brintos / linux-shallow public Read only

1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# Copyright (c) 2019 David Ahern <dsahern@gmail.com>. All rights reserved.5#6# IPv4 and IPv6 functional tests focusing on VRF and routing lookups7# for various permutations:8#   1. icmp, tcp, udp and netfilter9#   2. client, server, no-server10#   3. global address on interface11#   4. global address on 'lo'12#   5. remote and local traffic13#   6. VRF and non-VRF permutations14#15# Setup:16#                     ns-A     |     ns-B17# No VRF case:18#    [ lo ]         [ eth1 ]---|---[ eth1 ]      [ lo ]19#                                                remote address20# VRF case:21#         [ red ]---[ eth1 ]---|---[ eth1 ]      [ lo ]22#23# ns-A:24#     eth1: 172.16.1.1/24, 2001:db8:1::1/6425#       lo: 127.0.0.1/8, ::1/12826#           172.16.2.1/32, 2001:db8:2::1/12827#      red: 127.0.0.1/8, ::1/12828#           172.16.3.1/32, 2001:db8:3::1/12829#30# ns-B:31#     eth1: 172.16.1.2/24, 2001:db8:1::2/6432#      lo2: 127.0.0.1/8, ::1/12833#           172.16.2.2/32, 2001:db8:2::2/12834#35# ns-A to ns-C connection - only for VRF and same config36# as ns-A to ns-B37#38# server / client nomenclature relative to ns-A39 40source lib.sh41 42PATH=$PWD:$PWD/tools/testing/selftests/net:$PATH43 44VERBOSE=045 46NSA_DEV=eth147NSA_DEV2=eth248NSB_DEV=eth149NSC_DEV=eth250VRF=red51VRF_TABLE=110152 53# IPv4 config54NSA_IP=172.16.1.155NSB_IP=172.16.1.256VRF_IP=172.16.3.157NS_NET=172.16.1.0/2458 59# IPv6 config60NSA_IP6=2001:db8:1::161NSB_IP6=2001:db8:1::262VRF_IP6=2001:db8:3::163NS_NET6=2001:db8:1::/12064 65NSA_LO_IP=172.16.2.166NSB_LO_IP=172.16.2.267NSA_LO_IP6=2001:db8:2::168NSB_LO_IP6=2001:db8:2::269 70# non-local addresses for freebind tests71NL_IP=172.17.1.172NL_IP6=2001:db8:4::173 74# multicast and broadcast addresses75MCAST_IP=224.0.0.176BCAST_IP=255.255.255.25577 78MD5_PW=abc12379MD5_WRONG_PW=abc123480 81MCAST=ff02::182# set after namespace create83NSA_LINKIP6=84NSB_LINKIP6=85 86which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)87 88# Check if FIPS mode is enabled89if [ -f /proc/sys/crypto/fips_enabled ]; then90	fips_enabled=`cat /proc/sys/crypto/fips_enabled`91else92	fips_enabled=093fi94 95################################################################################96# utilities97 98log_test()99{100	local rc=$1101	local expected=$2102	local msg="$3"103	local ans104 105	[ "${VERBOSE}" = "1" ] && echo106 107	if [ ${rc} -eq ${expected} ]; then108		nsuccess=$((nsuccess+1))109		printf "TEST: %-70s  [ OK ]\n" "${msg}"110	else111		nfail=$((nfail+1))112		printf "TEST: %-70s  [FAIL]\n" "${msg}"113		echo "    expected rc $expected; actual rc $rc"114		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then115			echo116			echo "hit enter to continue, 'q' to quit"117			read ans118			[ "$ans" = "q" ] && exit 1119		fi120	fi121 122	if [ "${PAUSE}" = "yes" ]; then123		echo124		echo "hit enter to continue, 'q' to quit"125		read ans126		[ "$ans" = "q" ] && exit 1127	fi128 129	kill_procs130}131 132log_test_addr()133{134	local addr=$1135	local rc=$2136	local expected=$3137	local msg="$4"138	local astr139 140	astr=$(addr2str ${addr})141	log_test $rc $expected "$msg - ${astr}"142}143 144log_section()145{146	echo147	echo "###########################################################################"148	echo "$*"149	echo "###########################################################################"150	echo151}152 153log_subsection()154{155	echo156	echo "#################################################################"157	echo "$*"158	echo159}160 161log_start()162{163	# make sure we have no test instances running164	kill_procs165 166	if [ "${VERBOSE}" = "1" ]; then167		echo168		echo "#######################################################"169	fi170}171 172log_debug()173{174	if [ "${VERBOSE}" = "1" ]; then175		echo176		echo "$*"177		echo178	fi179}180 181show_hint()182{183	if [ "${VERBOSE}" = "1" ]; then184		echo "HINT: $*"185		echo186	fi187}188 189kill_procs()190{191	killall nettest ping ping6 >/dev/null 2>&1192	sleep 1193}194 195set_ping_group()196{197	if [ "$VERBOSE" = "1" ]; then198		echo "COMMAND: ${NSA_CMD} sysctl -q -w net.ipv4.ping_group_range='0 2147483647'"199	fi200 201	${NSA_CMD} sysctl -q -w net.ipv4.ping_group_range='0 2147483647'202}203 204do_run_cmd()205{206	local cmd="$*"207	local out208 209	if [ "$VERBOSE" = "1" ]; then210		echo "COMMAND: ${cmd}"211	fi212 213	out=$($cmd 2>&1)214	rc=$?215	if [ "$VERBOSE" = "1" -a -n "$out" ]; then216		echo "$out"217	fi218 219	return $rc220}221 222run_cmd()223{224	do_run_cmd ${NSA_CMD} $*225}226 227run_cmd_nsb()228{229	do_run_cmd ${NSB_CMD} $*230}231 232run_cmd_nsc()233{234	do_run_cmd ${NSC_CMD} $*235}236 237setup_cmd()238{239	local cmd="$*"240	local rc241 242	run_cmd ${cmd}243	rc=$?244	if [ $rc -ne 0 ]; then245		# show user the command if not done so already246		if [ "$VERBOSE" = "0" ]; then247			echo "setup command: $cmd"248		fi249		echo "failed. stopping tests"250		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then251			echo252			echo "hit enter to continue"253			read a254		fi255		exit $rc256	fi257}258 259setup_cmd_nsb()260{261	local cmd="$*"262	local rc263 264	run_cmd_nsb ${cmd}265	rc=$?266	if [ $rc -ne 0 ]; then267		# show user the command if not done so already268		if [ "$VERBOSE" = "0" ]; then269			echo "setup command: $cmd"270		fi271		echo "failed. stopping tests"272		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then273			echo274			echo "hit enter to continue"275			read a276		fi277		exit $rc278	fi279}280 281setup_cmd_nsc()282{283	local cmd="$*"284	local rc285 286	run_cmd_nsc ${cmd}287	rc=$?288	if [ $rc -ne 0 ]; then289		# show user the command if not done so already290		if [ "$VERBOSE" = "0" ]; then291			echo "setup command: $cmd"292		fi293		echo "failed. stopping tests"294		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then295			echo296			echo "hit enter to continue"297			read a298		fi299		exit $rc300	fi301}302 303# set sysctl values in NS-A304set_sysctl()305{306	echo "SYSCTL: $*"307	echo308	run_cmd sysctl -q -w $*309}310 311# get sysctl values in NS-A312get_sysctl()313{314	${NSA_CMD} sysctl -n $*315}316 317################################################################################318# Setup for tests319 320addr2str()321{322	case "$1" in323	127.0.0.1) echo "loopback";;324	::1) echo "IPv6 loopback";;325 326	${BCAST_IP}) echo "broadcast";;327	${MCAST_IP}) echo "multicast";;328 329	${NSA_IP})	echo "ns-A IP";;330	${NSA_IP6})	echo "ns-A IPv6";;331	${NSA_LO_IP})	echo "ns-A loopback IP";;332	${NSA_LO_IP6})	echo "ns-A loopback IPv6";;333	${NSA_LINKIP6}|${NSA_LINKIP6}%*) echo "ns-A IPv6 LLA";;334 335	${NSB_IP})	echo "ns-B IP";;336	${NSB_IP6})	echo "ns-B IPv6";;337	${NSB_LO_IP})	echo "ns-B loopback IP";;338	${NSB_LO_IP6})	echo "ns-B loopback IPv6";;339	${NSB_LINKIP6}|${NSB_LINKIP6}%*) echo "ns-B IPv6 LLA";;340 341	${NL_IP})       echo "nonlocal IP";;342	${NL_IP6})      echo "nonlocal IPv6";;343 344	${VRF_IP})	echo "VRF IP";;345	${VRF_IP6})	echo "VRF IPv6";;346 347	${MCAST}%*)	echo "multicast IP";;348 349	*) echo "unknown";;350	esac351}352 353get_linklocal()354{355	local ns=$1356	local dev=$2357	local addr358 359	addr=$(ip -netns ${ns} -6 -br addr show dev ${dev} | \360	awk '{361		for (i = 3; i <= NF; ++i) {362			if ($i ~ /^fe80/)363				print $i364		}365	}'366	)367	addr=${addr/\/*}368 369	[ -z "$addr" ] && return 1370 371	echo $addr372 373	return 0374}375 376################################################################################377# create namespaces and vrf378 379create_vrf()380{381	local ns=$1382	local vrf=$2383	local table=$3384	local addr=$4385	local addr6=$5386 387	ip -netns ${ns} link add ${vrf} type vrf table ${table}388	ip -netns ${ns} link set ${vrf} up389	ip -netns ${ns} route add vrf ${vrf} unreachable default metric 8192390	ip -netns ${ns} -6 route add vrf ${vrf} unreachable default metric 8192391 392	ip -netns ${ns} addr add 127.0.0.1/8 dev ${vrf}393	ip -netns ${ns} -6 addr add ::1 dev ${vrf} nodad394	if [ "${addr}" != "-" ]; then395		ip -netns ${ns} addr add dev ${vrf} ${addr}396	fi397	if [ "${addr6}" != "-" ]; then398		ip -netns ${ns} -6 addr add dev ${vrf} ${addr6}399	fi400 401	ip -netns ${ns} ru del pref 0402	ip -netns ${ns} ru add pref 32765 from all lookup local403	ip -netns ${ns} -6 ru del pref 0404	ip -netns ${ns} -6 ru add pref 32765 from all lookup local405}406 407create_ns()408{409	local ns=$1410	local addr=$2411	local addr6=$3412 413	if [ "${addr}" != "-" ]; then414		ip -netns ${ns} addr add dev lo ${addr}415	fi416	if [ "${addr6}" != "-" ]; then417		ip -netns ${ns} -6 addr add dev lo ${addr6}418	fi419 420	ip -netns ${ns} ro add unreachable default metric 8192421	ip -netns ${ns} -6 ro add unreachable default metric 8192422 423	ip netns exec ${ns} sysctl -qw net.ipv4.ip_forward=1424	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1425	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1426	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1427}428 429# create veth pair to connect namespaces and apply addresses.430connect_ns()431{432	local ns1=$1433	local ns1_dev=$2434	local ns1_addr=$3435	local ns1_addr6=$4436	local ns2=$5437	local ns2_dev=$6438	local ns2_addr=$7439	local ns2_addr6=$8440 441	ip -netns ${ns1} li add ${ns1_dev} type veth peer name tmp442	ip -netns ${ns1} li set ${ns1_dev} up443	ip -netns ${ns1} li set tmp netns ${ns2} name ${ns2_dev}444	ip -netns ${ns2} li set ${ns2_dev} up445 446	if [ "${ns1_addr}" != "-" ]; then447		ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr}448		ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr}449	fi450 451	if [ "${ns1_addr6}" != "-" ]; then452		ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr6}453		ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr6}454	fi455}456 457cleanup()458{459	# explicit cleanups to check those code paths460	ip netns | grep -q ${NSA}461	if [ $? -eq 0 ]; then462		ip -netns ${NSA} link delete ${VRF}463		ip -netns ${NSA} ro flush table ${VRF_TABLE}464 465		ip -netns ${NSA} addr flush dev ${NSA_DEV}466		ip -netns ${NSA} -6 addr flush dev ${NSA_DEV}467		ip -netns ${NSA} link set dev ${NSA_DEV} down468		ip -netns ${NSA} link del dev ${NSA_DEV}469 470		ip netns pids ${NSA} | xargs kill 2>/dev/null471		cleanup_ns ${NSA}472	fi473 474	ip netns pids ${NSB} | xargs kill 2>/dev/null475	ip netns pids ${NSC} | xargs kill 2>/dev/null476	cleanup_ns ${NSB} ${NSC}477}478 479cleanup_vrf_dup()480{481	ip link del ${NSA_DEV2} >/dev/null 2>&1482	ip netns pids ${NSC} | xargs kill 2>/dev/null483	ip netns del ${NSC} >/dev/null 2>&1484}485 486setup_vrf_dup()487{488	# some VRF tests use ns-C which has the same config as489	# ns-B but for a device NOT in the VRF490	setup_ns NSC491	NSC_CMD="ip netns exec ${NSC}"492	create_ns ${NSC} "-" "-"493	connect_ns ${NSA} ${NSA_DEV2} ${NSA_IP}/24 ${NSA_IP6}/64 \494		   ${NSC} ${NSC_DEV} ${NSB_IP}/24 ${NSB_IP6}/64495}496 497setup()498{499	local with_vrf=${1}500 501	# make sure we are starting with a clean slate502	kill_procs503	cleanup 2>/dev/null504 505	log_debug "Configuring network namespaces"506	set -e507 508	setup_ns NSA NSB509	NSA_CMD="ip netns exec ${NSA}"510	NSB_CMD="ip netns exec ${NSB}"511 512	create_ns ${NSA} ${NSA_LO_IP}/32 ${NSA_LO_IP6}/128513	create_ns ${NSB} ${NSB_LO_IP}/32 ${NSB_LO_IP6}/128514	connect_ns ${NSA} ${NSA_DEV} ${NSA_IP}/24 ${NSA_IP6}/64 \515		   ${NSB} ${NSB_DEV} ${NSB_IP}/24 ${NSB_IP6}/64516 517	NSA_LINKIP6=$(get_linklocal ${NSA} ${NSA_DEV})518	NSB_LINKIP6=$(get_linklocal ${NSB} ${NSB_DEV})519 520	# tell ns-A how to get to remote addresses of ns-B521	if [ "${with_vrf}" = "yes" ]; then522		create_vrf ${NSA} ${VRF} ${VRF_TABLE} ${VRF_IP} ${VRF_IP6}523 524		ip -netns ${NSA} link set dev ${NSA_DEV} vrf ${VRF}525		ip -netns ${NSA} ro add vrf ${VRF} ${NSB_LO_IP}/32 via ${NSB_IP} dev ${NSA_DEV}526		ip -netns ${NSA} -6 ro add vrf ${VRF} ${NSB_LO_IP6}/128 via ${NSB_IP6} dev ${NSA_DEV}527 528		ip -netns ${NSB} ro add ${VRF_IP}/32 via ${NSA_IP} dev ${NSB_DEV}529		ip -netns ${NSB} -6 ro add ${VRF_IP6}/128 via ${NSA_IP6} dev ${NSB_DEV}530	else531		ip -netns ${NSA} ro add ${NSB_LO_IP}/32 via ${NSB_IP} dev ${NSA_DEV}532		ip -netns ${NSA} ro add ${NSB_LO_IP6}/128 via ${NSB_IP6} dev ${NSA_DEV}533	fi534 535 536	# tell ns-B how to get to remote addresses of ns-A537	ip -netns ${NSB} ro add ${NSA_LO_IP}/32 via ${NSA_IP} dev ${NSB_DEV}538	ip -netns ${NSB} ro add ${NSA_LO_IP6}/128 via ${NSA_IP6} dev ${NSB_DEV}539 540	set +e541 542	sleep 1543}544 545setup_lla_only()546{547	# make sure we are starting with a clean slate548	kill_procs549	cleanup 2>/dev/null550 551	log_debug "Configuring network namespaces"552	set -e553 554	setup_ns NSA NSB NSC555	NSA_CMD="ip netns exec ${NSA}"556	NSB_CMD="ip netns exec ${NSB}"557	NSC_CMD="ip netns exec ${NSC}"558	create_ns ${NSA} "-" "-"559	create_ns ${NSB} "-" "-"560	create_ns ${NSC} "-" "-"561	connect_ns ${NSA} ${NSA_DEV} "-" "-" \562		   ${NSB} ${NSB_DEV} "-" "-"563	connect_ns ${NSA} ${NSA_DEV2} "-" "-" \564		   ${NSC} ${NSC_DEV}  "-" "-"565 566	NSA_LINKIP6=$(get_linklocal ${NSA} ${NSA_DEV})567	NSB_LINKIP6=$(get_linklocal ${NSB} ${NSB_DEV})568	NSC_LINKIP6=$(get_linklocal ${NSC} ${NSC_DEV})569 570	create_vrf ${NSA} ${VRF} ${VRF_TABLE} "-" "-"571	ip -netns ${NSA} link set dev ${NSA_DEV} vrf ${VRF}572	ip -netns ${NSA} link set dev ${NSA_DEV2} vrf ${VRF}573 574	set +e575 576	sleep 1577}578 579################################################################################580# IPv4581 582ipv4_ping_novrf()583{584	local a585 586	#587	# out588	#589	for a in ${NSB_IP} ${NSB_LO_IP}590	do591		log_start592		run_cmd ping -c1 -w1 ${a}593		log_test_addr ${a} $? 0 "ping out"594 595		log_start596		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}597		log_test_addr ${a} $? 0 "ping out, device bind"598 599		log_start600		run_cmd ping -c1 -w1 -I ${NSA_LO_IP} ${a}601		log_test_addr ${a} $? 0 "ping out, address bind"602	done603 604	#605	# out, but don't use gateway if peer is not on link606	#607	a=${NSB_IP}608	log_start609	run_cmd ping -c 1 -w 1 -r ${a}610	log_test_addr ${a} $? 0 "ping out (don't route), peer on link"611 612	a=${NSB_LO_IP}613	log_start614	show_hint "Fails since peer is not on link"615	run_cmd ping -c 1 -w 1 -r ${a}616	log_test_addr ${a} $? 1 "ping out (don't route), peer not on link"617 618	#619	# in620	#621	for a in ${NSA_IP} ${NSA_LO_IP}622	do623		log_start624		run_cmd_nsb ping -c1 -w1 ${a}625		log_test_addr ${a} $? 0 "ping in"626	done627 628	#629	# local traffic630	#631	for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1632	do633		log_start634		run_cmd ping -c1 -w1 ${a}635		log_test_addr ${a} $? 0 "ping local"636	done637 638	#639	# local traffic, socket bound to device640	#641	# address on device642	a=${NSA_IP}643	log_start644	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}645	log_test_addr ${a} $? 0 "ping local, device bind"646 647	# loopback addresses not reachable from device bind648	# fails in a really weird way though because ipv4 special cases649	# route lookups with oif set.650	for a in ${NSA_LO_IP} 127.0.0.1651	do652		log_start653		show_hint "Fails since address on loopback device is out of device scope"654		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}655		log_test_addr ${a} $? 