1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# Copyright (c) 2019 David Ahern <dsahern@gmail.com>. All rights reserved.
5#
6# IPv4 and IPv6 functional tests focusing on VRF and routing lookups
7# for various permutations:
8#   1. icmp, tcp, udp and netfilter
9#   2. client, server, no-server
10#   3. global address on interface
11#   4. global address on 'lo'
12#   5. remote and local traffic
13#   6. VRF and non-VRF permutations
14#
15# Setup:
16#                     ns-A     |     ns-B
17# No VRF case:
18#    [ lo ]         [ eth1 ]---|---[ eth1 ]      [ lo ]
19#                                                remote address
20# VRF case:
21#         [ red ]---[ eth1 ]---|---[ eth1 ]      [ lo ]
22#
23# ns-A:
24#     eth1: 172.16.1.1/24, 2001:db8:1::1/64
25#       lo: 127.0.0.1/8, ::1/128
26#           172.16.2.1/32, 2001:db8:2::1/128
27#      red: 127.0.0.1/8, ::1/128
28#           172.16.3.1/32, 2001:db8:3::1/128
29#
30# ns-B:
31#     eth1: 172.16.1.2/24, 2001:db8:1::2/64
32#      lo2: 127.0.0.1/8, ::1/128
33#           172.16.2.2/32, 2001:db8:2::2/128
34#
35# ns-A to ns-C connection - only for VRF and same config
36# as ns-A to ns-B
37#
38# server / client nomenclature relative to ns-A
39
40# Kselftest framework requirement - SKIP code is 4.
41ksft_skip=4
42
43VERBOSE=0
44
45NSA_DEV=eth1
46NSA_DEV2=eth2
47NSB_DEV=eth1
48NSC_DEV=eth2
49VRF=red
50VRF_TABLE=1101
51
52# IPv4 config
53NSA_IP=172.16.1.1
54NSB_IP=172.16.1.2
55VRF_IP=172.16.3.1
56NS_NET=172.16.1.0/24
57
58# IPv6 config
59NSA_IP6=2001:db8:1::1
60NSB_IP6=2001:db8:1::2
61VRF_IP6=2001:db8:3::1
62NS_NET6=2001:db8:1::/120
63
64NSA_LO_IP=172.16.2.1
65NSB_LO_IP=172.16.2.2
66NSA_LO_IP6=2001:db8:2::1
67NSB_LO_IP6=2001:db8:2::2
68
69# non-local addresses for freebind tests
70NL_IP=172.17.1.1
71NL_IP6=2001:db8:4::1
72
73MD5_PW=abc123
74MD5_WRONG_PW=abc1234
75
76MCAST=ff02::1
77# set after namespace create
78NSA_LINKIP6=
79NSB_LINKIP6=
80
81NSA=ns-A
82NSB=ns-B
83NSC=ns-C
84
85NSA_CMD="ip netns exec ${NSA}"
86NSB_CMD="ip netns exec ${NSB}"
87NSC_CMD="ip netns exec ${NSC}"
88
89which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)
90
91################################################################################
92# utilities
93
94log_test()
95{
96	local rc=$1
97	local expected=$2
98	local msg="$3"
99
100	[ "${VERBOSE}" = "1" ] && echo
101
102	if [ ${rc} -eq ${expected} ]; then
103		nsuccess=$((nsuccess+1))
104		printf "TEST: %-70s  [ OK ]\n" "${msg}"
105	else
106		nfail=$((nfail+1))
107		printf "TEST: %-70s  [FAIL]\n" "${msg}"
108		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
109			echo
110			echo "hit enter to continue, 'q' to quit"
111			read a
112			[ "$a" = "q" ] && exit 1
113		fi
114	fi
115
116	if [ "${PAUSE}" = "yes" ]; then
117		echo
118		echo "hit enter to continue, 'q' to quit"
119		read a
120		[ "$a" = "q" ] && exit 1
121	fi
122
123	kill_procs
124}
125
126log_test_addr()
127{
128	local addr=$1
129	local rc=$2
130	local expected=$3
131	local msg="$4"
132	local astr
133
134	astr=$(addr2str ${addr})
135	log_test $rc $expected "$msg - ${astr}"
136}
137
138log_section()
139{
140	echo
141	echo "###########################################################################"
142	echo "$*"
143	echo "###########################################################################"
144	echo
145}
146
147log_subsection()
148{
149	echo
150	echo "#################################################################"
151	echo "$*"
152	echo
153}
154
155log_start()
156{
157	# make sure we have no test instances running
158	kill_procs
159
160	if [ "${VERBOSE}" = "1" ]; then
161		echo
162		echo "#######################################################"
163	fi
164}
165
166log_debug()
167{
168	if [ "${VERBOSE}" = "1" ]; then
169		echo
170		echo "$*"
171		echo
172	fi
173}
174
175show_hint()
176{
177	if [ "${VERBOSE}" = "1" ]; then
178		echo "HINT: $*"
179		echo
180	fi
181}
182
183kill_procs()
184{
185	killall nettest ping ping6 >/dev/null 2>&1
186	sleep 1
187}
188
189do_run_cmd()
190{
191	local cmd="$*"
192	local out
193
194	if [ "$VERBOSE" = "1" ]; then
195		echo "COMMAND: ${cmd}"
196	fi
197
198	out=$($cmd 2>&1)
199	rc=$?
200	if [ "$VERBOSE" = "1" -a -n "$out" ]; then
201		echo "$out"
202	fi
203
204	return $rc
205}
206
207run_cmd()
208{
209	do_run_cmd ${NSA_CMD} $*
210}
211
212run_cmd_nsb()
213{
214	do_run_cmd ${NSB_CMD} $*
215}
216
217run_cmd_nsc()
218{
219	do_run_cmd ${NSC_CMD} $*
220}
221
222setup_cmd()
223{
224	local cmd="$*"
225	local rc
226
227	run_cmd ${cmd}
228	rc=$?
229	if [ $rc -ne 0 ]; then
230		# show user the command if not done so already
231		if [ "$VERBOSE" = "0" ]; then
232			echo "setup command: $cmd"
233		fi
234		echo "failed. stopping tests"
235		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
236			echo
237			echo "hit enter to continue"
238			read a
239		fi
240		exit $rc
241	fi
242}
243
244setup_cmd_nsb()
245{
246	local cmd="$*"
247	local rc
248
249	run_cmd_nsb ${cmd}
250	rc=$?
251	if [ $rc -ne 0 ]; then
252		# show user the command if not done so already
253		if [ "$VERBOSE" = "0" ]; then
254			echo "setup command: $cmd"
255		fi
256		echo "failed. stopping tests"
257		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
258			echo
259			echo "hit enter to continue"
260			read a
261		fi
262		exit $rc
263	fi
264}
265
266setup_cmd_nsc()
267{
268	local cmd="$*"
269	local rc
270
271	run_cmd_nsc ${cmd}
272	rc=$?
273	if [ $rc -ne 0 ]; then
274		# show user the command if not done so already
275		if [ "$VERBOSE" = "0" ]; then
276			echo "setup command: $cmd"
277		fi
278		echo "failed. stopping tests"
279		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
280			echo
281			echo "hit enter to continue"
282			read a
283		fi
284		exit $rc
285	fi
286}
287
288# set sysctl values in NS-A
289set_sysctl()
290{
291	echo "SYSCTL: $*"
292	echo
293	run_cmd sysctl -q -w $*
294}
295
296# get sysctl values in NS-A
297get_sysctl()
298{
299	${NSA_CMD} sysctl -n $*
300}
301
302################################################################################
303# Setup for tests
304
305addr2str()
306{
307	case "$1" in
308	127.0.0.1) echo "loopback";;
309	::1) echo "IPv6 loopback";;
310
311	${NSA_IP})	echo "ns-A IP";;
312	${NSA_IP6})	echo "ns-A IPv6";;
313	${NSA_LO_IP})	echo "ns-A loopback IP";;
314	${NSA_LO_IP6})	echo "ns-A loopback IPv6";;
315	${NSA_LINKIP6}|${NSA_LINKIP6}%*) echo "ns-A IPv6 LLA";;
316
317	${NSB_IP})	echo "ns-B IP";;
318	${NSB_IP6})	echo "ns-B IPv6";;
319	${NSB_LO_IP})	echo "ns-B loopback IP";;
320	${NSB_LO_IP6})	echo "ns-B loopback IPv6";;
321	${NSB_LINKIP6}|${NSB_LINKIP6}%*) echo "ns-B IPv6 LLA";;
322
323	${NL_IP})       echo "nonlocal IP";;
324	${NL_IP6})      echo "nonlocal IPv6";;
325
326	${VRF_IP})	echo "VRF IP";;
327	${VRF_IP6})	echo "VRF IPv6";;
328
329	${MCAST}%*)	echo "multicast IP";;
330
331	*) echo "unknown";;
332	esac
333}
334
335get_linklocal()
336{
337	local ns=$1
338	local dev=$2
339	local addr
340
341	addr=$(ip -netns ${ns} -6 -br addr show dev ${dev} | \
342	awk '{
343		for (i = 3; i <= NF; ++i) {
344			if ($i ~ /^fe80/)
345				print $i
346		}
347	}'
348	)
349	addr=${addr/\/*}
350
351	[ -z "$addr" ] && return 1
352
353	echo $addr
354
355	return 0
356}
357
358################################################################################
359# create namespaces and vrf
360
361create_vrf()
362{
363	local ns=$1
364	local vrf=$2
365	local table=$3
366	local addr=$4
367	local addr6=$5
368
369	ip -netns ${ns} link add ${vrf} type vrf table ${table}
370	ip -netns ${ns} link set ${vrf} up
371	ip -netns ${ns} route add vrf ${vrf} unreachable default metric 8192
372	ip -netns ${ns} -6 route add vrf ${vrf} unreachable default metric 8192
373
374	ip -netns ${ns} addr add 127.0.0.1/8 dev ${vrf}
375	ip -netns ${ns} -6 addr add ::1 dev ${vrf} nodad
376	if [ "${addr}" != "-" ]; then
377		ip -netns ${ns} addr add dev ${vrf} ${addr}
378	fi
379	if [ "${addr6}" != "-" ]; then
380		ip -netns ${ns} -6 addr add dev ${vrf} ${addr6}
381	fi
382
383	ip -netns ${ns} ru del pref 0
384	ip -netns ${ns} ru add pref 32765 from all lookup local
385	ip -netns ${ns} -6 ru del pref 0
386	ip -netns ${ns} -6 ru add pref 32765 from all lookup local
387}
388
389create_ns()
390{
391	local ns=$1
392	local addr=$2
393	local addr6=$3
394
395	ip netns add ${ns}
396
397	ip -netns ${ns} link set lo up
398	if [ "${addr}" != "-" ]; then
399		ip -netns ${ns} addr add dev lo ${addr}
400	fi
401	if [ "${addr6}" != "-" ]; then
402		ip -netns ${ns} -6 addr add dev lo ${addr6}
403	fi
404
405	ip -netns ${ns} ro add unreachable default metric 8192
406	ip -netns ${ns} -6 ro add unreachable default metric 8192
407
408	ip netns exec ${ns} sysctl -qw net.ipv4.ip_forward=1
409	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
410	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
411	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
412}
413
414# create veth pair to connect namespaces and apply addresses.
415connect_ns()
416{
417	local ns1=$1
418	local ns1_dev=$2
419	local ns1_addr=$3
420	local ns1_addr6=$4
421	local ns2=$5
422	local ns2_dev=$6
423	local ns2_addr=$7
424	local ns2_addr6=$8
425
426	ip -netns ${ns1} li add ${ns1_dev} type veth peer name tmp
427	ip -netns ${ns1} li set ${ns1_dev} up
428	ip -netns ${ns1} li set tmp netns ${ns2} name ${ns2_dev}
429	ip -netns ${ns2} li set ${ns2_dev} up
430
431	if [ "${ns1_addr}" != "-" ]; then
432		ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr}
433		ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr}
434	fi
435
436	if [ "${ns1_addr6}" != "-" ]; then
437		ip -netns ${ns1} addr add dev ${ns1_dev} ${ns1_addr6}
438		ip -netns ${ns2} addr add dev ${ns2_dev} ${ns2_addr6}
439	fi
440}
441
442cleanup()
443{
444	# explicit cleanups to check those code paths
445	ip netns | grep -q ${NSA}
446	if [ $? -eq 0 ]; then
447		ip -netns ${NSA} link delete ${VRF}
448		ip -netns ${NSA} ro flush table ${VRF_TABLE}
449
450		ip -netns ${NSA} addr flush dev ${NSA_DEV}
451		ip -netns ${NSA} -6 addr flush dev ${NSA_DEV}
452		ip -netns ${NSA} link set dev ${NSA_DEV} down
453		ip -netns ${NSA} link del dev ${NSA_DEV}
454
455		ip netns pids ${NSA} | xargs kill 2>/dev/null
456		ip netns del ${NSA}
457	fi
458
459	ip netns pids ${NSB} | xargs kill 2>/dev/null
460	ip netns del ${NSB}
461	ip netns pids ${NSC} | xargs kill 2>/dev/null
462	ip netns del ${NSC} >/dev/null 2>&1
463}
464
465cleanup_vrf_dup()
466{
467	ip link del ${NSA_DEV2} >/dev/null 2>&1
468	ip netns pids ${NSC} | xargs kill 2>/dev/null
469	ip netns del ${NSC} >/dev/null 2>&1
470}
471
472setup_vrf_dup()
473{
474	# some VRF tests use ns-C which has the same config as
475	# ns-B but for a device NOT in the VRF
476	create_ns ${NSC} "-" "-"
477	connect_ns ${NSA} ${NSA_DEV2} ${NSA_IP}/24 ${NSA_IP6}/64 \
478		   ${NSC} ${NSC_DEV} ${NSB_IP}/24 ${NSB_IP6}/64
479}
480
481setup()
482{
483	local with_vrf=${1}
484
485	# make sure we are starting with a clean slate
486	kill_procs
487	cleanup 2>/dev/null
488
489	log_debug "Configuring network namespaces"
490	set -e
491
492	create_ns ${NSA} ${NSA_LO_IP}/32 ${NSA_LO_IP6}/128
493	create_ns ${NSB} ${NSB_LO_IP}/32 ${NSB_LO_IP6}/128
494	connect_ns ${NSA} ${NSA_DEV} ${NSA_IP}/24 ${NSA_IP6}/64 \
495		   ${NSB} ${NSB_DEV} ${NSB_IP}/24 ${NSB_IP6}/64
496
497	NSA_LINKIP6=$(get_linklocal ${NSA} ${NSA_DEV})
498	NSB_LINKIP6=$(get_linklocal ${NSB} ${NSB_DEV})
499
500	# tell ns-A how to get to remote addresses of ns-B
501	if [ "${with_vrf}" = "yes" ]; then
502		create_vrf ${NSA} ${VRF} ${VRF_TABLE} ${VRF_IP} ${VRF_IP6}
503
504		ip -netns ${NSA} link set dev ${NSA_DEV} vrf ${VRF}
505		ip -netns ${NSA} ro add vrf ${VRF} ${NSB_LO_IP}/32 via ${NSB_IP} dev ${NSA_DEV}
506		ip -netns ${NSA} -6 ro add vrf ${VRF} ${NSB_LO_IP6}/128 via ${NSB_IP6} dev ${NSA_DEV}
507
508		ip -netns ${NSB} ro add ${VRF_IP}/32 via ${NSA_IP} dev ${NSB_DEV}
509		ip -netns ${NSB} -6 ro add ${VRF_IP6}/128 via ${NSA_IP6} dev ${NSB_DEV}
510	else
511		ip -netns ${NSA} ro add ${NSB_LO_IP}/32 via ${NSB_IP} dev ${NSA_DEV}
512		ip -netns ${NSA} ro add ${NSB_LO_IP6}/128 via ${NSB_IP6} dev ${NSA_DEV}
513	fi
514
515
516	# tell ns-B how to get to remote addresses of ns-A
517	ip -netns ${NSB} ro add ${NSA_LO_IP}/32 via ${NSA_IP} dev ${NSB_DEV}
518	ip -netns ${NSB} ro add ${NSA_LO_IP6}/128 via ${NSA_IP6} dev ${NSB_DEV}
519
520	set +e
521
522	sleep 1
523}
524
525setup_lla_only()
526{
527	# make sure we are starting with a clean slate
528	kill_procs
529	cleanup 2>/dev/null
530
531	log_debug "Configuring network namespaces"
532	set -e
533
534	create_ns ${NSA} "-" "-"
535	create_ns ${NSB} "-" "-"
536	create_ns ${NSC} "-" "-"
537	connect_ns ${NSA} ${NSA_DEV} "-" "-" \
538		   ${NSB} ${NSB_DEV} "-" "-"
539	connect_ns ${NSA} ${NSA_DEV2} "-" "-" \
540		   ${NSC} ${NSC_DEV}  "-" "-"
541
542	NSA_LINKIP6=$(get_linklocal ${NSA} ${NSA_DEV})
543	NSB_LINKIP6=$(get_linklocal ${NSB} ${NSB_DEV})
544	NSC_LINKIP6=$(get_linklocal ${NSC} ${NSC_DEV})
545
546	create_vrf ${NSA} ${VRF} ${VRF_TABLE} "-" "-"
547	ip -netns ${NSA} link set dev ${NSA_DEV} vrf ${VRF}
548	ip -netns ${NSA} link set dev ${NSA_DEV2} vrf ${VRF}
549
550	set +e
551
552	sleep 1
553}
554
555################################################################################
556# IPv4
557
558ipv4_ping_novrf()
559{
560	local a
561
562	#
563	# out
564	#
565	for a in ${NSB_IP} ${NSB_LO_IP}
566	do
567		log_start
568		run_cmd ping -c1 -w1 ${a}
569		log_test_addr ${a} $? 0 "ping out"
570
571		log_start
572		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
573		log_test_addr ${a} $? 0 "ping out, device bind"
574
575		log_start
576		run_cmd ping -c1 -w1 -I ${NSA_LO_IP} ${a}
577		log_test_addr ${a} $? 0 "ping out, address bind"
578	done
579
580	#
581	# in
582	#
583	for a in ${NSA_IP} ${NSA_LO_IP}
584	do
585		log_start
586		run_cmd_nsb ping -c1 -w1 ${a}
587		log_test_addr ${a} $? 0 "ping in"
588	done
589
590	#
591	# local traffic
592	#
593	for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1
594	do
595		log_start
596		run_cmd ping -c1 -w1 ${a}
597		log_test_addr ${a} $? 0 "ping local"
598	done
599
600	#
601	# local traffic, socket bound to device
602	#
603	# address on device
604	a=${NSA_IP}
605	log_start
606	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
607	log_test_addr ${a} $? 0 "ping local, device bind"
608
609	# loopback addresses not reachable from device bind
610	# fails in a really weird way though because ipv4 special cases
611	# route lookups with oif set.
