| #!/bin/bash -e |
| # SPDX-License-Identifier: GPL-2.0 |
| # |
| # xfrm/IPsec tests. |
| # Currently implemented: |
| # - ICMP error source address verification (IETF RFC 4301 section 6) |
| # - ICMP MTU exceeded handling over IPsec tunnels. |
| # |
| # Addresses and topology: |
| # IPv4 prefix 10.1.c.d IPv6 prefix fc00:c::d/64 where c is the segment number |
| # and d is the interface identifier. |
| # IPv6 uses the same c:d as IPv4, and start with IPv6 prefix instead ipv4 prefix |
| # |
| # Network topology default: ns_set_v4 or ns_set_v6 |
| # 1.1 1.2 2.1 2.2 3.1 3.2 4.1 4.2 5.1 5.2 6.1 6.2 |
| # eth0 eth1 eth0 eth1 eth0 eth1 eth0 eth1 eth0 eth1 eth0 eth1 |
| # a -------- r1 -------- s1 -------- r2 -------- s2 -------- r3 -------- b |
| # a, b = Alice and Bob hosts without IPsec. |
| # r1, r2, r3 routers, without IPsec |
| # s1, s2, IPsec gateways/routers that setup tunnel(s). |
| |
| # Network topology x: IPsec gateway that generates ICMP response - ns_set_v4x or ns_set_v6x |
| # 1.1 1.2 2.1 2.2 3.1 3.2 4.1 4.2 5.1 5.2 |
| # eth0 eth1 eth0 eth1 eth0 eth1 eth0 eth1 eth0 eth1 |
| # a -------- r1 -------- s1 -------- r2 -------- s2 -------- b |
| |
| . lib.sh |
| |
| EXIT_ON_TEST_FAIL=no |
| PAUSE=no |
| VERBOSE=${VERBOSE:-0} |
| DEBUG=0 |
| |
| # Name Description |
| tests=" |
| unreachable_ipv4 IPv4 unreachable from router r3 |
| unreachable_ipv6 IPv6 unreachable from router r3 |
| unreachable_gw_ipv4 IPv4 unreachable from IPsec gateway s2 |
| unreachable_gw_ipv6 IPv6 unreachable from IPsec gateway s2 |
| mtu_ipv4_s2 IPv4 MTU exceeded from IPsec gateway s2 |
| mtu_ipv6_s2 IPv6 MTU exceeded from IPsec gateway s2 |
| mtu_ipv4_r2 IPv4 MTU exceeded from ESP router r2 |
| mtu_ipv6_r2 IPv6 MTU exceeded from ESP router r2 |
| mtu_ipv4_r3 IPv4 MTU exceeded from router r3 |
| mtu_ipv6_r3 IPv6 MTU exceeded from router r3" |
| |
| prefix4="10.1" |
| prefix6="fc00" |
| |
| run_cmd_err() { |
| cmd="$*" |
| |
| if [ "$VERBOSE" -gt 0 ]; then |
| printf " COMMAND: %s\n" "$cmd" |
| fi |
| |
| out="$($cmd 2>&1)" && rc=0 || rc=$? |
| if [ "$VERBOSE" -gt 1 ] && [ -n "$out" ]; then |
| echo " $out" |
| echo |
| fi |
| return 0 |
| } |
| |
| run_cmd() { |
| run_cmd_err "$@" || exit 1 |
| } |
| |
| run_test() { |
| # If errexit is set, unset it for sub-shell and restore after test |
| errexit=0 |
| if [[ $- =~ "e" ]]; then |
| errexit=1 |
| set +e |
| fi |
| |
| ( |
| unset IFS |
| |
| # shellcheck disable=SC2030 # fail is read by trap/cleanup within this subshell |
| fail="yes" |
| |
| # Since cleanup() relies on variables modified by this sub shell, |
| # it has to run in this context. |
| trap 'log_test_error $?; cleanup' EXIT INT TERM |
| |
| if [ "$VERBOSE" -gt 0 ]; then |
| printf "\n#############################################################\n\n" |
| fi |
| |