1 "ping local, device bind"656	done657 658	#659	# ip rule blocks reachability to remote address660	#661	log_start662	setup_cmd ip rule add pref 32765 from all lookup local663	setup_cmd ip rule del pref 0 from all lookup local664	setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit665	setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit666 667	a=${NSB_LO_IP}668	run_cmd ping -c1 -w1 ${a}669	log_test_addr ${a} $? 2 "ping out, blocked by rule"670 671	# NOTE: ipv4 actually allows the lookup to fail and yet still create672	# a viable rtable if the oif (e.g., bind to device) is set, so this673	# case succeeds despite the rule674	# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}675 676	a=${NSA_LO_IP}677	log_start678	show_hint "Response generates ICMP (or arp request is ignored) due to ip rule"679	run_cmd_nsb ping -c1 -w1 ${a}680	log_test_addr ${a} $? 1 "ping in, blocked by rule"681 682	[ "$VERBOSE" = "1" ] && echo683	setup_cmd ip rule del pref 32765 from all lookup local684	setup_cmd ip rule add pref 0 from all lookup local685	setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit686	setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit687 688	#689	# route blocks reachability to remote address690	#691	log_start692	setup_cmd ip route replace unreachable ${NSB_LO_IP}693	setup_cmd ip route replace unreachable ${NSB_IP}694 695	a=${NSB_LO_IP}696	run_cmd ping -c1 -w1 ${a}697	log_test_addr ${a} $? 2 "ping out, blocked by route"698 699	# NOTE: ipv4 actually allows the lookup to fail and yet still create700	# a viable rtable if the oif (e.g., bind to device) is set, so this701	# case succeeds despite not having a route for the address702	# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}703 704	a=${NSA_LO_IP}705	log_start706	show_hint "Response is dropped (or arp request is ignored) due to ip route"707	run_cmd_nsb ping -c1 -w1 ${a}708	log_test_addr ${a} $? 1 "ping in, blocked by route"709 710	#711	# remove 'remote' routes; fallback to default712	#713	log_start714	setup_cmd ip ro del ${NSB_LO_IP}715 716	a=${NSB_LO_IP}717	run_cmd ping -c1 -w1 ${a}718	log_test_addr ${a} $? 2 "ping out, unreachable default route"719 720	# NOTE: ipv4 actually allows the lookup to fail and yet still create721	# a viable rtable if the oif (e.g., bind to device) is set, so this722	# case succeeds despite not having a route for the address723	# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}724}725 726ipv4_ping_vrf()727{728	local a729 730	# should default on; does not exist on older kernels731	set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null732 733	#734	# out735	#736	for a in ${NSB_IP} ${NSB_LO_IP}737	do738		log_start739		run_cmd ping -c1 -w1 -I ${VRF} ${a}740		log_test_addr ${a} $? 0 "ping out, VRF bind"741 742		log_start743		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}744		log_test_addr ${a} $? 0 "ping out, device bind"745 746		log_start747		run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${NSA_IP} ${a}748		log_test_addr ${a} $? 0 "ping out, vrf device + dev address bind"749 750		log_start751		run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${VRF_IP} ${a}752		log_test_addr ${a} $? 0 "ping out, vrf device + vrf address bind"753	done754 755	#756	# in757	#758	for a in ${NSA_IP} ${VRF_IP}759	do760		log_start761		run_cmd_nsb ping -c1 -w1 ${a}762		log_test_addr ${a} $? 0 "ping in"763	done764 765	#766	# local traffic, local address767	#768	for a in ${NSA_IP} ${VRF_IP} 127.0.0.1769	do770		log_start771		show_hint "Source address should be ${a}"772		run_cmd ping -c1 -w1 -I ${VRF} ${a}773		log_test_addr ${a} $? 0 "ping local, VRF bind"774	done775 776	#777	# local traffic, socket bound to device778	#779	# address on device780	a=${NSA_IP}781	log_start782	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}783	log_test_addr ${a} $? 0 "ping local, device bind"784 785	# vrf device is out of scope786	for a in ${VRF_IP} 127.0.0.1787	do788		log_start789		show_hint "Fails since address on vrf device is out of device scope"790		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}791		log_test_addr ${a} $? 2 "ping local, device bind"792	done793 794	#795	# ip rule blocks address796	#797	log_start798	setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit799	setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit800 801	a=${NSB_LO_IP}802	run_cmd ping -c1 -w1 -I ${VRF} ${a}803	log_test_addr ${a} $? 2 "ping out, vrf bind, blocked by rule"804 805	log_start806	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}807	log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"808 809	a=${NSA_LO_IP}810	log_start811	show_hint "Response lost due to ip rule"812	run_cmd_nsb ping -c1 -w1 ${a}813	log_test_addr ${a} $? 1 "ping in, blocked by rule"814 815	[ "$VERBOSE" = "1" ] && echo816	setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit817	setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit818 819	#820	# remove 'remote' routes; fallback to default821	#822	log_start823	setup_cmd ip ro del vrf ${VRF} ${NSB_LO_IP}824 825	a=${NSB_LO_IP}826	run_cmd ping -c1 -w1 -I ${VRF} ${a}827	log_test_addr ${a} $? 2 "ping out, vrf bind, unreachable route"828 829	log_start830	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}831	log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"832 833	a=${NSA_LO_IP}834	log_start835	show_hint "Response lost by unreachable route"836	run_cmd_nsb ping -c1 -w1 ${a}837	log_test_addr ${a} $? 1 "ping in, unreachable route"838}839 840ipv4_ping()841{842	log_section "IPv4 ping"843 844	log_subsection "No VRF"845	setup846	set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null847	ipv4_ping_novrf848	setup849	set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null850	ipv4_ping_novrf851	setup852	set_ping_group853	ipv4_ping_novrf854 855	log_subsection "With VRF"856	setup "yes"857	ipv4_ping_vrf858	setup "yes"859	set_ping_group860	ipv4_ping_vrf861}862 863################################################################################864# IPv4 TCP865 866#867# MD5 tests without VRF868#869ipv4_tcp_md5_novrf()870{871	#872	# single address873	#874 875	# basic use case876	log_start877	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &878	sleep 1879	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}880	log_test $? 0 "MD5: Single address config"881 882	# client sends MD5, server not configured883	log_start884	show_hint "Should timeout due to MD5 mismatch"885	run_cmd nettest -s &886	sleep 1887	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}888	log_test $? 2 "MD5: Server no config, client uses password"889 890	# wrong password891	log_start892	show_hint "Should timeout since client uses wrong password"893	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &894	sleep 1895	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}896	log_test $? 2 "MD5: Client uses wrong password"897 898	# client from different address899	log_start900	show_hint "Should timeout due to MD5 mismatch"901	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} &902	sleep 1903	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}904	log_test $? 2 "MD5: Client address does not match address configured with password"905 906	#907	# MD5 extension - prefix length908	#909 910	# client in prefix911	log_start912	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &913	sleep 1914	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}915	log_test $? 0 "MD5: Prefix config"916 917	# client in prefix, wrong password918	log_start919	show_hint "Should timeout since client uses wrong password"920	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &921	sleep 1922	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}923	log_test $? 2 "MD5: Prefix config, client uses wrong password"924 925	# client outside of prefix926	log_start927	show_hint "Should timeout due to MD5 mismatch"928	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &929	sleep 1930	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}931	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"932}933 934#935# MD5 tests with VRF936#937ipv4_tcp_md5()938{939	#940	# single address941	#942 943	# basic use case944	log_start945	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &946	sleep 1947	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}948	log_test $? 0 "MD5: VRF: Single address config"949 950	# client sends MD5, server not configured951	log_start952	show_hint "Should timeout since server does not have MD5 auth"953	run_cmd nettest -s -I ${VRF} &954	sleep 1955	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}956	log_test $? 2 "MD5: VRF: Server no config, client uses password"957 958	# wrong password959	log_start960	show_hint "Should timeout since client uses wrong password"961	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &962	sleep 1963	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}964	log_test $? 2 "MD5: VRF: Client uses wrong password"965 966	# client from different address967	log_start968	show_hint "Should timeout since server config differs from client"969	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} &970	sleep 1971	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}972	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"973 974	#975	# MD5 extension - prefix length976	#977 978	# client in prefix979	log_start980	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &981	sleep 1982	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}983	log_test $? 0 "MD5: VRF: Prefix config"984 985	# client in prefix, wrong password986	log_start987	show_hint "Should timeout since client uses wrong password"988	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &989	sleep 1990	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}991	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"992 993	# client outside of prefix994	log_start995	show_hint "Should timeout since client address is outside of prefix"996	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &997	sleep 1998	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}999	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"1000 1001	#1002	# duplicate config between default VRF and a VRF1003	#1004 1005	log_start1006	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &1007	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &1008	sleep 11009	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}1010	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"1011 1012	log_start1013	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &1014	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &1015	sleep 11016	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}1017	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"1018 1019	log_start1020	show_hint "Should timeout since client in default VRF uses VRF password"1021	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &1022	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &1023	sleep 11024	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}1025	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"1026 1027	log_start1028	show_hint "Should timeout since client in VRF uses default VRF password"1029	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &1030	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &1031	sleep 11032	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}1033	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"1034 1035	log_start1036	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &1037	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &1038	sleep 11039	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}1040	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"1041 1042	log_start1043	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &1044	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &1045	sleep 11046	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}1047	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"1048 1049	log_start1050	show_hint "Should timeout since client in default VRF uses VRF password"1051	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &1052	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &1053	sleep 11054	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}1055	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"1056 1057	log_start1058	show_hint "Should timeout since client in VRF uses default VRF password"1059	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &1060	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &1061	sleep 11062	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}1063	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"1064 1065	#1066	# negative tests1067	#1068	log_start1069	run_cmd nettest -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NSB_IP}1070	log_test $? 1 "MD5: VRF: Device must be a VRF - single address"1071 1072	log_start1073	run_cmd nettest -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NS_NET}1074	log_test $? 1 "MD5: VRF: Device must be a VRF - prefix"1075 1076	test_ipv4_md5_vrf__vrf_server__no_bind_ifindex1077	test_ipv4_md5_vrf__global_server__bind_ifindex01078}1079 1080test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()1081{1082	log_start1083	show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"1084	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &1085	sleep 11086	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}1087	log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"1088 1089	log_start1090	show_hint "Binding both the socket and the key is not required but it works"1091	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &1092	sleep 11093	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}1094	log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"1095}1096 1097test_ipv4_md5_vrf__global_server__bind_ifindex0()1098{1099	# This particular test needs tcp_l3mdev_accept=1 for Global server to accept VRF connections1100	local old_tcp_l3mdev_accept1101	old_tcp_l3mdev_accept=$(get_sysctl net.ipv4.tcp_l3mdev_accept)1102	set_sysctl net.ipv4.tcp_l3mdev_accept=11103 1104	log_start1105	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &1106	sleep 11107	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}1108	log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"1109 1110	log_start1111	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &1112	sleep 11113	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}1114	log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"1115	log_start1116 1117	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &1118	sleep 11119	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}1120	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"1121 1122	log_start1123	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &1124	sleep 11125	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}1126	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"1127 1128	# restore value1129	set_sysctl net.ipv4.tcp_l3mdev_accept="$old_tcp_l3mdev_accept"1130}1131 1132ipv4_tcp_dontroute()1133{1134	local syncookies=$11135	local nsa_syncookies1136	local nsb_syncookies1137	local a1138 1139	#1140	# Link local connection tests (SO_DONTROUTE).1141	# Connections should succeed only when the remote IP address is1142	# on link (doesn't need to be routed through a gateway).1143	#1144 1145	nsa_syncookies=$(ip netns exec "${NSA}" sysctl -n net.ipv4.tcp_syncookies)1146	nsb_syncookies=$(ip netns exec "${NSB}" sysctl -n net.ipv4.tcp_syncookies)1147	ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies}1148	ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies}1149 1150	# Test with eth1 address (on link).1151 1152	a=${NSB_IP}1153	log_start1154	do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -r ${a} --client-dontroute1155	log_test_addr ${a} $? 