612	for a in ${NSA_LO_IP} 127.0.0.1
613	do
614		log_start
615		show_hint "Fails since address on loopback device is out of device scope"
616		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
617		log_test_addr ${a} $? 1 "ping local, device bind"
618	done
619
620	#
621	# ip rule blocks reachability to remote address
622	#
623	log_start
624	setup_cmd ip rule add pref 32765 from all lookup local
625	setup_cmd ip rule del pref 0 from all lookup local
626	setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit
627	setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit
628
629	a=${NSB_LO_IP}
630	run_cmd ping -c1 -w1 ${a}
631	log_test_addr ${a} $? 2 "ping out, blocked by rule"
632
633	# NOTE: ipv4 actually allows the lookup to fail and yet still create
634	# a viable rtable if the oif (e.g., bind to device) is set, so this
635	# case succeeds despite the rule
636	# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
637
638	a=${NSA_LO_IP}
639	log_start
640	show_hint "Response generates ICMP (or arp request is ignored) due to ip rule"
641	run_cmd_nsb ping -c1 -w1 ${a}
642	log_test_addr ${a} $? 1 "ping in, blocked by rule"
643
644	[ "$VERBOSE" = "1" ] && echo
645	setup_cmd ip rule del pref 32765 from all lookup local
646	setup_cmd ip rule add pref 0 from all lookup local
647	setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit
648	setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit
649
650	#
651	# route blocks reachability to remote address
652	#
653	log_start
654	setup_cmd ip route replace unreachable ${NSB_LO_IP}
655	setup_cmd ip route replace unreachable ${NSB_IP}
656
657	a=${NSB_LO_IP}
658	run_cmd ping -c1 -w1 ${a}
659	log_test_addr ${a} $? 2 "ping out, blocked by route"
660
661	# NOTE: ipv4 actually allows the lookup to fail and yet still create
662	# a viable rtable if the oif (e.g., bind to device) is set, so this
663	# case succeeds despite not having a route for the address
664	# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
665
666	a=${NSA_LO_IP}
667	log_start
668	show_hint "Response is dropped (or arp request is ignored) due to ip route"
669	run_cmd_nsb ping -c1 -w1 ${a}
670	log_test_addr ${a} $? 1 "ping in, blocked by route"
671
672	#
673	# remove 'remote' routes; fallback to default
674	#
675	log_start
676	setup_cmd ip ro del ${NSB_LO_IP}
677
678	a=${NSB_LO_IP}
679	run_cmd ping -c1 -w1 ${a}
680	log_test_addr ${a} $? 2 "ping out, unreachable default route"
681
682	# NOTE: ipv4 actually allows the lookup to fail and yet still create
683	# a viable rtable if the oif (e.g., bind to device) is set, so this
684	# case succeeds despite not having a route for the address
685	# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
686}
687
688ipv4_ping_vrf()
689{
690	local a
691
692	# should default on; does not exist on older kernels
693	set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
694
695	#
696	# out
697	#
698	for a in ${NSB_IP} ${NSB_LO_IP}
699	do
700		log_start
701		run_cmd ping -c1 -w1 -I ${VRF} ${a}
702		log_test_addr ${a} $? 0 "ping out, VRF bind"
703
704		log_start
705		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
706		log_test_addr ${a} $? 0 "ping out, device bind"
707
708		log_start
709		run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${NSA_IP} ${a}
710		log_test_addr ${a} $? 0 "ping out, vrf device + dev address bind"
711
712		log_start
713		run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${VRF_IP} ${a}
714		log_test_addr ${a} $? 0 "ping out, vrf device + vrf address bind"
715	done
716
717	#
718	# in
719	#
720	for a in ${NSA_IP} ${VRF_IP}
721	do
722		log_start
723		run_cmd_nsb ping -c1 -w1 ${a}
724		log_test_addr ${a} $? 0 "ping in"
725	done
726
727	#
728	# local traffic, local address
729	#
730	for a in ${NSA_IP} ${VRF_IP} 127.0.0.1
731	do
732		log_start
733		show_hint "Source address should be ${a}"
734		run_cmd ping -c1 -w1 -I ${VRF} ${a}
735		log_test_addr ${a} $? 0 "ping local, VRF bind"
736	done
737
738	#
739	# local traffic, socket bound to device
740	#
741	# address on device
742	a=${NSA_IP}
743	log_start
744	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
745	log_test_addr ${a} $? 0 "ping local, device bind"
746
747	# vrf device is out of scope
748	for a in ${VRF_IP} 127.0.0.1
749	do
750		log_start
751		show_hint "Fails since address on vrf device is out of device scope"
752		run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
753		log_test_addr ${a} $? 1 "ping local, device bind"
754	done
755
756	#
757	# ip rule blocks address
758	#
759	log_start
760	setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit
761	setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit
762
763	a=${NSB_LO_IP}
764	run_cmd ping -c1 -w1 -I ${VRF} ${a}
765	log_test_addr ${a} $? 2 "ping out, vrf bind, blocked by rule"
766
767	log_start
768	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
769	log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"
770
771	a=${NSA_LO_IP}
772	log_start
773	show_hint "Response lost due to ip rule"
774	run_cmd_nsb ping -c1 -w1 ${a}
775	log_test_addr ${a} $? 1 "ping in, blocked by rule"
776
777	[ "$VERBOSE" = "1" ] && echo
778	setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit
779	setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit
780
781	#
782	# remove 'remote' routes; fallback to default
783	#
784	log_start
785	setup_cmd ip ro del vrf ${VRF} ${NSB_LO_IP}
786
787	a=${NSB_LO_IP}
788	run_cmd ping -c1 -w1 -I ${VRF} ${a}
789	log_test_addr ${a} $? 2 "ping out, vrf bind, unreachable route"
790
791	log_start
792	run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
793	log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"
794
795	a=${NSA_LO_IP}
796	log_start
797	show_hint "Response lost by unreachable route"
798	run_cmd_nsb ping -c1 -w1 ${a}
799	log_test_addr ${a} $? 1 "ping in, unreachable route"
800}
801
802ipv4_ping()
803{
804	log_section "IPv4 ping"
805
806	log_subsection "No VRF"
807	setup
808	set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null
809	ipv4_ping_novrf
810	setup
811	set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
812	ipv4_ping_novrf
813
814	log_subsection "With VRF"
815	setup "yes"
816	ipv4_ping_vrf
817}
818
819################################################################################
820# IPv4 TCP
821
822#
823# MD5 tests without VRF
824#
825ipv4_tcp_md5_novrf()
826{
827	#
828	# single address
829	#
830
831	# basic use case
832	log_start
833	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
834	sleep 1
835	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
836	log_test $? 0 "MD5: Single address config"
837
838	# client sends MD5, server not configured
839	log_start
840	show_hint "Should timeout due to MD5 mismatch"
841	run_cmd nettest -s &
842	sleep 1
843	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
844	log_test $? 2 "MD5: Server no config, client uses password"
845
846	# wrong password
847	log_start
848	show_hint "Should timeout since client uses wrong password"
849	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
850	sleep 1
851	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
852	log_test $? 2 "MD5: Client uses wrong password"
853
854	# client from different address
855	log_start
856	show_hint "Should timeout due to MD5 mismatch"
857	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} &
858	sleep 1
859	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
860	log_test $? 2 "MD5: Client address does not match address configured with password"
861
862	#
863	# MD5 extension - prefix length
864	#
865
866	# client in prefix
867	log_start
868	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
869	sleep 1
870	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
871	log_test $? 0 "MD5: Prefix config"
872
873	# client in prefix, wrong password
874	log_start
875	show_hint "Should timeout since client uses wrong password"
876	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
877	sleep 1
878	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
879	log_test $? 2 "MD5: Prefix config, client uses wrong password"
880
881	# client outside of prefix
882	log_start
883	show_hint "Should timeout due to MD5 mismatch"
884	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
885	sleep 1
886	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
887	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
888}
889
890#
891# MD5 tests with VRF
892#
893ipv4_tcp_md5()
894{
895	#
896	# single address
897	#
898
899	# basic use case
900	log_start
901	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
902	sleep 1
903	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
904	log_test $? 0 "MD5: VRF: Single address config"
905
906	# client sends MD5, server not configured
907	log_start
908	show_hint "Should timeout since server does not have MD5 auth"
909	run_cmd nettest -s -I ${VRF} &
910	sleep 1
911	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
912	log_test $? 2 "MD5: VRF: Server no config, client uses password"
913
914	# wrong password
915	log_start
916	show_hint "Should timeout since client uses wrong password"
917	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
918	sleep 1
919	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
920	log_test $? 2 "MD5: VRF: Client uses wrong password"
921
922	# client from different address
923	log_start
924	show_hint "Should timeout since server config differs from client"
925	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} &
926	sleep 1
927	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
928	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
929
930	#
931	# MD5 extension - prefix length
932	#
933
934	# client in prefix
935	log_start
936	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
937	sleep 1
938	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
939	log_test $? 0 "MD5: VRF: Prefix config"
940
941	# client in prefix, wrong password
942	log_start
943	show_hint "Should timeout since client uses wrong password"
944	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
945	sleep 1
946	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
947	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
948
949	# client outside of prefix
950	log_start
951	show_hint "Should timeout since client address is outside of prefix"
952	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
953	sleep 1
954	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
955	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
956
957	#
958	# duplicate config between default VRF and a VRF
959	#
960
961	log_start
962	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
963	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
964	sleep 1
965	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
966	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
967
968	log_start
969	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
970	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
971	sleep 1
972	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
973	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
974
975	log_start
976	show_hint "Should timeout since client in default VRF uses VRF password"
977	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
978	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
979	sleep 1
980	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
981	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
982
983	log_start
984	show_hint "Should timeout since client in VRF uses default VRF password"
985	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
986	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
987	sleep 1
988	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
989	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
990
991	log_start
992	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
993	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
994	sleep 1
995	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
996	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
997
998	log_start
999	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
1000	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
1001	sleep 1
1002	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
1003	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
1004
1005	log_start
1006	show_hint "Should timeout since client in default VRF uses VRF password"
1007	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
1008	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
1009	sleep 1
1010	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
1011	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
1012
1013	log_start
1014	show_hint "Should timeout since client in VRF uses default VRF password"
1015	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
1016	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
1017	sleep 1
1018	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
1019	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
1020
1021	#
1022	# negative tests
1023	#
1024	log_start
1025	run_cmd nettest -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NSB_IP}
1026	log_test $? 1 "MD5: VRF: Device must be a VRF - single address"
1027
1028	log_start
1029	run_cmd nettest -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NS_NET}
1030	log_test $? 1 "MD5: VRF: Device must be a VRF - prefix"
1031
1032	test_ipv4_md5_vrf__vrf_server__no_bind_ifindex
1033	test_ipv4_md5_vrf__global_server__bind_ifindex0
1034}
1035
1036test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()
1037{
1038	log_start
1039	show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"
1040	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
1041	sleep 1
1042	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
1043	log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"
1044
1045	log_start
1046	show_hint "Binding both the socket and the key is not required but it works"
1047	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
1048	sleep 1
1049	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
1050	log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"
1051}
1052
1053test_ipv4_md5_vrf__global_server__bind_ifindex0()
1054{
1055	# This particular test needs tcp_l3mdev_accept=1 for Global server to accept VRF connections
1056	local old_tcp_l3mdev_accept
1057	old_tcp_l3mdev_accept=$(get_sysctl net.ipv4.tcp_l3mdev_accept)
1058	set_sysctl net.ipv4.tcp_l3mdev_accept=1
1059
1060	log_start
1061	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
1062	sleep 1
1063	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
1064	log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"
1065
1066	log_start
1067	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
1068	sleep 1
1069	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
1070	log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"
1071	log_start
1072
1073	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
1074	sleep 1
1075	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
1076	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"
1077
1078	log_start
1079	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
1080	sleep 1
1081	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
1082	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
1083
1084	# restore value
1085	set_sysctl net.ipv4.tcp_l3mdev_accept="$old_tcp_l3mdev_accept"
1086}
1087
1088ipv4_tcp_novrf()
1089{
1090	local a
1091
1092	#
1093	# server tests
1094	#
1095	for a in ${NSA_IP} ${NSA_LO_IP}
1096	do
1097		log_start
1098		run_cmd nettest -s &
1099		sleep 1
1100		run_cmd_nsb nettest -r ${a}
1101		log_test_addr ${a} $? 0 "Global server"
1102	done
1103
1104	a=${NSA_IP}
1105	log_start
