1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3 4# End-to-end eBPF tunnel test suite 5# The script tests BPF network tunnel implementation. 6# 7# Topology: 8# --------- 9# root namespace | at_ns0 namespace 10# | 11# ----------- | ----------- 12# | tnl dev | | | tnl dev | (overlay network) 13# ----------- | ----------- 14# metadata-mode | native-mode 15# with bpf | 16# | 17# ---------- | ---------- 18# | veth1 | --------- | veth0 | (underlay network) 19# ---------- peer ---------- 20# 21# 22# Device Configuration 23# -------------------- 24# Root namespace with metadata-mode tunnel + BPF 25# Device names and addresses: 26# veth1 IP: 172.16.1.200, IPv6: 00::22 (underlay) 27# tunnel dev <type>11, ex: gre11, IPv4: 10.1.1.200, IPv6: 1::22 (overlay) 28# 29# Namespace at_ns0 with native tunnel 30# Device names and addresses: 31# veth0 IPv4: 172.16.1.100, IPv6: 00::11 (underlay) 32# tunnel dev <type>00, ex: gre00, IPv4: 10.1.1.100, IPv6: 1::11 (overlay) 33# 34# 35# End-to-end ping packet flow 36# --------------------------- 37# Most of the tests start by namespace creation, device configuration, 38# then ping the underlay and overlay network. When doing 'ping 10.1.1.100' 39# from root namespace, the following operations happen: 40# 1) Route lookup shows 10.1.1.100/24 belongs to tnl dev, fwd to tnl dev. 41# 2) Tnl device's egress BPF program is triggered and set the tunnel metadata, 42# with remote_ip=172.16.1.200 and others. 43# 3) Outer tunnel header is prepended and route the packet to veth1's egress 44# 4) veth0's ingress queue receive the tunneled packet at namespace at_ns0 45# 5) Tunnel protocol handler, ex: vxlan_rcv, decap the packet 46# 6) Forward the packet to the overlay tnl dev 47 48PING_ARG="-c 3 -w 10 -q" 49ret=0 50GREEN='\033[0;92m' 51RED='\033[0;31m' 52NC='\033[0m' # No Color 53 54config_device() 55{ 56 ip netns add at_ns0 57 ip link add veth0 type veth peer name veth1 58 ip link set veth0 netns at_ns0 59 ip netns exec at_ns0 ip addr add 172.16.1.100/24 dev veth0 60 ip netns exec at_ns0 ip link set dev veth0 up 61 ip link set dev veth1 up mtu 1500 62 ip addr add dev veth1 172.16.1.200/24 63} 64 65add_gre_tunnel() 66{ 67 # at_ns0 namespace 68 ip netns exec at_ns0 \ 69 ip link add dev $DEV_NS type $TYPE seq key 2 \ 70 local 172.16.1.100 remote 172.16.1.200 71 ip netns exec at_ns0 ip link set dev $DEV_NS up 72 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 73 74 # root namespace 75 ip link add dev $DEV type $TYPE key 2 external 76 ip link set dev $DEV up 77 ip addr add dev $DEV 10.1.1.200/24 78} 79 80add_ip6gretap_tunnel() 81{ 82 83 # assign ipv6 address 84 ip netns exec at_ns0 ip addr add ::11/96 dev veth0 85 ip netns exec at_ns0 ip link set dev veth0 up 86 ip addr add dev veth1 ::22/96 87 ip link set dev veth1 up 88 89 # at_ns0 namespace 90 ip netns exec at_ns0 \ 91 ip link add dev $DEV_NS type $TYPE seq flowlabel 0xbcdef key 2 \ 92 local ::11 remote ::22 93 94 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 