2 # SPDX-License-Identifier: GPL-2.0
4 # Copyright (c) 2019 David Ahern <dsahern@gmail.com>. All rights reserved.
5 # Copyright (c) 2020 Michael Jeanson <mjeanson@efficios.com>. All rights reserved.
7 # Requires CONFIG_NET_VRF, CONFIG_VETH, CONFIG_BRIDGE and CONFIG_NET_NS.
10 # Symmetric routing topology
13 # +----+ .253 +----+ .253 +----+
14 # | h1 |-------------------| r1 |-------------------| h2 |
15 # +----+ .1 +----+ .2 +----+
16 # 172.16.1/24 172.16.2/24
17 # 2001:db8:16:1/64 2001:db8:16:2/64
20 # Route from h1 to h2 and back goes through r1, incoming vrf blue has a route
21 # to the outgoing vrf red for the n2 network and red has a route back to n1.
22 # The red VRF interface has a MTU of 1400.
24 # The first test sends a ping with a ttl of 1 from h1 to h2 and parses the
25 # output of the command to check that a ttl expired error is received.
27 # The second test runs traceroute from h1 to h2 and parses the output to check
30 # The third test sends a ping with a packet size of 1450 from h1 to h2 and
31 # parses the output of the command to check that a fragmentation error is
35 # Asymmetric routing topology
37 # This topology represents a customer setup where the issue with icmp errors
38 # and VRF route leaking was initialy reported. The MTU test isn't done here
39 # because of the lack of a return route in the red VRF.
46 # | h1 |--------------+ +--------------| h2 |
47 # +----+ .1 | | .2 +----+
48 # 172.16.1/24 | +----+ | 172.16.2/24
49 # 2001:db8:16:1/64 +----| r2 |----+ 2001:db8:16:2/64
53 # Route from h1 to h2 goes through r1, incoming vrf blue has a route to the
54 # outgoing vrf red for the n2 network but red doesn't have a route back to n1.
55 # Route from h2 to h1 goes through r2.
57 # The objective is to check that the incoming vrf routing table is selected
58 # to send an ICMP error back to the source when the ttl of a packet reaches 1
59 # while it is forwarded between different vrfs.
66 H1_N1_6=2001:db8:16:1::/64
72 H1_N1_IP6=2001:db8:16:1::1
73 R1_N1_IP6=2001:db8:16:1::253
74 R2_N1_IP6=2001:db8:16:1::254
77 H2_N2_6=2001:db8:16:2::/64
83 H2_N2_IP6=2001:db8:16:2::2
84 R1_N2_IP6=2001:db8:16:2::253
85 R2_N2_IP6=2001:db8:16:2::254
87 ################################################################################
93 echo "###########################################################################"
95 echo "###########################################################################"
105 if [ "${rc}" -eq "${expected}" ]; then
106 printf "TEST: %-60s [ OK ]\n" "${msg}"
107 nsuccess=$((nsuccess+1))
111 printf "TEST: %-60s [FAIL]\n" "${msg}"
112 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
114 echo "hit enter to continue, 'q' to quit"
116 [ "$a" = "q" ] && exit 1
127 if [ "$VERBOSE" = "1" ]; then
131 # shellcheck disable=SC2086
132 out=$(eval $cmd 2>&1)
134 if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
138 [ "$VERBOSE" = "1" ] && echo
145 local grep_pattern="$1"
151 if [ "$VERBOSE" = "1" ]; then
155 # shellcheck disable=SC2086
156 out=$(eval $cmd 2>&1)
157 if [ "$VERBOSE" = "1" ] && [ -n "$out" ]; then
161 echo "$out" | grep -q "$grep_pattern"
164 [ "$VERBOSE" = "1" ] && echo
169 ################################################################################
176 for ns in h1 h2 r1 r2; do
177 ip netns del $ns 2>/dev/null
185 ip -netns "${ns}" rule del pref 0
186 ip -netns "${ns}" rule add pref 32765 from all lookup local
187 ip -netns "${ns}" -6 rule del pref 0
188 ip -netns "${ns}" -6 rule add pref 32765 from all lookup local
197 ip -netns "${ns}" link add "${vrf}" type vrf table "${table}"
198 ip -netns "${ns}" link set "${vrf}" up
199 ip -netns "${ns}" route add vrf "${vrf}" unreachable default metric 8192
200 ip -netns "${ns}" -6 route add vrf "${vrf}" unreachable default metric 8192
202 ip -netns "${ns}" addr add 127.0.0.1/8 dev "${vrf}"
203 ip -netns "${ns}" -6 addr add ::1 dev "${vrf}" nodad
210 # make sure we are starting with a clean slate
214 # create nodes as namespaces
216 for ns in h1 h2 r1; do
218 ip -netns $ns link set lo up
221 h[12]) ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
