0001
0002
0003
0004
0005
0006
0007
0008
0009
0010
0011
0012
0013
0014
0015
0016
0017
0018
0019
0020
0021
0022
0023
0024
0025
0026
0027
0028
0029
0030
0031
0032
0033
0034
0035
0036
0037
0038
0039
0040
0041
0042
0043
0044
0045
0046
0047
0048
0049
0050
0051
0052
0053
0054
0055
0056
0057
0058
0059
0060
0061
0062
0063
0064
0065
0066
0067
0068
0069
0070
0071
0072
0073
0074
0075
0076
0077
0078
0079
0080
0081
0082
0083
0084
0085
0086
0087
0088
0089
0090
0091
0092
0093
0094
0095
0096
0097
0098
0099
0100
0101
0102
0103
0104
0105
0106
0107
0108
0109
0110
0111
0112
0113
0114
0115
0116
0117
0118
0119
0120
0121
0122
0123
0124
0125
0126
0127
0128
0129
0130
0131
0132
0133
0134
0135
0136
0137
0138
0139
0140
0141
0142
0143
0144
0145
0146
0147
0148
0149
0150
0151
0152
0153
0154
0155
0156
0157
0158
0159
0160
0161
0162
0163
0164
0165
0166
0167
0168
0169
0170
0171
0172
0173
0174
0175
0176
0177
0178
0179
0180
0181
0182
0183
0184
0185
0186
0187
0188
0189
0190
0191
0192
0193
0194
0195
0196
0197 ksft_skip=4
0198
0199 readonly LOCALSID_TABLE_ID=90
0200 readonly IPv6_RT_NETWORK=fd00
0201 readonly IPv6_HS_NETWORK=cafe
0202 readonly IPv4_HS_NETWORK=10.0.0
0203 readonly VPN_LOCATOR_SERVICE=fc00
0204 PING_TIMEOUT_SEC=4
0205
0206 ret=0
0207
0208 PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
0209
0210 log_test()
0211 {
0212 local rc=$1
0213 local expected=$2
0214 local msg="$3"
0215
0216 if [ ${rc} -eq ${expected} ]; then
0217 nsuccess=$((nsuccess+1))
0218 printf "\n TEST: %-60s [ OK ]\n" "${msg}"
0219 else
0220 ret=1
0221 nfail=$((nfail+1))
0222 printf "\n TEST: %-60s [FAIL]\n" "${msg}"
0223 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
0224 echo
0225 echo "hit enter to continue, 'q' to quit"
0226 read a
0227 [ "$a" = "q" ] && exit 1
0228 fi
0229 fi
0230 }
0231
0232 print_log_test_results()
0233 {
0234 if [ "$TESTS" != "none" ]; then
0235 printf "\nTests passed: %3d\n" ${nsuccess}
0236 printf "Tests failed: %3d\n" ${nfail}
0237 fi
0238 }
0239
0240 log_section()
0241 {
0242 echo
0243 echo "################################################################################"
0244 echo "TEST SECTION: $*"
0245 echo "################################################################################"
0246 }
0247
0248 cleanup()
0249 {
0250 ip link del veth-rt-1 2>/dev/null || true
0251 ip link del veth-rt-2 2>/dev/null || true
0252
0253
0254 for ns in $(ip netns show | grep -E 'rt-*|hs-*'); do
0255 ip netns del ${ns} || true
0256 done
0257 }
0258
0259
0260 setup_rt_networking()
0261 {
0262 local rt=$1
0263 local nsname=rt-${rt}
0264
0265 ip netns add ${nsname}
0266 ip link set veth-rt-${rt} netns ${nsname}
0267 ip -netns ${nsname} link set veth-rt-${rt} name veth0
0268
0269 ip netns exec ${nsname} sysctl -wq net.ipv6.conf.all.accept_dad=0