95 ip netns exec at_ns0 ip addr add dev $DEV_NS fc80::100/96 96 ip netns exec at_ns0 ip link set dev $DEV_NS up 97 98 # root namespace 99 ip link add dev $DEV type $TYPE external 100 ip addr add dev $DEV 10.1.1.200/24 101 ip addr add dev $DEV fc80::200/24 102 ip link set dev $DEV up 103} 104 105add_erspan_tunnel() 106{ 107 # at_ns0 namespace 108 if [ "$1" == "v1" ]; then 109 ip netns exec at_ns0 \ 110 ip link add dev $DEV_NS type $TYPE seq key 2 \ 111 local 172.16.1.100 remote 172.16.1.200 \ 112 erspan_ver 1 erspan 123 113 else 114 ip netns exec at_ns0 \ 115 ip link add dev $DEV_NS type $TYPE seq key 2 \ 116 local 172.16.1.100 remote 172.16.1.200 \ 117 erspan_ver 2 erspan_dir egress erspan_hwid 3 118 fi 119 ip netns exec at_ns0 ip link set dev $DEV_NS up 120 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 121 122 # root namespace 123 ip link add dev $DEV type $TYPE external 124 ip link set dev $DEV up 125 ip addr add dev $DEV 10.1.1.200/24 126} 127 128add_ip6erspan_tunnel() 129{ 130 131 # assign ipv6 address 132 ip netns exec at_ns0 ip addr add ::11/96 dev veth0 133 ip netns exec at_ns0 ip link set dev veth0 up 134 ip addr add dev veth1 ::22/96 135 ip link set dev veth1 up 136 137 # at_ns0 namespace 138 if [ "$1" == "v1" ]; then 139 ip netns exec at_ns0 \ 140 ip link add dev $DEV_NS type $TYPE seq key 2 \ 141 local ::11 remote ::22 \ 142 erspan_ver 1 erspan 123 143 else 144 ip netns exec at_ns0 \ 145 ip link add dev $DEV_NS type $TYPE seq key 2 \ 146 local ::11 remote ::22 \ 147 erspan_ver 2 erspan_dir egress erspan_hwid 7 148 fi 149 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 150 ip netns exec at_ns0 ip link set dev $DEV_NS up 151 152 # root namespace 153 ip link add dev $DEV type $TYPE external 154 ip addr add dev $DEV 10.1.1.200/24 155 ip link set dev $DEV up 156} 157 158add_vxlan_tunnel() 159{ 160 # Set static ARP entry here because iptables set-mark works 161 # on L3 packet, as a result not applying to ARP packets, 162 # causing errors at get_tunnel_{key/opt}. 163 164 # at_ns0 namespace 165 ip netns exec at_ns0 \ 166 ip link add dev $DEV_NS type $TYPE \ 167 id 2 dstport 4789 gbp remote 172.16.1.200 168 ip netns exec at_ns0 \ 169 ip link set dev $DEV_NS address 52:54:00:d9:01:00 up 170 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 171 ip netns exec at_ns0 arp -s 10.1.1.200 52:54:00:d9:02:00 172 ip netns exec at_ns0 iptables -A OUTPUT -j MARK --set-mark 0x800FF 173 174 # root namespace 175 ip link add dev $DEV type $TYPE external gbp dstport 4789 176 ip link set dev $DEV address 52:54:00:d9:02:00 up 177 ip addr add dev $DEV 10.1.1.200/24 178 arp -s 10.1.1.100 52:54:00:d9:01:00 179} 180 181add_ip6vxlan_tunnel() 182{ 183 #ip netns exec at_ns0 ip -4 addr del 172.16.1.100 dev veth0 184 ip netns exec at_ns0 ip -6 addr add ::11/96 dev veth0 185 ip netns exec at_ns0 ip link set dev veth0 up 186 #ip -4 addr del 172.16.1.200 dev veth1 187 ip -6 addr add dev veth1 ::22/96 188 ip link set dev veth1 up 189 