1106	run_cmd nettest -s -I ${NSA_DEV} &
1107	sleep 1
1108	run_cmd_nsb nettest -r ${a}
1109	log_test_addr ${a} $? 0 "Device server"
1110
1111	# verify TCP reset sent and received
1112	for a in ${NSA_IP} ${NSA_LO_IP}
1113	do
1114		log_start
1115		show_hint "Should fail 'Connection refused' since there is no server"
1116		run_cmd_nsb nettest -r ${a}
1117		log_test_addr ${a} $? 1 "No server"
1118	done
1119
1120	#
1121	# client
1122	#
1123	for a in ${NSB_IP} ${NSB_LO_IP}
1124	do
1125		log_start
1126		run_cmd_nsb nettest -s &
1127		sleep 1
1128		run_cmd nettest -r ${a} -0 ${NSA_IP}
1129		log_test_addr ${a} $? 0 "Client"
1130
1131		log_start
1132		run_cmd_nsb nettest -s &
1133		sleep 1
1134		run_cmd nettest -r ${a} -d ${NSA_DEV}
1135		log_test_addr ${a} $? 0 "Client, device bind"
1136
1137		log_start
1138		show_hint "Should fail 'Connection refused'"
1139		run_cmd nettest -r ${a}
1140		log_test_addr ${a} $? 1 "No server, unbound client"
1141
1142		log_start
1143		show_hint "Should fail 'Connection refused'"
1144		run_cmd nettest -r ${a} -d ${NSA_DEV}
1145		log_test_addr ${a} $? 1 "No server, device client"
1146	done
1147
1148	#
1149	# local address tests
1150	#
1151	for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1
1152	do
1153		log_start
1154		run_cmd nettest -s &
1155		sleep 1
1156		run_cmd nettest -r ${a} -0 ${a} -1 ${a}
1157		log_test_addr ${a} $? 0 "Global server, local connection"
1158	done
1159
1160	a=${NSA_IP}
1161	log_start
1162	run_cmd nettest -s -I ${NSA_DEV} &
1163	sleep 1
1164	run_cmd nettest -r ${a} -0 ${a}
1165	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
1166
1167	for a in ${NSA_LO_IP} 127.0.0.1
1168	do
1169		log_start
1170		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
1171		run_cmd nettest -s -I ${NSA_DEV} &
1172		sleep 1
1173		run_cmd nettest -r ${a}
1174		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
1175	done
1176
1177	a=${NSA_IP}
1178	log_start
1179	run_cmd nettest -s &
1180	sleep 1
1181	run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV}
1182	log_test_addr ${a} $? 0 "Global server, device client, local connection"
1183
1184	for a in ${NSA_LO_IP} 127.0.0.1
1185	do
1186		log_start
1187		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
1188		run_cmd nettest -s &
1189		sleep 1
1190		run_cmd nettest -r ${a} -d ${NSA_DEV}
1191		log_test_addr ${a} $? 1 "Global server, device client, local connection"
1192	done
1193
1194	a=${NSA_IP}
1195	log_start
1196	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
1197	sleep 1
1198	run_cmd nettest  -d ${NSA_DEV} -r ${a} -0 ${a}
1199	log_test_addr ${a} $? 0 "Device server, device client, local connection"
1200
1201	log_start
1202	show_hint "Should fail 'Connection refused'"
1203	run_cmd nettest -d ${NSA_DEV} -r ${a}
1204	log_test_addr ${a} $? 1 "No server, device client, local conn"
1205
1206	ipv4_tcp_md5_novrf
1207}
1208
1209ipv4_tcp_vrf()
1210{
1211	local a
1212
1213	# disable global server
1214	log_subsection "Global server disabled"
1215
1216	set_sysctl net.ipv4.tcp_l3mdev_accept=0
1217
1218	#
1219	# server tests
1220	#
1221	for a in ${NSA_IP} ${VRF_IP}
1222	do
1223		log_start
1224		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
1225		run_cmd nettest -s &
1226		sleep 1
1227		run_cmd_nsb nettest -r ${a}
1228		log_test_addr ${a} $? 1 "Global server"
1229
1230		log_start
1231		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
1232		sleep 1
1233		run_cmd_nsb nettest -r ${a}
1234		log_test_addr ${a} $? 0 "VRF server"
1235
1236		log_start
1237		run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
1238		sleep 1
1239		run_cmd_nsb nettest -r ${a}
1240		log_test_addr ${a} $? 0 "Device server"
1241
1242		# verify TCP reset received
1243		log_start
1244		show_hint "Should fail 'Connection refused' since there is no server"
1245		run_cmd_nsb nettest -r ${a}
1246		log_test_addr ${a} $? 1 "No server"
1247	done
1248
1249	# local address tests
1250	# (${VRF_IP} and 127.0.0.1 both timeout)
1251	a=${NSA_IP}
1252	log_start
1253	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
1254	run_cmd nettest -s &
1255	sleep 1
1256	run_cmd nettest -r ${a} -d ${NSA_DEV}
1257	log_test_addr ${a} $? 1 "Global server, local connection"
1258
1259	# run MD5 tests
1260	setup_vrf_dup
1261	ipv4_tcp_md5
1262	cleanup_vrf_dup
1263
1264	#
1265	# enable VRF global server
1266	#
1267	log_subsection "VRF Global server enabled"
1268	set_sysctl net.ipv4.tcp_l3mdev_accept=1
1269
1270	for a in ${NSA_IP} ${VRF_IP}
1271	do
1272		log_start
1273		show_hint "client socket should be bound to VRF"
1274		run_cmd nettest -s -3 ${VRF} &
1275		sleep 1
1276		run_cmd_nsb nettest -r ${a}
1277		log_test_addr ${a} $? 0 "Global server"
1278
1279		log_start
1280		show_hint "client socket should be bound to VRF"
1281		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
1282		sleep 1
1283		run_cmd_nsb nettest -r ${a}
1284		log_test_addr ${a} $? 0 "VRF server"
1285
1286		# verify TCP reset received
1287		log_start
1288		show_hint "Should fail 'Connection refused'"
1289		run_cmd_nsb nettest -r ${a}
1290		log_test_addr ${a} $? 1 "No server"
1291	done
1292
1293	a=${NSA_IP}
1294	log_start
1295	show_hint "client socket should be bound to device"
1296	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
1297	sleep 1
1298	run_cmd_nsb nettest -r ${a}
1299	log_test_addr ${a} $? 0 "Device server"
1300
1301	# local address tests
1302	for a in ${NSA_IP} ${VRF_IP}
1303	do
1304		log_start
1305		show_hint "Should fail 'Connection refused' since client is not bound to VRF"
1306		run_cmd nettest -s -I ${VRF} &
1307		sleep 1
1308		run_cmd nettest -r ${a}
1309		log_test_addr ${a} $? 1 "Global server, local connection"
1310	done
1311
1312	#
1313	# client
1314	#
1315	for a in ${NSB_IP} ${NSB_LO_IP}
1316	do
1317		log_start
1318		run_cmd_nsb nettest -s &
1319		sleep 1
1320		run_cmd nettest -r ${a} -d ${VRF}
1321		log_test_addr ${a} $? 0 "Client, VRF bind"
1322
1323		log_start
1324		run_cmd_nsb nettest -s &
1325		sleep 1
1326		run_cmd nettest -r ${a} -d ${NSA_DEV}
1327		log_test_addr ${a} $? 0 "Client, device bind"
1328
1329		log_start
1330		show_hint "Should fail 'Connection refused'"
1331		run_cmd nettest -r ${a} -d ${VRF}
1332		log_test_addr ${a} $? 1 "No server, VRF client"
1333
1334		log_start
1335		show_hint "Should fail 'Connection refused'"
1336		run_cmd nettest -r ${a} -d ${NSA_DEV}
1337		log_test_addr ${a} $? 1 "No server, device client"
1338	done
1339
1340	for a in ${NSA_IP} ${VRF_IP} 127.0.0.1
1341	do
1342		log_start
1343		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
1344		sleep 1
1345		run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
1346		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
1347	done
1348
1349	a=${NSA_IP}
1350	log_start
1351	run_cmd nettest -s -I ${VRF} -3 ${VRF} &
1352	sleep 1
1353	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
1354	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
1355
1356	log_start
1357	show_hint "Should fail 'No route to host' since client is out of VRF scope"
1358	run_cmd nettest -s -I ${VRF} &
1359	sleep 1
1360	run_cmd nettest -r ${a}
1361	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
1362
1363	log_start
1364	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
1365	sleep 1
1366	run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
1367	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
1368
1369	log_start
1370	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
1371	sleep 1
1372	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
1373	log_test_addr ${a} $? 0 "Device server, device client, local connection"
1374}
1375
1376ipv4_tcp()
1377{
1378	log_section "IPv4/TCP"
1379	log_subsection "No VRF"
1380	setup
1381
1382	# tcp_l3mdev_accept should have no affect without VRF;
1383	# run tests with it enabled and disabled to verify
1384	log_subsection "tcp_l3mdev_accept disabled"
1385	set_sysctl net.ipv4.tcp_l3mdev_accept=0
1386	ipv4_tcp_novrf
1387	log_subsection "tcp_l3mdev_accept enabled"
1388	set_sysctl net.ipv4.tcp_l3mdev_accept=1
1389	ipv4_tcp_novrf
1390
1391	log_subsection "With VRF"
1392	setup "yes"
1393	ipv4_tcp_vrf
1394}
1395
1396################################################################################
1397# IPv4 UDP
1398
1399ipv4_udp_novrf()
1400{
1401	local a
1402
1403	#
1404	# server tests
1405	#
1406	for a in ${NSA_IP} ${NSA_LO_IP}
1407	do
1408		log_start
1409		run_cmd nettest -D -s -3 ${NSA_DEV} &
1410		sleep 1
1411		run_cmd_nsb nettest -D -r ${a}
1412		log_test_addr ${a} $? 0 "Global server"
1413
1414		log_start
1415		show_hint "Should fail 'Connection refused' since there is no server"
1416		run_cmd_nsb nettest -D -r ${a}
1417		log_test_addr ${a} $? 1 "No server"
1418	done
1419
1420	a=${NSA_IP}
1421	log_start
1422	run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
1423	sleep 1
1424	run_cmd_nsb nettest -D -r ${a}
1425	log_test_addr ${a} $? 0 "Device server"
1426
1427	#
1428	# client
1429	#
1430	for a in ${NSB_IP} ${NSB_LO_IP}
1431	do
1432		log_start
1433		run_cmd_nsb nettest -D -s &
1434		sleep 1
1435		run_cmd nettest -D -r ${a} -0 ${NSA_IP}
1436		log_test_addr ${a} $? 0 "Client"
1437
1438		log_start
1439		run_cmd_nsb nettest -D -s &
1440		sleep 1
1441		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP}
1442		log_test_addr ${a} $? 0 "Client, device bind"
1443
1444		log_start
1445		run_cmd_nsb nettest -D -s &
1446		sleep 1
1447		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP}
1448		log_test_addr ${a} $? 0 "Client, device send via cmsg"
1449
1450		log_start
1451		run_cmd_nsb nettest -D -s &
1452		sleep 1
1453		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP}
1454		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF"
1455
1456		log_start
1457		show_hint "Should fail 'Connection refused'"
1458		run_cmd nettest -D -r ${a}
1459		log_test_addr ${a} $? 1 "No server, unbound client"
1460
1461		log_start
1462		show_hint "Should fail 'Connection refused'"
1463		run_cmd nettest -D -r ${a} -d ${NSA_DEV}
1464		log_test_addr ${a} $? 1 "No server, device client"
1465	done
1466
1467	#
1468	# local address tests
1469	#
1470	for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1
1471	do
1472		log_start
1473		run_cmd nettest -D -s &
1474		sleep 1
1475		run_cmd nettest -D -r ${a} -0 ${a} -1 ${a}
1476		log_test_addr ${a} $? 0 "Global server, local connection"
1477	done
1478
1479	a=${NSA_IP}
1480	log_start
1481	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
1482	sleep 1
1483	run_cmd nettest -D -r ${a}
1484	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
1485
1486	for a in ${NSA_LO_IP} 127.0.0.1
1487	do
1488		log_start
1489		show_hint "Should fail 'Connection refused' since address is out of device scope"
1490		run_cmd nettest -s -D -I ${NSA_DEV} &
1491		sleep 1
1492		run_cmd nettest -D -r ${a}
1493		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
1494	done
1495
1496	a=${NSA_IP}
1497	log_start
1498	run_cmd nettest -s -D &
1499	sleep 1
1500	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
1501	log_test_addr ${a} $? 0 "Global server, device client, local connection"
1502
1503	log_start
1504	run_cmd nettest -s -D &
1505	sleep 1
1506	run_cmd nettest -D -d ${NSA_DEV} -C -r ${a}
1507	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
1508
1509	log_start
1510	run_cmd nettest -s -D &
1511	sleep 1
1512	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a}
1513	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection"
1514
1515	# IPv4 with device bind has really weird behavior - it overrides the
1516	# fib lookup, generates an rtable and tries to send the packet. This
1517	# causes failures for local traffic at different places
1518	for a in ${NSA_LO_IP} 127.0.0.1
1519	do
1520		log_start
1521		show_hint "Should fail since addresses on loopback are out of device scope"
1522		run_cmd nettest -D -s &
1523		sleep 1
1524		run_cmd nettest -D -r ${a} -d ${NSA_DEV}
1525		log_test_addr ${a} $? 2 "Global server, device client, local connection"
1526
1527		log_start
1528		show_hint "Should fail since addresses on loopback are out of device scope"
1529		run_cmd nettest -D -s &
1530		sleep 1
1531		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C
1532		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
1533
1534		log_start
1535		show_hint "Should fail since addresses on loopback are out of device scope"
1536		run_cmd nettest -D -s &
1537		sleep 1
1538		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S
1539		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
1540	done
1541
1542	a=${NSA_IP}
1543	log_start
1544	run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
1545	sleep 1
1546	run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a}
1547	log_test_addr ${a} $? 0 "Device server, device client, local conn"
1548
1549	log_start
1550	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
1551	log_test_addr ${a} $? 2 "No server, device client, local conn"
1552}
1553
1554ipv4_udp_vrf()
1555{
1556	local a
1557
1558	# disable global server
1559	log_subsection "Global server disabled"
1560	set_sysctl net.ipv4.udp_l3mdev_accept=0
1561
1562	#
1563	# server tests
1564	#
1565	for a in ${NSA_IP} ${VRF_IP}
1566	do
1567		log_start
1568		show_hint "Fails because ingress is in a VRF and global server is disabled"
1569		run_cmd nettest -D -s &
1570		sleep 1
1571		run_cmd_nsb nettest -D -r ${a}
1572		log_test_addr ${a} $? 1 "Global server"
1573
1574		log_start
1575		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
1576		sleep 1
1577		run_cmd_nsb nettest -D -r ${a}
1578		log_test_addr ${a} $? 0 "VRF server"
1579
1580		log_start
1581		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
1582		sleep 1
1583		run_cmd_nsb nettest -D -r ${a}
1584		log_test_addr ${a} $? 0 "Enslaved device server"
1585
1586		log_start
1587		show_hint "Should fail 'Connection refused' since there is no server"
1588		run_cmd_nsb nettest -D -r ${a}
1589		log_test_addr ${a} $? 1 "No server"
1590
1591		log_start
1592		show_hint "Should fail 'Connection refused' since global server is out of scope"
1593		run_cmd nettest -D -s &
1594		sleep 1
1595		run_cmd nettest -D -d ${VRF} -r ${a}
1596		log_test_addr ${a} $? 1 "Global server, VRF client, local connection"
1597	done
1598
1599	a=${NSA_IP}
1600	log_start
1601	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
1602	sleep 1
1603	run_cmd nettest -D -d ${VRF} -r ${a}
1604	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
1605
1606	log_start
1607	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
1608	sleep 1
1609	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
1610	log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection"
1611
1612	a=${NSA_IP}
1613	log_start
1614	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
1615	sleep 1
1616	run_cmd nettest -D -d ${VRF} -r ${a}
1617	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
1618
1619	log_start
1620	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
1621	sleep 1
1622	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
1623	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
1624
1625	# enable global server
1626	log_subsection "Global server enabled"
1627	set_sysctl net.ipv4.udp_l3mdev_accept=1
1628
1629	#
1630	# server tests
1631	#
1632	for a in ${NSA_IP} ${VRF_IP}
1633	do
1634		log_start
1635		run_cmd nettest -D -s -3 ${NSA_DEV} &
1636		sleep 1
1637		run_cmd_nsb nettest -D -r ${a}
1638		log_test_addr ${a} $? 0 "Global server"
1639
1640		log_start
1641		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
1642		sleep 1
1643		run_cmd_nsb nettest -D -r ${a}
1644		log_test_addr ${a} $? 0 "VRF server"
1645
1646		log_start
1647		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
1648		sleep 1