0270 ip netns exec ${nsname} sysctl -wq net.ipv6.conf.default.accept_dad=0
0271
0272 ip -netns ${nsname} addr add ${IPv6_RT_NETWORK}::${rt}/64 dev veth0 nodad
0273 ip -netns ${nsname} link set veth0 up
0274 ip -netns ${nsname} link set lo up
0275
0276 ip netns exec ${nsname} sysctl -wq net.ipv4.ip_forward=1
0277 ip netns exec ${nsname} sysctl -wq net.ipv6.conf.all.forwarding=1
0278 }
0279
0280 setup_hs()
0281 {
0282 local hs=$1
0283 local rt=$2
0284 local tid=$3
0285 local hsname=hs-t${tid}-${hs}
0286 local rtname=rt-${rt}
0287 local rtveth=veth-t${tid}
0288
0289
0290 ip netns add ${hsname}
0291
0292 ip netns exec ${hsname} sysctl -wq net.ipv6.conf.all.accept_dad=0
0293 ip netns exec ${hsname} sysctl -wq net.ipv6.conf.default.accept_dad=0
0294
0295 ip -netns ${hsname} link add veth0 type veth peer name ${rtveth}
0296 ip -netns ${hsname} link set ${rtveth} netns ${rtname}
0297 ip -netns ${hsname} addr add ${IPv6_HS_NETWORK}::${hs}/64 dev veth0 nodad
0298 ip -netns ${hsname} addr add ${IPv4_HS_NETWORK}.${hs}/24 dev veth0
0299 ip -netns ${hsname} link set veth0 up
0300 ip -netns ${hsname} link set lo up
0301
0302
0303
0304 ip -netns ${rtname} link add vrf-${tid} type vrf table ${tid}
0305 ip -netns ${rtname} link set vrf-${tid} up
0306
0307 ip netns exec ${rtname} sysctl -wq net.ipv6.conf.all.accept_dad=0
0308 ip netns exec ${rtname} sysctl -wq net.ipv6.conf.default.accept_dad=0
0309
0310
0311 ip -netns ${rtname} link set ${rtveth} master vrf-${tid}
0312 ip -netns ${rtname} addr add ${IPv6_HS_NETWORK}::254/64 dev ${rtveth} nodad
0313 ip -netns ${rtname} addr add ${IPv4_HS_NETWORK}.254/24 dev ${rtveth}
0314 ip -netns ${rtname} link set ${rtveth} up
0315
0316 ip netns exec ${rtname} sysctl -wq net.ipv6.conf.${rtveth}.proxy_ndp=1
0317 ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.proxy_arp=1
0318
0319
0320
0321 ip netns exec ${rtname} sysctl -wq net.ipv4.conf.all.rp_filter=0
0322 ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.rp_filter=0
0323
0324 ip netns exec ${rtname} sh -c "echo 1 > /proc/sys/net/vrf/strict_mode"
0325 }
0326
0327 setup_vpn_config()
0328 {
0329 local hssrc=$1
0330 local rtsrc=$2
0331 local hsdst=$3
0332 local rtdst=$4
0333 local tid=$5
0334
0335 local hssrc_name=hs-t${tid}-${hssrc}
0336 local hsdst_name=hs-t${tid}-${hsdst}
0337 local rtsrc_name=rt-${rtsrc}
0338 local rtdst_name=rt-${rtdst}
0339 local rtveth=veth-t${tid}
0340 local vpn_sid=${VPN_LOCATOR_SERVICE}:${hssrc}${hsdst}:${tid}::6046
0341
0342 ip -netns ${rtsrc_name} -6 neigh add proxy ${IPv6_HS_NETWORK}::${hsdst} dev ${rtveth}
0343
0344
0345
0346 ip -netns ${rtsrc_name} -6 route add ${IPv6_HS_NETWORK}::${hsdst}/128 vrf vrf-${tid} \
0347 encap seg6 mode encap segs ${vpn_sid} dev veth0
