selftests: Add ipv4 ping tests to fcnal-test

Add ping tests to fcnal-test.sh. Covers the permutations of directly
connected addresses, routed destinations, VRF and non-VRF, and expected
failures.

Setup includes unreachable routes and fib rules blocking traffic.

Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index 22cfbd2fd09c5967dc93c05e092cd90571003eaf..3f6e786b34aed520687ee782c889d1228af2740c 100755 (executable)
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -447,6 +447,270 @@ setup()
        sleep 1
 }
 
+################################################################################
+# IPv4
+
+ipv4_ping_novrf()
+{
+       local a
+
+       #
+       # out
+       #
+       for a in ${NSB_IP} ${NSB_LO_IP}
+       do
+               log_start
+               run_cmd ping -c1 -w1 ${a}
+               log_test_addr ${a} $? 0 "ping out"
+
+               log_start
+               run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+               log_test_addr ${a} $? 0 "ping out, device bind"
+
+               log_start
+               run_cmd ping -c1 -w1 -I ${NSA_LO_IP} ${a}
+               log_test_addr ${a} $? 0 "ping out, address bind"
+       done
+
+       #
+       # in
+       #
+       for a in ${NSA_IP} ${NSA_LO_IP}
+       do
+               log_start
+               run_cmd_nsb ping -c1 -w1 ${a}
+               log_test_addr ${a} $? 0 "ping in"
+       done
+
+       #
+       # local traffic
+       #
+       for a in ${NSA_IP} ${NSA_LO_IP} 127.0.0.1
+       do
+               log_start
+               run_cmd ping -c1 -w1 ${a}
+               log_test_addr ${a} $? 0 "ping local"
+       done
+
+       #
+       # local traffic, socket bound to device
+       #
+       # address on device
+       a=${NSA_IP}
+       log_start
+       run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+       log_test_addr ${a} $? 0 "ping local, device bind"
+
+       # loopback addresses not reachable from device bind
+       # fails in a really weird way though because ipv4 special cases
+       # route lookups with oif set.
+       for a in ${NSA_LO_IP} 127.0.0.1
+       do
+               log_start
+               show_hint "Fails since address on loopback device is out of device scope"
+               run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+               log_test_addr ${a} $? 1 "ping local, device bind"
+       done
+
+       #
+       # ip rule blocks reachability to remote address
+       #
+       log_start
+       setup_cmd ip rule add pref 32765 from all lookup local
+       setup_cmd ip rule del pref 0 from all lookup local
+       setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit
+       setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit
+
+       a=${NSB_LO_IP}
+       run_cmd ping -c1 -w1 ${a}
+       log_test_addr ${a} $? 2 "ping out, blocked by rule"
+
+       # NOTE: ipv4 actually allows the lookup to fail and yet still create
+       # a viable rtable if the oif (e.g., bind to device) is set, so this
+       # case succeeds despite the rule
+       # run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+
+       a=${NSA_LO_IP}
+       log_start
+       show_hint "Response generates ICMP (or arp request is ignored) due to ip rule"
+       run_cmd_nsb ping -c1 -w1 ${a}
+       log_test_addr ${a} $? 1 "ping in, blocked by rule"
+
+       [ "$VERBOSE" = "1" ] && echo
+       setup_cmd ip rule del pref 32765 from all lookup local
+       setup_cmd ip rule add pref 0 from all lookup local
+       setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit
+       setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit
+
+       #
+       # route blocks reachability to remote address
+       #
+       log_start
+       setup_cmd ip route replace unreachable ${NSB_LO_IP}
+       setup_cmd ip route replace unreachable ${NSB_IP}
+
+       a=${NSB_LO_IP}
+       run_cmd ping -c1 -w1 ${a}
+       log_test_addr ${a} $? 2 "ping out, blocked by route"
+
+       # NOTE: ipv4 actually allows the lookup to fail and yet still create
+       # a viable rtable if the oif (e.g., bind to device) is set, so this
+       # case succeeds despite not having a route for the address
+       # run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+
+       a=${NSA_LO_IP}
+       log_start
+       show_hint "Response is dropped (or arp request is ignored) due to ip route"
+       run_cmd_nsb ping -c1 -w1 ${a}
+       log_test_addr ${a} $? 1 "ping in, blocked by route"
+
+       #
+       # remove 'remote' routes; fallback to default
+       #
+       log_start
+       setup_cmd ip ro del ${NSB_LO_IP}
+
+       a=${NSB_LO_IP}
+       run_cmd ping -c1 -w1 ${a}
+       log_test_addr ${a} $? 2 "ping out, unreachable default route"
+
