1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# redirect test 5# 6# .253 +----+ 7# +----| r1 | 8# | +----+ 9# +----+ | |.1 10# | h1 |--------------+ | 10.1.1.0/30 2001:db8:1::0/126 11# +----+ .1 | |.2 12# 172.16.1/24 | +----+ +----+ 13# 2001:db8:16:1/64 +----| r2 |-------------------| h2 | 14# .254 +----+ .254 .2 +----+ 15# 172.16.2/24 16# 2001:db8:16:2/64 17# 18# Route from h1 to h2 goes through r1, eth1 - connection between r1 and r2. 19# Route on r1 changed to go to r2 via eth0. This causes a redirect to be sent 20# from r1 to h1 telling h1 to use r2 when talking to h2. 21 22VERBOSE=0 23PAUSE_ON_FAIL=no 24 25H1_N1_IP=172.16.1.1 26R1_N1_IP=172.16.1.253 27R2_N1_IP=172.16.1.254 28 29H1_N1_IP6=2001:db8:16:1::1 30R1_N1_IP6=2001:db8:16:1::253 31R2_N1_IP6=2001:db8:16:1::254 32 33R1_R2_N1_IP=10.1.1.1 34R2_R1_N1_IP=10.1.1.2 35 36R1_R2_N1_IP6=2001:db8:1::1 37R2_R1_N1_IP6=2001:db8:1::2 38 39H2_N2=172.16.2.0/24 40H2_N2_6=2001:db8:16:2::/64 41H2_N2_IP=172.16.2.2 42R2_N2_IP=172.16.2.254 43H2_N2_IP6=2001:db8:16:2::2 44R2_N2_IP6=2001:db8:16:2::254 45 46VRF=red 47VRF_TABLE=1111 48 49################################################################################ 50# helpers 51 52log_section() 53{ 54 echo 55 echo "###########################################################################" 56 echo "$*" 57 echo "###########################################################################" 58 echo 59} 60 61log_test() 62{ 63 local rc=$1 64 local expected=$2 65 local msg="$3" 66 67 if [ ${rc} -eq ${expected} ]; then 68 printf "TEST: %-60s [ OK ]\n" "${msg}" 69 nsuccess=$((nsuccess+1)) 70 else 71 ret=1 72 nfail=$((nfail+1)) 73 printf "TEST: %-60s [FAIL]\n" "${msg}" 74 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then 75 echo 76 echo "hit enter to continue, 'q' to quit" 77 read a 78 [ "$a" = "q" ] && exit 1 79 fi 80 fi 81} 82 83log_debug() 84{ 85 if [ "$VERBOSE" = "1" ]; then 86 echo "$*" 87 fi 88} 89 90run_cmd() 91{ 92 local cmd="$*" 93 local out 94 local rc 95 96 if [ "$VERBOSE" = "1" ]; then 97 echo "COMMAND: $cmd" 98 fi 99 100 out=$(eval $cmd 2>&1) 101 rc=$? 102 if [ "$VERBOSE" = "1" -a -n "$out" ]; then 103 echo "$out" 104 fi 105 106 [ "$VERBOSE" = "1" ] && echo 107 108 return $rc 109} 110 111get_linklocal() 112{ 113 local ns=$1 114 local dev=$2 115 local addr 116 117 addr=$(ip -netns $ns -6 -br addr show dev ${dev} | \ 118 awk '{ 119 for (i = 3; i <= NF; ++i) { 120 if ($i ~ /^fe80/) 121 print $i 122 } 123 }' 124 ) 125 addr=${addr/\/*} 126 127 [ -z "$addr" ] && return 1 128 129 echo $addr 130 131 return 0 132} 133 134################################################################################ 135# setup and teardown 136 137cleanup() 138{ 139 local ns 140 141 for ns in h1 h2 r1 r2; do 142 ip netns del $ns 2>/dev/null 143 done 144} 145 146create_vrf() 147{ 148 local ns=$1 149 150 ip -netns ${ns} link add ${VRF} type vrf table ${VRF_TABLE} 151 ip -netns ${ns} link set ${VRF} up 152 ip -netns ${ns} route add vrf ${VRF} unreachable default metric 8192 153 ip -netns ${ns} -6 route add vrf ${VRF} unreachable default metric 8192 154 155 ip -netns ${ns} addr add 127.0.0.1/8 dev ${VRF} 156 ip -netns ${ns} -6 addr add ::1 dev ${VRF} nodad 157 158 ip -netns ${ns} ru del pref 0 159 ip -netns ${ns} ru add pref 32765 from all lookup local 160 ip -netns ${ns} -6 ru del pref 0 161 ip -netns ${ns} -6 ru add pref 32765 from all lookup local 162} 163 164setup() 165{ 166 