2 # SPDX-License-Identifier: GPL-2.0
4 # This test is designed for testing the new VRF strict_mode functionality.
8 # identifies the "init" network namespace which is often called root network
10 INIT_NETNS_NAME="init"
12 PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
20 if [ ${rc} -eq ${expected} ]; then
21 nsuccess=$((nsuccess+1))
22 printf "\n TEST: %-60s [ OK ]\n" "${msg}"
26 printf "\n TEST: %-60s [FAIL]\n" "${msg}"
27 if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
29 echo "hit enter to continue, 'q' to quit"
31 [ "$a" = "q" ] && exit 1
36 print_log_test_results()
38 if [ "$TESTS" != "none" ]; then
39 printf "\nTests passed: %3d\n" ${nsuccess}
40 printf "Tests failed: %3d\n" ${nfail}
47 echo "################################################################################"
48 echo "TEST SECTION: $*"
49 echo "################################################################################"
57 if [ "${nsname}" != "${INIT_NETNS_NAME}" ]; then
58 nsarg="-netns ${nsname}"
67 local nsarg="$(ip_expand_args ${nsname})"
69 ip ${nsarg} -o link show type vrf | wc -l
72 count_vrf_by_table_id()
76 local nsarg="$(ip_expand_args ${nsname})"
78 ip ${nsarg} -d -o link show type vrf | grep "table ${tableid}" | wc -l
86 local nsarg="$(ip_expand_args ${nsname})"
88 ip ${nsarg} link add ${vrfname} type vrf table ${vrftable} &>/dev/null
99 add_vrf ${nsname} ${vrfname} ${vrftable}; rc=$?
101 cnt=$(count_vrf_by_table_id ${nsname} ${vrftable})
103 log_test ${rc} 0 "${nsname}: add vrf ${vrfname}, ${cnt} vrfs for table ${vrftable}"
106 add_vrf_and_check_fail()
114 add_vrf ${nsname} ${vrfname} ${vrftable}; rc=$?
116 cnt=$(count_vrf_by_table_id ${nsname} ${vrftable})
118 log_test ${rc} 2 "${nsname}: CANNOT add vrf ${vrfname}, ${cnt} vrfs for table ${vrftable}"
125 local nsarg="$(ip_expand_args ${nsname})"
127 ip ${nsarg} link del ${vrfname}
128 log_test $? 0 "${nsname}: remove vrf ${vrfname}"
131 config_vrf_and_check()
136 local nsarg="$(ip_expand_args ${nsname})"
138 ip ${nsarg} link set dev ${vrfname} up && \
139 ip ${nsarg} addr add ${addr} dev ${vrfname}
140 log_test $? 0 "${nsname}: vrf ${vrfname} up, addr ${addr}"
150 if [ "${nsname}" != "${INIT_NETNS_NAME}" ]; then
151 # a custom network namespace is provided
152 nsexec="ip netns exec ${nsname}"
155 rval="$(${nsexec} bash -c "cat /proc/sys/net/vrf/strict_mode" | \
156 grep -E "^[0-1]$")" &> /dev/null
157 if [ $? -ne 0 ]; then
163 # on success, rval can be only 0 or 1; on error, rval is equal to 255
168 read_strict_mode_compare_and_check()
174 res="$(read_strict_mode ${nsname})"
175 log_test ${res} ${expected} "${nsname}: check strict_mode=${res}"
184 if [ "${nsname}" != "${INIT_NETNS_NAME}" ]; then
185 # a custom network namespace is provided
186 nsexec="ip netns exec ${nsname}"
189 ${nsexec} bash -c "echo ${val} >/proc/sys/net/vrf/strict_mode" &>/dev/null
196 set_strict_mode ${nsname} 1
199 disable_strict_mode()
203 set_strict_mode ${nsname} 0
206 disable_strict_mode_and_check()
210 disable_strict_mode ${nsname}
211 log_test $? 0 "${nsname}: disable strict_mode (=0)"
214 enable_strict_mode_and_check()
218 enable_strict_mode ${nsname}
219 log_test $? 0 "${nsname}: enable strict_mode (=1)"
222 enable_strict_mode_and_check_fail()
226 enable_strict_mode ${nsname}
