1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# Copyright (c) 2019 David Ahern <dsahern@gmail.com>. All rights reserved.
5# Copyright (c) 2020 Michael Jeanson <mjeanson@efficios.com>. All rights reserved.
6#
7# Requires CONFIG_NET_VRF, CONFIG_VETH, CONFIG_BRIDGE and CONFIG_NET_NS.
8#
9#
10# Symmetric routing topology
11#
12#                     blue         red
13# +----+              .253 +----+ .253              +----+
14# | h1 |-------------------| r1 |-------------------| h2 |
15# +----+ .1                +----+                .2 +----+
16#         172.16.1/24                  172.16.2/24
17#    2001:db8:16:1/64                  2001:db8:16:2/64
18#
19#
20# Route from h1 to h2 and back goes through r1, incoming vrf blue has a route
21# to the outgoing vrf red for the n2 network and red has a route back to n1.
22# The red VRF interface has a MTU of 1400.
23#
24# The first test sends a ping with a ttl of 1 from h1 to h2 and parses the
25# output of the command to check that a ttl expired error is received.
26#
27# The second test runs traceroute from h1 to h2 and parses the output to check
28# for a hop on r1.
29#
30# The third test sends a ping with a packet size of 1450 from h1 to h2 and
31# parses the output of the command to check that a fragmentation error is
32# received.
33#
34#
35# Asymmetric routing topology
36#
37# This topology represents a customer setup where the issue with icmp errors
38# and VRF route leaking was initialy reported. The MTU test isn't done here
39# because of the lack of a return route in the red VRF.
40#
41#                     blue         red
42#                     .253 +----+ .253
43#                     +----| r1 |----+
44#                     |    +----+    |
45# +----+              |              |              +----+
46# | h1 |--------------+              +--------------| h2 |
47# +----+ .1           |              |           .2 +----+
48#         172.16.1/24 |    +----+    | 172.16.2/24
49#    2001:db8:16:1/64 +----| r2 |----+ 2001:db8:16:2/64
50#                     .254 +----+ .254
51#
52#
53# Route from h1 to h2 goes through r1, incoming vrf blue has a route to the
54# outgoing vrf red for the n2 network but red doesn't have a route back to n1.
55# Route from h2 to h1 goes through r2.
56#
57# The objective is to check that the incoming vrf routing table is selected
58# to send an ICMP error back to the source when the ttl of a packet reaches 1
59# while it is forwarded between different vrfs.
60
61source lib.sh
62VERBOSE=0
63PAUSE_ON_FAIL=no
64DEFAULT_TTYPE=sym
65
66H1_N1=172.16.1.0/24
67H1_N1_6=2001:db8:16:1::/64
68
69H1_N1_IP=172.16.1.1
70R1_N1_IP=172.16.1.253
71R2_N1_IP=172.16.1.254
72
73H1_N1_IP6=2001:db8:16:1::1
74R1_N1_IP6=2001:db8:16:1::253
75R2_N1_IP6=2001:db8:16:1::254
76
77H2_N2=172.16.2.0/24
78H2_N2_6=2001:db8:16:2::/64
79
80H2_N2_IP=172.16.2.2
81R1_N2_IP=172.16.2.253
82R2_N2_IP=172.16.2.254
83
84H2_N2_IP6=2001:db8:16:2::2
85R1_N2_IP6=2001:db8:16:2::253
86R2_N2_IP6=2001:db8:16:2::254
87
88################################################################################
89# helpers
90
91log_section()
92{
93	echo
94	echo "###########################################################################"
95	echo "$*"
96	echo "###########################################################################"
97	echo
98}
99
100log_test()
101{
102	local rc=$1
103	local expected=$2
104	local msg="$3"
105
106	if [ "${rc}" -eq "${expected}" ]; then
107		printf "TEST: %-60s  [ OK ]\n" "${msg}"
108		nsuccess=$((nsuccess+1))
109	else
110		ret=1
111		nfail=$((nfail+1))
112		printf "TEST: %-60s  [FAIL]\n" "${msg}"
113		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
114			echo
115			echo "hit enter to continue, 'q' to quit"
116			read -r a
117			[ "$a" = "q" ] && exit 1
118		fi
119	fi
120}
121
122run_cmd()
123{
124	local cmd="$*"
125	local out
126	local rc
127
128	if [ "$VERBOSE" = "1" ]; then
129		echo "COMMAND: $cmd"
130	fi
131
132	# shellcheck disable=SC2086
133	out=$(eval $cmd 2>&1)
134	rc=$?
