708 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03#4# Copyright (c) 2019 David Ahern <dsahern@gmail.com>. All rights reserved.5# Copyright (c) 2020 Michael Jeanson <mjeanson@efficios.com>. All rights reserved.6#7# Requires CONFIG_NET_VRF, CONFIG_VETH, CONFIG_BRIDGE and CONFIG_NET_NS.8#9#10# Symmetric routing topology11#12# blue red13# +----+ .253 +----+ .253 +----+14# | h1 |-------------------| r1 |-------------------| h2 |15# +----+ .1 +----+ .2 +----+16# 172.16.1/24 172.16.2/2417# 2001:db8:16:1/64 2001:db8:16:2/6418#19#20# Route from h1 to h2 and back goes through r1, incoming vrf blue has a route21# to the outgoing vrf red for the n2 network and red has a route back to n1.22# The red VRF interface has a MTU of 1400.23#24# The first test sends a ping with a ttl of 1 from h1 to h2 and parses the25# output of the command to check that a ttl expired error is received.26#27# The second test runs traceroute from h1 to h2 and parses the output to check28# for a hop on r1.29#30# The third test sends a ping with a packet size of 1450 from h1 to h2 and31# parses the output of the command to check that a fragmentation error is32# received.33#34#35# Asymmetric routing topology36#37# This topology represents a customer setup where the issue with icmp errors38# and VRF route leaking was initialy reported. The MTU test isn't done here39# because of the lack of a return route in the red VRF.40#41# blue red42# .253 +----+ .25343# +----| r1 |----+44# | +----+ |45# +----+ | | +----+46# | h1 |--------------+ +--------------| h2 |47# +----+ .1 | | .2 +----+48# 172.16.1/24 | +----+ | 172.16.2/2449# 2001:db8:16:1/64 +----| r2 |----+ 2001:db8:16:2/6450# .254 +----+ .25451#52#53# Route from h1 to h2 goes through r1, incoming vrf blue has a route to the54# outgoing vrf red for the n2 network but red doesn't have a route back to n1.55# Route from h2 to h1 goes through r2.56#57# The objective is to check that the incoming vrf routing table is selected58# to send an ICMP error back to the source when the ttl of a packet reaches 159# while it is forwarded between different vrfs.60 61source lib.sh62VERBOSE=063PAUSE_ON_FAIL=no64DEFAULT_TTYPE=sym65 66H1_N1=172.16.1.0/2467H1_N1_6=2001:db8:16:1::/6468 69H1_N1_IP=172.16.1.170R1_N1_IP=172.16.1.25371R2_N1_IP=172.16.1.25472 73H1_N1_IP6=2001:db8:16:1::174R1_N1_IP6=2001:db8:16:1::25375R2_N1_IP6=2001:db8:16:1::25476 77H2_N2=172.16.2.0/2478H2_N2_6=2001:db8:16:2::/6479 80H2_N2_IP=172.16.2.281R1_N2_IP=172.16.2.25382R2_N2_IP=172.16.2.25483 84H2_N2_IP6=2001:db8:16:2::285R1_N2_IP6=2001:db8:16:2::25386R2_N2_IP6=2001:db8:16:2::25487 88################################################################################89# helpers90 91log_section()92{93 echo94 echo "###########################################################################"95 echo "$*"96 echo "###########################################################################"97 echo98}99 100log_test()101{102 local rc=$1103 local expected=$2104 local msg="$3"105 106 if [ "${rc}" -eq "${expected}" ]; then107 printf "TEST: %-60s [ OK ]\n" "${msg}"108 nsuccess=$((nsuccess+1))109 else110 ret=1111 nfail=$((nfail+1))112 printf "TEST: %-60s [FAIL]\n" "${msg}"113 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then114 echo115 echo "hit enter to continue, 'q' to quit"116 read -r a117 [ "$a" = "q" ] && exit 1118 fi119 fi120}121 122run_cmd()123{124 local cmd="$*"125 local out126 local rc127 128 if [ "$VERBOSE" = "1" ]; then129 echo "COMMAND: $cmd"130 fi131 132 # shellcheck disable=SC2086133 out=$(eval $cmd 2>&1)134 rc=$?135 