| ret=0 |
| case "${name}" in |
| # can't use eval and test names shell check will complain about unused code |
| unreachable_ipv4) test_unreachable_ipv4 ;; |
| unreachable_ipv6) test_unreachable_ipv6 ;; |
| unreachable_gw_ipv4) test_unreachable_gw_ipv4 ;; |
| unreachable_gw_ipv6) test_unreachable_gw_ipv6 ;; |
| mtu_ipv4_s2) test_mtu_ipv4_s2 ;; |
| mtu_ipv6_s2) test_mtu_ipv6_s2 ;; |
| mtu_ipv4_r2) test_mtu_ipv4_r2 ;; |
| mtu_ipv6_r2) test_mtu_ipv6_r2 ;; |
| mtu_ipv4_r3) test_mtu_ipv4_r3 ;; |
| mtu_ipv6_r3) test_mtu_ipv6_r3 ;; |
| esac |
| ret=$? |
| |
| if [ $ret -eq 0 ]; then |
| fail="no" |
| |
| if [ "$VERBOSE" -gt 1 ]; then |
| show_icmp_filter |
| fi |
| |
| printf "TEST: %-60s [ PASS ]\n" "${desc}" |
| elif [ $ret -eq "$ksft_skip" ]; then |
| fail="no" |
| printf "TEST: %-60s [SKIP]\n" "${desc}" |
| fi |
| |
| return $ret |
| ) |
| ret=$? |
| |
| [ $errexit -eq 1 ] && set -e |
| |
| case $ret in |
| 0) |
| all_skipped=false |
| [ "$exitcode" -eq "$ksft_skip" ] && exitcode=0 |
| ;; |
| "$ksft_skip") |
| [ $all_skipped = true ] && exitcode=$ksft_skip |
| ;; |
| *) |
| all_skipped=false |
| exitcode=1 |
| ;; |
| esac |
| |
| return 0 # don't trigger errexit (-e); actual status in exitcode |
| } |
| |
| setup_namespaces() { |
| local namespaces="" |
| |
| NS_A="" |
| NS_B="" |
| NS_R1="" |
| NS_R2="" |
| NS_R3="" |
| NS_S1="" |
| NS_S2="" |
| |
| for ns in ${ns_set}; do |
| namespaces="$namespaces NS_${ns^^}" |
| done |
| |
| # shellcheck disable=SC2086 # setup_ns expects unquoted list |
| setup_ns $namespaces |
| |
| ns_active= #ordered list of namespaces for this test. |
| |
| [ -n "${NS_A}" ] && ns_a=(ip netns exec "${NS_A}") && ns_active="${ns_active} $NS_A" |
| [ -n "${NS_R1}" ] && ns_active="${ns_active} $NS_R1" |
| [ -n "${NS_S1}" ] && ns_s1=(ip netns exec "${NS_S1}") && ns_active="${ns_active} $NS_S1" |
| [ -n "${NS_R2}" ] && ns_r2=(ip netns exec "${NS_R2}") && ns_active="${ns_active} $NS_R2" |
| [ -n "${NS_S2}" ] && ns_s2=(ip netns exec "${NS_S2}") && ns_active="${ns_active} $NS_S2" |
| [ -n "${NS_R3}" ] && ns_r3=(ip netns exec "${NS_R3}") && ns_active="${ns_active} $NS_R3" |
| [ -n "${NS_B}" ] && ns_active="${ns_active} $NS_B" |
| } |
| |
| addr_add() { |
| local -a ns_cmd=(ip netns exec "$1") |
| local addr="$2" |
| local dev="$3" |
| |
| run_cmd "${ns_cmd[@]}" ip addr add "${addr}" dev "${dev}" |
| run_cmd "${ns_cmd[@]}" ip link set up "${dev}" |
| } |
| |
| veth_add() { |
| local ns=$2 |
| local pns=$1 |
| local -a ns_cmd=(ip netns exec "${pns}") |
| local ln="eth0" |
| local rn="eth1" |
| |
| run_cmd "${ns_cmd[@]}" ip link add "${ln}" type veth peer name "${rn}" netns "${ns}" |
| } |
| |
| show_icmp_filter() { |
| run_cmd "${ns_r2[@]}" nft list ruleset |
| echo "$out" |
| } |
| |
| setup_icmp_filter() { |
| run_cmd "${ns_r2[@]}" nft add table inet filter |
