1#!/bin/bash
  2# SPDX-License-Identifier: GPL-2.0
  3
  4[[ -z $TC ]] && TC='tc'
  5[[ -z $IP ]] && IP='ip'
  6
  7REDIRECT_USER='./tc_l2_redirect'
  8REDIRECT_BPF='./tc_l2_redirect_kern.o'
  9
 10RP_FILTER=$(< /proc/sys/net/ipv4/conf/all/rp_filter)
 11IPV6_DISABLED=$(< /proc/sys/net/ipv6/conf/all/disable_ipv6)
 12IPV6_FORWARDING=$(< /proc/sys/net/ipv6/conf/all/forwarding)
 13
 14function config_common {
 15	local tun_type=$1
 16
 17	$IP netns add ns1
 18	$IP netns add ns2
 19	$IP link add ve1 type veth peer name vens1
 20	$IP link add ve2 type veth peer name vens2
 21	$IP link set dev ve1 up
 22	$IP link set dev ve2 up
 23	$IP link set dev ve1 mtu 1500
 24	$IP link set dev ve2 mtu 1500
 25	$IP link set dev vens1 netns ns1
 26	$IP link set dev vens2 netns ns2
 27
 28	$IP -n ns1 link set dev lo up
 29	$IP -n ns1 link set dev vens1 up
 30	$IP -n ns1 addr add 10.1.1.101/24 dev vens1
 31	$IP -n ns1 addr add 2401:db01::65/64 dev vens1 nodad
 32	$IP -n ns1 route add default via 10.1.1.1 dev vens1
 33	$IP -n ns1 route add default via 2401:db01::1 dev vens1
 34
 35	$IP -n ns2 link set dev lo up
 36	$IP -n ns2 link set dev vens2 up
 37	$IP -n ns2 addr add 10.2.1.102/24 dev vens2
 38	$IP -n ns2 addr add 2401:db02::66/64 dev vens2 nodad
 39	$IP -n ns2 addr add 10.10.1.102 dev lo
 40	$IP -n ns2 addr add 2401:face::66/64 dev lo nodad
 41	$IP -n ns2 link add ipt2 type ipip local 10.2.1.102 remote 10.2.1.1
 42	$IP -n ns2 link add ip6t2 type ip6tnl mode any local 2401:db02::66 remote 2401:db02::1
 43	$IP -n ns2 link set dev ipt2 up
 44	$IP -n ns2 link set dev ip6t2 up
 45	$IP netns exec ns2 $TC qdisc add dev vens2 clsact
 46	$IP netns exec ns2 $TC filter add dev vens2 ingress bpf da obj $REDIRECT_BPF sec drop_non_tun_vip
 47	if [[ $tun_type == "ipip" ]]; then
 48		$IP -n ns2 route add 10.1.1.0/24 dev ipt2
 49		$IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
 50		$IP netns exec ns2 sysctl -q -w net.ipv4.conf.ipt2.rp_filter=0
 51	else
 52		$IP -n ns2 route add 10.1.1.0/24 dev ip6t2
 53		$IP -n ns2 route add 2401:db01::/64 dev ip6t2
 54		$IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
 55		$IP netns exec ns2 sysctl -q -w net.ipv4.conf.ip6t2.rp_filter=0
 56	fi
 57
 58	$IP addr add 10.1.1.1/24 dev ve1
 59	$IP addr add 2401:db01::1/64 dev ve1 nodad
 60	$IP addr add 10.2.1.1/24 dev ve2
 61	$IP addr add 2401:db02::1/64 dev ve2 nodad
 62
 63	$TC qdisc add dev ve2 clsact
 64	$TC filter add dev ve2 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_forward
 65
 66	sysctl -q -w net.ipv4.conf.all.rp_filter=0
 67	sysctl -q -w net.ipv6.conf.all.forwarding=1
 68	sysctl -q -w net.ipv6.conf.all.disable_ipv6=0
 69}
 70
 71function cleanup {
 72	set +e
 73	[[ -z $DEBUG ]] || set +x
 74	$IP netns delete ns1 >& /dev/null
 75	$IP netns delete ns2 >& /dev/null
 76	$IP link del ve1 >& /dev/null
 77	$IP link del ve2 >& /dev/null
 78	$IP link del ipt >& /dev/null
 79	$IP link del ip6t >& /dev/null
 80	sysctl -q -w net.ipv4.conf.all.rp_filter=$RP_FILTER
 81	sysctl -q -w net.ipv6.conf.all.forwarding=$IPV6_FORWARDING
 82	sysctl -q -w net.ipv6.conf.all.disable_ipv6=$IPV6_DISABLED
 83	rm -f /sys/fs/bpf/tc/globals/tun_iface
 84	[[ -z $DEBUG ]] || set -x
 85	set -e
 86}
 87
 88function l2_to_ipip {
 89	echo -n "l2_to_ipip $1: "
 90
 91	local dir=$1
 92
 93	config_common ipip
 94
 95	$IP link add ipt type ipip external
 96	$IP link set dev ipt up
 97	sysctl -q -w net.ipv4.conf.ipt.rp_filter=0
 98	sysctl -q -w net.ipv4.conf.ipt.forwarding=1
 99
100	if [[ $dir == "egress" ]]; then
101		$IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
102		$TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
103		sysctl -q -w net.ipv4.conf.ve1.forwarding=1
104	else
105		$TC qdisc add dev ve1 clsact
106		$TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
107	fi
108
109	$REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ipt/ifindex)
110
111	$IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
112
113	if [[ $dir == "egress" ]]; then
114		# test direct egress to ve2 (i.e. not forwarding from
115		# ve1 to ve2).
116		ping -c1 10.10.1.102 >& /dev/null
117	fi
118
119	cleanup
120
121	echo "OK"
122}
123
124function l2_to_ip6tnl {
125	echo -n "l2_to_ip6tnl $1: "
126
127	local dir=$1
128
129	config_common ip6tnl
130
131	$IP link add ip6t type ip6tnl mode any external
132	$IP link set dev ip6t up
133	sysctl -q -w net.ipv4.conf.ip6t.rp_filter=0
134	sysctl -q -w net.ipv4.conf.ip6t.forwarding=1
135
136	if [[ $dir == "egress" ]]; then
137		$IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
138		$IP route add 2401:face::/64 via 2401:db02::66 dev ve2
139		$TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
140		sysctl -q -w net.ipv4.conf.ve1.forwarding=1
141	else
142		$TC qdisc add dev ve1 clsact
143		$TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
144	fi
145
146	$REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ip6t/ifindex)
147
148	$IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
149	$IP netns exec ns1 ping -6 -c1 2401:face::66 >& /dev/null
150
151	if [[ $dir == "egress" ]]; then
152		# test direct egress to ve2 (i.e. not forwarding from
153		# ve1 to ve2).
154		ping -c1 10.10.1.102 >& /dev/null
155		ping -6 -c1 2401:face::66 >& /dev/null
156	fi
157
158	cleanup
159
160	echo "OK"
161}
162
163cleanup
164test_names="l2_to_ipip l2_to_ip6tnl"
165test_dirs="ingress egress"
166if [[ $# -ge 2 ]]; then
167	test_names=$1
168	test_dirs=$2
169elif [[ $# -ge 1 ]]; then
170	test_names=$1
171fi
172
173for t in $test_names; do
174	for d in $test_dirs; do
175		$t $d
176	done
177done