selftests: Add ipv4 ping tests to fcnal-test
Add ping tests to fcnal-test.sh. Covers the permutations of directly connected addresses, routed destinations, VRF and non-VRF, and expected failures. Setup includes unreachable routes and fib rules blocking traffic. Signed-off-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David Ahern
David S. Miller
parent
6f9d5cacfe
commit
c032dd8cc7
1 changed files with 267 additions and 1 deletions
|
|
@ -447,6 +447,270 @@ setup()
|
|||
sleep 1
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IPv4
|
||||
|
||||
ipv4_ping_novrf()
|
||||
{
|
||||
local a
|
||||
|
||||
#
|
||||
# out
|
||||
#
|
||||
for a in ${NSB_IP} ${NSB_LO_IP}
|
||||
do
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 0 "ping out"
|
||||
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 0 "ping out, device bind"
|
||||
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${NSA_LO_IP} ${a}
|
||||
log_test_addr ${a} $? 0 "ping out, address bind"
|
||||
done
|
||||
|
||||
#
|
||||
# in
|
||||
#
|
||||
for a in ${NSA_IP} ${NSA_LO_IP}
|
||||
do
|
||||
log_start
|
||||
run_cmd_nsb ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 0 "ping in"
|
||||
done
|
||||
|
||||
#
|
||||
# local traffic
|
||||
#
|
||||
for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1
|
||||
do
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 0 "ping local"
|
||||
done
|
||||
|
||||
#
|
||||
# local traffic, socket bound to device
|
||||
#
|
||||
# address on device
|
||||
a=${NSA_IP}
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 0 "ping local, device bind"
|
||||
|
||||
# loopback addresses not reachable from device bind
|
||||
# fails in a really weird way though because ipv4 special cases
|
||||
# route lookups with oif set.
|
||||
for a in ${NSA_LO_IP} 127.0.0.1
|
||||
do
|
||||
log_start
|
||||
show_hint "Fails since address on loopback device is out of device scope"
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 1 "ping local, device bind"
|
||||
done
|
||||
|
||||
#
|
||||
# ip rule blocks reachability to remote address
|
||||
#
|
||||
log_start
|
||||
setup_cmd ip rule add pref 32765 from all lookup local
|
||||
setup_cmd ip rule del pref 0 from all lookup local
|
||||
setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit
|
||||
setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit
|
||||
|
||||
a=${NSB_LO_IP}
|
||||
run_cmd ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 2 "ping out, blocked by rule"
|
||||
|
||||
# NOTE: ipv4 actually allows the lookup to fail and yet still create
|
||||
# a viable rtable if the oif (e.g., bind to device) is set, so this
|
||||
# case succeeds despite the rule
|
||||
# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
|
||||
a=${NSA_LO_IP}
|
||||
log_start
|
||||
show_hint "Response generates ICMP (or arp request is ignored) due to ip rule"
|
||||
run_cmd_nsb ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 1 "ping in, blocked by rule"
|
||||
|
||||
[ "$VERBOSE" = "1" ] && echo
|
||||
setup_cmd ip rule del pref 32765 from all lookup local
|
||||
setup_cmd ip rule add pref 0 from all lookup local
|
||||
setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit
|
||||
setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit
|
||||
|
||||
#
|
||||
# route blocks reachability to remote address
|
||||
#
|
||||
log_start
|
||||
setup_cmd ip route replace unreachable ${NSB_LO_IP}
|
||||
setup_cmd ip route replace unreachable ${NSB_IP}
|
||||
|
||||
a=${NSB_LO_IP}
|
||||
run_cmd ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 2 "ping out, blocked by route"
|
||||
|
||||
# NOTE: ipv4 actually allows the lookup to fail and yet still create
|
||||
# a viable rtable if the oif (e.g., bind to device) is set, so this
|
||||
# case succeeds despite not having a route for the address
|
||||
# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
|
||||
a=${NSA_LO_IP}
|
||||
log_start
|
||||
show_hint "Response is dropped (or arp request is ignored) due to ip route"
|
||||
run_cmd_nsb ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 1 "ping in, blocked by route"
|
||||
|
||||
#
|
||||
# remove 'remote' routes; fallback to default
|
||||
#
|
||||
log_start
|
||||
setup_cmd ip ro del ${NSB_LO_IP}
|
||||
|
||||
a=${NSB_LO_IP}
|
||||
run_cmd ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 2 "ping out, unreachable default route"
|
||||
|
||||
# NOTE: ipv4 actually allows the lookup to fail and yet still create
|