| run_cmd "${ns_r2[@]}" nft add chain inet filter FORWARD \ |
| '{ type filter hook forward priority filter; policy drop ; }' |
| run_cmd "${ns_r2[@]}" nft add rule inet filter FORWARD counter ip protocol esp \ |
| counter log accept |
| run_cmd "${ns_r2[@]}" nft add rule inet filter FORWARD counter ip protocol \ |
| icmp counter log drop |
| |
| if [ "$VERBOSE" -gt 0 ]; then |
| run_cmd "${ns_r2[@]}" nft list ruleset |
| echo "$out" |
| fi |
| } |
| |
| setup_icmpv6_filter() { |
| run_cmd "${ns_r2[@]}" nft add table inet filter |
| run_cmd "${ns_r2[@]}" nft add chain inet filter FORWARD \ |
| '{ type filter hook forward priority filter; policy drop ; }' |
| run_cmd "${ns_r2[@]}" nft add rule inet filter FORWARD ip6 nexthdr \ |
| ipv6-icmp icmpv6 type echo-request counter log drop |
| run_cmd "${ns_r2[@]}" nft add rule inet filter FORWARD ip6 nexthdr esp \ |
| counter log accept |
| run_cmd "${ns_r2[@]}" nft add rule inet filter FORWARD ip6 nexthdr \ |
| ipv6-icmp icmpv6 type \ |
| '{nd-neighbor-solicit,nd-neighbor-advert,nd-router-solicit,nd-router-advert}' \ |
| counter log drop |
| if [ "$VERBOSE" -gt 0 ]; then |
| run_cmd "${ns_r2[@]}" nft list ruleset |
| echo "$out" |
| fi |
| } |
| |
| set_xfrm_params() { |
| s1_src=${src} |
| s1_dst=${dst} |
| s1_src_net=${src_net} |
| s1_dst_net=${dst_net} |
| } |
| |
| setup_ns_set_v4() { |
| ns_set="a r1 s1 r2 s2 r3 b" # Network topology default |
| imax=$(echo "$ns_set" | wc -w) # number of namespaces in this topology |
| |
| src="10.1.3.1" |
| dst="10.1.4.2" |
| src_net="10.1.1.0/24" |
| dst_net="10.1.6.0/24" |
| |
| prefix=${prefix4} |
| prefix_len=24 |
| s="." |
| S="." |
| |
| set_xfrm_params |
| } |
| |
| setup_ns_set_v4x() { |
| ns_set="a r1 s1 r2 s2 b" # Network topology: x |
| imax=$(echo "$ns_set" | wc -w) # number of namespaces in this topology |
| prefix=${prefix4} |
| s="." |
| S="." |
| src="10.1.3.1" |
| dst="10.1.4.2" |
| src_net="10.1.1.0/24" |
| dst_net="10.1.5.0/24" |
| prefix_len=24 |
| |
| set_xfrm_params |
| } |
| |
| setup_ns_set_v6() { |
| ns_set="a r1 s1 r2 s2 r3 b" # Network topology default |
| imax=$(echo "$ns_set" | wc -w) # number of namespaces in this topology |
| prefix=${prefix6} |
| s=":" |
| S="::" |
| src="fc00:3::1" |
| dst="fc00:4::2" |
| src_net="fc00:1::0/64" |
| dst_net="fc00:6::0/64" |
| prefix_len=64 |
| |
| set_xfrm_params |
| } |
| |
| setup_ns_set_v6x() { |
| ns_set="a r1 s1 r2 s2 b" # Network topology: x |
| imax=$(echo "$ns_set" | wc -w) |
| prefix=${prefix6} |
| s=":" |
| S="::" |
| src="fc00:3::1" |
| dst="fc00:4::2" |
| src_net="fc00:1::0/64" |
| dst_net="fc00:5::0/64" |
| prefix_len=64 |
| |
| set_xfrm_params |
| } |
| |
| setup_network() { |
| # Create veths and add addresses |
| local -a ns_cmd |
| i=1 |
| p="" |
| for ns in ${ns_active}; do |
