[linux-2.6-block.git] / tools / testing / selftests / net / pmtu.sh

#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
#
# Check that route PMTU values match expectations, and that initial device MTU
# values are assigned correctly
#
# Tests currently implemented:
#
# - pmtu_vti4_exception
#	Set up vti tunnel on top of veth, with xfrm states and policies, in two
#	namespaces with matching endpoints. Check that route exception is not
#	created if link layer MTU is not exceeded, then exceed it and check that
#	exception is created with the expected PMTU. The approach described
#	below for IPv6 doesn't apply here, because, on IPv4, administrative MTU
#	changes alone won't affect PMTU
#
# - pmtu_vti6_exception
#	Set up vti6 tunnel on top of veth, with xfrm states and policies, in two
#	namespaces with matching endpoints. Check that route exception is
#	created by exceeding link layer MTU with ping to other endpoint. Then
#	decrease and increase MTU of tunnel, checking that route exception PMTU
#	changes accordingly
#
# - pmtu_vti4_default_mtu
#	Set up vti4 tunnel on top of veth, in two namespaces with matching
#	endpoints. Check that MTU assigned to vti interface is the MTU of the
#	lower layer (veth) minus additional lower layer headers (zero, for veth)
#	minus IPv4 header length
#
# - pmtu_vti6_default_mtu
#	Same as above, for IPv6
#
# - pmtu_vti4_link_add_mtu
#	Set up vti4 interface passing MTU value at link creation, check MTU is
#	configured, and that link is not created with invalid MTU values
#
# - pmtu_vti6_link_add_mtu
#	Same as above, for IPv6
#
# - pmtu_vti6_link_change_mtu
#	Set up two dummy interfaces with different MTUs, create a vti6 tunnel
#	and check that configured MTU is used on link creation and changes, and
#	that MTU is properly calculated instead when MTU is not configured from
#	userspace

# Kselftest framework requirement - SKIP code is 4.
ksft_skip=4

# Some systems don't have a ping6 binary anymore
which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)

tests="
	pmtu_vti6_exception		vti6: PMTU exceptions
	pmtu_vti4_exception		vti4: PMTU exceptions
	pmtu_vti4_default_mtu		vti4: default MTU assignment
	pmtu_vti6_default_mtu		vti6: default MTU assignment
	pmtu_vti4_link_add_mtu		vti4: MTU setting on link creation
	pmtu_vti6_link_add_mtu		vti6: MTU setting on link creation
	pmtu_vti6_link_change_mtu	vti6: MTU changes on link changes"

NS_A="ns-$(mktemp -u XXXXXX)"
NS_B="ns-$(mktemp -u XXXXXX)"
ns_a="ip netns exec ${NS_A}"
ns_b="ip netns exec ${NS_B}"

veth4_a_addr="192.168.1.1"
veth4_b_addr="192.168.1.2"
veth4_mask="24"
veth6_a_addr="fd00:1::a"
veth6_b_addr="fd00:1::b"
veth6_mask="64"

vti4_a_addr="192.168.2.1"
vti4_b_addr="192.168.2.2"
vti4_mask="24"
vti6_a_addr="fd00:2::a"
vti6_b_addr="fd00:2::b"
vti6_mask="64"

dummy6_0_addr="fc00:1000::0"
dummy6_1_addr="fc00:1001::0"
dummy6_mask="64"

cleanup_done=1
err_buf=

err() {
	err_buf="${err_buf}${1}
"
}

err_flush() {
	echo -n "${err_buf}"
	err_buf=
}

setup_namespaces() {
	ip netns add ${NS_A} || return 1
	ip netns add ${NS_B}
}

setup_veth() {
	${ns_a} ip link add veth_a type veth peer name veth_b || return 1
	${ns_a} ip link set veth_b netns ${NS_B}

	${ns_a} ip addr add ${veth4_a_addr}/${veth4_mask} dev veth_a
	${ns_b} ip addr add ${veth4_b_addr}/${veth4_mask} dev veth_b

	${ns_a} ip addr add ${veth6_a_addr}/${veth6_mask} dev veth_a
	${ns_b} ip addr add ${veth6_b_addr}/${veth6_mask} dev veth_b

	${ns_a} ip link set veth_a up
	${ns_b} ip link set veth_b up
}

setup_vti() {
	proto=${1}
	veth_a_addr="${2}"
	veth_b_addr="${3}"
	vti_a_addr="${4}"
	vti_b_addr="${5}"
	vti_mask=${6}

	[ ${proto} -eq 6 ] && vti_type="vti6" || vti_type="vti"

	${ns_a} ip link add vti${proto}_a type ${vti_type} local ${veth_a_addr} remote ${veth_b_addr} key 10 || return 1
	${ns_b} ip link add vti${proto}_b type ${vti_type} local ${veth_b_addr} remote ${veth_a_addr} key 10

	${ns_a} ip addr add ${vti_a_addr}/${vti_mask} dev vti${proto}_a
	${ns_b} ip addr add ${vti_b_addr}/${vti_mask} dev vti${proto}_b