||||
# a viable rtable if the oif (e.g., bind to device) is set, so this
|
||||
# case succeeds despite not having a route for the address
|
||||
# run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
}
|
||||
|
||||
ipv4_ping_vrf()
|
||||
{
|
||||
local a
|
||||
|
||||
# should default on; does not exist on older kernels
|
||||
set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
|
||||
|
||||
#
|
||||
# out
|
||||
#
|
||||
for a in ${NSB_IP} ${NSB_LO_IP}
|
||||
do
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${VRF} ${a}
|
||||
log_test_addr ${a} $? 0 "ping out, VRF bind"
|
||||
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 0 "ping out, device bind"
|
||||
|
||||
log_start
|
||||
run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${NSA_IP} ${a}
|
||||
log_test_addr ${a} $? 0 "ping out, vrf device + dev address bind"
|
||||
|
||||
log_start
|
||||
run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${VRF_IP} ${a}
|
||||
log_test_addr ${a} $? 0 "ping out, vrf device + vrf address bind"
|
||||
done
|
||||
|
||||
#
|
||||
# in
|
||||
#
|
||||
for a in ${NSA_IP} ${VRF_IP}
|
||||
do
|
||||
log_start
|
||||
run_cmd_nsb ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 0 "ping in"
|
||||
done
|
||||
|
||||
#
|
||||
# local traffic, local address
|
||||
#
|
||||
for a in ${NSA_IP} ${VRF_IP} 127.0.0.1
|
||||
do
|
||||
log_start
|
||||
show_hint "Source address should be ${a}"
|
||||
run_cmd ping -c1 -w1 -I ${VRF} ${a}
|
||||
log_test_addr ${a} $? 0 "ping local, VRF bind"
|
||||
done
|
||||
|
||||
#
|
||||
# local traffic, socket bound to device
|
||||
#
|
||||
# address on device
|
||||
a=${NSA_IP}
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 0 "ping local, device bind"
|
||||
|
||||
# vrf device is out of scope
|
||||
for a in ${VRF_IP} 127.0.0.1
|
||||
do
|
||||
log_start
|
||||
show_hint "Fails since address on vrf device is out of device scope"
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 1 "ping local, device bind"
|
||||
done
|
||||
|
||||
#
|
||||
# ip rule blocks address
|
||||
#
|
||||
log_start
|
||||
setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit
|
||||
setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit
|
||||
|
||||
a=${NSB_LO_IP}
|
||||
run_cmd ping -c1 -w1 -I ${VRF} ${a}
|
||||
log_test_addr ${a} $? 2 "ping out, vrf bind, blocked by rule"
|
||||
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"
|
||||
|
||||
a=${NSA_LO_IP}
|
||||
log_start
|
||||
show_hint "Response lost due to ip rule"
|
||||
run_cmd_nsb ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 1 "ping in, blocked by rule"
|
||||
|
||||
[ "$VERBOSE" = "1" ] && echo
|
||||
setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit
|
||||
setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit
|
||||
|
||||
#
|
||||
# remove 'remote' routes; fallback to default
|
||||
#
|
||||
log_start
|
||||
setup_cmd ip ro del vrf ${VRF} ${NSB_LO_IP}
|
||||
|
||||
a=${NSB_LO_IP}
|
||||
run_cmd ping -c1 -w1 -I ${VRF} ${a}
|
||||
log_test_addr ${a} $? 2 "ping out, vrf bind, unreachable route"
|
||||
|
||||
log_start
|
||||
run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
|
||||
log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"
|
||||
|
||||
a=${NSA_LO_IP}
|
||||
log_start
|
||||
show_hint "Response lost by unreachable route"
|
||||
run_cmd_nsb ping -c1 -w1 ${a}
|
||||
log_test_addr ${a} $? 1 "ping in, unreachable route"
|
||||
}
|
||||
|
||||
ipv4_ping()
|
||||
{
|
||||
log_section "IPv4 ping"
|
||||
|
||||
log_subsection "No VRF"
|
||||
setup
|
||||
set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null
|
||||
ipv4_ping_novrf
|
||||
setup
|
||||
set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
|
||||
ipv4_ping_novrf
|
||||
|
||||
log_subsection "With VRF"
|
||||
setup "yes"
|
||||
ipv4_ping_vrf
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# usage
|
||||
|
||||
|
|
@ -467,7 +731,7 @@ EOF
|
|||
################################################################################
|
||||
# main
|
||||
|
||||
TESTS_IPV4=""
|
||||
TESTS_IPV4="ipv4_ping"
|
||||
TESTS_IPV6=""
|
||||
PAUSE_ON_FAIL=no
|
||||
PAUSE=no
|
||||
|
|
@ -506,6 +770,8 @@ declare -i nsuccess=0
|
|||
for t in $TESTS
|
||||
do
|
||||
case $t in
|
||||
ipv4_ping|ping) ipv4_ping;;
|
||||
|
||||
# setup namespaces and config, but do not run any tests
|
||||
setup) setup; exit 0;;
|
||||
vrf_setup) setup "yes"; exit 0;;
|
||||
|
|
|
|||
Loading…
Reference in a new issue