selftests/net/vrf_strict_mode_test.sh

0001 #!/bin/bash
0002 # SPDX-License-Identifier: GPL-2.0
0003
0004 # This test is designed for testing the new VRF strict_mode functionality.
0005
0006 # Kselftest framework requirement - SKIP code is 4.
0007 ksft_skip=4
0008
0009 ret=0
0010
0011 # identifies the "init" network namespace which is often called root network
0012 # namespace.
0013 INIT_NETNS_NAME="init"
0014
0015 PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
0016
0017 TESTS="init testns mix"
0018
0019 log_test()
0020 {
0021         local rc=$1
0022         local expected=$2
0023         local msg="$3"
0024
0025         if [ ${rc} -eq ${expected} ]; then
0026                 nsuccess=$((nsuccess+1))
0027                 printf "\n    TEST: %-60s  [ OK ]\n" "${msg}"
0028         else
0029                 ret=1
0030                 nfail=$((nfail+1))
0031                 printf "\n    TEST: %-60s  [FAIL]\n" "${msg}"
0032                 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
0033                         echo
0034                         echo "hit enter to continue, 'q' to quit"
0035                         read a
0036                         [ "$a" = "q" ] && exit 1
0037                 fi
0038         fi
0039 }
0040
0041 print_log_test_results()
0042 {
0043         if [ "$TESTS" != "none" ]; then
0044                 printf "\nTests passed: %3d\n" ${nsuccess}
0045                 printf "Tests failed: %3d\n"   ${nfail}
0046         fi
0047 }
0048
0049 log_section()
0050 {
0051         echo
0052         echo "################################################################################"
0053         echo "TEST SECTION: $*"
0054         echo "################################################################################"
0055 }
0056
0057 ip_expand_args()
0058 {
0059         local nsname=$1
0060         local nsarg=""
0061
0062         if [ "${nsname}" != "${INIT_NETNS_NAME}" ]; then
0063                 nsarg="-netns ${nsname}"
0064         fi
0065
0066         echo "${nsarg}"
0067 }
0068
0069 vrf_count()
0070 {
0071         local nsname=$1
0072         local nsarg="$(ip_expand_args ${nsname})"
0073
0074         ip ${nsarg} -o link show type vrf | wc -l
0075 }
0076
0077 count_vrf_by_table_id()
0078 {
0079         local nsname=$1
0080         local tableid=$2
0081         local nsarg="$(ip_expand_args ${nsname})"
0082
0083         ip ${nsarg} -d -o link show type vrf | grep "table ${tableid}" | wc -l
0084 }
0085
0086 add_vrf()
0087 {
0088         local nsname=$1
0089         local vrfname=$2
0090         local vrftable=$3
0091         local nsarg="$(ip_expand_args ${nsname})"
0092
0093         ip ${nsarg} link add ${vrfname} type vrf table ${vrftable} &>/dev/null
0094 }
0095
0096 add_vrf_and_check()
0097 {
0098         local nsname=$1
0099         local vrfname=$2
0100         local vrftable=$3
0101         local cnt
0102         local rc
0103
0104         add_vrf ${nsname} ${vrfname} ${vrftable}; rc=$?
0105
0106         cnt=$(count_vrf_by_table_id ${nsname} ${vrftable})
0107
0108         log_test ${rc} 0 "${nsname}: add vrf ${vrfname}, ${cnt} vrfs for table ${vrftable}"
0109 }
0110
0111 add_vrf_and_check_fail()
0112 {
0113         local nsname=$1
0114         local vrfname=$2
0115         local vrftable=$3
0116         local cnt
0117         local rc
0118
0119         add_vrf ${nsname} ${vrfname} ${vrftable}; rc=$?