0 "SO_DONTROUTE client, syncookies=${syncookies}"1156 1157	a=${NSB_IP}1158	log_start1159	do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -r ${a} --server-dontroute1160	log_test_addr ${a} $? 0 "SO_DONTROUTE server, syncookies=${syncookies}"1161 1162	# Test with loopback address (routed).1163	#1164	# The client would use the eth1 address as source IP by default.1165	# Therefore, we need to use the -c option here, to force the use of the1166	# routed (loopback) address as source IP (so that the server will try1167	# to respond to a routed address and not a link local one).1168 1169	a=${NSB_LO_IP}1170	log_start1171	show_hint "Should fail 'Network is unreachable' since server is not on link"1172	do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -c "${NSA_LO_IP}" -r ${a} --client-dontroute1173	log_test_addr ${a} $? 1 "SO_DONTROUTE client, syncookies=${syncookies}"1174 1175	a=${NSB_LO_IP}1176	log_start1177	show_hint "Should timeout since server cannot respond (client is not on link)"1178	do_run_cmd nettest -B -N "${NSA}" -O "${NSB}" -c "${NSA_LO_IP}" -r ${a} --server-dontroute1179	log_test_addr ${a} $? 2 "SO_DONTROUTE server, syncookies=${syncookies}"1180 1181	ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${nsb_syncookies}1182	ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${nsa_syncookies}1183}1184 1185ipv4_tcp_novrf()1186{1187	local a1188 1189	#1190	# server tests1191	#1192	for a in ${NSA_IP} ${NSA_LO_IP}1193	do1194		log_start1195		run_cmd nettest -s &1196		sleep 11197		run_cmd_nsb nettest -r ${a}1198		log_test_addr ${a} $? 0 "Global server"1199	done1200 1201	a=${NSA_IP}1202	log_start1203	run_cmd nettest -s -I ${NSA_DEV} &1204	sleep 11205	run_cmd_nsb nettest -r ${a}1206	log_test_addr ${a} $? 0 "Device server"1207 1208	# verify TCP reset sent and received1209	for a in ${NSA_IP} ${NSA_LO_IP}1210	do1211		log_start1212		show_hint "Should fail 'Connection refused' since there is no server"1213		run_cmd_nsb nettest -r ${a}1214		log_test_addr ${a} $? 1 "No server"1215	done1216 1217	#1218	# client1219	#1220	for a in ${NSB_IP} ${NSB_LO_IP}1221	do1222		log_start1223		run_cmd_nsb nettest -s &1224		sleep 11225		run_cmd nettest -r ${a} -0 ${NSA_IP}1226		log_test_addr ${a} $? 0 "Client"1227 1228		log_start1229		run_cmd_nsb nettest -s &1230		sleep 11231		run_cmd nettest -r ${a} -d ${NSA_DEV}1232		log_test_addr ${a} $? 0 "Client, device bind"1233 1234		log_start1235		show_hint "Should fail 'Connection refused'"1236		run_cmd nettest -r ${a}1237		log_test_addr ${a} $? 1 "No server, unbound client"1238 1239		log_start1240		show_hint "Should fail 'Connection refused'"1241		run_cmd nettest -r ${a} -d ${NSA_DEV}1242		log_test_addr ${a} $? 1 "No server, device client"1243	done1244 1245	#1246	# local address tests1247	#1248	for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.11249	do1250		log_start1251		run_cmd nettest -s &1252		sleep 11253		run_cmd nettest -r ${a} -0 ${a} -1 ${a}1254		log_test_addr ${a} $? 0 "Global server, local connection"1255	done1256 1257	a=${NSA_IP}1258	log_start1259	run_cmd nettest -s -I ${NSA_DEV} &1260	sleep 11261	run_cmd nettest -r ${a} -0 ${a}1262	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"1263 1264	for a in ${NSA_LO_IP} 127.0.0.11265	do1266		log_start1267		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"1268		run_cmd nettest -s -I ${NSA_DEV} &1269		sleep 11270		run_cmd nettest -r ${a}1271		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"1272	done1273 1274	a=${NSA_IP}1275	log_start1276	run_cmd nettest -s &1277	sleep 11278	run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV}1279	log_test_addr ${a} $? 0 "Global server, device client, local connection"1280 1281	for a in ${NSA_LO_IP} 127.0.0.11282	do1283		log_start1284		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"1285		run_cmd nettest -s &1286		sleep 11287		run_cmd nettest -r ${a} -d ${NSA_DEV}1288		log_test_addr ${a} $? 1 "Global server, device client, local connection"1289	done1290 1291	a=${NSA_IP}1292	log_start1293	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &1294	sleep 11295	run_cmd nettest  -d ${NSA_DEV} -r ${a} -0 ${a}1296	log_test_addr ${a} $? 0 "Device server, device client, local connection"1297 1298	log_start1299	show_hint "Should fail 'Connection refused'"1300	run_cmd nettest -d ${NSA_DEV} -r ${a}1301	log_test_addr ${a} $? 1 "No server, device client, local conn"1302 1303	[ "$fips_enabled" = "1" ] || ipv4_tcp_md5_novrf1304 1305	ipv4_tcp_dontroute 01306	ipv4_tcp_dontroute 21307}1308 1309ipv4_tcp_vrf()1310{1311	local a1312 1313	# disable global server1314	log_subsection "Global server disabled"1315 1316	set_sysctl net.ipv4.tcp_l3mdev_accept=01317 1318	#1319	# server tests1320	#1321	for a in ${NSA_IP} ${VRF_IP}1322	do1323		log_start1324		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"1325		run_cmd nettest -s &1326		sleep 11327		run_cmd_nsb nettest -r ${a}1328		log_test_addr ${a} $? 1 "Global server"1329 1330		log_start1331		run_cmd nettest -s -I ${VRF} -3 ${VRF} &1332		sleep 11333		run_cmd_nsb nettest -r ${a}1334		log_test_addr ${a} $? 0 "VRF server"1335 1336		log_start1337		run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &1338		sleep 11339		run_cmd_nsb nettest -r ${a}1340		log_test_addr ${a} $? 0 "Device server"1341 1342		# verify TCP reset received1343		log_start1344		show_hint "Should fail 'Connection refused' since there is no server"1345		run_cmd_nsb nettest -r ${a}1346		log_test_addr ${a} $? 1 "No server"1347	done1348 1349	# local address tests1350	# (${VRF_IP} and 127.0.0.1 both timeout)1351	a=${NSA_IP}1352	log_start1353	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"1354	run_cmd nettest -s &1355	sleep 11356	run_cmd nettest -r ${a} -d ${NSA_DEV}1357	log_test_addr ${a} $? 1 "Global server, local connection"1358 1359	# run MD5 tests1360	if [ "$fips_enabled" = "0" ]; then1361		setup_vrf_dup1362		ipv4_tcp_md51363		cleanup_vrf_dup1364	fi1365 1366	#1367	# enable VRF global server1368	#1369	log_subsection "VRF Global server enabled"1370	set_sysctl net.ipv4.tcp_l3mdev_accept=11371 1372	for a in ${NSA_IP} ${VRF_IP}1373	do1374		log_start1375		show_hint "client socket should be bound to VRF"1376		run_cmd nettest -s -3 ${VRF} &1377		sleep 11378		run_cmd_nsb nettest -r ${a}1379		log_test_addr ${a} $? 0 "Global server"1380 1381		log_start1382		show_hint "client socket should be bound to VRF"1383		run_cmd nettest -s -I ${VRF} -3 ${VRF} &1384		sleep 11385		run_cmd_nsb nettest -r ${a}1386		log_test_addr ${a} $? 0 "VRF server"1387 1388		# verify TCP reset received1389		log_start1390		show_hint "Should fail 'Connection refused'"1391		run_cmd_nsb nettest -r ${a}1392		log_test_addr ${a} $? 1 "No server"1393	done1394 1395	a=${NSA_IP}1396	log_start1397	show_hint "client socket should be bound to device"1398	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &1399	sleep 11400	run_cmd_nsb nettest -r ${a}1401	log_test_addr ${a} $? 0 "Device server"1402 1403	# local address tests1404	for a in ${NSA_IP} ${VRF_IP}1405	do1406		log_start1407		show_hint "Should fail 'Connection refused' since client is not bound to VRF"1408		run_cmd nettest -s -I ${VRF} &1409		sleep 11410		run_cmd nettest -r ${a}1411		log_test_addr ${a} $? 1 "Global server, local connection"1412	done1413 1414	#1415	# client1416	#1417	for a in ${NSB_IP} ${NSB_LO_IP}1418	do1419		log_start1420		run_cmd_nsb nettest -s &1421		sleep 11422		run_cmd nettest -r ${a} -d ${VRF}1423		log_test_addr ${a} $? 0 "Client, VRF bind"1424 1425		log_start1426		run_cmd_nsb nettest -s &1427		sleep 11428		run_cmd nettest -r ${a} -d ${NSA_DEV}1429		log_test_addr ${a} $? 0 "Client, device bind"1430 1431		log_start1432		show_hint "Should fail 'Connection refused'"1433		run_cmd nettest -r ${a} -d ${VRF}1434		log_test_addr ${a} $? 1 "No server, VRF client"1435 1436		log_start1437		show_hint "Should fail 'Connection refused'"1438		run_cmd nettest -r ${a} -d ${NSA_DEV}1439		log_test_addr ${a} $? 1 "No server, device client"1440	done1441 1442	for a in ${NSA_IP} ${VRF_IP} 127.0.0.11443	do1444		log_start1445		run_cmd nettest -s -I ${VRF} -3 ${VRF} &1446		sleep 11447		run_cmd nettest -r ${a} -d ${VRF} -0 ${a}1448		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"1449	done1450 1451	a=${NSA_IP}1452	log_start1453	run_cmd nettest -s -I ${VRF} -3 ${VRF} &1454	sleep 11455	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}1456	log_test_addr ${a} $? 0 "VRF server, device client, local connection"1457 1458	log_start1459	show_hint "Should fail 'No route to host' since client is out of VRF scope"1460	run_cmd nettest -s -I ${VRF} &1461	sleep 11462	run_cmd nettest -r ${a}1463	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"1464 1465	log_start1466	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &1467	sleep 11468	run_cmd nettest -r ${a} -d ${VRF} -0 ${a}1469	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"1470 1471	log_start1472	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &1473	sleep 11474	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}1475	log_test_addr ${a} $? 0 "Device server, device client, local connection"1476}1477 1478ipv4_tcp()1479{1480	log_section "IPv4/TCP"1481	log_subsection "No VRF"1482	setup1483 1484	# tcp_l3mdev_accept should have no affect without VRF;1485	# run tests with it enabled and disabled to verify1486	log_subsection "tcp_l3mdev_accept disabled"1487	set_sysctl net.ipv4.tcp_l3mdev_accept=01488	ipv4_tcp_novrf1489	log_subsection "tcp_l3mdev_accept enabled"1490	set_sysctl net.ipv4.tcp_l3mdev_accept=11491	ipv4_tcp_novrf1492 1493	log_subsection "With VRF"1494	setup "yes"1495	ipv4_tcp_vrf1496}1497 1498################################################################################1499# IPv4 UDP1500 1501ipv4_udp_novrf()1502{1503	local a1504 1505	#1506	# server tests1507	#1508	for a in ${NSA_IP} ${NSA_LO_IP}1509	do1510		log_start1511		run_cmd nettest -D -s -3 ${NSA_DEV} &1512		sleep 11513		run_cmd_nsb nettest -D -r ${a}1514		log_test_addr ${a} $? 0 "Global server"1515 1516		log_start1517		show_hint "Should fail 'Connection refused' since there is no server"1518		run_cmd_nsb nettest -D -r ${a}1519		log_test_addr ${a} $? 1 "No server"1520	done1521 1522	a=${NSA_IP}1523	log_start1524	run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &1525	sleep 11526	run_cmd_nsb nettest -D -r ${a}1527	log_test_addr ${a} $? 0 "Device server"1528 1529	#1530	# client1531	#1532	for a in ${NSB_IP} ${NSB_LO_IP}1533	do1534		log_start1535		run_cmd_nsb nettest -D -s &1536		sleep 11537		run_cmd nettest -D -r ${a} -0 ${NSA_IP}1538		log_test_addr ${a} $? 0 "Client"1539 1540		log_start1541		run_cmd_nsb nettest -D -s &1542		sleep 11543		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP}1544		log_test_addr ${a} $? 0 "Client, device bind"1545 1546		log_start1547		run_cmd_nsb nettest -D -s &1548		sleep 11549		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP}1550		log_test_addr ${a} $? 0 "Client, device send via cmsg"1551 1552		log_start1553		run_cmd_nsb nettest -D -s &1554		sleep 11555		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP}1556		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF"1557 1558		log_start1559		run_cmd_nsb nettest -D -s &1560		sleep 11561		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U1562		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()"1563 1564 1565		log_start1566		show_hint "Should fail 'Connection refused'"1567		run_cmd nettest -D -r ${a}1568		log_test_addr ${a} $? 1 "No server, unbound client"1569 1570		log_start1571		show_hint "Should fail 'Connection refused'"1572		run_cmd nettest -D -r ${a} -d ${NSA_DEV}1573		log_test_addr ${a} $? 1 "No server, device client"1574	done1575 1576	#1577	# local address tests1578	#1579	for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.11580	do1581		log_start1582		run_cmd nettest -D -s &1583		sleep 11584		run_cmd nettest -D -r ${a} -0 ${a} -1 ${a}1585		log_test_addr ${a} $? 0 "Global server, local connection"1586	done1587 1588	a=${NSA_IP}1589	log_start1590	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &1591	sleep 11592	run_cmd nettest -D -r ${a}1593	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"1594 1595	for a in ${NSA_LO_IP} 127.0.0.11596	do1597		log_start1598		show_hint "Should fail 'Connection refused' since address is out of device scope"1599		run_cmd nettest -s -D -I ${NSA_DEV} &1600		sleep 11601		run_cmd nettest -D -r ${a}1602		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"1603	done1604 1605	a=${NSA_IP}1606	log_start1607	run_cmd nettest -s -D &1608	sleep 11609	run_cmd nettest -D -d ${NSA_DEV} -r ${a}1610	log_test_addr ${a} $? 0 "Global server, device client, local connection"1611 1612	log_start1613	run_cmd nettest -s -D &1614	sleep 11615	run_cmd nettest -D -d ${NSA_DEV} -C -r ${a}1616	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"1617 1618	log_start1619	run_cmd nettest -s -D &1620	sleep 11621	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a}1622	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection"1623 1624	log_start1625	run_cmd nettest -s -D &1626	sleep 11627	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U1628	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"1629 1630 1631	# IPv4 with device bind has really weird behavior - it overrides the1632	# fib lookup, generates an rtable and tries to send the packet. This1633	# causes failures for local traffic at different places1634	for a in ${NSA_LO_IP} 127.0.0.11635	do1636		log_start1637		show_hint "Should fail since addresses on loopback are out of device scope"1638		run_cmd nettest -D -s &1639		sleep 11640		run_cmd nettest -D -r ${a} -d ${NSA_DEV}1641		log_test_addr ${a} $? 2 "Global server, device client, local connection"1642 1643		log_start1644		show_hint "Should fail since addresses on loopback are out of device scope"1645		run_cmd nettest -D -s &1646		sleep 11647		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C1648		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"1649 1650		log_start1651		show_hint "Should fail since addresses on loopback are out of device scope"1652		run_cmd nettest -D -s &1653		sleep 11654		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S1655		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"1656 1657		log_start1658		show_hint "Should fail since addresses on loopback are out of device scope"1659		run_cmd nettest -D -s &1660		sleep 11661		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U1662		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"1663 1664 1665	done1666 1667	a=${NSA_IP}1668	log_start1669	run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &1670	sleep 11671	run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a}1672	log_test_addr ${a} $? 