1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3
4# This test is for checking IPv4 and IPv6 FIB rules API
5
6# Kselftest framework requirement - SKIP code is 4.
7ksft_skip=4
8
9ret=0
10
11PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
12IP="ip -netns testns"
13IP_PEER="ip -netns peerns"
14
15RTABLE=100
16RTABLE_PEER=101
17GW_IP4=192.51.100.2
18SRC_IP=192.51.100.3
19GW_IP6=2001:db8:1::2
20SRC_IP6=2001:db8:1::3
21
22DEV_ADDR=192.51.100.1
23DEV_ADDR6=2001:db8:1::1
24DEV=dummy0
25TESTS="fib_rule6 fib_rule4 fib_rule6_connect fib_rule4_connect"
26
27SELFTEST_PATH=""
28
29log_test()
30{
31	local rc=$1
32	local expected=$2
33	local msg="$3"
34
35	if [ ${rc} -eq ${expected} ]; then
36		nsuccess=$((nsuccess+1))
37		printf "\n    TEST: %-50s  [ OK ]\n" "${msg}"
38	else
39		ret=1
40		nfail=$((nfail+1))
41		printf "\n    TEST: %-50s  [FAIL]\n" "${msg}"
42		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
43			echo
44			echo "hit enter to continue, 'q' to quit"
45			read a
46			[ "$a" = "q" ] && exit 1
47		fi
48	fi
49}
50
51log_section()
52{
53	echo
54	echo "######################################################################"
55	echo "TEST SECTION: $*"
56	echo "######################################################################"
57}
58
59check_nettest()
60{
61	if which nettest > /dev/null 2>&1; then
62		return 0
63	fi
64
65	# Add the selftest directory to PATH if not already done
66	if [ "${SELFTEST_PATH}" = "" ]; then
67		SELFTEST_PATH="$(dirname $0)"
68		PATH="${PATH}:${SELFTEST_PATH}"
69
70		# Now retry with the new path
71		if which nettest > /dev/null 2>&1; then
72			return 0
73		fi
74
75		if [ "${ret}" -eq 0 ]; then
76			ret="${ksft_skip}"
77		fi
78		echo "nettest not found (try 'make -C ${SELFTEST_PATH} nettest')"
79	fi
80
81	return 1
82}
83
84setup()
85{
86	set -e
87	ip netns add testns
88	$IP link set dev lo up
89
90	$IP link add dummy0 type dummy
91	$IP link set dev dummy0 up
92	$IP address add $DEV_ADDR/24 dev dummy0
93	$IP -6 address add $DEV_ADDR6/64 dev dummy0
94
95	set +e
96}
97
98cleanup()
99{
100	$IP link del dev dummy0 &> /dev/null
101	ip netns del testns
102}
103
104setup_peer()
105{
106	set -e
107
108	ip netns add peerns
109	$IP_PEER link set dev lo up
110
111	ip link add name veth0 netns testns type veth \
112		peer name veth1 netns peerns
113	$IP link set dev veth0 up
114	$IP_PEER link set dev veth1 up
115
116	$IP address add 192.0.2.10 peer 192.0.2.11/32 dev veth0
117	$IP_PEER address add 192.0.2.11 peer 192.0.2.10/32 dev veth1
118
119	$IP address add 2001:db8::10 peer 2001:db8::11/128 dev veth0 nodad
120	$IP_PEER address add 2001:db8::11 peer 2001:db8::10/128 dev veth1 nodad
121
122	$IP_PEER address add 198.51.100.11/32 dev lo
123	$IP route add table $RTABLE_PEER 198.51.100.11/32 via 192.0.2.11
124
125	$IP_PEER address add 2001:db8::1:11/128 dev lo
126	$IP route add table $RTABLE_PEER 2001:db8::1:11/128 via 2001:db8::11
127
128	set +e
129}
130
131cleanup_peer()
132{
133	$IP link del dev veth0
134	ip netns del peerns
135}
136
137fib_check_iproute_support()
138{
139	ip rule help 2>&1 | grep -q $1
140	if [ $? -ne 0 ]; then
141		echo "SKIP: iproute2 iprule too old, missing $1 match"