222 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
224 r1) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
225 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
230 # create interconnects
232 ip -netns h1 link add eth0 type veth peer name r1h1
233 ip -netns h1 link set r1h1 netns r1 name eth0 up
235 ip -netns h2 link add eth0 type veth peer name r1h2
236 ip -netns h2 link set r1h2 netns r1 name eth1 up
241 ip -netns h1 addr add dev eth0 ${H1_N1_IP}/24
242 ip -netns h1 -6 addr add dev eth0 ${H1_N1_IP6}/64 nodad
243 ip -netns h1 link set eth0 up
246 ip -netns h1 route add ${H2_N2} via ${R1_N1_IP} dev eth0
247 ip -netns h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev eth0
252 ip -netns h2 addr add dev eth0 ${H2_N2_IP}/24
253 ip -netns h2 -6 addr add dev eth0 ${H2_N2_IP6}/64 nodad
254 ip -netns h2 link set eth0 up
257 ip -netns h2 route add default via ${R1_N2_IP} dev eth0
258 ip -netns h2 -6 route add default via ${R1_N2_IP6} dev eth0
264 create_vrf r1 blue 1101
265 create_vrf r1 red 1102
266 ip -netns r1 link set mtu 1400 dev eth1
267 ip -netns r1 link set eth0 vrf blue up
268 ip -netns r1 link set eth1 vrf red up
269 ip -netns r1 addr add dev eth0 ${R1_N1_IP}/24
270 ip -netns r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
271 ip -netns r1 addr add dev eth1 ${R1_N2_IP}/24
272 ip -netns r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
274 # Route leak from blue to red
275 ip -netns r1 route add vrf blue ${H2_N2} dev red
276 ip -netns r1 -6 route add vrf blue ${H2_N2_6} dev red
278 # Route leak from red to blue
279 ip -netns r1 route add vrf red ${H1_N1} dev blue
280 ip -netns r1 -6 route add vrf red ${H1_N1_6} dev blue
283 # Wait for ip config to settle
291 # make sure we are starting with a clean slate
295 # create nodes as namespaces
297 for ns in h1 h2 r1 r2; do
299 ip -netns $ns link set lo up
302 h[12]) ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=0
303 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.keep_addr_on_down=1
305 r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
306 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
311 # create interconnects
313 ip -netns h1 link add eth0 type veth peer name r1h1
314 ip -netns h1 link set r1h1 netns r1 name eth0 up
316 ip -netns h1 link add eth1 type veth peer name r2h1
317 ip -netns h1 link set r2h1 netns r2 name eth0 up
319 ip -netns h2 link add eth0 type veth peer name r1h2
320 ip -netns h2 link set r1h2 netns r1 name eth1 up
322 ip -netns h2 link add eth1 type veth peer name r2h2
323 ip -netns h2 link set r2h2 netns r2 name eth1 up
328 ip -netns h1 link add br0 type bridge
329 ip -netns h1 link set br0 up
330 ip -netns h1 addr add dev br0 ${H1_N1_IP}/24
331 ip -netns h1 -6 addr add dev br0 ${H1_N1_IP6}/64 nodad
332 ip -netns h1 link set eth0 master br0 up
333 ip -netns h1 link set eth1 master br0 up
336 ip -netns h1 route add ${H2_N2} via ${R1_N1_IP} dev br0
337 ip -netns h1 -6 route add ${H2_N2_6} via "${R1_N1_IP6}" dev br0
342 ip -netns h2 link add br0 type bridge
343 ip -netns h2 link set br0 up
344 ip -netns h2 addr add dev br0 ${H2_N2_IP}/24
345 ip -netns h2 -6 addr add dev br0 ${H2_N2_IP6}/64 nodad
346 ip -netns h2 link set eth0 master br0 up
347 ip -netns h2 link set eth1 master br0 up
350 ip -netns h2 route add default via ${R2_N2_IP} dev br0
351 ip -netns h2 -6 route add default via ${R2_N2_IP6} dev br0
357 create_vrf r1 blue 1101
358 create_vrf r1 red 1102
359 ip -netns r1 link set mtu 1400 dev eth1
360 ip -netns r1 link set eth0 vrf blue up
361 ip -netns r1 link set eth1 vrf red up
362 ip -netns r1 addr add dev eth0 ${R1_N1_IP}/24
363 ip -netns r1 -6 addr add dev eth0 ${R1_N1_IP6}/64 nodad
364 ip -netns r1 addr add dev eth1 ${R1_N2_IP}/24
365 ip -netns r1 -6 addr add dev eth1 ${R1_N2_IP6}/64 nodad
367 # Route leak from blue to red
368 ip -netns r1 route add vrf blue ${H2_N2} dev red
369 ip -netns r1 -6 route add vrf blue ${H2_N2_6} dev red
371 # No route leak from red to blue
376 ip -netns r2 addr add dev eth0 ${R2_N1_IP}/24
377 ip -netns r2 -6 addr add dev eth0 ${R2_N1_IP6}/64 nodad
378 ip -netns r2 addr add dev eth1 ${R2_N2_IP}/24
