tools/testing/selftests/net/vrf_route_leaking.sh

   1 #!/bin/bash
   2 # SPDX-License-Identifier: GPL-2.0
   3 #
   4 # Copyright (c) 2019 David Ahern <dsahern@gmail.com>. All rights reserved.
   5 # Copyright (c) 2020 Michael Jeanson <mjeanson@efficios.com>. All rights reserved.
   6 #
   7 # Requires CONFIG_NET_VRF, CONFIG_VETH, CONFIG_BRIDGE and CONFIG_NET_NS.
   8 #
   9 #
  10 # Symmetric routing topology
  11 #
  12 #                     blue         red
  13 # +----+              .253 +----+ .253              +----+
  14 # | h1 |-------------------| r1 |-------------------| h2 |
  15 # +----+ .1                +----+                .2 +----+
  16 #         172.16.1/24                  172.16.2/24
  17 #    2001:db8:16:1/64                  2001:db8:16:2/64
  18 #
  19 #
  20 # Route from h1 to h2 and back goes through r1, incoming vrf blue has a route
  21 # to the outgoing vrf red for the n2 network and red has a route back to n1.
  22 # The red VRF interface has a MTU of 1400.
  23 #
  24 # The first test sends a ping with a ttl of 1 from h1 to h2 and parses the
  25 # output of the command to check that a ttl expired error is received.
  26 #
  27 # The second test runs traceroute from h1 to h2 and parses the output to check
  28 # for a hop on r1.
  29 #
  30 # The third test sends a ping with a packet size of 1450 from h1 to h2 and
  31 # parses the output of the command to check that a fragmentation error is
  32 # received.
  33 #
  34 #
  35 # Asymmetric routing topology
  36 #
  37 # This topology represents a customer setup where the issue with icmp errors
  38 # and VRF route leaking was initialy reported. The MTU test isn't done here
  39 # because of the lack of a return route in the red VRF.
  40 #
  41 #                     blue         red
  42 #                     .253 +----+ .253
  43 #                     +----| r1 |----+
  44 #                     |    +----+    |
  45 # +----+              |              |              +----+
  46 # | h1 |--------------+              +--------------| h2 |
  47 # +----+ .1           |              |           .2 +----+
  48 #         172.16.1/24 |    +----+    | 172.16.2/24
  49 #    2001:db8:16:1/64 +----| r2 |----+ 2001:db8:16:2/64
  50 #                     .254 +----+ .254
  51 #
  52 #
  53 # Route from h1 to h2 goes through r1, incoming vrf blue has a route to the
  54 # outgoing vrf red for the n2 network but red doesn't have a route back to n1.
  55 # Route from h2 to h1 goes through r2.
  56 #
  57 # The objective is to check that the incoming vrf routing table is selected
  58 # to send an ICMP error back to the source when the ttl of a packet reaches 1
  59 # while it is forwarded between different vrfs.
  60
  61 VERBOSE=0
  62 PAUSE_ON_FAIL=no
  63 DEFAULT_TTYPE=sym
  64
  65 H1_N1=172.16.1.0/24
  66 H1_N1_6=2001:db8:16:1::/64
  67
  68 H1_N1_IP=172.16.1.1
  69 R1_N1_IP=172.16.1.253
  70 R2_N1_IP=172.16.1.254
  71
  72 H1_N1_IP6=2001:db8:16:1::1
  73 R1_N1_IP6=2001:db8:16:1::253
  74 R2_N1_IP6=2001:db8:16:1::254
  75
  76 H2_N2=172.16.2.0/24
  77 H2_N2_6=2001:db8:16:2::/64
  78
  79 H2_N2_IP=172.16.2.2
  80 R1_N2_IP=172.16.2.253
  81 R2_N2_IP=172.16.2.254
  82
  83 H2_N2_IP6=2001:db8:16:2::2
  84 R1_N2_IP6=2001:db8:16:2::253
  85 R2_N2_IP6=2001:db8:16:2::254
  86
  87 ################################################################################
  88 # helpers
  89
  90 log_section()
  91 {
  92         echo
  93         echo "###########################################################################"
  94         echo "$*"
  95         echo "###########################################################################"
  96         echo
  97 }
  98
  99 log_test()
 100 {
 101         local rc=$1
 102         local expected=$2
 103         local msg="$3"
 104
 105         if [ "${rc}" -eq "${expected}" ]; then
 106                 printf "TEST: %-60s  [ OK ]\n" "${msg}"
 107                 nsuccess=$((nsuccess+1))
 108         else
 109                 ret=1
 110                 nfail=$((nfail+1))
 111                 printf "TEST: %-60s  [FAIL]\n" "${msg}"
 112                 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
 113                         echo
 114                         echo "hit enter to continue, 'q' to quit"
 115                         read -r a
 116                         [ "$a" = "q" ] && exit 1
 117                 fi
 118         fi
 119 }
 120
 121 run_cmd()
 122 {
 123         local cmd="$*"
 124         local out
 125         local rc
 126
 127         if [ "$VERBOSE" = "1" ]; then
 128                 echo "COMMAND: $cmd"
 129         fi
 130
 131         # shellcheck disable=SC2086
 132         out=$(eval $cmd 2>&1)
 133         rc=$?
