Loading...
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# In-place tunneling
5
6BPF_FILE="test_tc_tunnel.bpf.o"
7# must match the port that the bpf program filters on
8readonly port=8000
9
10readonly ns_prefix="ns-$$-"
11readonly ns1="${ns_prefix}1"
12readonly ns2="${ns_prefix}2"
13
14readonly ns1_v4=192.168.1.1
15readonly ns2_v4=192.168.1.2
16readonly ns1_v6=fd::1
17readonly ns2_v6=fd::2
18
19# Must match port used by bpf program
20readonly udpport=5555
21# MPLSoverUDP
22readonly mplsudpport=6635
23readonly mplsproto=137
24
25readonly infile="$(mktemp)"
26readonly outfile="$(mktemp)"
27
28setup() {
29 ip netns add "${ns1}"
30 ip netns add "${ns2}"
31
32 ip link add dev veth1 mtu 1500 netns "${ns1}" type veth \
33 peer name veth2 mtu 1500 netns "${ns2}"
34
35 ip netns exec "${ns1}" ethtool -K veth1 tso off
36
37 ip -netns "${ns1}" link set veth1 up
38 ip -netns "${ns2}" link set veth2 up
39
40 ip -netns "${ns1}" -4 addr add "${ns1_v4}/24" dev veth1
41 ip -netns "${ns2}" -4 addr add "${ns2_v4}/24" dev veth2
42 ip -netns "${ns1}" -6 addr add "${ns1_v6}/64" dev veth1 nodad
43 ip -netns "${ns2}" -6 addr add "${ns2_v6}/64" dev veth2 nodad
44
45 # clamp route to reserve room for tunnel headers
46 ip -netns "${ns1}" -4 route flush table main
47 ip -netns "${ns1}" -6 route flush table main
48 ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1450 dev veth1
49 ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1430 dev veth1
50
51 sleep 1
52
53 dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none
54}
55
56cleanup() {
57 ip netns del "${ns2}"
58 ip netns del "${ns1}"
59
60 if [[ -f "${outfile}" ]]; then
61 rm "${outfile}"
62 fi
63 if [[ -f "${infile}" ]]; then
64 rm "${infile}"
65 fi
66
67 if [[ -n $server_pid ]]; then
68 kill $server_pid 2> /dev/null
69 fi
70}
71
72server_listen() {
73 ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" &
74 server_pid=$!
75}
76
77client_connect() {
78 ip netns exec "${ns1}" timeout 2 nc "${netcat_opt}" -w 1 "${addr2}" "${port}" < "${infile}"
79 echo $?
80}
81
82verify_data() {
83 wait "${server_pid}"
84 server_pid=
85 # sha1sum returns two fields [sha1] [filepath]
86 # convert to bash array and access first elem
87 insum=($(sha1sum ${infile}))
88 outsum=($(sha1sum ${outfile}))
89 if [[ "${insum[0]}" != "${outsum[0]}" ]]; then
90 echo "data mismatch"
91 exit 1
92 fi
93}
94
95wait_for_port() {
96 for i in $(seq 20); do
97 if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then
98 return 0
99 fi
100 sleep 0.1
101 done
102 return 1
103}
104
105set -e
106
107# no arguments: automated test, run all
108if [[ "$#" -eq "0" ]]; then
109 echo "ipip"
110 $0 ipv4 ipip none 100
111
112 echo "ipip6"
113 $0 ipv4 ipip6 none 100
114
115 echo "ip6ip6"
116 $0 ipv6 ip6tnl none 100
117
118 echo "sit"
119 $0 ipv6 sit none 100
120
121 echo "ip4 vxlan"
122 $0 ipv4 vxlan eth 2000
123
124 echo "ip6 vxlan"
125 $0 ipv6 ip6vxlan eth 2000
126
127 for mac in none mpls eth ; do
128 echo "ip gre $mac"
129 $0 ipv4 gre $mac 100
130
131 echo "ip6 gre $mac"
132 $0 ipv6 ip6gre $mac 100
133
134 echo "ip gre $mac gso"
135 $0 ipv4 gre $mac 2000
136
137 echo "ip6 gre $mac gso"
138 $0 ipv6 ip6gre $mac 2000
139
140 echo "ip udp $mac"
141 $0 ipv4 udp $mac 100
142
143 echo "ip6 udp $mac"
144 $0 ipv6 ip6udp $mac 100
145
146 echo "ip udp $mac gso"
147 $0 ipv4 udp $mac 2000
148
149 echo "ip6 udp $mac gso"
150 $0 ipv6 ip6udp $mac 2000
151 done
152
153 echo "OK. All tests passed"
154 exit 0
155fi
156
157if [[ "$#" -ne "4" ]]; then
158 echo "Usage: $0"
159 echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls|eth> <data_len>"
160 exit 1
161fi
162
163case "$1" in
164"ipv4")
165 readonly addr1="${ns1_v4}"
166 readonly addr2="${ns2_v4}"
167 readonly ipproto=4
168 readonly netcat_opt=-${ipproto}
169 readonly foumod=fou
170 readonly foutype=ipip
171 readonly fouproto=4
172 readonly fouproto_mpls=${mplsproto}
173 readonly gretaptype=gretap
174 ;;
175"ipv6")
176 readonly addr1="${ns1_v6}"
177 readonly addr2="${ns2_v6}"
178 readonly ipproto=6
179 readonly netcat_opt=-${ipproto}
