Loading...
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# In-place tunneling
5
6BPF_FILE="test_tc_tunnel.bpf.o"
7# must match the port that the bpf program filters on
8readonly port=8000
9
10readonly ns_prefix="ns-$$-"
11readonly ns1="${ns_prefix}1"
12readonly ns2="${ns_prefix}2"
13
14readonly ns1_v4=192.168.1.1
15readonly ns2_v4=192.168.1.2
16readonly ns1_v6=fd::1
17readonly ns2_v6=fd::2
18
19# Must match port used by bpf program
20readonly udpport=5555
21# MPLSoverUDP
22readonly mplsudpport=6635
23readonly mplsproto=137
24
25readonly infile="$(mktemp)"
26readonly outfile="$(mktemp)"
27
28setup() {
29 ip netns add "${ns1}"
30 ip netns add "${ns2}"
31
32 ip link add dev veth1 mtu 1500 netns "${ns1}" type veth \
33 peer name veth2 mtu 1500 netns "${ns2}"
34
35 ip netns exec "${ns1}" ethtool -K veth1 tso off
36
37 ip -netns "${ns1}" link set veth1 up
38 ip -netns "${ns2}" link set veth2 up
39
40 ip -netns "${ns1}" -4 addr add "${ns1_v4}/24" dev veth1
41 ip -netns "${ns2}" -4 addr add "${ns2_v4}/24" dev veth2
42 ip -netns "${ns1}" -6 addr add "${ns1_v6}/64" dev veth1 nodad
43 ip -netns "${ns2}" -6 addr add "${ns2_v6}/64" dev veth2 nodad
44
45 # clamp route to reserve room for tunnel headers
46 ip -netns "${ns1}" -4 route flush table main
47 ip -netns "${ns1}" -6 route flush table main
48 ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1450 dev veth1
49 ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1430 dev veth1
50
51 sleep 1
52
53 dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none
54}
55
56cleanup() {
57 ip netns del "${ns2}"
58 ip netns del "${ns1}"
59
60 if [[ -f "${outfile}" ]]; then
61 rm "${outfile}"
62 fi
63 if [[ -f "${infile}" ]]; then
64 rm "${infile}"
65 fi
66
67 if [[ -n $server_pid ]]; then
68 kill $server_pid 2> /dev/null
69 fi
70}
71
72server_listen() {
73 ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" &
74 server_pid=$!
75}
76
77client_connect() {
78 ip netns exec "${ns1}" timeout 2 nc "${netcat_opt}" -w 1 "${addr2}" "${port}" < "${infile}"
79 echo $?
80}
81
82verify_data() {
83 wait "${server_pid}"
84 server_pid=
85 # sha1sum returns two fields [sha1] [filepath]
86 # convert to bash array and access first elem
87 insum=($(sha1sum ${infile}))
88 outsum=($(sha1sum ${outfile}))
89 if [[ "${insum[0]}" != "${outsum[0]}" ]]; then
90 echo "data mismatch"
91 exit 1
92 fi
93}
94
95wait_for_port() {
96 for i in $(seq 20); do
97 if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then
98 return 0
99 fi
100 sleep 0.1
101 done
102 return 1
103}
104
105set -e
106
107# no arguments: automated test, run all
108if [[ "$#" -eq "0" ]]; then
109 echo "ipip"
110 $0 ipv4 ipip none 100
111
112 echo "ipip6"
113 $0 ipv4 ipip6 none 100
114
115 echo "ip6ip6"
116 $0 ipv6 ip6tnl none 100
117
118 echo "sit"
119 $0 ipv6 sit none 100
120
121 echo "ip4 vxlan"
122 $0 ipv4 vxlan eth 2000
123
124 echo "ip6 vxlan"
125 $0 ipv6 ip6vxlan eth 2000
126
127 for mac in none mpls eth ; do
128 echo "ip gre $mac"
129 $0 ipv4 gre $mac 100
130
131 echo "ip6 gre $mac"
132 $0 ipv6 ip6gre $mac 100
133
134 echo "ip gre $mac gso"
135 $0 ipv4 gre $mac 2000
136
137 echo "ip6 gre $mac gso"
138 $0 ipv6 ip6gre $mac 2000
139
140 echo "ip udp $mac"
141 $0 ipv4 udp $mac 100
142
143 echo "ip6 udp $mac"
144 $0 ipv6 ip6udp $mac 100
145
146 echo "ip udp $mac gso"
147 $0 ipv4 udp $mac 2000
148
149 echo "ip6 udp $mac gso"
150 $0 ipv6 ip6udp $mac 2000
151 done
152
153 echo "OK. All tests passed"
154 exit 0
155fi
156
157if [[ "$#" -ne "4" ]]; then
158 echo "Usage: $0"
159 echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls|eth> <data_len>"
160 exit 1
161fi
162
163case "$1" in
164"ipv4")
165 readonly addr1="${ns1_v4}"
166 readonly addr2="${ns2_v4}"
167 readonly ipproto=4
168 readonly netcat_opt=-${ipproto}
169 readonly foumod=fou
170 readonly foutype=ipip
171 readonly fouproto=4
172 readonly fouproto_mpls=${mplsproto}
173 readonly gretaptype=gretap
174 ;;
175"ipv6")
176 readonly addr1="${ns1_v6}"
177 readonly addr2="${ns2_v6}"
178 readonly ipproto=6
179 readonly netcat_opt=-${ipproto}
