tools/testing/selftests/net/srv6_hl2encap_red_l2vpn_test.sh - linux - Git at Google

 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 #
 # author: Andrea Mayer <andrea.mayer@uniroma2.it>
 #
 # This script is designed for testing the SRv6 H.L2Encaps.Red behavior.
 #
 # Below is depicted the IPv6 network of an operator which offers L2 VPN
 # services to hosts, enabling them to communicate with each other.
 # In this example, hosts hs-1 and hs-2 are connected through an L2 VPN service.
 # Currently, the SRv6 subsystem in Linux allows hosts hs-1 and hs-2 to exchange
 # full L2 frames as long as they carry IPv4/IPv6.
 #
 # Routers rt-1,rt-2,rt-3 and rt-4 implement L2 VPN services
 # leveraging the SRv6 architecture. The key components for such VPNs are:
 #
 #   i) The SRv6 H.L2Encaps.Red behavior applies SRv6 Policies on traffic
 #      received by connected hosts, initiating the VPN tunnel. Such a behavior
 #      is an optimization of the SRv6 H.L2Encap aiming to reduce the
 #      length of the SID List carried in the pushed SRH. Specifically, the
 #      H.L2Encaps.Red removes the first SID contained in the SID List (i.e. SRv6
 #      Policy) by storing it into the IPv6 Destination Address. When a SRv6
 #      Policy is made of only one SID, the SRv6 H.L2Encaps.Red behavior omits
 #      the SRH at all and pushes that SID directly into the IPv6 DA;
 #
 #  ii) The SRv6 End behavior advances the active SID in the SID List
 #      carried by the SRH;
 #
 # iii) The SRv6 End.DX2 behavior is used for removing the SRv6 Policy
 #      and, thus, it terminates the VPN tunnel. The decapsulated L2 frame is
 #      sent over the interface connected with the destination host.
 #
 #               cafe::1                      cafe::2
 #              10.0.0.1                     10.0.0.2
 #             +--------+                   +--------+
 #             |        |                   |        |
 #             |  hs-1  |                   |  hs-2  |
 #             |        |                   |        |
 #             +---+----+                   +--- +---+
 #    cafe::/64    |                             |      cafe::/64
 #  10.0.0.0/24    |                             |    10.0.0.0/24
 #             +---+----+                   +----+---+
 #             |        |  fcf0:0:1:2::/64  |        |
 #             |  rt-1  +-------------------+  rt-2  |
 #             |        |                   |        |
 #             +---+----+                   +----+---+
 #                 |      .               .      |
 #                 |  fcf0:0:1:3::/64   .        |
 #                 |          .       .          |
 #                 |            .   .            |
 # fcf0:0:1:4::/64 |              .              | fcf0:0:2:3::/64
 #                 |            .   .            |
 #                 |          .       .          |
 #                 |  fcf0:0:2:4::/64   .        |
 #                 |      .               .      |
 #             +---+----+                   +----+---+
 #             |        |                   |        |
 #             |  rt-4  +-------------------+  rt-3  |
 #             |        |  fcf0:0:3:4::/64  |        |
 #             +---+----+                   +----+---+
 #
 #
 # Every fcf0:0:x:y::/64 network interconnects the SRv6 routers rt-x with rt-y
 # in the IPv6 operator network.
 #
 # Local SID table
 # ===============
 #
 # Each SRv6 router is configured with a Local SID table in which SIDs are
 # stored. Considering the given SRv6 router rt-x, at least two SIDs are
 # configured in the Local SID table:
 #
 #   Local SID table for SRv6 router rt-x
 #   +----------------------------------------------------------+
 #   |fcff:x::e is associated with the SRv6 End behavior        |
 #   |fcff:x::d2 is associated with the SRv6 End.DX2 behavior   |
 #   +----------------------------------------------------------+
 #
 # The fcff::/16 prefix is reserved by the operator for implementing SRv6 VPN
 # services. Reachability of SIDs is ensured by proper configuration of the IPv6
 # operator's network and SRv6 routers.
 #
 # SRv6 Policies
 # =============
 #
 # An SRv6 ingress router applies SRv6 policies to the traffic received from a
 # connected host. SRv6 policy enforcement consists of encapsulating the
 # received traffic into a new IPv6 packet with a given SID List contained in
 # the SRH.
 #
 # L2 VPN between hs-1 and hs-2
 # ----------------------------
 #
 # Hosts hs-1 and hs-2 are connected using a dedicated L2 VPN.
 # Specifically, packets generated from hs-1 and directed towards hs-2 are
 # handled by rt-1 which applies the following SRv6 Policies:
 #
 #   i.a) L2 traffic, SID List=fcff:2::d2
 #
 # Policy (i.a) steers tunneled L2 traffic through SRv6 router rt-2.
 # The H.L2Encaps.Red omits the presence of SRH at all, since the SID List
 # consists of only one SID (fcff:2::d2) that can be stored directly in the IPv6
 # DA.
 #
 # On the reverse path (i.e. from hs-2 to hs-1), rt-2 applies the following
 # policies:
 #
 #   i.b) L2 traffic, SID List=fcff:4::e,fcff:3::e,fcff:1::d2
 #
 # Policy (i.b) steers tunneled L2 traffic through the SRv6 routers
 # rt-4,rt-3,rt2. The H.L2Encaps.Red reduces the SID List in the SRH by removing
 # the first SID (fcff:4::e) and pushing it into the IPv6 DA.
 #
 # In summary:
 #  hs-1->hs-2 |IPv6 DA=fcff:2::d2|eth|...|                              (i.a)
 #  hs-2->hs-1 |IPv6 DA=fcff:4::e|SRH SIDs=fcff:3::e,fcff:1::d2|eth|...| (i.b)
 #

