1 #!/bin/bash 1 #!/bin/bash
2 # SPDX-License-Identifier: GPL-2.0 2 # SPDX-License-Identifier: GPL-2.0
3 # 3 #
4 # In-place tunneling 4 # In-place tunneling
5 5
6 BPF_FILE="test_tc_tunnel.bpf.o" 6 BPF_FILE="test_tc_tunnel.bpf.o"
7 # must match the port that the bpf program fil 7 # must match the port that the bpf program filters on
8 readonly port=8000 8 readonly port=8000
9 9
10 readonly ns_prefix="ns-$$-" 10 readonly ns_prefix="ns-$$-"
11 readonly ns1="${ns_prefix}1" 11 readonly ns1="${ns_prefix}1"
12 readonly ns2="${ns_prefix}2" 12 readonly ns2="${ns_prefix}2"
13 13
14 readonly ns1_v4=192.168.1.1 14 readonly ns1_v4=192.168.1.1
15 readonly ns2_v4=192.168.1.2 15 readonly ns2_v4=192.168.1.2
16 readonly ns1_v6=fd::1 16 readonly ns1_v6=fd::1
17 readonly ns2_v6=fd::2 17 readonly ns2_v6=fd::2
18 18
19 # Must match port used by bpf program 19 # Must match port used by bpf program
20 readonly udpport=5555 20 readonly udpport=5555
21 # MPLSoverUDP 21 # MPLSoverUDP
22 readonly mplsudpport=6635 22 readonly mplsudpport=6635
23 readonly mplsproto=137 23 readonly mplsproto=137
24 24
25 readonly infile="$(mktemp)" 25 readonly infile="$(mktemp)"
26 readonly outfile="$(mktemp)" 26 readonly outfile="$(mktemp)"
27 27
28 setup() { 28 setup() {
29 ip netns add "${ns1}" 29 ip netns add "${ns1}"
30 ip netns add "${ns2}" 30 ip netns add "${ns2}"
31 31
32 ip link add dev veth1 mtu 1500 netns " 32 ip link add dev veth1 mtu 1500 netns "${ns1}" type veth \
33 peer name veth2 mtu 1500 netns " 33 peer name veth2 mtu 1500 netns "${ns2}"
34 34
35 ip netns exec "${ns1}" ethtool -K veth 35 ip netns exec "${ns1}" ethtool -K veth1 tso off
36 36
37 ip -netns "${ns1}" link set veth1 up 37 ip -netns "${ns1}" link set veth1 up
38 ip -netns "${ns2}" link set veth2 up 38 ip -netns "${ns2}" link set veth2 up
39 39
40 ip -netns "${ns1}" -4 addr add "${ns1_ 40 ip -netns "${ns1}" -4 addr add "${ns1_v4}/24" dev veth1
41 ip -netns "${ns2}" -4 addr add "${ns2_ 41 ip -netns "${ns2}" -4 addr add "${ns2_v4}/24" dev veth2
42 ip -netns "${ns1}" -6 addr add "${ns1_ 42 ip -netns "${ns1}" -6 addr add "${ns1_v6}/64" dev veth1 nodad
43 ip -netns "${ns2}" -6 addr add "${ns2_ 43 ip -netns "${ns2}" -6 addr add "${ns2_v6}/64" dev veth2 nodad
44 44
45 # clamp route to reserve room for tunn 45 # clamp route to reserve room for tunnel headers
46 ip -netns "${ns1}" -4 route flush tabl 46 ip -netns "${ns1}" -4 route flush table main
47 ip -netns "${ns1}" -6 route flush tabl 47 ip -netns "${ns1}" -6 route flush table main
48 ip -netns "${ns1}" -4 route add "${ns2 48 ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1450 dev veth1
49 ip -netns "${ns1}" -6 route add "${ns2 49 ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1430 dev veth1
50 50
51 sleep 1 51 sleep 1
52 52
53 dd if=/dev/urandom of="${infile}" bs=" 53 dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none
54 } 54 }
55 55
56 cleanup() { 56 cleanup() {
57 ip netns del "${ns2}" 57 ip netns del "${ns2}"
58 ip netns del "${ns1}" 58 ip netns del "${ns1}"
59 59
60 if [[ -f "${outfile}" ]]; then 60 if [[ -f "${outfile}" ]]; then
61 rm "${outfile}" 61 rm "${outfile}"
62 fi 62 fi
63 if [[ -f "${infile}" ]]; then 63 if [[ -f "${infile}" ]]; then
64 rm "${infile}" 64 rm "${infile}"
65 fi 65 fi
66 66
67 if [[ -n $server_pid ]]; then 67 if [[ -n $server_pid ]]; then
68 kill $server_pid 2> /dev/null 68 kill $server_pid 2> /dev/null
69 fi 69 fi
70 } 70 }
71 71
72 server_listen() { 72 server_listen() {
73 ip netns exec "${ns2}" nc "${netcat_op 73 ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" &
74 server_pid=$! 74 server_pid=$!