180 readonly foumod=fou6
181 readonly foutype=ip6tnl
182 readonly fouproto="41 -6"
183 readonly fouproto_mpls="${mplsproto} -6"
184 readonly gretaptype=ip6gretap
185 ;;
186*)
187 echo "unknown arg: $1"
188 exit 1
189 ;;
190esac
191
192readonly tuntype=$2
193readonly mac=$3
194readonly datalen=$4
195
196echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
197
198trap cleanup EXIT
199
200setup
201
202# basic communication works
203echo "test basic connectivity"
204server_listen
205wait_for_port ${port} ${netcat_opt}
206client_connect
207verify_data
208
209# clientside, insert bpf program to encap all TCP to port ${port}
210# client can no longer connect
211ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
212ip netns exec "${ns1}" tc filter add dev veth1 egress \
213 bpf direct-action object-file ${BPF_FILE} \
214 section "encap_${tuntype}_${mac}"
215echo "test bpf encap without decap (expect failure)"
216server_listen
217wait_for_port ${port} ${netcat_opt}
218! client_connect
219
220if [[ "$tuntype" =~ "udp" ]]; then
221 # Set up fou tunnel.
222 ttype="${foutype}"
223 targs="encap fou encap-sport auto encap-dport $udpport"
224 # fou may be a module; allow this to fail.
225 modprobe "${foumod}" ||true
226 if [[ "$mac" == "mpls" ]]; then
227 dport=${mplsudpport}
228 dproto=${fouproto_mpls}
229 tmode="mode any ttl 255"
230 else
231 dport=${udpport}
232 dproto=${fouproto}
233 fi
234 ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
235 targs="encap fou encap-sport auto encap-dport $dport"
236elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
237 ttype=$gretaptype
238elif [[ "$tuntype" =~ "vxlan" && "$mac" == "eth" ]]; then
239 ttype="vxlan"
240 targs="id 1 dstport 8472 udp6zerocsumrx"
241elif [[ "$tuntype" == "ipip6" ]]; then
242 ttype="ip6tnl"
243 targs=""
244else
245 ttype=$tuntype
246 targs=""
247fi
248
249# tunnel address family differs from inner for SIT
250if [[ "${tuntype}" == "sit" ]]; then
251 link_addr1="${ns1_v4}"
252 link_addr2="${ns2_v4}"
253elif [[ "${tuntype}" == "ipip6" ]]; then
254 link_addr1="${ns1_v6}"
255 link_addr2="${ns2_v6}"
256else
257 link_addr1="${addr1}"
258 link_addr2="${addr2}"
259fi
260
261# serverside, insert decap module
262# server is still running
263# client can connect again
264ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
265 ${tmode} remote "${link_addr1}" local "${link_addr2}" $targs
266
267expect_tun_fail=0
268
269if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
270 # No support for MPLS IPv6 fou tunnel; expect failure.
271 expect_tun_fail=1
272elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
273 # No support for TEB fou tunnel; expect failure.
274 expect_tun_fail=1
275elif [[ "$tuntype" =~ (gre|vxlan) && "$mac" == "eth" ]]; then
276 # Share ethernet address between tunnel/veth2 so L2 decap works.
277 ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
278 awk '/ether/ { print $2 }')
279 ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
280elif [[ "$mac" == "mpls" ]]; then
281 modprobe mpls_iptunnel ||true
282 modprobe mpls_gso ||true
283 ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
284 ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
285 ip netns exec "${ns2}" ip link set lo up
286 ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
287 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
288fi
289
290# Because packets are decapped by the tunnel they arrive on testtun0 from
291# the IP stack perspective. Ensure reverse path filtering is disabled
292# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
293# expected veth2 (veth2 is where 192.168.1.2 is configured).
294ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
295# rp needs to be disabled for both all and testtun0 as the rp value is
296# selected as the max of the "all" and device-specific values.
297ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
298ip netns exec "${ns2}" ip link set dev testtun0 up
299if [[ "$expect_tun_fail" == 1 ]]; then
300 # This tunnel mode is not supported, so we expect failure.