| ns_cmd=(ip netns exec "${ns}") |
| |
| if [ "${i}" -ne 1 ]; then |
| # Create veth between previous and current namespace |
| veth_add "${p}" "${ns}" |
| # Add addresses: previous gets .1 on eth0, current gets .2 on eth1 |
| addr_add "${p}" "${prefix}${s}$((i-1))${S}1/${prefix_len}" eth0 |
| addr_add "${ns}" "${prefix}${s}$((i-1))${S}2/${prefix_len}" eth1 |
| fi |
| |
| # Enable forwarding |
| run_cmd "${ns_cmd[@]}" sysctl -q net/ipv4/ip_forward=1 |
| run_cmd "${ns_cmd[@]}" sysctl -q net/ipv6/conf/all/forwarding=1 |
| run_cmd "${ns_cmd[@]}" sysctl -q net/ipv6/conf/default/accept_dad=0 |
| |
| p=${ns} |
| i=$((i + 1)) |
| done |
| |
| # Add routes (needs all addresses to exist first) |
| i=1 |
| for ns in ${ns_active}; do |
| ns_cmd=(ip netns exec "${ns}") |
| |
| # Forward routes to networks beyond this node |
| if [ "${i}" -ne "${imax}" ]; then |
| nhf="${prefix}${s}${i}${S}2" # nexthop forward |
| for j in $(seq $((i + 1)) "${imax}"); do |
| run_cmd "${ns_cmd[@]}" ip route replace \ |
| "${prefix}${s}${j}${S}0/${prefix_len}" via "${nhf}" |
| done |
| fi |
| |
| # Reverse routes to networks before this node |
| if [ "${i}" -gt 1 ]; then |
| nhr="${prefix}${s}$((i-1))${S}1" # nexthop reverse |
| for j in $(seq 1 $((i - 2))); do |
| run_cmd "${ns_cmd[@]}" ip route replace \ |
| "${prefix}${s}${j}${S}0/${prefix_len}" via "${nhr}" |
| done |
| fi |
| |
| i=$((i + 1)) |
| done |
| } |
| |
| setup_xfrm_mode() { |
| local MODE=${1:-tunnel} |
| if [ "${MODE}" != "tunnel" ] && [ "${MODE}" != "beet" ]; then |
| echo "xfrm mode ${MODE} not supported" |
| log_test_error |
| return 1 |
| fi |
| |
| run_cmd "${ns_s1[@]}" ip xfrm policy add src "${s1_src_net}" dst "${s1_dst_net}" dir out \ |
| tmpl src "${s1_src}" dst "${s1_dst}" proto esp reqid 1 mode "${MODE}" |
| |
| # no "input" policies. we are only doing forwarding so far |
| |
| run_cmd "${ns_s1[@]}" ip xfrm policy add src "${s1_dst_net}" dst "${s1_src_net}" dir fwd \ |
| flag icmp tmpl src "${s1_dst}" dst "${s1_src}" proto esp reqid 2 mode "${MODE}" |
| |
| run_cmd "${ns_s1[@]}" ip xfrm state add src "${s1_src}" dst "${s1_dst}" proto esp spi 1 \ |
| reqid 1 mode "${MODE}" aead 'rfc4106(gcm(aes))' \ |
| 0x1111111111111111111111111111111111111111 96 \ |
| sel src "${s1_src_net}" dst "${s1_dst_net}" dir out |
| |
| run_cmd "${ns_s1[@]}" ip xfrm state add src "${s1_dst}" dst "${s1_src}" proto esp spi 2 \ |
| reqid 2 flag icmp replay-window 8 mode "${MODE}" aead 'rfc4106(gcm(aes))' \ |
| 0x2222222222222222222222222222222222222222 96 \ |
| sel src "${s1_dst_net}" dst "${s1_src_net}" dir in |
| |
| run_cmd "${ns_s2[@]}" ip xfrm policy add src "${s1_dst_net}" dst "${s1_src_net}" dir out \ |
| flag icmp tmpl src "${s1_dst}" dst "${s1_src}" proto esp reqid 2 mode "${MODE}" |
| |