	${ns_a} ip link set vti${proto}_a up
	${ns_b} ip link set vti${proto}_b up

	sleep 1
}

setup_vti4() {
	setup_vti 4 ${veth4_a_addr} ${veth4_b_addr} ${vti4_a_addr} ${vti4_b_addr} ${vti4_mask}
}

setup_vti6() {
	setup_vti 6 ${veth6_a_addr} ${veth6_b_addr} ${vti6_a_addr} ${vti6_b_addr} ${vti6_mask}
}

setup_xfrm() {
	proto=${1}
	veth_a_addr="${2}"
	veth_b_addr="${3}"

	${ns_a} ip -${proto} xfrm state add src ${veth_a_addr} dst ${veth_b_addr} spi 0x1000 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel || return 1
	${ns_a} ip -${proto} xfrm state add src ${veth_b_addr} dst ${veth_a_addr} spi 0x1001 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
	${ns_a} ip -${proto} xfrm policy add dir out mark 10 tmpl src ${veth_a_addr} dst ${veth_b_addr} proto esp mode tunnel
	${ns_a} ip -${proto} xfrm policy add dir in mark 10 tmpl src ${veth_b_addr} dst ${veth_a_addr} proto esp mode tunnel

	${ns_b} ip -${proto} xfrm state add src ${veth_a_addr} dst ${veth_b_addr} spi 0x1000 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
	${ns_b} ip -${proto} xfrm state add src ${veth_b_addr} dst ${veth_a_addr} spi 0x1001 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
	${ns_b} ip -${proto} xfrm policy add dir out mark 10 tmpl src ${veth_b_addr} dst ${veth_a_addr} proto esp mode tunnel
	${ns_b} ip -${proto} xfrm policy add dir in mark 10 tmpl src ${veth_a_addr} dst ${veth_b_addr} proto esp mode tunnel
}

setup_xfrm4() {
	setup_xfrm 4 ${veth4_a_addr} ${veth4_b_addr}
}

setup_xfrm6() {
	setup_xfrm 6 ${veth6_a_addr} ${veth6_b_addr}
}

setup() {
	[ "$(id -u)" -ne 0 ] && echo "  need to run as root" && return $ksft_skip

	cleanup_done=0
	for arg do
		eval setup_${arg} || { echo "  ${arg} not supported"; return 1; }
	done
}

cleanup() {
	[ ${cleanup_done} -eq 1 ] && return
	ip netns del ${NS_A} 2 > /dev/null
	ip netns del ${NS_B} 2 > /dev/null
	cleanup_done=1
}

mtu() {
	ns_cmd="${1}"
	dev="${2}"
	mtu="${3}"

	${ns_cmd} ip link set dev ${dev} mtu ${mtu}
}

mtu_parse() {
	input="${1}"

	next=0
	for i in ${input}; do
		[ ${next} -eq 1 ] && echo "${i}" && return
		[ "${i}" = "mtu" ] && next=1
	done
}

link_get() {
	ns_cmd="${1}"
	name="${2}"

	${ns_cmd} ip link show dev "${name}"
}

link_get_mtu() {
	ns_cmd="${1}"
	name="${2}"

	mtu_parse "$(link_get "${ns_cmd}" ${name})"
}

route_get_dst_exception() {
	ns_cmd="${1}"
	dst="${2}"

	${ns_cmd} ip route get "${dst}"
}

route_get_dst_pmtu_from_exception() {
	ns_cmd="${1}"
	dst="${2}"

	mtu_parse "$(route_get_dst_exception "${ns_cmd}" ${dst})"
}

test_pmtu_vti4_exception() {
	setup namespaces veth vti4 xfrm4 || return 2

	veth_mtu=1500
	vti_mtu=$((veth_mtu - 20))

	#                                SPI   SN   IV  ICV   pad length   next header
	esp_payload_rfc4106=$((vti_mtu - 4   - 4  - 8 - 16  - 1          - 1))
	ping_payload=$((esp_payload_rfc4106 - 28))

	mtu "${ns_a}" veth_a ${veth_mtu}
	mtu "${ns_b}" veth_b ${veth_mtu}
	mtu "${ns_a}" vti4_a ${vti_mtu}
	mtu "${ns_b}" vti4_b ${vti_mtu}

	# Send DF packet without exceeding link layer MTU, check that no
	# exception is created
	${ns_a} ping -q -M want -i 0.1 -w 2 -s ${ping_payload} ${vti4_b_addr} > /dev/null
	pmtu="$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti4_b_addr})"
	if [ "${pmtu}" != "" ]; then
		err "  unexpected exception created with PMTU ${pmtu} for IP payload length ${esp_payload_rfc4106}"
		return 1
	fi

	# Now exceed link layer MTU by one byte, check that exception is created
	${ns_a} ping -q -M want -i 0.1 -w 2 -s $((ping_payload + 1)) ${vti4_b_addr} > /dev/null
	pmtu="$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti4_b_addr})"
	if [ "${pmtu}" = "" ]; then
		err "  exception not created for IP payload length $((esp_payload_rfc4106 + 1))"
		return 1
	fi