0120
0121         cnt=$(count_vrf_by_table_id ${nsname} ${vrftable})
0122
0123         log_test ${rc} 2 "${nsname}: CANNOT add vrf ${vrfname}, ${cnt} vrfs for table ${vrftable}"
0124 }
0125
0126 del_vrf_and_check()
0127 {
0128         local nsname=$1
0129         local vrfname=$2
0130         local nsarg="$(ip_expand_args ${nsname})"
0131
0132         ip ${nsarg} link del ${vrfname}
0133         log_test $? 0 "${nsname}: remove vrf ${vrfname}"
0134 }
0135
0136 config_vrf_and_check()
0137 {
0138         local nsname=$1
0139         local addr=$2
0140         local vrfname=$3
0141         local nsarg="$(ip_expand_args ${nsname})"
0142
0143         ip ${nsarg} link set dev ${vrfname} up && \
0144                 ip ${nsarg} addr add ${addr} dev ${vrfname}
0145         log_test $? 0 "${nsname}: vrf ${vrfname} up, addr ${addr}"
0146 }
0147
0148 read_strict_mode()
0149 {
0150         local nsname=$1
0151         local rval
0152         local rc=0
0153         local nsexec=""
0154
0155         if [ "${nsname}" != "${INIT_NETNS_NAME}" ]; then
0156                 # a custom network namespace is provided
0157                 nsexec="ip netns exec ${nsname}"
0158         fi
0159
0160         rval="$(${nsexec} bash -c "cat /proc/sys/net/vrf/strict_mode" | \
0161                 grep -E "^[0-1]$")" &> /dev/null
0162         if [ $? -ne 0 ]; then
0163                 # set errors
0164                 rval=255
0165                 rc=1
0166         fi
0167
0168         # on success, rval can be only 0 or 1; on error, rval is equal to 255
0169         echo ${rval}
0170         return ${rc}
0171 }
0172
0173 read_strict_mode_compare_and_check()
0174 {
0175         local nsname=$1
0176         local expected=$2
0177         local res
0178
0179         res="$(read_strict_mode ${nsname})"
0180         log_test ${res} ${expected} "${nsname}: check strict_mode=${res}"
0181 }
0182
0183 set_strict_mode()
0184 {
0185         local nsname=$1
0186         local val=$2
0187         local nsexec=""
0188
0189         if [ "${nsname}" != "${INIT_NETNS_NAME}" ]; then
0190                 # a custom network namespace is provided
0191                 nsexec="ip netns exec ${nsname}"
0192         fi
0193
0194         ${nsexec} bash -c "echo ${val} >/proc/sys/net/vrf/strict_mode" &>/dev/null
0195 }
0196
0197 enable_strict_mode()
0198 {
0199         local nsname=$1
0200
0201         set_strict_mode ${nsname} 1
0202 }
0203
0204 disable_strict_mode()
0205 {
0206         local nsname=$1
0207
0208         set_strict_mode ${nsname} 0
0209 }
0210
0211 disable_strict_mode_and_check()
0212 {
0213         local nsname=$1
0214
0215         disable_strict_mode ${nsname}
0216         log_test $? 0 "${nsname}: disable strict_mode (=0)"
0217 }
0218
0219 enable_strict_mode_and_check()
0220 {
0221         local nsname=$1
0222
0223         enable_strict_mode ${nsname}
0224         log_test $? 0 "${nsname}: enable strict_mode (=1)"
0225 }
0226
0227 enable_strict_mode_and_check_fail()
0228 {
0229         local nsname=$1
0230
0231         enable_strict_mode ${nsname}
0232         log_test $? 1 "${nsname}: CANNOT enable strict_mode"
0233 }
0234
0235 strict_mode_check_default()
0236 {
0237         local nsname=$1
0238         local strictmode
0239         local vrfcnt
0240
0241         vrfcnt=$(vrf_count ${nsname})
0242         strictmode=$(read_strict_mode ${nsname})
0243         log_test ${strictmode} 0 "${nsname}: strict_mode=0 by default, ${vrfcnt} vrfs"
0244 }
0245
0246 setup()
0247 {
0248         modprobe vrf
0249
0250         ip netns add testns
0251         ip netns exec testns ip link set lo up
0252 }
0253
0254 cleanup()
0255 {
0256         ip netns del testns 2>/dev/null
0257
0258         ip link del vrf100 2>/dev/null
0259         ip link del vrf101 2>/dev/null
0260         ip link del vrf102 2>/dev/null
0261
0262         echo 0 >/proc/sys/net/vrf/strict_mode 2>/dev/null
0263 }
0264
0265 vrf_strict_mode_tests_init()
0266 {
0267         log_section "VRF strict_mode test on init network namespace"
0268
0269         vrf_strict_mode_check_support init
0270
0271         strict_mode_check_default init
0272
0273         add_vrf_and_check init vrf100 100
0274         config_vrf_and_check init 172.16.100.1/24 vrf100
0275
0276         enable_strict_mode_and_check init
0277