0 "Device server, device client, local conn"1673 1674	log_start1675	run_cmd nettest -D -d ${NSA_DEV} -r ${a}1676	log_test_addr ${a} $? 2 "No server, device client, local conn"1677 1678	#1679	# Link local connection tests (SO_DONTROUTE).1680	# Connections should succeed only when the remote IP address is1681	# on link (doesn't need to be routed through a gateway).1682	#1683 1684	a=${NSB_IP}1685	log_start1686	do_run_cmd nettest -B -D -N "${NSA}" -O "${NSB}" -r ${a} --client-dontroute1687	log_test_addr ${a} $? 0 "SO_DONTROUTE client"1688 1689	a=${NSB_LO_IP}1690	log_start1691	show_hint "Should fail 'Network is unreachable' since server is not on link"1692	do_run_cmd nettest -B -D -N "${NSA}" -O "${NSB}" -r ${a} --client-dontroute1693	log_test_addr ${a} $? 1 "SO_DONTROUTE client"1694}1695 1696ipv4_udp_vrf()1697{1698	local a1699 1700	# disable global server1701	log_subsection "Global server disabled"1702	set_sysctl net.ipv4.udp_l3mdev_accept=01703 1704	#1705	# server tests1706	#1707	for a in ${NSA_IP} ${VRF_IP}1708	do1709		log_start1710		show_hint "Fails because ingress is in a VRF and global server is disabled"1711		run_cmd nettest -D -s &1712		sleep 11713		run_cmd_nsb nettest -D -r ${a}1714		log_test_addr ${a} $? 1 "Global server"1715 1716		log_start1717		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &1718		sleep 11719		run_cmd_nsb nettest -D -r ${a}1720		log_test_addr ${a} $? 0 "VRF server"1721 1722		log_start1723		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &1724		sleep 11725		run_cmd_nsb nettest -D -r ${a}1726		log_test_addr ${a} $? 0 "Enslaved device server"1727 1728		log_start1729		show_hint "Should fail 'Connection refused' since there is no server"1730		run_cmd_nsb nettest -D -r ${a}1731		log_test_addr ${a} $? 1 "No server"1732 1733		log_start1734		show_hint "Should fail 'Connection refused' since global server is out of scope"1735		run_cmd nettest -D -s &1736		sleep 11737		run_cmd nettest -D -d ${VRF} -r ${a}1738		log_test_addr ${a} $? 1 "Global server, VRF client, local connection"1739	done1740 1741	a=${NSA_IP}1742	log_start1743	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &1744	sleep 11745	run_cmd nettest -D -d ${VRF} -r ${a}1746	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"1747 1748	log_start1749	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &1750	sleep 11751	run_cmd nettest -D -d ${NSA_DEV} -r ${a}1752	log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection"1753 1754	a=${NSA_IP}1755	log_start1756	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &1757	sleep 11758	run_cmd nettest -D -d ${VRF} -r ${a}1759	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"1760 1761	log_start1762	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &1763	sleep 11764	run_cmd nettest -D -d ${NSA_DEV} -r ${a}1765	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"1766 1767	# enable global server1768	log_subsection "Global server enabled"1769	set_sysctl net.ipv4.udp_l3mdev_accept=11770 1771	#1772	# server tests1773	#1774	for a in ${NSA_IP} ${VRF_IP}1775	do1776		log_start1777		run_cmd nettest -D -s -3 ${NSA_DEV} &1778		sleep 11779		run_cmd_nsb nettest -D -r ${a}1780		log_test_addr ${a} $? 0 "Global server"1781 1782		log_start1783		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &1784		sleep 11785		run_cmd_nsb nettest -D -r ${a}1786		log_test_addr ${a} $? 0 "VRF server"1787 1788		log_start1789		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &1790		sleep 11791		run_cmd_nsb nettest -D -r ${a}1792		log_test_addr ${a} $? 0 "Enslaved device server"1793 1794		log_start1795		show_hint "Should fail 'Connection refused'"1796		run_cmd_nsb nettest -D -r ${a}1797		log_test_addr ${a} $? 1 "No server"1798	done1799 1800	#1801	# client tests1802	#1803	log_start1804	run_cmd_nsb nettest -D -s &1805	sleep 11806	run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP}1807	log_test $? 0 "VRF client"1808 1809	log_start1810	run_cmd_nsb nettest -D -s &1811	sleep 11812	run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP}1813	log_test $? 0 "Enslaved device client"1814 1815	# negative test - should fail1816	log_start1817	show_hint "Should fail 'Connection refused'"1818	run_cmd nettest -D -d ${VRF} -r ${NSB_IP}1819	log_test $? 1 "No server, VRF client"1820 1821	log_start1822	show_hint "Should fail 'Connection refused'"1823	run_cmd nettest -D -d ${NSA_DEV} -r ${NSB_IP}1824	log_test $? 1 "No server, enslaved device client"1825 1826	#1827	# local address tests1828	#1829	a=${NSA_IP}1830	log_start1831	run_cmd nettest -D -s -3 ${NSA_DEV} &1832	sleep 11833	run_cmd nettest -D -d ${VRF} -r ${a}1834	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"1835 1836	log_start1837	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &1838	sleep 11839	run_cmd nettest -D -d ${VRF} -r ${a}1840	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"1841 1842	log_start1843	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &1844	sleep 11845	run_cmd nettest -D -d ${NSA_DEV} -r ${a}1846	log_test_addr ${a} $? 0 "VRF server, device client, local conn"1847 1848	log_start1849	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &1850	sleep 11851	run_cmd nettest -D -d ${VRF} -r ${a}1852	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"1853 1854	log_start1855	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &1856	sleep 11857	run_cmd nettest -D -d ${NSA_DEV} -r ${a}1858	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"1859 1860	for a in ${VRF_IP} 127.0.0.11861	do1862		log_start1863		run_cmd nettest -D -s -3 ${VRF} &1864		sleep 11865		run_cmd nettest -D -d ${VRF} -r ${a}1866		log_test_addr ${a} $? 0 "Global server, VRF client, local conn"1867	done1868 1869	for a in ${VRF_IP} 127.0.0.11870	do1871		log_start1872		run_cmd nettest -s -D -I ${VRF} -3 ${VRF} &1873		sleep 11874		run_cmd nettest -D -d ${VRF} -r ${a}1875		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"1876	done1877 1878	# negative test - should fail1879	# verifies ECONNREFUSED1880	for a in ${NSA_IP} ${VRF_IP} 127.0.0.11881	do1882		log_start1883		show_hint "Should fail 'Connection refused'"1884		run_cmd nettest -D -d ${VRF} -r ${a}1885		log_test_addr ${a} $? 1 "No server, VRF client, local conn"1886	done1887}1888 1889ipv4_udp()1890{1891	log_section "IPv4/UDP"1892	log_subsection "No VRF"1893 1894	setup1895 1896	# udp_l3mdev_accept should have no affect without VRF;1897	# run tests with it enabled and disabled to verify1898	log_subsection "udp_l3mdev_accept disabled"1899	set_sysctl net.ipv4.udp_l3mdev_accept=01900	ipv4_udp_novrf1901	log_subsection "udp_l3mdev_accept enabled"1902	set_sysctl net.ipv4.udp_l3mdev_accept=11903	ipv4_udp_novrf1904 1905	log_subsection "With VRF"1906	setup "yes"1907	ipv4_udp_vrf1908}1909 1910################################################################################1911# IPv4 address bind1912#1913# verifies ability or inability to bind to an address / device1914 1915ipv4_addr_bind_novrf()1916{1917	#1918	# raw socket1919	#1920	for a in ${NSA_IP} ${NSA_LO_IP}1921	do1922		log_start1923		run_cmd nettest -s -R -P icmp -l ${a} -b1924		log_test_addr ${a} $? 0 "Raw socket bind to local address"1925 1926		log_start1927		run_cmd nettest -s -R -P icmp -l ${a} -I ${NSA_DEV} -b1928		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"1929	done1930 1931	#1932	# tests for nonlocal bind1933	#1934	a=${NL_IP}1935	log_start1936	run_cmd nettest -s -R -f -l ${a} -b1937	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address"1938 1939	log_start1940	run_cmd nettest -s -f -l ${a} -b1941	log_test_addr ${a} $? 0 "TCP socket bind to nonlocal address"1942 1943	log_start1944	run_cmd nettest -s -D -P icmp -f -l ${a} -b1945	log_test_addr ${a} $? 0 "ICMP socket bind to nonlocal address"1946 1947	#1948	# check that ICMP sockets cannot bind to broadcast and multicast addresses1949	#1950	a=${BCAST_IP}1951	log_start1952	run_cmd nettest -s -D -P icmp -l ${a} -b1953	log_test_addr ${a} $? 1 "ICMP socket bind to broadcast address"1954 1955	a=${MCAST_IP}1956	log_start1957	run_cmd nettest -s -D -P icmp -l ${a} -b1958	log_test_addr ${a} $? 1 "ICMP socket bind to multicast address"1959 1960	#1961	# tcp sockets1962	#1963	a=${NSA_IP}1964	log_start1965	run_cmd nettest -c ${a} -r ${NSB_IP} -t1 -b1966	log_test_addr ${a} $? 0 "TCP socket bind to local address"1967 1968	log_start1969	run_cmd nettest -c ${a} -r ${NSB_IP} -d ${NSA_DEV} -t1 -b1970	log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind"1971 1972	# Sadly, the kernel allows binding a socket to a device and then1973	# binding to an address not on the device. The only restriction1974	# is that the address is valid in the L3 domain. So this test1975	# passes when it really should not1976	#a=${NSA_LO_IP}1977	#log_start1978	#show_hint "Should fail with 'Cannot assign requested address'"1979	#run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b1980	#log_test_addr ${a} $? 1 "TCP socket bind to out of scope local address"1981}1982 1983ipv4_addr_bind_vrf()1984{1985	#1986	# raw socket1987	#1988	for a in ${NSA_IP} ${VRF_IP}1989	do1990		log_start1991		show_hint "Socket not bound to VRF, but address is in VRF"1992		run_cmd nettest -s -R -P icmp -l ${a} -b1993		log_test_addr ${a} $? 1 "Raw socket bind to local address"1994 1995		log_start1996		run_cmd nettest -s -R -P icmp -l ${a} -I ${NSA_DEV} -b1997		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"1998		log_start1999		run_cmd nettest -s -R -P icmp -l ${a} -I ${VRF} -b2000		log_test_addr ${a} $? 0 "Raw socket bind to local address after VRF bind"2001	done2002 2003	a=${NSA_LO_IP}2004	log_start2005	show_hint "Address on loopback is out of VRF scope"2006	run_cmd nettest -s -R -P icmp -l ${a} -I ${VRF} -b2007	log_test_addr ${a} $? 1 "Raw socket bind to out of scope address after VRF bind"2008 2009	#2010	# tests for nonlocal bind2011	#2012	a=${NL_IP}2013	log_start2014	run_cmd nettest -s -R -f -l ${a} -I ${VRF} -b2015	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address after VRF bind"2016 2017	log_start2018	run_cmd nettest -s -f -l ${a} -I ${VRF} -b2019	log_test_addr ${a} $? 0 "TCP socket bind to nonlocal address after VRF bind"2020 2021	log_start2022	run_cmd nettest -s -D -P icmp -f -l ${a} -I ${VRF} -b2023	log_test_addr ${a} $? 0 "ICMP socket bind to nonlocal address after VRF bind"2024 2025	#2026	# check that ICMP sockets cannot bind to broadcast and multicast addresses2027	#2028	a=${BCAST_IP}2029	log_start2030	run_cmd nettest -s -D -P icmp -l ${a} -I ${VRF} -b2031	log_test_addr ${a} $? 1 "ICMP socket bind to broadcast address after VRF bind"2032 2033	a=${MCAST_IP}2034	log_start2035	run_cmd nettest -s -D -P icmp -l ${a} -I ${VRF} -b2036	log_test_addr ${a} $? 1 "ICMP socket bind to multicast address after VRF bind"2037 2038	#2039	# tcp sockets2040	#2041	for a in ${NSA_IP} ${VRF_IP}2042	do2043		log_start2044		run_cmd nettest -s -l ${a} -I ${VRF} -t1 -b2045		log_test_addr ${a} $? 0 "TCP socket bind to local address"2046 2047		log_start2048		run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b2049		log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind"2050	done2051 2052	a=${NSA_LO_IP}2053	log_start2054	show_hint "Address on loopback out of scope for VRF"2055	run_cmd nettest -s -l ${a} -I ${VRF} -t1 -b2056	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for VRF"2057 2058	log_start2059	show_hint "Address on loopback out of scope for device in VRF"2060	run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b2061	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for device bind"2062}2063 2064ipv4_addr_bind()2065{2066	log_section "IPv4 address binds"2067 2068	log_subsection "No VRF"2069	setup2070	set_ping_group2071	ipv4_addr_bind_novrf2072 2073	log_subsection "With VRF"2074	setup "yes"2075	set_ping_group2076	ipv4_addr_bind_vrf2077}2078 2079################################################################################2080# IPv4 runtime tests2081 2082ipv4_rt()2083{2084	local desc="$1"2085	local varg="$2"2086	local with_vrf="yes"2087	local a2088 2089	#2090	# server tests2091	#2092	for a in ${NSA_IP} ${VRF_IP}2093	do2094		log_start2095		run_cmd nettest ${varg} -s &2096		sleep 12097		run_cmd_nsb nettest ${varg} -r ${a} &2098		sleep 32099		run_cmd ip link del ${VRF}2100		sleep 12101		log_test_addr ${a} 0 0 "${desc}, global server"2102 2103		setup ${with_vrf}2104	done2105 2106	for a in ${NSA_IP} ${VRF_IP}2107	do2108		log_start2109		run_cmd nettest ${varg} -s -I ${VRF} &2110		sleep 12111		run_cmd_nsb nettest ${varg} -r ${a} &2112		sleep 32113		run_cmd ip link del ${VRF}2114		sleep 12115		log_test_addr ${a} 0 0 "${desc}, VRF server"2116 2117		setup ${with_vrf}2118	done2119 2120	a=${NSA_IP}2121	log_start2122	run_cmd nettest ${varg} -s -I ${NSA_DEV} &2123	sleep 12124	run_cmd_nsb nettest ${varg} -r ${a} &2125	sleep 32126	run_cmd ip link del ${VRF}2127	sleep 12128	log_test_addr ${a} 0 0 "${desc}, enslaved device server"2129 2130	setup ${with_vrf}2131 2132	#2133	# client test2134	#2135	log_start2136	run_cmd_nsb nettest ${varg} -s &2137	sleep 12138	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} &2139	sleep 32140	run_cmd ip link del ${VRF}2141	sleep 12142	log_test_addr ${a} 0 0 "${desc}, VRF client"2143 2144	setup ${with_vrf}2145 2146	log_start2147	run_cmd_nsb nettest ${varg} -s &2148	sleep 12149	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} &2150	sleep 32151	run_cmd ip link del ${VRF}2152	sleep 12153	log_test_addr ${a} 0 0 "${desc}, enslaved device client"2154 2155	setup ${with_vrf}2156 2157	#2158	# local address tests2159	#2160	for a in ${NSA_IP} ${VRF_IP}2161	do2162		log_start2163		run_cmd nettest ${varg} -s &2164		sleep 12165		run_cmd nettest ${varg} -d ${VRF} -r ${a} &2166		sleep 32167		run_cmd ip link del ${VRF}2168		sleep 12169		log_test_addr ${a} 0 0 "${desc}, global server, VRF client, local"2170 2171		setup ${with_vrf}2172	done2173 2174	for a in ${NSA_IP} ${VRF_IP}2175	do2176		log_start2177		run_cmd nettest ${varg} -I ${VRF} -s &2178		sleep 12179		run_cmd nettest ${varg} -d ${VRF} -r ${a} &2180		sleep 32181		run_cmd ip link del ${VRF}2182		sleep 12183		log_test_addr ${a} 0 0 "${desc}, VRF server and client, local"2184 2185		setup ${with_vrf}2186	done2187 2188	a=${NSA_IP}2189	log_start2190 2191	run_cmd nettest ${varg} -s &2192	sleep 12193	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &2194	sleep 32195	run_cmd ip link del ${VRF}2196	sleep 12197	log_test_addr ${a} 0 0 "${desc}, global server, enslaved device client, local"2198 2199	setup ${with_vrf}2200 2201	log_start2202	run_cmd nettest ${varg} -I ${VRF} -s &2203	sleep 12204	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &2205	sleep 32206	run_cmd ip link del ${VRF}2207	sleep 12208	log_test_addr ${a} 0 0 "${desc}, VRF server, enslaved device client, local"2209 2210	setup ${with_vrf}2211 2212	log_start2213	run_cmd nettest ${varg} -I ${NSA_DEV} -s &2214	sleep 12215	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &2216	sleep 32217	run_cmd ip link del ${VRF}2218	sleep 12219	log_test_addr ${a} 0 0 "${desc}, enslaved device server and client, local"2220}2221 2222ipv4_ping_rt()2223{2224	local with_vrf="yes"2225	local a2226 2227	for a in ${NSA_IP} ${VRF_IP}2228	do2229		log_start2230		run_cmd_nsb ping -f ${a} &2231		sleep 32232		run_cmd ip link del ${VRF}2233		sleep 12234		log_test_addr ${a} 0 0 "Device delete with active traffic - ping in"2235 2236		setup ${with_vrf}2237	done2238 2239	a=${NSB_IP}2240	log_start2241	run_cmd ping -f -I ${VRF} ${a} &2242	sleep 32243	run_cmd ip link del ${VRF}2244	sleep 12245	log_test_addr ${a} 0 0 "Device delete with active traffic - ping out"2246}2247 2248ipv4_runtime()2249{2250	log_section "Run time tests - ipv4"2251 2252	setup "yes"2253	ipv4_ping_rt2254 2255	setup "yes"2256	ipv4_rt "TCP active socket"  "-n -1"2257 2258	setup "yes"2259	ipv4_rt "TCP passive socket" "-i"2260}2261 2262################################################################################2263# IPv62264 2265ipv6_ping_novrf()2266{2267	local a2268 2269	# should not have an impact, but make a known state2270	set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null2271 2272	#2273	# out2274	#2275	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}2276	do2277		log_start2278		run_cmd ${ping6} -c1 -w1 ${a}2279		log_test_addr ${a} $? 