3 # This test is for bridge 'brouting', i.e. make some packets being routed
4 # rather than getting bridged even though they arrive on interface that is
8 # setup is: ns1 <-> ns0 <-> ns2
10 # Kselftest framework requirement - SKIP code is 4.
14 ebtables -V > /dev/null 2>&1
16 echo "SKIP: Could not run test without ebtables"
20 ip -Version > /dev/null 2>&1
22 echo "SKIP: Could not run test without ip tool"
30 ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
32 echo "SKIP: Can't create veth device"
35 ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
37 ip -net ns0 link set lo up
38 ip -net ns0 link set veth0 up
39 ip -net ns0 link set veth1 up
41 ip -net ns0 link add br0 type bridge
43 echo "SKIP: Can't create bridge br0"
47 ip -net ns0 link set veth0 master br0
48 ip -net ns0 link set veth1 master br0
49 ip -net ns0 link set br0 up
50 ip -net ns0 addr add 10.0.0.1/24 dev br0
52 # place both in same subnet, ns1 and ns2 connected via ns0:br0
54 ip -net ns$i link set lo up
55 ip -net ns$i link set eth0 up
56 ip -net ns$i addr add 10.0.0.1$i/24 dev eth0
59 test_ebtables_broute()
63 # redirect is needed so the dstmac is rewritten to the bridge itself,
64 # ip stack won't process OTHERHOST (foreign unicast mac) packets.
65 ip netns exec ns0 ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP
67 echo "SKIP: Could not add ebtables broute redirect rule"
71 # ping netns1, expected to not work (ip forwarding is off)
72 ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null 2>&1
74 echo "ERROR: ping works, should have failed" 1>&2
78 # enable forwarding on both interfaces.
79 # neither needs an ip address, but at least the bridge needs
80 # an ip address in same network segment as ns1 and ns2 (ns0
81 # needs to be able to determine route for to-be-forwarded packet).
82 ip netns exec ns0 sysctl -q net.ipv4.conf.veth0.forwarding=1
83 ip netns exec ns0 sysctl -q net.ipv4.conf.veth1.forwarding=1
87 ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null
89 echo "ERROR: ping did not work, but it should (broute+forward)" 1>&2
93 echo "PASS: ns1/ns2 connectivity with active broute rule"
94 ip netns exec ns0 ebtables -t broute -F
96 # ping netns1, expected to work (frames are bridged)
97 ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null
99 echo "ERROR: ping did not work, but it should (bridged)" 1>&2
103 ip netns exec ns0 ebtables -t filter -A FORWARD -p ipv4 --ip-protocol icmp -j DROP
105 # ping netns1, expected to not work (DROP in bridge forward)
106 ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null 2>&1
107 if [ $? -eq 0 ]; then
108 echo "ERROR: ping works, should have failed (icmp forward drop)" 1>&2
112 # re-activate brouter
113 ip netns exec ns0 ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP
115 ip netns exec ns2 ping -q -c 1 10.0.0.11 > /dev/null
116 if [ $? -ne 0 ]; then
117 echo "ERROR: ping did not work, but it should (broute+forward 2)" 1>&2
121 echo "PASS: ns1/ns2 connectivity with active broute rule and bridge forward drop"
125 # test basic connectivity
126 ip netns exec ns1 ping -c 1 -q 10.0.0.12 > /dev/null
127 if [ $? -ne 0 ]; then
128 echo "ERROR: Could not reach ns2 from ns1" 1>&2
132 ip netns exec ns2 ping -c 1 -q 10.0.0.11 > /dev/null
133 if [ $? -ne 0 ]; then
134 echo "ERROR: Could not reach ns1 from ns2" 1>&2
138 if [ $ret -eq 0 ];then
139 echo "PASS: netns connectivity: ns1 and ns2 can reach each other"
144 for i in 0 1 2; do ip netns del ns$i;done