iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset 3966 3967 netfilter_tcp_reset 3968 3969 log_start 3970 log_subsection "ICMP unreachable" 3971 3972 log_start 3973 run_cmd iptables -F 3974 run_cmd iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp-port-unreachable 3975 run_cmd iptables -A INPUT -p udp --dport 12345 -j REJECT --reject-with icmp-port-unreachable 3976 3977 netfilter_icmp "TCP" 3978 netfilter_icmp "UDP" 3979 3980 log_start 3981 iptables -F 3982} 3983 3984netfilter_tcp6_reset() 3985{ 3986 local a 3987 3988 for a in ${NSA_IP6} ${VRF_IP6} 3989 do 3990 log_start 3991 run_cmd nettest -6 -s & 3992 wait_local_port_listen ${NSA} 12345 tcp 3993 run_cmd_nsb nettest -6 -r ${a} 3994 log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx" 3995 done 3996} 3997 3998netfilter_icmp6() 3999{ 4000 local stype="$1" 4001 local arg 4002 local a 4003 4004 [ "${stype}" = "UDP" ] && arg="$arg -D" 4005 4006 for a in ${NSA_IP6} ${VRF_IP6} 4007 do 4008 log_start 4009 run_cmd nettest -6 -s ${arg} & 4010 wait_local_port_listen ${NSA} 12345 tcp 4011 run_cmd_nsb nettest -6 ${arg} -r ${a} 4012 log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach" 4013 done 4014} 4015 4016ipv6_netfilter() 4017{ 4018 log_section "IPv6 Netfilter" 4019 log_subsection "TCP reset" 4020 4021 setup "yes" 4022 run_cmd ip6tables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset 4023 4024 netfilter_tcp6_reset 4025 4026 log_subsection "ICMP unreachable" 4027 4028 log_start 4029 run_cmd ip6tables -F 4030 run_cmd ip6tables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp6-port-unreachable 4031 run_cmd ip6tables -A INPUT -p udp --dport 12345 -j REJECT --reject-with icmp6-port-unreachable 4032 4033 netfilter_icmp6 "TCP" 4034 netfilter_icmp6 "UDP" 4035 4036 log_start 4037 ip6tables -F 4038} 4039 4040################################################################################ 4041# specific use cases 4042 4043# VRF only. 4044# ns-A device enslaved to bridge. Verify traffic with and without 4045# br_netfilter module loaded. Repeat with SVI on bridge. 4046use_case_br() 4047{ 4048 setup "yes" 4049 4050 setup_cmd ip link set ${NSA_DEV} down 4051 setup_cmd ip addr del dev ${NSA_DEV} ${NSA_IP}/24 4052 setup_cmd ip -6 addr del dev ${NSA_DEV} ${NSA_IP6}/64 4053 4054 setup_cmd ip link add br0 type bridge 4055 setup_cmd ip addr add dev br0 ${NSA_IP}/24 4056 setup_cmd ip -6 addr add dev br0 ${NSA_IP6}/64 nodad 4057 4058 setup_cmd ip li set ${NSA_DEV} master br0 4059 setup_cmd ip li set ${NSA_DEV} up 4060 setup_cmd ip li set br0 up 4061 setup_cmd ip li set br0 vrf ${VRF} 4062 4063 rmmod br_netfilter 2>/dev/null 4064 sleep 5 # DAD 4065 4066 run_cmd ip neigh flush all 4067 run_cmd ping -c1 -w1 -I br0 ${NSB_IP} 4068 log_test $? 0 "Bridge into VRF - IPv4 ping out" 4069 4070 run_cmd ip neigh flush all 4071 run_cmd ${ping6} -c1 -w1 -I br0 ${NSB_IP6} 4072 log_test $? 0 "Bridge into VRF - IPv6 ping out" 4073 4074 run_cmd ip neigh flush all 4075 run_cmd_nsb ping -c1 -w1 ${NSA_IP} 4076 log_test $? 0 "Bridge into VRF - IPv4 ping in" 4077 4078 run_cmd ip neigh flush all 4079 run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6} 4080 log_test $? 0 "Bridge into VRF - IPv6 ping in" 4081 4082 modprobe br_netfilter 4083 if [ $? -eq 0 ]; then 4084 run_cmd ip neigh flush all 4085 run_cmd ping -c1 -w1 -I br0 ${NSB_IP} 4086 log_test $? 0 "Bridge into VRF with br_netfilter - IPv4 ping out" 4087 4088 run_cmd ip neigh flush all 4089 run_cmd ${ping6} -c1 -w1 -I br0 ${NSB_IP6} 4090 log_test $? 0 "Bridge into VRF with br_netfilter - IPv6 ping out" 4091 4092 run_cmd ip neigh flush all 4093 run_cmd_nsb ping -c1 -w1 ${NSA_IP} 4094 log_test $? 