xref: /linux/tools/testing/selftests/wireguard/netns.sh (revision 24bce201d79807b668bf9d9e0aca801c5c0d5f78) 
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
5#
6# This script tests the below topology:
7#
8# ┌─────────────────────┐   ┌──────────────────────────────────┐   ┌─────────────────────┐
9# │   $ns1 namespace    │   │          $ns0 namespace          │   │   $ns2 namespace    │
10# │                     │   │                                  │   │                     │
11# │┌────────┐           │   │            ┌────────┐            │   │           ┌────────┐│
12# ││  wg0   │───────────┼───┼────────────│   lo   │────────────┼───┼───────────│  wg0   ││
13# │├────────┴──────────┐│   │    ┌───────┴────────┴────────┐   │   │┌──────────┴────────┤│
14# ││192.168.241.1/24   ││   │    │(ns1)         (ns2)      │   │   ││192.168.241.2/24   ││
15# ││fd00::1/24         ││   │    │127.0.0.1:1   127.0.0.1:2│   │   ││fd00::2/24         ││
16# │└───────────────────┘│   │    │[::]:1        [::]:2     │   │   │└───────────────────┘│
17# └─────────────────────┘   │    └─────────────────────────┘   │   └─────────────────────┘
18#                           └──────────────────────────────────┘
19#
20# After the topology is prepared we run a series of TCP/UDP iperf3 tests between the
21# wireguard peers in $ns1 and $ns2. Note that $ns0 is the endpoint for the wg0
22# interfaces in $ns1 and $ns2. See https://www.wireguard.com/netns/ for further
23# details on how this is accomplished.
24set -e
25shopt -s extglob
26
27exec 3>&1
28export LANG=C
29export WG_HIDE_KEYS=never
30NPROC=( /sys/devices/system/cpu/cpu+([0-9]) ); NPROC=${#NPROC[@]}
31netns0="wg-test-$$-0"
32netns1="wg-test-$$-1"
33netns2="wg-test-$$-2"
34pretty() { echo -e "\x1b[32m\x1b[1m[+] ${1:+NS$1: }${2}\x1b[0m" >&3; }
35pp() { pretty "" "$*"; "$@"; }
36maybe_exec() { if [[ $BASHPID -eq $$ ]]; then "$@"; else exec "$@"; fi; }
37n0() { pretty 0 "$*"; maybe_exec ip netns exec $netns0 "$@"; }
38n1() { pretty 1 "$*"; maybe_exec ip netns exec $netns1 "$@"; }
39n2() { pretty 2 "$*"; maybe_exec ip netns exec $netns2 "$@"; }
40ip0() { pretty 0 "ip $*"; ip -n $netns0 "$@"; }
41ip1() { pretty 1 "ip $*"; ip -n $netns1 "$@"; }
42ip2() { pretty 2 "ip $*"; ip -n $netns2 "$@"; }
43sleep() { read -t "$1" -N 1 || true; }
44waitiperf() { pretty "${1//*-}" "wait for iperf:${3:-5201} pid $2"; while [[ $(ss -N "$1" -tlpH "sport = ${3:-5201}") != *\"iperf3\",pid=$2,fd=* ]]; do sleep 0.1; done; }
45waitncatudp() { pretty "${1//*-}" "wait for udp:1111 pid $2"; while [[ $(ss -N "$1" -ulpH 'sport = 1111') != *\"ncat\",pid=$2,fd=* ]]; do sleep 0.1; done; }
46waitiface() { pretty "${1//*-}" "wait for $2 to come up"; ip netns exec "$1" bash -c "while [[ \$(< \"/sys/class/net/$2/operstate\") != up ]]; do read -t .1 -N 0 || true; done;"; }
47
48cleanup() {
49	set +e
50	exec 2>/dev/null
51	printf "$orig_message_cost" > /proc/sys/net/core/message_cost
52	ip0 link del dev wg0
53	ip0 link del dev wg1
54	ip1 link del dev wg0
55	ip1 link del dev wg1
56	ip2 link del dev wg0
57	ip2 link del dev wg1
58	local to_kill="$(ip netns pids $netns0) $(ip netns pids $netns1) $(ip netns pids $netns2)"
59	[[ -n $to_kill ]] && kill $to_kill
60	pp ip netns del $netns1
61	pp ip netns del $netns2
62	pp ip netns del $netns0
63	exit
64}
65
66orig_message_cost="$(< /proc/sys/net/core/message_cost)"
67trap cleanup EXIT
68printf 0 > /proc/sys/net/core/message_cost
69
70ip netns del $netns0 2>/dev/null || true
71ip netns del $netns1 2>/dev/null || true
72ip netns del $netns2 2>/dev/null || true
73pp ip netns add $netns0
74pp ip netns add $netns1
75pp ip netns add $netns2
76ip0 link set up dev lo
77
78ip0 link add dev wg0 type wireguard
79ip0 link set wg0 netns $netns1
80ip0 link add dev wg0 type wireguard