301 echo "test bpf encap with tunnel device decap (expect failure)"
302 ! client_connect
303else
304 echo "test bpf encap with tunnel device decap"
305 client_connect
306 verify_data
307 server_listen
308 wait_for_port ${port} ${netcat_opt}
309fi
310
311# serverside, use BPF for decap
312ip netns exec "${ns2}" ip link del dev testtun0
313ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
314ip netns exec "${ns2}" tc filter add dev veth2 ingress \
315 bpf direct-action object-file ${BPF_FILE} section decap
316echo "test bpf encap with bpf decap"
317client_connect
318verify_data
319
320echo OK
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# In-place tunneling
5
6# must match the port that the bpf program filters on
7readonly port=8000
8
9readonly ns_prefix="ns-$$-"
10readonly ns1="${ns_prefix}1"
11readonly ns2="${ns_prefix}2"
12
13readonly ns1_v4=192.168.1.1
14readonly ns2_v4=192.168.1.2
15readonly ns1_v6=fd::1
16readonly ns2_v6=fd::2
17
18# Must match port used by bpf program
19readonly udpport=5555
20# MPLSoverUDP
21readonly mplsudpport=6635
22readonly mplsproto=137
23
24readonly infile="$(mktemp)"
25readonly outfile="$(mktemp)"
26
27setup() {
28 ip netns add "${ns1}"
29 ip netns add "${ns2}"
30
31 ip link add dev veth1 mtu 1500 netns "${ns1}" type veth \
32 peer name veth2 mtu 1500 netns "${ns2}"
33
34 ip netns exec "${ns1}" ethtool -K veth1 tso off
35
36 ip -netns "${ns1}" link set veth1 up
37 ip -netns "${ns2}" link set veth2 up
38
39 ip -netns "${ns1}" -4 addr add "${ns1_v4}/24" dev veth1
40 ip -netns "${ns2}" -4 addr add "${ns2_v4}/24" dev veth2
41 ip -netns "${ns1}" -6 addr add "${ns1_v6}/64" dev veth1 nodad
42 ip -netns "${ns2}" -6 addr add "${ns2_v6}/64" dev veth2 nodad
43
44 # clamp route to reserve room for tunnel headers
45 ip -netns "${ns1}" -4 route flush table main
46 ip -netns "${ns1}" -6 route flush table main
47 ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1458 dev veth1
48 ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1438 dev veth1
49
50 sleep 1
51
52 dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none
53}
54
55cleanup() {
56 ip netns del "${ns2}"
57 ip netns del "${ns1}"
58
59 if [[ -f "${outfile}" ]]; then
60 rm "${outfile}"
61 fi
62 if [[ -f "${infile}" ]]; then
63 rm "${infile}"
64 fi
65}
66
67server_listen() {
68 ip netns exec "${ns2}" nc "${netcat_opt}" -l -p "${port}" > "${outfile}" &
69 server_pid=$!
70 sleep 0.2
71}
72
73client_connect() {
74 ip netns exec "${ns1}" timeout 2 nc "${netcat_opt}" -w 1 "${addr2}" "${port}" < "${infile}"
75 echo $?
76}
77
78verify_data() {
79 wait "${server_pid}"
80 # sha1sum returns two fields [sha1] [filepath]
81 # convert to bash array and access first elem
82 insum=($(sha1sum ${infile}))
83 outsum=($(sha1sum ${outfile}))
84 if [[ "${insum[0]}" != "${outsum[0]}" ]]; then
85 echo "data mismatch"
86 exit 1
87 fi
88}
89
90set -e
91
92# no arguments: automated test, run all
93if [[ "$#" -eq "0" ]]; then
94 echo "ipip"
95 $0 ipv4 ipip none 100
96
97 echo "ip6ip6"
98 $0 ipv6 ip6tnl none 100
99
100 echo "sit"
101 $0 ipv6 sit none 100
102
103 for mac in none mpls eth ; do
104 echo "ip gre $mac"
105 $0 ipv4 gre $mac 100
106
107 echo "ip6 gre $mac"
108 $0 ipv6 ip6gre $mac 100
109
110 echo "ip gre $mac gso"
111 $0 ipv4 gre $mac 2000
112
113 echo "ip6 gre $mac gso"
114 $0 ipv6 ip6gre $mac 2000
115
116 echo "ip udp $mac"
117 $0 ipv4 udp $mac 100
118
119 echo "ip6 udp $mac"
120 $0 ipv6 ip6udp $mac 100
121
122 echo "ip udp $mac gso"
123 $0 ipv4 udp $mac 2000
124
125 echo "ip6 udp $mac gso"
126 $0 ipv6 ip6udp $mac 2000
127 done
128
129 echo "OK. All tests passed"
130 exit 0
131fi
132
133if [[ "$#" -ne "4" ]]; then
134 echo "Usage: $0"
135 echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls|eth> <data_len>"
136 exit 1
137fi
138
139case "$1" in
140"ipv4")
141 readonly addr1="${ns1_v4}"
142 readonly addr2="${ns2_v4}"
143 readonly ipproto=4
144 readonly netcat_opt=-${ipproto}
145 readonly foumod=fou
146 readonly foutype=ipip
147 readonly fouproto=4
148 readonly fouproto_mpls=${mplsproto}
149 readonly gretaptype=gretap
150 ;;
151"ipv6")
152 readonly addr1="${ns1_v6}"
153 readonly addr2="${ns2_v6}"
154 readonly ipproto=6
155 readonly netcat_opt=-${ipproto}
156 readonly foumod=fou6
157 readonly foutype=ip6tnl
158 readonly fouproto="41 -6"