1649		run_cmd_nsb nettest -D -r ${a}
1650		log_test_addr ${a} $? 0 "Enslaved device server"
1651
1652		log_start
1653		show_hint "Should fail 'Connection refused'"
1654		run_cmd_nsb nettest -D -r ${a}
1655		log_test_addr ${a} $? 1 "No server"
1656	done
1657
1658	#
1659	# client tests
1660	#
1661	log_start
1662	run_cmd_nsb nettest -D -s &
1663	sleep 1
1664	run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP}
1665	log_test $? 0 "VRF client"
1666
1667	log_start
1668	run_cmd_nsb nettest -D -s &
1669	sleep 1
1670	run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP}
1671	log_test $? 0 "Enslaved device client"
1672
1673	# negative test - should fail
1674	log_start
1675	show_hint "Should fail 'Connection refused'"
1676	run_cmd nettest -D -d ${VRF} -r ${NSB_IP}
1677	log_test $? 1 "No server, VRF client"
1678
1679	log_start
1680	show_hint "Should fail 'Connection refused'"
1681	run_cmd nettest -D -d ${NSA_DEV} -r ${NSB_IP}
1682	log_test $? 1 "No server, enslaved device client"
1683
1684	#
1685	# local address tests
1686	#
1687	a=${NSA_IP}
1688	log_start
1689	run_cmd nettest -D -s -3 ${NSA_DEV} &
1690	sleep 1
1691	run_cmd nettest -D -d ${VRF} -r ${a}
1692	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
1693
1694	log_start
1695	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
1696	sleep 1
1697	run_cmd nettest -D -d ${VRF} -r ${a}
1698	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
1699
1700	log_start
1701	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
1702	sleep 1
1703	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
1704	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
1705
1706	log_start
1707	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
1708	sleep 1
1709	run_cmd nettest -D -d ${VRF} -r ${a}
1710	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
1711
1712	log_start
1713	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
1714	sleep 1
1715	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
1716	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
1717
1718	for a in ${VRF_IP} 127.0.0.1
1719	do
1720		log_start
1721		run_cmd nettest -D -s -3 ${VRF} &
1722		sleep 1
1723		run_cmd nettest -D -d ${VRF} -r ${a}
1724		log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
1725	done
1726
1727	for a in ${VRF_IP} 127.0.0.1
1728	do
1729		log_start
1730		run_cmd nettest -s -D -I ${VRF} -3 ${VRF} &
1731		sleep 1
1732		run_cmd nettest -D -d ${VRF} -r ${a}
1733		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
1734	done
1735
1736	# negative test - should fail
1737	# verifies ECONNREFUSED
1738	for a in ${NSA_IP} ${VRF_IP} 127.0.0.1
1739	do
1740		log_start
1741		show_hint "Should fail 'Connection refused'"
1742		run_cmd nettest -D -d ${VRF} -r ${a}
1743		log_test_addr ${a} $? 1 "No server, VRF client, local conn"
1744	done
1745}
1746
1747ipv4_udp()
1748{
1749	log_section "IPv4/UDP"
1750	log_subsection "No VRF"
1751
1752	setup
1753
1754	# udp_l3mdev_accept should have no affect without VRF;
1755	# run tests with it enabled and disabled to verify
1756	log_subsection "udp_l3mdev_accept disabled"
1757	set_sysctl net.ipv4.udp_l3mdev_accept=0
1758	ipv4_udp_novrf
1759	log_subsection "udp_l3mdev_accept enabled"
1760	set_sysctl net.ipv4.udp_l3mdev_accept=1
1761	ipv4_udp_novrf
1762
1763	log_subsection "With VRF"
1764	setup "yes"
1765	ipv4_udp_vrf
1766}
1767
1768################################################################################
1769# IPv4 address bind
1770#
1771# verifies ability or inability to bind to an address / device
1772
1773ipv4_addr_bind_novrf()
1774{
1775	#
1776	# raw socket
1777	#
1778	for a in ${NSA_IP} ${NSA_LO_IP}
1779	do
1780		log_start
1781		run_cmd nettest -s -R -P icmp -l ${a} -b
1782		log_test_addr ${a} $? 0 "Raw socket bind to local address"
1783
1784		log_start
1785		run_cmd nettest -s -R -P icmp -l ${a} -I ${NSA_DEV} -b
1786		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"
1787	done
1788
1789	#
1790	# raw socket with nonlocal bind
1791	#
1792	a=${NL_IP}
1793	log_start
1794	run_cmd nettest -s -R -P icmp -f -l ${a} -I ${NSA_DEV} -b
1795	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address after device bind"
1796
1797	#
1798	# tcp sockets
1799	#
1800	a=${NSA_IP}
1801	log_start
1802	run_cmd nettest -c ${a} -r ${NSB_IP} -t1 -b
1803	log_test_addr ${a} $? 0 "TCP socket bind to local address"
1804
1805	log_start
1806	run_cmd nettest -c ${a} -r ${NSB_IP} -d ${NSA_DEV} -t1 -b
1807	log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind"
1808
1809	# Sadly, the kernel allows binding a socket to a device and then
1810	# binding to an address not on the device. The only restriction
1811	# is that the address is valid in the L3 domain. So this test
1812	# passes when it really should not
1813	#a=${NSA_LO_IP}
1814	#log_start
1815	#show_hint "Should fail with 'Cannot assign requested address'"
1816	#run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b
1817	#log_test_addr ${a} $? 1 "TCP socket bind to out of scope local address"
1818}
1819
1820ipv4_addr_bind_vrf()
1821{
1822	#
1823	# raw socket
1824	#
1825	for a in ${NSA_IP} ${VRF_IP}
1826	do
1827		log_start
1828		show_hint "Socket not bound to VRF, but address is in VRF"
1829		run_cmd nettest -s -R -P icmp -l ${a} -b
1830		log_test_addr ${a} $? 1 "Raw socket bind to local address"
1831
1832		log_start
1833		run_cmd nettest -s -R -P icmp -l ${a} -I ${NSA_DEV} -b
1834		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"
1835		log_start
1836		run_cmd nettest -s -R -P icmp -l ${a} -I ${VRF} -b
1837		log_test_addr ${a} $? 0 "Raw socket bind to local address after VRF bind"
1838	done
1839
1840	a=${NSA_LO_IP}
1841	log_start
1842	show_hint "Address on loopback is out of VRF scope"
1843	run_cmd nettest -s -R -P icmp -l ${a} -I ${VRF} -b
1844	log_test_addr ${a} $? 1 "Raw socket bind to out of scope address after VRF bind"
1845
1846	#
1847	# raw socket with nonlocal bind
1848	#
1849	a=${NL_IP}
1850	log_start
1851	run_cmd nettest -s -R -P icmp -f -l ${a} -I ${VRF} -b
1852	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address after VRF bind"
1853
1854	#
1855	# tcp sockets
1856	#
1857	for a in ${NSA_IP} ${VRF_IP}
1858	do
1859		log_start
1860		run_cmd nettest -s -l ${a} -I ${VRF} -t1 -b
1861		log_test_addr ${a} $? 0 "TCP socket bind to local address"
1862
1863		log_start
1864		run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b
1865		log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind"
1866	done
1867
1868	a=${NSA_LO_IP}
1869	log_start
1870	show_hint "Address on loopback out of scope for VRF"
1871	run_cmd nettest -s -l ${a} -I ${VRF} -t1 -b
1872	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for VRF"
1873
1874	log_start
1875	show_hint "Address on loopback out of scope for device in VRF"
1876	run_cmd nettest -s -l ${a} -I ${NSA_DEV} -t1 -b
1877	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for device bind"
1878}
1879
1880ipv4_addr_bind()
1881{
1882	log_section "IPv4 address binds"
1883
1884	log_subsection "No VRF"
1885	setup
1886	ipv4_addr_bind_novrf
1887
1888	log_subsection "With VRF"
1889	setup "yes"
1890	ipv4_addr_bind_vrf
1891}
1892
1893################################################################################
1894# IPv4 runtime tests
1895
1896ipv4_rt()
1897{
1898	local desc="$1"
1899	local varg="$2"
1900	local with_vrf="yes"
1901	local a
1902
1903	#
1904	# server tests
1905	#
1906	for a in ${NSA_IP} ${VRF_IP}
1907	do
1908		log_start
1909		run_cmd nettest ${varg} -s &
1910		sleep 1
1911		run_cmd_nsb nettest ${varg} -r ${a} &
1912		sleep 3
1913		run_cmd ip link del ${VRF}
1914		sleep 1
1915		log_test_addr ${a} 0 0 "${desc}, global server"
1916
1917		setup ${with_vrf}
1918	done
1919
1920	for a in ${NSA_IP} ${VRF_IP}
1921	do
1922		log_start
1923		run_cmd nettest ${varg} -s -I ${VRF} &
1924		sleep 1
1925		run_cmd_nsb nettest ${varg} -r ${a} &
1926		sleep 3
1927		run_cmd ip link del ${VRF}
1928		sleep 1
1929		log_test_addr ${a} 0 0 "${desc}, VRF server"
1930
1931		setup ${with_vrf}
1932	done
1933
1934	a=${NSA_IP}
1935	log_start
1936	run_cmd nettest ${varg} -s -I ${NSA_DEV} &
1937	sleep 1
1938	run_cmd_nsb nettest ${varg} -r ${a} &
1939	sleep 3
1940	run_cmd ip link del ${VRF}
1941	sleep 1
1942	log_test_addr ${a} 0 0 "${desc}, enslaved device server"
1943
1944	setup ${with_vrf}
1945
1946	#
1947	# client test
1948	#
1949	log_start
1950	run_cmd_nsb nettest ${varg} -s &
1951	sleep 1
1952	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} &
1953	sleep 3
1954	run_cmd ip link del ${VRF}
1955	sleep 1
1956	log_test_addr ${a} 0 0 "${desc}, VRF client"
1957
1958	setup ${with_vrf}
1959
1960	log_start
1961	run_cmd_nsb nettest ${varg} -s &
1962	sleep 1
1963	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} &
1964	sleep 3
1965	run_cmd ip link del ${VRF}
1966	sleep 1
1967	log_test_addr ${a} 0 0 "${desc}, enslaved device client"
1968
1969	setup ${with_vrf}
1970
1971	#
1972	# local address tests
1973	#
1974	for a in ${NSA_IP} ${VRF_IP}
1975	do
1976		log_start
1977		run_cmd nettest ${varg} -s &
1978		sleep 1
1979		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
1980		sleep 3
1981		run_cmd ip link del ${VRF}
1982		sleep 1
1983		log_test_addr ${a} 0 0 "${desc}, global server, VRF client, local"
1984
1985		setup ${with_vrf}
1986	done
1987
1988	for a in ${NSA_IP} ${VRF_IP}
1989	do
1990		log_start
1991		run_cmd nettest ${varg} -I ${VRF} -s &
1992		sleep 1
1993		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
1994		sleep 3
1995		run_cmd ip link del ${VRF}
1996		sleep 1
1997		log_test_addr ${a} 0 0 "${desc}, VRF server and client, local"
1998
1999		setup ${with_vrf}
2000	done
2001
2002	a=${NSA_IP}
2003	log_start
2004
2005	run_cmd nettest ${varg} -s &
2006	sleep 1
2007	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
2008	sleep 3
2009	run_cmd ip link del ${VRF}
2010	sleep 1
2011	log_test_addr ${a} 0 0 "${desc}, global server, enslaved device client, local"
2012
2013	setup ${with_vrf}
2014
2015	log_start
2016	run_cmd nettest ${varg} -I ${VRF} -s &
2017	sleep 1
2018	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
2019	sleep 3
2020	run_cmd ip link del ${VRF}
2021	sleep 1
2022	log_test_addr ${a} 0 0 "${desc}, VRF server, enslaved device client, local"
2023
2024	setup ${with_vrf}
2025
2026	log_start
2027	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
2028	sleep 1
2029	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
2030	sleep 3
2031	run_cmd ip link del ${VRF}
2032	sleep 1
2033	log_test_addr ${a} 0 0 "${desc}, enslaved device server and client, local"
2034}
2035
2036ipv4_ping_rt()
2037{
2038	local with_vrf="yes"
2039	local a
2040
2041	for a in ${NSA_IP} ${VRF_IP}
2042	do
2043		log_start
2044		run_cmd_nsb ping -f ${a} &
2045		sleep 3
2046		run_cmd ip link del ${VRF}
2047		sleep 1
2048		log_test_addr ${a} 0 0 "Device delete with active traffic - ping in"
2049
2050		setup ${with_vrf}
2051	done
2052
2053	a=${NSB_IP}
2054	log_start
2055	run_cmd ping -f -I ${VRF} ${a} &
2056	sleep 3
2057	run_cmd ip link del ${VRF}
2058	sleep 1
2059	log_test_addr ${a} 0 0 "Device delete with active traffic - ping out"
2060}
2061
2062ipv4_runtime()
2063{
2064	log_section "Run time tests - ipv4"
2065
2066	setup "yes"
2067	ipv4_ping_rt
2068
2069	setup "yes"
2070	ipv4_rt "TCP active socket"  "-n -1"
2071
2072	setup "yes"
2073	ipv4_rt "TCP passive socket" "-i"
2074}
2075
2076################################################################################
2077# IPv6
2078
2079ipv6_ping_novrf()
2080{
2081	local a
2082
2083	# should not have an impact, but make a known state
2084	set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null
2085
2086	#
2087	# out
2088	#
2089	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}
2090	do
2091		log_start
2092		run_cmd ${ping6} -c1 -w1 ${a}
2093		log_test_addr ${a} $? 0 "ping out"
2094	done
2095
2096	for a in ${NSB_IP6} ${NSB_LO_IP6}
2097	do
2098		log_start
2099		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2100		log_test_addr ${a} $? 0 "ping out, device bind"
2101
2102		log_start
2103		run_cmd ${ping6} -c1 -w1 -I ${NSA_LO_IP6} ${a}
2104		log_test_addr ${a} $? 0 "ping out, loopback address bind"
2105	done
2106
2107	#
2108	# in
2109	#
2110	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV} ${MCAST}%${NSB_DEV}
2111	do
2112		log_start
2113		run_cmd_nsb ${ping6} -c1 -w1 ${a}
2114		log_test_addr ${a} $? 0 "ping in"
2115	done
2116
2117	#
2118	# local traffic, local address
2119	#
2120	for a in ${NSA_IP6} ${NSA_LO_IP6} ::1 ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}
2121	do
2122		log_start
2123		run_cmd ${ping6} -c1 -w1 ${a}
2124		log_test_addr ${a} $? 0 "ping local, no bind"
2125	done
2126
2127	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}
2128	do
2129		log_start
2130		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2131		log_test_addr ${a} $? 0 "ping local, device bind"
2132	done
2133
2134	for a in ${NSA_LO_IP6} ::1
2135	do
2136		log_start
2137		show_hint "Fails since address on loopback is out of device scope"
2138		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2139		log_test_addr ${a} $? 2 "ping local, device bind"
2140	done
2141
2142	#
2143	# ip rule blocks address
2144	#
2145	log_start
2146	setup_cmd ip -6 rule add pref 32765 from all lookup local
2147	setup_cmd ip -6 rule del pref 0 from all lookup local
2148	setup_cmd ip -6 rule add pref 50 to ${NSB_LO_IP6} prohibit
2149	setup_cmd ip -6 rule add pref 51 from ${NSB_IP6} prohibit
2150
2151	a=${NSB_LO_IP6}
2152	run_cmd ${ping6} -c1 -w1 ${a}
2153	log_test_addr ${a} $? 2 "ping out, blocked by rule"
2154
2155	log_start
2156	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2157	log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"
2158
2159	a=${NSA_LO_IP6}
2160	log_start
2161	show_hint "Response lost due to ip rule"
2162	run_cmd_nsb ${ping6} -c1 -w1 ${a}
2163	log_test_addr ${a} $? 1 "ping in, blocked by rule"
2164
2165	setup_cmd ip -6 rule add pref 0 from all lookup local
2166	setup_cmd ip -6 rule del pref 32765 from all lookup local
2167	setup_cmd ip -6 rule del pref 50 to ${NSB_LO_IP6} prohibit
2168	setup_cmd ip -6 rule del pref 51 from ${NSB_IP6} prohibit
2169
2170	#
2171	# route blocks reachability to remote address
2172	#
2173	log_start
2174	setup_cmd ip -6 route del ${NSB_LO_IP6}
2175	setup_cmd ip -6 route add unreachable ${NSB_LO_IP6} metric 10
2176	setup_cmd ip -6 route add unreachable ${NSB_IP6} metric 10
2177
2178	a=${NSB_LO_IP6}
2179	run_cmd ${ping6} -c1 -w1 ${a}
2180	log_test_addr ${a} $? 2 "ping out, blocked by route"
2181
2182	log_start
2183	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2184	log_test_addr ${a} $? 2 "ping out, device bind, blocked by route"
2185
2186	a=${NSA_LO_IP6}
2187	log_start
2188	show_hint "Response lost due to ip route"
2189	run_cmd_nsb ${ping6} -c1 -w1 ${a}
2190	log_test_addr ${a} $? 1 "ping in, blocked by route"
2191
2192
2193	#
2194	# remove 'remote' routes; fallback to default
2195	#
2196	log_start
2197	setup_cmd ip -6 ro del unreachable ${NSB_LO_IP6}
2198	setup_cmd ip -6 ro del unreachable ${NSB_IP6}
2199
2200	a=${NSB_LO_IP6}
2201	run_cmd ${ping6} -c1 -w1 ${a}
2202	log_test_addr ${a} $? 2 "ping out, unreachable route"
2203
2204	log_start
2205	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2206	log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"
2207}
2208
2209ipv6_ping_vrf()
2210{
2211	local a
2212
2213	# should default on; does not exist on older kernels
2214	set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
2215
2216	#
2217	# out
2218	#
2219	for a in ${NSB_IP6} ${NSB_LO_IP6}
2220	do
2221		log_start
2222		run_cmd ${ping6} -c1 -w1 -I ${VRF} ${a}
2223		log_test_addr ${a} $? 0 "ping out, VRF bind"
2224	done
2225