| run_cmd "${ns_s2[@]}" ip xfrm policy add src "${s1_src_net}" dst "${s1_dst_net}" dir fwd \ |
| tmpl src "${s1_src}" dst "${s1_dst}" proto esp reqid 1 mode "${MODE}" |
| |
| run_cmd "${ns_s2[@]}" ip xfrm state add src "${s1_dst}" dst "${s1_src}" proto esp spi 2 \ |
| reqid 2 mode "${MODE}" aead 'rfc4106(gcm(aes))' \ |
| 0x2222222222222222222222222222222222222222 96 \ |
| sel src "${s1_dst_net}" dst "${s1_src_net}" dir out |
| |
| run_cmd "${ns_s2[@]}" ip xfrm state add src "${s1_src}" dst "${s1_dst}" proto esp spi 1 \ |
| reqid 1 flag icmp replay-window 8 mode "${MODE}" aead 'rfc4106(gcm(aes))' \ |
| 0x1111111111111111111111111111111111111111 96 \ |
| sel src "${s1_src_net}" dst "${s1_dst_net}" dir in |
| } |
| |
| setup_xfrm() { |
| setup_xfrm_mode tunnel |
| } |
| |
| setup() { |
| [ "$(id -u)" -ne 0 ] && echo " need to run as root" && return "$ksft_skip" |
| |
| for arg; do |
| case "${arg}" in |
| ns_set_v4) setup_ns_set_v4 ;; |
| ns_set_v4x) setup_ns_set_v4x ;; |
| ns_set_v6) setup_ns_set_v6 ;; |
| ns_set_v6x) setup_ns_set_v6x ;; |
| namespaces) setup_namespaces ;; |
| network) setup_network ;; |
| xfrm) setup_xfrm ;; |
| icmp_filter) setup_icmp_filter ;; |
| icmpv6_filter) setup_icmpv6_filter ;; |
| *) echo " ${arg} not supported"; return 1 ;; |
| esac || return 1 |
| done |
| } |
| |
| # shellcheck disable=SC2317 # called via trap |
| pause() { |
| echo |
| echo "Pausing. Hit enter to continue" |
| read -r _ |
| } |
| |
| # shellcheck disable=SC2317 # called via trap |
| log_test_error() { |
| # shellcheck disable=SC2031 # fail is set in subshell, read via trap |
| if [ "${fail}" = "yes" ] && [ -n "${desc}" ]; then |
| if [ "$VERBOSE" -gt 0 ]; then |
| show_icmp_filter |
| fi |
| printf "TEST: %-60s [ FAIL ] %s\n" "${desc}" "${name}" |
| [ -n "${cmd}" ] && printf '%s\n\n' "${cmd}" |
| [ -n "${out}" ] && printf '%s\n\n' "${out}" |
| fi |
| } |
| |
| # shellcheck disable=SC2317 # called via trap |
| cleanup() { |
| # shellcheck disable=SC2031 # fail is set in subshell, read via trap |
| [[ "$PAUSE" = "always" || ( "$PAUSE" = "fail" && "$fail" = "yes" ) ]] && pause |
| cleanup_all_ns |
| # shellcheck disable=SC2031 # fail is set in subshell, read via trap |
| [ "${EXIT_ON_TEST_FAIL}" = "yes" ] && [ "${fail}" = "yes" ] && exit 1 |
| } |
| |
| test_unreachable_ipv6() { |
| setup ns_set_v6 namespaces network xfrm icmpv6_filter || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 fc00:6::2 |
| run_cmd_err "${ns_a[@]}" ping -W 5 -w 4 -c 1 fc00:6::3 |
| rc=0 |
| echo -e "$out" | grep -q -E 'From fc00:5::2 icmp_seq.* Destination' || rc=1 |
| return "${rc}" |
| } |
| |
| test_unreachable_gw_ipv6() { |
| setup ns_set_v6x namespaces network xfrm icmpv6_filter || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 fc00:5::2 |
| run_cmd_err "${ns_a[@]}" ping -W 5 -w 4 -c 1 fc00:5::3 |