 # Kselftest framework requirement - SKIP code is 4.
 readonly ksft_skip=4

 readonly RDMSUFF="$(mktemp -u XXXXXXXX)"
 readonly DUMMY_DEVNAME="dum0"
 readonly RT2HS_DEVNAME="veth-hs"
 readonly HS_VETH_NAME="veth0"
 readonly LOCALSID_TABLE_ID=90
 readonly IPv6_RT_NETWORK=fcf0:0
 readonly IPv6_HS_NETWORK=cafe
 readonly IPv4_HS_NETWORK=10.0.0
 readonly VPN_LOCATOR_SERVICE=fcff
 readonly MAC_PREFIX=00:00:00:c0:01
 readonly END_FUNC=000e
 readonly DX2_FUNC=00d2

 PING_TIMEOUT_SEC=4
 PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}

 # IDs of routers and hosts are initialized during the setup of the testing
 # network
 ROUTERS=''
 HOSTS=''

 SETUP_ERR=1

 ret=${ksft_skip}
 nsuccess=0
 nfail=0

 log_test()
 {
 	local rc="$1"
 	local expected="$2"
 	local msg="$3"

 	if [ "${rc}" -eq "${expected}" ]; then
 		nsuccess=$((nsuccess+1))
 		printf "\n    TEST: %-60s  [ OK ]\n" "${msg}"
 	else
 		ret=1
 		nfail=$((nfail+1))
 		printf "\n    TEST: %-60s  [FAIL]\n" "${msg}"
 		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
 			echo
 			echo "hit enter to continue, 'q' to quit"
 			read a
 			[ "$a" = "q" ] && exit 1
 		fi
 	fi
 }

 print_log_test_results()
 {
 	printf "\nTests passed: %3d\n" "${nsuccess}"
 	printf "Tests failed: %3d\n"   "${nfail}"

 	# when a test fails, the value of 'ret' is set to 1 (error code).
 	# Conversely, when all tests are passed successfully, the 'ret' value
 	# is set to 0 (success code).
 	if [ "${ret}" -ne 1 ]; then
 		ret=0
 	fi
 }

 log_section()
 {
 	echo
 	echo "################################################################################"
 	echo "TEST SECTION: $*"
 	echo "################################################################################"
 }

 test_command_or_ksft_skip()
 {
 	local cmd="$1"

 	if [ ! -x "$(command -v "${cmd}")" ]; then
 		echo "SKIP: Could not run test without \"${cmd}\" tool";
 		exit "${ksft_skip}"
 	fi
 }

 get_nodename()
 {
 	local name="$1"

 	echo "${name}-${RDMSUFF}"
 }

 get_rtname()
 {
 	local rtid="$1"

 	get_nodename "rt-${rtid}"
 }

 get_hsname()
 {
 	local hsid="$1"

 	get_nodename "hs-${hsid}"
 }

 __create_namespace()
 {
 	local name="$1"

 	ip netns add "${name}"
 }

 create_router()
 {
 	local rtid="$1"
 	local nsname

 	nsname="$(get_rtname "${rtid}")"

 	__create_namespace "${nsname}"
 }

 create_host()
 {
 	local hsid="$1"
 	local nsname

 	nsname="$(get_hsname "${hsid}")"

 	__create_namespace "${nsname}"
 }

 cleanup()
 {
 	local nsname
 	local i

 	# destroy routers
 	for i in ${ROUTERS}; do
 		nsname="$(get_rtname "${i}")"

 		ip netns del "${nsname}" &>/dev/null || true
 	done

 	# destroy hosts
 	for i in ${HOSTS}; do
 		nsname="$(get_hsname "${i}")"

 		ip netns del "${nsname}" &>/dev/null || true
 	done

 	# check whether the setup phase was completed successfully or not. In
 	# case of an error during the setup phase of the testing environment,
 	# the selftest is considered as "skipped".
 	if [ "${SETUP_ERR}" -ne 0 ]; then
 		echo "SKIP: Setting up the testing environment failed"
 		exit "${ksft_skip}"
 	fi

