• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# This test sets up 3 netns (src <-> fwd <-> dst). There is no direct veth link
5# between src and dst. The netns fwd has veth links to each src and dst. The
6# client is in src and server in dst. The test installs a TC BPF program to each
7# host facing veth in fwd which calls into i) bpf_redirect_neigh() to perform the
8# neigh addr population and redirect or ii) bpf_redirect_peer() for namespace
9# switch from ingress side; it also installs a checker prog on the egress side
10# to drop unexpected traffic.
11
12if [[ $EUID -ne 0 ]]; then
13	echo "This script must be run as root"
14	echo "FAIL"
15	exit 1
16fi
17
18# check that needed tools are present
19command -v nc >/dev/null 2>&1 || \
20	{ echo >&2 "nc is not available"; exit 1; }
21command -v dd >/dev/null 2>&1 || \
22	{ echo >&2 "dd is not available"; exit 1; }
23command -v timeout >/dev/null 2>&1 || \
24	{ echo >&2 "timeout is not available"; exit 1; }
25command -v ping >/dev/null 2>&1 || \
26	{ echo >&2 "ping is not available"; exit 1; }
27if command -v ping6 >/dev/null 2>&1; then PING6=ping6; else PING6=ping; fi
28command -v perl >/dev/null 2>&1 || \
29	{ echo >&2 "perl is not available"; exit 1; }
30command -v jq >/dev/null 2>&1 || \
31	{ echo >&2 "jq is not available"; exit 1; }
32command -v bpftool >/dev/null 2>&1 || \
33	{ echo >&2 "bpftool is not available"; exit 1; }
34
35readonly GREEN='\033[0;92m'
36readonly RED='\033[0;31m'
37readonly NC='\033[0m' # No Color
38
39readonly PING_ARG="-c 3 -w 10 -q"
40
41readonly TIMEOUT=10
42
43readonly NS_SRC="ns-src-$(mktemp -u XXXXXX)"
44readonly NS_FWD="ns-fwd-$(mktemp -u XXXXXX)"
45readonly NS_DST="ns-dst-$(mktemp -u XXXXXX)"
46
47readonly IP4_SRC="172.16.1.100"
48readonly IP4_DST="172.16.2.100"
49
50readonly IP6_SRC="::1:dead:beef:cafe"
51readonly IP6_DST="::2:dead:beef:cafe"
52
53readonly IP4_SLL="169.254.0.1"
54readonly IP4_DLL="169.254.0.2"
55readonly IP4_NET="169.254.0.0"
56
57netns_cleanup()
58{
59	ip netns del ${NS_SRC}
60	ip netns del ${NS_FWD}
61	ip netns del ${NS_DST}
62}
63
64netns_setup()
65{
66	ip netns add "${NS_SRC}"
67	ip netns add "${NS_FWD}"
68	ip netns add "${NS_DST}"
69
70	ip link add veth_src type veth peer name veth_src_fwd
71	ip link add veth_dst type veth peer name veth_dst_fwd
72
73	ip link set veth_src netns ${NS_SRC}
74	ip link set veth_src_fwd netns ${NS_FWD}
75
76	ip link set veth_dst netns ${NS_DST}
77	ip link set veth_dst_fwd netns ${NS_FWD}
78
79	ip -netns ${NS_SRC} addr add ${IP4_SRC}/32 dev veth_src
80	ip -netns ${NS_DST} addr add ${IP4_DST}/32 dev veth_dst
81
82	# The fwd netns automatically get a v6 LL address / routes, but also
83	# needs v4 one in order to start ARP probing. IP4_NET route is added
84	# to the endpoints so that the ARP processing will reply.
85
86	ip -netns ${NS_FWD} addr add ${IP4_SLL}/32 dev veth_src_fwd
87	ip -netns ${NS_FWD} addr add ${IP4_DLL}/32 dev veth_dst_fwd
88
89	ip -netns ${NS_SRC} addr add ${IP6_SRC}/128 dev veth_src nodad
90	ip -netns ${NS_DST} addr add ${IP6_DST}/128 dev veth_dst nodad
91
92	ip -netns ${NS_SRC} link set dev veth_src up
93	ip -netns ${NS_FWD} link set dev veth_src_fwd up
94
95	ip -netns ${NS_DST} link set dev veth_dst up
96	ip -netns ${NS_FWD} link set dev veth_dst_fwd up
97
98	ip -netns ${NS_SRC} route add ${IP4_DST}/32 dev veth_src scope global
99	ip -netns ${NS_SRC} route add ${IP4_NET}/16 dev veth_src scope global
100	ip -netns ${NS_FWD} route add ${IP4_SRC}/32 dev veth_src_fwd scope global
101
102	ip -netns ${NS_SRC} route add ${IP6_DST}/128 dev veth_src scope global
103	ip -netns ${NS_FWD} route add ${IP6_SRC}/128 dev veth_src_fwd scope global
104
105	ip -netns ${NS_DST} route add ${IP4_SRC}/32 dev veth_dst scope global
106	ip -netns ${NS_DST} route add ${IP4_NET}/16 dev veth_dst scope global
107	ip -netns ${NS_FWD} route add ${IP4_DST}/32 dev veth_dst_fwd scope global