0278         add_vrf_and_check_fail init vrf101 100
0279
0280         disable_strict_mode_and_check init
0281
0282         add_vrf_and_check init vrf101 100
0283         config_vrf_and_check init 172.16.101.1/24 vrf101
0284
0285         enable_strict_mode_and_check_fail init
0286
0287         del_vrf_and_check init vrf101
0288
0289         enable_strict_mode_and_check init
0290
0291         add_vrf_and_check init vrf102 102
0292         config_vrf_and_check init 172.16.102.1/24 vrf102
0293
0294         # the strict_modle is enabled in the init
0295 }
0296
0297 vrf_strict_mode_tests_testns()
0298 {
0299         log_section "VRF strict_mode test on testns network namespace"
0300
0301         vrf_strict_mode_check_support testns
0302
0303         strict_mode_check_default testns
0304
0305         enable_strict_mode_and_check testns
0306
0307         add_vrf_and_check testns vrf100 100
0308         config_vrf_and_check testns 10.0.100.1/24 vrf100
0309
0310         add_vrf_and_check_fail testns vrf101 100
0311
0312         add_vrf_and_check_fail testns vrf102 100
0313
0314         add_vrf_and_check testns vrf200 200
0315
0316         disable_strict_mode_and_check testns
0317
0318         add_vrf_and_check testns vrf101 100
0319
0320         add_vrf_and_check testns vrf102 100
0321
0322         #the strict_mode is disabled in the testns
0323 }
0324
0325 vrf_strict_mode_tests_mix()
0326 {
0327         log_section "VRF strict_mode test mixing init and testns network namespaces"
0328
0329         read_strict_mode_compare_and_check init 1
0330
0331         read_strict_mode_compare_and_check testns 0
0332
0333         del_vrf_and_check testns vrf101
0334
0335         del_vrf_and_check testns vrf102
0336
0337         disable_strict_mode_and_check init
0338
0339         enable_strict_mode_and_check testns
0340
0341         enable_strict_mode_and_check init
0342         enable_strict_mode_and_check init
0343
0344         disable_strict_mode_and_check testns
0345         disable_strict_mode_and_check testns
0346
0347         read_strict_mode_compare_and_check init 1
0348
0349         read_strict_mode_compare_and_check testns 0
0350 }
0351
0352 ################################################################################
0353 # usage
0354
0355 usage()
0356 {
0357         cat <<EOF
0358 usage: ${0##*/} OPTS
0359
0360         -t <test>       Test(s) to run (default: all)
0361                         (options: $TESTS)
0362 EOF
0363 }
0364
0365 ################################################################################
0366 # main
0367
0368 while getopts ":t:h" opt; do
0369         case $opt in
0370                 t) TESTS=$OPTARG;;
0371                 h) usage; exit 0;;
0372                 *) usage; exit 1;;
0373         esac
0374 done
0375
0376 vrf_strict_mode_check_support()
0377 {
0378         local nsname=$1
0379         local output
0380         local rc
0381
0382         output="$(lsmod | grep '^vrf' | awk '{print $1}')"
0383         if [ -z "${output}" ]; then
0384                 modinfo vrf || return $?
0385         fi
0386
0387         # we do not care about the value of the strict_mode; we only check if
0388         # the strict_mode parameter is available or not.
0389         read_strict_mode ${nsname} &>/dev/null; rc=$?
0390         log_test ${rc} 0 "${nsname}: net.vrf.strict_mode is available"
0391
0392         return ${rc}
0393 }
0394
0395 if [ "$(id -u)" -ne 0 ];then
0396         echo "SKIP: Need root privileges"
0397         exit $ksft_skip
0398 fi
0399
0400 if [ ! -x "$(command -v ip)" ]; then
0401         echo "SKIP: Could not run test without ip tool"
0402         exit $ksft_skip
0403 fi
0404
0405 modprobe vrf &>/dev/null
0406 if [ ! -e /proc/sys/net/vrf/strict_mode ]; then
0407         echo "SKIP: vrf sysctl does not exist"
0408         exit $ksft_skip
0409 fi
0410
0411 cleanup &> /dev/null
0412
0413 setup
0414 for t in $TESTS
0415 do
0416         case $t in
0417         vrf_strict_mode_tests_init|init) vrf_strict_mode_tests_init;;
0418         vrf_strict_mode_tests_testns|testns) vrf_strict_mode_tests_testns;;
0419         vrf_strict_mode_tests_mix|mix) vrf_strict_mode_tests_mix;;
0420
0421         help) echo "Test names: $TESTS"; exit 0;;
0422
0423         esac
0424 done
0425 cleanup
0426
0427 print_log_test_results
0428
0429 exit $ret