81ip0 link set wg0 netns $netns2
82key1="$(pp wg genkey)"
83key2="$(pp wg genkey)"
84key3="$(pp wg genkey)"
85key4="$(pp wg genkey)"
86pub1="$(pp wg pubkey <<<"$key1")"
87pub2="$(pp wg pubkey <<<"$key2")"
88pub3="$(pp wg pubkey <<<"$key3")"
89pub4="$(pp wg pubkey <<<"$key4")"
90psk="$(pp wg genpsk)"
91[[ -n $key1 && -n $key2 && -n $psk ]]
92
93configure_peers() {
94	ip1 addr add 192.168.241.1/24 dev wg0
95	ip1 addr add fd00::1/112 dev wg0
96
97	ip2 addr add 192.168.241.2/24 dev wg0
98	ip2 addr add fd00::2/112 dev wg0
99
100	n1 wg set wg0 \
101		private-key <(echo "$key1") \
102		listen-port 1 \
103		peer "$pub2" \
104			preshared-key <(echo "$psk") \
105			allowed-ips 192.168.241.2/32,fd00::2/128
106	n2 wg set wg0 \
107		private-key <(echo "$key2") \
108		listen-port 2 \
109		peer "$pub1" \
110			preshared-key <(echo "$psk") \
111			allowed-ips 192.168.241.1/32,fd00::1/128
112
113	ip1 link set up dev wg0
114	ip2 link set up dev wg0
115}
116configure_peers
117
118tests() {
119	# Ping over IPv4
120	n2 ping -c 10 -f -W 1 192.168.241.1
121	n1 ping -c 10 -f -W 1 192.168.241.2
122
123	# Ping over IPv6
124	n2 ping6 -c 10 -f -W 1 fd00::1
125	n1 ping6 -c 10 -f -W 1 fd00::2
126
127	# TCP over IPv4
128	n2 iperf3 -s -1 -B 192.168.241.2 &
129	waitiperf $netns2 $!
130	n1 iperf3 -Z -t 3 -c 192.168.241.2
131
132	# TCP over IPv6
133	n1 iperf3 -s -1 -B fd00::1 &
134	waitiperf $netns1 $!
135	n2 iperf3 -Z -t 3 -c fd00::1
136
137	# UDP over IPv4
138	n1 iperf3 -s -1 -B 192.168.241.1 &
139	waitiperf $netns1 $!
140	n2 iperf3 -Z -t 3 -b 0 -u -c 192.168.241.1
141
142	# UDP over IPv6
143	n2 iperf3 -s -1 -B fd00::2 &
144	waitiperf $netns2 $!
145	n1 iperf3 -Z -t 3 -b 0 -u -c fd00::2
146
147	# TCP over IPv4, in parallel
148	local pids=( ) i
149	for ((i=0; i < NPROC; ++i)) do
150		n2 iperf3 -p $(( 5200 + i )) -s -1 -B 192.168.241.2 &
151		pids+=( $! ); waitiperf $netns2 $! $(( 5200 + i ))
152	done
153	for ((i=0; i < NPROC; ++i)) do
154		n1 iperf3 -Z -t 3 -p $(( 5200 + i )) -c 192.168.241.2 &
155	done
156	wait "${pids[@]}"
157}
158
159[[ $(ip1 link show dev wg0) =~ mtu\ ([0-9]+) ]] && orig_mtu="${BASH_REMATCH[1]}"
160big_mtu=$(( 34816 - 1500 + $orig_mtu ))
161
162# Test using IPv4 as outer transport
163n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
164n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1
165# Before calling tests, we first make sure that the stats counters and timestamper are working
166n2 ping -c 10 -f -W 1 192.168.241.1
167{ read _; read _; read _; read rx_bytes _; read _; read tx_bytes _; } < <(ip2 -stats link show dev wg0)
168(( rx_bytes == 1372 && (tx_bytes == 1428 || tx_bytes == 1460) ))
169{ read _; read _; read _; read rx_bytes _; read _; read tx_bytes _; } < <(ip1 -stats link show dev wg0)
170(( tx_bytes == 1372 && (rx_bytes == 1428 || rx_bytes == 1460) ))
171read _ rx_bytes tx_bytes < <(n2 wg show wg0 transfer)
172(( rx_bytes == 1372 && (tx_bytes == 1428 || tx_bytes == 1460) ))
173read _ rx_bytes tx_bytes < <(n1 wg show wg0 transfer)
174(( tx_bytes == 1372 && (rx_bytes == 1428 || rx_bytes == 1460) ))
175read _ timestamp < <(n1 wg show wg0 latest-handshakes)
176(( timestamp != 0 ))
177
178tests
179ip1 link set wg0 mtu $big_mtu
180ip2 link set wg0 mtu $big_mtu
181tests
182
183ip1 link set wg0 mtu $orig_mtu
184ip2 link set wg0 mtu $orig_mtu
185
186# Test using IPv6 as outer transport
187n1 wg set wg0 peer "$pub2" endpoint [::1]:2
188n2 wg set wg0 peer "$pub1" endpoint [::1]:1
189tests
190ip1 link set wg0 mtu $big_mtu
191ip2 link set wg0 mtu $big_mtu
192tests
193
194# Test that route MTUs work with the padding
195ip1 link set wg0 mtu 1300
196ip2 link set wg0 mtu 1300
197n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
198n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1
199n0 iptables -A INPUT -m length --length 1360 -j DROP