75 } 75 }
76 76
77 client_connect() { 77 client_connect() {
78 ip netns exec "${ns1}" timeout 2 nc "$ 78 ip netns exec "${ns1}" timeout 2 nc "${netcat_opt}" -w 1 "${addr2}" "${port}" < "${infile}"
79 echo $? 79 echo $?
80 } 80 }
81 81
82 verify_data() { 82 verify_data() {
83 wait "${server_pid}" 83 wait "${server_pid}"
84 server_pid= 84 server_pid=
85 # sha1sum returns two fields [sha1] [f 85 # sha1sum returns two fields [sha1] [filepath]
86 # convert to bash array and access fir 86 # convert to bash array and access first elem
87 insum=($(sha1sum ${infile})) 87 insum=($(sha1sum ${infile}))
88 outsum=($(sha1sum ${outfile})) 88 outsum=($(sha1sum ${outfile}))
89 if [[ "${insum[0]}" != "${outsum[0]}" 89 if [[ "${insum[0]}" != "${outsum[0]}" ]]; then
90 echo "data mismatch" 90 echo "data mismatch"
91 exit 1 91 exit 1
92 fi 92 fi
93 } 93 }
94 94
95 wait_for_port() { 95 wait_for_port() {
96 for i in $(seq 20); do 96 for i in $(seq 20); do
97 if ip netns exec "${ns2}" ss $ 97 if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then
98 return 0 98 return 0
99 fi 99 fi
100 sleep 0.1 100 sleep 0.1
101 done 101 done
102 return 1 102 return 1
103 } 103 }
104 104
105 set -e 105 set -e
106 106
107 # no arguments: automated test, run all 107 # no arguments: automated test, run all
108 if [[ "$#" -eq "0" ]]; then 108 if [[ "$#" -eq "0" ]]; then
109 echo "ipip" 109 echo "ipip"
110 $0 ipv4 ipip none 100 110 $0 ipv4 ipip none 100
111 111
112 echo "ipip6" 112 echo "ipip6"
113 $0 ipv4 ipip6 none 100 113 $0 ipv4 ipip6 none 100
114 114
115 echo "ip6ip6" 115 echo "ip6ip6"
116 $0 ipv6 ip6tnl none 100 116 $0 ipv6 ip6tnl none 100
117 117
118 echo "sit" 118 echo "sit"
119 $0 ipv6 sit none 100 119 $0 ipv6 sit none 100
120 120
121 echo "ip4 vxlan" 121 echo "ip4 vxlan"
122 $0 ipv4 vxlan eth 2000 122 $0 ipv4 vxlan eth 2000
123 123
124 echo "ip6 vxlan" 124 echo "ip6 vxlan"
125 $0 ipv6 ip6vxlan eth 2000 125 $0 ipv6 ip6vxlan eth 2000
126 126
127 for mac in none mpls eth ; do 127 for mac in none mpls eth ; do
128 echo "ip gre $mac" 128 echo "ip gre $mac"
129 $0 ipv4 gre $mac 100 129 $0 ipv4 gre $mac 100
130 130
131 echo "ip6 gre $mac" 131 echo "ip6 gre $mac"
132 $0 ipv6 ip6gre $mac 100 132 $0 ipv6 ip6gre $mac 100
133 133
134 echo "ip gre $mac gso" 134 echo "ip gre $mac gso"
135 $0 ipv4 gre $mac 2000 135 $0 ipv4 gre $mac 2000
136 136
137 echo "ip6 gre $mac gso" 137 echo "ip6 gre $mac gso"
138 $0 ipv6 ip6gre $mac 2000 138 $0 ipv6 ip6gre $mac 2000
139 139
140 echo "ip udp $mac" 140 echo "ip udp $mac"
141 $0 ipv4 udp $mac 100 141 $0 ipv4 udp $mac 100
142 142
143 echo "ip6 udp $mac" 143 echo "ip6 udp $mac"
144 $0 ipv6 ip6udp $mac 100 144 $0 ipv6 ip6udp $mac 100
145 145
146 echo "ip udp $mac gso" 146 echo "ip udp $mac gso"
147 $0 ipv4 udp $mac 2000 147 $0 ipv4 udp $mac 2000
148 148
149 echo "ip6 udp $mac gso" 149 echo "ip6 udp $mac gso"
150 $0 ipv6 ip6udp $mac 2000 150 $0 ipv6 ip6udp $mac 2000
151 done 151 done
152 152
153 echo "OK. All tests passed" 153 echo "OK. All tests passed"
154 exit 0 154 exit 0
155 fi 155 fi
156 156
157 if [[ "$#" -ne "4" ]]; then 157 if [[ "$#" -ne "4" ]]; then
158 echo "Usage: $0" 158 echo "Usage: $0"