	# ...with the right PMTU value
	if [ ${pmtu} -ne ${esp_payload_rfc4106} ]; then
		err "  wrong PMTU ${pmtu} in exception, expected: ${esp_payload_rfc4106}"
		return 1
	fi
}

test_pmtu_vti6_exception() {
	setup namespaces veth vti6 xfrm6 || return 2
	fail=0

	# Create route exception by exceeding link layer MTU
	mtu "${ns_a}" veth_a 4000
	mtu "${ns_b}" veth_b 4000
	mtu "${ns_a}" vti6_a 5000
	mtu "${ns_b}" vti6_b 5000
	${ns_a} ${ping6} -q -i 0.1 -w 2 -s 60000 ${vti6_b_addr} > /dev/null

	# Check that exception was created
	if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" = "" ]; then
		err "  tunnel exceeding link layer MTU didn't create route exception"
		return 1
	fi

	# Decrease tunnel MTU, check for PMTU decrease in route exception
	mtu "${ns_a}" vti6_a 3000

	if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" -ne 3000 ]; then
		err "  decreasing tunnel MTU didn't decrease route exception PMTU"
		fail=1
	fi

	# Increase tunnel MTU, check for PMTU increase in route exception
	mtu "${ns_a}" vti6_a 9000
	if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" -ne 9000 ]; then
		err "  increasing tunnel MTU didn't increase route exception PMTU"
		fail=1
	fi

	return ${fail}
}

test_pmtu_vti4_default_mtu() {
	setup namespaces veth vti4 || return 2

	# Check that MTU of vti device is MTU of veth minus IPv4 header length
	veth_mtu="$(link_get_mtu "${ns_a}" veth_a)"
	vti4_mtu="$(link_get_mtu "${ns_a}" vti4_a)"
	if [ $((veth_mtu - vti4_mtu)) -ne 20 ]; then
		err "  vti MTU ${vti4_mtu} is not veth MTU ${veth_mtu} minus IPv4 header length"
		return 1
	fi
}

test_pmtu_vti6_default_mtu() {
	setup namespaces veth vti6 || return 2

	# Check that MTU of vti device is MTU of veth minus IPv6 header length
	veth_mtu="$(link_get_mtu "${ns_a}" veth_a)"
	vti6_mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	if [ $((veth_mtu - vti6_mtu)) -ne 40 ]; then
		err "  vti MTU ${vti6_mtu} is not veth MTU ${veth_mtu} minus IPv6 header length"
		return 1
	fi
}

test_pmtu_vti4_link_add_mtu() {
	setup namespaces || return 2

	${ns_a} ip link add vti4_a type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10
	[ $? -ne 0 ] && err "  vti not supported" && return 2
	${ns_a} ip link del vti4_a

	fail=0

	min=68
	max=$((65535 - 20))
	# Check invalid values first
	for v in $((min - 1)) $((max + 1)); do
		${ns_a} ip link add vti4_a mtu ${v} type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10 2>/dev/null
		# This can fail, or MTU can be adjusted to a proper value
		[ $? -ne 0 ] && continue
		mtu="$(link_get_mtu "${ns_a}" vti4_a)"
		if [ ${mtu} -lt ${min} -o ${mtu} -gt ${max} ]; then
			err "  vti tunnel created with invalid MTU ${mtu}"
			fail=1
		fi
		${ns_a} ip link del vti4_a
	done

	# Now check valid values
	for v in ${min} 1300 ${max}; do
		${ns_a} ip link add vti4_a mtu ${v} type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10
		mtu="$(link_get_mtu "${ns_a}" vti4_a)"
		${ns_a} ip link del vti4_a
		if [ "${mtu}" != "${v}" ]; then
			err "  vti MTU ${mtu} doesn't match configured value ${v}"
			fail=1
		fi
	done

	return ${fail}
}

test_pmtu_vti6_link_add_mtu() {
	setup namespaces || return 2

	${ns_a} ip link add vti6_a type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10
	[ $? -ne 0 ] && err "  vti6 not supported" && return 2
	${ns_a} ip link del vti6_a

	fail=0

	min=68			# vti6 can carry IPv4 packets too
	max=$((65535 - 40))
	# Check invalid values first
	for v in $((min - 1)) $((max + 1)); do
		${ns_a} ip link add vti6_a mtu ${v} type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10 2>/dev/null
		# This can fail, or MTU can be adjusted to a proper value
		[ $? -ne 0 ] && continue
		mtu="$(link_get_mtu "${ns_a}" vti6_a)"
		if [ ${mtu} -lt ${min} -o ${mtu} -gt ${max} ]; then
			err "  vti6 tunnel created with invalid MTU ${v}"
			fail=1
		fi
		${ns_a} ip link del vti6_a
	done

	# Now check valid values
	for v in 68 1280 1300 $((65535 - 40)); do
		${ns_a} ip link add vti6_a mtu ${v} type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10
		mtu="$(link_get_mtu "${ns_a}" vti6_a)"
		${ns_a} ip link del vti6_a
		if [ "${mtu}" != "${v}" ]; then
			err "  vti6 MTU ${mtu} doesn't match configured value ${v}"
			fail=1
		fi
	done

	return ${fail}
}

test_pmtu_vti6_link_change_mtu() {
	setup namespaces || return 2

	${ns_a} ip link add dummy0 mtu 1500 type dummy
	[ $? -ne 0 ] && err "  dummy not supported" && return 2
	${ns_a} ip link add dummy1 mtu 3000 type dummy
	${ns_a} ip link set dummy0 up
	${ns_a} ip link set dummy1 up

