selftests/net/vrf_route_leaking.sh

2 # SPDX-License-Identifier: GPL-2.0
13 # +----+              .253 +----+ .253              +----+
14 # | h1 |-------------------| r1 |-------------------| h2 |
15 # +----+ .1                +----+                .2 +----+
20 # Route from h1 to h2 and back goes through r1, incoming vrf blue has a route
21 # to the outgoing vrf red for the n2 network and red has a route back to n1.
38 # and VRF route leaking was initialy reported. The MTU test isn't done here
39 # because of the lack of a return route in the red VRF.
42 #                     .253 +----+ .253
43 #                     +----| r1 |----+
44 #                     |    +----+    |
45 # +----+              |              |              +----+
46 # | h1 |--------------+              +--------------| h2 |
47 # +----+ .1           |              |           .2 +----+
48 #         172.16.1/24 |    +----+    | 172.16.2/24
49 #    2001:db8:16:1/64 +----| r2 |----+ 2001:db8:16:2/64
50 #                     .254 +----+ .254
53 # Route from h1 to h2 goes through r1, incoming vrf blue has a route to the
54 # outgoing vrf red for the n2 network but red doesn't have a route back to n1.
55 # Route from h2 to h1 goes through r2.
106 	if [ "${rc}" -eq "${expected}" ]; then
107 		printf "TEST: %-60s  [ OK ]\n" "${msg}"
112 		printf "TEST: %-60s  [FAIL]\n" "${msg}"
116 			read -r a
135 	if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
158 	if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
162 	echo "$out" | grep -q "$grep_pattern"
182 	ip -netns "${ns}" rule del pref 0
183 	ip -netns "${ns}" rule add pref 32765 from all lookup local
184 	ip -netns "${ns}" -6 rule del pref 0
185 	ip -netns "${ns}" -6 rule add pref 32765 from all lookup local
194 	ip -netns "${ns}" link add "${vrf}" type vrf table "${table}"
195 	ip -netns "${ns}" link set "${vrf}" up
196 	ip -netns "${ns}" route add vrf "${vrf}" unreachable default metric 8192
197 	ip -netns "${ns}" -6 route add vrf "${vrf}" unreachable default metric 8192
199 	ip -netns "${ns}" addr add 127.0.0.1/8 dev "${vrf}"
200 	ip -netns "${ns}" -6 addr add ::1 dev "${vrf}" nodad
214 		if echo $ns | grep -q h[12]-; then
215 			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
216 			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
218 			ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
219 			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
226 	ip -netns $h1 link add eth0 type veth peer name r1h1
227 	ip -netns $h1 link set r1h1 netns $r1 name eth0 up
229 	ip -netns $h2 link add eth0 type veth peer name r1h2
230 	ip -netns $h2 link set r1h2 netns $r1 name eth1 up
235 	ip -netns $h1 addr add dev eth0 ${H1_N1_IP}/24
236 	ip -netns $h1 -6 addr add dev eth0 ${H1_N1_IP6}/64 nodad
237 	ip -netns $h1 link set eth0 up
240 	ip -netns $h1    route add ${H2_N2} via ${R1_N1_IP} dev eth0
241 	ip -netns $h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev eth0
246 	ip -netns $h2 addr add dev eth0 ${H2_N2_IP}/24
247 	ip -netns $h2 -6 addr add dev eth0 ${H2_N2_IP6}/64 nodad
248 	ip -netns $h2 link set eth0 up
251 	ip -netns $h2 route add default via ${R1_N2_IP} dev eth0
252 	ip -netns $h2 -6 route add default via ${R1_N2_IP6} dev eth0
260 	ip -netns $r1 link set mtu 1400 dev eth1
261 	ip -netns $r1 link set eth0 vrf blue up
262 	ip -netns $r1 link set eth1 vrf red up
263 	ip -netns $r1 addr add dev eth0 ${R1_N1_IP}/24
264 	ip -netns $r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
265 	ip -netns $r1 addr add dev eth1 ${R1_N2_IP}/24
266 	ip -netns $r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
268 	# Route leak from blue to red
269 	ip -netns $r1 route add vrf blue ${H2_N2} dev red
270 	ip -netns $r1 -6 route add vrf blue ${H2_N2_6} dev red
272 	# Route leak from red to blue
273 	ip -netns $r1 route add vrf red ${H1_N1} dev blue
274 	ip -netns $r1 -6 route add vrf red ${H1_N1_6} dev blue
292 		if echo $ns | grep -q h[12]-; then
293 			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
294 			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
296 			ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
297 			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
304 	ip -netns $h1 link add eth0 type veth peer name r1h1
305 	ip -netns $h1 link set r1h1 netns $r1 name eth0 up
307 	ip -netns $h1 link add eth1 type veth peer name r2h1
