samples/bpf/tc_l2_redirect.sh

0001 #!/bin/bash
0002 # SPDX-License-Identifier: GPL-2.0
0003
0004 [[ -z $TC ]] && TC='tc'
0005 [[ -z $IP ]] && IP='ip'
0006
0007 REDIRECT_USER='./tc_l2_redirect'
0008 REDIRECT_BPF='./tc_l2_redirect_kern.o'
0009
0010 RP_FILTER=$(< /proc/sys/net/ipv4/conf/all/rp_filter)
0011 IPV6_FORWARDING=$(< /proc/sys/net/ipv6/conf/all/forwarding)
0012
0013 function config_common {
0014         local tun_type=$1
0015
0016         $IP netns add ns1
0017         $IP netns add ns2
0018         $IP link add ve1 type veth peer name vens1
0019         $IP link add ve2 type veth peer name vens2
0020         $IP link set dev ve1 up
0021         $IP link set dev ve2 up
0022         $IP link set dev ve1 mtu 1500
0023         $IP link set dev ve2 mtu 1500
0024         $IP link set dev vens1 netns ns1
0025         $IP link set dev vens2 netns ns2
0026
0027         $IP -n ns1 link set dev lo up
0028         $IP -n ns1 link set dev vens1 up
0029         $IP -n ns1 addr add 10.1.1.101/24 dev vens1
0030         $IP -n ns1 addr add 2401:db01::65/64 dev vens1 nodad
0031         $IP -n ns1 route add default via 10.1.1.1 dev vens1
0032         $IP -n ns1 route add default via 2401:db01::1 dev vens1
0033
0034         $IP -n ns2 link set dev lo up
0035         $IP -n ns2 link set dev vens2 up
0036         $IP -n ns2 addr add 10.2.1.102/24 dev vens2
0037         $IP -n ns2 addr add 2401:db02::66/64 dev vens2 nodad
0038         $IP -n ns2 addr add 10.10.1.102 dev lo
0039         $IP -n ns2 addr add 2401:face::66/64 dev lo nodad
0040         $IP -n ns2 link add ipt2 type ipip local 10.2.1.102 remote 10.2.1.1
0041         $IP -n ns2 link add ip6t2 type ip6tnl mode any local 2401:db02::66 remote 2401:db02::1
0042         $IP -n ns2 link set dev ipt2 up
0043         $IP -n ns2 link set dev ip6t2 up
0044         $IP netns exec ns2 $TC qdisc add dev vens2 clsact
0045         $IP netns exec ns2 $TC filter add dev vens2 ingress bpf da obj $REDIRECT_BPF sec drop_non_tun_vip
0046         if [[ $tun_type == "ipip" ]]; then
0047                 $IP -n ns2 route add 10.1.1.0/24 dev ipt2
0048                 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
0049                 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ipt2.rp_filter=0
0050         else
0051                 $IP -n ns2 route add 10.1.1.0/24 dev ip6t2
0052                 $IP -n ns2 route add 2401:db01::/64 dev ip6t2
0053                 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
0054                 $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ip6t2.rp_filter=0
0055         fi
0056
0057         $IP addr add 10.1.1.1/24 dev ve1
0058         $IP addr add 2401:db01::1/64 dev ve1 nodad
0059         $IP addr add 10.2.1.1/24 dev ve2
0060         $IP addr add 2401:db02::1/64 dev ve2 nodad
0061
0062         $TC qdisc add dev ve2 clsact
0063         $TC filter add dev ve2 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_forward
0064
0065         sysctl -q -w net.ipv4.conf.all.rp_filter=0
0066         sysctl -q -w net.ipv6.conf.all.forwarding=1
0067 }
0068
0069 function cleanup {
0070         set +e
0071         [[ -z $DEBUG ]] || set +x
0072         $IP netns delete ns1 >& /dev/null
0073         $IP netns delete ns2 >& /dev/null
0074         $IP link del ve1 >& /dev/null
0075         $IP link del ve2 >& /dev/null
0076         $IP link del ipt >& /dev/null
0077         $IP link del ip6t >& /dev/null
0078         sysctl -q -w net.ipv4.conf.all.rp_filter=$RP_FILTER
0079         sysctl -q -w net.ipv6.conf.all.forwarding=$IPV6_FORWARDING
0080         rm -f /sys/fs/bpf/tc/globals/tun_iface
0081         [[ -z $DEBUG ]] || set -x
0082         set -e
0083 }
0084
0085 function l2_to_ipip {
0086         echo -n "l2_to_ipip $1: "
0087
0088         local dir=$1
0089
0090         config_common ipip
0091
0092         $IP link add ipt type ipip external
0093         $IP link set dev ipt up
0094         sysctl -q -w net.ipv4.conf.ipt.rp_filter=0
0095         sysctl -q -w net.ipv4.conf.ipt.forwarding=1
0096
0097         if [[ $dir == "egress" ]]; then
0098                 $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
0099                 $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
0100                 sysctl -q -w net.ipv4.conf.ve1.forwarding=1
0101         else
0102                 $TC qdisc add dev ve1 clsact
0103                 $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
0104         fi
0105
0106         $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ipt/ifindex)
0107
0108         $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
0109
0110         if [[ $dir == "egress" ]]; then
0111                 # test direct egress to ve2 (i.e. not forwarding from
0112                 # ve1 to ve2).
0113                 ping -c1 10.10.1.102 >& /dev/null
0114         fi
0115
0116         cleanup
0117
0118         echo "OK"
0119 }
0120
0121 function l2_to_ip6tnl {
0122         echo -n "l2_to_ip6tnl $1: "
0123
0124         local dir=$1
0125
0126         config_common ip6tnl
0127
0128         $IP link add ip6t type ip6tnl mode any external
0129         $IP link set dev ip6t up
0130         sysctl -q -w net.ipv4.conf.ip6t.rp_filter=0
0131         sysctl -q -w net.ipv4.conf.ip6t.forwarding=1
0132
0133         if [[ $dir == "egress" ]]; then
0134                 $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
0135                 $IP route add 2401:face::/64 via 2401:db02::66 dev ve2
0136                 $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
0137                 sysctl -q -w net.ipv4.conf.ve1.forwarding=1
0138         else
0139                 $TC qdisc add dev ve1 clsact
0140                 $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
0141         fi
0142
0143         $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ip6t/ifindex)
0144
0145         $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
0146         $IP netns exec ns1 ping -6 -c1 2401:face::66 >& /dev/null
0147
0148         if [[ $dir == "egress" ]]; then
0149                 # test direct egress to ve2 (i.e. not forwarding from
0150                 # ve1 to ve2).
0151                 ping -c1 10.10.1.102 >& /dev/null
0152                 ping -6 -c1 2401:face::66 >& /dev/null
0153         fi
0154
0155         cleanup
0156
0157         echo "OK"
0158 }
0159
0160 cleanup
0161 test_names="l2_to_ipip l2_to_ip6tnl"
0162 test_dirs="ingress egress"
0163 if [[ $# -ge 2 ]]; then
0164         test_names=$1
0165         test_dirs=$2
0166 elif [[ $# -ge 1 ]]; then
0167         test_names=$1
0168 fi
0169
0170 for t in $test_names; do
0171         for d in $test_dirs; do
0172                 $t $d
0173         done
0174 done