200n1 ip route add 192.168.241.2/32 dev wg0 mtu 1299
201n2 ip route add 192.168.241.1/32 dev wg0 mtu 1299
202n2 ping -c 1 -W 1 -s 1269 192.168.241.1
203n2 ip route delete 192.168.241.1/32 dev wg0 mtu 1299
204n1 ip route delete 192.168.241.2/32 dev wg0 mtu 1299
205n0 iptables -F INPUT
206
207ip1 link set wg0 mtu $orig_mtu
208ip2 link set wg0 mtu $orig_mtu
209
210# Test using IPv4 that roaming works
211ip0 -4 addr del 127.0.0.1/8 dev lo
212ip0 -4 addr add 127.212.121.99/8 dev lo
213n1 wg set wg0 listen-port 9999
214n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
215n1 ping6 -W 1 -c 1 fd00::2
216[[ $(n2 wg show wg0 endpoints) == "$pub1	127.212.121.99:9999" ]]
217
218# Test using IPv6 that roaming works
219n1 wg set wg0 listen-port 9998
220n1 wg set wg0 peer "$pub2" endpoint [::1]:2
221n1 ping -W 1 -c 1 192.168.241.2
222[[ $(n2 wg show wg0 endpoints) == "$pub1	[::1]:9998" ]]
223
224# Test that crypto-RP filter works
225n1 wg set wg0 peer "$pub2" allowed-ips 192.168.241.0/24
226exec 4< <(n1 ncat -l -u -p 1111)
227ncat_pid=$!
228waitncatudp $netns1 $ncat_pid
229n2 ncat -u 192.168.241.1 1111 <<<"X"
230read -r -N 1 -t 1 out <&4 && [[ $out == "X" ]]
231kill $ncat_pid
232more_specific_key="$(pp wg genkey | pp wg pubkey)"
233n1 wg set wg0 peer "$more_specific_key" allowed-ips 192.168.241.2/32
234n2 wg set wg0 listen-port 9997
235exec 4< <(n1 ncat -l -u -p 1111)
236ncat_pid=$!
237waitncatudp $netns1 $ncat_pid
238n2 ncat -u 192.168.241.1 1111 <<<"X"
239! read -r -N 1 -t 1 out <&4 || false
240kill $ncat_pid
241n1 wg set wg0 peer "$more_specific_key" remove
242[[ $(n1 wg show wg0 endpoints) == "$pub2	[::1]:9997" ]]
243
244# Test that we can change private keys keys and immediately handshake
245n1 wg set wg0 private-key <(echo "$key1") peer "$pub2" preshared-key <(echo "$psk") allowed-ips 192.168.241.2/32 endpoint 127.0.0.1:2
246n2 wg set wg0 private-key <(echo "$key2") listen-port 2 peer "$pub1" preshared-key <(echo "$psk") allowed-ips 192.168.241.1/32
247n1 ping -W 1 -c 1 192.168.241.2
248n1 wg set wg0 private-key <(echo "$key3")
249n2 wg set wg0 peer "$pub3" preshared-key <(echo "$psk") allowed-ips 192.168.241.1/32 peer "$pub1" remove
250n1 ping -W 1 -c 1 192.168.241.2
251n2 wg set wg0 peer "$pub3" remove
252
253# Test that we can route wg through wg
254ip1 addr flush dev wg0
255ip2 addr flush dev wg0
256ip1 addr add fd00::5:1/112 dev wg0
257ip2 addr add fd00::5:2/112 dev wg0
258n1 wg set wg0 private-key <(echo "$key1") peer "$pub2" preshared-key <(echo "$psk") allowed-ips fd00::5:2/128 endpoint 127.0.0.1:2
259n2 wg set wg0 private-key <(echo "$key2") listen-port 2 peer "$pub1" preshared-key <(echo "$psk") allowed-ips fd00::5:1/128 endpoint 127.212.121.99:9998
260ip1 link add wg1 type wireguard
261ip2 link add wg1 type wireguard
262ip1 addr add 192.168.241.1/24 dev wg1
263ip1 addr add fd00::1/112 dev wg1
264ip2 addr add 192.168.241.2/24 dev wg1
265ip2 addr add fd00::2/112 dev wg1
266ip1 link set mtu 1340 up dev wg1
267ip2 link set mtu 1340 up dev wg1
268n1 wg set wg1 listen-port 5 private-key <(echo "$key3") peer "$pub4" allowed-ips 192.168.241.2/32,fd00::2/128 endpoint [fd00::5:2]:5
269n2 wg set wg1 listen-port 5 private-key <(echo "$key4") peer "$pub3" allowed-ips 192.168.241.1/32,fd00::1/128 endpoint [fd00::5:1]:5
270tests
271# Try to set up a routing loop between the two namespaces
272ip1 link set netns $netns0 dev wg1
273ip0 addr add 192.168.241.1/24 dev wg1
274ip0 link set up dev wg1
275n0 ping -W 1 -c 1 192.168.241.2
276n1 wg set wg0 peer "$pub2" endpoint 192.168.241.2:7
277ip2 link del wg0
278ip2 link del wg1
279read _ _ tx_bytes_before < <(n0 wg show wg1 transfer)
280! n0 ping -W 1 -c 10 -f 192.168.241.2 || false
281sleep 1
282read _ _ tx_bytes_after < <(n0 wg show wg1 transfer)