 	exit "${ret}"
 }

 add_link_rt_pairs()
 {
 	local rt="$1"
 	local rt_neighs="$2"
 	local neigh
 	local nsname
 	local neigh_nsname

 	nsname="$(get_rtname "${rt}")"

 	for neigh in ${rt_neighs}; do
 		neigh_nsname="$(get_rtname "${neigh}")"

 		ip link add "veth-rt-${rt}-${neigh}" netns "${nsname}" \
 			type veth peer name "veth-rt-${neigh}-${rt}" \
 			netns "${neigh_nsname}"
 	done
 }

 get_network_prefix()
 {
 	local rt="$1"
 	local neigh="$2"
 	local p="${rt}"
 	local q="${neigh}"

 	if [ "${p}" -gt "${q}" ]; then
 		p="${q}"; q="${rt}"
 	fi

 	echo "${IPv6_RT_NETWORK}:${p}:${q}"
 }

 # Setup the basic networking for the routers
 setup_rt_networking()
 {
 	local rt="$1"
 	local rt_neighs="$2"
 	local nsname
 	local net_prefix
 	local devname
 	local neigh

 	nsname="$(get_rtname "${rt}")"

 	for neigh in ${rt_neighs}; do
 		devname="veth-rt-${rt}-${neigh}"

 		net_prefix="$(get_network_prefix "${rt}" "${neigh}")"

 		ip -netns "${nsname}" addr \
 			add "${net_prefix}::${rt}/64" dev "${devname}" nodad

 		ip -netns "${nsname}" link set "${devname}" up
 	done

 	ip -netns "${nsname}" link add "${DUMMY_DEVNAME}" type dummy

 	ip -netns "${nsname}" link set "${DUMMY_DEVNAME}" up
 	ip -netns "${nsname}" link set lo up

 	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.all.accept_dad=0
 	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.default.accept_dad=0
 	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.all.forwarding=1

 	ip netns exec "${nsname}" sysctl -wq net.ipv4.conf.all.rp_filter=0
 	ip netns exec "${nsname}" sysctl -wq net.ipv4.conf.default.rp_filter=0
 	ip netns exec "${nsname}" sysctl -wq net.ipv4.ip_forward=1
 }

 # Setup local SIDs for an SRv6 router
 setup_rt_local_sids()
 {
 	local rt="$1"
 	local rt_neighs="$2"
 	local net_prefix
 	local devname
 	local nsname
 	local neigh

 	nsname="$(get_rtname "${rt}")"

 	for neigh in ${rt_neighs}; do
 		devname="veth-rt-${rt}-${neigh}"

 		net_prefix="$(get_network_prefix "${rt}" "${neigh}")"

 		# set underlay network routes for SIDs reachability
 		ip -netns "${nsname}" -6 route \
 			add "${VPN_LOCATOR_SERVICE}:${neigh}::/32" \
 			table "${LOCALSID_TABLE_ID}" \
 			via "${net_prefix}::${neigh}" dev "${devname}"
 	done

 	# Local End behavior (note that dev "${DUMMY_DEVNAME}" is a dummy
 	# interface)
 	ip -netns "${nsname}" -6 route \
 		add "${VPN_LOCATOR_SERVICE}:${rt}::${END_FUNC}" \
 		table "${LOCALSID_TABLE_ID}" \
 		encap seg6local action End dev "${DUMMY_DEVNAME}"

 	# all SIDs for VPNs start with a common locator. Routes and SRv6
 	# Endpoint behaviors instaces are grouped together in the 'localsid'
 	# table.
 	ip -netns "${nsname}" -6 rule add \
 		to "${VPN_LOCATOR_SERVICE}::/16" \
 		lookup "${LOCALSID_TABLE_ID}" prio 999
 }

 # build and install the SRv6 policy into the ingress SRv6 router.
 # args:
 #  $1 - destination host (i.e. cafe::x host)
 #  $2 - SRv6 router configured for enforcing the SRv6 Policy
 #  $3 - SRv6 routers configured for steering traffic (End behaviors)
 #  $4 - SRv6 router configured for removing the SRv6 Policy (router connected
 #       to the destination host)
 #  $5 - encap mode (full or red)
 #  $6 - traffic type (IPv6 or IPv4)
 __setup_rt_policy()
 {
 	local dst="$1"
 	local encap_rt="$2"
 	local end_rts="$3"
 	local dec_rt="$4"
 	local mode="$5"
 	local traffic="$6"
 	local nsname
 	local policy=''
 	local n

 	nsname="$(get_rtname "${encap_rt}")"

 	for n in ${end_rts}; do
 		policy="${policy}${VPN_LOCATOR_SERVICE}:${n}::${END_FUNC},"
 	done

 	policy="${policy}${VPN_LOCATOR_SERVICE}:${dec_rt}::${DX2_FUNC}"