0 "ping out"2280	done2281 2282	for a in ${NSB_IP6} ${NSB_LO_IP6}2283	do2284		log_start2285		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2286		log_test_addr ${a} $? 0 "ping out, device bind"2287 2288		log_start2289		run_cmd ${ping6} -c1 -w1 -I ${NSA_LO_IP6} ${a}2290		log_test_addr ${a} $? 0 "ping out, loopback address bind"2291	done2292 2293	#2294	# in2295	#2296	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV} ${MCAST}%${NSB_DEV}2297	do2298		log_start2299		run_cmd_nsb ${ping6} -c1 -w1 ${a}2300		log_test_addr ${a} $? 0 "ping in"2301	done2302 2303	#2304	# local traffic, local address2305	#2306	for a in ${NSA_IP6} ${NSA_LO_IP6} ::1 ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}2307	do2308		log_start2309		run_cmd ${ping6} -c1 -w1 ${a}2310		log_test_addr ${a} $? 0 "ping local, no bind"2311	done2312 2313	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}2314	do2315		log_start2316		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2317		log_test_addr ${a} $? 0 "ping local, device bind"2318	done2319 2320	for a in ${NSA_LO_IP6} ::12321	do2322		log_start2323		show_hint "Fails since address on loopback is out of device scope"2324		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2325		log_test_addr ${a} $? 2 "ping local, device bind"2326	done2327 2328	#2329	# ip rule blocks address2330	#2331	log_start2332	setup_cmd ip -6 rule add pref 32765 from all lookup local2333	setup_cmd ip -6 rule del pref 0 from all lookup local2334	setup_cmd ip -6 rule add pref 50 to ${NSB_LO_IP6} prohibit2335	setup_cmd ip -6 rule add pref 51 from ${NSB_IP6} prohibit2336 2337	a=${NSB_LO_IP6}2338	run_cmd ${ping6} -c1 -w1 ${a}2339	log_test_addr ${a} $? 2 "ping out, blocked by rule"2340 2341	log_start2342	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2343	log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"2344 2345	a=${NSA_LO_IP6}2346	log_start2347	show_hint "Response lost due to ip rule"2348	run_cmd_nsb ${ping6} -c1 -w1 ${a}2349	log_test_addr ${a} $? 1 "ping in, blocked by rule"2350 2351	setup_cmd ip -6 rule add pref 0 from all lookup local2352	setup_cmd ip -6 rule del pref 32765 from all lookup local2353	setup_cmd ip -6 rule del pref 50 to ${NSB_LO_IP6} prohibit2354	setup_cmd ip -6 rule del pref 51 from ${NSB_IP6} prohibit2355 2356	#2357	# route blocks reachability to remote address2358	#2359	log_start2360	setup_cmd ip -6 route del ${NSB_LO_IP6}2361	setup_cmd ip -6 route add unreachable ${NSB_LO_IP6} metric 102362	setup_cmd ip -6 route add unreachable ${NSB_IP6} metric 102363 2364	a=${NSB_LO_IP6}2365	run_cmd ${ping6} -c1 -w1 ${a}2366	log_test_addr ${a} $? 2 "ping out, blocked by route"2367 2368	log_start2369	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2370	log_test_addr ${a} $? 2 "ping out, device bind, blocked by route"2371 2372	a=${NSA_LO_IP6}2373	log_start2374	show_hint "Response lost due to ip route"2375	run_cmd_nsb ${ping6} -c1 -w1 ${a}2376	log_test_addr ${a} $? 1 "ping in, blocked by route"2377 2378 2379	#2380	# remove 'remote' routes; fallback to default2381	#2382	log_start2383	setup_cmd ip -6 ro del unreachable ${NSB_LO_IP6}2384	setup_cmd ip -6 ro del unreachable ${NSB_IP6}2385 2386	a=${NSB_LO_IP6}2387	run_cmd ${ping6} -c1 -w1 ${a}2388	log_test_addr ${a} $? 2 "ping out, unreachable route"2389 2390	log_start2391	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2392	log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"2393}2394 2395ipv6_ping_vrf()2396{2397	local a2398 2399	# should default on; does not exist on older kernels2400	set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null2401 2402	#2403	# out2404	#2405	for a in ${NSB_IP6} ${NSB_LO_IP6}2406	do2407		log_start2408		run_cmd ${ping6} -c1 -w1 -I ${VRF} ${a}2409		log_test_addr ${a} $? 0 "ping out, VRF bind"2410	done2411 2412	for a in ${NSB_LINKIP6}%${VRF} ${MCAST}%${VRF}2413	do2414		log_start2415		show_hint "Fails since VRF device does not support linklocal or multicast"2416		run_cmd ${ping6} -c1 -w1 ${a}2417		log_test_addr ${a} $? 1 "ping out, VRF bind"2418	done2419 2420	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}2421	do2422		log_start2423		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2424		log_test_addr ${a} $? 0 "ping out, device bind"2425	done2426 2427	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}2428	do2429		log_start2430		run_cmd ip vrf exec ${VRF} ${ping6} -c1 -w1 -I ${VRF_IP6} ${a}2431		log_test_addr ${a} $? 0 "ping out, vrf device+address bind"2432	done2433 2434	#2435	# in2436	#2437	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV} ${MCAST}%${NSB_DEV}2438	do2439		log_start2440		run_cmd_nsb ${ping6} -c1 -w1 ${a}2441		log_test_addr ${a} $? 0 "ping in"2442	done2443 2444	a=${NSA_LO_IP6}2445	log_start2446	show_hint "Fails since loopback address is out of VRF scope"2447	run_cmd_nsb ${ping6} -c1 -w1 ${a}2448	log_test_addr ${a} $? 1 "ping in"2449 2450	#2451	# local traffic, local address2452	#2453	for a in ${NSA_IP6} ${VRF_IP6} ::12454	do2455		log_start2456		show_hint "Source address should be ${a}"2457		run_cmd ${ping6} -c1 -w1 -I ${VRF} ${a}2458		log_test_addr ${a} $? 0 "ping local, VRF bind"2459	done2460 2461	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}2462	do2463		log_start2464		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2465		log_test_addr ${a} $? 0 "ping local, device bind"2466	done2467 2468	# LLA to GUA - remove ipv6 global addresses from ns-B2469	setup_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV}2470	setup_cmd_nsb ip -6 addr del ${NSB_LO_IP6}/128 dev lo2471	setup_cmd_nsb ip -6 ro add ${NSA_IP6}/128 via ${NSA_LINKIP6} dev ${NSB_DEV}2472 2473	for a in ${NSA_IP6} ${VRF_IP6}2474	do2475		log_start2476		run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6}2477		log_test_addr ${a} $? 0 "ping in, LLA to GUA"2478	done2479 2480	setup_cmd_nsb ip -6 ro del ${NSA_IP6}/128 via ${NSA_LINKIP6} dev ${NSB_DEV}2481	setup_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV}2482	setup_cmd_nsb ip -6 addr add ${NSB_LO_IP6}/128 dev lo2483 2484	#2485	# ip rule blocks address2486	#2487	log_start2488	setup_cmd ip -6 rule add pref 50 to ${NSB_LO_IP6} prohibit2489	setup_cmd ip -6 rule add pref 51 from ${NSB_IP6} prohibit2490 2491	a=${NSB_LO_IP6}2492	run_cmd ${ping6} -c1 -w1 ${a}2493	log_test_addr ${a} $? 2 "ping out, blocked by rule"2494 2495	log_start2496	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2497	log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"2498 2499	a=${NSA_LO_IP6}2500	log_start2501	show_hint "Response lost due to ip rule"2502	run_cmd_nsb ${ping6} -c1 -w1 ${a}2503	log_test_addr ${a} $? 1 "ping in, blocked by rule"2504 2505	log_start2506	setup_cmd ip -6 rule del pref 50 to ${NSB_LO_IP6} prohibit2507	setup_cmd ip -6 rule del pref 51 from ${NSB_IP6} prohibit2508 2509	#2510	# remove 'remote' routes; fallback to default2511	#2512	log_start2513	setup_cmd ip -6 ro del ${NSB_LO_IP6} vrf ${VRF}2514 2515	a=${NSB_LO_IP6}2516	run_cmd ${ping6} -c1 -w1 ${a}2517	log_test_addr ${a} $? 2 "ping out, unreachable route"2518 2519	log_start2520	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}2521	log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"2522 2523	ip -netns ${NSB} -6 ro del ${NSA_LO_IP6}2524	a=${NSA_LO_IP6}2525	log_start2526	run_cmd_nsb ${ping6} -c1 -w1 ${a}2527	log_test_addr ${a} $? 2 "ping in, unreachable route"2528}2529 2530ipv6_ping()2531{2532	log_section "IPv6 ping"2533 2534	log_subsection "No VRF"2535	setup2536	ipv6_ping_novrf2537	setup2538	set_ping_group2539	ipv6_ping_novrf2540 2541	log_subsection "With VRF"2542	setup "yes"2543	ipv6_ping_vrf2544	setup "yes"2545	set_ping_group2546	ipv6_ping_vrf2547}2548 2549################################################################################2550# IPv6 TCP2551 2552#2553# MD5 tests without VRF2554#2555ipv6_tcp_md5_novrf()2556{2557	#2558	# single address2559	#2560 2561	# basic use case2562	log_start2563	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &2564	sleep 12565	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2566	log_test $? 0 "MD5: Single address config"2567 2568	# client sends MD5, server not configured2569	log_start2570	show_hint "Should timeout due to MD5 mismatch"2571	run_cmd nettest -6 -s &2572	sleep 12573	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2574	log_test $? 2 "MD5: Server no config, client uses password"2575 2576	# wrong password2577	log_start2578	show_hint "Should timeout since client uses wrong password"2579	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &2580	sleep 12581	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2582	log_test $? 2 "MD5: Client uses wrong password"2583 2584	# client from different address2585	log_start2586	show_hint "Should timeout due to MD5 mismatch"2587	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} &2588	sleep 12589	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2590	log_test $? 2 "MD5: Client address does not match address configured with password"2591 2592	#2593	# MD5 extension - prefix length2594	#2595 2596	# client in prefix2597	log_start2598	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &2599	sleep 12600	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2601	log_test $? 0 "MD5: Prefix config"2602 2603	# client in prefix, wrong password2604	log_start2605	show_hint "Should timeout since client uses wrong password"2606	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &2607	sleep 12608	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2609	log_test $? 2 "MD5: Prefix config, client uses wrong password"2610 2611	# client outside of prefix2612	log_start2613	show_hint "Should timeout due to MD5 mismatch"2614	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &2615	sleep 12616	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}2617	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"2618}2619 2620#2621# MD5 tests with VRF2622#2623ipv6_tcp_md5()2624{2625	#2626	# single address2627	#2628 2629	# basic use case2630	log_start2631	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &2632	sleep 12633	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2634	log_test $? 0 "MD5: VRF: Single address config"2635 2636	# client sends MD5, server not configured2637	log_start2638	show_hint "Should timeout since server does not have MD5 auth"2639	run_cmd nettest -6 -s -I ${VRF} &2640	sleep 12641	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2642	log_test $? 2 "MD5: VRF: Server no config, client uses password"2643 2644	# wrong password2645	log_start2646	show_hint "Should timeout since client uses wrong password"2647	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &2648	sleep 12649	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2650	log_test $? 2 "MD5: VRF: Client uses wrong password"2651 2652	# client from different address2653	log_start2654	show_hint "Should timeout since server config differs from client"2655	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} &2656	sleep 12657	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2658	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"2659 2660	#2661	# MD5 extension - prefix length2662	#2663 2664	# client in prefix2665	log_start2666	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &2667	sleep 12668	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2669	log_test $? 0 "MD5: VRF: Prefix config"2670 2671	# client in prefix, wrong password2672	log_start2673	show_hint "Should timeout since client uses wrong password"2674	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &2675	sleep 12676	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2677	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"2678 2679	# client outside of prefix2680	log_start2681	show_hint "Should timeout since client address is outside of prefix"2682	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &2683	sleep 12684	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}2685	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"2686 2687	#2688	# duplicate config between default VRF and a VRF2689	#2690 2691	log_start2692	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &2693	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &2694	sleep 12695	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2696	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"2697 2698	log_start2699	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &2700	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &2701	sleep 12702	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2703	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"2704 2705	log_start2706	show_hint "Should timeout since client in default VRF uses VRF password"2707	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &2708	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &2709	sleep 12710	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2711	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"2712 2713	log_start2714	show_hint "Should timeout since client in VRF uses default VRF password"2715	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &2716	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &2717	sleep 12718	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2719	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"2720 2721	log_start2722	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &2723	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &2724	sleep 12725	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2726	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"2727 2728	log_start2729	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &2730	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &2731	sleep 12732	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2733	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"2734 2735	log_start2736	show_hint "Should timeout since client in default VRF uses VRF password"2737	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &2738	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &2739	sleep 12740	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}2741	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"2742 2743	log_start2744	show_hint "Should timeout since client in VRF uses default VRF password"2745	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &2746	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &2747	sleep 12748	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}2749	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"2750 2751	#2752	# negative tests2753	#2754	log_start2755	run_cmd nettest -6 -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NSB_IP6}2756	log_test $? 