283if ! (( tx_bytes_after - tx_bytes_before < 70000 )); then
284	errstart=$'\x1b[37m\x1b[41m\x1b[1m'
285	errend=$'\x1b[0m'
286	echo "${errstart}                                                ${errend}"
287	echo "${errstart}                   E  R  R  O  R                ${errend}"
288	echo "${errstart}                                                ${errend}"
289	echo "${errstart} This architecture does not do the right thing  ${errend}"
290	echo "${errstart} with cross-namespace routing loops. This test  ${errend}"
291	echo "${errstart} has thus technically failed but, as this issue ${errend}"
292	echo "${errstart} is as yet unsolved, these tests will continue  ${errend}"
293	echo "${errstart} onward. :(                                     ${errend}"
294	echo "${errstart}                                                ${errend}"
295fi
296
297ip0 link del wg1
298ip1 link del wg0
299
300# Test using NAT. We now change the topology to this:
301# ┌────────────────────────────────────────┐    ┌────────────────────────────────────────────────┐     ┌────────────────────────────────────────┐
302# │             $ns1 namespace             │    │                 $ns0 namespace                 │     │             $ns2 namespace             │
303# │                                        │    │                                                │     │                                        │
304# │  ┌─────┐             ┌─────┐           │    │    ┌──────┐              ┌──────┐              │     │  ┌─────┐            ┌─────┐            │
305# │  │ wg0 │─────────────│vethc│───────────┼────┼────│vethrc│              │vethrs│──────────────┼─────┼──│veths│────────────│ wg0 │            │
306# │  ├─────┴──────────┐  ├─────┴──────────┐│    │    ├──────┴─────────┐    ├──────┴────────────┐ │     │  ├─────┴──────────┐ ├─────┴──────────┐ │
307# │  │192.168.241.1/24│  │192.168.1.100/24││    │    │192.168.1.1/24  │    │10.0.0.1/24        │ │     │  │10.0.0.100/24   │ │192.168.241.2/24│ │
308# │  │fd00::1/24      │  │                ││    │    │                │    │SNAT:192.168.1.0/24│ │     │  │                │ │fd00::2/24      │ │
309# │  └────────────────┘  └────────────────┘│    │    └────────────────┘    └───────────────────┘ │     │  └────────────────┘ └────────────────┘ │
310# └────────────────────────────────────────┘    └────────────────────────────────────────────────┘     └────────────────────────────────────────┘
311
312ip1 link add dev wg0 type wireguard
313ip2 link add dev wg0 type wireguard
314configure_peers
315
316ip0 link add vethrc type veth peer name vethc
317ip0 link add vethrs type veth peer name veths
318ip0 link set vethc netns $netns1
319ip0 link set veths netns $netns2
320ip0 link set vethrc up
321ip0 link set vethrs up
322ip0 addr add 192.168.1.1/24 dev vethrc
323ip0 addr add 10.0.0.1/24 dev vethrs
324ip1 addr add 192.168.1.100/24 dev vethc
325ip1 link set vethc up
326ip1 route add default via 192.168.1.1
327ip2 addr add 10.0.0.100/24 dev veths
328ip2 link set veths up
329waitiface $netns0 vethrc
330waitiface $netns0 vethrs
331waitiface $netns1 vethc
332waitiface $netns2 veths
333
334n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'
335n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout'
336n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream'
337n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT --to 10.0.0.1
338
339n1 wg set wg0 peer "$pub2" endpoint 10.0.0.100:2 persistent-keepalive 1
340n1 ping -W 1 -c 1 192.168.241.2
341n2 ping -W 1 -c 1 192.168.241.1
342[[ $(n2 wg show wg0 endpoints) == "$pub1	10.0.0.1:1" ]]
343# Demonstrate n2 can still send packets to n1, since persistent-keepalive will prevent connection tracking entry from expiring (to see entries: `n0 conntrack -L`).