	${ns_a} ip addr add ${dummy6_0_addr}/${dummy6_mask} dev dummy0
	${ns_a} ip addr add ${dummy6_1_addr}/${dummy6_mask} dev dummy1

	fail=0

	# Create vti6 interface bound to device, passing MTU, check it
	${ns_a} ip link add vti6_a mtu 1300 type vti6 remote ${dummy6_0_addr} local ${dummy6_0_addr}
	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	if [ ${mtu} -ne 1300 ]; then
		err "  vti6 MTU ${mtu} doesn't match configured value 1300"
		fail=1
	fi

	# Move to another device with different MTU, without passing MTU, check
	# MTU is adjusted
	${ns_a} ip link set vti6_a type vti6 remote ${dummy6_1_addr} local ${dummy6_1_addr}
	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	if [ ${mtu} -ne $((3000 - 40)) ]; then
		err "  vti MTU ${mtu} is not dummy MTU 3000 minus IPv6 header length"
		fail=1
	fi

	# Move it back, passing MTU, check MTU is not overridden
	${ns_a} ip link set vti6_a mtu 1280 type vti6 remote ${dummy6_0_addr} local ${dummy6_0_addr}
	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	if [ ${mtu} -ne 1280 ]; then
		err "  vti6 MTU ${mtu} doesn't match configured value 1280"
		fail=1
	fi

	return ${fail}
}

trap cleanup EXIT

exitcode=0
desc=0
IFS="	
"
for t in ${tests}; do
	[ $desc -eq 0 ] && name="${t}" && desc=1 && continue || desc=0

	(
		unset IFS
		eval test_${name}
		ret=$?
		cleanup

		if [ $ret -eq 0 ]; then
			printf "TEST: %-60s  [ OK ]\n" "${t}"
		elif [ $ret -eq 1 ]; then
			printf "TEST: %-60s  [FAIL]\n" "${t}"
			err_flush
			exit 1
		elif [ $ret -eq 2 ]; then
			printf "TEST: %-60s  [SKIP]\n" "${t}"
			err_flush
		fi
	)
	[ $? -ne 0 ] && exitcode=1
done

