tools/testing/selftests/wireguard/netns.sh

   1 #!/bin/bash
   2 # SPDX-License-Identifier: GPL-2.0
   3 #
   4 # Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
   5 #
   6 # This script tests the below topology:
   7 #
   8 # ┌─────────────────────┐   ┌──────────────────────────────────┐   ┌─────────────────────┐
   9 # │   $ns1 namespace    │   │          $ns0 namespace          │   │   $ns2 namespace    │
  10 # │                     │   │                                  │   │                     │
  11 # │┌────────┐           │   │            ┌────────┐            │   │           ┌────────┐│
  12 # ││  wg0   │───────────┼───┼────────────│   lo   │────────────┼───┼───────────│  wg0   ││
  13 # │├────────┴──────────┐│   │    ┌───────┴────────┴────────┐   │   │┌──────────┴────────┤│
  14 # ││192.168.241.1/24   ││   │    │(ns1)         (ns2)      │   │   ││192.168.241.2/24   ││
  15 # ││fd00::1/24         ││   │    │127.0.0.1:1   127.0.0.1:2│   │   ││fd00::2/24         ││
  16 # │└───────────────────┘│   │    │[::]:1        [::]:2     │   │   │└───────────────────┘│
  17 # └─────────────────────┘   │    └─────────────────────────┘   │   └─────────────────────┘
  18 #                           └──────────────────────────────────┘
  19 #
  20 # After the topology is prepared we run a series of TCP/UDP iperf3 tests between the
  21 # wireguard peers in $ns1 and $ns2. Note that $ns0 is the endpoint for the wg0
  22 # interfaces in $ns1 and $ns2. See https://www.wireguard.com/netns/ for further
  23 # details on how this is accomplished.
  24 set -e
  25
  26 exec 3>&1
  27 export WG_HIDE_KEYS=never
  28 netns0="wg-test-$$-0"
  29 netns1="wg-test-$$-1"
  30 netns2="wg-test-$$-2"
  31 pretty() { echo -e "\x1b[32m\x1b[1m[+] ${1:+NS$1: }${2}\x1b[0m" >&3; }
  32 pp() { pretty "" "$*"; "$@"; }
  33 maybe_exec() { if [[ $BASHPID -eq $$ ]]; then "$@"; else exec "$@"; fi; }
  34 n0() { pretty 0 "$*"; maybe_exec ip netns exec $netns0 "$@"; }
  35 n1() { pretty 1 "$*"; maybe_exec ip netns exec $netns1 "$@"; }
  36 n2() { pretty 2 "$*"; maybe_exec ip netns exec $netns2 "$@"; }
  37 ip0() { pretty 0 "ip $*"; ip -n $netns0 "$@"; }
  38 ip1() { pretty 1 "ip $*"; ip -n $netns1 "$@"; }
  39 ip2() { pretty 2 "ip $*"; ip -n $netns2 "$@"; }
  40 sleep() { read -t "$1" -N 1 || true; }
  41 waitiperf() { pretty "${1//*-}" "wait for iperf:5201"; while [[ $(ss -N "$1" -tlp 'sport = 5201') != *iperf3* ]]; do sleep 0.1; done; }
  42 waitncatudp() { pretty "${1//*-}" "wait for udp:1111"; while [[ $(ss -N "$1" -ulp 'sport = 1111') != *ncat* ]]; do sleep 0.1; done; }
  43 waitncattcp() { pretty "${1//*-}" "wait for tcp:1111"; while [[ $(ss -N "$1" -tlp 'sport = 1111') != *ncat* ]]; do sleep 0.1; done; }
  44 waitiface() { pretty "${1//*-}" "wait for $2 to come up"; ip netns exec "$1" bash -c "while [[ \$(< \"/sys/class/net/$2/operstate\") != up ]]; do read -t .1 -N 0 || true; done;"; }
  45
  46 cleanup() {
  47         set +e
  48         exec 2>/dev/null