344pp sleep 3
345n2 ping -W 1 -c 1 192.168.241.1
346n1 wg set wg0 peer "$pub2" persistent-keepalive 0
347
348# Test that sk_bound_dev_if works
349n1 ping -I wg0 -c 1 -W 1 192.168.241.2
350# What about when the mark changes and the packet must be rerouted?
351n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1
352n1 ping -c 1 -W 1 192.168.241.2 # First the boring case
353n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case
354n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1
355
356# Test that onion routing works, even when it loops
357n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5
358ip1 addr add 192.168.242.1/24 dev wg0
359ip2 link add wg1 type wireguard
360ip2 addr add 192.168.242.2/24 dev wg1
361n2 wg set wg1 private-key <(echo "$key3") listen-port 5 peer "$pub1" allowed-ips 192.168.242.1/32
362ip2 link set wg1 up
363n1 ping -W 1 -c 1 192.168.242.2
364ip2 link del wg1
365n1 wg set wg0 peer "$pub3" endpoint 192.168.242.2:5
366! n1 ping -W 1 -c 1 192.168.242.2 || false # Should not crash kernel
367n1 wg set wg0 peer "$pub3" remove
368ip1 addr del 192.168.242.1/24 dev wg0
369
370# Do a wg-quick(8)-style policy routing for the default route, making sure vethc has a v6 address to tease out bugs.
371ip1 -6 addr add fc00::9/96 dev vethc
372ip1 -6 route add default via fc00::1
373ip2 -4 addr add 192.168.99.7/32 dev wg0
374ip2 -6 addr add abab::1111/128 dev wg0
375n1 wg set wg0 fwmark 51820 peer "$pub2" allowed-ips 192.168.99.7,abab::1111
376ip1 -6 route add default dev wg0 table 51820
377ip1 -6 rule add not fwmark 51820 table 51820
378ip1 -6 rule add table main suppress_prefixlength 0
379ip1 -4 route add default dev wg0 table 51820
380ip1 -4 rule add not fwmark 51820 table 51820
381ip1 -4 rule add table main suppress_prefixlength 0
382n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/vethc/rp_filter'
383# Flood the pings instead of sending just one, to trigger routing table reference counting bugs.
384n1 ping -W 1 -c 100 -f 192.168.99.7
385n1 ping -W 1 -c 100 -f abab::1111
386
387# Have ns2 NAT into wg0 packets from ns0, but return an icmp error along the right route.
388n2 iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 192.168.241.0/24 -j SNAT --to 192.168.241.2
389n0 iptables -t filter -A INPUT \! -s 10.0.0.0/24 -i vethrs -j DROP # Manual rpfilter just to be explicit.