180 readonly foumod=fou6
181 readonly foutype=ip6tnl
182 readonly fouproto="41 -6"
183 readonly fouproto_mpls="${mplsproto} -6"
184 readonly gretaptype=ip6gretap
185 ;;
186*)
187 echo "unknown arg: $1"
188 exit 1
189 ;;
190esac
191
192readonly tuntype=$2
193readonly mac=$3
194readonly datalen=$4
195
196echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
197
198trap cleanup EXIT
199
200setup
201
202# basic communication works
203echo "test basic connectivity"
204server_listen
205wait_for_port ${port} ${netcat_opt}
206client_connect
207verify_data
208
209# clientside, insert bpf program to encap all TCP to port ${port}
210# client can no longer connect
211ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
212ip netns exec "${ns1}" tc filter add dev veth1 egress \
213 bpf direct-action object-file ${BPF_FILE} \
214 section "encap_${tuntype}_${mac}"
215echo "test bpf encap without decap (expect failure)"
216server_listen
217wait_for_port ${port} ${netcat_opt}
218! client_connect
219
220if [[ "$tuntype" =~ "udp" ]]; then
221 # Set up fou tunnel.
222 ttype="${foutype}"
223 targs="encap fou encap-sport auto encap-dport $udpport"
224 # fou may be a module; allow this to fail.
225 modprobe "${foumod}" ||true
226 if [[ "$mac" == "mpls" ]]; then
227 dport=${mplsudpport}
228 dproto=${fouproto_mpls}
229 tmode="mode any ttl 255"
230 else
231 dport=${udpport}
232 dproto=${fouproto}
233 fi
234 ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
235 targs="encap fou encap-sport auto encap-dport $dport"
236elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
237 ttype=$gretaptype
238elif [[ "$tuntype" =~ "vxlan" && "$mac" == "eth" ]]; then
239 ttype="vxlan"
240 targs="id 1 dstport 8472 udp6zerocsumrx"
241elif [[ "$tuntype" == "ipip6" ]]; then
242 ttype="ip6tnl"
243 targs=""
244else
245 ttype=$tuntype
246 targs=""
247fi
248
249# tunnel address family differs from inner for SIT
250if [[ "${tuntype}" == "sit" ]]; then
251 link_addr1="${ns1_v4}"
252 link_addr2="${ns2_v4}"
253elif [[ "${tuntype}" == "ipip6" ]]; then
254 link_addr1="${ns1_v6}"
255 link_addr2="${ns2_v6}"
256else
257 link_addr1="${addr1}"
258 link_addr2="${addr2}"
259fi
260
261# serverside, insert decap module
262# server is still running
263# client can connect again
264ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
265 ${tmode} remote "${link_addr1}" local "${link_addr2}" $targs
266
267expect_tun_fail=0
268
269if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
270 # No support for MPLS IPv6 fou tunnel; expect failure.
271 expect_tun_fail=1
272elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
273 # No support for TEB fou tunnel; expect failure.
274 expect_tun_fail=1
275elif [[ "$tuntype" =~ (gre|vxlan) && "$mac" == "eth" ]]; then
276 # Share ethernet address between tunnel/veth2 so L2 decap works.
277 ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
278 awk '/ether/ { print $2 }')
279 ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
280elif [[ "$mac" == "mpls" ]]; then
281 modprobe mpls_iptunnel ||true
282 modprobe mpls_gso ||true
283 ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
284 ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
285 ip netns exec "${ns2}" ip link set lo up
286 ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
287 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
288fi
289
290# Because packets are decapped by the tunnel they arrive on testtun0 from
291# the IP stack perspective. Ensure reverse path filtering is disabled
292# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
293# expected veth2 (veth2 is where 192.168.1.2 is configured).
294ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
295# rp needs to be disabled for both all and testtun0 as the rp value is
296# selected as the max of the "all" and device-specific values.
297ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
298ip netns exec "${ns2}" ip link set dev testtun0 up
299if [[ "$expect_tun_fail" == 1 ]]; then
300 # This tunnel mode is not supported, so we expect failure.
