2 # SPDX-License-Identifier: GPL-2.0
4 # return code to signal skipped test
7 # search for legacy iptables (it uses the xtables extensions
8 if iptables-legacy --version >/dev/null 2>&1; then
9 iptables='iptables-legacy'
10 elif iptables --version >/dev/null 2>&1; then
16 if ip6tables-legacy --version >/dev/null 2>&1; then
17 ip6tables='ip6tables-legacy'
18 elif ! ip6tables --version >/dev/null 2>&1; then
24 if nft --version >/dev/null 2>&1; then
30 if [ -z "$iptables$ip6tables$nft" ]; then
31 echo "SKIP: Test needs iptables, ip6tables or nft"
35 sfx=$(mktemp -u "XXXXXXXX")
38 trap "ip netns del $ns1; ip netns del $ns2" EXIT
40 # create two netns, disable rp_filter in ns2 and
41 # keep IPv6 address when moving into VRF
44 ip netns exec "$ns2" sysctl -q net.ipv4.conf.all.rp_filter=0
45 ip netns exec "$ns2" sysctl -q net.ipv4.conf.default.rp_filter=0
46 ip netns exec "$ns2" sysctl -q net.ipv6.conf.all.keep_addr_on_down=1
48 # a standard connection between the netns, should not trigger rp filter
49 ip -net "$ns1" link add v0 type veth peer name v0 netns "$ns2"
50 ip -net "$ns1" link set v0 up; ip -net "$ns2" link set v0 up
51 ip -net "$ns1" a a 192.168.23.2/24 dev v0
52 ip -net "$ns2" a a 192.168.23.1/24 dev v0
53 ip -net "$ns1" a a fec0:23::2/64 dev v0 nodad
54 ip -net "$ns2" a a fec0:23::1/64 dev v0 nodad
56 # rp filter testing: ns1 sends packets via v0 which ns2 would route back via d0
57 ip -net "$ns2" link add d0 type dummy
58 ip -net "$ns2" link set d0 up
59 ip -net "$ns1" a a 192.168.42.2/24 dev v0
60 ip -net "$ns2" a a 192.168.42.1/24 dev d0
61 ip -net "$ns1" a a fec0:42::2/64 dev v0 nodad
62 ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad
64 # firewall matches to test
65 ip netns exec "$ns2" "$iptables" -t raw -A PREROUTING -s 192.168.0.0/16 -m rpfilter
66 ip netns exec "$ns2" "$ip6tables" -t raw -A PREROUTING -s fec0::/16 -m rpfilter
67 ip netns exec "$ns2" nft -f - <<EOF
70 type filter hook prerouting priority raw;
71 ip saddr 192.168.0.0/16 fib saddr . iif oif exists counter
72 ip6 saddr fec0::/16 fib saddr . iif oif exists counter
79 #ip netns exec "$ns2" "$iptables" -t raw -vS
80 #ip netns exec "$ns2" "$ip6tables" -t raw -vS
81 #ip netns exec "$ns2" nft list ruleset
85 # check rule counters, return true if rule did not match
86 ipt_zero_rule() { # (command)
87 [ -n "$1" ] || return 0
88 ip netns exec "$ns2" "$1" -t raw -vS | grep -q -- "-m rpfilter -c 0 0"
90 nft_zero_rule() { # (family)
91 [ -n "$nft" ] || return 0
92 ip netns exec "$ns2" "$nft" list chain inet t c | \
93 grep -q "$1 saddr .* counter packets 0 bytes 0"
96 netns_ping() { # (netns, args...)
99 ip netns exec "$netns" ping -q -c 1 -W 1 "$@" >/dev/null
103 # clear counters first
104 [ -n "$iptables" ] && ip netns exec "$ns2" "$iptables" -t raw -Z
105 [ -n "$ip6tables" ] && ip netns exec "$ns2" "$ip6tables" -t raw -Z
106 if [ -n "$nft" ]; then
108 echo "delete table inet t";
109 ip netns exec "$ns2" nft -s list table inet t;
110 ) | ip netns exec "$ns2" nft -f -
113 # test 1: martian traffic should fail rpfilter matches
114 netns_ping "$ns1" -I v0 192.168.42.1 && \
115 die "martian ping 192.168.42.1 succeeded"
116 netns_ping "$ns1" -I v0 fec0:42::1 && \
117 die "martian ping fec0:42::1 succeeded"
119 ipt_zero_rule "$iptables" || die "iptables matched martian"
120 ipt_zero_rule "$ip6tables" || die "ip6tables matched martian"
121 nft_zero_rule ip || die "nft IPv4 matched martian"
122 nft_zero_rule ip6 || die "nft IPv6 matched martian"
124 # test 2: rpfilter match should pass for regular traffic
125 netns_ping "$ns1" 192.168.23.1 || \
126 die "regular ping 192.168.23.1 failed"
127 netns_ping "$ns1" fec0:23::1 || \
128 die "regular ping fec0:23::1 failed"
130 ipt_zero_rule "$iptables" && die "iptables match not effective"
131 ipt_zero_rule "$ip6tables" && die "ip6tables match not effective"
132 nft_zero_rule ip && die "nft IPv4 match not effective"
133 nft_zero_rule ip6 && die "nft IPv6 match not effective"
139 # repeat test with vrf device in $ns2
140 ip -net "$ns2" link add vrf0 type vrf table 10
141 ip -net "$ns2" link set vrf0 up
142 ip -net "$ns2" link set v0 master vrf0
146 echo "PASS: netfilter reverse path match works as intended"