2226	for a in ${NSB_LINKIP6}%${VRF} ${MCAST}%${VRF}
2227	do
2228		log_start
2229		show_hint "Fails since VRF device does not support linklocal or multicast"
2230		run_cmd ${ping6} -c1 -w1 ${a}
2231		log_test_addr ${a} $? 1 "ping out, VRF bind"
2232	done
2233
2234	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}
2235	do
2236		log_start
2237		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2238		log_test_addr ${a} $? 0 "ping out, device bind"
2239	done
2240
2241	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}
2242	do
2243		log_start
2244		run_cmd ip vrf exec ${VRF} ${ping6} -c1 -w1 -I ${VRF_IP6} ${a}
2245		log_test_addr ${a} $? 0 "ping out, vrf device+address bind"
2246	done
2247
2248	#
2249	# in
2250	#
2251	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV} ${MCAST}%${NSB_DEV}
2252	do
2253		log_start
2254		run_cmd_nsb ${ping6} -c1 -w1 ${a}
2255		log_test_addr ${a} $? 0 "ping in"
2256	done
2257
2258	a=${NSA_LO_IP6}
2259	log_start
2260	show_hint "Fails since loopback address is out of VRF scope"
2261	run_cmd_nsb ${ping6} -c1 -w1 ${a}
2262	log_test_addr ${a} $? 1 "ping in"
2263
2264	#
2265	# local traffic, local address
2266	#
2267	for a in ${NSA_IP6} ${VRF_IP6} ::1
2268	do
2269		log_start
2270		show_hint "Source address should be ${a}"
2271		run_cmd ${ping6} -c1 -w1 -I ${VRF} ${a}
2272		log_test_addr ${a} $? 0 "ping local, VRF bind"
2273	done
2274
2275	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}
2276	do
2277		log_start
2278		run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2279		log_test_addr ${a} $? 0 "ping local, device bind"
2280	done
2281
2282	# LLA to GUA - remove ipv6 global addresses from ns-B
2283	setup_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV}
2284	setup_cmd_nsb ip -6 addr del ${NSB_LO_IP6}/128 dev lo
2285	setup_cmd_nsb ip -6 ro add ${NSA_IP6}/128 via ${NSA_LINKIP6} dev ${NSB_DEV}
2286
2287	for a in ${NSA_IP6} ${VRF_IP6}
2288	do
2289		log_start
2290		run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6}
2291		log_test_addr ${a} $? 0 "ping in, LLA to GUA"
2292	done
2293
2294	setup_cmd_nsb ip -6 ro del ${NSA_IP6}/128 via ${NSA_LINKIP6} dev ${NSB_DEV}
2295	setup_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV}
2296	setup_cmd_nsb ip -6 addr add ${NSB_LO_IP6}/128 dev lo
2297
2298	#
2299	# ip rule blocks address
2300	#
2301	log_start
2302	setup_cmd ip -6 rule add pref 50 to ${NSB_LO_IP6} prohibit
2303	setup_cmd ip -6 rule add pref 51 from ${NSB_IP6} prohibit
2304
2305	a=${NSB_LO_IP6}
2306	run_cmd ${ping6} -c1 -w1 ${a}
2307	log_test_addr ${a} $? 2 "ping out, blocked by rule"
2308
2309	log_start
2310	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2311	log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"
2312
2313	a=${NSA_LO_IP6}
2314	log_start
2315	show_hint "Response lost due to ip rule"
2316	run_cmd_nsb ${ping6} -c1 -w1 ${a}
2317	log_test_addr ${a} $? 1 "ping in, blocked by rule"
2318
2319	log_start
2320	setup_cmd ip -6 rule del pref 50 to ${NSB_LO_IP6} prohibit
2321	setup_cmd ip -6 rule del pref 51 from ${NSB_IP6} prohibit
2322
2323	#
2324	# remove 'remote' routes; fallback to default
2325	#
2326	log_start
2327	setup_cmd ip -6 ro del ${NSB_LO_IP6} vrf ${VRF}
2328
2329	a=${NSB_LO_IP6}
2330	run_cmd ${ping6} -c1 -w1 ${a}
2331	log_test_addr ${a} $? 2 "ping out, unreachable route"
2332
2333	log_start
2334	run_cmd ${ping6} -c1 -w1 -I ${NSA_DEV} ${a}
2335	log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"
2336
2337	ip -netns ${NSB} -6 ro del ${NSA_LO_IP6}
2338	a=${NSA_LO_IP6}
2339	log_start
2340	run_cmd_nsb ${ping6} -c1 -w1 ${a}
2341	log_test_addr ${a} $? 2 "ping in, unreachable route"
2342}
2343
2344ipv6_ping()
2345{
2346	log_section "IPv6 ping"
2347
2348	log_subsection "No VRF"
2349	setup
2350	ipv6_ping_novrf
2351
2352	log_subsection "With VRF"
2353	setup "yes"
2354	ipv6_ping_vrf
2355}
2356
2357################################################################################
2358# IPv6 TCP
2359
2360#
2361# MD5 tests without VRF
2362#
2363ipv6_tcp_md5_novrf()
2364{
2365	#
2366	# single address
2367	#
2368
2369	# basic use case
2370	log_start
2371	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
2372	sleep 1
2373	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2374	log_test $? 0 "MD5: Single address config"
2375
2376	# client sends MD5, server not configured
2377	log_start
2378	show_hint "Should timeout due to MD5 mismatch"
2379	run_cmd nettest -6 -s &
2380	sleep 1
2381	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2382	log_test $? 2 "MD5: Server no config, client uses password"
2383
2384	# wrong password
2385	log_start
2386	show_hint "Should timeout since client uses wrong password"
2387	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
2388	sleep 1
2389	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2390	log_test $? 2 "MD5: Client uses wrong password"
2391
2392	# client from different address
2393	log_start
2394	show_hint "Should timeout due to MD5 mismatch"
2395	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} &
2396	sleep 1
2397	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2398	log_test $? 2 "MD5: Client address does not match address configured with password"
2399
2400	#
2401	# MD5 extension - prefix length
2402	#
2403
2404	# client in prefix
2405	log_start
2406	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
2407	sleep 1
2408	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2409	log_test $? 0 "MD5: Prefix config"
2410
2411	# client in prefix, wrong password
2412	log_start
2413	show_hint "Should timeout since client uses wrong password"
2414	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
2415	sleep 1
2416	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2417	log_test $? 2 "MD5: Prefix config, client uses wrong password"
2418
2419	# client outside of prefix
2420	log_start
2421	show_hint "Should timeout due to MD5 mismatch"
2422	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
2423	sleep 1
2424	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
2425	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
2426}
2427
2428#
2429# MD5 tests with VRF
2430#
2431ipv6_tcp_md5()
2432{
2433	#
2434	# single address
2435	#
2436
2437	# basic use case
2438	log_start
2439	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
2440	sleep 1
2441	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2442	log_test $? 0 "MD5: VRF: Single address config"
2443
2444	# client sends MD5, server not configured
2445	log_start
2446	show_hint "Should timeout since server does not have MD5 auth"
2447	run_cmd nettest -6 -s -I ${VRF} &
2448	sleep 1
2449	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2450	log_test $? 2 "MD5: VRF: Server no config, client uses password"
2451
2452	# wrong password
2453	log_start
2454	show_hint "Should timeout since client uses wrong password"
2455	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
2456	sleep 1
2457	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2458	log_test $? 2 "MD5: VRF: Client uses wrong password"
2459
2460	# client from different address
2461	log_start
2462	show_hint "Should timeout since server config differs from client"
2463	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} &
2464	sleep 1
2465	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2466	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
2467
2468	#
2469	# MD5 extension - prefix length
2470	#
2471
2472	# client in prefix
2473	log_start
2474	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
2475	sleep 1
2476	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2477	log_test $? 0 "MD5: VRF: Prefix config"
2478
2479	# client in prefix, wrong password
2480	log_start
2481	show_hint "Should timeout since client uses wrong password"
2482	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
2483	sleep 1
2484	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2485	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
2486
2487	# client outside of prefix
2488	log_start
2489	show_hint "Should timeout since client address is outside of prefix"
2490	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
2491	sleep 1
2492	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
2493	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
2494
2495	#
2496	# duplicate config between default VRF and a VRF
2497	#
2498
2499	log_start
2500	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
2501	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
2502	sleep 1
2503	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2504	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
2505
2506	log_start
2507	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
2508	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
2509	sleep 1
2510	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2511	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
2512
2513	log_start
2514	show_hint "Should timeout since client in default VRF uses VRF password"
2515	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
2516	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
2517	sleep 1
2518	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2519	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
2520
2521	log_start
2522	show_hint "Should timeout since client in VRF uses default VRF password"
2523	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
2524	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
2525	sleep 1
2526	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2527	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
2528
2529	log_start
2530	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
2531	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
2532	sleep 1
2533	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2534	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
2535
2536	log_start
2537	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
2538	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
2539	sleep 1
2540	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2541	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
2542
2543	log_start
2544	show_hint "Should timeout since client in default VRF uses VRF password"
2545	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
2546	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
2547	sleep 1
2548	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
2549	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
2550
2551	log_start
2552	show_hint "Should timeout since client in VRF uses default VRF password"
2553	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
2554	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
2555	sleep 1
2556	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
2557	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
2558
2559	#
2560	# negative tests
2561	#
2562	log_start
2563	run_cmd nettest -6 -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NSB_IP6}
2564	log_test $? 1 "MD5: VRF: Device must be a VRF - single address"
2565
2566	log_start
2567	run_cmd nettest -6 -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NS_NET6}
2568	log_test $? 1 "MD5: VRF: Device must be a VRF - prefix"
2569
2570}
2571
2572ipv6_tcp_novrf()
2573{
2574	local a
2575
2576	#
2577	# server tests
2578	#
2579	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2580	do
2581		log_start
2582		run_cmd nettest -6 -s &
2583		sleep 1
2584		run_cmd_nsb nettest -6 -r ${a}
2585		log_test_addr ${a} $? 0 "Global server"
2586	done
2587
2588	# verify TCP reset received
2589	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2590	do
2591		log_start
2592		show_hint "Should fail 'Connection refused'"
2593		run_cmd_nsb nettest -6 -r ${a}
2594		log_test_addr ${a} $? 1 "No server"
2595	done
2596
2597	#
2598	# client
2599	#
2600	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}
2601	do
2602		log_start
2603		run_cmd_nsb nettest -6 -s &
2604		sleep 1
2605		run_cmd nettest -6 -r ${a}
2606		log_test_addr ${a} $? 0 "Client"
2607	done
2608
2609	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}
2610	do
2611		log_start
2612		run_cmd_nsb nettest -6 -s &
2613		sleep 1
2614		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
2615		log_test_addr ${a} $? 0 "Client, device bind"
2616	done
2617
2618	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}
2619	do
2620		log_start
2621		show_hint "Should fail 'Connection refused'"
2622		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
2623		log_test_addr ${a} $? 1 "No server, device client"
2624	done
2625
2626	#
2627	# local address tests
2628	#
2629	for a in ${NSA_IP6} ${NSA_LO_IP6} ::1
2630	do
2631		log_start
2632		run_cmd nettest -6 -s &
2633		sleep 1
2634		run_cmd nettest -6 -r ${a}
2635		log_test_addr ${a} $? 0 "Global server, local connection"
2636	done
2637
2638	a=${NSA_IP6}
2639	log_start
2640	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
2641	sleep 1
2642	run_cmd nettest -6 -r ${a} -0 ${a}
2643	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
2644
2645	for a in ${NSA_LO_IP6} ::1
2646	do
2647		log_start
2648		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
2649		run_cmd nettest -6 -s -I ${NSA_DEV} &
2650		sleep 1
2651		run_cmd nettest -6 -r ${a}
2652		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
2653	done
2654
2655	a=${NSA_IP6}
2656	log_start
2657	run_cmd nettest -6 -s &
2658	sleep 1
2659	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
2660	log_test_addr ${a} $? 0 "Global server, device client, local connection"
2661
2662	for a in ${NSA_LO_IP6} ::1
2663	do
2664		log_start
2665		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
2666		run_cmd nettest -6 -s &
2667		sleep 1
2668		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
2669		log_test_addr ${a} $? 1 "Global server, device client, local connection"
2670	done
2671
2672	for a in ${NSA_IP6} ${NSA_LINKIP6}
2673	do
2674		log_start
2675		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
2676		sleep 1
2677		run_cmd nettest -6  -d ${NSA_DEV} -r ${a}
2678		log_test_addr ${a} $? 0 "Device server, device client, local conn"
2679	done
2680
2681	for a in ${NSA_IP6} ${NSA_LINKIP6}
2682	do
2683		log_start
2684		show_hint "Should fail 'Connection refused'"
2685		run_cmd nettest -6 -d ${NSA_DEV} -r ${a}
2686		log_test_addr ${a} $? 1 "No server, device client, local conn"
2687	done
2688
2689	ipv6_tcp_md5_novrf
2690}
2691
2692ipv6_tcp_vrf()
2693{
2694	local a
2695
2696	# disable global server
2697	log_subsection "Global server disabled"
2698
2699	set_sysctl net.ipv4.tcp_l3mdev_accept=0
2700
2701	#
2702	# server tests
2703	#
2704	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2705	do
2706		log_start
2707		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
2708		run_cmd nettest -6 -s &
2709		sleep 1
2710		run_cmd_nsb nettest -6 -r ${a}
2711		log_test_addr ${a} $? 1 "Global server"
2712	done
2713
2714	for a in ${NSA_IP6} ${VRF_IP6}
2715	do
2716		log_start
2717		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
2718		sleep 1
2719		run_cmd_nsb nettest -6 -r ${a}
2720		log_test_addr ${a} $? 0 "VRF server"
2721	done
2722
2723	# link local is always bound to ingress device
2724	a=${NSA_LINKIP6}%${NSB_DEV}
2725	log_start
2726	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
2727	sleep 1
2728	run_cmd_nsb nettest -6 -r ${a}
2729	log_test_addr ${a} $? 0 "VRF server"
2730
2731	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2732	do
2733		log_start
2734		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
2735		sleep 1
2736		run_cmd_nsb nettest -6 -r ${a}
2737		log_test_addr ${a} $? 0 "Device server"
2738	done
2739
2740	# verify TCP reset received
2741	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2742	do