308 	ip -netns $h1 link set r2h1 netns $r2 name eth0 up
310 	ip -netns $h2 link add eth0 type veth peer name r1h2
311 	ip -netns $h2 link set r1h2 netns $r1 name eth1 up
313 	ip -netns $h2 link add eth1 type veth peer name r2h2
314 	ip -netns $h2 link set r2h2 netns $r2 name eth1 up
319 	ip -netns $h1 link add br0 type bridge
320 	ip -netns $h1 link set br0 up
321 	ip -netns $h1 addr add dev br0 ${H1_N1_IP}/24
322 	ip -netns $h1 -6 addr add dev br0 ${H1_N1_IP6}/64 nodad
323 	ip -netns $h1 link set eth0 master br0 up
324 	ip -netns $h1 link set eth1 master br0 up
327 	ip -netns $h1    route add ${H2_N2} via ${R1_N1_IP} dev br0
328 	ip -netns $h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev br0
333 	ip -netns $h2 link add br0 type bridge
334 	ip -netns $h2 link set br0 up
335 	ip -netns $h2 addr add dev br0 ${H2_N2_IP}/24
336 	ip -netns $h2 -6 addr add dev br0 ${H2_N2_IP6}/64 nodad
337 	ip -netns $h2 link set eth0 master br0 up
338 	ip -netns $h2 link set eth1 master br0 up
341 	ip -netns $h2 route add default via ${R2_N2_IP} dev br0
342 	ip -netns $h2 -6 route add default via ${R2_N2_IP6} dev br0
350 	ip -netns $r1 link set mtu 1400 dev eth1
351 	ip -netns $r1 link set eth0 vrf blue up
352 	ip -netns $r1 link set eth1 vrf red up
353 	ip -netns $r1 addr add dev eth0 ${R1_N1_IP}/24
354 	ip -netns $r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
355 	ip -netns $r1 addr add dev eth1 ${R1_N2_IP}/24
356 	ip -netns $r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
358 	# Route leak from blue to red
359 	ip -netns $r1 route add vrf blue ${H2_N2} dev red
360 	ip -netns $r1 -6 route add vrf blue ${H2_N2_6} dev red
362 	# No route leak from red to blue
367 	ip -netns $r2 addr add dev eth0 ${R2_N1_IP}/24
368 	ip -netns $r2 -6 addr add dev eth0 ${R2_N1_IP6}/64 nodad
369 	ip -netns $r2 addr add dev eth1 ${R2_N2_IP}/24
370 	ip -netns $r2 -6 addr add dev eth1 ${R2_N2_IP6}/64 nodad
378 	ip netns exec $h1 ping -c1 -w1 ${H2_N2_IP} >/dev/null 2>&1
385 	ip netns exec $h1 "${ping6}" -c1 -w1 ${H2_N2_IP6} >/dev/null 2>&1
392 	if [ ! -x "$(command -v traceroute)" ]; then
400 	if [ ! -x "$(command -v traceroute6)" ]; then
412 	log_section "IPv4 ($ttype route): VRF ICMP error route lookup traceroute"
435 	log_section "IPv6 ($ttype route): VRF ICMP error route lookup traceroute"
458 	log_section "IPv4 ($ttype route): VRF ICMP ttl error route lookup ping"
464 	run_cmd_grep "Time to live exceeded" ip netns exec $h1 ping -t1 -c1 -W2 ${H2_N2_IP}
479 	log_section "IPv4 ($ttype route): VRF ICMP fragmentation error route lookup ping"
485 	run_cmd_grep "Frag needed" ip netns exec $h1 ping -s 1450 -Mdo -c1 -W2 ${H2_N2_IP}
500 	log_section "IPv6 ($ttype route): VRF ICMP ttl error route lookup ping"
506 	run_cmd_grep "Time exceeded: Hop limit" ip netns exec $h1 "${ping6}" -t1 -c1 -W2 ${H2_N2_IP6}
521 	log_section "IPv6 ($ttype route): VRF ICMP fragmentation error route lookup ping"
527 	run_cmd_grep "Packet too big" ip netns exec $h1 "${ping6}" -s 1450 -Mdo -c1 -W2 ${H2_N2_IP6}
538 	log_section "IPv4 (sym route): VRF ICMP local error route lookup ping"
544 	run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP}
550 	log_section "IPv4 (sym route): VRF tcp local connection"
556 	run_cmd nettest -s -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 &
558 	run_cmd nettest -N "$r1" -d blue -r ${H2_N2_IP}
564 	log_section "IPv4 (sym route): VRF udp local connection"
570 	run_cmd nettest -s -D -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 &
572 	run_cmd nettest -D -N "$r1" -d blue -r ${H2_N2_IP}
578 	log_section "IPv6 (sym route): VRF ICMP local error route lookup ping"
584 	run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6}
590 	log_section "IPv6 (sym route): VRF tcp local connection"
596 	run_cmd nettest -s -6 -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 &
598 	run_cmd nettest -6 -N "$r1" -d blue -r ${H2_N2_IP6}
604 	log_section "IPv6 (sym route): VRF udp local connection"
610 	run_cmd nettest -s -6 -D -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 &
612 	run_cmd nettest -6 -D -N "$r1" -d blue -r ${H2_N2_IP6}
624 	-4          Run IPv4 tests only
625 	-6          Run IPv6 tests only
626         -t TEST     Run only TEST
627 	-p          Pause on fail
628 	-v          verbose mode (show commands and output)
636 command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping)
665 if [ -z "$TESTS" ]; then