 	# add SRv6 policy to incoming traffic sent by connected hosts
 	if [ "${traffic}" -eq 6 ]; then
 		ip -netns "${nsname}" -6 route \
 			add "${IPv6_HS_NETWORK}::${dst}" \
 			encap seg6 mode "${mode}" segs "${policy}" \
 			dev dum0
 	else
 		ip -netns "${nsname}" -4 route \
 			add "${IPv4_HS_NETWORK}.${dst}" \
 			encap seg6 mode "${mode}" segs "${policy}" \
 			dev dum0
 	fi
 }

 # see __setup_rt_policy
 setup_rt_policy_ipv6()
 {
 	__setup_rt_policy "$1" "$2" "$3" "$4" "$5" 6
 }

 #see __setup_rt_policy
 setup_rt_policy_ipv4()
 {
 	__setup_rt_policy "$1" "$2" "$3" "$4" "$5" 4
 }

 setup_decap()
 {
 	local rt="$1"
 	local nsname

 	nsname="$(get_rtname "${rt}")"

 	# Local End.DX2 behavior
 	ip -netns "${nsname}" -6 route \
 		add "${VPN_LOCATOR_SERVICE}:${rt}::${DX2_FUNC}" \
 		table "${LOCALSID_TABLE_ID}" \
 		encap seg6local action End.DX2 oif "${RT2HS_DEVNAME}" \
 		dev "${RT2HS_DEVNAME}"
 }

 setup_hs()
 {
 	local hs="$1"
 	local rt="$2"
 	local hsname
 	local rtname

 	hsname="$(get_hsname "${hs}")"
 	rtname="$(get_rtname "${rt}")"

 	ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.all.accept_dad=0
 	ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.default.accept_dad=0

 	ip -netns "${hsname}" link add "${HS_VETH_NAME}" type veth \
 		peer name "${RT2HS_DEVNAME}" netns "${rtname}"

 	ip -netns "${hsname}" addr add "${IPv6_HS_NETWORK}::${hs}/64" \
 		dev "${HS_VETH_NAME}" nodad
 	ip -netns "${hsname}" addr add "${IPv4_HS_NETWORK}.${hs}/24" \
 		dev "${HS_VETH_NAME}"

 	ip -netns "${hsname}" link set "${HS_VETH_NAME}" up
 	ip -netns "${hsname}" link set lo up

 	ip -netns "${rtname}" addr add "${IPv6_HS_NETWORK}::254/64" \
 		dev "${RT2HS_DEVNAME}" nodad
 	ip -netns "${rtname}" addr \
 		add "${IPv4_HS_NETWORK}.254/24" dev "${RT2HS_DEVNAME}"

 	ip -netns "${rtname}" link set "${RT2HS_DEVNAME}" up

 	# disable the rp_filter otherwise the kernel gets confused about how
 	# to route decap ipv4 packets.
 	ip netns exec "${rtname}" \
 		sysctl -wq net.ipv4.conf."${RT2HS_DEVNAME}".rp_filter=0
 }

 # set an auto-generated mac address
 # args:
 #  $1 - name of the node (e.g.: hs-1, rt-3, etc)
 #  $2 - id of the node (e.g.: 1 for hs-1, 3 for rt-3, etc)
 #  $3 - host part of the IPv6 network address
 #  $4 - name of the network interface to which the generated mac address must
 #       be set.
 set_mac_address()
 {
 	local nodename="$1"
 	local nodeid="$2"
 	local host="$3"
 	local ifname="$4"
 	local nsname

 	nsname=$(get_nodename "${nodename}")

 	ip -netns "${nsname}" link set dev "${ifname}" down

 	ip -netns "${nsname}" link set address "${MAC_PREFIX}:${nodeid}" \
 		dev "${ifname}"

 	# the IPv6 address must be set once again after the MAC address has
 	# been changed.
 	ip -netns "${nsname}" addr add "${IPv6_HS_NETWORK}::${host}/64" \
 		dev "${ifname}" nodad

 	ip -netns "${nsname}" link set dev "${ifname}" up
 }

 set_host_l2peer()
 {
 	local hssrc="$1"
 	local hsdst="$2"
 	local ipprefix="$3"
 	local proto="$4"
 	local hssrc_name
 	local ipaddr

 	hssrc_name="$(get_hsname "${hssrc}")"

 	if [ "${proto}" -eq 6 ]; then
 		ipaddr="${ipprefix}::${hsdst}"
 	else
 		ipaddr="${ipprefix}.${hsdst}"
 	fi

 	ip -netns "${hssrc_name}" route add "${ipaddr}" dev "${HS_VETH_NAME}"

 	ip -netns "${hssrc_name}" neigh \
 		add "${ipaddr}" lladdr "${MAC_PREFIX}:${hsdst}" \
 		dev "${HS_VETH_NAME}"
 }