108
109	ip -netns ${NS_DST} route add ${IP6_SRC}/128 dev veth_dst scope global
110	ip -netns ${NS_FWD} route add ${IP6_DST}/128 dev veth_dst_fwd scope global
111
112	fmac_src=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_src_fwd/address)
113	fmac_dst=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_dst_fwd/address)
114
115	ip -netns ${NS_SRC} neigh add ${IP4_DST} dev veth_src lladdr $fmac_src
116	ip -netns ${NS_DST} neigh add ${IP4_SRC} dev veth_dst lladdr $fmac_dst
117
118	ip -netns ${NS_SRC} neigh add ${IP6_DST} dev veth_src lladdr $fmac_src
119	ip -netns ${NS_DST} neigh add ${IP6_SRC} dev veth_dst lladdr $fmac_dst
120}
121
122netns_test_connectivity()
123{
124	set +e
125
126	ip netns exec ${NS_DST} bash -c "nc -4 -l -p 9004 &"
127	ip netns exec ${NS_DST} bash -c "nc -6 -l -p 9006 &"
128
129	TEST="TCPv4 connectivity test"
130	ip netns exec ${NS_SRC} bash -c "timeout ${TIMEOUT} dd if=/dev/zero bs=1000 count=100 > /dev/tcp/${IP4_DST}/9004"
131	if [ $? -ne 0 ]; then
132		echo -e "${TEST}: ${RED}FAIL${NC}"
133		exit 1
134	fi
135	echo -e "${TEST}: ${GREEN}PASS${NC}"
136
137	TEST="TCPv6 connectivity test"
138	ip netns exec ${NS_SRC} bash -c "timeout ${TIMEOUT} dd if=/dev/zero bs=1000 count=100 > /dev/tcp/${IP6_DST}/9006"
139	if [ $? -ne 0 ]; then
140		echo -e "${TEST}: ${RED}FAIL${NC}"
141		exit 1
142	fi
143	echo -e "${TEST}: ${GREEN}PASS${NC}"
144
145	TEST="ICMPv4 connectivity test"
146	ip netns exec ${NS_SRC} ping  $PING_ARG ${IP4_DST}
147	if [ $? -ne 0 ]; then
148		echo -e "${TEST}: ${RED}FAIL${NC}"
149		exit 1
150	fi
151	echo -e "${TEST}: ${GREEN}PASS${NC}"
152
153	TEST="ICMPv6 connectivity test"
154	ip netns exec ${NS_SRC} $PING6 $PING_ARG ${IP6_DST}
155	if [ $? -ne 0 ]; then
156		echo -e "${TEST}: ${RED}FAIL${NC}"
157		exit 1
158	fi
159	echo -e "${TEST}: ${GREEN}PASS${NC}"
160
161	set -e
162}
163
164hex_mem_str()
165{
166	perl -e 'print join(" ", unpack("(H2)8", pack("L", @ARGV)))' $1
167}
168
169netns_setup_bpf()
170{
171	local obj=$1
172	local use_forwarding=${2:-0}
173
174	ip netns exec ${NS_FWD} tc qdisc add dev veth_src_fwd clsact
175	ip netns exec ${NS_FWD} tc filter add dev veth_src_fwd ingress bpf da obj $obj sec src_ingress
176	ip netns exec ${NS_FWD} tc filter add dev veth_src_fwd egress  bpf da obj $obj sec chk_egress
177
178	ip netns exec ${NS_FWD} tc qdisc add dev veth_dst_fwd clsact
179	ip netns exec ${NS_FWD} tc filter add dev veth_dst_fwd ingress bpf da obj $obj sec dst_ingress
180	ip netns exec ${NS_FWD} tc filter add dev veth_dst_fwd egress  bpf da obj $obj sec chk_egress
181
182	if [ "$use_forwarding" -eq "1" ]; then
183		# bpf_fib_lookup() checks if forwarding is enabled
184		ip netns exec ${NS_FWD} sysctl -w net.ipv4.ip_forward=1
185		ip netns exec ${NS_FWD} sysctl -w net.ipv6.conf.veth_dst_fwd.forwarding=1
186		ip netns exec ${NS_FWD} sysctl -w net.ipv6.conf.veth_src_fwd.forwarding=1
187		return 0
188	fi
189
190	veth_src=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_src_fwd/ifindex)
191	veth_dst=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_dst_fwd/ifindex)
192
193	progs=$(ip netns exec ${NS_FWD} bpftool net --json | jq -r '.[] | .tc | map(.id) | .[]')
194	for prog in $progs; do
195		map=$(bpftool prog show id $prog --json | jq -r '.map_ids | .? | .[]')
196		if [ ! -z "$map" ]; then
197			bpftool map update id $map key hex $(hex_mem_str 0) value hex $(hex_mem_str $veth_src)
198			bpftool map update id $map key hex $(hex_mem_str 1) value hex $(hex_mem_str $veth_dst)
199		fi
200	done
201}
202
203trap netns_cleanup EXIT
204set -e
205
206netns_setup
207netns_setup_bpf test_tc_neigh.o
208netns_test_connectivity
209netns_cleanup
210netns_setup
211netns_setup_bpf test_tc_neigh_fib.o 1
212netns_test_connectivity
213netns_cleanup
214netns_setup
215netns_setup_bpf test_tc_peer.o
216netns_test_connectivity
217