#!/bin/bash # SPDX-License-Identifier: GPL-2.0 # return code to signal skipped test ksft_skip=4 # search for legacy iptables (it uses the xtables extensions if iptables-legacy --version >/dev/null 2>&1; then iptables='iptables-legacy' elif iptables --version >/dev/null 2>&1; then iptables='iptables' else iptables='' fi if ip6tables-legacy --version >/dev/null 2>&1; then ip6tables='ip6tables-legacy' elif ip6tables --version >/dev/null 2>&1; then ip6tables='ip6tables' else ip6tables='' fi if nft --version >/dev/null 2>&1; then nft='nft' else nft='' fi if [ -z "$iptables$ip6tables$nft" ]; then echo "SKIP: Test needs iptables, ip6tables or nft" exit $ksft_skip fi sfx=$(mktemp -u "XXXXXXXX") ns1="ns1-$sfx" ns2="ns2-$sfx" trap "ip netns del $ns1; ip netns del $ns2" EXIT # create two netns, disable rp_filter in ns2 and # keep IPv6 address when moving into VRF ip netns add "$ns1" ip netns add "$ns2" ip netns exec "$ns2" sysctl -q net.ipv4.conf.all.rp_filter=0 ip netns exec "$ns2" sysctl -q net.ipv4.conf.default.rp_filter=0 ip netns exec "$ns2" sysctl -q net.ipv6.conf.all.keep_addr_on_down=1 # a standard connection between the netns, should not trigger rp filter ip -net "$ns1" link add v0 type veth peer name v0 netns "$ns2" ip -net "$ns1" link set v0 up; ip -net "$ns2" link set v0 up ip -net "$ns1" a a 192.168.23.2/24 dev v0 ip -net "$ns2" a a 192.168.23.1/24 dev v0 ip -net "$ns1" a a fec0:23::2/64 dev v0 nodad ip -net "$ns2" a a fec0:23::1/64 dev v0 nodad # rp filter testing: ns1 sends packets via v0 which ns2 would route back via d0 ip -net "$ns2" link add d0 type dummy ip -net "$ns2" link set d0 up ip -net "$ns1" a a 192.168.42.2/24 dev v0 ip -net "$ns2" a a 192.168.42.1/24 dev d0 ip -net "$ns1" a a fec0:42::2/64 dev v0 nodad ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad # firewall matches to test [ -n "$iptables" ] && { common='-t raw -A PREROUTING -s 192.168.0.0/16' ip netns exec "$ns2" "$iptables" $common -m rpfilter ip netns exec "$ns2" "$iptables" $common -m rpfilter --invert } [ -n "$ip6tables" ] && { common='-t raw -A PREROUTING -s fec0::/16' ip netns exec "$ns2" "$ip6tables" $common -m rpfilter ip netns exec "$ns2" "$ip6tables" $common -m rpfilter --invert } [ -n "$nft" ] && ip netns exec "$ns2" $nft -f - </dev/null } clear_counters() { [ -n "$iptables" ] && ip netns exec "$ns2" "$iptables" -t raw -Z [ -n "$ip6tables" ] && ip netns exec "$ns2" "$ip6tables" -t raw -Z if [ -n "$nft" ]; then ( echo "delete table inet t"; ip netns exec "$ns2" $nft -s list table inet t; ) | ip netns exec "$ns2" $nft -f - fi } testrun() { clear_counters # test 1: martian traffic should fail rpfilter matches netns_ping "$ns1" -I v0 192.168.42.1 && \ die "martian ping 192.168.42.1 succeeded" netns_ping "$ns1" -I v0 fec0:42::1 && \ die "martian ping fec0:42::1 succeeded" ipt_zero_rule "$iptables" || die "iptables matched martian" ipt_zero_rule "$ip6tables" || die "ip6tables matched martian" ipt_zero_reverse_rule "$iptables" && die "iptables not matched martian" ipt_zero_reverse_rule "$ip6tables" && die "ip6tables not matched martian" nft_zero_rule ip || die "nft IPv4 matched martian" nft_zero_rule ip6 || die "nft IPv6 matched martian" clear_counters # test 2: rpfilter match should pass for regular traffic netns_ping "$ns1" 192.168.23.1 || \ die "regular ping 192.168.23.1 failed" netns_ping "$ns1" fec0:23::1 || \ die "regular ping fec0:23::1 failed" ipt_zero_rule "$iptables" && die "iptables match not effective" ipt_zero_rule "$ip6tables" && die "ip6tables match not effective" ipt_zero_reverse_rule "$iptables" || die "iptables match over-effective" ipt_zero_reverse_rule "$ip6tables" || die "ip6tables match over-effective" nft_zero_rule ip && die "nft IPv4 match not effective" nft_zero_rule ip6 && die "nft IPv6 match not effective" } testrun # repeat test with vrf device in $ns2 ip -net "$ns2" link add vrf0 type vrf table 10 ip -net "$ns2" link set vrf0 up ip -net "$ns2" link set v0 master vrf0 testrun echo "PASS: netfilter reverse path match works as intended" exit 0