 # setup an SRv6 L2 VPN between host hs-x and hs-y (currently, the SRv6
 # subsystem only supports L2 frames whose layer-3 is IPv4/IPv6).
 # args:
 #  $1 - source host
 #  $2 - SRv6 routers configured for steering tunneled traffic
 #  $3 - destination host
 setup_l2vpn()
 {
 	local hssrc="$1"
 	local end_rts="$2"
 	local hsdst="$3"
 	local rtsrc="${hssrc}"
 	local rtdst="${hsdst}"

 	# set fixed mac for source node and the neigh MAC address
 	set_mac_address "hs-${hssrc}" "${hssrc}" "${hssrc}" "${HS_VETH_NAME}"
 	set_host_l2peer "${hssrc}" "${hsdst}" "${IPv6_HS_NETWORK}" 6
 	set_host_l2peer "${hssrc}" "${hsdst}" "${IPv4_HS_NETWORK}" 4

 	# we have to set the mac address of the veth-host (on ingress router)
 	# to the mac address of the remote peer (L2 VPN destination host).
 	# Otherwise, traffic coming from the source host is dropped at the
 	# ingress router.
 	set_mac_address "rt-${rtsrc}" "${hsdst}" 254 "${RT2HS_DEVNAME}"

 	# set the SRv6 Policies at the ingress router
 	setup_rt_policy_ipv6 "${hsdst}" "${rtsrc}" "${end_rts}" "${rtdst}" \
 		l2encap.red 6
 	setup_rt_policy_ipv4 "${hsdst}" "${rtsrc}" "${end_rts}" "${rtdst}" \
 		l2encap.red 4

 	# set the decap behavior
 	setup_decap "${rtsrc}"
 }

 setup()
 {
 	local i

 	# create routers
 	ROUTERS="1 2 3 4"; readonly ROUTERS
 	for i in ${ROUTERS}; do
 		create_router "${i}"
 	done

 	# create hosts
 	HOSTS="1 2"; readonly HOSTS
 	for i in ${HOSTS}; do
 		create_host "${i}"
 	done

 	# set up the links for connecting routers
 	add_link_rt_pairs 1 "2 3 4"
 	add_link_rt_pairs 2 "3 4"
 	add_link_rt_pairs 3 "4"

 	# set up the basic connectivity of routers and routes required for
 	# reachability of SIDs.
 	setup_rt_networking 1 "2 3 4"
 	setup_rt_networking 2 "1 3 4"
 	setup_rt_networking 3 "1 2 4"
 	setup_rt_networking 4 "1 2 3"

 	# set up the hosts connected to routers
 	setup_hs 1 1
 	setup_hs 2 2

 	# set up default SRv6 Endpoints (i.e. SRv6 End and SRv6 End.DX2)
 	setup_rt_local_sids 1 "2 3 4"
 	setup_rt_local_sids 2 "1 3 4"
 	setup_rt_local_sids 3 "1 2 4"
 	setup_rt_local_sids 4 "1 2 3"

 	# create a L2 VPN between hs-1 and hs-2.
 	# NB: currently, H.L2Encap* enables tunneling of L2 frames whose
 	# layer-3 is IPv4/IPv6.
 	#
 	# the network path between hs-1 and hs-2 traverses several routers
 	# depending on the direction of traffic.
 	#
 	# Direction hs-1 -> hs-2 (H.L2Encaps.Red)
 	# - rt-2 (SRv6 End.DX2 behavior)
 	#
 	# Direction hs-2 -> hs-1 (H.L2Encaps.Red)
 	#  - rt-4,rt-3 (SRv6 End behaviors)
 	#  - rt-1 (SRv6 End.DX2 behavior)
 	setup_l2vpn 1 "" 2
 	setup_l2vpn 2 "4 3" 1

 	# testing environment was set up successfully
 	SETUP_ERR=0
 }

 check_rt_connectivity()
 {
 	local rtsrc="$1"
 	local rtdst="$2"
 	local prefix
 	local rtsrc_nsname

 	rtsrc_nsname="$(get_rtname "${rtsrc}")"

 	prefix="$(get_network_prefix "${rtsrc}" "${rtdst}")"

 	ip netns exec "${rtsrc_nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
 		"${prefix}::${rtdst}" >/dev/null 2>&1
 }

 check_and_log_rt_connectivity()
 {
 	local rtsrc="$1"
 	local rtdst="$2"

 	check_rt_connectivity "${rtsrc}" "${rtdst}"
 	log_test $? 0 "Routers connectivity: rt-${rtsrc} -> rt-${rtdst}"
 }

 check_hs_ipv6_connectivity()
 {
 	local hssrc="$1"
 	local hsdst="$2"
 	local hssrc_nsname

 	hssrc_nsname="$(get_hsname "${hssrc}")"

 	ip netns exec "${hssrc_nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
 		"${IPv6_HS_NETWORK}::${hsdst}" >/dev/null 2>&1
 }

 check_hs_ipv4_connectivity()
 {
 	local hssrc="$1"
 	local hsdst="$2"
 	local hssrc_nsname

 	hssrc_nsname="$(get_hsname "${hssrc}")"