390n2 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'
391ip0 -4 route add 192.168.241.1 via 10.0.0.100
392n2 wg set wg0 peer "$pub1" remove
393[[ $(! n0 ping -W 1 -c 1 192.168.241.1 || false) == *"From 10.0.0.100 icmp_seq=1 Destination Host Unreachable"* ]]
394
395n0 iptables -t nat -F
396n0 iptables -t filter -F
397n2 iptables -t nat -F
398ip0 link del vethrc
399ip0 link del vethrs
400ip1 link del wg0
401ip2 link del wg0
402
403# Test that saddr routing is sticky but not too sticky, changing to this topology:
404# ┌────────────────────────────────────────┐    ┌────────────────────────────────────────┐
405# │             $ns1 namespace             │    │             $ns2 namespace             │
406# │                                        │    │                                        │
407# │  ┌─────┐             ┌─────┐           │    │  ┌─────┐            ┌─────┐            │
408# │  │ wg0 │─────────────│veth1│───────────┼────┼──│veth2│────────────│ wg0 │            │
409# │  ├─────┴──────────┐  ├─────┴──────────┐│    │  ├─────┴──────────┐ ├─────┴──────────┐ │
410# │  │192.168.241.1/24│  │10.0.0.1/24     ││    │  │10.0.0.2/24     │ │192.168.241.2/24│ │
411# │  │fd00::1/24      │  │fd00:aa::1/96   ││    │  │fd00:aa::2/96   │ │fd00::2/24      │ │
412# │  └────────────────┘  └────────────────┘│    │  └────────────────┘ └────────────────┘ │
413# └────────────────────────────────────────┘    └────────────────────────────────────────┘
414
415ip1 link add dev wg0 type wireguard
416ip2 link add dev wg0 type wireguard
417configure_peers
418ip1 link add veth1 type veth peer name veth2
419ip1 link set veth2 netns $netns2
420n1 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/all/accept_dad'
421n2 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/all/accept_dad'
422n1 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/veth1/accept_dad'
423n2 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/veth2/accept_dad'
424n1 bash -c 'printf 1 > /proc/sys/net/ipv4/conf/veth1/promote_secondaries'
425
426# First we check that we aren't overly sticky and can fall over to new IPs when old ones are removed
427ip1 addr add 10.0.0.1/24 dev veth1
428ip1 addr add fd00:aa::1/96 dev veth1
429ip2 addr add 10.0.0.2/24 dev veth2
430ip2 addr add fd00:aa::2/96 dev veth2
431ip1 link set veth1 up
432ip2 link set veth2 up
433waitiface $netns1 veth1
434waitiface $netns2 veth2
435n1 wg set wg0 peer "$pub2" endpoint 10.0.0.2:2
436n1 ping -W 1 -c 1 192.168.241.2
437ip1 addr add 10.0.0.10/24 dev veth1
438ip1 addr del 10.0.0.1/24 dev veth1
439n1 ping -W 1 -c 1 192.168.241.2
440n1 wg set wg0 peer "$pub2" endpoint [fd00:aa::2]:2
441n1 ping -W 1 -c 1 192.168.241.2
442ip1 addr add fd00:aa::10/96 dev veth1
443ip1 addr del fd00:aa::1/96 dev veth1
444n1 ping -W 1 -c 1 192.168.241.2
445
446# Now we show that we can successfully do reply to sender routing
447ip1 link set veth1 down
448ip2 link set veth2 down
449ip1 addr flush dev veth1
450ip2 addr flush dev veth2
451ip1 addr add 10.0.0.1/24 dev veth1
452ip1 addr add 10.0.0.2/24 dev veth1
453ip1 addr add fd00:aa::1/96 dev veth1
454ip1 addr add fd00:aa::2/96 dev veth1
455ip2 addr add 10.0.0.3/24 dev veth2
456ip2 addr add fd00:aa::3/96 dev veth2
457ip1 link set veth1 up
458ip2 link set veth2 up
459waitiface $netns1 veth1
460waitiface $netns2 veth2
461n2 wg set wg0 peer "$pub1" endpoint 10.0.0.1:1
462n2 ping -W 1 -c 1 192.168.241.1
463[[ $(n2 wg show wg0 endpoints) == "$pub1	10.0.0.1:1" ]]
464n2 wg set wg0 peer "$pub1" endpoint [fd00:aa::1]:1
465n2 ping -W 1 -c 1 192.168.241.1
466[[ $(n2 wg show wg0 endpoints) == "$pub1	[fd00:aa::1]:1" ]]
467n2 wg set wg0 peer "$pub1" endpoint 10.0.0.2:1
468n2 ping -W 1 -c 1 192.168.241.1
469[[ $(n2 wg show wg0 endpoints) == "$pub1	10.0.0.2:1" ]]
470n2 wg set wg0 peer "$pub1" endpoint [fd00:aa::2]:1
471n2 ping -W 1 -c 1 192.168.241.1
472[[ $(n2 wg show wg0 endpoints) == "$pub1	[fd00:aa::2]:1" ]]
473
474# What happens if the inbound destination address belongs to a different interface as the default route?