2743		log_start
2744		show_hint "Should fail 'Connection refused'"
2745		run_cmd_nsb nettest -6 -r ${a}
2746		log_test_addr ${a} $? 1 "No server"
2747	done
2748
2749	# local address tests
2750	a=${NSA_IP6}
2751	log_start
2752	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
2753	run_cmd nettest -6 -s &
2754	sleep 1
2755	run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
2756	log_test_addr ${a} $? 1 "Global server, local connection"
2757
2758	# run MD5 tests
2759	setup_vrf_dup
2760	ipv6_tcp_md5
2761	cleanup_vrf_dup
2762
2763	#
2764	# enable VRF global server
2765	#
2766	log_subsection "VRF Global server enabled"
2767	set_sysctl net.ipv4.tcp_l3mdev_accept=1
2768
2769	for a in ${NSA_IP6} ${VRF_IP6}
2770	do
2771		log_start
2772		run_cmd nettest -6 -s -3 ${VRF} &
2773		sleep 1
2774		run_cmd_nsb nettest -6 -r ${a}
2775		log_test_addr ${a} $? 0 "Global server"
2776	done
2777
2778	for a in ${NSA_IP6} ${VRF_IP6}
2779	do
2780		log_start
2781		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
2782		sleep 1
2783		run_cmd_nsb nettest -6 -r ${a}
2784		log_test_addr ${a} $? 0 "VRF server"
2785	done
2786
2787	# For LLA, child socket is bound to device
2788	a=${NSA_LINKIP6}%${NSB_DEV}
2789	log_start
2790	run_cmd nettest -6 -s -3 ${NSA_DEV} &
2791	sleep 1
2792	run_cmd_nsb nettest -6 -r ${a}
2793	log_test_addr ${a} $? 0 "Global server"
2794
2795	log_start
2796	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
2797	sleep 1
2798	run_cmd_nsb nettest -6 -r ${a}
2799	log_test_addr ${a} $? 0 "VRF server"
2800
2801	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2802	do
2803		log_start
2804		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
2805		sleep 1
2806		run_cmd_nsb nettest -6 -r ${a}
2807		log_test_addr ${a} $? 0 "Device server"
2808	done
2809
2810	# verify TCP reset received
2811	for a in ${NSA_IP6} ${VRF_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2812	do
2813		log_start
2814		show_hint "Should fail 'Connection refused'"
2815		run_cmd_nsb nettest -6 -r ${a}
2816		log_test_addr ${a} $? 1 "No server"
2817	done
2818
2819	# local address tests
2820	for a in ${NSA_IP6} ${VRF_IP6}
2821	do
2822		log_start
2823		show_hint "Fails 'Connection refused' since client is not in VRF"
2824		run_cmd nettest -6 -s -I ${VRF} &
2825		sleep 1
2826		run_cmd nettest -6 -r ${a}
2827		log_test_addr ${a} $? 1 "Global server, local connection"
2828	done
2829
2830
2831	#
2832	# client
2833	#
2834	for a in ${NSB_IP6} ${NSB_LO_IP6}
2835	do
2836		log_start
2837		run_cmd_nsb nettest -6 -s &
2838		sleep 1
2839		run_cmd nettest -6 -r ${a} -d ${VRF}
2840		log_test_addr ${a} $? 0 "Client, VRF bind"
2841	done
2842
2843	a=${NSB_LINKIP6}
2844	log_start
2845	show_hint "Fails since VRF device does not allow linklocal addresses"
2846	run_cmd_nsb nettest -6 -s &
2847	sleep 1
2848	run_cmd nettest -6 -r ${a} -d ${VRF}
2849	log_test_addr ${a} $? 1 "Client, VRF bind"
2850
2851	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}
2852	do
2853		log_start
2854		run_cmd_nsb nettest -6 -s &
2855		sleep 1
2856		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
2857		log_test_addr ${a} $? 0 "Client, device bind"
2858	done
2859
2860	for a in ${NSB_IP6} ${NSB_LO_IP6}
2861	do
2862		log_start
2863		show_hint "Should fail 'Connection refused'"
2864		run_cmd nettest -6 -r ${a} -d ${VRF}
2865		log_test_addr ${a} $? 1 "No server, VRF client"
2866	done
2867
2868	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}
2869	do
2870		log_start
2871		show_hint "Should fail 'Connection refused'"
2872		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
2873		log_test_addr ${a} $? 1 "No server, device client"
2874	done
2875
2876	for a in ${NSA_IP6} ${VRF_IP6} ::1
2877	do
2878		log_start
2879		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
2880		sleep 1
2881		run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
2882		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
2883	done
2884
2885	a=${NSA_IP6}
2886	log_start
2887	run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
2888	sleep 1
2889	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
2890	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
2891
2892	a=${NSA_IP6}
2893	log_start
2894	show_hint "Should fail since unbound client is out of VRF scope"
2895	run_cmd nettest -6 -s -I ${VRF} &
2896	sleep 1
2897	run_cmd nettest -6 -r ${a}
2898	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
2899
2900	log_start
2901	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
2902	sleep 1
2903	run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
2904	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
2905
2906	for a in ${NSA_IP6} ${NSA_LINKIP6}
2907	do
2908		log_start
2909		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
2910		sleep 1
2911		run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
2912		log_test_addr ${a} $? 0 "Device server, device client, local connection"
2913	done
2914}
2915
2916ipv6_tcp()
2917{
2918	log_section "IPv6/TCP"
2919	log_subsection "No VRF"
2920	setup
2921
2922	# tcp_l3mdev_accept should have no affect without VRF;
2923	# run tests with it enabled and disabled to verify
2924	log_subsection "tcp_l3mdev_accept disabled"
2925	set_sysctl net.ipv4.tcp_l3mdev_accept=0
2926	ipv6_tcp_novrf
2927	log_subsection "tcp_l3mdev_accept enabled"
2928	set_sysctl net.ipv4.tcp_l3mdev_accept=1
2929	ipv6_tcp_novrf
2930
2931	log_subsection "With VRF"
2932	setup "yes"
2933	ipv6_tcp_vrf
2934}
2935
2936################################################################################
2937# IPv6 UDP
2938
2939ipv6_udp_novrf()
2940{
2941	local a
2942
2943	#
2944	# server tests
2945	#
2946	for a in ${NSA_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2947	do
2948		log_start
2949		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
2950		sleep 1
2951		run_cmd_nsb nettest -6 -D -r ${a}
2952		log_test_addr ${a} $? 0 "Global server"
2953
2954		log_start
2955		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
2956		sleep 1
2957		run_cmd_nsb nettest -6 -D -r ${a}
2958		log_test_addr ${a} $? 0 "Device server"
2959	done
2960
2961	a=${NSA_LO_IP6}
2962	log_start
2963	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
2964	sleep 1
2965	run_cmd_nsb nettest -6 -D -r ${a}
2966	log_test_addr ${a} $? 0 "Global server"
2967
2968	# should fail since loopback address is out of scope for a device
2969	# bound server, but it does not - hence this is more documenting
2970	# behavior.
2971	#log_start
2972	#show_hint "Should fail since loopback address is out of scope"
2973	#run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
2974	#sleep 1
2975	#run_cmd_nsb nettest -6 -D -r ${a}
2976	#log_test_addr ${a} $? 1 "Device server"
2977
2978	# negative test - should fail
2979	for a in ${NSA_IP6} ${NSA_LO_IP6} ${NSA_LINKIP6}%${NSB_DEV}
2980	do
2981		log_start
2982		show_hint "Should fail 'Connection refused' since there is no server"
2983		run_cmd_nsb nettest -6 -D -r ${a}
2984		log_test_addr ${a} $? 1 "No server"
2985	done
2986
2987	#
2988	# client
2989	#
2990	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV}
2991	do
2992		log_start
2993		run_cmd_nsb nettest -6 -D -s &
2994		sleep 1
2995		run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6}
2996		log_test_addr ${a} $? 0 "Client"
2997
2998		log_start
2999		run_cmd_nsb nettest -6 -D -s &
3000		sleep 1
3001		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6}
3002		log_test_addr ${a} $? 0 "Client, device bind"
3003
3004		log_start
3005		run_cmd_nsb nettest -6 -D -s &
3006		sleep 1
3007		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6}
3008		log_test_addr ${a} $? 0 "Client, device send via cmsg"
3009
3010		log_start
3011		run_cmd_nsb nettest -6 -D -s &
3012		sleep 1
3013		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6}
3014		log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"
3015
3016		log_start
3017		show_hint "Should fail 'Connection refused'"
3018		run_cmd nettest -6 -D -r ${a}
3019		log_test_addr ${a} $? 1 "No server, unbound client"
3020
3021		log_start
3022		show_hint "Should fail 'Connection refused'"
3023		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}
3024		log_test_addr ${a} $? 1 "No server, device client"
3025	done
3026
3027	#
3028	# local address tests
3029	#
3030	for a in ${NSA_IP6} ${NSA_LO_IP6} ::1
3031	do
3032		log_start
3033		run_cmd nettest -6 -D -s &
3034		sleep 1
3035		run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a}
3036		log_test_addr ${a} $? 0 "Global server, local connection"
3037	done
3038
3039	a=${NSA_IP6}
3040	log_start
3041	run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
3042	sleep 1
3043	run_cmd nettest -6 -D -r ${a}
3044	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
3045
3046	for a in ${NSA_LO_IP6} ::1
3047	do
3048		log_start
3049		show_hint "Should fail 'Connection refused' since address is out of device scope"
3050		run_cmd nettest -6 -s -D -I ${NSA_DEV} &
3051		sleep 1
3052		run_cmd nettest -6 -D -r ${a}
3053		log_test_addr ${a} $? 1 "Device server, local connection"
3054	done
3055
3056	a=${NSA_IP6}
3057	log_start
3058	run_cmd nettest -6 -s -D &
3059	sleep 1
3060	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3061	log_test_addr ${a} $? 0 "Global server, device client, local connection"
3062
3063	log_start
3064	run_cmd nettest -6 -s -D &
3065	sleep 1
3066	run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a}
3067	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
3068
3069	log_start
3070	run_cmd nettest -6 -s -D &
3071	sleep 1
3072	run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a}
3073	log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"
3074
3075	for a in ${NSA_LO_IP6} ::1
3076	do
3077		log_start
3078		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
3079		run_cmd nettest -6 -D -s &
3080		sleep 1
3081		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}
3082		log_test_addr ${a} $? 1 "Global server, device client, local connection"
3083
3084		log_start
3085		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
3086		run_cmd nettest -6 -D -s &
3087		sleep 1
3088		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C
3089		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
3090
3091		log_start
3092		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
3093		run_cmd nettest -6 -D -s &
3094		sleep 1
3095		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S
3096		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
3097	done
3098
3099	a=${NSA_IP6}
3100	log_start
3101	run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
3102	sleep 1
3103	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a}
3104	log_test_addr ${a} $? 0 "Device server, device client, local conn"
3105
3106	log_start
3107	show_hint "Should fail 'Connection refused'"
3108	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3109	log_test_addr ${a} $? 1 "No server, device client, local conn"
3110
3111	# LLA to GUA
3112	run_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV}
3113	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
3114	log_start
3115	run_cmd nettest -6 -s -D &
3116	sleep 1
3117	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
3118	log_test $? 0 "UDP in - LLA to GUA"
3119
3120	run_cmd_nsb ip -6 ro del ${NSA_IP6}/128 dev ${NSB_DEV}
3121	run_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV} nodad
3122}
3123
3124ipv6_udp_vrf()
3125{
3126	local a
3127
3128	# disable global server
3129	log_subsection "Global server disabled"
3130	set_sysctl net.ipv4.udp_l3mdev_accept=0
3131
3132	#
3133	# server tests
3134	#
3135	for a in ${NSA_IP6} ${VRF_IP6}
3136	do
3137		log_start
3138		show_hint "Should fail 'Connection refused' since global server is disabled"
3139		run_cmd nettest -6 -D -s &
3140		sleep 1
3141		run_cmd_nsb nettest -6 -D -r ${a}
3142		log_test_addr ${a} $? 1 "Global server"
3143	done
3144
3145	for a in ${NSA_IP6} ${VRF_IP6}
3146	do
3147		log_start
3148		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
3149		sleep 1
3150		run_cmd_nsb nettest -6 -D -r ${a}
3151		log_test_addr ${a} $? 0 "VRF server"
3152	done
3153
3154	for a in ${NSA_IP6} ${VRF_IP6}
3155	do
3156		log_start
3157		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
3158		sleep 1
3159		run_cmd_nsb nettest -6 -D -r ${a}
3160		log_test_addr ${a} $? 0 "Enslaved device server"
3161	done
3162
3163	# negative test - should fail
3164	for a in ${NSA_IP6} ${VRF_IP6}
3165	do
3166		log_start
3167		show_hint "Should fail 'Connection refused' since there is no server"
3168		run_cmd_nsb nettest -6 -D -r ${a}
3169		log_test_addr ${a} $? 1 "No server"
3170	done
3171
3172	#
3173	# local address tests
3174	#
3175	for a in ${NSA_IP6} ${VRF_IP6}
3176	do
3177		log_start
3178		show_hint "Should fail 'Connection refused' since global server is disabled"
3179		run_cmd nettest -6 -D -s &
3180		sleep 1
3181		run_cmd nettest -6 -D -d ${VRF} -r ${a}
3182		log_test_addr ${a} $? 1 "Global server, VRF client, local conn"
3183	done
3184
3185	for a in ${NSA_IP6} ${VRF_IP6}
3186	do
3187		log_start
3188		run_cmd nettest -6 -D -I ${VRF} -s &
3189		sleep 1
3190		run_cmd nettest -6 -D -d ${VRF} -r ${a}
3191		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
3192	done
3193
3194	a=${NSA_IP6}
3195	log_start
3196	show_hint "Should fail 'Connection refused' since global server is disabled"
3197	run_cmd nettest -6 -D -s &
3198	sleep 1
3199	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3200	log_test_addr ${a} $? 1 "Global server, device client, local conn"
3201
3202	log_start
3203	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
3204	sleep 1
3205	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3206	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
3207
3208	log_start
3209	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
3210	sleep 1
3211	run_cmd nettest -6 -D -d ${VRF} -r ${a}
3212	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
3213
3214	log_start
3215	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
3216	sleep 1
3217	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3218	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
3219
3220	# disable global server
3221	log_subsection "Global server enabled"
3222	set_sysctl net.ipv4.udp_l3mdev_accept=1
3223
3224	#
3225	# server tests
3226	#
3227	for a in ${NSA_IP6} ${VRF_IP6}
3228	do
3229		log_start
3230		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
3231		sleep 1
3232		run_cmd_nsb nettest -6 -D -r ${a}
3233		log_test_addr ${a} $? 0 "Global server"
3234	done
3235
3236	for a in ${NSA_IP6} ${VRF_IP6}
3237	do
3238		log_start
3239		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
3240		sleep 1
3241		run_cmd_nsb nettest -6 -D -r ${a}
3242		log_test_addr ${a} $? 0 "VRF server"
3243	done
3244
3245	for a in ${NSA_IP6} ${VRF_IP6}
3246	do
3247		log_start
3248		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
3249		sleep 1
3250		run_cmd_nsb nettest -6 -D -r ${a}
3251		log_test_addr ${a} $? 0 "Enslaved device server"
3252	done
3253
3254	# negative test - should fail
3255	for a in ${NSA_IP6} ${VRF_IP6}
3256	do
3257		log_start
3258		run_cmd_nsb nettest -6 -D -r ${a}
3259		log_test_addr ${a} $? 1 "No server"
3260	done
3261
3262	#
3263	# client tests
3264	#
3265	log_start
3266	run_cmd_nsb nettest -6 -D -s &
3267	sleep 1
3268	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}
3269	log_test $? 0 "VRF client"
3270
3271	# negative test - should fail
3272	log_start
3273	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}
3274	log_test $? 1 "No server, VRF client"
3275
3276	log_start
3277	run_cmd_nsb nettest -6 -D -s &
3278	sleep 1
3279	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}