0 "Bridge into VRF with br_netfilter - IPv4 ping in" 4095 4096 run_cmd ip neigh flush all 4097 run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6} 4098 log_test $? 0 "Bridge into VRF with br_netfilter - IPv6 ping in" 4099 fi 4100 4101 setup_cmd ip li set br0 nomaster 4102 setup_cmd ip li add br0.100 link br0 type vlan id 100 4103 setup_cmd ip li set br0.100 vrf ${VRF} up 4104 setup_cmd ip addr add dev br0.100 172.16.101.1/24 4105 setup_cmd ip -6 addr add dev br0.100 2001:db8:101::1/64 nodad 4106 4107 setup_cmd_nsb ip li add vlan100 link ${NSB_DEV} type vlan id 100 4108 setup_cmd_nsb ip addr add dev vlan100 172.16.101.2/24 4109 setup_cmd_nsb ip -6 addr add dev vlan100 2001:db8:101::2/64 nodad 4110 setup_cmd_nsb ip li set vlan100 up 4111 sleep 1 4112 4113 rmmod br_netfilter 2>/dev/null 4114 4115 run_cmd ip neigh flush all 4116 run_cmd ping -c1 -w1 -I br0.100 172.16.101.2 4117 log_test $? 0 "Bridge vlan into VRF - IPv4 ping out" 4118 4119 run_cmd ip neigh flush all 4120 run_cmd ${ping6} -c1 -w1 -I br0.100 2001:db8:101::2 4121 log_test $? 0 "Bridge vlan into VRF - IPv6 ping out" 4122 4123 run_cmd ip neigh flush all 4124 run_cmd_nsb ping -c1 -w1 172.16.101.1 4125 log_test $? 0 "Bridge vlan into VRF - IPv4 ping in" 4126 4127 run_cmd ip neigh flush all 4128 run_cmd_nsb ${ping6} -c1 -w1 2001:db8:101::1 4129 log_test $? 0 "Bridge vlan into VRF - IPv6 ping in" 4130 4131 modprobe br_netfilter 4132 if [ $? -eq 0 ]; then 4133 run_cmd ip neigh flush all 4134 run_cmd ping -c1 -w1 -I br0.100 172.16.101.2 4135 log_test $? 0 "Bridge vlan into VRF with br_netfilter - IPv4 ping out" 4136 4137 run_cmd ip neigh flush all 4138 run_cmd ${ping6} -c1 -w1 -I br0.100 2001:db8:101::2 4139 log_test $? 0 "Bridge vlan into VRF with br_netfilter - IPv6 ping out" 4140 4141 run_cmd ip neigh flush all 4142 run_cmd_nsb ping -c1 -w1 172.16.101.1 4143 log_test $? 0 "Bridge vlan into VRF - IPv4 ping in" 4144 4145 run_cmd ip neigh flush all 4146 run_cmd_nsb ${ping6} -c1 -w1 2001:db8:101::1 4147 log_test $? 0 "Bridge vlan into VRF - IPv6 ping in" 4148 fi 4149 4150 setup_cmd ip li del br0 2>/dev/null 4151 setup_cmd_nsb ip li del vlan100 2>/dev/null 4152} 4153 4154# VRF only. 4155# ns-A device is connected to both ns-B and ns-C on a single VRF but only has 4156# LLA on the interfaces 4157use_case_ping_lla_multi() 4158{ 4159 setup_lla_only 4160 # only want reply from ns-A 4161 setup_cmd_nsb sysctl -qw net.ipv6.icmp.echo_ignore_multicast=1 4162 setup_cmd_nsc sysctl -qw net.ipv6.icmp.echo_ignore_multicast=1 4163 4164 log_start 4165 run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV} 4166 log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Pre cycle, ping out ns-B" 4167 4168 run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV} 4169 log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Pre cycle, ping out ns-C" 4170 4171 # cycle/flap the first ns-A interface 4172 setup_cmd ip link set ${NSA_DEV} down 4173 setup_cmd ip link set ${NSA_DEV} up 4174 sleep 1 4175 4176 log_start 4177 run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV} 4178 log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-B" 4179 run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV} 4180 log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-C" 4181 4182 # cycle/flap the second ns-A interface 4183 setup_cmd ip link set ${NSA_DEV2} down 4184 setup_cmd ip link set ${NSA_DEV2} up 4185 sleep 1 4186 4187 log_start 4188 run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV} 4189 log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-B" 4190 run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV} 4191 log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-C" 4192} 4193 4194# Perform IPv{4,6} SNAT on ns-A, and verify TCP connection is successfully 4195# established with ns-B. 4196use_case_snat_on_vrf() 4197{ 4198 setup "yes" 4199 4200 local port="12345" 4201 4202 run_cmd iptables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP} -o ${VRF} 4203 run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF} 4204 4205 run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} & 4206 wait_local_port_listen ${NSB} ${port} tcp 4207 run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port} 4208 log_test $? 