159 readonly fouproto_mpls="${mplsproto} -6"
160 readonly gretaptype=ip6gretap
161 ;;
162*)
163 echo "unknown arg: $1"
164 exit 1
165 ;;
166esac
167
168readonly tuntype=$2
169readonly mac=$3
170readonly datalen=$4
171
172echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
173
174trap cleanup EXIT
175
176setup
177
178# basic communication works
179echo "test basic connectivity"
180server_listen
181client_connect
182verify_data
183
184# clientside, insert bpf program to encap all TCP to port ${port}
185# client can no longer connect
186ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
187ip netns exec "${ns1}" tc filter add dev veth1 egress \
188 bpf direct-action object-file ./test_tc_tunnel.o \
189 section "encap_${tuntype}_${mac}"
190echo "test bpf encap without decap (expect failure)"
191server_listen
192! client_connect
193
194if [[ "$tuntype" =~ "udp" ]]; then
195 # Set up fou tunnel.
196 ttype="${foutype}"
197 targs="encap fou encap-sport auto encap-dport $udpport"
198 # fou may be a module; allow this to fail.
199 modprobe "${foumod}" ||true
200 if [[ "$mac" == "mpls" ]]; then
201 dport=${mplsudpport}
202 dproto=${fouproto_mpls}
203 tmode="mode any ttl 255"
204 else
205 dport=${udpport}
206 dproto=${fouproto}
207 fi
208 ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
209 targs="encap fou encap-sport auto encap-dport $dport"
210elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
211 ttype=$gretaptype
212else
213 ttype=$tuntype
214 targs=""
215fi
216
217# tunnel address family differs from inner for SIT
218if [[ "${tuntype}" == "sit" ]]; then
219 link_addr1="${ns1_v4}"
220 link_addr2="${ns2_v4}"
221else
222 link_addr1="${addr1}"
223 link_addr2="${addr2}"
224fi
225
226# serverside, insert decap module
227# server is still running
228# client can connect again
229ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
230 ${tmode} remote "${link_addr1}" local "${link_addr2}" $targs
231
232expect_tun_fail=0
233
234if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
235 # No support for MPLS IPv6 fou tunnel; expect failure.
236 expect_tun_fail=1
237elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
238 # No support for TEB fou tunnel; expect failure.
239 expect_tun_fail=1
240elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
241 # Share ethernet address between tunnel/veth2 so L2 decap works.
242 ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
243 awk '/ether/ { print $2 }')
244 ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
245elif [[ "$mac" == "mpls" ]]; then
246 modprobe mpls_iptunnel ||true
247 modprobe mpls_gso ||true
248 ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
249 ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
250 ip netns exec "${ns2}" ip link set lo up
251 ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
252 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
253fi
254
255# Because packets are decapped by the tunnel they arrive on testtun0 from
256# the IP stack perspective. Ensure reverse path filtering is disabled
257# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
258# expected veth2 (veth2 is where 192.168.1.2 is configured).
259ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
260# rp needs to be disabled for both all and testtun0 as the rp value is
261# selected as the max of the "all" and device-specific values.
262ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
263ip netns exec "${ns2}" ip link set dev testtun0 up
264if [[ "$expect_tun_fail" == 1 ]]; then
265 # This tunnel mode is not supported, so we expect failure.
266 echo "test bpf encap with tunnel device decap (expect failure)"
267 ! client_connect
268else
269 echo "test bpf encap with tunnel device decap"
270 client_connect
271 verify_data
272 server_listen
273fi
274
275# bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3.
276if [[ "${tuntype}" == "sit" ]]; then
277 echo OK
278 exit 0
279fi
280
281# serverside, use BPF for decap
282ip netns exec "${ns2}" ip link del dev testtun0
283ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
284ip netns exec "${ns2}" tc filter add dev veth2 ingress \
285 bpf direct-action object-file ./test_tc_tunnel.o section decap
286echo "test bpf encap with bpf decap"
287client_connect
288verify_data
289
290echo OK