475ip1 link add dummy0 type dummy
476ip1 addr add 10.50.0.1/24 dev dummy0
477ip1 link set dummy0 up
478ip2 route add 10.50.0.0/24 dev veth2
479n2 wg set wg0 peer "$pub1" endpoint 10.50.0.1:1
480n2 ping -W 1 -c 1 192.168.241.1
481[[ $(n2 wg show wg0 endpoints) == "$pub1	10.50.0.1:1" ]]
482
483ip1 link del dummy0
484ip1 addr flush dev veth1
485ip2 addr flush dev veth2
486ip1 route flush dev veth1
487ip2 route flush dev veth2
488
489# Now we see what happens if another interface route takes precedence over an ongoing one
490ip1 link add veth3 type veth peer name veth4
491ip1 link set veth4 netns $netns2
492ip1 addr add 10.0.0.1/24 dev veth1
493ip2 addr add 10.0.0.2/24 dev veth2
494ip1 addr add 10.0.0.3/24 dev veth3
495ip1 link set veth1 up
496ip2 link set veth2 up
497ip1 link set veth3 up
498ip2 link set veth4 up
499waitiface $netns1 veth1
500waitiface $netns2 veth2
501waitiface $netns1 veth3
502waitiface $netns2 veth4
503ip1 route flush dev veth1
504ip1 route flush dev veth3
505ip1 route add 10.0.0.0/24 dev veth1 src 10.0.0.1 metric 2
506n1 wg set wg0 peer "$pub2" endpoint 10.0.0.2:2
507n1 ping -W 1 -c 1 192.168.241.2
508[[ $(n2 wg show wg0 endpoints) == "$pub1	10.0.0.1:1" ]]
509ip1 route add 10.0.0.0/24 dev veth3 src 10.0.0.3 metric 1
510n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/veth1/rp_filter'
511n2 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/veth4/rp_filter'
512n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/all/rp_filter'
513n2 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/all/rp_filter'
514n1 ping -W 1 -c 1 192.168.241.2
515[[ $(n2 wg show wg0 endpoints) == "$pub1	10.0.0.3:1" ]]
516
517ip1 link del veth1
518ip1 link del veth3
519ip1 link del wg0
520ip2 link del wg0
521
522# We test that Netlink/IPC is working properly by doing things that usually cause split responses
523ip0 link add dev wg0 type wireguard
524config=( "[Interface]" "PrivateKey=$(wg genkey)" "[Peer]" "PublicKey=$(wg genkey)" )
525for a in {1..255}; do
526	for b in {0..255}; do
527		config+=( "AllowedIPs=$a.$b.0.0/16,$a::$b/128" )
528	done
529done
530n0 wg setconf wg0 <(printf '%s\n' "${config[@]}")
531i=0
532for ip in $(n0 wg show wg0 allowed-ips); do
533	((++i))
534done
535((i == 255*256*2+1))
536ip0 link del wg0
537ip0 link add dev wg0 type wireguard
538config=( "[Interface]" "PrivateKey=$(wg genkey)" )
539for a in {1..40}; do
540	config+=( "[Peer]" "PublicKey=$(wg genkey)" )
541	for b in {1..52}; do
542		config+=( "AllowedIPs=$a.$b.0.0/16" )
543	done
544done
545n0 wg setconf wg0 <(printf '%s\n' "${config[@]}")
546i=0
547while read -r line; do
548	j=0
549	for ip in $line; do
550		((++j))
551	done
552	((j == 53))
553	((++i))
554done < <(n0 wg show wg0 allowed-ips)
555((i == 40))
556ip0 link del wg0
557ip0 link add wg0 type wireguard
558config=( )
559for i in {1..29}; do
560	config+=( "[Peer]" "PublicKey=$(wg genkey)" )
561done
562config+=( "[Peer]" "PublicKey=$(wg genkey)" "AllowedIPs=255.2.3.4/32,abcd::255/128" )
563n0 wg setconf wg0 <(printf '%s\n' "${config[@]}")
564n0 wg showconf wg0 > /dev/null
565ip0 link del wg0
566
567allowedips=( )
568for i in {1..197}; do
569        allowedips+=( abcd::$i )
570done
571saved_ifs="$IFS"
572IFS=,
573allowedips="${allowedips[*]}"
574IFS="$saved_ifs"
575ip0 link add wg0 type wireguard
576n0 wg set wg0 peer "$pub1"
577n0 wg set wg0 peer "$pub2" allowed-ips "$allowedips"
578{
579	read -r pub allowedips
580	[[ $pub == "$pub1" && $allowedips == "(none)" ]]
581	read -r pub allowedips
582	[[ $pub == "$pub2" ]]
583	i=0
584	for _ in $allowedips; do
585		((++i))
586	done
587	((i == 197))
588} < <(n0 wg show wg0 allowed-ips)
589ip0 link del wg0