local ns 167 168 # 169 # create nodes as namespaces 170 # 171 for ns in h1 h2 r1 r2; do 172 ip netns add $ns 173 ip -netns $ns li set lo up 174 175 case "${ns}" in 176 h[12]) ip netns exec $ns sysctl -q -w net.ipv4.conf.all.accept_redirects=1 177 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0 178 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.accept_redirects=1 179 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1 180 ;; 181 r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1 182 ip netns exec $ns sysctl -q -w net.ipv4.conf.all.send_redirects=1 183 ip netns exec $ns sysctl -q -w net.ipv4.conf.default.rp_filter=0 184 ip netns exec $ns sysctl -q -w net.ipv4.conf.all.rp_filter=0 185 186 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1 187 ip netns exec $ns sysctl -q -w net.ipv6.route.mtu_expires=10 188 esac 189 done 190 191 # 192 # create interconnects 193 # 194 ip -netns h1 li add eth0 type veth peer name r1h1 195 ip -netns h1 li set r1h1 netns r1 name eth0 up 196 197 ip -netns h1 li add eth1 type veth peer name r2h1 198 ip -netns h1 li set r2h1 netns r2 name eth0 up 199 200 ip -netns h2 li add eth0 type veth peer name r2h2 201 ip -netns h2 li set eth0 up 202 ip -netns h2 li set r2h2 netns r2 name eth2 up 203 204 ip -netns r1 li add eth1 type veth peer name r2r1 205 ip -netns r1 li set eth1 up 206 ip -netns r1 li set r2r1 netns r2 name eth1 up 207 208 # 209 # h1 210 # 211 if [ "${WITH_VRF}" = "yes" ]; then 212 create_vrf "h1" 213 H1_VRF_ARG="vrf ${VRF}" 214 H1_PING_ARG="-I ${VRF}" 215 else 216 H1_VRF_ARG= 217 H1_PING_ARG= 218 fi 219 ip -netns h1 li add br0 type bridge 220 if [ "${WITH_VRF}" = "yes" ]; then 221 ip -netns h1 li set br0 vrf ${VRF} up 222 else 223 ip -netns h1 li set br0 up 224 fi 225 ip -netns h1 addr add dev br0 ${H1_N1_IP}/24 226 ip -netns h1 -6 addr add dev br0 ${H1_N1_IP6}/64 nodad 227 ip -netns h1 li set eth0 master br0 up 228 ip -netns h1 li set eth1 master br0 up 229 230 # 231 # h2 232 # 233 ip -netns h2 addr add dev eth0 ${H2_N2_IP}/24 234 ip -netns h2 ro add default via ${R2_N2_IP} dev eth0 235 ip -netns h2 -6 addr add dev eth0 ${H2_N2_IP6}/64 nodad 236 ip -netns h2 -6 ro add default via ${R2_N2_IP6} dev eth0 237 238 # 239 # r1 240 # 241 ip -netns r1 addr add dev eth0 ${R1_N1_IP}/24 242 ip -netns r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad 243 ip -netns r1 addr add dev eth1 ${R1_R2_N1_IP}/30 244 ip -netns r1 -6 addr add dev eth1 ${R1_R2_N1_IP6}/126 nodad 245 246 # 247 # r2 248 # 249 ip -netns r2 addr add dev eth0 ${R2_N1_IP}/24 250 ip -netns r2 -6 addr add dev eth0 ${R2_N1_IP6}/64 nodad 251 ip -netns r2 addr add dev eth1 ${R2_R1_N1_IP}/30 252 ip -netns r2 -6 addr add dev eth1 ${R2_R1_N1_IP6}/126 nodad 253 ip -netns r2 addr add dev eth2 ${R2_N2_IP}/24 254 ip -netns r2 -6 addr add dev eth2 ${R2_N2_IP6}/64 nodad 255 256 sleep 2 257 258 R1_LLADDR=$(get_linklocal r1 eth0) 259 if [ $? -ne 0 ]; then 260 echo "Error: Failed to get link-local address of r1's eth0" 261 exit 1 262 fi 263 log_debug "initial gateway is R1's lladdr = ${R1_LLADDR}" 264 265 R2_LLADDR=$(get_linklocal r2 eth0) 266 if [ $? -ne 0 ]; then 267 echo "Error: Failed to get link-local address of r2's eth0" 268 exit 1 269 fi 270 log_debug "initial gateway is R2's lladdr = ${R2_LLADDR}" 271} 272 273change_h2_mtu() 274{ 275 local mtu=$1 276 277 run_cmd ip -netns h2 li set eth0 mtu ${mtu} 278 run_cmd ip -netns r2 li set eth2 mtu ${mtu} 279} 