1 "MD5: VRF: Device must be a VRF - single address"2757 2758	log_start2759	run_cmd nettest -6 -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NS_NET6}2760	log_test $? 1 "MD5: VRF: Device must be a VRF - prefix"2761 2762}2763 2764ipv6_tcp_novrf()2765{2766	local a2767 2768	#2769	# server tests2770	#2771	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV}2772	do2773		log_start2774		run_cmd nettest -6 -s &2775		sleep 12776		run_cmd_nsb nettest -6 -r ${a}2777		log_test_addr ${a} $? 0 "Global server"2778	done2779 2780	# verify TCP reset received2781	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV}2782	do2783		log_start2784		show_hint "Should fail 'Connection refused'"2785		run_cmd_nsb nettest -6 -r ${a}2786		log_test_addr ${a} $? 1 "No server"2787	done2788 2789	#2790	# client2791	#2792	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}2793	do2794		log_start2795		run_cmd_nsb nettest -6 -s &2796		sleep 12797		run_cmd nettest -6 -r ${a}2798		log_test_addr ${a} $? 0 "Client"2799	done2800 2801	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}2802	do2803		log_start2804		run_cmd_nsb nettest -6 -s &2805		sleep 12806		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}2807		log_test_addr ${a} $? 0 "Client, device bind"2808	done2809 2810	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}2811	do2812		log_start2813		show_hint "Should fail 'Connection refused'"2814		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}2815		log_test_addr ${a} $? 1 "No server, device client"2816	done2817 2818	#2819	# local address tests2820	#2821	for a in ${NSA_IP6} ${NSA_LO_IP6} ::12822	do2823		log_start2824		run_cmd nettest -6 -s &2825		sleep 12826		run_cmd nettest -6 -r ${a}2827		log_test_addr ${a} $? 0 "Global server, local connection"2828	done2829 2830	a=${NSA_IP6}2831	log_start2832	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &2833	sleep 12834	run_cmd nettest -6 -r ${a} -0 ${a}2835	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"2836 2837	for a in ${NSA_LO_IP6} ::12838	do2839		log_start2840		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"2841		run_cmd nettest -6 -s -I ${NSA_DEV} &2842		sleep 12843		run_cmd nettest -6 -r ${a}2844		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"2845	done2846 2847	a=${NSA_IP6}2848	log_start2849	run_cmd nettest -6 -s &2850	sleep 12851	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}2852	log_test_addr ${a} $? 0 "Global server, device client, local connection"2853 2854	for a in ${NSA_LO_IP6} ::12855	do2856		log_start2857		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"2858		run_cmd nettest -6 -s &2859		sleep 12860		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}2861		log_test_addr ${a} $? 1 "Global server, device client, local connection"2862	done2863 2864	for a in ${NSA_IP6} ${NSA_LINKIP6}2865	do2866		log_start2867		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &2868		sleep 12869		run_cmd nettest -6  -d ${NSA_DEV} -r ${a}2870		log_test_addr ${a} $? 0 "Device server, device client, local conn"2871	done2872 2873	for a in ${NSA_IP6} ${NSA_LINKIP6}2874	do2875		log_start2876		show_hint "Should fail 'Connection refused'"2877		run_cmd nettest -6 -d ${NSA_DEV} -r ${a}2878		log_test_addr ${a} $? 1 "No server, device client, local conn"2879	done2880 2881	[ "$fips_enabled" = "1" ] || ipv6_tcp_md5_novrf2882}2883 2884ipv6_tcp_vrf()2885{2886	local a2887 2888	# disable global server2889	log_subsection "Global server disabled"2890 2891	set_sysctl net.ipv4.tcp_l3mdev_accept=02892 2893	#2894	# server tests2895	#2896	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}2897	do2898		log_start2899		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"2900		run_cmd nettest -6 -s &2901		sleep 12902		run_cmd_nsb nettest -6 -r ${a}2903		log_test_addr ${a} $? 1 "Global server"2904	done2905 2906	for a in ${NSA_IP6} ${VRF_IP6}2907	do2908		log_start2909		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &2910		sleep 12911		run_cmd_nsb nettest -6 -r ${a}2912		log_test_addr ${a} $? 0 "VRF server"2913	done2914 2915	# link local is always bound to ingress device2916	a=${NSA_LINKIP6}%${NSB_DEV}2917	log_start2918	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &2919	sleep 12920	run_cmd_nsb nettest -6 -r ${a}2921	log_test_addr ${a} $? 0 "VRF server"2922 2923	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}2924	do2925		log_start2926		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &2927		sleep 12928		run_cmd_nsb nettest -6 -r ${a}2929		log_test_addr ${a} $? 0 "Device server"2930	done2931 2932	# verify TCP reset received2933	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}2934	do2935		log_start2936		show_hint "Should fail 'Connection refused'"2937		run_cmd_nsb nettest -6 -r ${a}2938		log_test_addr ${a} $? 1 "No server"2939	done2940 2941	# local address tests2942	a=${NSA_IP6}2943	log_start2944	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"2945	run_cmd nettest -6 -s &2946	sleep 12947	run_cmd nettest -6 -r ${a} -d ${NSA_DEV}2948	log_test_addr ${a} $? 1 "Global server, local connection"2949 2950	# run MD5 tests2951	if [ "$fips_enabled" = "0" ]; then2952		setup_vrf_dup2953		ipv6_tcp_md52954		cleanup_vrf_dup2955	fi2956 2957	#2958	# enable VRF global server2959	#2960	log_subsection "VRF Global server enabled"2961	set_sysctl net.ipv4.tcp_l3mdev_accept=12962 2963	for a in ${NSA_IP6} ${VRF_IP6}2964	do2965		log_start2966		run_cmd nettest -6 -s -3 ${VRF} &2967		sleep 12968		run_cmd_nsb nettest -6 -r ${a}2969		log_test_addr ${a} $? 0 "Global server"2970	done2971 2972	for a in ${NSA_IP6} ${VRF_IP6}2973	do2974		log_start2975		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &2976		sleep 12977		run_cmd_nsb nettest -6 -r ${a}2978		log_test_addr ${a} $? 0 "VRF server"2979	done2980 2981	# For LLA, child socket is bound to device2982	a=${NSA_LINKIP6}%${NSB_DEV}2983	log_start2984	run_cmd nettest -6 -s -3 ${NSA_DEV} &2985	sleep 12986	run_cmd_nsb nettest -6 -r ${a}2987	log_test_addr ${a} $? 0 "Global server"2988 2989	log_start2990	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &2991	sleep 12992	run_cmd_nsb nettest -6 -r ${a}2993	log_test_addr ${a} $? 0 "VRF server"2994 2995	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSB_DEV}2996	do2997		log_start2998		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &2999		sleep 13000		run_cmd_nsb nettest -6 -r ${a}3001		log_test_addr ${a} $? 0 "Device server"3002	done3003 3004	# verify TCP reset received3005	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}3006	do3007		log_start3008		show_hint "Should fail 'Connection refused'"3009		run_cmd_nsb nettest -6 -r ${a}3010		log_test_addr ${a} $? 1 "No server"3011	done3012 3013	# local address tests3014	for a in ${NSA_IP6} ${VRF_IP6}3015	do3016		log_start3017		show_hint "Fails 'Connection refused' since client is not in VRF"3018		run_cmd nettest -6 -s -I ${VRF} &3019		sleep 13020		run_cmd nettest -6 -r ${a}3021		log_test_addr ${a} $? 1 "Global server, local connection"3022	done3023 3024 3025	#3026	# client3027	#3028	for a in ${NSB_IP6} ${NSB_LO_IP6}3029	do3030		log_start3031		run_cmd_nsb nettest -6 -s &3032		sleep 13033		run_cmd nettest -6 -r ${a} -d ${VRF}3034		log_test_addr ${a} $? 0 "Client, VRF bind"3035	done3036 3037	a=${NSB_LINKIP6}3038	log_start3039	show_hint "Fails since VRF device does not allow linklocal addresses"3040	run_cmd_nsb nettest -6 -s &3041	sleep 13042	run_cmd nettest -6 -r ${a} -d ${VRF}3043	log_test_addr ${a} $? 1 "Client, VRF bind"3044 3045	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}3046	do3047		log_start3048		run_cmd_nsb nettest -6 -s &3049		sleep 13050		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}3051		log_test_addr ${a} $? 0 "Client, device bind"3052	done3053 3054	for a in ${NSB_IP6} ${NSB_LO_IP6}3055	do3056		log_start3057		show_hint "Should fail 'Connection refused'"3058		run_cmd nettest -6 -r ${a} -d ${VRF}3059		log_test_addr ${a} $? 1 "No server, VRF client"3060	done3061 3062	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}3063	do3064		log_start3065		show_hint "Should fail 'Connection refused'"3066		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}3067		log_test_addr ${a} $? 1 "No server, device client"3068	done3069 3070	for a in ${NSA_IP6} ${VRF_IP6} ::13071	do3072		log_start3073		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &3074		sleep 13075		run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}3076		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"3077	done3078 3079	a=${NSA_IP6}3080	log_start3081	run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &3082	sleep 13083	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}3084	log_test_addr ${a} $? 0 "VRF server, device client, local connection"3085 3086	a=${NSA_IP6}3087	log_start3088	show_hint "Should fail since unbound client is out of VRF scope"3089	run_cmd nettest -6 -s -I ${VRF} &3090	sleep 13091	run_cmd nettest -6 -r ${a}3092	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"3093 3094	log_start3095	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &3096	sleep 13097	run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}3098	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"3099 3100	for a in ${NSA_IP6} ${NSA_LINKIP6}3101	do3102		log_start3103		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &3104		sleep 13105		run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}3106		log_test_addr ${a} $? 0 "Device server, device client, local connection"3107	done3108}3109 3110ipv6_tcp()3111{3112	log_section "IPv6/TCP"3113	log_subsection "No VRF"3114	setup3115 3116	# tcp_l3mdev_accept should have no affect without VRF;3117	# run tests with it enabled and disabled to verify3118	log_subsection "tcp_l3mdev_accept disabled"3119	set_sysctl net.ipv4.tcp_l3mdev_accept=03120	ipv6_tcp_novrf3121	log_subsection "tcp_l3mdev_accept enabled"3122	set_sysctl net.ipv4.tcp_l3mdev_accept=13123	ipv6_tcp_novrf3124 3125	log_subsection "With VRF"3126	setup "yes"3127	ipv6_tcp_vrf3128}3129 3130################################################################################3131# IPv6 UDP3132 3133ipv6_udp_novrf()3134{3135	local a3136 3137	#3138	# server tests3139	#3140	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSB_DEV}3141	do3142		log_start3143		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &3144		sleep 13145		run_cmd_nsb nettest -6 -D -r ${a}3146		log_test_addr ${a} $? 0 "Global server"3147 3148		log_start3149		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3150		sleep 13151		run_cmd_nsb nettest -6 -D -r ${a}3152		log_test_addr ${a} $? 0 "Device server"3153	done3154 3155	a=${NSA_LO_IP6}3156	log_start3157	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &3158	sleep 13159	run_cmd_nsb nettest -6 -D -r ${a}3160	log_test_addr ${a} $? 0 "Global server"3161 3162	# should fail since loopback address is out of scope for a device3163	# bound server, but it does not - hence this is more documenting3164	# behavior.3165	#log_start3166	#show_hint "Should fail since loopback address is out of scope"3167	#run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3168	#sleep 13169	#run_cmd_nsb nettest -6 -D -r ${a}3170	#log_test_addr ${a} $? 1 "Device server"3171 3172	# negative test - should fail3173	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV}3174	do3175		log_start3176		show_hint "Should fail 'Connection refused' since there is no server"3177		run_cmd_nsb nettest -6 -D -r ${a}3178		log_test_addr ${a} $? 1 "No server"3179	done3180 3181	#3182	# client3183	#3184	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}3185	do3186		log_start3187		run_cmd_nsb nettest -6 -D -s &3188		sleep 13189		run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6}3190		log_test_addr ${a} $? 0 "Client"3191 3192		log_start3193		run_cmd_nsb nettest -6 -D -s &3194		sleep 13195		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6}3196		log_test_addr ${a} $? 0 "Client, device bind"3197 3198		log_start3199		run_cmd_nsb nettest -6 -D -s &3200		sleep 13201		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6}3202		log_test_addr ${a} $? 0 "Client, device send via cmsg"3203 3204		log_start3205		run_cmd_nsb nettest -6 -D -s &3206		sleep 13207		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6}3208		log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"3209 3210		log_start3211		show_hint "Should fail 'Connection refused'"3212		run_cmd nettest -6 -D -r ${a}3213		log_test_addr ${a} $? 1 "No server, unbound client"3214 3215		log_start3216		show_hint "Should fail 'Connection refused'"3217		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}3218		log_test_addr ${a} $? 1 "No server, device client"3219	done3220 3221	#3222	# local address tests3223	#3224	for a in ${NSA_IP6} ${NSA_LO_IP6} ::13225	do3226		log_start3227		run_cmd nettest -6 -D -s &3228		sleep 13229		run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a}3230		log_test_addr ${a} $? 0 "Global server, local connection"3231	done3232 3233	a=${NSA_IP6}3234	log_start3235	run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &3236	sleep 13237	run_cmd nettest -6 -D -r ${a}3238	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"3239 3240	for a in ${NSA_LO_IP6} ::13241	do3242		log_start3243		show_hint "Should fail 'Connection refused' since address is out of device scope"3244		run_cmd nettest -6 -s -D -I ${NSA_DEV} &3245		sleep 13246		run_cmd nettest -6 -D -r ${a}3247		log_test_addr ${a} $? 1 "Device server, local connection"3248	done3249 3250	a=${NSA_IP6}3251	log_start3252	run_cmd nettest -6 -s -D &3253	sleep 13254	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3255	log_test_addr ${a} $? 0 "Global server, device client, local connection"3256 3257	log_start3258	run_cmd nettest -6 -s -D &3259	sleep 13260	run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a}3261	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"3262 3263	log_start3264	run_cmd nettest -6 -s -D &3265	sleep 13266	run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a}3267	log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"3268 3269	for a in ${NSA_LO_IP6} ::13270	do3271		log_start3272		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"3273		run_cmd nettest -6 -D -s &3274		sleep 13275		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}3276		log_test_addr ${a} $? 