 134         if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
 135                 echo "$out"
 136         fi
 137
 138         [ "$VERBOSE" = "1" ] && echo
 139
 140         return $rc
 141 }
 142
 143 run_cmd_grep()
 144 {
 145         local grep_pattern="$1"
 146         shift
 147         local cmd="$*"
 148         local out
 149         local rc
 150
 151         if [ "$VERBOSE" = "1" ]; then
 152                 echo "COMMAND: $cmd"
 153         fi
 154
 155         # shellcheck disable=SC2086
 156         out=$(eval $cmd 2>&1)
 157         if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
 158                 echo "$out"
 159         fi
 160
 161         echo "$out" | grep -q "$grep_pattern"
 162         rc=$?
 163
 164         [ "$VERBOSE" = "1" ] && echo
 165
 166         return $rc
 167 }
 168
 169 ################################################################################
 170 # setup and teardown
 171
 172 cleanup()
 173 {
 174         local ns
 175
 176         for ns in h1 h2 r1 r2; do
 177                 ip netns del $ns 2>/dev/null
 178         done
 179 }
 180
 181 setup_vrf()
 182 {
 183         local ns=$1
 184
 185         ip -netns "${ns}" rule del pref 0
 186         ip -netns "${ns}" rule add pref 32765 from all lookup local
 187         ip -netns "${ns}" -6 rule del pref 0
 188         ip -netns "${ns}" -6 rule add pref 32765 from all lookup local
 189 }
 190
 191 create_vrf()
 192 {
 193         local ns=$1
 194         local vrf=$2
 195         local table=$3
 196
 197         ip -netns "${ns}" link add "${vrf}" type vrf table "${table}"
 198         ip -netns "${ns}" link set "${vrf}" up
 199         ip -netns "${ns}" route add vrf "${vrf}" unreachable default metric 8192
 200         ip -netns "${ns}" -6 route add vrf "${vrf}" unreachable default metric 8192
 201
 202         ip -netns "${ns}" addr add 127.0.0.1/8 dev "${vrf}"
 203         ip -netns "${ns}" -6 addr add ::1 dev "${vrf}" nodad
 204 }
 205
 206 setup_sym()
 207 {
 208         local ns
 209
 210         # make sure we are starting with a clean slate
 211         cleanup
 212
 213         #
 214         # create nodes as namespaces
 215         #
 216         for ns in h1 h2 r1; do
 217                 ip netns add $ns
 218                 ip -netns $ns link set lo up
 219
 220                 case "${ns}" in
 221                 h[12]) ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
 222                        ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
 223                         ;;
 224                 r1)    ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
 225                        ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
 226                 esac
 227         done
 228
 229         #
 230         # create interconnects
 231         #
 232         ip -netns h1 link add eth0 type veth peer name r1h1
 233         ip -netns h1 link set r1h1 netns r1 name eth0 up
 234
 235         ip -netns h2 link add eth0 type veth peer name r1h2
 236         ip -netns h2 link set r1h2 netns r1 name eth1 up
 237
 238         #
 239         # h1
 240         #
 241         ip -netns h1 addr add dev eth0 ${H1_N1_IP}/24
 242         ip -netns h1 -6 addr add dev eth0 ${H1_N1_IP6}/64 nodad
 243         ip -netns h1 link set eth0 up
 244
 245         # h1 to h2 via r1
 246         ip -netns h1    route add ${H2_N2} via ${R1_N1_IP} dev eth0
 247         ip -netns h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev eth0
 248
 249         #
 250         # h2
 251         #
 252         ip -netns h2 addr add dev eth0 ${H2_N2_IP}/24
 253         ip -netns h2 -6 addr add dev eth0 ${H2_N2_IP6}/64 nodad
 254         ip -netns h2 link set eth0 up
 255
 256         # h2 to h1 via r1
 257         ip -netns h2 route add default via ${R1_N2_IP} dev eth0
 258         ip -netns h2 -6 route add default via ${R1_N2_IP6} dev eth0
 259
 260         #
 261         # r1
 262         #
 263         setup_vrf r1
 264         create_vrf r1 blue 1101
 265         create_vrf r1 red 1102
 266         ip -netns r1 link set mtu 1400 dev eth1
 267         ip -netns r1 link set eth0 vrf blue up
 268         ip -netns r1 link set eth1 vrf red up
 269         ip -netns r1 addr add dev eth0 ${R1_N1_IP}/24
 270         ip -netns r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
 271         ip -netns r1 addr add dev eth1 ${R1_N2_IP}/24