159 echo " or: $0 <ipv4|ipv6> <tuntype> 159 echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls|eth> <data_len>"
160 exit 1 160 exit 1
161 fi 161 fi
162 162
163 case "$1" in 163 case "$1" in
164 "ipv4") 164 "ipv4")
165 readonly addr1="${ns1_v4}" 165 readonly addr1="${ns1_v4}"
166 readonly addr2="${ns2_v4}" 166 readonly addr2="${ns2_v4}"
167 readonly ipproto=4 167 readonly ipproto=4
168 readonly netcat_opt=-${ipproto} 168 readonly netcat_opt=-${ipproto}
169 readonly foumod=fou 169 readonly foumod=fou
170 readonly foutype=ipip 170 readonly foutype=ipip
171 readonly fouproto=4 171 readonly fouproto=4
172 readonly fouproto_mpls=${mplsproto} 172 readonly fouproto_mpls=${mplsproto}
173 readonly gretaptype=gretap 173 readonly gretaptype=gretap
174 ;; 174 ;;
175 "ipv6") 175 "ipv6")
176 readonly addr1="${ns1_v6}" 176 readonly addr1="${ns1_v6}"
177 readonly addr2="${ns2_v6}" 177 readonly addr2="${ns2_v6}"
178 readonly ipproto=6 178 readonly ipproto=6
179 readonly netcat_opt=-${ipproto} 179 readonly netcat_opt=-${ipproto}
180 readonly foumod=fou6 180 readonly foumod=fou6
181 readonly foutype=ip6tnl 181 readonly foutype=ip6tnl
182 readonly fouproto="41 -6" 182 readonly fouproto="41 -6"
183 readonly fouproto_mpls="${mplsproto} - 183 readonly fouproto_mpls="${mplsproto} -6"
184 readonly gretaptype=ip6gretap 184 readonly gretaptype=ip6gretap
185 ;; 185 ;;
186 *) 186 *)
187 echo "unknown arg: $1" 187 echo "unknown arg: $1"
188 exit 1 188 exit 1
189 ;; 189 ;;
190 esac 190 esac
191 191
192 readonly tuntype=$2 192 readonly tuntype=$2
193 readonly mac=$3 193 readonly mac=$3
194 readonly datalen=$4 194 readonly datalen=$4
195 195
196 echo "encap ${addr1} to ${addr2}, type ${tunty 196 echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
197 197
198 trap cleanup EXIT 198 trap cleanup EXIT
199 199
200 setup 200 setup
201 201
202 # basic communication works 202 # basic communication works
203 echo "test basic connectivity" 203 echo "test basic connectivity"
204 server_listen 204 server_listen
205 wait_for_port ${port} ${netcat_opt} 205 wait_for_port ${port} ${netcat_opt}
206 client_connect 206 client_connect
207 verify_data 207 verify_data
208 208
209 # clientside, insert bpf program to encap all 209 # clientside, insert bpf program to encap all TCP to port ${port}
210 # client can no longer connect 210 # client can no longer connect
211 ip netns exec "${ns1}" tc qdisc add dev veth1 211 ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
212 ip netns exec "${ns1}" tc filter add dev veth1 212 ip netns exec "${ns1}" tc filter add dev veth1 egress \
213 bpf direct-action object-file ${BPF_FI 213 bpf direct-action object-file ${BPF_FILE} \
214 section "encap_${tuntype}_${mac}" 214 section "encap_${tuntype}_${mac}"
215 echo "test bpf encap without decap (expect fai 215 echo "test bpf encap without decap (expect failure)"
216 server_listen 216 server_listen
217 wait_for_port ${port} ${netcat_opt} 217 wait_for_port ${port} ${netcat_opt}
218 ! client_connect 218 ! client_connect
219 219
220 if [[ "$tuntype" =~ "udp" ]]; then 220 if [[ "$tuntype" =~ "udp" ]]; then
221 # Set up fou tunnel. 221 # Set up fou tunnel.