135	if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
136		echo "$out"
137	fi
138
139	[ "$VERBOSE" = "1" ] && echo
140
141	return $rc
142}
143
144run_cmd_grep()
145{
146	local grep_pattern="$1"
147	shift
148	local cmd="$*"
149	local out
150	local rc
151
152	if [ "$VERBOSE" = "1" ]; then
153		echo "COMMAND: $cmd"
154	fi
155
156	# shellcheck disable=SC2086
157	out=$(eval $cmd 2>&1)
158	if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
159		echo "$out"
160	fi
161
162	echo "$out" | grep -q "$grep_pattern"
163	rc=$?
164
165	[ "$VERBOSE" = "1" ] && echo
166
167	return $rc
168}
169
170################################################################################
171# setup and teardown
172
173cleanup()
174{
175	cleanup_ns $h1 $h2 $r1 $r2
176}
177
178setup_vrf()
179{
180	local ns=$1
181
182	ip -netns "${ns}" rule del pref 0
183	ip -netns "${ns}" rule add pref 32765 from all lookup local
184	ip -netns "${ns}" -6 rule del pref 0
185	ip -netns "${ns}" -6 rule add pref 32765 from all lookup local
186}
187
188create_vrf()
189{
190	local ns=$1
191	local vrf=$2
192	local table=$3
193
194	ip -netns "${ns}" link add "${vrf}" type vrf table "${table}"
195	ip -netns "${ns}" link set "${vrf}" up
196	ip -netns "${ns}" route add vrf "${vrf}" unreachable default metric 8192
197	ip -netns "${ns}" -6 route add vrf "${vrf}" unreachable default metric 8192
198
199	ip -netns "${ns}" addr add 127.0.0.1/8 dev "${vrf}"
200	ip -netns "${ns}" -6 addr add ::1 dev "${vrf}" nodad
201}
202
203setup_sym()
204{
205	local ns
206
207	# make sure we are starting with a clean slate
208	cleanup
209
210	#
211	# create nodes as namespaces
212	setup_ns h1 h2 r1
213	for ns in $h1 $h2 $r1; do
214		if echo $ns | grep -q h[12]-; then
215			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
216			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
217		else
218			ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
219			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
220		fi
221	done
222
223	#
224	# create interconnects
225	#
226	ip -netns $h1 link add eth0 type veth peer name r1h1
227	ip -netns $h1 link set r1h1 netns $r1 name eth0 up
228
229	ip -netns $h2 link add eth0 type veth peer name r1h2
230	ip -netns $h2 link set r1h2 netns $r1 name eth1 up
231
232	#
233	# h1
234	#
235	ip -netns $h1 addr add dev eth0 ${H1_N1_IP}/24
236	ip -netns $h1 -6 addr add dev eth0 ${H1_N1_IP6}/64 nodad
237	ip -netns $h1 link set eth0 up
238
239	# h1 to h2 via r1
240	ip -netns $h1    route add ${H2_N2} via ${R1_N1_IP} dev eth0
241	ip -netns $h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev eth0
242
243	#
244	# h2
245	#
246	ip -netns $h2 addr add dev eth0 ${H2_N2_IP}/24
247	ip -netns $h2 -6 addr add dev eth0 ${H2_N2_IP6}/64 nodad
248	ip -netns $h2 link set eth0 up
249
250	# h2 to h1 via r1
251	ip -netns $h2 route add default via ${R1_N2_IP} dev eth0
252	ip -netns $h2 -6 route add default via ${R1_N2_IP6} dev eth0
253
254	#
255	# r1
256	#
257	setup_vrf $r1
258	create_vrf $r1 blue 1101
259	create_vrf $r1 red 1102
260	ip -netns $r1 link set mtu 1400 dev eth1
261	ip -netns $r1 link set eth0 vrf blue up
262	ip -netns $r1 link set eth1 vrf red up
263	ip -netns $r1 addr add dev eth0 ${R1_N1_IP}/24
264	ip -netns $r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
265	ip -netns $r1 addr add dev eth1 ${R1_N2_IP}/24
266	ip -netns $r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
267
