178 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03 4[[ -z $TC ]] && TC='tc'5[[ -z $IP ]] && IP='ip'6 7REDIRECT_USER='./tc_l2_redirect'8REDIRECT_BPF='./tc_l2_redirect_kern.o'9 10RP_FILTER=$(< /proc/sys/net/ipv4/conf/all/rp_filter)11IPV6_DISABLED=$(< /proc/sys/net/ipv6/conf/all/disable_ipv6)12IPV6_FORWARDING=$(< /proc/sys/net/ipv6/conf/all/forwarding)13 14function config_common {15 local tun_type=$116 17 $IP netns add ns118 $IP netns add ns219 $IP link add ve1 type veth peer name vens120 $IP link add ve2 type veth peer name vens221 $IP link set dev ve1 up22 $IP link set dev ve2 up23 $IP link set dev ve1 mtu 150024 $IP link set dev ve2 mtu 150025 $IP link set dev vens1 netns ns126 $IP link set dev vens2 netns ns227 28 $IP -n ns1 link set dev lo up29 $IP -n ns1 link set dev vens1 up30 $IP -n ns1 addr add 10.1.1.101/24 dev vens131 $IP -n ns1 addr add 2401:db01::65/64 dev vens1 nodad32 $IP -n ns1 route add default via 10.1.1.1 dev vens133 $IP -n ns1 route add default via 2401:db01::1 dev vens134 35 $IP -n ns2 link set dev lo up36 $IP -n ns2 link set dev vens2 up37 $IP -n ns2 addr add 10.2.1.102/24 dev vens238 $IP -n ns2 addr add 2401:db02::66/64 dev vens2 nodad39 $IP -n ns2 addr add 10.10.1.102 dev lo40 $IP -n ns2 addr add 2401:face::66/64 dev lo nodad41 $IP -n ns2 link add ipt2 type ipip local 10.2.1.102 remote 10.2.1.142 $IP -n ns2 link add ip6t2 type ip6tnl mode any local 2401:db02::66 remote 2401:db02::143 $IP -n ns2 link set dev ipt2 up44 $IP -n ns2 link set dev ip6t2 up45 $IP netns exec ns2 $TC qdisc add dev vens2 clsact46 $IP netns exec ns2 $TC filter add dev vens2 ingress bpf da obj $REDIRECT_BPF sec drop_non_tun_vip47 if [[ $tun_type == "ipip" ]]; then48 $IP -n ns2 route add 10.1.1.0/24 dev ipt249 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=050 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ipt2.rp_filter=051 else52 $IP -n ns2 route add 10.1.1.0/24 dev ip6t253 $IP -n ns2 route add 2401:db01::/64 dev ip6t254 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=055 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ip6t2.rp_filter=056 fi57 58 $IP addr add 10.1.1.1/24 dev ve159 $IP addr add 2401:db01::1/64 dev ve1 nodad60 $IP addr add 10.2.1.1/24 dev ve261 $IP addr add 2401:db02::1/64 dev ve2 nodad62 63 $TC qdisc add dev ve2 clsact64 $TC filter add dev ve2 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_forward65 66 sysctl -q -w net.ipv4.conf.all.rp_filter=067 sysctl -q -w net.ipv6.conf.all.forwarding=168 sysctl -q -w net.ipv6.conf.all.disable_ipv6=069}70 71function cleanup {72 set +e73 [[ -z $DEBUG ]] || set +x74 $IP netns delete ns1 >& /dev/null75 $IP netns delete ns2 >& /dev/null76 $IP link del ve1 >& /dev/null77 $IP link del ve2 >& /dev/null78 $IP link del ipt >& /dev/null79 $IP link del ip6t >& /dev/null80 sysctl -q -w net.ipv4.conf.all.rp_filter=$RP_FILTER81 sysctl -q -w net.ipv6.conf.all.forwarding=$IPV6_FORWARDING82 sysctl -q -w net.ipv6.conf.all.disable_ipv6=$IPV6_DISABLED83 rm -f /sys/fs/bpf/tc/globals/tun_iface84 [[ -z $DEBUG ]] || set -x85 set -e86}87 88function l2_to_ipip {89 echo -n "l2_to_ipip $1: "90 91 local dir=$192 93 config_common ipip94 95 $IP link add ipt type ipip external96 $IP link set dev ipt up97 sysctl -q -w net.ipv4.conf.ipt.rp_filter=098 sysctl -q -w net.ipv4.conf.ipt.forwarding=199 100 if [[ $dir == "egress" ]]; then101 $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2102 $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect103 sysctl -q -w net.ipv4.conf.ve1.forwarding=1104 else105 $TC qdisc add dev ve1 clsact106 $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect107 fi108 109 $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ipt/ifindex)110 111 $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null112 113 if [[ $dir == "egress" ]]; then114 # test direct egress to ve2 (i.e. not forwarding from115 # ve1 to ve2).116 ping -c1 10.10.1.102 >& /dev/null117 fi118 119 cleanup120 121 echo "OK"122}123 124function l2_to_ip6tnl {125 echo -n "l2_to_ip6tnl $1: "126 127 local dir=$1128 129 config_common ip6tnl130 131 $IP link add ip6t type ip6tnl mode any external132 $IP link set dev ip6t up133 sysctl -q -w net.ipv4.conf.ip6t.rp_filter=0134 sysctl -q -w net.ipv4.conf.ip6t.forwarding=1135 136 if [[ $dir == "egress" ]]; then137 $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2138 $IP route add 2401:face::/64 via 2401:db02::66 dev ve2139 $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect140 sysctl -q -w net.ipv4.conf.ve1.forwarding=1141 else142 $TC qdisc add dev ve1 clsact143 $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect144 fi145 146 $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ip6t/ifindex)147 148 $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null149 $IP netns exec ns1 ping -6 -c1 2401:face::66 >& /dev/null150 151 if [[ $dir == "egress" ]]; then152 # test direct egress to ve2 (i.e. not forwarding from153 # ve1 to ve2).154 ping -c1 10.10.1.102 >& /dev/null155 ping -6 -c1 2401:face::66 >& /dev/null156 fi157 158 cleanup159 160 echo "OK"161}162 163cleanup164test_names="l2_to_ipip l2_to_ip6tnl"165test_dirs="ingress egress"166if [[ $# -ge 2 ]]; then167 test_names=$1168 test_dirs=$2169elif [[ $# -ge 1 ]]; then170 test_names=$1171fi172 173for t in $test_names; do174 for d in $test_dirs; do175 $t $d176 done177done178