0348 ip -netns ${rtsrc_name} -4 route add ${IPv4_HS_NETWORK}.${hsdst}/32 vrf vrf-${tid} \
0349 encap seg6 mode encap segs ${vpn_sid} dev veth0
0350 ip -netns ${rtsrc_name} -6 route add ${vpn_sid}/128 vrf vrf-${tid} \
0351 via fd00::${rtdst} dev veth0
0352
0353
0354
0355 ip -netns ${rtdst_name} -6 route add ${vpn_sid}/128 table ${LOCALSID_TABLE_ID} \
0356 encap seg6local action End.DT46 vrftable ${tid} dev vrf-${tid}
0357
0358
0359
0360
0361
0362
0363 if [ -z "$(ip -netns ${rtdst_name} -6 rule show | \
0364 grep "to ${VPN_LOCATOR_SERVICE}::/16 lookup ${LOCALSID_TABLE_ID}")" ]; then
0365 ip -netns ${rtdst_name} -6 rule add \
0366 to ${VPN_LOCATOR_SERVICE}::/16 \
0367 lookup ${LOCALSID_TABLE_ID} prio 999
0368 fi
0369
0370
0371 ip -netns ${rtsrc_name} -6 route add unreachable default metric 4278198272 \
0372 vrf vrf-${tid}
0373
0374 ip -netns ${rtsrc_name} -4 route add unreachable default metric 4278198272 \
0375 vrf vrf-${tid}
0376 }
0377
0378 setup()
0379 {
0380 ip link add veth-rt-1 type veth peer name veth-rt-2
0381
0382 setup_rt_networking 1
0383 setup_rt_networking 2
0384
0385
0386
0387
0388 setup_hs 1 1 100
0389 setup_hs 2 2 100
0390
0391
0392
0393
0394 setup_hs 3 1 200
0395 setup_hs 4 2 200
0396
0397
0398
0399 setup_vpn_config 1 1 2 2 100
0400 setup_vpn_config 2 2 1 1 100
0401
0402
0403
0404 setup_vpn_config 3 1 4 2 200
0405 setup_vpn_config 4 2 3 1 200
0406 }
0407
0408 check_rt_connectivity()
0409 {
0410 local rtsrc=$1
0411 local rtdst=$2
0412
0413 ip netns exec rt-${rtsrc} ping -c 1 -W 1 ${IPv6_RT_NETWORK}::${rtdst} \
0414 >/dev/null 2>&1
0415 }
0416
0417 check_and_log_rt_connectivity()
0418 {
0419 local rtsrc=$1
0420 local rtdst=$2
0421
0422 check_rt_connectivity ${rtsrc} ${rtdst}
0423 log_test $? 0 "Routers connectivity: rt-${rtsrc} -> rt-${rtdst}"
0424 }
0425
0426 check_hs_ipv6_connectivity()
0427 {
0428 local hssrc=$1
0429 local hsdst=$2
0430 local tid=$3
0431
0432 ip netns exec hs-t${tid}-${hssrc} ping -c 1 -W ${PING_TIMEOUT_SEC} \
0433 ${IPv6_HS_NETWORK}::${hsdst} >/dev/null 2>&1
0434 }
0435
0436 check_hs_ipv4_connectivity()
0437 {
0438 local hssrc=$1
0439 local hsdst=$2
0440 local tid=$3
0441
0442 ip netns exec hs-t${tid}-${hssrc} ping -c 1 -W ${PING_TIMEOUT_SEC} \
0443 ${IPv4_HS_NETWORK}.${hsdst} >/dev/null 2>&1
0444 }
0445
0446 check_and_log_hs_connectivity()
0447 {
0448 local hssrc=$1
0449 local hsdst=$2
0450 local tid=$3
0451
0452 check_hs_ipv6_connectivity ${hssrc} ${hsdst} ${tid}
0453 log_test $? 0 "IPv6 Hosts connectivity: hs-t${tid}-${hssrc} -> hs-t${tid}-${hsdst} (tenant ${tid})"
0454
0455 check_hs_ipv4_connectivity ${hssrc} ${hsdst} ${tid}
0456 log_test $? 0 "IPv4 Hosts connectivity: hs-t${tid}-${hssrc} -> hs-t${tid}-${hsdst} (tenant ${tid})"
0457
0458 }
0459
0460 check_and_log_hs_isolation()