268	# Route leak from blue to red
269	ip -netns $r1 route add vrf blue ${H2_N2} dev red
270	ip -netns $r1 -6 route add vrf blue ${H2_N2_6} dev red
271
272	# Route leak from red to blue
273	ip -netns $r1 route add vrf red ${H1_N1} dev blue
274	ip -netns $r1 -6 route add vrf red ${H1_N1_6} dev blue
275
276
277	# Wait for ip config to settle
278	sleep 2
279}
280
281setup_asym()
282{
283	local ns
284
285	# make sure we are starting with a clean slate
286	cleanup
287
288	#
289	# create nodes as namespaces
290	setup_ns h1 h2 r1 r2
291	for ns in $h1 $h2 $r1 $r2; do
292		if echo $ns | grep -q h[12]-; then
293			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
294			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
295		else
296			ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
297			ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
298		fi
299	done
300
301	#
302	# create interconnects
303	#
304	ip -netns $h1 link add eth0 type veth peer name r1h1
305	ip -netns $h1 link set r1h1 netns $r1 name eth0 up
306
307	ip -netns $h1 link add eth1 type veth peer name r2h1
308	ip -netns $h1 link set r2h1 netns $r2 name eth0 up
309
310	ip -netns $h2 link add eth0 type veth peer name r1h2
311	ip -netns $h2 link set r1h2 netns $r1 name eth1 up
312
313	ip -netns $h2 link add eth1 type veth peer name r2h2
314	ip -netns $h2 link set r2h2 netns $r2 name eth1 up
315
316	#
317	# h1
318	#
319	ip -netns $h1 link add br0 type bridge
320	ip -netns $h1 link set br0 up
321	ip -netns $h1 addr add dev br0 ${H1_N1_IP}/24
322	ip -netns $h1 -6 addr add dev br0 ${H1_N1_IP6}/64 nodad
323	ip -netns $h1 link set eth0 master br0 up
324	ip -netns $h1 link set eth1 master br0 up
325
326	# h1 to h2 via r1
327	ip -netns $h1    route add ${H2_N2} via ${R1_N1_IP} dev br0
328	ip -netns $h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev br0
329
330	#
331	# h2
332	#
333	ip -netns $h2 link add br0 type bridge
334	ip -netns $h2 link set br0 up
335	ip -netns $h2 addr add dev br0 ${H2_N2_IP}/24
336	ip -netns $h2 -6 addr add dev br0 ${H2_N2_IP6}/64 nodad
337	ip -netns $h2 link set eth0 master br0 up
338	ip -netns $h2 link set eth1 master br0 up
339
340	# h2 to h1 via r2
341	ip -netns $h2 route add default via ${R2_N2_IP} dev br0
342	ip -netns $h2 -6 route add default via ${R2_N2_IP6} dev br0
343
344	#
345	# r1
346	#
347	setup_vrf $r1
348	create_vrf $r1 blue 1101
349	create_vrf $r1 red 1102
350	ip -netns $r1 link set mtu 1400 dev eth1
351	ip -netns $r1 link set eth0 vrf blue up
352	ip -netns $r1 link set eth1 vrf red up
353	ip -netns $r1 addr add dev eth0 ${R1_N1_IP}/24
354	ip -netns $r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
355	ip -netns $r1 addr add dev eth1 ${R1_N2_IP}/24
356	ip -netns $r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
357
358	# Route leak from blue to red
359	ip -netns $r1 route add vrf blue ${H2_N2} dev red
360	ip -netns $r1 -6 route add vrf blue ${H2_N2_6} dev red
361
362	# No route leak from red to blue
363
364	#
365	# r2
366	#
367	ip -netns $r2 addr add dev eth0 ${R2_N1_IP}/24
368	ip -netns $r2 -6 addr add dev eth0 ${R2_N1_IP6}/64 nodad
369	ip -netns $r2 addr add dev eth1 ${R2_N2_IP}/24
370	ip -netns $r2 -6 addr add dev eth1 ${R2_N2_IP6}/64 nodad
371
372	# Wait for ip config to settle
373	sleep 2
374}
375
376check_connectivity()
377{
378	ip netns exec $h1 ping -c1 -w1 ${H2_N2_IP} >/dev/null 2>&1
379	log_test $? 0 "Basic IPv4 connectivity"
380	return $?