  49         printf "$orig_message_cost" > /proc/sys/net/core/message_cost
  50         ip0 link del dev wg0
  51         ip1 link del dev wg0
  52         ip2 link del dev wg0
  53         local to_kill="$(ip netns pids $netns0) $(ip netns pids $netns1) $(ip netns pids $netns2)"
  54         [[ -n $to_kill ]] && kill $to_kill
  55         pp ip netns del $netns1
  56         pp ip netns del $netns2
  57         pp ip netns del $netns0
  58         exit
  59 }
  60
  61 orig_message_cost="$(< /proc/sys/net/core/message_cost)"
  62 trap cleanup EXIT
  63 printf 0 > /proc/sys/net/core/message_cost
  64
  65 ip netns del $netns0 2>/dev/null || true
  66 ip netns del $netns1 2>/dev/null || true
  67 ip netns del $netns2 2>/dev/null || true
  68 pp ip netns add $netns0
  69 pp ip netns add $netns1
  70 pp ip netns add $netns2
  71 ip0 link set up dev lo
  72
  73 ip0 link add dev wg0 type wireguard
  74 ip0 link set wg0 netns $netns1
  75 ip0 link add dev wg0 type wireguard
  76 ip0 link set wg0 netns $netns2
  77 key1="$(pp wg genkey)"
  78 key2="$(pp wg genkey)"
  79 key3="$(pp wg genkey)"
  80 pub1="$(pp wg pubkey <<<"$key1")"
  81 pub2="$(pp wg pubkey <<<"$key2")"
  82 pub3="$(pp wg pubkey <<<"$key3")"
  83 psk="$(pp wg genpsk)"
  84 [[ -n $key1 && -n $key2 && -n $psk ]]
  85
  86 configure_peers() {
  87         ip1 addr add 192.168.241.1/24 dev wg0
  88         ip1 addr add fd00::1/24 dev wg0
  89
  90         ip2 addr add 192.168.241.2/24 dev wg0
  91         ip2 addr add fd00::2/24 dev wg0
  92
  93         n1 wg set wg0 \
  94                 private-key <(echo "$key1") \
  95                 listen-port 1 \
  96                 peer "$pub2" \
  97                         preshared-key <(echo "$psk") \
  98                         allowed-ips 192.168.241.2/32,fd00::2/128
  99         n2 wg set wg0 \
 100                 private-key <(echo "$key2") \
 101                 listen-port 2 \
 102                 peer "$pub1" \
 103                         preshared-key <(echo "$psk") \
 104                         allowed-ips 192.168.241.1/32,fd00::1/128
 105
 106         ip1 link set up dev wg0
 107         ip2 link set up dev wg0
 108 }
 109 configure_peers
 110
 111 tests() {
 112         # Ping over IPv4
 113         n2 ping -c 10 -f -W 1 192.168.241.1
 114         n1 ping -c 10 -f -W 1 192.168.241.2
 115
 116         # Ping over IPv6
 117         n2 ping6 -c 10 -f -W 1 fd00::1
 118         n1 ping6 -c 10 -f -W 1 fd00::2
 119
 120         # TCP over IPv4
 121         n2 iperf3 -s -1 -B 192.168.241.2 &
 122         waitiperf $netns2
 123         n1 iperf3 -Z -t 3 -c 192.168.241.2
 124
 125         # TCP over IPv6
 126         n1 iperf3 -s -1 -B fd00::1 &
 127         waitiperf $netns1
 128         n2 iperf3 -Z -t 3 -c fd00::1
 129
 130         # UDP over IPv4
 131         n1 iperf3 -s -1 -B 192.168.241.1 &
 132         waitiperf $netns1
 133         n2 iperf3 -Z -t 3 -b 0 -u -c 192.168.241.1
 134
 135         # UDP over IPv6
 136         n2 iperf3 -s -1 -B fd00::2 &
 137         waitiperf $netns2