590
591! n0 wg show doesnotexist || false
592
593ip0 link add wg0 type wireguard
594n0 wg set wg0 private-key <(echo "$key1") peer "$pub2" preshared-key <(echo "$psk")
595[[ $(n0 wg show wg0 private-key) == "$key1" ]]
596[[ $(n0 wg show wg0 preshared-keys) == "$pub2	$psk" ]]
597n0 wg set wg0 private-key /dev/null peer "$pub2" preshared-key /dev/null
598[[ $(n0 wg show wg0 private-key) == "(none)" ]]
599[[ $(n0 wg show wg0 preshared-keys) == "$pub2	(none)" ]]
600n0 wg set wg0 peer "$pub2"
601n0 wg set wg0 private-key <(echo "$key2")
602[[ $(n0 wg show wg0 public-key) == "$pub2" ]]
603[[ -z $(n0 wg show wg0 peers) ]]
604n0 wg set wg0 peer "$pub2"
605[[ -z $(n0 wg show wg0 peers) ]]
606n0 wg set wg0 private-key <(echo "$key1")
607n0 wg set wg0 peer "$pub2"
608[[ $(n0 wg show wg0 peers) == "$pub2" ]]
609n0 wg set wg0 private-key <(echo "/${key1:1}")
610[[ $(n0 wg show wg0 private-key) == "+${key1:1}" ]]
611n0 wg set wg0 peer "$pub2" allowed-ips 0.0.0.0/0,10.0.0.0/8,100.0.0.0/10,172.16.0.0/12,192.168.0.0/16
612n0 wg set wg0 peer "$pub2" allowed-ips 0.0.0.0/0
613n0 wg set wg0 peer "$pub2" allowed-ips ::/0,1700::/111,5000::/4,e000::/37,9000::/75
614n0 wg set wg0 peer "$pub2" allowed-ips ::/0
615n0 wg set wg0 peer "$pub2" remove
616for low_order_point in AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= 4Ot6fDtBuK4WVuP68Z/EatoJjeucMrH9hmIFFl9JuAA= X5yVvKNQjCSx0LFVnIPvWwREXMRYHI6G2CJO3dCfEVc= 7P///////////////////////////////////////38= 7f///////////////////////////////////////38= 7v///////////////////////////////////////38=; do
617	n0 wg set wg0 peer "$low_order_point" persistent-keepalive 1 endpoint 127.0.0.1:1111
618done
619[[ -n $(n0 wg show wg0 peers) ]]
620exec 4< <(n0 ncat -l -u -p 1111)
621ncat_pid=$!
622waitncatudp $netns0 $ncat_pid
623ip0 link set wg0 up
624! read -r -n 1 -t 2 <&4 || false
625kill $ncat_pid
626ip0 link del wg0
627
628# Ensure that dst_cache references don't outlive netns lifetime
629ip1 link add dev wg0 type wireguard
630ip2 link add dev wg0 type wireguard
631configure_peers
632ip1 link add veth1 type veth peer name veth2
633ip1 link set veth2 netns $netns2
634ip1 addr add fd00:aa::1/64 dev veth1
635ip2 addr add fd00:aa::2/64 dev veth2
636ip1 link set veth1 up
637ip2 link set veth2 up
638waitiface $netns1 veth1
639waitiface $netns2 veth2
640ip1 -6 route add default dev veth1 via fd00:aa::2
641ip2 -6 route add default dev veth2 via fd00:aa::1
642n1 wg set wg0 peer "$pub2" endpoint [fd00:aa::2]:2
643n2 wg set wg0 peer "$pub1" endpoint [fd00:aa::1]:1
644n1 ping6 -c 1 fd00::2
645pp ip netns delete $netns1
646pp ip netns delete $netns2
647pp ip netns add $netns1
648pp ip netns add $netns2
649
650# Ensure there aren't circular reference loops
651ip1 link add wg1 type wireguard
652ip2 link add wg2 type wireguard
653ip1 link set wg1 netns $netns2
654ip2 link set wg2 netns $netns1
655pp ip netns delete $netns1
656pp ip netns delete $netns2
657pp ip netns add $netns1
658pp ip netns add $netns2
659
660sleep 2 # Wait for cleanup and grace periods
661declare -A objects
662while read -t 0.1 -r line 2>/dev/null || [[ $? -ne 142 ]]; do
663	[[ $line =~ .*(wg[0-9]+:\ [A-Z][a-z]+\ ?[0-9]*)\ .*(created|destroyed).* ]] || continue
664	objects["${BASH_REMATCH[1]}"]+="${BASH_REMATCH[2]}"
665done < /dev/kmsg
666alldeleted=1
667for object in "${!objects[@]}"; do
668	if [[ ${objects["$object"]} != *createddestroyed && ${objects["$object"]} != *createdcreateddestroyeddestroyed ]]; then
669		echo "Error: $object: merely ${objects["$object"]}" >&3
670		alldeleted=0
671	fi
672done
673[[ $alldeleted -eq 1 ]]
674pretty "" "Objects that were created were also destroyed."
675