 	ip netns exec "${hssrc_nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
 		"${IPv4_HS_NETWORK}.${hsdst}" >/dev/null 2>&1
 }

 check_and_log_hs2gw_connectivity()
 {
 	local hssrc="$1"

 	check_hs_ipv6_connectivity "${hssrc}" 254
 	log_test $? 0 "IPv6 Hosts connectivity: hs-${hssrc} -> gw"

 	check_hs_ipv4_connectivity "${hssrc}" 254
 	log_test $? 0 "IPv4 Hosts connectivity: hs-${hssrc} -> gw"
 }

 check_and_log_hs_ipv6_connectivity()
 {
 	local hssrc="$1"
 	local hsdst="$2"

 	check_hs_ipv6_connectivity "${hssrc}" "${hsdst}"
 	log_test $? 0 "IPv6 Hosts connectivity: hs-${hssrc} -> hs-${hsdst}"
 }

 check_and_log_hs_ipv4_connectivity()
 {
 	local hssrc="$1"
 	local hsdst="$2"

 	check_hs_ipv4_connectivity "${hssrc}" "${hsdst}"
 	log_test $? 0 "IPv4 Hosts connectivity: hs-${hssrc} -> hs-${hsdst}"
 }

 check_and_log_hs_connectivity()
 {
 	local hssrc="$1"
 	local hsdst="$2"

 	check_and_log_hs_ipv4_connectivity "${hssrc}" "${hsdst}"
 	check_and_log_hs_ipv6_connectivity "${hssrc}" "${hsdst}"
 }

 router_tests()
 {
 	local i
 	local j

 	log_section "IPv6 routers connectivity test"

 	for i in ${ROUTERS}; do
 		for j in ${ROUTERS}; do
 			if [ "${i}" -eq "${j}" ]; then
 				continue
 			fi

 			check_and_log_rt_connectivity "${i}" "${j}"
 		done
 	done
 }

 host2gateway_tests()
 {
 	local hs

 	log_section "IPv4/IPv6 connectivity test among hosts and gateways"

 	for hs in ${HOSTS}; do
 		check_and_log_hs2gw_connectivity "${hs}"
 	done
 }

 host_vpn_tests()
 {
 	log_section "SRv6 L2 VPN connectivity test hosts (h1 <-> h2)"

 	check_and_log_hs_connectivity 1 2
 	check_and_log_hs_connectivity 2 1
 }

 test_dummy_dev_or_ksft_skip()
 {
 	local test_netns

 	test_netns="dummy-$(mktemp -u XXXXXXXX)"

 	if ! ip netns add "${test_netns}"; then
 		echo "SKIP: Cannot set up netns for testing dummy dev support"
 		exit "${ksft_skip}"
 	fi

 	modprobe dummy &>/dev/null || true
 	if ! ip -netns "${test_netns}" link \
 		add "${DUMMY_DEVNAME}" type dummy; then
 		echo "SKIP: dummy dev not supported"

 		ip netns del "${test_netns}"
 		exit "${ksft_skip}"
 	fi

 	ip netns del "${test_netns}"
 }

 test_iproute2_supp_or_ksft_skip()
 {
 	if ! ip route help 2>&1 | grep -qo "l2encap.red"; then
 		echo "SKIP: Missing SRv6 l2encap.red support in iproute2"
 		exit "${ksft_skip}"
 	fi
 }

 if [ "$(id -u)" -ne 0 ]; then
 	echo "SKIP: Need root privileges"
 	exit "${ksft_skip}"
 fi

 # required programs to carry out this selftest
 test_command_or_ksft_skip ip
 test_command_or_ksft_skip ping
 test_command_or_ksft_skip sysctl
 test_command_or_ksft_skip grep