 272         ip -netns r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
 273
 274         # Route leak from blue to red
 275         ip -netns r1 route add vrf blue ${H2_N2} dev red
 276         ip -netns r1 -6 route add vrf blue ${H2_N2_6} dev red
 277
 278         # Route leak from red to blue
 279         ip -netns r1 route add vrf red ${H1_N1} dev blue
 280         ip -netns r1 -6 route add vrf red ${H1_N1_6} dev blue
 281
 282
 283         # Wait for ip config to settle
 284         sleep 2
 285 }
 286
 287 setup_asym()
 288 {
 289         local ns
 290
 291         # make sure we are starting with a clean slate
 292         cleanup
 293
 294         #
 295         # create nodes as namespaces
 296         #
 297         for ns in h1 h2 r1 r2; do
 298                 ip netns add $ns
 299                 ip -netns $ns link set lo up
 300
 301                 case "${ns}" in
 302                 h[12]) ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
 303                        ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
 304                         ;;
 305                 r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
 306                        ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
 307                 esac
 308         done
 309
 310         #
 311         # create interconnects
 312         #
 313         ip -netns h1 link add eth0 type veth peer name r1h1
 314         ip -netns h1 link set r1h1 netns r1 name eth0 up
 315
 316         ip -netns h1 link add eth1 type veth peer name r2h1
 317         ip -netns h1 link set r2h1 netns r2 name eth0 up
 318
 319         ip -netns h2 link add eth0 type veth peer name r1h2
 320         ip -netns h2 link set r1h2 netns r1 name eth1 up
 321
 322         ip -netns h2 link add eth1 type veth peer name r2h2
 323         ip -netns h2 link set r2h2 netns r2 name eth1 up
 324
 325         #
 326         # h1
 327         #
 328         ip -netns h1 link add br0 type bridge
 329         ip -netns h1 link set br0 up
 330         ip -netns h1 addr add dev br0 ${H1_N1_IP}/24
 331         ip -netns h1 -6 addr add dev br0 ${H1_N1_IP6}/64 nodad
 332         ip -netns h1 link set eth0 master br0 up
 333         ip -netns h1 link set eth1 master br0 up
 334
 335         # h1 to h2 via r1
 336         ip -netns h1    route add ${H2_N2} via ${R1_N1_IP} dev br0
 337         ip -netns h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev br0
 338
 339         #
 340         # h2
 341         #
 342         ip -netns h2 link add br0 type bridge
 343         ip -netns h2 link set br0 up
 344         ip -netns h2 addr add dev br0 ${H2_N2_IP}/24
 345         ip -netns h2 -6 addr add dev br0 ${H2_N2_IP6}/64 nodad
 346         ip -netns h2 link set eth0 master br0 up
 347         ip -netns h2 link set eth1 master br0 up
 348
 349         # h2 to h1 via r2
 350         ip -netns h2 route add default via ${R2_N2_IP} dev br0
 351         ip -netns h2 -6 route add default via ${R2_N2_IP6} dev br0
 352
 353         #
 354         # r1
 355         #
 356         setup_vrf r1
 357         create_vrf r1 blue 1101
 358         create_vrf r1 red 1102
 359         ip -netns r1 link set mtu 1400 dev eth1
 360         ip -netns r1 link set eth0 vrf blue up
 361         ip -netns r1 link set eth1 vrf red up
 362         ip -netns r1 addr add dev eth0 ${R1_N1_IP}/24
 363         ip -netns r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
 364         ip -netns r1 addr add dev eth1 ${R1_N2_IP}/24
 365         ip -netns r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
 366
 367         # Route leak from blue to red
 368         ip -netns r1 route add vrf blue ${H2_N2} dev red
 369         ip -netns r1 -6 route add vrf blue ${H2_N2_6} dev red
 370
 371         # No route leak from red to blue
 372
 373         #
 374         # r2
 375         #
 376         ip -netns r2 addr add dev eth0 ${R2_N1_IP}/24
 377         ip -netns r2 -6 addr add dev eth0 ${R2_N1_IP6}/64 nodad
 378         ip -netns r2 addr add dev eth1 ${R2_N2_IP}/24
 379         ip -netns r2 -6 addr add dev eth1 ${R2_N2_IP6}/64 nodad
 380
 381         # Wait for ip config to settle
 382         sleep 2
 383 }
 384
 385 check_connectivity()
 386 {
 387         ip netns exec h1 ping -c1 -w1 ${H2_N2_IP} >/dev/null 2>&1
 388         log_test $? 0 "Basic IPv4 connectivity"
 389         return $?