381}
382
383check_connectivity6()
384{
385	ip netns exec $h1 "${ping6}" -c1 -w1 ${H2_N2_IP6} >/dev/null 2>&1
386	log_test $? 0 "Basic IPv6 connectivity"
387	return $?
388}
389
390check_traceroute()
391{
392	if [ ! -x "$(command -v traceroute)" ]; then
393		echo "SKIP: Could not run IPV4 test without traceroute"
394		return 1
395	fi
396}
397
398check_traceroute6()
399{
400	if [ ! -x "$(command -v traceroute6)" ]; then
401		echo "SKIP: Could not run IPV6 test without traceroute6"
402		return 1
403	fi
404}
405
406ipv4_traceroute()
407{
408	local ttype="$1"
409
410	[ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
411
412	log_section "IPv4 ($ttype route): VRF ICMP error route lookup traceroute"
413
414	check_traceroute || return
415
416	setup_"$ttype"
417
418	check_connectivity || return
419
420	run_cmd_grep "${R1_N1_IP}" ip netns exec $h1 traceroute ${H2_N2_IP}
421	log_test $? 0 "Traceroute reports a hop on r1"
422}
423
424ipv4_traceroute_asym()
425{
426	ipv4_traceroute asym
427}
428
429ipv6_traceroute()
430{
431	local ttype="$1"
432
433	[ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
434
435	log_section "IPv6 ($ttype route): VRF ICMP error route lookup traceroute"
436
437	check_traceroute6 || return
438
439	setup_"$ttype"
440
441	check_connectivity6 || return
442
443	run_cmd_grep "${R1_N1_IP6}" ip netns exec $h1 traceroute6 ${H2_N2_IP6}
444	log_test $? 0 "Traceroute6 reports a hop on r1"
445}
446
447ipv6_traceroute_asym()
448{
449	ipv6_traceroute asym
450}
451
452ipv4_ping_ttl()
453{
454	local ttype="$1"
455
456	[ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
457
458	log_section "IPv4 ($ttype route): VRF ICMP ttl error route lookup ping"
459
460	setup_"$ttype"
461
462	check_connectivity || return
463
464	run_cmd_grep "Time to live exceeded" ip netns exec $h1 ping -t1 -c1 -W2 ${H2_N2_IP}
465	log_test $? 0 "Ping received ICMP ttl exceeded"
466}
467
468ipv4_ping_ttl_asym()
469{
470	ipv4_ping_ttl asym
471}
472
473ipv4_ping_frag()
474{
475	local ttype="$1"
476
477	[ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
478
479	log_section "IPv4 ($ttype route): VRF ICMP fragmentation error route lookup ping"
480
481	setup_"$ttype"
482
483	check_connectivity || return
484
485	run_cmd_grep "Frag needed" ip netns exec $h1 ping -s 1450 -Mdo -c1 -W2 ${H2_N2_IP}
486	log_test $? 0 "Ping received ICMP Frag needed"
487}
488
489ipv4_ping_frag_asym()
490{
491	ipv4_ping_frag asym
492}
493
494ipv6_ping_ttl()
495{
496	local ttype="$1"
497
498	[ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
499
500	log_section "IPv6 ($ttype route): VRF ICMP ttl error route lookup ping"
501
502	setup_"$ttype"
503
504	check_connectivity6 || return
505
506	run_cmd_grep "Time exceeded: Hop limit" ip netns exec $h1 "${ping6}" -t1 -c1 -W2 ${H2_N2_IP6}
507	log_test $? 0 "Ping received ICMP Hop limit"
508}