exit ${exitcode}
Commit	Line	Data
d1f1b9cb SB	1	#!/bin/sh
	2	# SPDX-License-Identifier: GPL-2.0
	3	#
a41c789b SB	4	# Check that route PMTU values match expectations, and that initial device MTU
a41c789b SB	5	# values are assigned correctly
d1f1b9cb SB	6	#
	7	# Tests currently implemented:
	8	#
5e84430b SB	9	# - pmtu_vti4_exception
	10	# Set up vti tunnel on top of veth, with xfrm states and policies, in two
	11	# namespaces with matching endpoints. Check that route exception is not
	12	# created if link layer MTU is not exceeded, then exceed it and check that
	13	# exception is created with the expected PMTU. The approach described
	14	# below for IPv6 doesn't apply here, because, on IPv4, administrative MTU
	15	# changes alone won't affect PMTU
	16	#
36455bd1	17	# - pmtu_vti6_exception
d1f1b9cb SB	18	# Set up vti6 tunnel on top of veth, with xfrm states and policies, in two
	19	# namespaces with matching endpoints. Check that route exception is
	20	# created by exceeding link layer MTU with ping to other endpoint. Then
	21	# decrease and increase MTU of tunnel, checking that route exception PMTU
	22	# changes accordingly
a41c789b SB	23	#
	24	# - pmtu_vti4_default_mtu
	25	# Set up vti4 tunnel on top of veth, in two namespaces with matching
	26	# endpoints. Check that MTU assigned to vti interface is the MTU of the
	27	# lower layer (veth) minus additional lower layer headers (zero, for veth)
	28	# minus IPv4 header length
35b49424 SB	29	#
	30	# - pmtu_vti6_default_mtu
	31	# Same as above, for IPv6
719e1215 SB	32	#
	33	# - pmtu_vti4_link_add_mtu
	34	# Set up vti4 interface passing MTU value at link creation, check MTU is
	35	# configured, and that link is not created with invalid MTU values
8b6022fc SB	36	#
	37	# - pmtu_vti6_link_add_mtu
	38	# Same as above, for IPv6
1fad59ea SB	39	#
	40	# - pmtu_vti6_link_change_mtu
	41	# Set up two dummy interfaces with different MTUs, create a vti6 tunnel
	42	# and check that configured MTU is used on link creation and changes, and
	43	# that MTU is properly calculated instead when MTU is not configured from
	44	# userspace
d1f1b9cb	45
57aefc7c SKSO	46	# Kselftest framework requirement - SKIP code is 4.
	47	ksft_skip=4
	48
c81c7012 SD	49	# Some systems don't have a ping6 binary anymore
	50	which ping6 > /dev/null 2>&1 && ping6=$(which ping6) \|\| ping6=$(which ping)
	51
36455bd1	52	tests="
1fad59ea SB	53	pmtu_vti6_exception vti6: PMTU exceptions
	54	pmtu_vti4_exception vti4: PMTU exceptions
	55	pmtu_vti4_default_mtu vti4: default MTU assignment
	56	pmtu_vti6_default_mtu vti6: default MTU assignment
	57	pmtu_vti4_link_add_mtu vti4: MTU setting on link creation
	58	pmtu_vti6_link_add_mtu vti6: MTU setting on link creation
	59	pmtu_vti6_link_change_mtu vti6: MTU changes on link changes"
36455bd1	60
d1f1b9cb SB	61	NS_A="ns-$(mktemp -u XXXXXX)"
	62	NS_B="ns-$(mktemp -u XXXXXX)"
	63	ns_a="ip netns exec ${NS_A}"
	64	ns_b="ip netns exec ${NS_B}"
	65
a41c789b SB	66	veth4_a_addr="192.168.1.1"
	67	veth4_b_addr="192.168.1.2"
	68	veth4_mask="24"
d1f1b9cb SB	69	veth6_a_addr="fd00:1::a"
	70	veth6_b_addr="fd00:1::b"
	71	veth6_mask="64"
	72
a41c789b SB	73	vti4_a_addr="192.168.2.1"
	74	vti4_b_addr="192.168.2.2"
	75	vti4_mask="24"
d1f1b9cb SB	76	vti6_a_addr="fd00:2::a"
	77	vti6_b_addr="fd00:2::b"
	78	vti6_mask="64"
	79
1fad59ea SB	80	dummy6_0_addr="fc00:1000::0"
	81	dummy6_1_addr="fc00:1001::0"
	82	dummy6_mask="64"
	83
36455bd1 SB	84	cleanup_done=1
	85	err_buf=
	86
	87	err() {
	88	err_buf="${err_buf}${1}
	89	"
	90	}
	91
	92	err_flush() {
	93	echo -n "${err_buf}"
	94	err_buf=
	95	}
	96
d1f1b9cb	97	setup_namespaces() {
380e29a6	98	ip netns add ${NS_A} \|\| return 1
d1f1b9cb	99	ip netns add ${NS_B}
d1f1b9cb SB	100	}
	101
	102	setup_veth() {
380e29a6	103	${ns_a} ip link add veth_a type veth peer name veth_b \|\| return 1
d1f1b9cb SB	104	${ns_a} ip link set veth_b netns ${NS_B}
d1f1b9cb SB	105
a41c789b SB	106	${ns_a} ip addr add ${veth4_a_addr}/${veth4_mask} dev veth_a
	107	${ns_b} ip addr add ${veth4_b_addr}/${veth4_mask} dev veth_b
	108
d1f1b9cb SB	109	${ns_a} ip addr add ${veth6_a_addr}/${veth6_mask} dev veth_a
	110	${ns_b} ip addr add ${veth6_b_addr}/${veth6_mask} dev veth_b
	111
	112	${ns_a} ip link set veth_a up
	113	${ns_b} ip link set veth_b up
