320 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# In-place tunneling5 6BPF_FILE="test_tc_tunnel.bpf.o"7# must match the port that the bpf program filters on8readonly port=80009 10readonly ns_prefix="ns-$$-"11readonly ns1="${ns_prefix}1"12readonly ns2="${ns_prefix}2"13 14readonly ns1_v4=192.168.1.115readonly ns2_v4=192.168.1.216readonly ns1_v6=fd::117readonly ns2_v6=fd::218 19# Must match port used by bpf program20readonly udpport=555521# MPLSoverUDP22readonly mplsudpport=663523readonly mplsproto=13724 25readonly infile="$(mktemp)"26readonly outfile="$(mktemp)"27 28setup() {29 ip netns add "${ns1}"30 ip netns add "${ns2}"31 32 ip link add dev veth1 mtu 1500 netns "${ns1}" type veth \33 peer name veth2 mtu 1500 netns "${ns2}"34 35 ip netns exec "${ns1}" ethtool -K veth1 tso off36 37 ip -netns "${ns1}" link set veth1 up38 ip -netns "${ns2}" link set veth2 up39 40 ip -netns "${ns1}" -4 addr add "${ns1_v4}/24" dev veth141 ip -netns "${ns2}" -4 addr add "${ns2_v4}/24" dev veth242 ip -netns "${ns1}" -6 addr add "${ns1_v6}/64" dev veth1 nodad43 ip -netns "${ns2}" -6 addr add "${ns2_v6}/64" dev veth2 nodad44 45 # clamp route to reserve room for tunnel headers46 ip -netns "${ns1}" -4 route flush table main47 ip -netns "${ns1}" -6 route flush table main48 ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1450 dev veth149 ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1430 dev veth150 51 sleep 152 53 dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none54}55 56cleanup() {57 ip netns del "${ns2}"58 ip netns del "${ns1}"59 60 if [[ -f "${outfile}" ]]; then61 rm "${outfile}"62 fi63 if [[ -f "${infile}" ]]; then64 rm "${infile}"65 fi66 67 if [[ -n $server_pid ]]; then68 kill $server_pid 2> /dev/null69 fi70}71 72server_listen() {73 ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" &74 server_pid=$!75}76 77client_connect() {78 ip netns exec "${ns1}" timeout 2 nc "${netcat_opt}" -w 1 "${addr2}" "${port}" < "${infile}"79 echo $?80}81 82verify_data() {83 wait "${server_pid}"84 server_pid=85 # sha1sum returns two fields [sha1] [filepath]86 # convert to bash array and access first elem87 insum=($(sha1sum ${infile}))88 outsum=($(sha1sum ${outfile}))89 if [[ "${insum[0]}" != "${outsum[0]}" ]]; then90 echo "data mismatch"91 exit 192 fi93}94 95wait_for_port() {96 for i in $(seq 20); do97 if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then98 return 099 fi100 sleep 0.1101 done102 return 1103}104 105set -e106 107# no arguments: automated test, run all108if [[ "$#" -eq "0" ]]; then109 echo "ipip"110 $0 ipv4 ipip none 100111 112 echo "ipip6"113 $0 ipv4 ipip6 none 100114 115 echo "ip6ip6"116 $0 ipv6 ip6tnl none 100117 118 echo "sit"119 $0 ipv6 sit none 100120 121 echo "ip4 vxlan"122 $0 ipv4 vxlan eth 2000123 124 echo "ip6 vxlan"125 $0 ipv6 ip6vxlan eth 2000126 127 for mac in none mpls eth ; do128 echo "ip gre $mac"129 $0 ipv4 gre $mac 100130 131 echo "ip6 gre $mac"132 $0 ipv6 ip6gre $mac 100133 134 echo "ip gre $mac gso"135 $0 ipv4 gre $mac 2000136 137 echo "ip6 gre $mac gso"138 $0 ipv6 ip6gre $mac 2000139 140 echo "ip udp $mac"141 $0 ipv4 udp $mac 100142 143 echo "ip6 udp $mac"144 $0 ipv6 ip6udp $mac 100145 146 echo "ip udp $mac gso"147 $0 ipv4 udp $mac 2000148 149 echo "ip6 udp $mac gso"150 $0 ipv6 ip6udp $mac 2000151 done152 153 echo "OK. All tests passed"154 exit 0155fi156 157if [[ "$#" -ne "4" ]]; then158 echo "Usage: $0"159 echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls|eth> <data_len>"160 exit 1161fi162 163case "$1" in164"ipv4")165 readonly addr1="${ns1_v4}"166 readonly addr2="${ns2_v4}"167 readonly ipproto=4168 readonly netcat_opt=-${ipproto}169 readonly foumod=fou170 readonly foutype=ipip171 readonly fouproto=4172 readonly fouproto_mpls=${mplsproto}173 readonly gretaptype=gretap174 ;;175"ipv6")176 readonly addr1="${ns1_v6}"177 readonly addr2="${ns2_v6}"178 readonly ipproto=6179 readonly netcat_opt=-${ipproto}180 readonly foumod=fou6181 readonly foutype=ip6tnl182 readonly fouproto="41 -6"183 readonly fouproto_mpls="${mplsproto} -6"184 readonly gretaptype=ip6gretap185 ;;186*)187 echo "unknown arg: $1"188 exit 1189 ;;190esac191 192readonly tuntype=$2193readonly mac=$3194readonly datalen=$4195 196echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"197 198trap cleanup EXIT199 200setup201 202# basic communication works203echo "test basic connectivity"204server_listen205wait_for_port ${port} ${netcat_opt}206client_connect207verify_data208 209# clientside, insert bpf program to encap all TCP to port ${port}210# client can no longer connect211ip netns exec "${ns1}" tc qdisc add dev veth1 clsact212ip netns exec "${ns1}" tc filter add dev veth1 egress \213 bpf direct-action object-file ${BPF_FILE} \214 section "encap_${tuntype}_${mac}"215echo "test bpf encap without decap (expect failure)"216server_listen217wait_for_port ${port} ${netcat_opt}218! client_connect219 220if [[ "$tuntype" =~ "udp" ]]; then221 # Set up fou tunnel.222 ttype="${foutype}"223 targs="encap fou encap-sport auto encap-dport $udpport"224 # fou may be a module; allow this to fail.225 modprobe "${foumod}" ||true226 if [[ "$mac" == "mpls" ]]; then227 dport=${mplsudpport}228 dproto=${fouproto_mpls}229 tmode="mode any ttl 255"230 else231 dport=${udpport}232 dproto=${fouproto}233 fi234 ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}235 targs="encap fou encap-sport auto encap-dport $dport"236elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then237 ttype=$gretaptype238elif [[ "$tuntype" =~ "vxlan" && "$mac" == "eth" ]]; then239 ttype="vxlan"240 targs="id 1 dstport 8472 udp6zerocsumrx"241elif [[ "$tuntype" == "ipip6" ]]; then242 ttype="ip6tnl"243 targs=""244else245 ttype=$tuntype246 targs=""247fi248 249# tunnel address family differs from inner for SIT250if [[ "${tuntype}" == "sit" ]]; then251 link_addr1="${ns1_v4}"252 link_addr2="${ns2_v4}"253elif [[ "${tuntype}" == "ipip6" ]]; then254 link_addr1="${ns1_v6}"255 link_addr2="${ns2_v6}"256else257 link_addr1="${addr1}"258 link_addr2="${addr2}"259fi260 261# serverside, insert decap module262# server is still running263# client can connect again264ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \265 ${tmode} remote "${link_addr1}" local "${link_addr2}" $targs266 267expect_tun_fail=0268 269if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then270 # No support for MPLS IPv6 fou tunnel; expect failure.271 expect_tun_fail=1272elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then273 # No support for TEB fou tunnel; expect failure.274 expect_tun_fail=1275elif [[ "$tuntype" =~ (gre|vxlan) && "$mac" == "eth" ]]; then276 # Share ethernet address between tunnel/veth2 so L2 decap works.277 ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \278 awk '/ether/ { print $2 }')279 ip netns exec "${ns2}" ip link set testtun0 address $ethaddr280elif [[ "$mac" == "mpls" ]]; then281 modprobe mpls_iptunnel ||true282 modprobe mpls_gso ||true283 ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536284 ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo285 ip netns exec "${ns2}" ip link set lo up286 ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1287 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0288fi289 290# Because packets are decapped by the tunnel they arrive on testtun0 from291# the IP stack perspective. Ensure reverse path filtering is disabled292# otherwise we drop the TCP SYN as arriving on testtun0 instead of the293# expected veth2 (veth2 is where 192.168.1.2 is configured).294ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0295# rp needs to be disabled for both all and testtun0 as the rp value is296# selected as the max of the "all" and device-specific values.297ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0298ip netns exec "${ns2}" ip link set dev testtun0 up299if [[ "$expect_tun_fail" == 1 ]]; then300 # This tunnel mode is not supported, so we expect failure.301 echo "test bpf encap with tunnel device decap (expect failure)"302 ! client_connect303else304 echo "test bpf encap with tunnel device decap"305 client_connect306 verify_data307 server_listen308fi309 310# serverside, use BPF for decap311ip netns exec "${ns2}" ip link del dev testtun0312ip netns exec "${ns2}" tc qdisc add dev veth2 clsact313ip netns exec "${ns2}" tc filter add dev veth2 ingress \314 bpf direct-action object-file ${BPF_FILE} section decap315echo "test bpf encap with bpf decap"316client_connect317verify_data318 319echo OK320