301 echo "test bpf encap with tunnel device decap (expect failure)"
302 ! client_connect
303else
304 echo "test bpf encap with tunnel device decap"
305 client_connect
306 verify_data
307 server_listen
308 wait_for_port ${port} ${netcat_opt}
309fi
310
311# serverside, use BPF for decap
312ip netns exec "${ns2}" ip link del dev testtun0
313ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
314ip netns exec "${ns2}" tc filter add dev veth2 ingress \
315 bpf direct-action object-file ${BPF_FILE} section decap
316echo "test bpf encap with bpf decap"
317client_connect
318verify_data
319
320echo OK
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# In-place tunneling
5
6# must match the port that the bpf program filters on
7readonly port=8000
8
9readonly ns_prefix="ns-$$-"
10readonly ns1="${ns_prefix}1"
11readonly ns2="${ns_prefix}2"
12
13readonly ns1_v4=192.168.1.1
14readonly ns2_v4=192.168.1.2
15readonly ns1_v6=fd::1
16readonly ns2_v6=fd::2
17
18# Must match port used by bpf program
19readonly udpport=5555
20# MPLSoverUDP
21readonly mplsudpport=6635
22readonly mplsproto=137
23
24readonly infile="$(mktemp)"
25readonly outfile="$(mktemp)"
26
27setup() {
28 ip netns add "${ns1}"
29 ip netns add "${ns2}"
30
31 ip link add dev veth1 mtu 1500 netns "${ns1}" type veth \
32 peer name veth2 mtu 1500 netns "${ns2}"
33
34 ip netns exec "${ns1}" ethtool -K veth1 tso off
35
36 ip -netns "${ns1}" link set veth1 up
37 ip -netns "${ns2}" link set veth2 up
38
39 ip -netns "${ns1}" -4 addr add "${ns1_v4}/24" dev veth1
40 ip -netns "${ns2}" -4 addr add "${ns2_v4}/24" dev veth2
41 ip -netns "${ns1}" -6 addr add "${ns1_v6}/64" dev veth1 nodad
42 ip -netns "${ns2}" -6 addr add "${ns2_v6}/64" dev veth2 nodad
43
44 # clamp route to reserve room for tunnel headers
45 ip -netns "${ns1}" -4 route flush table main
46 ip -netns "${ns1}" -6 route flush table main
47 ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1458 dev veth1
48 ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1438 dev veth1
49
50 sleep 1
51
52 dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none
53}
54
55cleanup() {
56 ip netns del "${ns2}"
57 ip netns del "${ns1}"
58
59 if [[ -f "${outfile}" ]]; then
60 rm "${outfile}"
61 fi
62 if [[ -f "${infile}" ]]; then
63 rm "${infile}"
64 fi
65
66 if [[ -n $server_pid ]]; then
67 kill $server_pid 2> /dev/null
68 fi
69}
70
71server_listen() {
72 ip netns exec "${ns2}" nc "${netcat_opt}" -l -p "${port}" > "${outfile}" &
73 server_pid=$!
74 sleep 0.2
75}
76
77client_connect() {
78 ip netns exec "${ns1}" timeout 2 nc "${netcat_opt}" -w 1 "${addr2}" "${port}" < "${infile}"
79 echo $?
80}
81
82verify_data() {
83 wait "${server_pid}"
84 server_pid=
85 # sha1sum returns two fields [sha1] [filepath]
86 # convert to bash array and access first elem
87 insum=($(sha1sum ${infile}))
88 outsum=($(sha1sum ${outfile}))
89 if [[ "${insum[0]}" != "${outsum[0]}" ]]; then
90 echo "data mismatch"
91 exit 1
92 fi
93}
94
95set -e
96
97# no arguments: automated test, run all
98if [[ "$#" -eq "0" ]]; then
99 echo "ipip"
100 $0 ipv4 ipip none 100
101
102 echo "ip6ip6"
103 $0 ipv6 ip6tnl none 100
104
105 echo "sit"
106 $0 ipv6 sit none 100
107
108 for mac in none mpls eth ; do
109 echo "ip gre $mac"
110 $0 ipv4 gre $mac 100
111
112 echo "ip6 gre $mac"
113 $0 ipv6 ip6gre $mac 100
114
115 echo "ip gre $mac gso"
116 $0 ipv4 gre $mac 2000
117
118 echo "ip6 gre $mac gso"
119 $0 ipv6 ip6gre $mac 2000
120
121 echo "ip udp $mac"
122 $0 ipv4 udp $mac 100
123
124 echo "ip6 udp $mac"
125 $0 ipv6 ip6udp $mac 100
126
127 echo "ip udp $mac gso"
128 $0 ipv4 udp $mac 2000
129
130 echo "ip6 udp $mac gso"
131 $0 ipv6 ip6udp $mac 2000
132 done
133
134 echo "OK. All tests passed"
135 exit 0
136fi
137
138if [[ "$#" -ne "4" ]]; then
139 echo "Usage: $0"
140 echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls|eth> <data_len>"
141 exit 1
142fi
143
144case "$1" in
145"ipv4")
146 readonly addr1="${ns1_v4}"
147 readonly addr2="${ns2_v4}"
148 readonly ipproto=4
149 readonly netcat_opt=-${ipproto}
150 readonly foumod=fou
151 readonly foutype=ipip
152 readonly fouproto=4
153 readonly fouproto_mpls=${mplsproto}
154 readonly gretaptype=gretap
155 ;;
156"ipv6")
157 readonly addr1="${ns1_v6}"
158 readonly addr2="${ns2_v6}"
159 readonly ipproto=6
160 readonly netcat_opt=-${ipproto}
161 readonly foumod=fou6