190 # at_ns0 namespace 191 ip netns exec at_ns0 \ 192 ip link add dev $DEV_NS type $TYPE id 22 dstport 4789 \ 193 local ::11 remote ::22 194 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 195 ip netns exec at_ns0 ip link set dev $DEV_NS up 196 197 # root namespace 198 ip link add dev $DEV type $TYPE external dstport 4789 199 ip addr add dev $DEV 10.1.1.200/24 200 ip link set dev $DEV up 201} 202 203add_geneve_tunnel() 204{ 205 # at_ns0 namespace 206 ip netns exec at_ns0 \ 207 ip link add dev $DEV_NS type $TYPE \ 208 id 2 dstport 6081 remote 172.16.1.200 209 ip netns exec at_ns0 ip link set dev $DEV_NS up 210 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 211 212 # root namespace 213 ip link add dev $DEV type $TYPE dstport 6081 external 214 ip link set dev $DEV up 215 ip addr add dev $DEV 10.1.1.200/24 216} 217 218add_ip6geneve_tunnel() 219{ 220 ip netns exec at_ns0 ip addr add ::11/96 dev veth0 221 ip netns exec at_ns0 ip link set dev veth0 up 222 ip addr add dev veth1 ::22/96 223 ip link set dev veth1 up 224 225 # at_ns0 namespace 226 ip netns exec at_ns0 \ 227 ip link add dev $DEV_NS type $TYPE id 22 \ 228 remote ::22 # geneve has no local option 229 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 230 ip netns exec at_ns0 ip link set dev $DEV_NS up 231 232 # root namespace 233 ip link add dev $DEV type $TYPE external 234 ip addr add dev $DEV 10.1.1.200/24 235 ip link set dev $DEV up 236} 237 238add_ipip_tunnel() 239{ 240 # at_ns0 namespace 241 ip netns exec at_ns0 \ 242 ip link add dev $DEV_NS type $TYPE \ 243 local 172.16.1.100 remote 172.16.1.200 244 ip netns exec at_ns0 ip link set dev $DEV_NS up 245 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 246 247 # root namespace 248 ip link add dev $DEV type $TYPE external 249 ip link set dev $DEV up 250 ip addr add dev $DEV 10.1.1.200/24 251} 252 253add_ip6tnl_tunnel() 254{ 255 ip netns exec at_ns0 ip addr add ::11/96 dev veth0 256 ip netns exec at_ns0 ip link set dev veth0 up 257 ip addr add dev veth1 ::22/96 258 ip link set dev veth1 up 259 260 # at_ns0 namespace 261 ip netns exec at_ns0 \ 262 ip link add dev $DEV_NS type $TYPE \ 263 local ::11 remote ::22 264 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 265 ip netns exec at_ns0 ip addr add dev $DEV_NS 1::11/96 266 ip netns exec at_ns0 ip link set dev $DEV_NS up 267 268 # root namespace 269 ip link add dev $DEV type $TYPE external 270 ip addr add dev $DEV 10.1.1.200/24 271 ip addr add dev $DEV 1::22/96 272 ip link set dev $DEV up 273} 274 275test_gre() 276{ 277 TYPE=gretap 278 DEV_NS=gretap00 279 DEV=gretap11 280 ret=0 281 282 check $TYPE 283 config_device 284 add_gre_tunnel 285 attach_bpf $DEV gre_set_tunnel gre_get_tunnel 286 ping $PING_ARG 10.1.1.100 287 check_err $? 288 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 289 check_err $? 