 138         n1 iperf3 -Z -t 3 -b 0 -u -c fd00::2
 139 }
 140
 141 [[ $(ip1 link show dev wg0) =~ mtu\ ([0-9]+) ]] && orig_mtu="${BASH_REMATCH[1]}"
 142 big_mtu=$(( 34816 - 1500 + $orig_mtu ))
 143
 144 # Test using IPv4 as outer transport
 145 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
 146 n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1
 147 # Before calling tests, we first make sure that the stats counters and timestamper are working
 148 n2 ping -c 10 -f -W 1 192.168.241.1
 149 { read _; read _; read _; read rx_bytes _; read _; read tx_bytes _; } < <(ip2 -stats link show dev wg0)
 150 (( rx_bytes == 1372 && (tx_bytes == 1428 || tx_bytes == 1460) ))
 151 { read _; read _; read _; read rx_bytes _; read _; read tx_bytes _; } < <(ip1 -stats link show dev wg0)
 152 (( tx_bytes == 1372 && (rx_bytes == 1428 || rx_bytes == 1460) ))
 153 read _ rx_bytes tx_bytes < <(n2 wg show wg0 transfer)
 154 (( rx_bytes == 1372 && (tx_bytes == 1428 || tx_bytes == 1460) ))
 155 read _ rx_bytes tx_bytes < <(n1 wg show wg0 transfer)
 156 (( tx_bytes == 1372 && (rx_bytes == 1428 || rx_bytes == 1460) ))
 157 read _ timestamp < <(n1 wg show wg0 latest-handshakes)
 158 (( timestamp != 0 ))
 159
 160 tests
 161 ip1 link set wg0 mtu $big_mtu
 162 ip2 link set wg0 mtu $big_mtu
 163 tests
 164
 165 ip1 link set wg0 mtu $orig_mtu
 166 ip2 link set wg0 mtu $orig_mtu
 167
 168 # Test using IPv6 as outer transport
 169 n1 wg set wg0 peer "$pub2" endpoint [::1]:2
 170 n2 wg set wg0 peer "$pub1" endpoint [::1]:1
 171 tests
 172 ip1 link set wg0 mtu $big_mtu
 173 ip2 link set wg0 mtu $big_mtu
 174 tests
 175
 176 # Test that route MTUs work with the padding
 177 ip1 link set wg0 mtu 1300
 178 ip2 link set wg0 mtu 1300
 179 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
 180 n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1
 181 n0 iptables -A INPUT -m length --length 1360 -j DROP
 182 n1 ip route add 192.168.241.2/32 dev wg0 mtu 1299
 183 n2 ip route add 192.168.241.1/32 dev wg0 mtu 1299
 184 n2 ping -c 1 -W 1 -s 1269 192.168.241.1
 185 n2 ip route delete 192.168.241.1/32 dev wg0 mtu 1299
 186 n1 ip route delete 192.168.241.2/32 dev wg0 mtu 1299
 187 n0 iptables -F INPUT
 188
 189 ip1 link set wg0 mtu $orig_mtu
 190 ip2 link set wg0 mtu $orig_mtu
 191
 192 # Test using IPv4 that roaming works
 193 ip0 -4 addr del 127.0.0.1/8 dev lo
 194 ip0 -4 addr add 127.212.121.99/8 dev lo
 195 n1 wg set wg0 listen-port 9999
 196 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
 197 n1 ping6 -W 1 -c 1 fd00::2
 198 [[ $(n2 wg show wg0 endpoints) == "$pub1        127.212.121.99:9999" ]]
 199
 200 # Test using IPv6 that roaming works
 201 n1 wg set wg0 listen-port 9998
 202 n1 wg set wg0 peer "$pub2" endpoint [::1]:2
 203 n1 ping -W 1 -c 1 192.168.241.2
 204 [[ $(n2 wg show wg0 endpoints) == "$pub1        [::1]:9998" ]]
 205
 206 # Test that crypto-RP filter works
 207 n1 wg set wg0 peer "$pub2" allowed-ips 192.168.241.0/24
 208 exec 4< <(n1 ncat -l -u -p 1111)
 209 ncat_pid=$!