142		return 1
143	fi
144
145	ip route get help 2>&1 | grep -q $2
146	if [ $? -ne 0 ]; then
147		echo "SKIP: iproute2 get route too old, missing $2 match"
148		return 1
149	fi
150
151	return 0
152}
153
154fib_rule6_del()
155{
156	$IP -6 rule del $1
157	log_test $? 0 "rule6 del $1"
158}
159
160fib_rule6_del_by_pref()
161{
162	pref=$($IP -6 rule show $1 table $RTABLE | cut -d ":" -f 1)
163	$IP -6 rule del pref $pref
164}
165
166fib_rule6_test_match_n_redirect()
167{
168	local match="$1"
169	local getmatch="$2"
170	local description="$3"
171
172	$IP -6 rule add $match table $RTABLE
173	$IP -6 route get $GW_IP6 $getmatch | grep -q "table $RTABLE"
174	log_test $? 0 "rule6 check: $description"
175
176	fib_rule6_del_by_pref "$match"
177	log_test $? 0 "rule6 del by pref: $description"
178}
179
180fib_rule6_test_reject()
181{
182	local match="$1"
183	local rc
184
185	$IP -6 rule add $match table $RTABLE 2>/dev/null
186	rc=$?
187	log_test $rc 2 "rule6 check: $match"
188
189	if [ $rc -eq 0 ]; then
190		$IP -6 rule del $match table $RTABLE
191	fi
192}
193
194fib_rule6_test()
195{
196	local getmatch
197	local match
198	local cnt
199
200	# setup the fib rule redirect route
201	$IP -6 route add table $RTABLE default via $GW_IP6 dev $DEV onlink
202
203	match="oif $DEV"
204	fib_rule6_test_match_n_redirect "$match" "$match" "oif redirect to table"
205
206	match="from $SRC_IP6 iif $DEV"
207	fib_rule6_test_match_n_redirect "$match" "$match" "iif redirect to table"
208
209	# Reject dsfield (tos) options which have ECN bits set
210	for cnt in $(seq 1 3); do
211		match="dsfield $cnt"
212		fib_rule6_test_reject "$match"
213	done
214
215	# Don't take ECN bits into account when matching on dsfield
216	match="tos 0x10"
217	for cnt in "0x10" "0x11" "0x12" "0x13"; do
218		# Using option 'tos' instead of 'dsfield' as old iproute2
219		# versions don't support 'dsfield' in ip rule show.
220		getmatch="tos $cnt"
221		fib_rule6_test_match_n_redirect "$match" "$getmatch" \
222						"$getmatch redirect to table"
223	done
224
225	match="fwmark 0x64"
226	getmatch="mark 0x64"
227	fib_rule6_test_match_n_redirect "$match" "$getmatch" "fwmark redirect to table"
228
229	fib_check_iproute_support "uidrange" "uid"
230	if [ $? -eq 0 ]; then
231		match="uidrange 100-100"
232		getmatch="uid 100"
233		fib_rule6_test_match_n_redirect "$match" "$getmatch" "uid redirect to table"
234	fi
235
236	fib_check_iproute_support "sport" "sport"
237	if [ $? -eq 0 ]; then
238		match="sport 666 dport 777"
239		fib_rule6_test_match_n_redirect "$match" "$match" "sport and dport redirect to table"
240	fi
241
242	fib_check_iproute_support "ipproto" "ipproto"
243	if [ $? -eq 0 ]; then
244		match="ipproto tcp"
245		fib_rule6_test_match_n_redirect "$match" "$match" "ipproto match"
246	fi
247
248	fib_check_iproute_support "ipproto" "ipproto"
249	if [ $? -eq 0 ]; then
250		match="ipproto ipv6-icmp"
251		fib_rule6_test_match_n_redirect "$match" "$match" "ipproto ipv6-icmp match"
252	fi
253}
254
255# Verify that the IPV6_TCLASS option of UDPv6 and TCPv6 sockets is properly
256# taken into account when connecting the socket and when sending packets.