0 "IPv4 TCP connection over VRF with SNAT" 4209 4210 run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} & 4211 wait_local_port_listen ${NSB} ${port} tcp 4212 run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port} 4213 log_test $? 0 "IPv6 TCP connection over VRF with SNAT" 4214 4215 # Cleanup 4216 run_cmd iptables -t nat -D POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP} -o ${VRF} 4217 run_cmd ip6tables -t nat -D POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF} 4218} 4219 4220use_cases() 4221{ 4222 log_section "Use cases" 4223 log_subsection "Device enslaved to bridge" 4224 use_case_br 4225 log_subsection "Ping LLA with multiple interfaces" 4226 use_case_ping_lla_multi 4227 log_subsection "SNAT on VRF" 4228 use_case_snat_on_vrf 4229} 4230 4231################################################################################ 4232# usage 4233 4234usage() 4235{ 4236 cat <<EOF 4237usage: ${0##*/} OPTS 4238 4239 -4 IPv4 tests only 4240 -6 IPv6 tests only 4241 -t <test> Test name/set to run 4242 -p Pause on fail 4243 -P Pause after each test 4244 -v Be verbose 4245 4246Tests: 4247 $TESTS_IPV4 $TESTS_IPV6 $TESTS_OTHER 4248EOF 4249} 4250 4251################################################################################ 4252# main 4253 4254TESTS_IPV4="ipv4_ping ipv4_tcp ipv4_udp ipv4_bind ipv4_runtime ipv4_netfilter" 4255TESTS_IPV6="ipv6_ping ipv6_tcp ipv6_udp ipv6_bind ipv6_runtime ipv6_netfilter" 4256TESTS_OTHER="use_cases" 4257# note: each TEST_ group needs a dedicated runner, e.g. fcnal-ipv4.sh 4258 4259PAUSE_ON_FAIL=no 4260PAUSE=no 4261 4262while getopts :46t:pPvh o 4263do 4264 case $o in 4265 4) TESTS=ipv4;; 4266 6) TESTS=ipv6;; 4267 t) TESTS=$OPTARG;; 4268 p) PAUSE_ON_FAIL=yes;; 4269 P) PAUSE=yes;; 4270 v) VERBOSE=1;; 4271 h) usage; exit 0;; 4272 *) usage; exit 1;; 4273 esac 4274done 4275 4276# make sure we don't pause twice 4277[ "${PAUSE}" = "yes" ] && PAUSE_ON_FAIL=no 4278 4279# 4280# show user test config 4281# 4282if [ -z "$TESTS" ]; then 4283 TESTS="$TESTS_IPV4 $TESTS_IPV6 $TESTS_OTHER" 4284elif [ "$TESTS" = "ipv4" ]; then 4285 TESTS="$TESTS_IPV4" 4286elif [ "$TESTS" = "ipv6" ]; then 4287 TESTS="$TESTS_IPV6" 4288elif [ "$TESTS" = "other" ]; then 4289 TESTS="$TESTS_OTHER" 4290fi 4291 4292check_gen_prog "nettest" 4293 4294declare -i nfail=0 4295declare -i nsuccess=0 4296 4297for t in $TESTS 4298do 4299 case $t in 4300 ipv4_ping|ping) ipv4_ping;; 4301 ipv4_tcp|tcp) ipv4_tcp;; 4302 ipv4_udp|udp) ipv4_udp;; 4303 ipv4_bind|bind) ipv4_addr_bind;; 4304 ipv4_runtime) ipv4_runtime;; 4305 ipv4_netfilter) ipv4_netfilter;; 4306 4307 ipv6_ping|ping6) ipv6_ping;; 4308 ipv6_tcp|tcp6) ipv6_tcp;; 4309 ipv6_udp|udp6) ipv6_udp;; 4310 ipv6_bind|bind6) ipv6_addr_bind;; 4311 ipv6_runtime) ipv6_runtime;; 4312 ipv6_netfilter) ipv6_netfilter;; 4313 4314 use_cases) use_cases;; 4315 4316 # setup namespaces and config, but do not run any tests 4317 setup) setup; exit 0;; 4318 vrf_setup) setup "yes"; exit 0;; 4319 esac 4320done 4321 4322cleanup 2>/dev/null 4323 4324printf "\nTests passed: %3d\n" ${nsuccess} 4325printf "Tests failed: %3d\n" ${nfail} 4326 4327if [ $nfail -ne 0 ]; then 4328 exit 1 # KSFT_FAIL 4329elif [ $nsuccess -eq 0 ]; then 4330 exit $ksft_skip 4331fi 4332 4333exit 0 # KSFT_PASS 4334