162 readonly foutype=ip6tnl
163 readonly fouproto="41 -6"
164 readonly fouproto_mpls="${mplsproto} -6"
165 readonly gretaptype=ip6gretap
166 ;;
167*)
168 echo "unknown arg: $1"
169 exit 1
170 ;;
171esac
172
173readonly tuntype=$2
174readonly mac=$3
175readonly datalen=$4
176
177echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
178
179trap cleanup EXIT
180
181setup
182
183# basic communication works
184echo "test basic connectivity"
185server_listen
186client_connect
187verify_data
188
189# clientside, insert bpf program to encap all TCP to port ${port}
190# client can no longer connect
191ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
192ip netns exec "${ns1}" tc filter add dev veth1 egress \
193 bpf direct-action object-file ./test_tc_tunnel.o \
194 section "encap_${tuntype}_${mac}"
195echo "test bpf encap without decap (expect failure)"
196server_listen
197! client_connect
198
199if [[ "$tuntype" =~ "udp" ]]; then
200 # Set up fou tunnel.
201 ttype="${foutype}"
202 targs="encap fou encap-sport auto encap-dport $udpport"
203 # fou may be a module; allow this to fail.
204 modprobe "${foumod}" ||true
205 if [[ "$mac" == "mpls" ]]; then
206 dport=${mplsudpport}
207 dproto=${fouproto_mpls}
208 tmode="mode any ttl 255"
209 else
210 dport=${udpport}
211 dproto=${fouproto}
212 fi
213 ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
214 targs="encap fou encap-sport auto encap-dport $dport"
215elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
216 ttype=$gretaptype
217else
218 ttype=$tuntype
219 targs=""
220fi
221
222# tunnel address family differs from inner for SIT
223if [[ "${tuntype}" == "sit" ]]; then
224 link_addr1="${ns1_v4}"
225 link_addr2="${ns2_v4}"
226else
227 link_addr1="${addr1}"
228 link_addr2="${addr2}"
229fi
230
231# serverside, insert decap module
232# server is still running
233# client can connect again
234ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
235 ${tmode} remote "${link_addr1}" local "${link_addr2}" $targs
236
237expect_tun_fail=0
238
239if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
240 # No support for MPLS IPv6 fou tunnel; expect failure.
241 expect_tun_fail=1
242elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
243 # No support for TEB fou tunnel; expect failure.
244 expect_tun_fail=1
245elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
246 # Share ethernet address between tunnel/veth2 so L2 decap works.
247 ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
248 awk '/ether/ { print $2 }')
249 ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
250elif [[ "$mac" == "mpls" ]]; then
251 modprobe mpls_iptunnel ||true
252 modprobe mpls_gso ||true
253 ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
254 ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
255 ip netns exec "${ns2}" ip link set lo up
256 ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
257 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
258fi
259
260# Because packets are decapped by the tunnel they arrive on testtun0 from
261# the IP stack perspective. Ensure reverse path filtering is disabled
262# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
263# expected veth2 (veth2 is where 192.168.1.2 is configured).
264ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
265# rp needs to be disabled for both all and testtun0 as the rp value is
266# selected as the max of the "all" and device-specific values.
267ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
268ip netns exec "${ns2}" ip link set dev testtun0 up
269if [[ "$expect_tun_fail" == 1 ]]; then
270 # This tunnel mode is not supported, so we expect failure.
271 echo "test bpf encap with tunnel device decap (expect failure)"
272 ! client_connect
273else
274 echo "test bpf encap with tunnel device decap"
275 client_connect
276 verify_data
277 server_listen
278fi
279
280# bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3.
281if [[ "${tuntype}" == "sit" ]]; then
282 echo OK
283 exit 0
284fi
285
286# serverside, use BPF for decap
287ip netns exec "${ns2}" ip link del dev testtun0
288ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
289ip netns exec "${ns2}" tc filter add dev veth2 ingress \
290 bpf direct-action object-file ./test_tc_tunnel.o section decap
291echo "test bpf encap with bpf decap"
292client_connect
293verify_data
294
295echo OK