280 281check_exception() 282{ 283 local mtu="$1" 284 local with_redirect="$2" 285 local desc="$3" 286 287 # From 172.16.1.101: icmp_seq=1 Redirect Host(New nexthop: 172.16.1.102) 288 if [ "$VERBOSE" = "1" ]; then 289 echo "Commands to check for exception:" 290 run_cmd ip -netns h1 ro get ${H1_VRF_ARG} ${H2_N2_IP} 291 run_cmd ip -netns h1 -6 ro get ${H1_VRF_ARG} ${H2_N2_IP6} 292 fi 293 294 if [ -n "${mtu}" ]; then 295 mtu=" mtu ${mtu}" 296 fi 297 if [ "$with_redirect" = "yes" ]; then 298 ip -netns h1 ro get ${H1_VRF_ARG} ${H2_N2_IP} | \ 299 grep -q "cache <redirected> expires [0-9]*sec${mtu}" 300 elif [ -n "${mtu}" ]; then 301 ip -netns h1 ro get ${H1_VRF_ARG} ${H2_N2_IP} | \ 302 grep -q "cache expires [0-9]*sec${mtu}" 303 else 304 # want to verify that neither mtu nor redirected appears in 305 # the route get output. The -v will wipe out the cache line 306 # if either are set so the last grep -q will not find a match 307 ip -netns h1 ro get ${H1_VRF_ARG} ${H2_N2_IP} | \ 308 grep -E -v 'mtu|redirected' | grep -q "cache" 309 fi 310 log_test $? 0 "IPv4: ${desc}" 311 312 # No PMTU info for test "redirect" and "mtu exception plus redirect" 313 if [ "$with_redirect" = "yes" ] && [ "$desc" != "redirect exception plus mtu" ]; then 314 ip -netns h1 -6 ro get ${H1_VRF_ARG} ${H2_N2_IP6} | \ 315 grep -v "mtu" | grep -q "${H2_N2_IP6} .*via ${R2_LLADDR} dev br0" 316 elif [ -n "${mtu}" ]; then 317 ip -netns h1 -6 ro get ${H1_VRF_ARG} ${H2_N2_IP6} | \ 318 grep -q "${mtu}" 319 else 320 # IPv6 is a bit harder. First strip out the match if it 321 # contains an mtu exception and then look for the first 322 # gateway - R1's lladdr 323 ip -netns h1 -6 ro get ${H1_VRF_ARG} ${H2_N2_IP6} | \ 324 grep -v "mtu" | grep -q "${R1_LLADDR}" 325 fi 326 log_test $? 0 "IPv6: ${desc}" 327} 328 329run_ping() 330{ 331 local sz=$1 332 333 run_cmd ip netns exec h1 ping -q -M want -i 0.5 -c 10 -w 2 -s ${sz} ${H1_PING_ARG} ${H2_N2_IP} 334 run_cmd ip netns exec h1 ${ping6} -q -M want -i 0.5 -c 10 -w 2 -s ${sz} ${H1_PING_ARG} ${H2_N2_IP6} 335} 336 337replace_route_new() 338{ 339 # r1 to h2 via r2 and eth0 340 run_cmd ip -netns r1 nexthop replace id 1 via ${R2_N1_IP} dev eth0 341 run_cmd ip -netns r1 nexthop replace id 2 via ${R2_LLADDR} dev eth0 342} 343 344reset_route_new() 345{ 346 run_cmd ip -netns r1 nexthop flush 347 run_cmd ip -netns h1 nexthop flush 348 349 initial_route_new 350} 351 352initial_route_new() 353{ 354 # r1 to h2 via r2 and eth1 355 run_cmd ip -netns r1 nexthop add id 1 via ${R2_R1_N1_IP} dev eth1 356 run_cmd ip -netns r1 ro add ${H2_N2} nhid 1 357 358 run_cmd ip -netns r1 nexthop add id 2 via ${R2_R1_N1_IP6} dev eth1 359 run_cmd ip -netns r1 -6 ro add ${H2_N2_6} nhid 2 360 361 # h1 to h2 via r1 362 run_cmd ip -netns h1 nexthop add id 1 via ${R1_N1_IP} dev br0 363 run_cmd ip -netns h1 ro add ${H1_VRF_ARG} ${H2_N2} nhid 1 364 365 run_cmd ip -netns h1 nexthop add id 2 via ${R1_LLADDR} dev br0 366 run_cmd ip -netns h1 -6 ro add ${H1_VRF_ARG} ${H2_N2_6} nhid 2 367} 368 369replace_route_legacy() 370{ 371 # r1 to h2 via r2 and eth0 372 run_cmd ip -netns r1 ro replace ${H2_N2} via ${R2_N1_IP} dev eth0 373 run_cmd ip -netns r1 -6 ro replace ${H2_N2_6} via ${R2_LLADDR} dev eth0 374} 375 376reset_route_legacy() 377{ 378 run_cmd ip -netns r1 ro del ${H2_N2} 379 run_cmd ip -netns r1 -6 ro del ${H2_N2_6} 380 381 run_cmd ip -netns h1 ro del ${H1_VRF_ARG} ${H2_N2} 382 run_cmd ip -netns h1 -6 ro