377 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# L2TPv3 tunnel between 2 hosts5#6# host-1 | router | host-27# | |8# lo l2tp | | l2tp lo9# 172.16.101.1 172.16.1.1 | | 172.16.1.2 172.16.101.210# fc00:101::1 fc00:1::1 | | fc00:1::2 fc00:101::211# | |12# eth0 | | eth013# 10.1.1.1 | | 10.1.2.114# 2001:db8:1::1 | | 2001:db8:2::115 16source lib.sh17VERBOSE=018PAUSE_ON_FAIL=no19 20which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)21 22################################################################################23#24log_test()25{26 local rc=$127 local expected=$228 local msg="$3"29 30 if [ ${rc} -eq ${expected} ]; then31 printf "TEST: %-60s [ OK ]\n" "${msg}"32 nsuccess=$((nsuccess+1))33 else34 ret=135 nfail=$((nfail+1))36 printf "TEST: %-60s [FAIL]\n" "${msg}"37 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then38 echo39 echo "hit enter to continue, 'q' to quit"40 read a41 [ "$a" = "q" ] && exit 142 fi43 fi44}45 46run_cmd()47{48 local ns49 local cmd50 local out51 local rc52 53 ns="$1"54 shift55 cmd="$*"56 57 if [ "$VERBOSE" = "1" ]; then58 printf " COMMAND: $cmd\n"59 fi60 61 out=$(eval ip netns exec ${ns} ${cmd} 2>&1)62 rc=$?63 if [ "$VERBOSE" = "1" -a -n "$out" ]; then64 echo " $out"65 fi66 67 [ "$VERBOSE" = "1" ] && echo68 69 return $rc70}71 72################################################################################73# create namespaces and interconnects74 75create_ns()76{77 local ns=$178 local addr=$279 local addr6=$380 81 [ -z "${addr}" ] && addr="-"82 [ -z "${addr6}" ] && addr6="-"83 84 if [ "${addr}" != "-" ]; then85 ip -netns ${ns} addr add dev lo ${addr}86 fi87 if [ "${addr6}" != "-" ]; then88 ip -netns ${ns} -6 addr add dev lo ${addr6}89 fi90 91 ip -netns ${ns} ro add unreachable default metric 819292 ip -netns ${ns} -6 ro add unreachable default metric 819293 94 ip netns exec ${ns} sysctl -qw net.ipv4.ip_forward=195 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=196 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=197 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=198 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=099}100 101# create veth pair to connect namespaces and apply addresses.102connect_ns()103{104 local ns1=$1105 local ns1_dev=$2106 local ns1_addr=$3107 local ns1_addr6=$4108 local ns2=$5109 local ns2_dev=$6110 local ns2_addr=$7111 local ns2_addr6=$8112 113 ip -netns ${ns1} li add ${ns1_dev} type veth peer name tmp114 ip -netns ${ns1} li set ${ns1_dev} up115 ip -netns ${ns1} li set tmp netns ${ns2} name ${ns2_dev}116 ip -netns ${ns2} li set ${ns2_dev} up117 118 if [ "${ns1_addr}" != "-" ]; then119 ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr}120 ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr}121 fi122 123 if [ "${ns1_addr6}" != "-" ]; then124 ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr6}125 ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr6}126 fi127}128 129################################################################################130# test setup131 132cleanup()133{134 cleanup_ns $host_1 $host_2 $router135}136 137setup_l2tp_ipv4()138{139 #140 # configure l2tpv3 tunnel on host-1141 #142 ip -netns $host_1 l2tp add tunnel tunnel_id 1041 peer_tunnel_id 1042 \143 encap ip local 10.1.1.1 remote 10.1.2.1144 ip -netns $host_1 l2tp add session name l2tp4 tunnel_id 1041 \145 session_id 1041 peer_session_id 1042146 ip -netns $host_1 link set dev l2tp4 