290 cleanup 291 292 if [ $ret -ne 0 ]; then 293 echo -e ${RED}"FAIL: $TYPE"${NC} 294 return 1 295 fi 296 echo -e ${GREEN}"PASS: $TYPE"${NC} 297} 298 299test_ip6gre() 300{ 301 TYPE=ip6gre 302 DEV_NS=ip6gre00 303 DEV=ip6gre11 304 ret=0 305 306 check $TYPE 307 config_device 308 # reuse the ip6gretap function 309 add_ip6gretap_tunnel 310 attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel 311 # underlay 312 ping6 $PING_ARG ::11 313 # overlay: ipv4 over ipv6 314 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 315 ping $PING_ARG 10.1.1.100 316 check_err $? 317 # overlay: ipv6 over ipv6 318 ip netns exec at_ns0 ping6 $PING_ARG fc80::200 319 check_err $? 320 cleanup 321 322 if [ $ret -ne 0 ]; then 323 echo -e ${RED}"FAIL: $TYPE"${NC} 324 return 1 325 fi 326 echo -e ${GREEN}"PASS: $TYPE"${NC} 327} 328 329test_ip6gretap() 330{ 331 TYPE=ip6gretap 332 DEV_NS=ip6gretap00 333 DEV=ip6gretap11 334 ret=0 335 336 check $TYPE 337 config_device 338 add_ip6gretap_tunnel 339 attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel 340 # underlay 341 ping6 $PING_ARG ::11 342 # overlay: ipv4 over ipv6 343 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 344 ping $PING_ARG 10.1.1.100 345 check_err $? 346 # overlay: ipv6 over ipv6 347 ip netns exec at_ns0 ping6 $PING_ARG fc80::200 348 check_err $? 349 cleanup 350 351 if [ $ret -ne 0 ]; then 352 echo -e ${RED}"FAIL: $TYPE"${NC} 353 return 1 354 fi 355 echo -e ${GREEN}"PASS: $TYPE"${NC} 356} 357 358test_erspan() 359{ 360 TYPE=erspan 361 DEV_NS=erspan00 362 DEV=erspan11 363 ret=0 364 365 check $TYPE 366 config_device 367 add_erspan_tunnel $1 368 attach_bpf $DEV erspan_set_tunnel erspan_get_tunnel 369 ping $PING_ARG 10.1.1.100 370 check_err $? 371 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 372 check_err $? 373 cleanup 374 375 if [ $ret -ne 0 ]; then 376 echo -e ${RED}"FAIL: $TYPE"${NC} 377 return 1 378 fi 379 echo -e ${GREEN}"PASS: $TYPE"${NC} 380} 381 382test_ip6erspan() 383{ 384 TYPE=ip6erspan 385 DEV_NS=ip6erspan00 386 DEV=ip6erspan11 387 ret=0 388 389 check $TYPE 390 config_device 391 add_ip6erspan_tunnel $1 392 attach_bpf $DEV ip4ip6erspan_set_tunnel ip4ip6erspan_get_tunnel 393 ping6 $PING_ARG ::11 394 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 395 check_err $? 396 cleanup 397 398 if [ $ret -ne 0 ]; then 399 echo -e ${RED}"FAIL: $TYPE"${NC} 400 return 1 401 fi 402 echo -e ${GREEN}"PASS: $TYPE"${NC} 403} 404 405test_vxlan() 406{ 407 TYPE=vxlan 408 DEV_NS=vxlan00 409 DEV=vxlan11 410 ret=0 411 412 check $TYPE 413 config_device 414 add_vxlan_tunnel 415 attach_bpf $DEV vxlan_set_tunnel vxlan_get_tunnel 416 ping $PING_ARG 10.1.1.100 417 check_err $? 418 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 419 check_err $? 420 cleanup 421 422 if [ $ret -ne 0 ]; then 423 echo -e ${RED}"FAIL: $TYPE"${NC} 424 return 1 425 fi 426 echo -e ${GREEN}"PASS: $TYPE"${NC} 427} 428 429test_ip6vxlan() 430{ 431 TYPE=vxlan 432 DEV_NS=ip6vxlan00 433 DEV=ip6vxlan11 434 ret=0 435 436 check $TYPE 437 config_device 438 add_ip6vxlan_tunnel 439 ip link set dev veth1 mtu 1500 440 attach_bpf $DEV ip6vxlan_set_tunnel ip6vxlan_get_tunnel 441 # underlay 442 ping6 $PING_ARG ::11 443 # ip4 over ip6 444 ping $PING_ARG 10.1.1.100 445 check_err $? 