3280	log_test $? 0 "Enslaved device client"
3281
3282	# negative test - should fail
3283	log_start
3284	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}
3285	log_test $? 1 "No server, enslaved device client"
3286
3287	#
3288	# local address tests
3289	#
3290	a=${NSA_IP6}
3291	log_start
3292	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
3293	sleep 1
3294	run_cmd nettest -6 -D -d ${VRF} -r ${a}
3295	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
3296
3297	#log_start
3298	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
3299	sleep 1
3300	run_cmd nettest -6 -D -d ${VRF} -r ${a}
3301	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
3302
3303
3304	a=${VRF_IP6}
3305	log_start
3306	run_cmd nettest -6 -D -s -3 ${VRF} &
3307	sleep 1
3308	run_cmd nettest -6 -D -d ${VRF} -r ${a}
3309	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
3310
3311	log_start
3312	run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} &
3313	sleep 1
3314	run_cmd nettest -6 -D -d ${VRF} -r ${a}
3315	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
3316
3317	# negative test - should fail
3318	for a in ${NSA_IP6} ${VRF_IP6}
3319	do
3320		log_start
3321		run_cmd nettest -6 -D -d ${VRF} -r ${a}
3322		log_test_addr ${a} $? 1 "No server, VRF client, local conn"
3323	done
3324
3325	# device to global IP
3326	a=${NSA_IP6}
3327	log_start
3328	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
3329	sleep 1
3330	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3331	log_test_addr ${a} $? 0 "Global server, device client, local conn"
3332
3333	log_start
3334	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
3335	sleep 1
3336	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3337	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
3338
3339	log_start
3340	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
3341	sleep 1
3342	run_cmd nettest -6 -D -d ${VRF} -r ${a}
3343	log_test_addr ${a} $? 0 "Device server, VRF client, local conn"
3344
3345	log_start
3346	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
3347	sleep 1
3348	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3349	log_test_addr ${a} $? 0 "Device server, device client, local conn"
3350
3351	log_start
3352	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
3353	log_test_addr ${a} $? 1 "No server, device client, local conn"
3354
3355
3356	# link local addresses
3357	log_start
3358	run_cmd nettest -6 -D -s &
3359	sleep 1
3360	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}
3361	log_test $? 0 "Global server, linklocal IP"
3362
3363	log_start
3364	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}
3365	log_test $? 1 "No server, linklocal IP"
3366
3367
3368	log_start
3369	run_cmd_nsb nettest -6 -D -s &
3370	sleep 1
3371	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}
3372	log_test $? 0 "Enslaved device client, linklocal IP"
3373
3374	log_start
3375	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}
3376	log_test $? 1 "No server, device client, peer linklocal IP"
3377
3378
3379	log_start
3380	run_cmd nettest -6 -D -s &
3381	sleep 1
3382	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}
3383	log_test $? 0 "Enslaved device client, local conn - linklocal IP"
3384
3385	log_start
3386	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}
3387	log_test $? 1 "No server, device client, local conn  - linklocal IP"
3388
3389	# LLA to GUA
3390	run_cmd_nsb ip -6 addr del ${NSB_IP6}/64 dev ${NSB_DEV}
3391	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
3392	log_start
3393	run_cmd nettest -6 -s -D &
3394	sleep 1
3395	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
3396	log_test $? 0 "UDP in - LLA to GUA"
3397
3398	run_cmd_nsb ip -6 ro del ${NSA_IP6}/128 dev ${NSB_DEV}
3399	run_cmd_nsb ip -6 addr add ${NSB_IP6}/64 dev ${NSB_DEV} nodad
3400}
3401
3402ipv6_udp()
3403{
3404        # should not matter, but set to known state
3405        set_sysctl net.ipv4.udp_early_demux=1
3406
3407        log_section "IPv6/UDP"
3408        log_subsection "No VRF"
3409        setup
3410
3411        # udp_l3mdev_accept should have no affect without VRF;
3412        # run tests with it enabled and disabled to verify
3413        log_subsection "udp_l3mdev_accept disabled"
3414        set_sysctl net.ipv4.udp_l3mdev_accept=0
3415        ipv6_udp_novrf
3416        log_subsection "udp_l3mdev_accept enabled"
3417        set_sysctl net.ipv4.udp_l3mdev_accept=1
3418        ipv6_udp_novrf
3419
3420        log_subsection "With VRF"
3421        setup "yes"
3422        ipv6_udp_vrf
3423}
3424
3425################################################################################
3426# IPv6 address bind
3427
3428ipv6_addr_bind_novrf()
3429{
3430	#
3431	# raw socket
3432	#
3433	for a in ${NSA_IP6} ${NSA_LO_IP6}
3434	do
3435		log_start
3436		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -b
3437		log_test_addr ${a} $? 0 "Raw socket bind to local address"
3438
3439		log_start
3440		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${NSA_DEV} -b
3441		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"
3442	done
3443
3444	#
3445	# raw socket with nonlocal bind
3446	#
3447	a=${NL_IP6}
3448	log_start
3449	run_cmd nettest -6 -s -R -P icmp -f -l ${a} -I ${NSA_DEV} -b
3450	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address"
3451
3452	#
3453	# tcp sockets
3454	#
3455	a=${NSA_IP6}
3456	log_start
3457	run_cmd nettest -6 -s -l ${a} -t1 -b
3458	log_test_addr ${a} $? 0 "TCP socket bind to local address"
3459
3460	log_start
3461	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
3462	log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind"
3463
3464	# Sadly, the kernel allows binding a socket to a device and then
3465	# binding to an address not on the device. So this test passes
3466	# when it really should not
3467	a=${NSA_LO_IP6}
3468	log_start
3469	show_hint "Tecnically should fail since address is not on device but kernel allows"
3470	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
3471	log_test_addr ${a} $? 0 "TCP socket bind to out of scope local address"
3472}
3473
3474ipv6_addr_bind_vrf()
3475{
3476	#
3477	# raw socket
3478	#
3479	for a in ${NSA_IP6} ${VRF_IP6}
3480	do
3481		log_start
3482		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${VRF} -b
3483		log_test_addr ${a} $? 0 "Raw socket bind to local address after vrf bind"
3484
3485		log_start
3486		run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${NSA_DEV} -b
3487		log_test_addr ${a} $? 0 "Raw socket bind to local address after device bind"
3488	done
3489
3490	a=${NSA_LO_IP6}
3491	log_start
3492	show_hint "Address on loopback is out of VRF scope"
3493	run_cmd nettest -6 -s -R -P ipv6-icmp -l ${a} -I ${VRF} -b
3494	log_test_addr ${a} $? 1 "Raw socket bind to invalid local address after vrf bind"
3495
3496	#
3497	# raw socket with nonlocal bind
3498	#
3499	a=${NL_IP6}
3500	log_start
3501	run_cmd nettest -6 -s -R -P icmp -f -l ${a} -I ${VRF} -b
3502	log_test_addr ${a} $? 0 "Raw socket bind to nonlocal address after VRF bind"
3503
3504	#
3505	# tcp sockets
3506	#
3507	# address on enslaved device is valid for the VRF or device in a VRF
3508	for a in ${NSA_IP6} ${VRF_IP6}
3509	do
3510		log_start
3511		run_cmd nettest -6 -s -l ${a} -I ${VRF} -t1 -b
3512		log_test_addr ${a} $? 0 "TCP socket bind to local address with VRF bind"
3513	done
3514
3515	a=${NSA_IP6}
3516	log_start
3517	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
3518	log_test_addr ${a} $? 0 "TCP socket bind to local address with device bind"
3519
3520	# Sadly, the kernel allows binding a socket to a device and then
3521	# binding to an address not on the device. The only restriction
3522	# is that the address is valid in the L3 domain. So this test
3523	# passes when it really should not
3524	a=${VRF_IP6}
3525	log_start
3526	show_hint "Tecnically should fail since address is not on device but kernel allows"
3527	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
3528	log_test_addr ${a} $? 0 "TCP socket bind to VRF address with device bind"
3529
3530	a=${NSA_LO_IP6}
3531	log_start
3532	show_hint "Address on loopback out of scope for VRF"
3533	run_cmd nettest -6 -s -l ${a} -I ${VRF} -t1 -b
3534	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for VRF"
3535
3536	log_start
3537	show_hint "Address on loopback out of scope for device in VRF"
3538	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
3539	log_test_addr ${a} $? 1 "TCP socket bind to invalid local address for device bind"
3540
3541}
3542
3543ipv6_addr_bind()
3544{
3545	log_section "IPv6 address binds"
3546
3547	log_subsection "No VRF"
3548	setup
3549	ipv6_addr_bind_novrf
3550
3551	log_subsection "With VRF"
3552	setup "yes"
3553	ipv6_addr_bind_vrf
3554}
3555
3556################################################################################
3557# IPv6 runtime tests
3558
3559ipv6_rt()
3560{
3561	local desc="$1"
3562	local varg="-6 $2"
3563	local with_vrf="yes"
3564	local a
3565
3566	#
3567	# server tests
3568	#
3569	for a in ${NSA_IP6} ${VRF_IP6}
3570	do
3571		log_start
3572		run_cmd nettest ${varg} -s &
3573		sleep 1
3574		run_cmd_nsb nettest ${varg} -r ${a} &
3575		sleep 3
3576		run_cmd ip link del ${VRF}
3577		sleep 1
3578		log_test_addr ${a} 0 0 "${desc}, global server"
3579
3580		setup ${with_vrf}
3581	done
3582
3583	for a in ${NSA_IP6} ${VRF_IP6}
3584	do
3585		log_start
3586		run_cmd nettest ${varg} -I ${VRF} -s &
3587		sleep 1
3588		run_cmd_nsb nettest ${varg} -r ${a} &
3589		sleep 3
3590		run_cmd ip link del ${VRF}
3591		sleep 1
3592		log_test_addr ${a} 0 0 "${desc}, VRF server"
3593
3594		setup ${with_vrf}
3595	done
3596
3597	for a in ${NSA_IP6} ${VRF_IP6}
3598	do
3599		log_start
3600		run_cmd nettest ${varg} -I ${NSA_DEV} -s &
3601		sleep 1
3602		run_cmd_nsb nettest ${varg} -r ${a} &
3603		sleep 3
3604		run_cmd ip link del ${VRF}
3605		sleep 1
3606		log_test_addr ${a} 0 0 "${desc}, enslaved device server"
3607
3608		setup ${with_vrf}
3609	done
3610
3611	#
3612	# client test
3613	#
3614	log_start
3615	run_cmd_nsb nettest ${varg} -s &
3616	sleep 1
3617	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} &
3618	sleep 3
3619	run_cmd ip link del ${VRF}
3620	sleep 1
3621	log_test  0 0 "${desc}, VRF client"
3622
3623	setup ${with_vrf}
3624
3625	log_start
3626	run_cmd_nsb nettest ${varg} -s &
3627	sleep 1
3628	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} &
3629	sleep 3
3630	run_cmd ip link del ${VRF}
3631	sleep 1
3632	log_test  0 0 "${desc}, enslaved device client"
3633
3634	setup ${with_vrf}
3635
3636
3637	#
3638	# local address tests
3639	#
3640	for a in ${NSA_IP6} ${VRF_IP6}
3641	do
3642		log_start
3643		run_cmd nettest ${varg} -s &
3644		sleep 1
3645		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
3646		sleep 3
3647		run_cmd ip link del ${VRF}
3648		sleep 1
3649		log_test_addr ${a} 0 0 "${desc}, global server, VRF client"
3650
3651		setup ${with_vrf}
3652	done
3653
3654	for a in ${NSA_IP6} ${VRF_IP6}
3655	do
3656		log_start
3657		run_cmd nettest ${varg} -I ${VRF} -s &
3658		sleep 1
3659		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
3660		sleep 3
3661		run_cmd ip link del ${VRF}
3662		sleep 1
3663		log_test_addr ${a} 0 0 "${desc}, VRF server and client"
3664
3665		setup ${with_vrf}
3666	done
3667
3668	a=${NSA_IP6}
3669	log_start
3670	run_cmd nettest ${varg} -s &
3671	sleep 1
3672	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
3673	sleep 3
3674	run_cmd ip link del ${VRF}
3675	sleep 1
3676	log_test_addr ${a} 0 0 "${desc}, global server, device client"
3677
3678	setup ${with_vrf}
3679
3680	log_start
3681	run_cmd nettest ${varg} -I ${VRF} -s &
3682	sleep 1
3683	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
3684	sleep 3
3685	run_cmd ip link del ${VRF}
3686	sleep 1
3687	log_test_addr ${a} 0 0 "${desc}, VRF server, device client"
3688
3689	setup ${with_vrf}
3690
3691	log_start
3692	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
3693	sleep 1
3694	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
3695	sleep 3
3696	run_cmd ip link del ${VRF}
3697	sleep 1
3698	log_test_addr ${a} 0 0 "${desc}, device server, device client"
3699}
3700
3701ipv6_ping_rt()
3702{
3703	local with_vrf="yes"
3704	local a
3705
3706	a=${NSA_IP6}
3707	log_start
3708	run_cmd_nsb ${ping6} -f ${a} &
3709	sleep 3
3710	run_cmd ip link del ${VRF}
3711	sleep 1
3712	log_test_addr ${a} 0 0 "Device delete with active traffic - ping in"
3713
3714	setup ${with_vrf}
3715
3716	log_start
3717	run_cmd ${ping6} -f ${NSB_IP6} -I ${VRF} &
3718	sleep 1
3719	run_cmd ip link del ${VRF}
3720	sleep 1
3721	log_test_addr ${a} 0 0 "Device delete with active traffic - ping out"
3722}
3723
3724ipv6_runtime()
3725{
3726	log_section "Run time tests - ipv6"
3727
3728	setup "yes"
3729	ipv6_ping_rt
3730
3731	setup "yes"
3732	ipv6_rt "TCP active socket"  "-n -1"
3733
3734	setup "yes"
3735	ipv6_rt "TCP passive socket" "-i"
3736
3737	setup "yes"
3738	ipv6_rt "UDP active socket"  "-D -n -1"
3739}
3740
3741################################################################################
3742# netfilter blocking connections
3743
3744netfilter_tcp_reset()
3745{
3746	local a
3747
3748	for a in ${NSA_IP} ${VRF_IP}
3749	do
3750		log_start
3751		run_cmd nettest -s &
3752		sleep 1
3753		run_cmd_nsb nettest -r ${a}
3754		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
3755	done
3756}
3757
3758netfilter_icmp()
3759{
3760	local stype="$1"
3761	local arg
3762	local a
3763
3764	[ "${stype}" = "UDP" ] && arg="-D"
3765
3766	for a in ${NSA_IP} ${VRF_IP}
3767	do
3768		log_start
3769		run_cmd nettest ${arg} -s &
3770		sleep 1
3771		run_cmd_nsb nettest ${arg} -r ${a}
3772		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
3773	done
3774}
3775
3776ipv4_netfilter()
3777{
3778	log_section "IPv4 Netfilter"
3779	log_subsection "TCP reset"
3780
3781	setup "yes"
3782	run_cmd iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset
3783
3784	netfilter_tcp_reset
3785
3786	log_start
3787	log_subsection "ICMP unreachable"
3788
3789	log_start
3790	run_cmd iptables -F
3791	run_cmd iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp-port-unreachable
3792	run_cmd iptables -A INPUT -p udp --dport 12345 -j REJECT --reject-with icmp-port-unreachable
3793
3794	netfilter_icmp "TCP"
3795	netfilter_icmp "UDP"
3796
3797	log_start
3798	iptables -F
3799}
3800
3801netfilter_tcp6_reset()
3802{
3803	local a
3804
3805	for a in ${NSA_IP6} ${VRF_IP6}
3806	do
3807		log_start
3808		run_cmd nettest -6 -s &
3809		sleep 1
3810		run_cmd_nsb nettest -6 -r ${a}
3811		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
3812	done
3813}
3814
3815netfilter_icmp6()
3816{
3817	local stype="$1"
3818	local arg
3819	local a
3820
3821	[ "${stype}" = "UDP" ] && arg="$arg -D"
3822
3823	for a in ${NSA_IP6} ${VRF_IP6}
3824	do
3825		log_start
3826		run_cmd nettest -6 -s ${arg} &
3827		sleep 1
3828		run_cmd_nsb nettest -6 ${arg} -r ${a}
3829		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
3830	done
3831}
3832
3833ipv6_netfilter()
3834{
3835	log_section "IPv6 Netfilter"
3836	log_subsection "TCP reset"
3837
3838	setup "yes"
3839	run_cmd ip6tables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset
3840
3841	netfilter_tcp6_reset
3842
3843	log_subsection "ICMP unreachable"
3844
3845	log_start
3846	run_cmd ip6tables -F
3847	run_cmd ip6tables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp6-port-unreachable
3848	run_cmd ip6tables -A INPUT -p udp --dport 12345 -j REJECT --reject-with icmp6-port-unreachable
3849
3850	netfilter_icmp6 "TCP"
3851	netfilter_icmp6 "UDP"
3852
3853	log_start
3854	ip6tables -F
3855}
3856
3857################################################################################
3858# specific use cases
3859
3860# VRF only.