 210 waitncatudp $netns1
 211 n2 ncat -u 192.168.241.1 1111 <<<"X"
 212 read -r -N 1 -t 1 out <&4 && [[ $out == "X" ]]
 213 kill $ncat_pid
 214 more_specific_key="$(pp wg genkey | pp wg pubkey)"
 215 n1 wg set wg0 peer "$more_specific_key" allowed-ips 192.168.241.2/32
 216 n2 wg set wg0 listen-port 9997
 217 exec 4< <(n1 ncat -l -u -p 1111)
 218 ncat_pid=$!
 219 waitncatudp $netns1
 220 n2 ncat -u 192.168.241.1 1111 <<<"X"
 221 ! read -r -N 1 -t 1 out <&4 || false
 222 kill $ncat_pid
 223 n1 wg set wg0 peer "$more_specific_key" remove
 224 [[ $(n1 wg show wg0 endpoints) == "$pub2        [::1]:9997" ]]
 225
 226 # Test that we can change private keys keys and immediately handshake
 227 n1 wg set wg0 private-key <(echo "$key1") peer "$pub2" preshared-key <(echo "$psk") allowed-ips 192.168.241.2/32 endpoint 127.0.0.1:2
 228 n2 wg set wg0 private-key <(echo "$key2") listen-port 2 peer "$pub1" preshared-key <(echo "$psk") allowed-ips 192.168.241.1/32
 229 n1 ping -W 1 -c 1 192.168.241.2
 230 n1 wg set wg0 private-key <(echo "$key3")
 231 n2 wg set wg0 peer "$pub3" preshared-key <(echo "$psk") allowed-ips 192.168.241.1/32 peer "$pub1" remove
 232 n1 ping -W 1 -c 1 192.168.241.2
 233
 234 ip1 link del wg0
 235 ip2 link del wg0
 236
 237 # Test using NAT. We now change the topology to this:
 238 # ┌────────────────────────────────────────┐    ┌────────────────────────────────────────────────┐     ┌────────────────────────────────────────┐
 239 # │             $ns1 namespace             │    │                 $ns0 namespace                 │     │             $ns2 namespace             │
 240 # │                                        │    │                                                │     │                                        │
 241 # │  ┌─────┐             ┌─────┐           │    │    ┌──────┐              ┌──────┐              │     │  ┌─────┐            ┌─────┐            │
 242 # │  │ wg0 │─────────────│vethc│───────────┼────┼────│vethrc│              │vethrs│──────────────┼─────┼──│veths│────────────│ wg0 │            │
 243 # │  ├─────┴──────────┐  ├─────┴──────────┐│    │    ├──────┴─────────┐    ├──────┴────────────┐ │     │  ├─────┴──────────┐ ├─────┴──────────┐ │
 244 # │  │192.168.241.1/24│  │192.168.1.100/24││    │    │192.168.1.1/24  │    │10.0.0.1/24        │ │     │  │10.0.0.100/24   │ │192.168.241.2/24│ │
 245 # │  │fd00::1/24      │  │                ││    │    │                │    │SNAT:192.168.1.0/24│ │     │  │                │ │fd00::2/24      │ │
 246 # │  └────────────────┘  └────────────────┘│    │    └────────────────┘    └───────────────────┘ │     │  └────────────────┘ └────────────────┘ │
 247 # └────────────────────────────────────────┘    └────────────────────────────────────────────────┘     └────────────────────────────────────────┘
 248
 249 ip1 link add dev wg0 type wireguard
 250 ip2 link add dev wg0 type wireguard
 251 configure_peers
 252
 253 ip0 link add vethrc type veth peer name vethc
 254 ip0 link add vethrs type veth peer name veths
 255 ip0 link set vethc netns $netns1
 256 ip0 link set veths netns $netns2
 257 ip0 link set vethrc up
 258 ip0 link set vethrs up
 259 ip0 addr add 192.168.1.1/24 dev vethrc
 260 ip0 addr add 10.0.0.1/24 dev vethrs
 261 ip1 addr add 192.168.1.100/24 dev vethc
 262 ip1 link set vethc up
 263 ip1 route add default via 192.168.1.1
 264 ip2 addr add 10.0.0.100/24 dev veths
 265 ip2 link set veths up
 266 waitiface $netns0 vethrc
 267 waitiface $netns0 vethrs
 268 waitiface $netns1 vethc
 269 waitiface $netns2 veths
 270
 271 n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'
 272 n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout'
 273 n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream'
 274 n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT --to 10.0.0.1
 275
 276 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.100:2 persistent-keepalive 1
 277 n1 ping -W 1 -c 1 192.168.241.2
 278 n2 ping -W 1 -c 1 192.168.241.1
 279 [[ $(n2 wg show wg0 endpoints) == "$pub1        10.0.0.1:1" ]]
 280 # Demonstrate n2 can still send packets to n1, since persistent-keepalive will prevent connection tracking entry from expiring (to see entries: `n0 conntrack -L`).