509
510ipv6_ping_ttl_asym()
511{
512	ipv6_ping_ttl asym
513}
514
515ipv6_ping_frag()
516{
517	local ttype="$1"
518
519	[ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
520
521	log_section "IPv6 ($ttype route): VRF ICMP fragmentation error route lookup ping"
522
523	setup_"$ttype"
524
525	check_connectivity6 || return
526
527	run_cmd_grep "Packet too big" ip netns exec $h1 "${ping6}" -s 1450 -Mdo -c1 -W2 ${H2_N2_IP6}
528	log_test $? 0 "Ping received ICMP Packet too big"
529}
530
531ipv6_ping_frag_asym()
532{
533	ipv6_ping_frag asym
534}
535
536################################################################################
537# usage
538
539usage()
540{
541        cat <<EOF
542usage: ${0##*/} OPTS
543
544	-4          Run IPv4 tests only
545	-6          Run IPv6 tests only
546        -t TEST     Run only TEST
547	-p          Pause on fail
548	-v          verbose mode (show commands and output)
549EOF
550}
551
552################################################################################
553# main
554
555# Some systems don't have a ping6 binary anymore
556command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping)
557
558TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym"
559TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_ttl_asym ipv6_traceroute_asym"
560
561ret=0
562nsuccess=0
563nfail=0
564
565while getopts :46t:pvh o
566do
567	case $o in
568		4) TESTS=ipv4;;
569		6) TESTS=ipv6;;
570		t) TESTS=$OPTARG;;
571		p) PAUSE_ON_FAIL=yes;;
572		v) VERBOSE=1;;
573		h) usage; exit 0;;
574		*) usage; exit 1;;
575	esac
576done
577
578#
579# show user test config
580#
581if [ -z "$TESTS" ]; then
582        TESTS="$TESTS_IPV4 $TESTS_IPV6"
583elif [ "$TESTS" = "ipv4" ]; then
584        TESTS="$TESTS_IPV4"
585elif [ "$TESTS" = "ipv6" ]; then
586        TESTS="$TESTS_IPV6"
587fi
588
589for t in $TESTS
590do
591	case $t in
592	ipv4_ping_ttl|ping)              ipv4_ping_ttl;;&
593	ipv4_ping_ttl_asym|ping)         ipv4_ping_ttl_asym;;&
594	ipv4_traceroute|traceroute)      ipv4_traceroute;;&
595	ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;&
596	ipv4_ping_frag|ping)             ipv4_ping_frag;;&
597
598	ipv6_ping_ttl|ping)              ipv6_ping_ttl;;&
599	ipv6_ping_ttl_asym|ping)         ipv6_ping_ttl_asym;;&
600	ipv6_traceroute|traceroute)      ipv6_traceroute;;&
601	ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;&
602	ipv6_ping_frag|ping)             ipv6_ping_frag;;&
603
604	# setup namespaces and config, but do not run any tests
605	setup_sym|setup)                 setup_sym; exit 0;;
606	setup_asym)                      setup_asym; exit 0;;
607
608	help)                       echo "Test names: $TESTS"; exit 0;;
609	esac
610done
611
612cleanup
613
614printf "\nTests passed: %3d\n" ${nsuccess}
615printf "Tests failed: %3d\n"   ${nfail}
616
617exit $ret
618