d1f1b9cb SB	114	}
d1f1b9cb SB	115
a41c789b SB	116	setup_vti() {
	117	proto=${1}
	118	veth_a_addr="${2}"
	119	veth_b_addr="${3}"
	120	vti_a_addr="${4}"
	121	vti_b_addr="${5}"
	122	vti_mask=${6}
d1f1b9cb	123
a41c789b	124	[ ${proto} -eq 6 ] && vti_type="vti6" \|\| vti_type="vti"
d1f1b9cb	125
a41c789b SB	126	${ns_a} ip link add vti${proto}_a type ${vti_type} local ${veth_a_addr} remote ${veth_b_addr} key 10 \|\| return 1
	127	${ns_b} ip link add vti${proto}_b type ${vti_type} local ${veth_b_addr} remote ${veth_a_addr} key 10
	128
	129	${ns_a} ip addr add ${vti_a_addr}/${vti_mask} dev vti${proto}_a
	130	${ns_b} ip addr add ${vti_b_addr}/${vti_mask} dev vti${proto}_b
	131
	132	${ns_a} ip link set vti${proto}_a up
	133	${ns_b} ip link set vti${proto}_b up
d1f1b9cb SB	134
d1f1b9cb SB	135	sleep 1
d1f1b9cb SB	136	}
d1f1b9cb SB	137
a41c789b SB	138	setup_vti4() {
	139	setup_vti 4 ${veth4_a_addr} ${veth4_b_addr} ${vti4_a_addr} ${vti4_b_addr} ${vti4_mask}
	140	}
	141
	142	setup_vti6() {
	143	setup_vti 6 ${veth6_a_addr} ${veth6_b_addr} ${vti6_a_addr} ${vti6_b_addr} ${vti6_mask}
	144	}
	145
d1f1b9cb	146	setup_xfrm() {
5e84430b SB	147	proto=${1}
	148	veth_a_addr="${2}"
	149	veth_b_addr="${3}"
	150
	151	${ns_a} ip -${proto} xfrm state add src ${veth_a_addr} dst ${veth_b_addr} spi 0x1000 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel \|\| return 1
	152	${ns_a} ip -${proto} xfrm state add src ${veth_b_addr} dst ${veth_a_addr} spi 0x1001 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
	153	${ns_a} ip -${proto} xfrm policy add dir out mark 10 tmpl src ${veth_a_addr} dst ${veth_b_addr} proto esp mode tunnel
	154	${ns_a} ip -${proto} xfrm policy add dir in mark 10 tmpl src ${veth_b_addr} dst ${veth_a_addr} proto esp mode tunnel
	155
	156	${ns_b} ip -${proto} xfrm state add src ${veth_a_addr} dst ${veth_b_addr} spi 0x1000 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
	157	${ns_b} ip -${proto} xfrm state add src ${veth_b_addr} dst ${veth_a_addr} spi 0x1001 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
	158	${ns_b} ip -${proto} xfrm policy add dir out mark 10 tmpl src ${veth_b_addr} dst ${veth_a_addr} proto esp mode tunnel
	159	${ns_b} ip -${proto} xfrm policy add dir in mark 10 tmpl src ${veth_a_addr} dst ${veth_b_addr} proto esp mode tunnel
	160	}
	161
	162	setup_xfrm4() {
	163	setup_xfrm 4 ${veth4_a_addr} ${veth4_b_addr}
	164	}
d1f1b9cb	165
5e84430b SB	166	setup_xfrm6() {
5e84430b SB	167	setup_xfrm 6 ${veth6_a_addr} ${veth6_b_addr}
d1f1b9cb SB	168	}
	169
	170	setup() {
57aefc7c	171	[ "$(id -u)" -ne 0 ] && echo " need to run as root" && return $ksft_skip
d1f1b9cb	172
36455bd1 SB	173	cleanup_done=0
	174	for arg do
	175	eval setup_${arg} \|\| { echo " ${arg} not supported"; return 1; }
	176	done
d1f1b9cb SB	177	}
	178
	179	cleanup() {
36455bd1	180	[ ${cleanup_done} -eq 1 ] && return
d1f1b9cb SB	181	ip netns del ${NS_A} 2 > /dev/null
d1f1b9cb SB	182	ip netns del ${NS_B} 2 > /dev/null
36455bd1	183	cleanup_done=1
d1f1b9cb SB	184	}
	185
	186	mtu() {
	187	ns_cmd="${1}"
	188	dev="${2}"
	189	mtu="${3}"
	190
	191	${ns_cmd} ip link set dev ${dev} mtu ${mtu}
	192	}
	193
f2c929fe SB	194	mtu_parse() {
	195	input="${1}"
	196
	197	next=0
	198	for i in ${input}; do
	199	[ ${next} -eq 1 ] && echo "${i}" && return
	200	[ "${i}" = "mtu" ] && next=1
	201	done
	202	}
	203
a41c789b SB	204	link_get() {
	205	ns_cmd="${1}"
	206	name="${2}"
	207
	208	${ns_cmd} ip link show dev "${name}"
	209	}
	210
	211	link_get_mtu() {
	212	ns_cmd="${1}"
	213	name="${2}"
	214
	215	mtu_parse "$(link_get "${ns_cmd}" ${name})"
	216	}
	217
d1f1b9cb	218	route_get_dst_exception() {
822d2f86 SB	219	ns_cmd="${1}"
822d2f86 SB	220	dst="${2}"
d1f1b9cb	221
822d2f86	222	${ns_cmd} ip route get "${dst}"
d1f1b9cb SB	223	}
	224
	225	route_get_dst_pmtu_from_exception() {
822d2f86 SB	226	ns_cmd="${1}"
822d2f86 SB	227	dst="${2}"
d1f1b9cb	228
f2c929fe	229	mtu_parse "$(route_get_dst_exception "${ns_cmd}" ${dst})"
d1f1b9cb SB	230	}
d1f1b9cb SB	231
5e84430b SB	232	test_pmtu_vti4_exception() {
	233	setup namespaces veth vti4 xfrm4 \|\| return 2
	234
	235	veth_mtu=1500
	236	vti_mtu=$((veth_mtu - 20))
	237
	238	# SPI SN IV ICV pad length next header
	239	esp_payload_rfc4106=$((vti_mtu - 4 - 4 - 8 - 16 - 1 - 1))