 281 pp sleep 3
 282 n2 ping -W 1 -c 1 192.168.241.1
 283 n1 wg set wg0 peer "$pub2" persistent-keepalive 0
 284
 285 # Do a wg-quick(8)-style policy routing for the default route, making sure vethc has a v6 address to tease out bugs.
 286 ip1 -6 addr add fc00::9/96 dev vethc
 287 ip1 -6 route add default via fc00::1
 288 ip2 -4 addr add 192.168.99.7/32 dev wg0
 289 ip2 -6 addr add abab::1111/128 dev wg0
 290 n1 wg set wg0 fwmark 51820 peer "$pub2" allowed-ips 192.168.99.7,abab::1111
 291 ip1 -6 route add default dev wg0 table 51820
 292 ip1 -6 rule add not fwmark 51820 table 51820
 293 ip1 -6 rule add table main suppress_prefixlength 0
 294 ip1 -4 route add default dev wg0 table 51820
 295 ip1 -4 rule add not fwmark 51820 table 51820
 296 ip1 -4 rule add table main suppress_prefixlength 0
 297 # Flood the pings instead of sending just one, to trigger routing table reference counting bugs.
 298 n1 ping -W 1 -c 100 -f 192.168.99.7
 299 n1 ping -W 1 -c 100 -f abab::1111
 300
 301 n0 iptables -t nat -F
 302 ip0 link del vethrc
 303 ip0 link del vethrs
 304 ip1 link del wg0
 305 ip2 link del wg0
 306
 307 # Test that saddr routing is sticky but not too sticky, changing to this topology:
 308 # ┌────────────────────────────────────────┐    ┌────────────────────────────────────────┐
 309 # │             $ns1 namespace             │    │             $ns2 namespace             │
 310 # │                                        │    │                                        │
 311 # │  ┌─────┐             ┌─────┐           │    │  ┌─────┐            ┌─────┐            │
 312 # │  │ wg0 │─────────────│veth1│───────────┼────┼──│veth2│────────────│ wg0 │            │
 313 # │  ├─────┴──────────┐  ├─────┴──────────┐│    │  ├─────┴──────────┐ ├─────┴──────────┐ │
 314 # │  │192.168.241.1/24│  │10.0.0.1/24     ││    │  │10.0.0.2/24     │ │192.168.241.2/24│ │
 315 # │  │fd00::1/24      │  │fd00:aa::1/96   ││    │  │fd00:aa::2/96   │ │fd00::2/24      │ │
 316 # │  └────────────────┘  └────────────────┘│    │  └────────────────┘ └────────────────┘ │
 317 # └────────────────────────────────────────┘    └────────────────────────────────────────┘
 318
 319 ip1 link add dev wg0 type wireguard
 320 ip2 link add dev wg0 type wireguard
 321 configure_peers
 322 ip1 link add veth1 type veth peer name veth2
 323 ip1 link set veth2 netns $netns2
 324 n1 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/all/accept_dad'
