1#!/bin/bash 2# 3# This test is for bridge 'brouting', i.e. make some packets being routed 4# rather than getting bridged even though they arrive on interface that is 5# part of a bridge. 6 7# eth0 br0 eth0 8# setup is: ns1 <-> nsbr <-> ns2 9 10source lib.sh 11 12if ! ebtables -V > /dev/null 2>&1;then 13 echo "SKIP: Could not run test without ebtables" 14 exit $ksft_skip 15fi 16 17cleanup() { 18 cleanup_all_ns 19} 20 21trap cleanup EXIT 22 23setup_ns nsbr ns1 ns2 24 25ip netns exec "$nsbr" sysctl -q net.ipv4.conf.default.rp_filter=0 26ip netns exec "$nsbr" sysctl -q net.ipv4.conf.all.rp_filter=0 27if ! ip link add veth0 netns "$nsbr" type veth peer name eth0 netns "$ns1"; then 28 echo "SKIP: Can't create veth device" 29 exit $ksft_skip 30fi 31ip link add veth1 netns "$nsbr" type veth peer name eth0 netns "$ns2" 32 33if ! ip -net "$nsbr" link add br0 type bridge; then 34 echo "SKIP: Can't create bridge br0" 35 exit $ksft_skip 36fi 37 38ip -net "$nsbr" link set veth0 up 39ip -net "$nsbr" link set veth1 up 40 41ip -net "$nsbr" link set veth0 master br0 42ip -net "$nsbr" link set veth1 master br0 43ip -net "$nsbr" link set br0 up 44ip -net "$nsbr" addr add 10.0.0.1/24 dev br0 45 46# place both in same subnet, ${ns1} and ${ns2} connected via ${nsbr}:br0 47ip -net "$ns1" link set eth0 up 48ip -net "$ns2" link set eth0 up 49ip -net "$ns1" addr add 10.0.0.11/24 dev eth0 50ip -net "$ns2" addr add 10.0.0.12/24 dev eth0 51 52test_ebtables_broute() 53{ 54 # redirect is needed so the dstmac is rewritten to the bridge itself, 55 # ip stack won't process OTHERHOST (foreign unicast mac) packets. 56 if ! ip netns exec "$nsbr" ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP; then 57 echo "SKIP: Could not add ebtables broute redirect rule" 58 return $ksft_skip 59 fi 60 61 ip netns exec "$nsbr" sysctl -q net.ipv4.conf.veth0.forwarding=0 62 63 # ping net${ns1}, expected to not work (ip forwarding is off) 64 if ip netns exec "$ns1" ping -q -c 1 10.0.0.12 -W 0.5 > /dev/null 2>&1; then 65 echo "ERROR: ping works, should have failed" 1>&2 66 return 1 67 fi 68 69 # enable forwarding on both interfaces. 70 # neither needs an ip address, but at least the bridge needs 71 # an ip address in same network segment as ${ns1} and ${ns2} (${nsbr} 72 # needs to be able to determine route for to-be-forwarded packet). 73 ip netns exec "$nsbr" sysctl -q net.ipv4.conf.veth0.forwarding=1 74 ip netns exec "$nsbr" sysctl -q net.ipv4.conf.veth1.forwarding=1 75 76 if ! ip netns exec "$ns1" ping -q -c 1 10.0.0.12 > /dev/null; then 77 echo "ERROR: ping did not work, but it should (broute+forward)" 1>&2 78 return 1 79 fi 80 81 echo "PASS: ${ns1}/${ns2} connectivity with active broute rule" 82 ip netns exec "$nsbr" ebtables -t broute -F 83 84 # ping net${ns1}, expected to work (frames are bridged) 85 if ! ip netns exec "$ns1" ping -q -c 1 10.0.0.12 > /dev/null; then 86 echo "ERROR: ping did not work, but it should (bridged)" 1>&2 87 return 1 88 fi 89 90 ip netns exec "$nsbr" ebtables -t filter -A FORWARD -p ipv4 --ip-protocol icmp -j DROP 91 92 # ping net${ns1}, expected to not work (DROP in bridge forward) 93 if ip netns exec "$ns1" ping -q -c 1 10.0.0.12 -W 0.5 > /dev/null 2>&1; then 94 echo "ERROR: ping works, should have failed (icmp forward drop)" 1>&2 95 return 1 96 fi 97 98 # re-activate brouter 99 ip netns exec "$nsbr" ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP 100 101 if ! ip netns exec "$ns2" ping -q -c 1 10.0.0.11 > /dev/null; then 102 echo "ERROR: ping did not work, but it should (broute+forward 2)" 1>&2 103 return 1 104 fi 105 106 echo "PASS: ${ns1}/${ns2} connectivity with active broute rule and bridge forward drop" 107 return 0 108} 109 110# test basic connectivity 111if ! ip netns exec "$ns1" ping -c 1 -q 10.0.0.12 > /dev/null; then 112 echo "ERROR: Could not reach ${ns2} from ${ns1}" 1>&2 113 exit 1 114fi 115 116if ! ip netns exec "$ns2" ping -c 1 -q 10.0.0.11 > /dev/null; then 117 echo "ERROR: Could not reach ${ns1} from ${ns2}" 1>&2 118 exit 1 119fi 120 121test_ebtables_broute 122exit $? 123