3861# ns-A device enslaved to bridge. Verify traffic with and without
3862# br_netfilter module loaded. Repeat with SVI on bridge.
3863use_case_br()
3864{
3865	setup "yes"
3866
3867	setup_cmd ip link set ${NSA_DEV} down
3868	setup_cmd ip addr del dev ${NSA_DEV} ${NSA_IP}/24
3869	setup_cmd ip -6 addr del dev ${NSA_DEV} ${NSA_IP6}/64
3870
3871	setup_cmd ip link add br0 type bridge
3872	setup_cmd ip addr add dev br0 ${NSA_IP}/24
3873	setup_cmd ip -6 addr add dev br0 ${NSA_IP6}/64 nodad
3874
3875	setup_cmd ip li set ${NSA_DEV} master br0
3876	setup_cmd ip li set ${NSA_DEV} up
3877	setup_cmd ip li set br0 up
3878	setup_cmd ip li set br0 vrf ${VRF}
3879
3880	rmmod br_netfilter 2>/dev/null
3881	sleep 5 # DAD
3882
3883	run_cmd ip neigh flush all
3884	run_cmd ping -c1 -w1 -I br0 ${NSB_IP}
3885	log_test $? 0 "Bridge into VRF - IPv4 ping out"
3886
3887	run_cmd ip neigh flush all
3888	run_cmd ${ping6} -c1 -w1 -I br0 ${NSB_IP6}
3889	log_test $? 0 "Bridge into VRF - IPv6 ping out"
3890
3891	run_cmd ip neigh flush all
3892	run_cmd_nsb ping -c1 -w1 ${NSA_IP}
3893	log_test $? 0 "Bridge into VRF - IPv4 ping in"
3894
3895	run_cmd ip neigh flush all
3896	run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6}
3897	log_test $? 0 "Bridge into VRF - IPv6 ping in"
3898
3899	modprobe br_netfilter
3900	if [ $? -eq 0 ]; then
3901		run_cmd ip neigh flush all
3902		run_cmd ping -c1 -w1 -I br0 ${NSB_IP}
3903		log_test $? 0 "Bridge into VRF with br_netfilter - IPv4 ping out"
3904
3905		run_cmd ip neigh flush all
3906		run_cmd ${ping6} -c1 -w1 -I br0 ${NSB_IP6}
3907		log_test $? 0 "Bridge into VRF with br_netfilter - IPv6 ping out"
3908
3909		run_cmd ip neigh flush all
3910		run_cmd_nsb ping -c1 -w1 ${NSA_IP}
3911		log_test $? 0 "Bridge into VRF with br_netfilter - IPv4 ping in"
3912
3913		run_cmd ip neigh flush all
3914		run_cmd_nsb ${ping6} -c1 -w1 ${NSA_IP6}
3915		log_test $? 0 "Bridge into VRF with br_netfilter - IPv6 ping in"
3916	fi
3917
3918	setup_cmd ip li set br0 nomaster
3919	setup_cmd ip li add br0.100 link br0 type vlan id 100
3920	setup_cmd ip li set br0.100 vrf ${VRF} up
3921	setup_cmd ip    addr add dev br0.100 172.16.101.1/24
3922	setup_cmd ip -6 addr add dev br0.100 2001:db8:101::1/64 nodad
3923
3924	setup_cmd_nsb ip li add vlan100 link ${NSB_DEV} type vlan id 100
3925	setup_cmd_nsb ip addr add dev vlan100 172.16.101.2/24
3926	setup_cmd_nsb ip -6 addr add dev vlan100 2001:db8:101::2/64 nodad
3927	setup_cmd_nsb ip li set vlan100 up
3928	sleep 1
3929
3930	rmmod br_netfilter 2>/dev/null
3931
3932	run_cmd ip neigh flush all
3933	run_cmd ping -c1 -w1 -I br0.100 172.16.101.2
3934	log_test $? 0 "Bridge vlan into VRF - IPv4 ping out"
3935
3936	run_cmd ip neigh flush all
3937	run_cmd ${ping6} -c1 -w1 -I br0.100 2001:db8:101::2
3938	log_test $? 0 "Bridge vlan into VRF - IPv6 ping out"
3939
3940	run_cmd ip neigh flush all
3941	run_cmd_nsb ping -c1 -w1 172.16.101.1
3942	log_test $? 0 "Bridge vlan into VRF - IPv4 ping in"
3943
3944	run_cmd ip neigh flush all
3945	run_cmd_nsb ${ping6} -c1 -w1 2001:db8:101::1
3946	log_test $? 0 "Bridge vlan into VRF - IPv6 ping in"
3947
3948	modprobe br_netfilter
3949	if [ $? -eq 0 ]; then
3950		run_cmd ip neigh flush all
3951		run_cmd ping -c1 -w1 -I br0.100 172.16.101.2
3952		log_test $? 0 "Bridge vlan into VRF with br_netfilter - IPv4 ping out"
3953
3954		run_cmd ip neigh flush all
3955		run_cmd ${ping6} -c1 -w1 -I br0.100 2001:db8:101::2
3956		log_test $? 0 "Bridge vlan into VRF with br_netfilter - IPv6 ping out"
3957
3958		run_cmd ip neigh flush all
3959		run_cmd_nsb ping -c1 -w1 172.16.101.1
3960		log_test $? 0 "Bridge vlan into VRF - IPv4 ping in"
3961
3962		run_cmd ip neigh flush all
3963		run_cmd_nsb ${ping6} -c1 -w1 2001:db8:101::1
3964		log_test $? 0 "Bridge vlan into VRF - IPv6 ping in"
3965	fi
3966
3967	setup_cmd ip li del br0 2>/dev/null
3968	setup_cmd_nsb ip li del vlan100 2>/dev/null
3969}
3970
3971# VRF only.
3972# ns-A device is connected to both ns-B and ns-C on a single VRF but only has
3973# LLA on the interfaces
3974use_case_ping_lla_multi()
3975{
3976	setup_lla_only
3977	# only want reply from ns-A
3978	setup_cmd_nsb sysctl -qw net.ipv6.icmp.echo_ignore_multicast=1
3979	setup_cmd_nsc sysctl -qw net.ipv6.icmp.echo_ignore_multicast=1
3980
3981	log_start
3982	run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}
3983	log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Pre cycle, ping out ns-B"
3984
3985	run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}
3986	log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Pre cycle, ping out ns-C"
3987
3988	# cycle/flap the first ns-A interface
3989	setup_cmd ip link set ${NSA_DEV} down
3990	setup_cmd ip link set ${NSA_DEV} up
3991	sleep 1
3992
3993	log_start
3994	run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}
3995	log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-B"
3996	run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}
3997	log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-C"
3998
3999	# cycle/flap the second ns-A interface
4000	setup_cmd ip link set ${NSA_DEV2} down
4001	setup_cmd ip link set ${NSA_DEV2} up
4002	sleep 1
4003
4004	log_start
4005	run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}
4006	log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-B"
4007	run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}
4008	log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-C"
4009}
4010
4011# Perform IPv{4,6} SNAT on ns-A, and verify TCP connection is successfully
4012# established with ns-B.
4013use_case_snat_on_vrf()
4014{
4015	setup "yes"
4016
4017	local port="12345"
4018
4019	run_cmd iptables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP} -o ${VRF}
4020	run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}
4021
4022	run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} &
4023	sleep 1
4024	run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port}
4025	log_test $? 0 "IPv4 TCP connection over VRF with SNAT"
4026
4027	run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} &
4028	sleep 1
4029	run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port}
4030	log_test $? 0 "IPv6 TCP connection over VRF with SNAT"
4031
4032	# Cleanup
4033	run_cmd iptables -t nat -D POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP} -o ${VRF}
4034	run_cmd ip6tables -t nat -D POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}
4035}
4036
4037use_cases()
4038{
4039	log_section "Use cases"
4040	log_subsection "Device enslaved to bridge"
4041	use_case_br
4042	log_subsection "Ping LLA with multiple interfaces"
4043	use_case_ping_lla_multi
4044	log_subsection "SNAT on VRF"
4045	use_case_snat_on_vrf
4046}
4047
4048################################################################################
4049# usage
4050
4051usage()
4052{
4053	cat <<EOF
4054usage: ${0##*/} OPTS
4055
4056	-4          IPv4 tests only
4057	-6          IPv6 tests only
4058	-t <test>   Test name/set to run
4059	-p          Pause on fail
4060	-P          Pause after each test
4061	-v          Be verbose
4062
4063Tests:
4064	$TESTS_IPV4 $TESTS_IPV6 $TESTS_OTHER
4065EOF
4066}
4067
4068################################################################################
4069# main
4070
4071TESTS_IPV4="ipv4_ping ipv4_tcp ipv4_udp ipv4_bind ipv4_runtime ipv4_netfilter"
4072TESTS_IPV6="ipv6_ping ipv6_tcp ipv6_udp ipv6_bind ipv6_runtime ipv6_netfilter"
4073TESTS_OTHER="use_cases"
4074
4075PAUSE_ON_FAIL=no
4076PAUSE=no
4077
4078while getopts :46t:pPvh o
4079do
4080	case $o in
4081		4) TESTS=ipv4;;
4082		6) TESTS=ipv6;;
4083		t) TESTS=$OPTARG;;
4084		p) PAUSE_ON_FAIL=yes;;
4085		P) PAUSE=yes;;
4086		v) VERBOSE=1;;
4087		h) usage; exit 0;;
4088		*) usage; exit 1;;
4089	esac
4090done
4091
4092# make sure we don't pause twice
4093[ "${PAUSE}" = "yes" ] && PAUSE_ON_FAIL=no
4094
4095#
4096# show user test config
4097#
4098if [ -z "$TESTS" ]; then
4099	TESTS="$TESTS_IPV4 $TESTS_IPV6 $TESTS_OTHER"
4100elif [ "$TESTS" = "ipv4" ]; then
4101	TESTS="$TESTS_IPV4"
4102elif [ "$TESTS" = "ipv6" ]; then
4103	TESTS="$TESTS_IPV6"
4104fi
4105
4106which nettest >/dev/null
4107if [ $? -ne 0 ]; then
4108	echo "'nettest' command not found; skipping tests"
4109	exit $ksft_skip
4110fi
4111
4112declare -i nfail=0
4113declare -i nsuccess=0
4114
4115for t in $TESTS
4116do
4117	case $t in
4118	ipv4_ping|ping)  ipv4_ping;;
4119	ipv4_tcp|tcp)    ipv4_tcp;;
4120	ipv4_udp|udp)    ipv4_udp;;
4121	ipv4_bind|bind)  ipv4_addr_bind;;
4122	ipv4_runtime)    ipv4_runtime;;
4123	ipv4_netfilter)  ipv4_netfilter;;
4124
4125	ipv6_ping|ping6) ipv6_ping;;
4126	ipv6_tcp|tcp6)   ipv6_tcp;;
4127	ipv6_udp|udp6)   ipv6_udp;;
4128	ipv6_bind|bind6) ipv6_addr_bind;;
4129	ipv6_runtime)    ipv6_runtime;;
4130	ipv6_netfilter)  ipv6_netfilter;;
4131
4132	use_cases)       use_cases;;
4133
4134	# setup namespaces and config, but do not run any tests
4135	setup)		 setup; exit 0;;
4136	vrf_setup)	 setup "yes"; exit 0;;
4137	esac
4138done
4139
4140cleanup 2>/dev/null
4141
4142printf "\nTests passed: %3d\n" ${nsuccess}
4143printf "Tests failed: %3d\n"   ${nfail}
4144
4145if [ $nfail -ne 0 ]; then
4146	exit 1 # KSFT_FAIL
4147elif [ $nsuccess -eq 0 ]; then
4148	exit $ksft_skip
4149fi
4150
4151exit 0 # KSFT_PASS
4152