 325 n2 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/all/accept_dad'
 326 n1 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/veth1/accept_dad'
 327 n2 bash -c 'printf 0 > /proc/sys/net/ipv6/conf/veth2/accept_dad'
 328 n1 bash -c 'printf 1 > /proc/sys/net/ipv4/conf/veth1/promote_secondaries'
 329
 330 # First we check that we aren't overly sticky and can fall over to new IPs when old ones are removed
 331 ip1 addr add 10.0.0.1/24 dev veth1
 332 ip1 addr add fd00:aa::1/96 dev veth1
 333 ip2 addr add 10.0.0.2/24 dev veth2
 334 ip2 addr add fd00:aa::2/96 dev veth2
 335 ip1 link set veth1 up
 336 ip2 link set veth2 up
 337 waitiface $netns1 veth1
 338 waitiface $netns2 veth2
 339 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.2:2
 340 n1 ping -W 1 -c 1 192.168.241.2
 341 ip1 addr add 10.0.0.10/24 dev veth1
 342 ip1 addr del 10.0.0.1/24 dev veth1
 343 n1 ping -W 1 -c 1 192.168.241.2
 344 n1 wg set wg0 peer "$pub2" endpoint [fd00:aa::2]:2
 345 n1 ping -W 1 -c 1 192.168.241.2
 346 ip1 addr add fd00:aa::10/96 dev veth1
 347 ip1 addr del fd00:aa::1/96 dev veth1
 348 n1 ping -W 1 -c 1 192.168.241.2
 349
 350 # Now we show that we can successfully do reply to sender routing
 351 ip1 link set veth1 down
 352 ip2 link set veth2 down
 353 ip1 addr flush dev veth1
 354 ip2 addr flush dev veth2
 355 ip1 addr add 10.0.0.1/24 dev veth1
 356 ip1 addr add 10.0.0.2/24 dev veth1
 357 ip1 addr add fd00:aa::1/96 dev veth1
 358 ip1 addr add fd00:aa::2/96 dev veth1
 359 ip2 addr add 10.0.0.3/24 dev veth2
 360 ip2 addr add fd00:aa::3/96 dev veth2
 361 ip1 link set veth1 up
 362 ip2 link set veth2 up
 363 waitiface $netns1 veth1
 364 waitiface $netns2 veth2
 365 n2 wg set wg0 peer "$pub1" endpoint 10.0.0.1:1
 366 n2 ping -W 1 -c 1 192.168.241.1
 367 [[ $(n2 wg show wg0 endpoints) == "$pub1        10.0.0.1:1" ]]
 368 n2 wg set wg0 peer "$pub1" endpoint [fd00:aa::1]:1
 369 n2 ping -W 1 -c 1 192.168.241.1
 370 [[ $(n2 wg show wg0 endpoints) == "$pub1        [fd00:aa::1]:1" ]]
 371 n2 wg set wg0 peer "$pub1" endpoint 10.0.0.2:1
 372 n2 ping -W 1 -c 1 192.168.241.1
 373 [[ $(n2 wg show wg0 endpoints) == "$pub1        10.0.0.2:1" ]]
 374 n2 wg set wg0 peer "$pub1" endpoint [fd00:aa::2]:1
 375 n2 ping -W 1 -c 1 192.168.241.1
 376 [[ $(n2 wg show wg0 endpoints) == "$pub1        [fd00:aa::2]:1" ]]
 377
 378 # What happens if the inbound destination address belongs to a different interface as the default route?