	240	ping_payload=$((esp_payload_rfc4106 - 28))
	241
	242	mtu "${ns_a}" veth_a ${veth_mtu}
	243	mtu "${ns_b}" veth_b ${veth_mtu}
	244	mtu "${ns_a}" vti4_a ${vti_mtu}
	245	mtu "${ns_b}" vti4_b ${vti_mtu}
	246
	247	# Send DF packet without exceeding link layer MTU, check that no
	248	# exception is created
	249	${ns_a} ping -q -M want -i 0.1 -w 2 -s ${ping_payload} ${vti4_b_addr} > /dev/null
	250	pmtu="$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti4_b_addr})"
	251	if [ "${pmtu}" != "" ]; then
	252	err " unexpected exception created with PMTU ${pmtu} for IP payload length ${esp_payload_rfc4106}"
	253	return 1
	254	fi
	255
	256	# Now exceed link layer MTU by one byte, check that exception is created
	257	${ns_a} ping -q -M want -i 0.1 -w 2 -s $((ping_payload + 1)) ${vti4_b_addr} > /dev/null
	258	pmtu="$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti4_b_addr})"
	259	if [ "${pmtu}" = "" ]; then
	260	err " exception not created for IP payload length $((esp_payload_rfc4106 + 1))"
	261	return 1
	262	fi
	263
	264	# ...with the right PMTU value
	265	if [ ${pmtu} -ne ${esp_payload_rfc4106} ]; then
	266	err " wrong PMTU ${pmtu} in exception, expected: ${esp_payload_rfc4106}"
	267	return 1
	268	fi
	269	}
	270
d1f1b9cb	271	test_pmtu_vti6_exception() {
5e84430b	272	setup namespaces veth vti6 xfrm6 \|\| return 2
36455bd1	273	fail=0
d1f1b9cb SB	274
	275	# Create route exception by exceeding link layer MTU
	276	mtu "${ns_a}" veth_a 4000
	277	mtu "${ns_b}" veth_b 4000
a41c789b SB	278	mtu "${ns_a}" vti6_a 5000
a41c789b SB	279	mtu "${ns_b}" vti6_b 5000
c81c7012	280	${ns_a} ${ping6} -q -i 0.1 -w 2 -s 60000 ${vti6_b_addr} > /dev/null
d1f1b9cb SB	281
d1f1b9cb SB	282	# Check that exception was created
822d2f86	283	if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" = "" ]; then
36455bd1 SB	284	err " tunnel exceeding link layer MTU didn't create route exception"
36455bd1 SB	285	return 1
d1f1b9cb SB	286	fi
	287
	288	# Decrease tunnel MTU, check for PMTU decrease in route exception
a41c789b	289	mtu "${ns_a}" vti6_a 3000
d1f1b9cb	290
822d2f86	291	if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" -ne 3000 ]; then
36455bd1 SB	292	err " decreasing tunnel MTU didn't decrease route exception PMTU"
36455bd1 SB	293	fail=1
d1f1b9cb SB	294	fi
	295
	296	# Increase tunnel MTU, check for PMTU increase in route exception
a41c789b	297	mtu "${ns_a}" vti6_a 9000
822d2f86	298	if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" -ne 9000 ]; then
36455bd1 SB	299	err " increasing tunnel MTU didn't increase route exception PMTU"
36455bd1 SB	300	fail=1
d1f1b9cb SB	301	fi
d1f1b9cb SB	302
36455bd1	303	return ${fail}
d1f1b9cb SB	304	}
d1f1b9cb SB	305
a41c789b SB	306	test_pmtu_vti4_default_mtu() {
	307	setup namespaces veth vti4 \|\| return 2
	308
	309	# Check that MTU of vti device is MTU of veth minus IPv4 header length
	310	veth_mtu="$(link_get_mtu "${ns_a}" veth_a)"
	311	vti4_mtu="$(link_get_mtu "${ns_a}" vti4_a)"
	312	if [ $((veth_mtu - vti4_mtu)) -ne 20 ]; then
	313	err " vti MTU ${vti4_mtu} is not veth MTU ${veth_mtu} minus IPv4 header length"
	314	return 1
	315	fi
	316	}
	317
35b49424 SB	318	test_pmtu_vti6_default_mtu() {
	319	setup namespaces veth vti6 \|\| return 2
	320
	321	# Check that MTU of vti device is MTU of veth minus IPv6 header length
	322	veth_mtu="$(link_get_mtu "${ns_a}" veth_a)"
	323	vti6_mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	324	if [ $((veth_mtu - vti6_mtu)) -ne 40 ]; then
	325	err " vti MTU ${vti6_mtu} is not veth MTU ${veth_mtu} minus IPv6 header length"
	326	return 1
	327	fi
	328	}
	329
719e1215 SB	330	test_pmtu_vti4_link_add_mtu() {
	331	setup namespaces \|\| return 2
	332
	333	${ns_a} ip link add vti4_a type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10
	334	[ $? -ne 0 ] && err " vti not supported" && return 2
	335	${ns_a} ip link del vti4_a
	336
	337	fail=0
	338
	339	min=68
902b5417	340	max=$((65535 - 20))
719e1215 SB	341	# Check invalid values first
	342	for v in $((min - 1)) $((max + 1)); do
	343	${ns_a} ip link add vti4_a mtu ${v} type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10 2>/dev/null
	344	# This can fail, or MTU can be adjusted to a proper value
	345	[ $? -ne 0 ] && continue