up147 ip -netns $host_1 addr add dev l2tp4 172.16.1.1 peer 172.16.1.2148 149 #150 # configure l2tpv3 tunnel on host-2151 #152 ip -netns $host_2 l2tp add tunnel tunnel_id 1042 peer_tunnel_id 1041 \153 encap ip local 10.1.2.1 remote 10.1.1.1154 ip -netns $host_2 l2tp add session name l2tp4 tunnel_id 1042 \155 session_id 1042 peer_session_id 1041156 ip -netns $host_2 link set dev l2tp4 up157 ip -netns $host_2 addr add dev l2tp4 172.16.1.2 peer 172.16.1.1158 159 #160 # add routes to loopback addresses161 #162 ip -netns $host_1 ro add 172.16.101.2/32 via 172.16.1.2163 ip -netns $host_2 ro add 172.16.101.1/32 via 172.16.1.1164}165 166setup_l2tp_ipv6()167{168 #169 # configure l2tpv3 tunnel on host-1170 #171 ip -netns $host_1 l2tp add tunnel tunnel_id 1061 peer_tunnel_id 1062 \172 encap ip local 2001:db8:1::1 remote 2001:db8:2::1173 ip -netns $host_1 l2tp add session name l2tp6 tunnel_id 1061 \174 session_id 1061 peer_session_id 1062175 ip -netns $host_1 link set dev l2tp6 up176 ip -netns $host_1 addr add dev l2tp6 fc00:1::1 peer fc00:1::2177 178 #179 # configure l2tpv3 tunnel on host-2180 #181 ip -netns $host_2 l2tp add tunnel tunnel_id 1062 peer_tunnel_id 1061 \182 encap ip local 2001:db8:2::1 remote 2001:db8:1::1183 ip -netns $host_2 l2tp add session name l2tp6 tunnel_id 1062 \184 session_id 1062 peer_session_id 1061185 ip -netns $host_2 link set dev l2tp6 up186 ip -netns $host_2 addr add dev l2tp6 fc00:1::2 peer fc00:1::1187 188 #189 # add routes to loopback addresses190 #191 ip -netns $host_1 -6 ro add fc00:101::2/128 via fc00:1::2192 ip -netns $host_2 -6 ro add fc00:101::1/128 via fc00:1::1193}194 195setup()196{197 # start clean198 cleanup199 200 set -e201 setup_ns host_1 host_2 router202 create_ns $host_1 172.16.101.1/32 fc00:101::1/128203 create_ns $host_2 172.16.101.2/32 fc00:101::2/128204 create_ns $router205 206 connect_ns $host_1 eth0 10.1.1.1/24 2001:db8:1::1/64 \207 $router eth1 10.1.1.2/24 2001:db8:1::2/64208 209 connect_ns $host_2 eth0 10.1.2.1/24 2001:db8:2::1/64 \210 $router eth2 10.1.2.2/24 2001:db8:2::2/64211 212 ip -netns $host_1 ro add 10.1.2.0/24 via 10.1.1.2213 ip -netns $host_1 -6 ro add 2001:db8:2::/64 via 2001:db8:1::2214 215 ip -netns $host_2 ro add 10.1.1.0/24 via 10.1.2.2216 ip -netns $host_2 -6 ro add 2001:db8:1::/64 via 2001:db8:2::2217 218 setup_l2tp_ipv4219 setup_l2tp_ipv6220 set +e221}222 223setup_ipsec()224{225 #226 # IPv4227 #228 run_cmd $host_1 ip xfrm policy add \229 src 10.1.1.1 dst 10.1.2.1 dir out \230 tmpl proto esp mode transport231 232 run_cmd $host_1 ip xfrm policy add \233 src 10.1.2.1 dst 10.1.1.1 dir in \234 tmpl proto esp mode transport235 236 run_cmd $host_2 ip xfrm policy add \237 src 10.1.1.1 dst 10.1.2.1 dir in \238 tmpl proto esp mode transport239 240 run_cmd $host_2 ip xfrm policy add \241 src 10.1.2.1 dst 10.1.1.1 dir out \242 tmpl proto esp mode transport243 244 ip -netns $host_1 xfrm state add \245 src 10.1.1.1 dst 10.1.2.1 \246 spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \247 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport248 249 ip -netns $host_1 xfrm state add \250 src 10.1.2.1 dst 10.1.1.1 \251 spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \252 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport253 254 ip -netns $host_2 xfrm state add \255 src 10.1.1.1 dst 10.1.2.1 \256 spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \257 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport258 