1 "Global server, device client, local connection"3277 3278		log_start3279		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"3280		run_cmd nettest -6 -D -s &3281		sleep 13282		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C3283		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"3284 3285		log_start3286		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"3287		run_cmd nettest -6 -D -s &3288		sleep 13289		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S3290		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"3291 3292		log_start3293		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"3294		run_cmd nettest -6 -D -s &3295		sleep 13296		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U3297		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"3298	done3299 3300	a=${NSA_IP6}3301	log_start3302	run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &3303	sleep 13304	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a}3305	log_test_addr ${a} $? 0 "Device server, device client, local conn"3306 3307	log_start3308	show_hint "Should fail 'Connection refused'"3309	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3310	log_test_addr ${a} $? 1 "No server, device client, local conn"3311 3312	# LLA to GUA3313	run_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV}3314	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}3315	log_start3316	run_cmd nettest -6 -s -D &3317	sleep 13318	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}3319	log_test $? 0 "UDP in - LLA to GUA"3320 3321	run_cmd_nsb ip -6 ro del ${NSA_IP6}/128 dev ${NSB_DEV}3322	run_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV} nodad3323}3324 3325ipv6_udp_vrf()3326{3327	local a3328 3329	# disable global server3330	log_subsection "Global server disabled"3331	set_sysctl net.ipv4.udp_l3mdev_accept=03332 3333	#3334	# server tests3335	#3336	for a in ${NSA_IP6} ${VRF_IP6}3337	do3338		log_start3339		show_hint "Should fail 'Connection refused' since global server is disabled"3340		run_cmd nettest -6 -D -s &3341		sleep 13342		run_cmd_nsb nettest -6 -D -r ${a}3343		log_test_addr ${a} $? 1 "Global server"3344	done3345 3346	for a in ${NSA_IP6} ${VRF_IP6}3347	do3348		log_start3349		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &3350		sleep 13351		run_cmd_nsb nettest -6 -D -r ${a}3352		log_test_addr ${a} $? 0 "VRF server"3353	done3354 3355	for a in ${NSA_IP6} ${VRF_IP6}3356	do3357		log_start3358		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3359		sleep 13360		run_cmd_nsb nettest -6 -D -r ${a}3361		log_test_addr ${a} $? 0 "Enslaved device server"3362	done3363 3364	# negative test - should fail3365	for a in ${NSA_IP6} ${VRF_IP6}3366	do3367		log_start3368		show_hint "Should fail 'Connection refused' since there is no server"3369		run_cmd_nsb nettest -6 -D -r ${a}3370		log_test_addr ${a} $? 1 "No server"3371	done3372 3373	#3374	# local address tests3375	#3376	for a in ${NSA_IP6} ${VRF_IP6}3377	do3378		log_start3379		show_hint "Should fail 'Connection refused' since global server is disabled"3380		run_cmd nettest -6 -D -s &3381		sleep 13382		run_cmd nettest -6 -D -d ${VRF} -r ${a}3383		log_test_addr ${a} $? 1 "Global server, VRF client, local conn"3384	done3385 3386	for a in ${NSA_IP6} ${VRF_IP6}3387	do3388		log_start3389		run_cmd nettest -6 -D -I ${VRF} -s &3390		sleep 13391		run_cmd nettest -6 -D -d ${VRF} -r ${a}3392		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"3393	done3394 3395	a=${NSA_IP6}3396	log_start3397	show_hint "Should fail 'Connection refused' since global server is disabled"3398	run_cmd nettest -6 -D -s &3399	sleep 13400	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3401	log_test_addr ${a} $? 1 "Global server, device client, local conn"3402 3403	log_start3404	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &3405	sleep 13406	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3407	log_test_addr ${a} $? 0 "VRF server, device client, local conn"3408 3409	log_start3410	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3411	sleep 13412	run_cmd nettest -6 -D -d ${VRF} -r ${a}3413	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"3414 3415	log_start3416	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3417	sleep 13418	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3419	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"3420 3421	# disable global server3422	log_subsection "Global server enabled"3423	set_sysctl net.ipv4.udp_l3mdev_accept=13424 3425	#3426	# server tests3427	#3428	for a in ${NSA_IP6} ${VRF_IP6}3429	do3430		log_start3431		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &3432		sleep 13433		run_cmd_nsb nettest -6 -D -r ${a}3434		log_test_addr ${a} $? 0 "Global server"3435	done3436 3437	for a in ${NSA_IP6} ${VRF_IP6}3438	do3439		log_start3440		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &3441		sleep 13442		run_cmd_nsb nettest -6 -D -r ${a}3443		log_test_addr ${a} $? 0 "VRF server"3444	done3445 3446	for a in ${NSA_IP6} ${VRF_IP6}3447	do3448		log_start3449		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3450		sleep 13451		run_cmd_nsb nettest -6 -D -r ${a}3452		log_test_addr ${a} $? 0 "Enslaved device server"3453	done3454 3455	# negative test - should fail3456	for a in ${NSA_IP6} ${VRF_IP6}3457	do3458		log_start3459		run_cmd_nsb nettest -6 -D -r ${a}3460		log_test_addr ${a} $? 1 "No server"3461	done3462 3463	#3464	# client tests3465	#3466	log_start3467	run_cmd_nsb nettest -6 -D -s &3468	sleep 13469	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}3470	log_test $? 0 "VRF client"3471 3472	# negative test - should fail3473	log_start3474	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}3475	log_test $? 1 "No server, VRF client"3476 3477	log_start3478	run_cmd_nsb nettest -6 -D -s &3479	sleep 13480	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}3481	log_test $? 0 "Enslaved device client"3482 3483	# negative test - should fail3484	log_start3485	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}3486	log_test $? 1 "No server, enslaved device client"3487 3488	#3489	# local address tests3490	#3491	a=${NSA_IP6}3492	log_start3493	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &3494	sleep 13495	run_cmd nettest -6 -D -d ${VRF} -r ${a}3496	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"3497 3498	#log_start3499	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &3500	sleep 13501	run_cmd nettest -6 -D -d ${VRF} -r ${a}3502	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"3503 3504 3505	a=${VRF_IP6}3506	log_start3507	run_cmd nettest -6 -D -s -3 ${VRF} &3508	sleep 13509	run_cmd nettest -6 -D -d ${VRF} -r ${a}3510	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"3511 3512	log_start3513	run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} &3514	sleep 13515	run_cmd nettest -6 -D -d ${VRF} -r ${a}3516	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"3517 3518	# negative test - should fail3519	for a in ${NSA_IP6} ${VRF_IP6}3520	do3521		log_start3522		run_cmd nettest -6 -D -d ${VRF} -r ${a}3523		log_test_addr ${a} $? 1 "No server, VRF client, local conn"3524	done3525 3526	# device to global IP3527	a=${NSA_IP6}3528	log_start3529	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &3530	sleep 13531	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3532	log_test_addr ${a} $? 0 "Global server, device client, local conn"3533 3534	log_start3535	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &3536	sleep 13537	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3538	log_test_addr ${a} $? 0 "VRF server, device client, local conn"3539 3540	log_start3541	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3542	sleep 13543	run_cmd nettest -6 -D -d ${VRF} -r ${a}3544	log_test_addr ${a} $? 0 "Device server, VRF client, local conn"3545 3546	log_start3547	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &3548	sleep 13549	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3550	log_test_addr ${a} $? 0 "Device server, device client, local conn"3551 3552	log_start3553	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}3554	log_test_addr ${a} $? 1 "No server, device client, local conn"3555 3556 3557	# link local addresses3558	log_start3559	run_cmd nettest -6 -D -s &3560	sleep 13561	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}3562	log_test $? 0 "Global server, linklocal IP"3563 3564	log_start3565	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}3566	log_test $? 1 "No server, linklocal IP"3567 3568 3569	log_start3570	run_cmd_nsb nettest -6 -D -s &3571	sleep 13572	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}3573	log_test $? 0 "Enslaved device client, linklocal IP"3574 3575	log_start3576	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}3577	log_test $? 1 "No server, device client, peer linklocal IP"3578 3579 3580	log_start3581	run_cmd nettest -6 -D -s &3582	sleep 13583	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}3584	log_test $? 0 "Enslaved device client, local conn - linklocal IP"3585 3586	log_start3587	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}3588	log_test $? 1 "No server, device client, local conn  - linklocal IP"3589 3590	# LLA to GUA3591	run_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV}3592	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}3593	log_start3594	run_cmd nettest -6 -s -D &3595	sleep 13596	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}3597	log_test $? 0 "UDP in - LLA to GUA"3598 3599	run_cmd_nsb ip -6 ro del ${NSA_IP6}/128 dev ${NSB_DEV}3600	run_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV} nodad3601}3602 3603ipv6_udp()3604{3605        # should not matter, but set to known state3606        set_sysctl net.ipv4.udp_early_demux=13607 3608        log_section "IPv6/UDP"3609        log_subsection "No VRF"3610        setup3611 3612        # udp_l3mdev_accept should have no affect without VRF;3613        # run tests with it enabled and disabled to verify3614        log_subsection "udp_l3mdev_accept disabled"3615        set_sysctl net.ipv4.udp_l3mdev_accept=03616        ipv6_udp_novrf3617        log_subsection "udp_l3mdev_accept enabled"3618        set_sysctl net.ipv4.udp_l3mdev_accept=13619        ipv6_udp_novrf3620 3621        log_subsection "With VRF"3622        setup "yes"3623        ipv6_udp_vrf3624}3625 3626################################################################################3627# IPv6 address bind3628 3629ipv6_addr_bind_novrf()3630{3631	#3632	# raw socket3633	#3634	for a in ${NSA_IP6} ${NSA_LO_IP6}3635	do3636		log_start3637		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -b3638		log_test_addr ${a} $? 0 "Raw socket bind to local address"3639 3640		log_start3641		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${NSA_DEV} -b3642		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"3643	done3644 3645	#3646	# raw socket with nonlocal bind3647	#3648	a=${NL_IP6}3649	log_start3650	run_cmd nettest -6 -s -R -P icmp -f -l ${a} -I ${NSA_DEV} -b3651	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address"3652 3653	#3654	# tcp sockets3655	#3656	a=${NSA_IP6}3657	log_start3658	run_cmd nettest -6 -s -l ${a} -t1 -b3659	log_test_addr ${a} $? 0 "TCP socket bind to local address"3660 3661	log_start3662	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b3663	log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind"3664 3665	# Sadly, the kernel allows binding a socket to a device and then3666	# binding to an address not on the device. So this test passes3667	# when it really should not3668	a=${NSA_LO_IP6}3669	log_start3670	show_hint "Tecnically should fail since address is not on device but kernel allows"3671	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b3672	log_test_addr ${a} $? 0 "TCP socket bind to out of scope local address"3673}3674 3675ipv6_addr_bind_vrf()3676{3677	#3678	# raw socket3679	#3680	for a in ${NSA_IP6} ${VRF_IP6}3681	do3682		log_start3683		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${VRF} -b3684		log_test_addr ${a} $? 0 "Raw socket bind to local address after vrf bind"3685 3686		log_start3687		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${NSA_DEV} -b3688		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"3689	done3690 3691	a=${NSA_LO_IP6}3692	log_start3693	show_hint "Address on loopback is out of VRF scope"3694	run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${VRF} -b3695	log_test_addr ${a} $? 1 "Raw socket bind to invalid local address after vrf bind"3696 3697	#3698	# raw socket with nonlocal bind3699	#3700	a=${NL_IP6}3701	log_start3702	run_cmd nettest -6 -s -R -P icmp -f -l ${a} -I ${VRF} -b3703	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address after VRF bind"3704 3705	#3706	# tcp sockets3707	#3708	# address on enslaved device is valid for the VRF or device in a VRF3709	for a in ${NSA_IP6} ${VRF_IP6}3710	do3711		log_start3712		run_cmd nettest -6 -s -l ${a} -I ${VRF} -t1 -b3713		log_test_addr ${a} $? 0 "TCP socket bind to local address with VRF bind"3714	done3715 3716	a=${NSA_IP6}3717	log_start3718	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b3719	log_test_addr ${a} $? 0 "TCP socket bind to local address with device bind"3720 3721	# Sadly, the kernel allows binding a socket to a device and then3722	# binding to an address not on the device. The only restriction3723	# is that the address is valid in the L3 domain. So this test3724	# passes when it really should not3725	a=${VRF_IP6}3726	log_start3727	show_hint "Tecnically should fail since address is not on device but kernel allows"3728	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b3729	log_test_addr ${a} $? 