 test_iproute2_supp_or_ksft_skip
 test_dummy_dev_or_ksft_skip

 set -e
 trap cleanup EXIT

 setup
 set +e

 router_tests
 host2gateway_tests
 host_vpn_tests

 print_log_test_results
	#!/bin/bash
	# SPDX-License-Identifier: GPL-2.0
	#
	# author: Andrea Mayer <andrea.mayer@uniroma2.it>
	#
	# This script is designed for testing the SRv6 H.L2Encaps.Red behavior.
	#
	# Below is depicted the IPv6 network of an operator which offers L2 VPN
	# services to hosts, enabling them to communicate with each other.
	# In this example, hosts hs-1 and hs-2 are connected through an L2 VPN service.
	# Currently, the SRv6 subsystem in Linux allows hosts hs-1 and hs-2 to exchange
	# full L2 frames as long as they carry IPv4/IPv6.
	#
	# Routers rt-1,rt-2,rt-3 and rt-4 implement L2 VPN services
	# leveraging the SRv6 architecture. The key components for such VPNs are:
	#
	# i) The SRv6 H.L2Encaps.Red behavior applies SRv6 Policies on traffic
	# received by connected hosts, initiating the VPN tunnel. Such a behavior
	# is an optimization of the SRv6 H.L2Encap aiming to reduce the
	# length of the SID List carried in the pushed SRH. Specifically, the
	# H.L2Encaps.Red removes the first SID contained in the SID List (i.e. SRv6
	# Policy) by storing it into the IPv6 Destination Address. When a SRv6
	# Policy is made of only one SID, the SRv6 H.L2Encaps.Red behavior omits
	# the SRH at all and pushes that SID directly into the IPv6 DA;
	#
	# ii) The SRv6 End behavior advances the active SID in the SID List
	# carried by the SRH;
	#
	# iii) The SRv6 End.DX2 behavior is used for removing the SRv6 Policy
	# and, thus, it terminates the VPN tunnel. The decapsulated L2 frame is
	# sent over the interface connected with the destination host.
	#
	# cafe::1 cafe::2
	# 10.0.0.1 10.0.0.2
	# +--------+ +--------+
	# \| \| \| \|
	# \| hs-1 \| \| hs-2 \|
	# \| \| \| \|
	# +---+----+ +--- +---+
	# cafe::/64 \| \| cafe::/64
	# 10.0.0.0/24 \| \| 10.0.0.0/24
	# +---+----+ +----+---+
	# \| \| fcf0:0:1:2::/64 \| \|
	# \| rt-1 +-------------------+ rt-2 \|
	# \| \| \| \|
	# +---+----+ +----+---+
	# \| . . \|
	# \| fcf0:0:1:3::/64 . \|
	# \| . . \|
	# \| . . \|
	# fcf0:0:1:4::/64 \| . \| fcf0:0:2:3::/64
	# \| . . \|
	# \| . . \|
	# \| fcf0:0:2:4::/64 . \|
	# \| . . \|
	# +---+----+ +----+---+
	# \| \| \| \|
	# \| rt-4 +-------------------+ rt-3 \|
	# \| \| fcf0:0:3:4::/64 \| \|
	# +---+----+ +----+---+
	#
	#
	# Every fcf0:0:x:y::/64 network interconnects the SRv6 routers rt-x with rt-y
	# in the IPv6 operator network.
	#
	# Local SID table
	# ===============
	#
	# Each SRv6 router is configured with a Local SID table in which SIDs are
	# stored. Considering the given SRv6 router rt-x, at least two SIDs are
	# configured in the Local SID table:
	#
	# Local SID table for SRv6 router rt-x
	# +----------------------------------------------------------+
	# \|fcff:x::e is associated with the SRv6 End behavior \|
	# \|fcff:x::d2 is associated with the SRv6 End.DX2 behavior \|
	# +----------------------------------------------------------+
	#
	# The fcff::/16 prefix is reserved by the operator for implementing SRv6 VPN
	# services. Reachability of SIDs is ensured by proper configuration of the IPv6
	# operator's network and SRv6 routers.
	#
	# SRv6 Policies
	# =============
	#
	# An SRv6 ingress router applies SRv6 policies to the traffic received from a
	# connected host. SRv6 policy enforcement consists of encapsulating the
	# received traffic into a new IPv6 packet with a given SID List contained in
	# the SRH.
	#
	# L2 VPN between hs-1 and hs-2
	# ----------------------------
	#
	# Hosts hs-1 and hs-2 are connected using a dedicated L2 VPN.
	# Specifically, packets generated from hs-1 and directed towards hs-2 are
	# handled by rt-1 which applies the following SRv6 Policies:
	#
	# i.a) L2 traffic, SID List=fcff:2::d2
	#
	# Policy (i.a) steers tunneled L2 traffic through SRv6 router rt-2.
	# The H.L2Encaps.Red omits the presence of SRH at all, since the SID List
	# consists of only one SID (fcff:2::d2) that can be stored directly in the IPv6
	# DA.
	#
	# On the reverse path (i.e. from hs-2 to hs-1), rt-2 applies the following
	# policies:
	#
	# i.b) L2 traffic, SID List=fcff:4::e,fcff:3::e,fcff:1::d2
	#
	# Policy (i.b) steers tunneled L2 traffic through the SRv6 routers
	# rt-4,rt-3,rt2. The H.L2Encaps.Red reduces the SID List in the SRH by removing
	# the first SID (fcff:4::e) and pushing it into the IPv6 DA.
	#
	# In summary:
	# hs-1->hs-2 \|IPv6 DA=fcff:2::d2\|eth\|...\| (i.a)
	# hs-2->hs-1 \|IPv6 DA=fcff:4::e\|SRH SIDs=fcff:3::e,fcff:1::d2\|eth\|...\| (i.b)
	#