259 ip -netns $host_2 xfrm state add \260 src 10.1.2.1 dst 10.1.1.1 \261 spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \262 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport263 264 #265 # IPV6266 #267 run_cmd $host_1 ip -6 xfrm policy add \268 src 2001:db8:1::1 dst 2001:db8:2::1 dir out \269 tmpl proto esp mode transport270 271 run_cmd $host_1 ip -6 xfrm policy add \272 src 2001:db8:2::1 dst 2001:db8:1::1 dir in \273 tmpl proto esp mode transport274 275 run_cmd $host_2 ip -6 xfrm policy add \276 src 2001:db8:1::1 dst 2001:db8:2::1 dir in \277 tmpl proto esp mode transport278 279 run_cmd $host_2 ip -6 xfrm policy add \280 src 2001:db8:2::1 dst 2001:db8:1::1 dir out \281 tmpl proto esp mode transport282 283 ip -netns $host_1 -6 xfrm state add \284 src 2001:db8:1::1 dst 2001:db8:2::1 \285 spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \286 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport287 288 ip -netns $host_1 -6 xfrm state add \289 src 2001:db8:2::1 dst 2001:db8:1::1 \290 spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \291 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport292 293 ip -netns $host_2 -6 xfrm state add \294 src 2001:db8:1::1 dst 2001:db8:2::1 \295 spi 0x1000 proto esp aead 'rfc4106(gcm(aes))' \296 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport297 298 ip -netns $host_2 -6 xfrm state add \299 src 2001:db8:2::1 dst 2001:db8:1::1 \300 spi 0x1001 proto esp aead 'rfc4106(gcm(aes))' \301 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode transport302}303 304teardown_ipsec()305{306 run_cmd $host_1 ip xfrm state flush307 run_cmd $host_1 ip xfrm policy flush308 run_cmd $host_2 ip xfrm state flush309 run_cmd $host_2 ip xfrm policy flush310}311 312################################################################################313# generate traffic through tunnel for various cases314 315run_ping()316{317 local desc="$1"318 319 run_cmd $host_1 ping -c1 -w1 172.16.1.2320 log_test $? 0 "IPv4 basic L2TP tunnel ${desc}"321 322 run_cmd $host_1 ping -c1 -w1 -I 172.16.101.1 172.16.101.2323 log_test $? 0 "IPv4 route through L2TP tunnel ${desc}"324 325 run_cmd $host_1 ${ping6} -c1 -w1 fc00:1::2326 log_test $? 0 "IPv6 basic L2TP tunnel ${desc}"327 328 run_cmd $host_1 ${ping6} -c1 -w1 -I fc00:101::1 fc00:101::2329 log_test $? 0 "IPv6 route through L2TP tunnel ${desc}"330}331 332run_tests()333{334 local desc335 336 setup337 run_ping338 339 setup_ipsec340 run_ping "- with IPsec"341 run_cmd $host_1 ping -c1 -w1 172.16.1.2342 log_test $? 0 "IPv4 basic L2TP tunnel ${desc}"343 344 run_cmd $host_1 ping -c1 -w1 -I 172.16.101.1 172.16.101.2345 log_test $? 0 "IPv4 route through L2TP tunnel ${desc}"346 347 run_cmd $host_1 ${ping6} -c1 -w1 fc00:1::2348 log_test $? 0 "IPv6 basic L2TP tunnel - with IPsec"349 350 run_cmd $host_1 ${ping6} -c1 -w1 -I fc00:101::1 fc00:101::2351 log_test $? 0 "IPv6 route through L2TP tunnel - with IPsec"352 353 teardown_ipsec354 run_ping "- after IPsec teardown"355}356 357################################################################################358# main359 360declare -i nfail=0361declare -i nsuccess=0362 363while getopts :pv o364do365 case $o in366 p) PAUSE_ON_FAIL=yes;;367 v) VERBOSE=$(($VERBOSE + 1));;368 *) exit 1;;369 esac370done371 372run_tests373cleanup374 375printf "\nTests passed: %3d\n" ${nsuccess}376printf "Tests failed: %3d\n" ${nfail}377