if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then136 echo "$out"137 fi138 139 [ "$VERBOSE" = "1" ] && echo140 141 return $rc142}143 144run_cmd_grep()145{146 local grep_pattern="$1"147 shift148 local cmd="$*"149 local out150 local rc151 152 if [ "$VERBOSE" = "1" ]; then153 echo "COMMAND: $cmd"154 fi155 156 # shellcheck disable=SC2086157 out=$(eval $cmd 2>&1)158 if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then159 echo "$out"160 fi161 162 echo "$out" | grep -q "$grep_pattern"163 rc=$?164 165 [ "$VERBOSE" = "1" ] && echo166 167 return $rc168}169 170################################################################################171# setup and teardown172 173cleanup()174{175 cleanup_ns $h1 $h2 $r1 $r2176}177 178setup_vrf()179{180 local ns=$1181 182 ip -netns "${ns}" rule del pref 0183 ip -netns "${ns}" rule add pref 32765 from all lookup local184 ip -netns "${ns}" -6 rule del pref 0185 ip -netns "${ns}" -6 rule add pref 32765 from all lookup local186}187 188create_vrf()189{190 local ns=$1191 local vrf=$2192 local table=$3193 194 ip -netns "${ns}" link add "${vrf}" type vrf table "${table}"195 ip -netns "${ns}" link set "${vrf}" up196 ip -netns "${ns}" route add vrf "${vrf}" unreachable default metric 8192197 ip -netns "${ns}" -6 route add vrf "${vrf}" unreachable default metric 8192198 199 ip -netns "${ns}" addr add 127.0.0.1/8 dev "${vrf}"200 ip -netns "${ns}" -6 addr add ::1 dev "${vrf}" nodad201}202 203setup_sym()204{205 local ns206 207 # make sure we are starting with a clean slate208 cleanup209 210 #211 # create nodes as namespaces212 setup_ns h1 h2 r1213 for ns in $h1 $h2 $r1; do214 if echo $ns | grep -q h[12]-; then215 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0216 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1217 else218 ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1219 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1220 fi221 done222 223 #224 # create interconnects225 #226 ip -netns $h1 link add eth0 type veth peer name r1h1227 ip -netns $h1 link set r1h1 netns $r1 name eth0 up228 229 ip -netns $h2 link add eth0 type veth peer name r1h2230 ip -netns $h2 link set r1h2 netns $r1 name eth1 up231 232 #233 # h1234 #235 ip -netns $h1 addr add dev eth0 ${H1_N1_IP}/24236 ip -netns $h1 -6 addr add dev eth0 ${H1_N1_IP6}/64 nodad237 ip -netns $h1 link set eth0 up238 239 # h1 to h2 via r1240 ip -netns $h1 route add ${H2_N2} via ${R1_N1_IP} dev eth0241 ip -netns $h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev eth0242 243 #244 # h2245 #246 ip -netns $h2 addr add dev eth0 ${H2_N2_IP}/24247 ip -netns $h2 -6 addr add dev eth0 ${H2_N2_IP6}/64 nodad248 ip -netns $h2 link set eth0 up249 250 # h2 to h1 via r1251 ip -netns $h2 route add default via ${R1_N2_IP} dev eth0252 ip -netns $h2 -6 route add default via ${R1_N2_IP6} dev eth0253 254 #255 # r1256 #257 setup_vrf $r1258 create_vrf $r1 blue 1101259 create_vrf $r1 red 1102260 ip -netns $r1 link set mtu 1400 dev eth1261 ip -netns $r1 link set eth0 vrf blue up262 ip -netns $r1 link set eth1 vrf red up263 ip -netns $r1 addr add dev eth0 ${R1_N1_IP}/24264 ip -netns $r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad265 ip -netns $r1 addr add dev eth1 ${R1_N2_IP}/24266 ip -netns $r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad267 268 # Route leak from blue to red269 ip -netns $r1 route add vrf blue ${H2_N2} dev red270 ip -netns $r1 -6 route add vrf blue ${H2_N2_6} dev red271 272 # Route leak from red to blue273 ip -netns $r1 route add vrf red ${H1_N1} dev blue274 ip -netns $r1 -6 route add vrf red ${H1_N1_6} dev blue275 276 277 # Wait for ip config to settle278 sleep 2279}280 281setup_asym()282{283 local ns284 285 # make sure we are starting with a clean slate286 cleanup287 288 #289 # create nodes as namespaces290 setup_ns h1 h2 r1 r2291 for ns in $h1 $h2 $r1 $r2; do292 if echo $ns | grep -q h[12]-; then293 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0294 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1295 else296 ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1297 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1298 fi299 done300 301 #302 # create interconnects303 #304 ip -netns $h1 link add eth0 type veth peer name r1h1305 ip -netns $h1 link set r1h1 netns $r1 name eth0 up306 307 ip -netns $h1 link add eth1 type veth peer name r2h1308 ip -netns $h1 link set r2h1 netns $r2 name eth0 up309 310 ip -netns $h2 link add eth0 type veth peer name r1h2311 ip -netns $h2 link set r1h2 netns $r1 name eth1 up312 313 ip -netns $h2 link add eth1 type veth peer name r2h2314 ip -netns $h2 link set r2h2 netns $r2 name eth1 up315 316 #317 # h1318 #319 ip -netns $h1 link add br0 type bridge320 ip -netns $h1 link set br0 up321 ip -netns $h1 addr add dev br0 ${H1_N1_IP}/24322 ip -netns $h1 -6 addr add dev br0 ${H1_N1_IP6}/64 nodad323 ip -netns $h1 link set eth0 master br0 up324 ip -netns $h1 link set eth1 master br0 up325 326 # h1 to h2 via r1327 ip -netns $h1 route add ${H2_N2} via ${R1_N1_IP} dev br0328 ip -netns $h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev br0329 330 #331 # h2332 #333 ip -netns $h2 link add br0 type bridge334 ip -netns $h2 link set br0 up335 ip -netns $h2 addr add dev br0 ${H2_N2_IP}/24336 ip -netns $h2 -6 addr add dev br0 ${H2_N2_IP6}/64 nodad337 ip -netns $h2 link set eth0 master br0 up338 ip -netns $h2 link set eth1 master br0 up339 340 # h2 to h1 via r2341 ip -netns $h2 route add default via ${R2_N2_IP} dev br0342 ip -netns $h2 -6 route add default via ${R2_N2_IP6} dev br0343 344 #345 # r1346 #347 setup_vrf $r1348 create_vrf $r1 blue 1101349 create_vrf $r1 red 1102350 ip -netns $r1 link set mtu 1400 dev eth1351 ip -netns $r1 link set eth0 vrf blue up352 ip -netns $r1 link set eth1 vrf red up353 ip -netns $r1 addr add dev eth0 ${R1_N1_IP}/24354 ip -netns $r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad355 ip -netns $r1 addr add dev eth1 ${R1_N2_IP}/24356 ip -netns $r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad357 358 # Route leak from blue to red359 ip -netns $r1 route add vrf blue ${H2_N2} dev red360 ip -netns $r1 -6 route add vrf blue ${H2_N2_6} dev red361 362 # No route leak from red to blue363 364 #365 # r2366 #367 ip -netns $r2 addr add dev eth0 ${R2_N1_IP}/24368 ip -netns $r2 -6 addr add dev eth0 ${R2_N1_IP6}/64 nodad369 ip -netns $r2 addr add dev eth1 ${R2_N2_IP}/24370 ip -netns $r2 -6 addr add dev eth1 ${R2_N2_IP6}/64 nodad371 372 # Wait for ip config to settle373 sleep 2374}375 376check_connectivity()377{378 ip netns exec $h1 ping -c1 -w1 ${H2_N2_IP} >/dev/null 2>&1379 log_test $? 0 "Basic IPv4 connectivity"380 return $?381}382 383check_connectivity6()384{385 ip netns exec $h1 "${ping6}" -c1 -w1 ${H2_N2_IP6} >/dev/null 2>&1386 log_test $? 