 379 ip1 link add dummy0 type dummy
 380 ip1 addr add 10.50.0.1/24 dev dummy0
 381 ip1 link set dummy0 up
 382 ip2 route add 10.50.0.0/24 dev veth2
 383 n2 wg set wg0 peer "$pub1" endpoint 10.50.0.1:1
 384 n2 ping -W 1 -c 1 192.168.241.1
 385 [[ $(n2 wg show wg0 endpoints) == "$pub1        10.50.0.1:1" ]]
 386
 387 ip1 link del dummy0
 388 ip1 addr flush dev veth1
 389 ip2 addr flush dev veth2
 390 ip1 route flush dev veth1
 391 ip2 route flush dev veth2
 392
 393 # Now we see what happens if another interface route takes precedence over an ongoing one
 394 ip1 link add veth3 type veth peer name veth4
 395 ip1 link set veth4 netns $netns2
 396 ip1 addr add 10.0.0.1/24 dev veth1
 397 ip2 addr add 10.0.0.2/24 dev veth2
 398 ip1 addr add 10.0.0.3/24 dev veth3
 399 ip1 link set veth1 up
 400 ip2 link set veth2 up
 401 ip1 link set veth3 up
 402 ip2 link set veth4 up
 403 waitiface $netns1 veth1
 404 waitiface $netns2 veth2
 405 waitiface $netns1 veth3
 406 waitiface $netns2 veth4
 407 ip1 route flush dev veth1
 408 ip1 route flush dev veth3
 409 ip1 route add 10.0.0.0/24 dev veth1 src 10.0.0.1 metric 2
 410 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.2:2
 411 n1 ping -W 1 -c 1 192.168.241.2
 412 [[ $(n2 wg show wg0 endpoints) == "$pub1        10.0.0.1:1" ]]
 413 ip1 route add 10.0.0.0/24 dev veth3 src 10.0.0.3 metric 1
 414 n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/veth1/rp_filter'
 415 n2 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/veth4/rp_filter'
 416 n1 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/all/rp_filter'
 417 n2 bash -c 'printf 0 > /proc/sys/net/ipv4/conf/all/rp_filter'
 418 n1 ping -W 1 -c 1 192.168.241.2
 419 [[ $(n2 wg show wg0 endpoints) == "$pub1        10.0.0.3:1" ]]
 420
 421 ip1 link del veth1
 422 ip1 link del veth3
 423 ip1 link del wg0
 424 ip2 link del wg0
 425
 426 # We test that Netlink/IPC is working properly by doing things that usually cause split responses
 427 ip0 link add dev wg0 type wireguard
 428 config=( "[Interface]" "PrivateKey=$(wg genkey)" "[Peer]" "PublicKey=$(wg genkey)" )
 429 for a in {1..255}; do
 430         for b in {0..255}; do
 431                 config+=( "AllowedIPs=$a.$b.0.0/16,$a::$b/128" )
 432         done
 433 done
 434 n0 wg setconf wg0 <(printf '%s\n' "${config[@]}")
 435 i=0
 436 for ip in $(n0 wg show wg0 allowed-ips); do
 437         ((++i))
 438 done
 439 ((i == 255*256*2+1))
 440 ip0 link del wg0
 441 ip0 link add dev wg0 type wireguard
 442 config=( "[Interface]" "PrivateKey=$(wg genkey)" )
 443 for a in {1..40}; do
 444         config+=( "[Peer]" "PublicKey=$(wg genkey)" )
 445         for b in {1..52}; do
 446                 config+=( "AllowedIPs=$a.$b.0.0/16" )
 447         done
 448 done
 449 n0 wg setconf wg0 <(printf '%s\n' "${config[@]}")
 450 i=0
 451 while read -r line; do
 452         j=0
 453         for ip in $line; do
 454                 ((++j))
 455         done
 456         ((j == 53))
 457         ((++i))
 458 done < <(n0 wg show wg0 allowed-ips)