del ${H1_VRF_ARG} ${H2_N2_6} 383 384 initial_route_legacy 385} 386 387initial_route_legacy() 388{ 389 # r1 to h2 via r2 and eth1 390 run_cmd ip -netns r1 ro add ${H2_N2} via ${R2_R1_N1_IP} dev eth1 391 run_cmd ip -netns r1 -6 ro add ${H2_N2_6} via ${R2_R1_N1_IP6} dev eth1 392 393 # h1 to h2 via r1 394 # - IPv6 redirect only works if gateway is the LLA 395 run_cmd ip -netns h1 ro add ${H1_VRF_ARG} ${H2_N2} via ${R1_N1_IP} dev br0 396 run_cmd ip -netns h1 -6 ro add ${H1_VRF_ARG} ${H2_N2_6} via ${R1_LLADDR} dev br0 397} 398 399check_connectivity() 400{ 401 local rc 402 403 run_cmd ip netns exec h1 ping -c1 -w1 ${H1_PING_ARG} ${H2_N2_IP} 404 rc=$? 405 run_cmd ip netns exec h1 ${ping6} -c1 -w1 ${H1_PING_ARG} ${H2_N2_IP6} 406 [ $? -ne 0 ] && rc=$? 407 408 return $rc 409} 410 411do_test() 412{ 413 local ttype="$1" 414 415 eval initial_route_${ttype} 416 417 # verify connectivity 418 check_connectivity 419 if [ $? -ne 0 ]; then 420 echo "Error: Basic connectivity is broken" 421 ret=1 422 return 423 fi 424 425 # redirect exception followed by mtu 426 eval replace_route_${ttype} 427 run_ping 64 428 check_exception "" "yes" "redirect exception" 429 430 check_connectivity 431 if [ $? -ne 0 ]; then 432 echo "Error: Basic connectivity is broken after redirect" 433 ret=1 434 return 435 fi 436 437 change_h2_mtu 1300 438 run_ping 1350 439 check_exception "1300" "yes" "redirect exception plus mtu" 440 441 # remove exceptions and restore routing 442 change_h2_mtu 1500 443 eval reset_route_${ttype} 444 445 check_connectivity 446 if [ $? -ne 0 ]; then 447 echo "Error: Basic connectivity is broken after reset" 448 ret=1 449 return 450 fi 451 check_exception "" "no" "routing reset" 452 453 # MTU exception followed by redirect 454 change_h2_mtu 1300 455 run_ping 1350 456 check_exception "1300" "no" "mtu exception" 457 458 eval replace_route_${ttype} 459 run_ping 64 460 check_exception "1300" "yes" "mtu exception plus redirect" 461 462 check_connectivity 463 if [ $? -ne 0 ]; then 464 echo "Error: Basic connectivity is broken after redirect" 465 ret=1 466 return 467 fi 468} 469 470################################################################################ 471# usage 472 473usage() 474{ 475 cat <<EOF 476usage: ${0##*/} OPTS 477 478 -p Pause on fail 479 -v verbose mode (show commands and output) 480EOF 481} 482 483################################################################################ 484# main 485 486# Some systems don't have a ping6 binary anymore 487which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping) 488 489ret=0 490nsuccess=0 491nfail=0 492 493while getopts :pv o 494do 495 case $o in 496 p) PAUSE_ON_FAIL=yes;; 497 v) VERBOSE=$(($VERBOSE + 1));; 498 *) usage; exit 1;; 499 esac 500done 501 502trap cleanup EXIT 503 504cleanup 505WITH_VRF=no 506setup 507 508log_section "Legacy routing" 509do_test "legacy" 510 511cleanup 512log_section "Legacy routing with VRF" 513WITH_VRF=yes 514setup 515do_test "legacy" 516 517cleanup 518log_section "Routing with nexthop objects" 519ip nexthop ls >/dev/null 2>&1 520if [ $? -eq 0 ]; then 521 WITH_VRF=no 522 setup 523 do_test "new" 524 525 cleanup 526 log_section "Routing with nexthop objects and VRF" 527 WITH_VRF=yes 528 setup 529 do_test "new" 530else 531 echo "Nexthop objects not supported; skipping tests" 532fi 533 534printf "\nTests passed: %3d\n" ${nsuccess} 535printf "Tests failed: %3d\n" ${nfail} 536 537exit $ret 538