0 "Basic IPv6 connectivity"387 return $?388}389 390check_traceroute()391{392 if [ ! -x "$(command -v traceroute)" ]; then393 echo "SKIP: Could not run IPV4 test without traceroute"394 return 1395 fi396}397 398check_traceroute6()399{400 if [ ! -x "$(command -v traceroute6)" ]; then401 echo "SKIP: Could not run IPV6 test without traceroute6"402 return 1403 fi404}405 406ipv4_traceroute()407{408 local ttype="$1"409 410 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"411 412 log_section "IPv4 ($ttype route): VRF ICMP error route lookup traceroute"413 414 check_traceroute || return415 416 setup_"$ttype"417 418 check_connectivity || return419 420 run_cmd_grep "${R1_N1_IP}" ip netns exec $h1 traceroute ${H2_N2_IP}421 log_test $? 0 "Traceroute reports a hop on r1"422}423 424ipv4_traceroute_asym()425{426 ipv4_traceroute asym427}428 429ipv6_traceroute()430{431 local ttype="$1"432 433 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"434 435 log_section "IPv6 ($ttype route): VRF ICMP error route lookup traceroute"436 437 check_traceroute6 || return438 439 setup_"$ttype"440 441 check_connectivity6 || return442 443 run_cmd_grep "${R1_N1_IP6}" ip netns exec $h1 traceroute6 ${H2_N2_IP6}444 log_test $? 0 "Traceroute6 reports a hop on r1"445}446 447ipv6_traceroute_asym()448{449 ipv6_traceroute asym450}451 452ipv4_ping_ttl()453{454 local ttype="$1"455 456 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"457 458 log_section "IPv4 ($ttype route): VRF ICMP ttl error route lookup ping"459 460 setup_"$ttype"461 462 check_connectivity || return463 464 run_cmd_grep "Time to live exceeded" ip netns exec $h1 ping -t1 -c1 -W2 ${H2_N2_IP}465 log_test $? 0 "Ping received ICMP ttl exceeded"466}467 468ipv4_ping_ttl_asym()469{470 ipv4_ping_ttl asym471}472 473ipv4_ping_frag()474{475 local ttype="$1"476 477 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"478 479 log_section "IPv4 ($ttype route): VRF ICMP fragmentation error route lookup ping"480 481 setup_"$ttype"482 483 check_connectivity || return484 485 run_cmd_grep "Frag needed" ip netns exec $h1 ping -s 1450 -Mdo -c1 -W2 ${H2_N2_IP}486 log_test $? 0 "Ping received ICMP Frag needed"487}488 489ipv4_ping_frag_asym()490{491 ipv4_ping_frag asym492}493 494ipv6_ping_ttl()495{496 local ttype="$1"497 498 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"499 500 log_section "IPv6 ($ttype route): VRF ICMP ttl error route lookup ping"501 502 setup_"$ttype"503 504 check_connectivity6 || return505 506 run_cmd_grep "Time exceeded: Hop limit" ip netns exec $h1 "${ping6}" -t1 -c1 -W2 ${H2_N2_IP6}507 log_test $? 0 "Ping received ICMP Hop limit"508}509 510ipv6_ping_ttl_asym()511{512 ipv6_ping_ttl asym513}514 515ipv6_ping_frag()516{517 local ttype="$1"518 519 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"520 521 log_section "IPv6 ($ttype route): VRF ICMP fragmentation error route lookup ping"522 523 setup_"$ttype"524 525 check_connectivity6 || return526 527 run_cmd_grep "Packet too big" ip netns exec $h1 "${ping6}" -s 1450 -Mdo -c1 -W2 ${H2_N2_IP6}528 log_test $? 0 "Ping received ICMP Packet too big"529}530 531ipv6_ping_frag_asym()532{533 ipv6_ping_frag asym534}535 536ipv4_ping_local()537{538 log_section "IPv4 (sym route): VRF ICMP local error route lookup ping"539 540 setup_sym541 542 check_connectivity || return543 544 run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP}545 log_test $? 0 "VRF ICMP local IPv4"546}547 548ipv4_tcp_local()549{550 log_section "IPv4 (sym route): VRF tcp local connection"551 552 setup_sym553 554 check_connectivity || return555 556 run_cmd nettest -s -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 &557 sleep 1558 run_cmd nettest -N "$r1" -d blue -r ${H2_N2_IP}559 log_test $? 0 "VRF tcp local connection IPv4"560}561 562ipv4_udp_local()563{564 log_section "IPv4 (sym route): VRF udp local connection"565 566 setup_sym567 568 check_connectivity || return569 570 run_cmd nettest -s -D -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 &571 sleep 1572 run_cmd nettest -D -N "$r1" -d blue -r ${H2_N2_IP}573 log_test $? 