 459 ((i == 40))
 460 ip0 link del wg0
 461 ip0 link add wg0 type wireguard
 462 config=( )
 463 for i in {1..29}; do
 464         config+=( "[Peer]" "PublicKey=$(wg genkey)" )
 465 done
 466 config+=( "[Peer]" "PublicKey=$(wg genkey)" "AllowedIPs=255.2.3.4/32,abcd::255/128" )
 467 n0 wg setconf wg0 <(printf '%s\n' "${config[@]}")
 468 n0 wg showconf wg0 > /dev/null
 469 ip0 link del wg0
 470
 471 allowedips=( )
 472 for i in {1..197}; do
 473         allowedips+=( abcd::$i )
 474 done
 475 saved_ifs="$IFS"
 476 IFS=,
 477 allowedips="${allowedips[*]}"
 478 IFS="$saved_ifs"
 479 ip0 link add wg0 type wireguard
 480 n0 wg set wg0 peer "$pub1"
 481 n0 wg set wg0 peer "$pub2" allowed-ips "$allowedips"
 482 {
 483         read -r pub allowedips
 484         [[ $pub == "$pub1" && $allowedips == "(none)" ]]
 485         read -r pub allowedips
 486         [[ $pub == "$pub2" ]]
 487         i=0
 488         for _ in $allowedips; do
 489                 ((++i))
 490         done
 491         ((i == 197))
 492 } < <(n0 wg show wg0 allowed-ips)
 493 ip0 link del wg0
 494
 495 ! n0 wg show doesnotexist || false
 496
 497 ip0 link add wg0 type wireguard
 498 n0 wg set wg0 private-key <(echo "$key1") peer "$pub2" preshared-key <(echo "$psk")
 499 [[ $(n0 wg show wg0 private-key) == "$key1" ]]
 500 [[ $(n0 wg show wg0 preshared-keys) == "$pub2   $psk" ]]
 501 n0 wg set wg0 private-key /dev/null peer "$pub2" preshared-key /dev/null
 502 [[ $(n0 wg show wg0 private-key) == "(none)" ]]
 503 [[ $(n0 wg show wg0 preshared-keys) == "$pub2   (none)" ]]
 504 n0 wg set wg0 peer "$pub2"
 505 n0 wg set wg0 private-key <(echo "$key2")
 506 [[ $(n0 wg show wg0 public-key) == "$pub2" ]]
 507 [[ -z $(n0 wg show wg0 peers) ]]
 508 n0 wg set wg0 peer "$pub2"
 509 [[ -z $(n0 wg show wg0 peers) ]]
 510 n0 wg set wg0 private-key <(echo "$key1")
 511 n0 wg set wg0 peer "$pub2"
 512 [[ $(n0 wg show wg0 peers) == "$pub2" ]]
 513 n0 wg set wg0 private-key <(echo "/${key1:1}")
 514 [[ $(n0 wg show wg0 private-key) == "+${key1:1}" ]]
 515 n0 wg set wg0 peer "$pub2" allowed-ips 0.0.0.0/0,10.0.0.0/8,100.0.0.0/10,172.16.0.0/12,192.168.0.0/16
 516 n0 wg set wg0 peer "$pub2" allowed-ips 0.0.0.0/0
 517 n0 wg set wg0 peer "$pub2" allowed-ips ::/0,1700::/111,5000::/4,e000::/37,9000::/75
 518 n0 wg set wg0 peer "$pub2" allowed-ips ::/0
 519 ip0 link del wg0
 520
 521 declare -A objects
 522 while read -t 0.1 -r line 2>/dev/null || [[ $? -ne 142 ]]; do
 523         [[ $line =~ .*(wg[0-9]+:\ [A-Z][a-z]+\ [0-9]+)\ .*(created|destroyed).* ]] || continue
 524         objects["${BASH_REMATCH[1]}"]+="${BASH_REMATCH[2]}"
 525 done < /dev/kmsg
 526 alldeleted=1
 527 for object in "${!objects[@]}"; do
 528         if [[ ${objects["$object"]} != *createddestroyed ]]; then
 529                 echo "Error: $object: merely ${objects["$object"]}" >&3
 530                 alldeleted=0
 531         fi
 532 done
 533 [[ $alldeleted -eq 1 ]]
 534 pretty "" "Objects that were created were also destroyed."