+       # NOTE: ipv4 actually allows the lookup to fail and yet still create
+       # a viable rtable if the oif (e.g., bind to device) is set, so this
+       # case succeeds despite not having a route for the address
+       # run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+}
+
+ipv4_ping_vrf()
+{
+       local a
+
+       # should default on; does not exist on older kernels
+       set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
+
+       #
+       # out
+       #
+       for a in ${NSB_IP} ${NSB_LO_IP}
+       do
+               log_start
+               run_cmd ping -c1 -w1 -I ${VRF} ${a}
+               log_test_addr ${a} $? 0 "ping out, VRF bind"
+
+               log_start
+               run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+               log_test_addr ${a} $? 0 "ping out, device bind"
+
+               log_start
+               run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${NSA_IP} ${a}
+               log_test_addr ${a} $? 0 "ping out, vrf device + dev address bind"
+
+               log_start
+               run_cmd ip vrf exec ${VRF} ping -c1 -w1 -I ${VRF_IP} ${a}
+               log_test_addr ${a} $? 0 "ping out, vrf device + vrf address bind"
+       done
+
+       #
+       # in
+       #
+       for a in ${NSA_IP} ${VRF_IP}
+       do
+               log_start
+               run_cmd_nsb ping -c1 -w1 ${a}
+               log_test_addr ${a} $? 0 "ping in"
+       done
+
+       #
+       # local traffic, local address
+       #
+       for a in ${NSA_IP} ${VRF_IP} 127.0.0.1
+       do
+               log_start
+               show_hint "Source address should be ${a}"
+               run_cmd ping -c1 -w1 -I ${VRF} ${a}
+               log_test_addr ${a} $? 0 "ping local, VRF bind"
+       done
+
+       #
+       # local traffic, socket bound to device
+       #
+       # address on device
+       a=${NSA_IP}
+       log_start
+       run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+       log_test_addr ${a} $? 0 "ping local, device bind"
+
+       # vrf device is out of scope
+       for a in ${VRF_IP} 127.0.0.1
+       do
+               log_start
+               show_hint "Fails since address on vrf device is out of device scope"
+               run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+               log_test_addr ${a} $? 1 "ping local, device bind"
+       done
+
+       #
+       # ip rule blocks address
+       #
+       log_start
+       setup_cmd ip rule add pref 50 to ${NSB_LO_IP} prohibit
+       setup_cmd ip rule add pref 51 from ${NSB_IP} prohibit
+
+       a=${NSB_LO_IP}
+       run_cmd ping -c1 -w1 -I ${VRF} ${a}
+       log_test_addr ${a} $? 2 "ping out, vrf bind, blocked by rule"
+
+       log_start
+       run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+       log_test_addr ${a} $? 2 "ping out, device bind, blocked by rule"
+
+       a=${NSA_LO_IP}
+       log_start
+       show_hint "Response lost due to ip rule"
+       run_cmd_nsb ping -c1 -w1 ${a}
+       log_test_addr ${a} $? 1 "ping in, blocked by rule"
+
+       [ "$VERBOSE" = "1" ] && echo
+       setup_cmd ip rule del pref 50 to ${NSB_LO_IP} prohibit
+       setup_cmd ip rule del pref 51 from ${NSB_IP} prohibit
+
+       #
+       # remove 'remote' routes; fallback to default
+       #
+       log_start
+       setup_cmd ip ro del vrf ${VRF} ${NSB_LO_IP}
+
+       a=${NSB_LO_IP}
+       run_cmd ping -c1 -w1 -I ${VRF} ${a}
+       log_test_addr ${a} $? 2 "ping out, vrf bind, unreachable route"
+
+       log_start
+       run_cmd ping -c1 -w1 -I ${NSA_DEV} ${a}
+       log_test_addr ${a} $? 2 "ping out, device bind, unreachable route"
+
+       a=${NSA_LO_IP}
+       log_start
+       show_hint "Response lost by unreachable route"
+       run_cmd_nsb ping -c1 -w1 ${a}
+       log_test_addr ${a} $? 1 "ping in, unreachable route"
+}
+
+ipv4_ping()
+{
+       log_section "IPv4 ping"
+
+       log_subsection "No VRF"
+       setup
+       set_sysctl net.ipv4.raw_l3mdev_accept=0 2>/dev/null
+       ipv4_ping_novrf
+       setup
+       set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
+       ipv4_ping_novrf
+
+       log_subsection "With VRF"
+       setup "yes"
+       ipv4_ping_vrf
+}
+
 ################################################################################
 # usage
 
@@ -467,7 +731,7 @@ EOF
 ################################################################################
 # main
 
-TESTS_IPV4=""
+TESTS_IPV4="ipv4_ping"
 TESTS_IPV6=""
 PAUSE_ON_FAIL=no
 PAUSE=no
@@ -506,6 +770,8 @@ declare -i nsuccess=0
 for t in $TESTS
 do
        case $t in
+       ipv4_ping|ping)  ipv4_ping;;
+
        # setup namespaces and config, but do not run any tests
        setup)           setup; exit 0;;
        vrf_setup)       setup "yes"; exit 0;;