0 "VRF udp local connection IPv4"574}575 576ipv6_ping_local()577{578 log_section "IPv6 (sym route): VRF ICMP local error route lookup ping"579 580 setup_sym581 582 check_connectivity6 || return583 584 run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6}585 log_test $? 0 "VRF ICMP local IPv6"586}587 588ipv6_tcp_local()589{590 log_section "IPv6 (sym route): VRF tcp local connection"591 592 setup_sym593 594 check_connectivity6 || return595 596 run_cmd nettest -s -6 -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 &597 sleep 1598 run_cmd nettest -6 -N "$r1" -d blue -r ${H2_N2_IP6}599 log_test $? 0 "VRF tcp local connection IPv6"600}601 602ipv6_udp_local()603{604 log_section "IPv6 (sym route): VRF udp local connection"605 606 setup_sym607 608 check_connectivity6 || return609 610 run_cmd nettest -s -6 -D -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 &611 sleep 1612 run_cmd nettest -6 -D -N "$r1" -d blue -r ${H2_N2_IP6}613 log_test $? 0 "VRF udp local connection IPv6"614}615 616################################################################################617# usage618 619usage()620{621 cat <<EOF622usage: ${0##*/} OPTS623 624 -4 Run IPv4 tests only625 -6 Run IPv6 tests only626 -t TEST Run only TEST627 -p Pause on fail628 -v verbose mode (show commands and output)629EOF630}631 632################################################################################633# main634 635# Some systems don't have a ping6 binary anymore636command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping)637 638check_gen_prog "nettest"639 640TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_local ipv4_tcp_local641ipv4_udp_local ipv4_ping_ttl_asym ipv4_traceroute_asym"642TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_local ipv6_tcp_local ipv6_udp_local643ipv6_ping_ttl_asym ipv6_traceroute_asym"644 645ret=0646nsuccess=0647nfail=0648 649while getopts :46t:pvh o650do651 case $o in652 4) TESTS=ipv4;;653 6) TESTS=ipv6;;654 t) TESTS=$OPTARG;;655 p) PAUSE_ON_FAIL=yes;;656 v) VERBOSE=1;;657 h) usage; exit 0;;658 *) usage; exit 1;;659 esac660done661 662#663# show user test config664#665if [ -z "$TESTS" ]; then666 TESTS="$TESTS_IPV4 $TESTS_IPV6"667elif [ "$TESTS" = "ipv4" ]; then668 TESTS="$TESTS_IPV4"669elif [ "$TESTS" = "ipv6" ]; then670 TESTS="$TESTS_IPV6"671fi672 673for t in $TESTS674do675 case $t in676 ipv4_ping_ttl|ping) ipv4_ping_ttl;;&677 ipv4_ping_ttl_asym|ping) ipv4_ping_ttl_asym;;&678 ipv4_traceroute|traceroute) ipv4_traceroute;;&679 ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;&680 ipv4_ping_frag|ping) ipv4_ping_frag;;&681 ipv4_ping_local|ping) ipv4_ping_local;;&682 ipv4_tcp_local) ipv4_tcp_local;;&683 ipv4_udp_local) ipv4_udp_local;;&684 685 ipv6_ping_ttl|ping) ipv6_ping_ttl;;&686 ipv6_ping_ttl_asym|ping) ipv6_ping_ttl_asym;;&687 ipv6_traceroute|traceroute) ipv6_traceroute;;&688 ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;&689 ipv6_ping_frag|ping) ipv6_ping_frag;;&690 ipv6_ping_local|ping) ipv6_ping_local;;&691 ipv6_tcp_local) ipv6_tcp_local;;&692 ipv6_udp_local) ipv6_udp_local;;&693 694 # setup namespaces and config, but do not run any tests695 setup_sym|setup) setup_sym; exit 0;;696 setup_asym) setup_asym; exit 0;;697 698 help) echo "Test names: $TESTS"; exit 0;;699 esac700done701 702cleanup703 704printf "\nTests passed: %3d\n" ${nsuccess}705printf "Tests failed: %3d\n" ${nfail}706 707exit $ret708