 390 }
 391
 392 check_connectivity6()
 393 {
 394         ip netns exec h1 "${ping6}" -c1 -w1 ${H2_N2_IP6} >/dev/null 2>&1
 395         log_test $? 0 "Basic IPv6 connectivity"
 396         return $?
 397 }
 398
 399 check_traceroute()
 400 {
 401         if [ ! -x "$(command -v traceroute)" ]; then
 402                 echo "SKIP: Could not run IPV4 test without traceroute"
 403                 return 1
 404         fi
 405 }
 406
 407 check_traceroute6()
 408 {
 409         if [ ! -x "$(command -v traceroute6)" ]; then
 410                 echo "SKIP: Could not run IPV6 test without traceroute6"
 411                 return 1
 412         fi
 413 }
 414
 415 ipv4_traceroute()
 416 {
 417         local ttype="$1"
 418
 419         [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
 420
 421         log_section "IPv4 ($ttype route): VRF ICMP error route lookup traceroute"
 422
 423         check_traceroute || return
 424
 425         setup_"$ttype"
 426
 427         check_connectivity || return
 428
 429         run_cmd_grep "${R1_N1_IP}" ip netns exec h1 traceroute ${H2_N2_IP}
 430         log_test $? 0 "Traceroute reports a hop on r1"
 431 }
 432
 433 ipv4_traceroute_asym()
 434 {
 435         ipv4_traceroute asym
 436 }
 437
 438 ipv6_traceroute()
 439 {
 440         local ttype="$1"
 441
 442         [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
 443
 444         log_section "IPv6 ($ttype route): VRF ICMP error route lookup traceroute"
 445
 446         check_traceroute6 || return
 447
 448         setup_"$ttype"
 449
 450         check_connectivity6 || return
 451
 452         run_cmd_grep "${R1_N1_IP6}" ip netns exec h1 traceroute6 ${H2_N2_IP6}
 453         log_test $? 0 "Traceroute6 reports a hop on r1"
 454 }
 455
 456 ipv6_traceroute_asym()
 457 {
 458         ipv6_traceroute asym
 459 }
 460
 461 ipv4_ping_ttl()
 462 {
 463         local ttype="$1"
 464
 465         [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
 466
 467         log_section "IPv4 ($ttype route): VRF ICMP ttl error route lookup ping"
 468
 469         setup_"$ttype"
 470
 471         check_connectivity || return
 472
 473         run_cmd_grep "Time to live exceeded" ip netns exec h1 ping -t1 -c1 -W2 ${H2_N2_IP}
 474         log_test $? 0 "Ping received ICMP ttl exceeded"
 475 }
 476
 477 ipv4_ping_ttl_asym()
 478 {
 479         ipv4_ping_ttl asym
 480 }
 481
 482 ipv4_ping_frag()
 483 {
 484         local ttype="$1"
 485
 486         [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
 487
 488         log_section "IPv4 ($ttype route): VRF ICMP fragmentation error route lookup ping"
 489
 490         setup_"$ttype"
 491
 492         check_connectivity || return
 493
 494         run_cmd_grep "Frag needed" ip netns exec h1 ping -s 1450 -Mdo -c1 -W2 ${H2_N2_IP}
 495         log_test $? 0 "Ping received ICMP Frag needed"
 496 }
 497
 498 ipv4_ping_frag_asym()
 499 {
 500         ipv4_ping_frag asym
 501 }
 502
 503 ipv6_ping_ttl()
 504 {
 505         local ttype="$1"
 506
 507         [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
 508
 509         log_section "IPv6 ($ttype route): VRF ICMP ttl error route lookup ping"
 510
 511         setup_"$ttype"
 512
 513         check_connectivity6 || return
 514
 515         run_cmd_grep "Time exceeded: Hop limit" ip netns exec h1 "${ping6}" -t1 -c1 -W2 ${H2_N2_IP6}