446 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 447 check_err $? 448 cleanup 449 450 if [ $ret -ne 0 ]; then 451 echo -e ${RED}"FAIL: ip6$TYPE"${NC} 452 return 1 453 fi 454 echo -e ${GREEN}"PASS: ip6$TYPE"${NC} 455} 456 457test_geneve() 458{ 459 TYPE=geneve 460 DEV_NS=geneve00 461 DEV=geneve11 462 ret=0 463 464 check $TYPE 465 config_device 466 add_geneve_tunnel 467 attach_bpf $DEV geneve_set_tunnel geneve_get_tunnel 468 ping $PING_ARG 10.1.1.100 469 check_err $? 470 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 471 check_err $? 472 cleanup 473 474 if [ $ret -ne 0 ]; then 475 echo -e ${RED}"FAIL: $TYPE"${NC} 476 return 1 477 fi 478 echo -e ${GREEN}"PASS: $TYPE"${NC} 479} 480 481test_ip6geneve() 482{ 483 TYPE=geneve 484 DEV_NS=ip6geneve00 485 DEV=ip6geneve11 486 ret=0 487 488 check $TYPE 489 config_device 490 add_ip6geneve_tunnel 491 attach_bpf $DEV ip6geneve_set_tunnel ip6geneve_get_tunnel 492 ping $PING_ARG 10.1.1.100 493 check_err $? 494 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 495 check_err $? 496 cleanup 497 498 if [ $ret -ne 0 ]; then 499 echo -e ${RED}"FAIL: ip6$TYPE"${NC} 500 return 1 501 fi 502 echo -e ${GREEN}"PASS: ip6$TYPE"${NC} 503} 504 505test_ipip() 506{ 507 TYPE=ipip 508 DEV_NS=ipip00 509 DEV=ipip11 510 ret=0 511 512 check $TYPE 513 config_device 514 add_ipip_tunnel 515 ip link set dev veth1 mtu 1500 516 attach_bpf $DEV ipip_set_tunnel ipip_get_tunnel 517 ping $PING_ARG 10.1.1.100 518 check_err $? 519 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 520 check_err $? 521 cleanup 522 523 if [ $ret -ne 0 ]; then 524 echo -e ${RED}"FAIL: $TYPE"${NC} 525 return 1 526 fi 527 echo -e ${GREEN}"PASS: $TYPE"${NC} 528} 529 530test_ipip6() 531{ 532 TYPE=ip6tnl 533 DEV_NS=ipip6tnl00 534 DEV=ipip6tnl11 535 ret=0 536 537 check $TYPE 538 config_device 539 add_ip6tnl_tunnel 540 ip link set dev veth1 mtu 1500 541 attach_bpf $DEV ipip6_set_tunnel ipip6_get_tunnel 542 # underlay 543 ping6 $PING_ARG ::11 544 # ip4 over ip6 545 ping $PING_ARG 10.1.1.100 546 check_err $? 547 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 548 check_err $? 549 cleanup 550 551 if [ $ret -ne 0 ]; then 552 echo -e ${RED}"FAIL: $TYPE"${NC} 553 return 1 554 fi 555 echo -e ${GREEN}"PASS: $TYPE"${NC} 556} 557 558test_ip6ip6() 559{ 560 TYPE=ip6tnl 561 DEV_NS=ip6ip6tnl00 562 DEV=ip6ip6tnl11 563 ret=0 564 565 check $TYPE 566 config_device 567 add_ip6tnl_tunnel 568 ip link set dev veth1 mtu 1500 569 attach_bpf $DEV ip6ip6_set_tunnel ip6ip6_get_tunnel 570 # underlay 571 ping6 $PING_ARG ::11 572 # ip6 over ip6 573 ping6 $PING_ARG 1::11 574 check_err $? 575 ip netns exec at_ns0 ping6 $PING_ARG 1::22 576 check_err $? 