227 log_test $? 1 "${nsname}: CANNOT enable strict_mode"
230 strict_mode_check_default()
236 vrfcnt=$(vrf_count ${nsname})
237 strictmode=$(read_strict_mode ${nsname})
238 log_test ${strictmode} 0 "${nsname}: strict_mode=0 by default, ${vrfcnt} vrfs"
246 ip netns exec testns ip link set lo up
251 ip netns del testns 2>/dev/null
253 ip link del vrf100 2>/dev/null
254 ip link del vrf101 2>/dev/null
255 ip link del vrf102 2>/dev/null
257 echo 0 >/proc/sys/net/vrf/strict_mode 2>/dev/null
260 vrf_strict_mode_tests_init()
262 vrf_strict_mode_check_support init
264 strict_mode_check_default init
266 add_vrf_and_check init vrf100 100
267 config_vrf_and_check init 172.16.100.1/24 vrf100
269 enable_strict_mode_and_check init
271 add_vrf_and_check_fail init vrf101 100
273 disable_strict_mode_and_check init
275 add_vrf_and_check init vrf101 100
276 config_vrf_and_check init 172.16.101.1/24 vrf101
278 enable_strict_mode_and_check_fail init
280 del_vrf_and_check init vrf101
282 enable_strict_mode_and_check init
284 add_vrf_and_check init vrf102 102
285 config_vrf_and_check init 172.16.102.1/24 vrf102
287 # the strict_modle is enabled in the init
290 vrf_strict_mode_tests_testns()
292 vrf_strict_mode_check_support testns
294 strict_mode_check_default testns
296 enable_strict_mode_and_check testns
298 add_vrf_and_check testns vrf100 100
299 config_vrf_and_check testns 10.0.100.1/24 vrf100
301 add_vrf_and_check_fail testns vrf101 100
303 add_vrf_and_check_fail testns vrf102 100
305 add_vrf_and_check testns vrf200 200
307 disable_strict_mode_and_check testns
309 add_vrf_and_check testns vrf101 100
311 add_vrf_and_check testns vrf102 100
313 #the strict_mode is disabled in the testns
316 vrf_strict_mode_tests_mix()
318 read_strict_mode_compare_and_check init 1
320 read_strict_mode_compare_and_check testns 0
322 del_vrf_and_check testns vrf101
324 del_vrf_and_check testns vrf102
326 disable_strict_mode_and_check init
328 enable_strict_mode_and_check testns
330 enable_strict_mode_and_check init
331 enable_strict_mode_and_check init
333 disable_strict_mode_and_check testns
334 disable_strict_mode_and_check testns
336 read_strict_mode_compare_and_check init 1
338 read_strict_mode_compare_and_check testns 0
341 vrf_strict_mode_tests()
343 log_section "VRF strict_mode test on init network namespace"
344 vrf_strict_mode_tests_init
346 log_section "VRF strict_mode test on testns network namespace"
347 vrf_strict_mode_tests_testns
349 log_section "VRF strict_mode test mixing init and testns network namespaces"
350 vrf_strict_mode_tests_mix
353 vrf_strict_mode_check_support()
359 output="$(lsmod | grep '^vrf' | awk '{print $1}')"
360 if [ -z "${output}" ]; then
361 modinfo vrf || return $?
364 # we do not care about the value of the strict_mode; we only check if
365 # the strict_mode parameter is available or not.
366 read_strict_mode ${nsname} &>/dev/null; rc=$?
367 log_test ${rc} 0 "${nsname}: net.vrf.strict_mode is available"
372 if [ "$(id -u)" -ne 0 ];then
373 echo "SKIP: Need root privileges"
377 if [ ! -x "$(command -v ip)" ]; then
378 echo "SKIP: Could not run test without ip tool"
382 modprobe vrf &>/dev/null
383 if [ ! -e /proc/sys/net/vrf/strict_mode ]; then
384 echo "SKIP: vrf sysctl does not exist"
391 vrf_strict_mode_tests
394 print_log_test_results