257fib_rule6_connect_test()
258{
259	local dsfield
260
261	if ! check_nettest; then
262		echo "SKIP: Could not run test without nettest tool"
263		return
264	fi
265
266	setup_peer
267	$IP -6 rule add dsfield 0x04 table $RTABLE_PEER
268
269	# Combine the base DS Field value (0x04) with all possible ECN values
270	# (Not-ECT: 0, ECT(1): 1, ECT(0): 2, CE: 3).
271	# The ECN bits shouldn't influence the result of the test.
272	for dsfield in 0x04 0x05 0x06 0x07; do
273		nettest -q -6 -B -t 5 -N testns -O peerns -U -D \
274			-Q "${dsfield}" -l 2001:db8::1:11 -r 2001:db8::1:11
275		log_test $? 0 "rule6 dsfield udp connect (dsfield ${dsfield})"
276
277		nettest -q -6 -B -t 5 -N testns -O peerns -Q "${dsfield}" \
278			-l 2001:db8::1:11 -r 2001:db8::1:11
279		log_test $? 0 "rule6 dsfield tcp connect (dsfield ${dsfield})"
280	done
281
282	$IP -6 rule del dsfield 0x04 table $RTABLE_PEER
283	cleanup_peer
284}
285
286fib_rule4_del()
287{
288	$IP rule del $1
289	log_test $? 0 "del $1"
290}
291
292fib_rule4_del_by_pref()
293{
294	pref=$($IP rule show $1 table $RTABLE | cut -d ":" -f 1)
295	$IP rule del pref $pref
296}
297
298fib_rule4_test_match_n_redirect()
299{
300	local match="$1"
301	local getmatch="$2"
302	local description="$3"
303
304	$IP rule add $match table $RTABLE
305	$IP route get $GW_IP4 $getmatch | grep -q "table $RTABLE"
306	log_test $? 0 "rule4 check: $description"
307
308	fib_rule4_del_by_pref "$match"
309	log_test $? 0 "rule4 del by pref: $description"
310}
311
312fib_rule4_test_reject()
313{
314	local match="$1"
315	local rc
316
317	$IP rule add $match table $RTABLE 2>/dev/null
318	rc=$?
319	log_test $rc 2 "rule4 check: $match"
320
321	if [ $rc -eq 0 ]; then
322		$IP rule del $match table $RTABLE
323	fi
324}
325
326fib_rule4_test()
327{
328	local getmatch
329	local match
330	local cnt
331
332	# setup the fib rule redirect route
333	$IP route add table $RTABLE default via $GW_IP4 dev $DEV onlink
334
335	match="oif $DEV"
336	fib_rule4_test_match_n_redirect "$match" "$match" "oif redirect to table"
337
338	# need enable forwarding and disable rp_filter temporarily as all the
339	# addresses are in the same subnet and egress device == ingress device.
340	ip netns exec testns sysctl -qw net.ipv4.ip_forward=1
341	ip netns exec testns sysctl -qw net.ipv4.conf.$DEV.rp_filter=0
342	match="from $SRC_IP iif $DEV"
343	fib_rule4_test_match_n_redirect "$match" "$match" "iif redirect to table"
344	ip netns exec testns sysctl -qw net.ipv4.ip_forward=0
345
346	# Reject dsfield (tos) options which have ECN bits set
347	for cnt in $(seq 1 3); do
348		match="dsfield $cnt"
349		fib_rule4_test_reject "$match"
350	done
351
352	# Don't take ECN bits into account when matching on dsfield
353	match="tos 0x10"
354	for cnt in "0x10" "0x11" "0x12" "0x13"; do
355		# Using option 'tos' instead of 'dsfield' as old iproute2
356		# versions don't support 'dsfield' in ip rule show.