	346	mtu="$(link_get_mtu "${ns_a}" vti4_a)"
	347	if [ ${mtu} -lt ${min} -o ${mtu} -gt ${max} ]; then
	348	err " vti tunnel created with invalid MTU ${mtu}"
	349	fail=1
	350	fi
	351	${ns_a} ip link del vti4_a
	352	done
	353
	354	# Now check valid values
	355	for v in ${min} 1300 ${max}; do
	356	${ns_a} ip link add vti4_a mtu ${v} type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10
	357	mtu="$(link_get_mtu "${ns_a}" vti4_a)"
	358	${ns_a} ip link del vti4_a
	359	if [ "${mtu}" != "${v}" ]; then
	360	err " vti MTU ${mtu} doesn't match configured value ${v}"
	361	fail=1
	362	fi
	363	done
	364
	365	return ${fail}
	366	}
	367
8b6022fc SB	368	test_pmtu_vti6_link_add_mtu() {
	369	setup namespaces \|\| return 2
	370
	371	${ns_a} ip link add vti6_a type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10
	372	[ $? -ne 0 ] && err " vti6 not supported" && return 2
	373	${ns_a} ip link del vti6_a
	374
	375	fail=0
	376
5a643c86	377	min=68 # vti6 can carry IPv4 packets too
8b6022fc SB	378	max=$((65535 - 40))
	379	# Check invalid values first
	380	for v in $((min - 1)) $((max + 1)); do
	381	${ns_a} ip link add vti6_a mtu ${v} type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10 2>/dev/null
	382	# This can fail, or MTU can be adjusted to a proper value
	383	[ $? -ne 0 ] && continue
	384	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	385	if [ ${mtu} -lt ${min} -o ${mtu} -gt ${max} ]; then
	386	err " vti6 tunnel created with invalid MTU ${v}"
	387	fail=1
	388	fi
	389	${ns_a} ip link del vti6_a
	390	done
	391
	392	# Now check valid values
5a643c86	393	for v in 68 1280 1300 $((65535 - 40)); do
8b6022fc SB	394	${ns_a} ip link add vti6_a mtu ${v} type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10
	395	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	396	${ns_a} ip link del vti6_a
	397	if [ "${mtu}" != "${v}" ]; then
	398	err " vti6 MTU ${mtu} doesn't match configured value ${v}"
	399	fail=1
	400	fi
	401	done
	402
	403	return ${fail}
	404	}
	405
1fad59ea SB	406	test_pmtu_vti6_link_change_mtu() {
	407	setup namespaces \|\| return 2
	408
	409	${ns_a} ip link add dummy0 mtu 1500 type dummy
	410	[ $? -ne 0 ] && err " dummy not supported" && return 2
	411	${ns_a} ip link add dummy1 mtu 3000 type dummy
	412	${ns_a} ip link set dummy0 up
	413	${ns_a} ip link set dummy1 up
	414
	415	${ns_a} ip addr add ${dummy6_0_addr}/${dummy6_mask} dev dummy0
	416	${ns_a} ip addr add ${dummy6_1_addr}/${dummy6_mask} dev dummy1
	417
	418	fail=0
	419
	420	# Create vti6 interface bound to device, passing MTU, check it
	421	${ns_a} ip link add vti6_a mtu 1300 type vti6 remote ${dummy6_0_addr} local ${dummy6_0_addr}
	422	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	423	if [ ${mtu} -ne 1300 ]; then
	424	err " vti6 MTU ${mtu} doesn't match configured value 1300"
	425	fail=1
	426	fi
	427
	428	# Move to another device with different MTU, without passing MTU, check
	429	# MTU is adjusted
1fad59ea SB	430	${ns_a} ip link set vti6_a type vti6 remote ${dummy6_1_addr} local ${dummy6_1_addr}
	431	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	432	if [ ${mtu} -ne $((3000 - 40)) ]; then
	433	err " vti MTU ${mtu} is not dummy MTU 3000 minus IPv6 header length"
	434	fail=1
	435	fi
	436
	437	# Move it back, passing MTU, check MTU is not overridden
1fad59ea SB	438	${ns_a} ip link set vti6_a mtu 1280 type vti6 remote ${dummy6_0_addr} local ${dummy6_0_addr}
	439	mtu="$(link_get_mtu "${ns_a}" vti6_a)"
	440	if [ ${mtu} -ne 1280 ]; then
	441	err " vti6 MTU ${mtu} doesn't match configured value 1280"
	442	fail=1
	443	fi
	444
	445	return ${fail}
	446	}
	447
d1f1b9cb SB	448	trap cleanup EXIT
d1f1b9cb SB	449
36455bd1 SB	450	exitcode=0
	451	desc=0
	452	IFS="
	453	"
	454	for t in ${tests}; do
	455	[ $desc -eq 0 ] && name="${t}" && desc=1 && continue \|\| desc=0
	456
	457	(
	458	unset IFS
	459	eval test_${name}
	460	ret=$?
	461	cleanup
	462
	463	if [ $ret -eq 0 ]; then
	464	printf "TEST: %-60s [ OK ]\n" "${t}"
	465	elif [ $ret -eq 1 ]; then
	466	printf "TEST: %-60s [FAIL]\n" "${t}"
	467	err_flush
	468	exit 1
	469	elif [ $ret -eq 2 ]; then
	470	printf "TEST: %-60s [SKIP]\n" "${t}"
	471	err_flush
	472	fi
	473	)
	474	[ $? -ne 0 ] && exitcode=1
	475	done
	476
	477	exit ${exitcode}