| rc=0 |
| echo -e "$out" | grep -q -E 'From fc00:4::2 icmp_seq.* Destination' || rc=1 |
| return "${rc}" |
| } |
| |
| test_unreachable_ipv4() { |
| setup ns_set_v4 namespaces network icmp_filter xfrm || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 10.1.6.2 |
| run_cmd_err "${ns_a[@]}" ping -W 5 -w 4 -c 1 10.1.6.3 |
| rc=0 |
| echo -e "$out" | grep -q -E 'From 10.1.5.2 icmp_seq.* Destination' || rc=1 |
| return "${rc}" |
| } |
| |
| test_unreachable_gw_ipv4() { |
| setup ns_set_v4x namespaces network icmp_filter xfrm || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 10.1.5.2 |
| run_cmd_err "${ns_a[@]}" ping -W 5 -w 4 -c 1 10.1.5.3 |
| rc=0 |
| echo -e "$out" | grep -q -E 'From 10.1.4.2 icmp_seq.* Destination' || rc=1 |
| return "${rc}" |
| } |
| |
| test_mtu_ipv4_r2() { |
| setup ns_set_v4 namespaces network icmp_filter xfrm || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 10.1.6.2 |
| run_cmd "${ns_r2[@]}" ip route replace 10.1.3.0/24 dev eth1 src 10.1.3.2 mtu 1300 |
| run_cmd "${ns_r2[@]}" ip route replace 10.1.4.0/24 dev eth0 src 10.1.4.1 mtu 1300 |
| # shellcheck disable=SC1010 # -M do: do = dont-fragment, not shell keyword |
| run_cmd "${ns_a[@]}" ping -M do -s 1300 -W 5 -w 4 -c 1 10.1.6.2 || true |
| rc=0 |
| echo -e "$out" | grep -q -E "From 10.1.2.2 icmp_seq=.* Frag needed and DF set" || rc=1 |
| return "${rc}" |
| } |
| |
| test_mtu_ipv6_r2() { |
| setup ns_set_v6 namespaces network xfrm icmpv6_filter || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 fc00:6::2 |
| run_cmd "${ns_r2[@]}" ip -6 route replace fc00:3::/64 \ |
| dev eth1 metric 256 src fc00:3::2 mtu 1300 |
| run_cmd "${ns_r2[@]}" ip -6 route replace fc00:4::/64 \ |
| dev eth0 metric 256 src fc00:4::1 mtu 1300 |
| # shellcheck disable=SC1010 # -M do: do = dont-fragment, not shell keyword |
| run_cmd "${ns_a[@]}" ping -M do -s 1300 -W 5 -w 4 -c 1 fc00:6::2 || true |
| rc=0 |
| echo -e "$out" | grep -q -E "From fc00:2::2 icmp_seq=.* Packet too big: mtu=1230" || rc=1 |
| return "${rc}" |
| } |
| |
| test_mtu_ipv4_r3() { |
| setup ns_set_v4 namespaces network icmp_filter xfrm || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 10.1.6.2 |
| run_cmd "${ns_r3[@]}" ip route replace 10.1.6.0/24 dev eth0 mtu 1300 |
| # shellcheck disable=SC1010 # -M do: do = dont-fragment, not shell keyword |
| run_cmd "${ns_a[@]}" ping -M do -s 1350 -W 5 -w 4 -c 1 10.1.6.2 || true |
| rc=0 |
| echo -e "$out" | grep -q -E "From 10.1.5.2 .* Frag needed and DF set \(mtu = 1300\)" || rc=1 |
| return "${rc}" |
| } |
| |
| test_mtu_ipv4_s2() { |
| setup ns_set_v4x namespaces network icmp_filter xfrm || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 10.1.5.2 |
| run_cmd "${ns_s2[@]}" ip route replace 10.1.5.0/24 dev eth0 src 10.1.5.1 mtu 1300 |