577 cleanup 578 579 if [ $ret -ne 0 ]; then 580 echo -e ${RED}"FAIL: ip6$TYPE"${NC} 581 return 1 582 fi 583 echo -e ${GREEN}"PASS: ip6$TYPE"${NC} 584} 585 586setup_xfrm_tunnel() 587{ 588 auth=0x$(printf '1%.0s' {1..40}) 589 enc=0x$(printf '2%.0s' {1..32}) 590 spi_in_to_out=0x1 591 spi_out_to_in=0x2 592 # at_ns0 namespace 593 # at_ns0 -> root 594 ip netns exec at_ns0 \ 595 ip xfrm state add src 172.16.1.100 dst 172.16.1.200 proto esp \ 596 spi $spi_in_to_out reqid 1 mode tunnel \ 597 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc 598 ip netns exec at_ns0 \ 599 ip xfrm policy add src 10.1.1.100/32 dst 10.1.1.200/32 dir out \ 600 tmpl src 172.16.1.100 dst 172.16.1.200 proto esp reqid 1 \ 601 mode tunnel 602 # root -> at_ns0 603 ip netns exec at_ns0 \ 604 ip xfrm state add src 172.16.1.200 dst 172.16.1.100 proto esp \ 605 spi $spi_out_to_in reqid 2 mode tunnel \ 606 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc 607 ip netns exec at_ns0 \ 608 ip xfrm policy add src 10.1.1.200/32 dst 10.1.1.100/32 dir in \ 609 tmpl src 172.16.1.200 dst 172.16.1.100 proto esp reqid 2 \ 610 mode tunnel 611 # address & route 612 ip netns exec at_ns0 \ 613 ip addr add dev veth0 10.1.1.100/32 614 ip netns exec at_ns0 \ 615 ip route add 10.1.1.200 dev veth0 via 172.16.1.200 \ 616 src 10.1.1.100 617 618 # root namespace 619 # at_ns0 -> root 620 ip xfrm state add src 172.16.1.100 dst 172.16.1.200 proto esp \ 621 spi $spi_in_to_out reqid 1 mode tunnel \ 622 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc 623 ip xfrm policy add src 10.1.1.100/32 dst 10.1.1.200/32 dir in \ 624 tmpl src 172.16.1.100 dst 172.16.1.200 proto esp reqid 1 \ 625 mode tunnel 626 # root -> at_ns0 627 ip xfrm state add src 172.16.1.200 dst 172.16.1.100 proto esp \ 628 spi $spi_out_to_in reqid 2 mode tunnel \ 629 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc 630 ip xfrm policy add src 10.1.1.200/32 dst 10.1.1.100/32 dir out \ 631 tmpl src 172.16.1.200 dst 172.16.1.100 proto esp reqid 2 \ 632 mode tunnel 633 # address & route 634 ip addr add dev veth1 10.1.1.200/32 635 ip route add 10.1.1.100 dev veth1 via 172.16.1.100 src 10.1.1.200 636} 637 638test_xfrm_tunnel() 639{ 640 config_device 641 > /sys/kernel/debug/tracing/trace 642 setup_xfrm_tunnel 643 tc qdisc add dev veth1 clsact 644 tc filter add dev veth1 proto ip ingress bpf da obj test_tunnel_kern.o \ 645 sec xfrm_get_state 646 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 647 sleep 1 648 grep "reqid 1" /sys/kernel/debug/tracing/trace 649 check_err $? 650 grep "spi 0x1" /sys/kernel/debug/tracing/trace 651 check_err $? 652 grep "remote ip 0xac100164" /sys/kernel/debug/tracing/trace 653 check_err $? 654 cleanup 655 656 if [ $ret -ne 0 ]; then 657 echo -e ${RED}"FAIL: xfrm tunnel"${NC} 658 return 1 659 fi 660 echo -e ${GREEN}"PASS: xfrm tunnel"${NC} 661} 662 663attach_bpf() 664{ 665 DEV=$1 666 SET=$2 667 GET=$3 668 tc qdisc add dev $DEV clsact 669 tc filter add dev $DEV egress bpf da obj test_tunnel_kern.o sec $SET 670 tc filter add dev $DEV ingress bpf da obj test_tunnel_kern.o sec $GET 671} 672 673cleanup() 674{ 675 ip netns delete at_ns0 2> /dev/null 676 ip link del veth1 2> /dev/null 677 ip link del ipip11 