222 ttype="${foutype}" 222 ttype="${foutype}"
223 targs="encap fou encap-sport auto enca 223 targs="encap fou encap-sport auto encap-dport $udpport"
224 # fou may be a module; allow this to f 224 # fou may be a module; allow this to fail.
225 modprobe "${foumod}" ||true 225 modprobe "${foumod}" ||true
226 if [[ "$mac" == "mpls" ]]; then 226 if [[ "$mac" == "mpls" ]]; then
227 dport=${mplsudpport} 227 dport=${mplsudpport}
228 dproto=${fouproto_mpls} 228 dproto=${fouproto_mpls}
229 tmode="mode any ttl 255" 229 tmode="mode any ttl 255"
230 else 230 else
231 dport=${udpport} 231 dport=${udpport}
232 dproto=${fouproto} 232 dproto=${fouproto}
233 fi 233 fi
234 ip netns exec "${ns2}" ip fou add port 234 ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
235 targs="encap fou encap-sport auto enca 235 targs="encap fou encap-sport auto encap-dport $dport"
236 elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" 236 elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
237 ttype=$gretaptype 237 ttype=$gretaptype
238 elif [[ "$tuntype" =~ "vxlan" && "$mac" == "et 238 elif [[ "$tuntype" =~ "vxlan" && "$mac" == "eth" ]]; then
239 ttype="vxlan" 239 ttype="vxlan"
240 targs="id 1 dstport 8472 udp6zerocsumr 240 targs="id 1 dstport 8472 udp6zerocsumrx"
241 elif [[ "$tuntype" == "ipip6" ]]; then 241 elif [[ "$tuntype" == "ipip6" ]]; then
242 ttype="ip6tnl" 242 ttype="ip6tnl"
243 targs="" 243 targs=""
244 else 244 else
245 ttype=$tuntype 245 ttype=$tuntype
246 targs="" 246 targs=""
247 fi 247 fi
248 248
249 # tunnel address family differs from inner for 249 # tunnel address family differs from inner for SIT
250 if [[ "${tuntype}" == "sit" ]]; then 250 if [[ "${tuntype}" == "sit" ]]; then
251 link_addr1="${ns1_v4}" 251 link_addr1="${ns1_v4}"
252 link_addr2="${ns2_v4}" 252 link_addr2="${ns2_v4}"
253 elif [[ "${tuntype}" == "ipip6" ]]; then 253 elif [[ "${tuntype}" == "ipip6" ]]; then
254 link_addr1="${ns1_v6}" 254 link_addr1="${ns1_v6}"
255 link_addr2="${ns2_v6}" 255 link_addr2="${ns2_v6}"
256 else 256 else
257 link_addr1="${addr1}" 257 link_addr1="${addr1}"
258 link_addr2="${addr2}" 258 link_addr2="${addr2}"
259 fi 259 fi
260 260
261 # serverside, insert decap module 261 # serverside, insert decap module
262 # server is still running 262 # server is still running
263 # client can connect again 263 # client can connect again
264 ip netns exec "${ns2}" ip link add name testtu 264 ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
265 ${tmode} remote "${link_addr1}" local 265 ${tmode} remote "${link_addr1}" local "${link_addr2}" $targs
266 266
267 expect_tun_fail=0 267 expect_tun_fail=0
268 268
269 if [[ "$tuntype" == "ip6udp" && "$mac" == "mpl 269 if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
270 # No support for MPLS IPv6 fou tunnel; 270 # No support for MPLS IPv6 fou tunnel; expect failure.