| # shellcheck disable=SC1010 # -M do: do = dont-fragment, not shell keyword |
| run_cmd "${ns_a[@]}" ping -M do -s 1350 -W 5 -w 4 -c 1 10.1.5.2 || true |
| rc=0 |
| echo -e "$out" | grep -q -E "From 10.1.4.2.*Frag needed and DF set \(mtu = 1300\)" || rc=1 |
| return "${rc}" |
| } |
| |
| test_mtu_ipv6_s2() { |
| setup ns_set_v6x namespaces network xfrm icmpv6_filter || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 fc00:5::2 |
| run_cmd "${ns_s2[@]}" ip -6 route replace fc00:5::/64 dev eth0 metric 256 mtu 1300 |
| # shellcheck disable=SC1010 # -M do: do = dont-fragment, not shell keyword |
| run_cmd "${ns_a[@]}" ping -M do -s 1350 -W 5 -w 4 -c 1 fc00:5::2 || true |
| rc=0 |
| echo -e "$out" | grep -q -E "From fc00:4::2.*Packet too big: mtu=1300" || rc=1 |
| return "${rc}" |
| } |
| |
| test_mtu_ipv6_r3() { |
| setup ns_set_v6 namespaces network xfrm icmpv6_filter || return "$ksft_skip" |
| run_cmd "${ns_a[@]}" ping -W 5 -w 4 -c 1 fc00:6::2 |
| run_cmd "${ns_r3[@]}" ip -6 route replace fc00:6::/64 dev eth1 metric 256 mtu 1300 |
| # shellcheck disable=SC1010 # -M do: do = dont-fragment, not shell keyword |
| run_cmd "${ns_a[@]}" ping -M do -s 1300 -W 5 -w 4 -c 1 fc00:6::2 || true |
| rc=0 |
| echo -e "$out" | grep -q -E "From fc00:5::2 icmp_seq=.* Packet too big: mtu=1300" || rc=1 |
| return "${rc}" |
| } |
| |
| ################################################################################ |
| # |
| usage() { |
| echo |
| echo "$0 [OPTIONS] [TEST]..." |
| echo "If no TEST argument is given, all tests will be run." |
| echo |
| echo -e "\t-p Pause on fail. Namespaces are kept for diagnostics" |
| echo -e "\t-P Pause after the test. Namespaces are kept for diagnostics" |
| echo -e "\t-v Verbose output. Show commands; -vv Show output and nft rules also" |
| echo "Available tests${tests}" |
| exit 1 |
| } |
| |
| ################################################################################ |
| # |
| exitcode=0 |
| all_skipped=true |
| out= |
| cmd= |
| |
| while getopts :epPv o; do |
| case $o in |
| e) EXIT_ON_TEST_FAIL=yes ;; |
| P) PAUSE=always ;; |
| p) PAUSE=fail ;; |
| v) VERBOSE=$((VERBOSE + 1)) ;; |
| *) usage ;; |
| esac |
| done |
| shift $((OPTIND - 1)) |
| |
| IFS=$'\t\n' |
| |
| for arg; do |
| # Check first that all requested tests are available before running any |
| command -v "test_${arg}" >/dev/null || { |
| echo "=== Test ${arg} not found" |
| usage |
| } |
| done |
| |
| name="" |
| desc="" |
| fail="no" |
| |
| for t in ${tests}; do |
| [ "${name}" = "" ] && name="${t}" && continue |
| [ "${desc}" = "" ] && desc="${t}" |
| |
| run_this=1 |
| for arg; do |
| [ "${arg}" = "${name}" ] && run_this=1 && break |
| run_this=0 |
| done |
| if [ $run_this -eq 1 ]; then |
| run_test |
| fi |
| name="" |
| desc="" |
| done |
| |
| exit ${exitcode} |