357		getmatch="tos $cnt"
358		fib_rule4_test_match_n_redirect "$match" "$getmatch" \
359						"$getmatch redirect to table"
360	done
361
362	match="fwmark 0x64"
363	getmatch="mark 0x64"
364	fib_rule4_test_match_n_redirect "$match" "$getmatch" "fwmark redirect to table"
365
366	fib_check_iproute_support "uidrange" "uid"
367	if [ $? -eq 0 ]; then
368		match="uidrange 100-100"
369		getmatch="uid 100"
370		fib_rule4_test_match_n_redirect "$match" "$getmatch" "uid redirect to table"
371	fi
372
373	fib_check_iproute_support "sport" "sport"
374	if [ $? -eq 0 ]; then
375		match="sport 666 dport 777"
376		fib_rule4_test_match_n_redirect "$match" "$match" "sport and dport redirect to table"
377	fi
378
379	fib_check_iproute_support "ipproto" "ipproto"
380	if [ $? -eq 0 ]; then
381		match="ipproto tcp"
382		fib_rule4_test_match_n_redirect "$match" "$match" "ipproto tcp match"
383	fi
384
385	fib_check_iproute_support "ipproto" "ipproto"
386	if [ $? -eq 0 ]; then
387		match="ipproto icmp"
388		fib_rule4_test_match_n_redirect "$match" "$match" "ipproto icmp match"
389	fi
390}
391
392# Verify that the IP_TOS option of UDPv4 and TCPv4 sockets is properly taken
393# into account when connecting the socket and when sending packets.
394fib_rule4_connect_test()
395{
396	local dsfield
397
398	if ! check_nettest; then
399		echo "SKIP: Could not run test without nettest tool"
400		return
401	fi
402
403	setup_peer
404	$IP -4 rule add dsfield 0x04 table $RTABLE_PEER
405
406	# Combine the base DS Field value (0x04) with all possible ECN values
407	# (Not-ECT: 0, ECT(1): 1, ECT(0): 2, CE: 3).
408	# The ECN bits shouldn't influence the result of the test.
409	for dsfield in 0x04 0x05 0x06 0x07; do
410		nettest -q -B -t 5 -N testns -O peerns -D -U -Q "${dsfield}" \
411			-l 198.51.100.11 -r 198.51.100.11
412		log_test $? 0 "rule4 dsfield udp connect (dsfield ${dsfield})"
413
414		nettest -q -B -t 5 -N testns -O peerns -Q "${dsfield}" \
415			-l 198.51.100.11 -r 198.51.100.11
416		log_test $? 0 "rule4 dsfield tcp connect (dsfield ${dsfield})"
417	done
418
419	$IP -4 rule del dsfield 0x04 table $RTABLE_PEER
420	cleanup_peer
421}
422
423run_fibrule_tests()
424{
425	log_section "IPv4 fib rule"
426	fib_rule4_test
427	log_section "IPv6 fib rule"
428	fib_rule6_test
429}
430################################################################################
431# usage
432
433usage()
434{
435	cat <<EOF
436usage: ${0##*/} OPTS
437
438        -t <test>   Test(s) to run (default: all)
439                    (options: $TESTS)
440EOF
441}
442
443################################################################################
444# main
445
446while getopts ":t:h" opt; do
447	case $opt in
448		t) TESTS=$OPTARG;;
449		h) usage; exit 0;;
450		*) usage; exit 1;;
451	esac
452done
453
454if [ "$(id -u)" -ne 0 ];then
455	echo "SKIP: Need root privileges"
456	exit $ksft_skip
457fi
458
459if [ ! -x "$(command -v ip)" ]; then
460	echo "SKIP: Could not run test without ip tool"
461	exit $ksft_skip
462fi
463
464# start clean
465cleanup &> /dev/null
466setup
467for t in $TESTS
468do
469	case $t in
470	fib_rule6_test|fib_rule6)		fib_rule6_test;;
471	fib_rule4_test|fib_rule4)		fib_rule4_test;;
472	fib_rule6_connect_test|fib_rule6_connect)	fib_rule6_connect_test;;
473	fib_rule4_connect_test|fib_rule4_connect)	fib_rule4_connect_test;;
474
475	help) echo "Test names: $TESTS"; exit 0;;
476
477	esac
478done
479cleanup
480
481if [ "$TESTS" != "none" ]; then
482	printf "\nTests passed: %3d\n" ${nsuccess}
483	printf "Tests failed: %3d\n"   ${nfail}
484fi
485
486exit $ret
487