271 expect_tun_fail=1 271 expect_tun_fail=1
272 elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" 272 elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
273 # No support for TEB fou tunnel; expec 273 # No support for TEB fou tunnel; expect failure.
274 expect_tun_fail=1 274 expect_tun_fail=1
275 elif [[ "$tuntype" =~ (gre|vxlan) && "$mac" == 275 elif [[ "$tuntype" =~ (gre|vxlan) && "$mac" == "eth" ]]; then
276 # Share ethernet address between tunne 276 # Share ethernet address between tunnel/veth2 so L2 decap works.
277 ethaddr=$(ip netns exec "${ns2}" ip li 277 ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
278 awk '/ether/ { print $2 }') 278 awk '/ether/ { print $2 }')
279 ip netns exec "${ns2}" ip link set tes 279 ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
280 elif [[ "$mac" == "mpls" ]]; then 280 elif [[ "$mac" == "mpls" ]]; then
281 modprobe mpls_iptunnel ||true 281 modprobe mpls_iptunnel ||true
282 modprobe mpls_gso ||true 282 modprobe mpls_gso ||true
283 ip netns exec "${ns2}" sysctl -qw net. 283 ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
284 ip netns exec "${ns2}" ip -f mpls rout 284 ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
285 ip netns exec "${ns2}" ip link set lo 285 ip netns exec "${ns2}" ip link set lo up
286 ip netns exec "${ns2}" sysctl -qw net. 286 ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
287 ip netns exec "${ns2}" sysctl -qw net. 287 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
288 fi 288 fi
289 289
290 # Because packets are decapped by the tunnel t 290 # Because packets are decapped by the tunnel they arrive on testtun0 from
291 # the IP stack perspective. Ensure reverse pa 291 # the IP stack perspective. Ensure reverse path filtering is disabled
292 # otherwise we drop the TCP SYN as arriving on 292 # otherwise we drop the TCP SYN as arriving on testtun0 instead of the
293 # expected veth2 (veth2 is where 192.168.1.2 i 293 # expected veth2 (veth2 is where 192.168.1.2 is configured).
294 ip netns exec "${ns2}" sysctl -qw net.ipv4.con 294 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
295 # rp needs to be disabled for both all and tes 295 # rp needs to be disabled for both all and testtun0 as the rp value is
296 # selected as the max of the "all" and device- 296 # selected as the max of the "all" and device-specific values.
297 ip netns exec "${ns2}" sysctl -qw net.ipv4.con 297 ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
298 ip netns exec "${ns2}" ip link set dev testtun 298 ip netns exec "${ns2}" ip link set dev testtun0 up
299 if [[ "$expect_tun_fail" == 1 ]]; then 299 if [[ "$expect_tun_fail" == 1 ]]; then
300 # This tunnel mode is not supported, s 300 # This tunnel mode is not supported, so we expect failure.
301 echo "test bpf encap with tunnel devic 301 echo "test bpf encap with tunnel device decap (expect failure)"
302 ! client_connect 302 ! client_connect
303 else 303 else
304 echo "test bpf encap with tunnel devic 304 echo "test bpf encap with tunnel device decap"
305 client_connect 305 client_connect
306 verify_data 306 verify_data
307 server_listen 307 server_listen
308 fi 308 fi
309 309
310 # serverside, use BPF for decap 310 # serverside, use BPF for decap
311 ip netns exec "${ns2}" ip link del dev testtun 311 ip netns exec "${ns2}" ip link del dev testtun0
312 ip netns exec "${ns2}" tc qdisc add dev veth2 312 ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
313 ip netns exec "${ns2}" tc filter add dev veth2 313 ip netns exec "${ns2}" tc filter add dev veth2 ingress \
314 bpf direct-action object-file ${BPF_FI 314 bpf direct-action object-file ${BPF_FILE} section decap
315 echo "test bpf encap with bpf decap" 315 echo "test bpf encap with bpf decap"
316 client_connect 316 client_connect
317 verify_data 317 verify_data
318 318
319 echo OK 319 echo OK
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.