0461 {
0462 local hssrc=$1
0463 local tidsrc=$2
0464 local hsdst=$3
0465 local tiddst=$4
0466
0467 check_hs_ipv6_connectivity ${hssrc} ${hsdst} ${tidsrc}
0468
0469 log_test $? 1 "IPv6 Hosts isolation: hs-t${tidsrc}-${hssrc} -X-> hs-t${tiddst}-${hsdst}"
0470
0471 check_hs_ipv4_connectivity ${hssrc} ${hsdst} ${tidsrc}
0472
0473 log_test $? 1 "IPv4 Hosts isolation: hs-t${tidsrc}-${hssrc} -X-> hs-t${tiddst}-${hsdst}"
0474
0475 }
0476
0477
0478 check_and_log_hs2gw_connectivity()
0479 {
0480 local hssrc=$1
0481 local tid=$2
0482
0483 check_hs_ipv6_connectivity ${hssrc} 254 ${tid}
0484 log_test $? 0 "IPv6 Hosts connectivity: hs-t${tid}-${hssrc} -> gw (tenant ${tid})"
0485
0486 check_hs_ipv4_connectivity ${hssrc} 254 ${tid}
0487 log_test $? 0 "IPv4 Hosts connectivity: hs-t${tid}-${hssrc} -> gw (tenant ${tid})"
0488
0489 }
0490
0491 router_tests()
0492 {
0493 log_section "IPv6 routers connectivity test"
0494
0495 check_and_log_rt_connectivity 1 2
0496 check_and_log_rt_connectivity 2 1
0497 }
0498
0499 host2gateway_tests()
0500 {
0501 log_section "IPv4/IPv6 connectivity test among hosts and gateway"
0502
0503 check_and_log_hs2gw_connectivity 1 100
0504 check_and_log_hs2gw_connectivity 2 100
0505
0506 check_and_log_hs2gw_connectivity 3 200
0507 check_and_log_hs2gw_connectivity 4 200
0508 }
0509
0510 host_vpn_tests()
0511 {
0512 log_section "SRv6 VPN connectivity test among hosts in the same tenant"
0513
0514 check_and_log_hs_connectivity 1 2 100
0515 check_and_log_hs_connectivity 2 1 100
0516
0517 check_and_log_hs_connectivity 3 4 200
0518 check_and_log_hs_connectivity 4 3 200
0519 }
0520
0521 host_vpn_isolation_tests()
0522 {
0523 local i
0524 local j
0525 local k
0526 local tmp
0527 local l1="1 2"
0528 local l2="3 4"
0529 local t1=100
0530 local t2=200
0531
0532 log_section "SRv6 VPN isolation test among hosts in different tentants"
0533
0534 for k in 0 1; do
0535 for i in ${l1}; do
0536 for j in ${l2}; do
0537 check_and_log_hs_isolation ${i} ${t1} ${j} ${t2}
0538 done
0539 done
0540
0541
0542 tmp="${l1}"; l1="${l2}"; l2="${tmp}"
0543 tmp=${t1}; t1=${t2}; t2=${tmp}
0544 done
0545 }
0546
0547 if [ "$(id -u)" -ne 0 ];then
0548 echo "SKIP: Need root privileges"
0549 exit $ksft_skip
0550 fi
0551
0552 if [ ! -x "$(command -v ip)" ]; then
0553 echo "SKIP: Could not run test without ip tool"
0554 exit $ksft_skip
0555 fi
0556
0557 modprobe vrf &>/dev/null
0558 if [ ! -e /proc/sys/net/vrf/strict_mode ]; then
0559 echo "SKIP: vrf sysctl does not exist"
0560 exit $ksft_skip
0561 fi
0562
0563 cleanup &>/dev/null
0564
0565 setup
0566
0567 router_tests
0568 host2gateway_tests
0569 host_vpn_tests
0570 host_vpn_isolation_tests
0571
0572 print_log_test_results
0573
0574 cleanup &>/dev/null
0575
0576 exit ${ret}