379 ip -netns r2 -6 addr add dev eth1 ${R2_N2_IP6}/64 nodad
381 # Wait for ip config to settle
387 ip netns exec h1 ping -c1 -w1 ${H2_N2_IP} >/dev/null 2>&1
388 log_test $? 0 "Basic IPv4 connectivity"
392 check_connectivity6()
394 ip netns exec h1 "${ping6}" -c1 -w1 ${H2_N2_IP6} >/dev/null 2>&1
395 log_test $? 0 "Basic IPv6 connectivity"
401 if [ ! -x "$(command -v traceroute)" ]; then
402 echo "SKIP: Could not run IPV4 test without traceroute"
409 if [ ! -x "$(command -v traceroute6)" ]; then
410 echo "SKIP: Could not run IPV6 test without traceroute6"
419 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
421 log_section "IPv4 ($ttype route): VRF ICMP error route lookup traceroute"
423 check_traceroute || return
427 check_connectivity || return
429 run_cmd_grep "${R1_N1_IP}" ip netns exec h1 traceroute ${H2_N2_IP}
430 log_test $? 0 "Traceroute reports a hop on r1"
433 ipv4_traceroute_asym()
442 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
444 log_section "IPv6 ($ttype route): VRF ICMP error route lookup traceroute"
446 check_traceroute6 || return
450 check_connectivity6 || return
452 run_cmd_grep "${R1_N1_IP6}" ip netns exec h1 traceroute6 ${H2_N2_IP6}
453 log_test $? 0 "Traceroute6 reports a hop on r1"
456 ipv6_traceroute_asym()
465 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
467 log_section "IPv4 ($ttype route): VRF ICMP ttl error route lookup ping"
471 check_connectivity || return
473 run_cmd_grep "Time to live exceeded" ip netns exec h1 ping -t1 -c1 -W2 ${H2_N2_IP}
474 log_test $? 0 "Ping received ICMP ttl exceeded"
486 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
488 log_section "IPv4 ($ttype route): VRF ICMP fragmentation error route lookup ping"
492 check_connectivity || return
494 run_cmd_grep "Frag needed" ip netns exec h1 ping -s 1450 -Mdo -c1 -W2 ${H2_N2_IP}
495 log_test $? 0 "Ping received ICMP Frag needed"
498 ipv4_ping_frag_asym()
507 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
509 log_section "IPv6 ($ttype route): VRF ICMP ttl error route lookup ping"
513 check_connectivity6 || return
515 run_cmd_grep "Time exceeded: Hop limit" ip netns exec h1 "${ping6}" -t1 -c1 -W2 ${H2_N2_IP6}
516 log_test $? 0 "Ping received ICMP Hop limit"
528 [ "x$ttype" = "x" ] && ttype="$DEFAULT_TTYPE"
530 log_section "IPv6 ($ttype route): VRF ICMP fragmentation error route lookup ping"
534 check_connectivity6 || return
536 run_cmd_grep "Packet too big" ip netns exec h1 "${ping6}" -s 1450 -Mdo -c1 -W2 ${H2_N2_IP6}
537 log_test $? 0 "Ping received ICMP Packet too big"
540 ipv6_ping_frag_asym()
545 ################################################################################
553 -4 Run IPv4 tests only
554 -6 Run IPv6 tests only
555 -t TEST Run only TEST
557 -v verbose mode (show commands and output)
561 ################################################################################
564 # Some systems don't have a ping6 binary anymore
565 command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping)
567 TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym"
568 TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_ttl_asym ipv6_traceroute_asym"
574 while getopts :46t:pvh o
580 p) PAUSE_ON_FAIL=yes;;
588 # show user test config
590 if [ -z "$TESTS" ]; then
591 TESTS="$TESTS_IPV4 $TESTS_IPV6"
592 elif [ "$TESTS" = "ipv4" ]; then
594 elif [ "$TESTS" = "ipv6" ]; then
601 ipv4_ping_ttl|ping) ipv4_ping_ttl;;&
602 ipv4_ping_ttl_asym|ping) ipv4_ping_ttl_asym;;&
603 ipv4_traceroute|traceroute) ipv4_traceroute;;&
604 ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;&
605 ipv4_ping_frag|ping) ipv4_ping_frag;;&
607 ipv6_ping_ttl|ping) ipv6_ping_ttl;;&
608 ipv6_ping_ttl_asym|ping) ipv6_ping_ttl_asym;;&
609 ipv6_traceroute|traceroute) ipv6_traceroute;;&
610 ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;&
611 ipv6_ping_frag|ping) ipv6_ping_frag;;&
613 # setup namespaces and config, but do not run any tests
614 setup_sym|setup) setup_sym; exit 0;;
615 setup_asym) setup_asym; exit 0;;
617 help) echo "Test names: $TESTS"; exit 0;;
623 printf "\nTests passed: %3d\n" ${nsuccess}
624 printf "Tests failed: %3d\n" ${nfail}