0 "TCP socket bind to VRF address with device bind"3730 3731	a=${NSA_LO_IP6}3732	log_start3733	show_hint "Address on loopback out of scope for VRF"3734	run_cmd nettest -6 -s -l ${a} -I ${VRF} -t1 -b3735	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for VRF"3736 3737	log_start3738	show_hint "Address on loopback out of scope for device in VRF"3739	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b3740	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for device bind"3741 3742}3743 3744ipv6_addr_bind()3745{3746	log_section "IPv6 address binds"3747 3748	log_subsection "No VRF"3749	setup3750	ipv6_addr_bind_novrf3751 3752	log_subsection "With VRF"3753	setup "yes"3754	ipv6_addr_bind_vrf3755}3756 3757################################################################################3758# IPv6 runtime tests3759 3760ipv6_rt()3761{3762	local desc="$1"3763	local varg="-6 $2"3764	local with_vrf="yes"3765	local a3766 3767	#3768	# server tests3769	#3770	for a in ${NSA_IP6} ${VRF_IP6}3771	do3772		log_start3773		run_cmd nettest ${varg} -s &3774		sleep 13775		run_cmd_nsb nettest ${varg} -r ${a} &3776		sleep 33777		run_cmd ip link del ${VRF}3778		sleep 13779		log_test_addr ${a} 0 0 "${desc}, global server"3780 3781		setup ${with_vrf}3782	done3783 3784	for a in ${NSA_IP6} ${VRF_IP6}3785	do3786		log_start3787		run_cmd nettest ${varg} -I ${VRF} -s &3788		sleep 13789		run_cmd_nsb nettest ${varg} -r ${a} &3790		sleep 33791		run_cmd ip link del ${VRF}3792		sleep 13793		log_test_addr ${a} 0 0 "${desc}, VRF server"3794 3795		setup ${with_vrf}3796	done3797 3798	for a in ${NSA_IP6} ${VRF_IP6}3799	do3800		log_start3801		run_cmd nettest ${varg} -I ${NSA_DEV} -s &3802		sleep 13803		run_cmd_nsb nettest ${varg} -r ${a} &3804		sleep 33805		run_cmd ip link del ${VRF}3806		sleep 13807		log_test_addr ${a} 0 0 "${desc}, enslaved device server"3808 3809		setup ${with_vrf}3810	done3811 3812	#3813	# client test3814	#3815	log_start3816	run_cmd_nsb nettest ${varg} -s &3817	sleep 13818	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} &3819	sleep 33820	run_cmd ip link del ${VRF}3821	sleep 13822	log_test  0 0 "${desc}, VRF client"3823 3824	setup ${with_vrf}3825 3826	log_start3827	run_cmd_nsb nettest ${varg} -s &3828	sleep 13829	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} &3830	sleep 33831	run_cmd ip link del ${VRF}3832	sleep 13833	log_test  0 0 "${desc}, enslaved device client"3834 3835	setup ${with_vrf}3836 3837 3838	#3839	# local address tests3840	#3841	for a in ${NSA_IP6} ${VRF_IP6}3842	do3843		log_start3844		run_cmd nettest ${varg} -s &3845		sleep 13846		run_cmd nettest ${varg} -d ${VRF} -r ${a} &3847		sleep 33848		run_cmd ip link del ${VRF}3849		sleep 13850		log_test_addr ${a} 0 0 "${desc}, global server, VRF client"3851 3852		setup ${with_vrf}3853	done3854 3855	for a in ${NSA_IP6} ${VRF_IP6}3856	do3857		log_start3858		run_cmd nettest ${varg} -I ${VRF} -s &3859		sleep 13860		run_cmd nettest ${varg} -d ${VRF} -r ${a} &3861		sleep 33862		run_cmd ip link del ${VRF}3863		sleep 13864		log_test_addr ${a} 0 0 "${desc}, VRF server and client"3865 3866		setup ${with_vrf}3867	done3868 3869	a=${NSA_IP6}3870	log_start3871	run_cmd nettest ${varg} -s &3872	sleep 13873	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &3874	sleep 33875	run_cmd ip link del ${VRF}3876	sleep 13877	log_test_addr ${a} 0 0 "${desc}, global server, device client"3878 3879	setup ${with_vrf}3880 3881	log_start3882	run_cmd nettest ${varg} -I ${VRF} -s &3883	sleep 13884	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &3885	sleep 33886	run_cmd ip link del ${VRF}3887	sleep 13888	log_test_addr ${a} 0 0 "${desc}, VRF server, device client"3889 3890	setup ${with_vrf}3891 3892	log_start3893	run_cmd nettest ${varg} -I ${NSA_DEV} -s &3894	sleep 13895	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &3896	sleep 33897	run_cmd ip link del ${VRF}3898	sleep 13899	log_test_addr ${a} 0 0 "${desc}, device server, device client"3900}3901 3902ipv6_ping_rt()3903{3904	local with_vrf="yes"3905	local a3906 3907	a=${NSA_IP6}3908	log_start3909	run_cmd_nsb ${ping6} -f ${a} &3910	sleep 33911	run_cmd ip link del ${VRF}3912	sleep 13913	log_test_addr ${a} 0 0 "Device delete with active traffic - ping in"3914 3915	setup ${with_vrf}3916 3917	log_start3918	run_cmd ${ping6} -f ${NSB_IP6} -I ${VRF} &3919	sleep 13920	run_cmd ip link del ${VRF}3921	sleep 13922	log_test_addr ${a} 0 0 "Device delete with active traffic - ping out"3923}3924 3925ipv6_runtime()3926{3927	log_section "Run time tests - ipv6"3928 3929	setup "yes"3930	ipv6_ping_rt3931 3932	setup "yes"3933	ipv6_rt "TCP active socket"  "-n -1"3934 3935	setup "yes"3936	ipv6_rt "TCP passive socket" "-i"3937 3938	setup "yes"3939	ipv6_rt "UDP active socket"  "-D -n -1"3940}3941 3942################################################################################3943# netfilter blocking connections3944 3945netfilter_tcp_reset()3946{3947	local a3948 3949	for a in ${NSA_IP} ${VRF_IP}3950	do3951		log_start3952		run_cmd nettest -s &3953		sleep 13954		run_cmd_nsb nettest -r ${a}3955		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"3956	done3957}3958 3959netfilter_icmp()3960{3961	local stype="$1"3962	local arg3963	local a3964 3965	[ "${stype}" = "UDP" ] && arg="-D"3966 3967	for a in ${NSA_IP} ${VRF_IP}3968	do3969		log_start3970		run_cmd nettest ${arg} -s &3971		sleep 13972		run_cmd_nsb nettest ${arg} -r ${a}3973		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"3974	done3975}3976 3977ipv4_netfilter()3978{3979	log_section "IPv4 Netfilter"3980	log_subsection "TCP reset"3981 3982	setup "yes"3983	run_cmd iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset3984 3985	netfilter_tcp_reset3986 3987	log_start3988	log_subsection "ICMP unreachable"3989 3990	log_start3991	run_cmd iptables -F3992	run_cmd iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp-port-unreachable3993	run_cmd iptables -A INPUT -p udp --dport 12345 -j REJECT --reject-with icmp-port-unreachable3994 3995	netfilter_icmp "TCP"3996	netfilter_icmp "UDP"3997 3998	log_start3999	iptables -F4000}4001 4002netfilter_tcp6_reset()4003{4004	local a4005 4006	for a in ${NSA_IP6} ${VRF_IP6}4007	do4008		log_start4009		run_cmd nettest -6 -s &4010		sleep 14011		run_cmd_nsb nettest -6 -r ${a}4012		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"4013	done4014}4015 4016netfilter_icmp6()4017{4018	local stype="$1"4019	local arg4020	local a4021 4022	[ "${stype}" = "UDP" ] && arg="$arg -D"4023 4024	for a in ${NSA_IP6} ${VRF_IP6}4025	do4026		log_start4027		run_cmd nettest -6 -s ${arg} &4028		sleep 14029		run_cmd_nsb nettest -6 ${arg} -r ${a}4030		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"4031	done4032}4033 4034ipv6_netfilter()4035{4036	log_section "IPv6 Netfilter"4037	log_subsection "TCP reset"4038 4039	setup "yes"4040	run_cmd ip6tables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset4041 4042	netfilter_tcp6_reset4043 4044	log_subsection "ICMP unreachable"4045 4046	log_start4047	run_cmd ip6tables -F4048	run_cmd ip6tables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp6-port-unreachable4049	run_cmd ip6tables -A INPUT -p udp --dport 12345 -j REJECT --reject-with icmp6-port-unreachable4050 4051	netfilter_icmp6 "TCP"4052	netfilter_icmp6 "UDP"4053 4054	log_start4055	ip6tables -F4056}4057 4058################################################################################4059# specific use cases4060 4061# VRF only.4062# ns-A device enslaved to bridge. Verify traffic with and without4063# br_netfilter module loaded. Repeat with SVI on bridge.4064use_case_br()4065{4066	setup "yes"4067 4068	setup_cmd ip link set ${NSA_DEV} down4069	setup_cmd ip addr del dev ${NSA_DEV} ${NSA_IP}/244070	setup_cmd ip -6 addr del dev ${NSA_DEV} ${NSA_IP6}/644071 4072	setup_cmd ip link add br0 type bridge4073	setup_cmd ip addr add dev br0 ${NSA_IP}/244074	setup_cmd ip -6 addr add dev br0 ${NSA_IP6}/64 nodad4075 4076	setup_cmd ip li set ${NSA_DEV} master br04077	setup_cmd ip li set ${NSA_DEV} up4078	setup_cmd ip li set br0 up4079	setup_cmd ip li set br0 vrf ${VRF}4080 4081	rmmod br_netfilter 2>/dev/null4082	sleep 5 # DAD4083 4084	run_cmd ip neigh flush all4085	run_cmd ping -c1 -w1 -I br0 ${NSB_IP}4086	log_test $? 0 "Bridge into VRF - IPv4 ping out"4087 4088	run_cmd ip neigh flush all4089	run_cmd ${ping6} -c1 -w1 -I br0 ${NSB_IP6}4090	log_test $? 0 "Bridge into VRF - IPv6 ping out"4091 4092	run_cmd ip neigh flush all4093	run_cmd_nsb ping -c1 -w1 ${NSA_IP}4094	log_test $? 0 "Bridge into VRF - IPv4 ping in"4095 4096	run_cmd ip neigh flush all4097	run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6}4098	log_test $? 0 "Bridge into VRF - IPv6 ping in"4099 4100	modprobe br_netfilter4101	if [ $? -eq 0 ]; then4102		run_cmd ip neigh flush all4103		run_cmd ping -c1 -w1 -I br0 ${NSB_IP}4104		log_test $? 0 "Bridge into VRF with br_netfilter - IPv4 ping out"4105 4106		run_cmd ip neigh flush all4107		run_cmd ${ping6} -c1 -w1 -I br0 ${NSB_IP6}4108		log_test $? 0 "Bridge into VRF with br_netfilter - IPv6 ping out"4109 4110		run_cmd ip neigh flush all4111		run_cmd_nsb ping -c1 -w1 ${NSA_IP}4112		log_test $? 0 "Bridge into VRF with br_netfilter - IPv4 ping in"4113 4114		run_cmd ip neigh flush all4115		run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6}4116		log_test $? 0 "Bridge into VRF with br_netfilter - IPv6 ping in"4117	fi4118 4119	setup_cmd ip li set br0 nomaster4120	setup_cmd ip li add br0.100 link br0 type vlan id 1004121	setup_cmd ip li set br0.100 vrf ${VRF} up4122	setup_cmd ip    addr add dev br0.100 172.16.101.1/244123	setup_cmd ip -6 addr add dev br0.100 2001:db8:101::1/64 nodad4124 4125	setup_cmd_nsb ip li add vlan100 link ${NSB_DEV} type vlan id 1004126	setup_cmd_nsb ip addr add dev vlan100 172.16.101.2/244127	setup_cmd_nsb ip -6 addr add dev vlan100 2001:db8:101::2/64 nodad4128	setup_cmd_nsb ip li set vlan100 up4129	sleep 14130 4131	rmmod br_netfilter 2>/dev/null4132 4133	run_cmd ip neigh flush all4134	run_cmd ping -c1 -w1 -I br0.100 172.16.101.24135	log_test $? 0 "Bridge vlan into VRF - IPv4 ping out"4136 4137	run_cmd ip neigh flush all4138	run_cmd ${ping6} -c1 -w1 -I br0.100 2001:db8:101::24139	log_test $? 0 "Bridge vlan into VRF - IPv6 ping out"4140 4141	run_cmd ip neigh flush all4142	run_cmd_nsb ping -c1 -w1 172.16.101.14143	log_test $? 0 "Bridge vlan into VRF - IPv4 ping in"4144 4145	run_cmd ip neigh flush all4146	run_cmd_nsb ${ping6} -c1 -w1 2001:db8:101::14147	log_test $? 0 "Bridge vlan into VRF - IPv6 ping in"4148 4149	modprobe br_netfilter4150	if [ $? -eq 0 ]; then4151		run_cmd ip neigh flush all4152		run_cmd ping -c1 -w1 -I br0.100 172.16.101.24153		log_test $? 0 "Bridge vlan into VRF with br_netfilter - IPv4 ping out"4154 4155		run_cmd ip neigh flush all4156		run_cmd ${ping6} -c1 -w1 -I br0.100 2001:db8:101::24157		log_test $? 0 "Bridge vlan into VRF with br_netfilter - IPv6 ping out"4158 4159		run_cmd ip neigh flush all4160		run_cmd_nsb ping -c1 -w1 172.16.101.14161		log_test $? 0 "Bridge vlan into VRF - IPv4 ping in"4162 4163		run_cmd ip neigh flush all4164		run_cmd_nsb ${ping6} -c1 -w1 2001:db8:101::14165		log_test $? 0 "Bridge vlan into VRF - IPv6 ping in"4166	fi4167 4168	setup_cmd ip li del br0 2>/dev/null4169	setup_cmd_nsb ip li del vlan100 2>/dev/null4170}4171 4172# VRF only.4173# ns-A device is connected to both ns-B and ns-C on a single VRF but only has4174# LLA on the interfaces4175use_case_ping_lla_multi()4176{4177	setup_lla_only4178	# only want reply from ns-A4179	setup_cmd_nsb sysctl -qw net.ipv6.icmp.echo_ignore_multicast=14180	setup_cmd_nsc sysctl -qw net.ipv6.icmp.echo_ignore_multicast=14181 4182	log_start4183	run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}4184	log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Pre cycle, ping out ns-B"4185 4186	run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}4187	log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Pre cycle, ping out ns-C"4188 4189	# cycle/flap the first ns-A interface4190	setup_cmd ip link set ${NSA_DEV} down4191	setup_cmd ip link set ${NSA_DEV} up4192	sleep 14193 4194	log_start4195	run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}4196	log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-B"4197	run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}4198	log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-C"4199 4200	# cycle/flap the second ns-A interface4201	setup_cmd ip link set ${NSA_DEV2} down4202	setup_cmd ip link set ${NSA_DEV2} up4203	sleep 14204 4205	log_start4206	run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}4207	log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-B"4208	run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}4209	log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-C"4210}4211 4212# Perform IPv{4,6} SNAT on ns-A, and verify TCP connection is successfully4213# established with ns-B.4214use_case_snat_on_vrf()4215{4216	setup "yes"4217 4218	local port="12345"4219 4220	run_cmd iptables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP} -o ${VRF}4221	run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}4222 4223	run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} &4224	sleep 14225	run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port}4226	log_test $? 0 "IPv4 TCP connection over VRF with SNAT"4227 4228	run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} &4229	sleep 14230	run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port}4231	log_test $? 0 "IPv6 TCP connection over VRF with SNAT"4232 4233	# Cleanup4234	run_cmd iptables -t nat -D POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP} -o ${VRF}4235	run_cmd ip6tables -t nat -D POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}4236}4237 4238use_cases()4239{4240	log_section "Use cases"4241	log_subsection "Device enslaved to bridge"4242	use_case_br4243	log_subsection "Ping LLA with multiple interfaces"4244	use_case_ping_lla_multi4245	log_subsection "SNAT on VRF"4246	use_case_snat_on_vrf4247}4248 4249################################################################################4250# usage4251 4252usage()4253{4254	cat <<EOF4255usage: ${0##*/} OPTS4256 4257	-4          IPv4 tests only4258	-6          IPv6 tests only4259	-t <test>   Test name/set to run4260	-p          Pause on fail4261	-P          Pause after each test4262	-v          Be verbose4263 4264Tests:4265	$TESTS_IPV4 $TESTS_IPV6 $TESTS_OTHER4266EOF4267}4268 4269################################################################################4270# main4271 4272TESTS_IPV4="ipv4_ping ipv4_tcp ipv4_udp ipv4_bind ipv4_runtime ipv4_netfilter"4273TESTS_IPV6="ipv6_ping ipv6_tcp ipv6_udp ipv6_bind ipv6_runtime ipv6_netfilter"4274TESTS_OTHER="use_cases"4275 4276PAUSE_ON_FAIL=no4277PAUSE=no4278 4279while getopts :46t:pPvh o4280do4281	case $o in4282		4) TESTS=ipv4;;4283		6) TESTS=ipv6;;4284		t) TESTS=$OPTARG;;4285		p) PAUSE_ON_FAIL=yes;;4286		P) PAUSE=yes;;4287		v) VERBOSE=1;;4288		h) usage; exit 0;;4289		*) usage; exit 1;;4290	esac4291done4292 4293# make sure we don't pause twice4294[ "${PAUSE}" = "yes" ] && PAUSE_ON_FAIL=no4295 4296#4297# show user test config4298#4299if [ -z "$TESTS" ]; then4300	TESTS="$TESTS_IPV4 $TESTS_IPV6 $TESTS_OTHER"4301elif [ "$TESTS" = "ipv4" ]; then4302	TESTS="$TESTS_IPV4"4303elif [ "$TESTS" = "ipv6" ]; then4304	TESTS="$TESTS_IPV6"4305fi4306 4307check_gen_prog "nettest"4308 4309declare -i nfail=04310declare -i nsuccess=04311 4312for t in $TESTS4313do4314	case $t in4315	ipv4_ping|ping)  ipv4_ping;;4316	ipv4_tcp|tcp)    ipv4_tcp;;4317	ipv4_udp|udp)    ipv4_udp;;4318	ipv4_bind|bind)  ipv4_addr_bind;;4319	ipv4_runtime)    ipv4_runtime;;4320	ipv4_netfilter)  ipv4_netfilter;;4321 4322	ipv6_ping|ping6) ipv6_ping;;4323	ipv6_tcp|tcp6)   ipv6_tcp;;4324	ipv6_udp|udp6)   ipv6_udp;;4325	ipv6_bind|bind6) ipv6_addr_bind;;4326	ipv6_runtime)    ipv6_runtime;;4327	ipv6_netfilter)  ipv6_netfilter;;4328 4329	use_cases)       use_cases;;4330 4331	# setup namespaces and config, but do not run any tests4332	setup)		 setup; exit 0;;4333	vrf_setup)	 setup "yes"; exit 0;;4334	esac4335done4336 4337cleanup 2>/dev/null4338 4339printf "\nTests passed: %3d\n" ${nsuccess}4340printf "Tests failed: %3d\n"   ${nfail}4341 4342if [ $nfail -ne 0 ]; then4343	exit 1 # KSFT_FAIL4344elif [ $nsuccess -eq 0 ]; then4345	exit $ksft_skip4346fi4347 4348exit 0 # KSFT_PASS4349