2> /dev/null 678 ip link del ipip6tnl11 2> /dev/null 679 ip link del ip6ip6tnl11 2> /dev/null 680 ip link del gretap11 2> /dev/null 681 ip link del ip6gre11 2> /dev/null 682 ip link del ip6gretap11 2> /dev/null 683 ip link del vxlan11 2> /dev/null 684 ip link del ip6vxlan11 2> /dev/null 685 ip link del geneve11 2> /dev/null 686 ip link del ip6geneve11 2> /dev/null 687 ip link del erspan11 2> /dev/null 688 ip link del ip6erspan11 2> /dev/null 689 ip xfrm policy delete dir out src 10.1.1.200/32 dst 10.1.1.100/32 2> /dev/null 690 ip xfrm policy delete dir in src 10.1.1.100/32 dst 10.1.1.200/32 2> /dev/null 691 ip xfrm state delete src 172.16.1.100 dst 172.16.1.200 proto esp spi 0x1 2> /dev/null 692 ip xfrm state delete src 172.16.1.200 dst 172.16.1.100 proto esp spi 0x2 2> /dev/null 693} 694 695cleanup_exit() 696{ 697 echo "CATCH SIGKILL or SIGINT, cleanup and exit" 698 cleanup 699 exit 0 700} 701 702check() 703{ 704 ip link help 2>&1 | grep -q "\s$1\s" 705 if [ $? -ne 0 ];then 706 echo "SKIP $1: iproute2 not support" 707 cleanup 708 return 1 709 fi 710} 711 712enable_debug() 713{ 714 echo 'file ip_gre.c +p' > /sys/kernel/debug/dynamic_debug/control 715 echo 'file ip6_gre.c +p' > /sys/kernel/debug/dynamic_debug/control 716 echo 'file vxlan.c +p' > /sys/kernel/debug/dynamic_debug/control 717 echo 'file geneve.c +p' > /sys/kernel/debug/dynamic_debug/control 718 echo 'file ipip.c +p' > /sys/kernel/debug/dynamic_debug/control 719} 720 721check_err() 722{ 723 if [ $ret -eq 0 ]; then 724 ret=$1 725 fi 726} 727 728bpf_tunnel_test() 729{ 730 local errors=0 731 732 echo "Testing GRE tunnel..." 733 test_gre 734 errors=$(( $errors + $? )) 735 736 echo "Testing IP6GRE tunnel..." 737 test_ip6gre 738 errors=$(( $errors + $? )) 739 740 echo "Testing IP6GRETAP tunnel..." 741 test_ip6gretap 742 errors=$(( $errors + $? )) 743 744 echo "Testing ERSPAN tunnel..." 745 test_erspan v2 746 errors=$(( $errors + $? )) 747 748 echo "Testing IP6ERSPAN tunnel..." 749 test_ip6erspan v2 750 errors=$(( $errors + $? )) 751 752 echo "Testing VXLAN tunnel..." 753 test_vxlan 754 errors=$(( $errors + $? )) 755 756 echo "Testing IP6VXLAN tunnel..." 757 test_ip6vxlan 758 errors=$(( $errors + $? )) 759 760 echo "Testing GENEVE tunnel..." 761 test_geneve 762 errors=$(( $errors + $? )) 763 764 echo "Testing IP6GENEVE tunnel..." 765 test_ip6geneve 766 errors=$(( $errors + $? )) 767 768 echo "Testing IPIP tunnel..." 769 test_ipip 770 errors=$(( $errors + $? )) 771 772 echo "Testing IPIP6 tunnel..." 773 test_ipip6 774 errors=$(( $errors + $? )) 775 776 echo "Testing IP6IP6 tunnel..." 777 test_ip6ip6 778 errors=$(( $errors + $? )) 779 780 echo "Testing IPSec tunnel..." 781 test_xfrm_tunnel 782 errors=$(( $errors + $? )) 783 784 return $errors 785} 786 787trap cleanup 0 3 6 788trap cleanup_exit 2 9 789 790cleanup 791bpf_tunnel_test 792 793if [ $? -ne 0 ]; then 794 echo -e "$(basename $0): ${RED}FAIL${NC}" 795 exit 1 796fi 797echo -e "$(basename $0): ${GREEN}PASS${NC}" 798exit 0 799