 516         log_test $? 0 "Ping received ICMP Hop limit"
 517 }
 518
 519 ipv6_ping_ttl_asym()
 520 {
 521         ipv6_ping_ttl asym
 522 }
 523
 524 ipv6_ping_frag()
 525 {
 526         local ttype="$1"
 527
 528         [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
 529
 530         log_section "IPv6 ($ttype route): VRF ICMP fragmentation error route lookup ping"
 531
 532         setup_"$ttype"
 533
 534         check_connectivity6 || return
 535
 536         run_cmd_grep "Packet too big" ip netns exec h1 "${ping6}" -s 1450 -Mdo -c1 -W2 ${H2_N2_IP6}
 537         log_test $? 0 "Ping received ICMP Packet too big"
 538 }
 539
 540 ipv6_ping_frag_asym()
 541 {
 542         ipv6_ping_frag asym
 543 }
 544
 545 ################################################################################
 546 # usage
 547
 548 usage()
 549 {
 550         cat <<EOF
 551 usage: ${0##*/} OPTS
 552
 553         -4          Run IPv4 tests only
 554         -6          Run IPv6 tests only
 555         -t TEST     Run only TEST
 556         -p          Pause on fail
 557         -v          verbose mode (show commands and output)
 558 EOF
 559 }
 560
 561 ################################################################################
 562 # main
 563
 564 # Some systems don't have a ping6 binary anymore
 565 command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping)
 566
 567 TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym"
 568 TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_frag ipv6_ping_ttl_asym ipv6_traceroute_asym"
 569
 570 ret=0
 571 nsuccess=0
 572 nfail=0
 573
 574 while getopts :46t:pvh o
 575 do
 576         case $o in
 577                 4) TESTS=ipv4;;
 578                 6) TESTS=ipv6;;
 579                 t) TESTS=$OPTARG;;
 580                 p) PAUSE_ON_FAIL=yes;;
 581                 v) VERBOSE=1;;
 582                 h) usage; exit 0;;
 583                 *) usage; exit 1;;
 584         esac
 585 done
 586
 587 #
 588 # show user test config
 589 #
 590 if [ -z "$TESTS" ]; then
 591         TESTS="$TESTS_IPV4 $TESTS_IPV6"
 592 elif [ "$TESTS" = "ipv4" ]; then
 593         TESTS="$TESTS_IPV4"
 594 elif [ "$TESTS" = "ipv6" ]; then
 595         TESTS="$TESTS_IPV6"
 596 fi
 597
 598 for t in $TESTS
 599 do
 600         case $t in
 601         ipv4_ping_ttl|ping)              ipv4_ping_ttl;;&
 602         ipv4_ping_ttl_asym|ping)         ipv4_ping_ttl_asym;;&
 603         ipv4_traceroute|traceroute)      ipv4_traceroute;;&
 604         ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;&
 605         ipv4_ping_frag|ping)             ipv4_ping_frag;;&
 606
 607         ipv6_ping_ttl|ping)              ipv6_ping_ttl;;&
 608         ipv6_ping_ttl_asym|ping)         ipv6_ping_ttl_asym;;&
 609         ipv6_traceroute|traceroute)      ipv6_traceroute;;&
 610         ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;&
 611         ipv6_ping_frag|ping)             ipv6_ping_frag;;&
 612
 613         # setup namespaces and config, but do not run any tests
 614         setup_sym|setup)                 setup_sym; exit 0;;
 615         setup_asym)                      setup_asym; exit 0;;
 616
 617         help)                       echo "Test names: $TESTS"; exit 0;;
 618         esac
 619 done
 620
 621 cleanup
 622
 623 printf "\nTests passed: %3d\n" ${nsuccess}
 624 printf "Tests failed: %3d\n"   ${nfail}
 625
 626 exit $ret