selftests/wireguard/netns.sh

38 n1() { pretty 1 "$*"; maybe_exec ip netns exec $netns1 "$@"; }
100 	n1 wg set wg0 \
121 	n1 ping -c 10 -f -W 1 192.168.241.2
125 	n1 ping6 -c 10 -f -W 1 fd00::2
130 	n1 iperf3 -Z -t 3 -c 192.168.241.2
133 	n1 iperf3 -s -1 -B fd00::1 &
138 	n1 iperf3 -s -1 -B 192.168.241.1 &
145 	n1 iperf3 -Z -t 3 -b 0 -u -c fd00::2
154 		n1 iperf3 -Z -t 3 -p $(( 5200 + i )) -c 192.168.241.2 &
163 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
173 read _ rx_bytes tx_bytes < <(n1 wg show wg0 transfer)
175 read _ timestamp < <(n1 wg show wg0 latest-handshakes)
187 n1 wg set wg0 peer "$pub2" endpoint [::1]:2
197 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
200 n1 ip route add 192.168.241.2/32 dev wg0 mtu 1299
204 n1 ip route delete 192.168.241.2/32 dev wg0 mtu 1299
213 n1 wg set wg0 listen-port 9999
214 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
215 n1 ping6 -W 1 -c 1 fd00::2
219 n1 wg set wg0 listen-port 9998
220 n1 wg set wg0 peer "$pub2" endpoint [::1]:2
221 n1 ping -W 1 -c 1 192.168.241.2
225 n1 wg set wg0 peer "$pub2" allowed-ips 192.168.241.0/24
226 exec 4< <(n1 ncat -l -u -p 1111)
233 n1 wg set wg0 peer "$more_specific_key" allowed-ips 192.168.241.2/32
235 exec 4< <(n1 ncat -l -u -p 1111)
241 n1 wg set wg0 peer "$more_specific_key" remove
242 [[ $(n1 wg show wg0 endpoints) == "$pub2	[::1]:9997" ]]
245 n1 wg set wg0 private-key <(echo "$key1") peer "$pub2" preshared-key <(echo "$psk") allowed-ips 192.168.241.2/32 endpoint 127.0.0.1:2
247 n1 ping -W 1 -c 1 192.168.241.2
248 n1 wg set wg0 private-key <(echo "$key3")
250 n1 ping -W 1 -c 1 192.168.241.2
258 n1 wg set wg0 private-key <(echo "$key1") peer "$pub2" preshared-key <(echo "$psk") allowed-ips fd00::5:2/128 endpoint 127.0.0.1:2
268 n1 wg set wg1 listen-port 5 private-key <(echo "$key3") peer "$pub4" allowed-ips 192.168.241.2/32,fd00::2/128 endpoint [fd00::5:2]:5
276 n1 wg set wg0 peer "$pub2" endpoint 192.168.241.2:7
339 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.100:2 persistent-keepalive 1
340 n1 ping -W 1 -c 1 192.168.241.2
343 # Demonstrate n2 can still send packets to n1, since persistent-keepalive will prevent connection tracking entry from expiring (to see entries: `n0 conntrack -L`).
346 n1 wg set wg0 peer "$pub2" persistent-keepalive 0
349 n1 ping -I wg0 -c 1 -W 1 192.168.241.2
351 n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1
352 n1 ping -c 1 -W 1 192.168.241.2 # First the boring case
353 n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case
354 n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1
357 n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5
363 n1 ping -W 1 -c 1 192.168.242.2
365 n1 wg set wg0 peer "$pub3" endpoint 192.168.242.2:5
366 ! n1 ping -W 1 -c 1 192.168.242.2 || false # Should not crash kernel
367 n1 wg set wg0 peer "$pub3" remove
375 n1 wg set wg0 fwmark 51820 peer "$pub2" allowed-ips 192.168.99.7,abab::1111
382 n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/vethc/rp_filter'
384 n1 ping -W 1 -c 100 -f 192.168.99.7
385 n1 ping -W 1 -c 100 -f abab::1111
420 n1 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/all/accept_dad'
422 n1 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/veth1/accept_dad'
424 n1 bash -c 'printf 1 > /proc/sys/net/ipv4/conf/veth1/promote_secondaries'
435 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.2:2
436 n1 ping -W 1 -c 1 192.168.241.2
439 n1 ping -W 1 -c 1 192.168.241.2
440 n1 wg set wg0 peer "$pub2" endpoint [fd00:aa::2]:2
441 n1 ping -W 1 -c 1 192.168.241.2
444 n1 ping -W 1 -c 1 192.168.241.2
506 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.2:2
507 n1 ping -W 1 -c 1 192.168.241.2
510 n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/veth1/rp_filter'
512 n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/all/rp_filter'
514 n1 ping -W 1 -c 1 192.168.241.2
523 n1 wg set wg0 private-key <(echo "$key1") peer "$pub2" endpoint 10.0.0.1:1 persistent-keepalive 1
524 read _ _ tx_bytes < <(n1 wg show wg0 transfer)
527 read _ _ tx_bytes < <(n1 wg show wg0 transfer)
532 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.1:1 persistent-keepalive 1
533 read _ _ tx_bytes < <(n1 wg show wg0 transfer)
536 read _ _ tx_bytes < <(n1 wg show wg0 transfer)
538 n1 wg set wg0 private-key <(echo "$key1")
539 read _ _ tx_bytes < <(n1 wg show wg0 transfer)
664 n1 wg set wg0 peer "$pub2" endpoint [fd00:aa::2]:2
666 n1 ping6 -c 1 fd00::2