	# Kselftest framework requirement - SKIP code is 4.
	readonly ksft_skip=4

	readonly RDMSUFF="$(mktemp -u XXXXXXXX)"
	readonly DUMMY_DEVNAME="dum0"
	readonly RT2HS_DEVNAME="veth-hs"
	readonly HS_VETH_NAME="veth0"
	readonly LOCALSID_TABLE_ID=90
	readonly IPv6_RT_NETWORK=fcf0:0
	readonly IPv6_HS_NETWORK=cafe
	readonly IPv4_HS_NETWORK=10.0.0
	readonly VPN_LOCATOR_SERVICE=fcff
	readonly MAC_PREFIX=00:00:00:c0:01
	readonly END_FUNC=000e
	readonly DX2_FUNC=00d2

	PING_TIMEOUT_SEC=4
	PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}

	# IDs of routers and hosts are initialized during the setup of the testing
	# network
	ROUTERS=''
	HOSTS=''

	SETUP_ERR=1

	ret=${ksft_skip}
	nsuccess=0
	nfail=0

	log_test()
	{
	local rc="$1"
	local expected="$2"
	local msg="$3"

	if [ "${rc}" -eq "${expected}" ]; then
	nsuccess=$((nsuccess+1))
	printf "\n TEST: %-60s [ OK ]\n" "${msg}"
	else
	ret=1
	nfail=$((nfail+1))
	printf "\n TEST: %-60s [FAIL]\n" "${msg}"
	if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
	echo
	echo "hit enter to continue, 'q' to quit"
	read a
	[ "$a" = "q" ] && exit 1
	fi
	fi
	}

	print_log_test_results()
	{
	printf "\nTests passed: %3d\n" "${nsuccess}"
	printf "Tests failed: %3d\n" "${nfail}"

	# when a test fails, the value of 'ret' is set to 1 (error code).
	# Conversely, when all tests are passed successfully, the 'ret' value
	# is set to 0 (success code).
	if [ "${ret}" -ne 1 ]; then
	ret=0
	fi
	}

	log_section()
	{
	echo
	echo "################################################################################"
	echo "TEST SECTION: $*"
	echo "################################################################################"
	}

	test_command_or_ksft_skip()
	{
	local cmd="$1"

	if [ ! -x "$(command -v "${cmd}")" ]; then
	echo "SKIP: Could not run test without \"${cmd}\" tool";
	exit "${ksft_skip}"
	fi
	}

	get_nodename()
	{
	local name="$1"

	echo "${name}-${RDMSUFF}"
	}

	get_rtname()
	{
	local rtid="$1"

	get_nodename "rt-${rtid}"
	}

	get_hsname()
	{
	local hsid="$1"

	get_nodename "hs-${hsid}"
	}

	__create_namespace()
	{
	local name="$1"

	ip netns add "${name}"
	}

	create_router()
	{
	local rtid="$1"
	local nsname

	nsname="$(get_rtname "${rtid}")"

	__create_namespace "${nsname}"
	}

	create_host()
	{
	local hsid="$1"
	local nsname

	nsname="$(get_hsname "${hsid}")"

	__create_namespace "${nsname}"
	}

	cleanup()
	{
	local nsname
	local i

	# destroy routers
	for i in ${ROUTERS}; do
	nsname="$(get_rtname "${i}")"

	ip netns del "${nsname}" &>/dev/null \|\| true
	done

	# destroy hosts
	for i in ${HOSTS}; do
	nsname="$(get_hsname "${i}")"

	ip netns del "${nsname}" &>/dev/null \|\| true
	done

	# check whether the setup phase was completed successfully or not. In
	# case of an error during the setup phase of the testing environment,
	# the selftest is considered as "skipped".
	if [ "${SETUP_ERR}" -ne 0 ]; then
	echo "SKIP: Setting up the testing environment failed"
	exit "${ksft_skip}"
	fi

	exit "${ret}"
	}

	add_link_rt_pairs()
	{
	local rt="$1"
	local rt_neighs="$2"
	local neigh
	local nsname
	local neigh_nsname

	nsname="$(get_rtname "${rt}")"

	for neigh in ${rt_neighs}; do
	neigh_nsname="$(get_rtname "${neigh}")"

	ip link add "veth-rt-${rt}-${neigh}" netns "${nsname}" \
	type veth peer name "veth-rt-${neigh}-${rt}" \
	netns "${neigh_nsname}"
	done
	}

	get_network_prefix()
	{
	local rt="$1"
	local neigh="$2"
	local p="${rt}"
	local q="${neigh}"

	if [ "${p}" -gt "${q}" ]; then
	p="${q}"; q="${rt}"
	fi

	echo "${IPv6_RT_NETWORK}:${p}:${q}"
	}

	# Setup the basic networking for the routers
	setup_rt_networking()
	{
	local rt="$1"
	local rt_neighs="$2"
	local nsname
	local net_prefix
	local devname
	local neigh

	nsname="$(get_rtname "${rt}")"

	for neigh in ${rt_neighs}; do
	devname="veth-rt-${rt}-${neigh}"

	net_prefix="$(get_network_prefix "${rt}" "${neigh}")"

	ip -netns "${nsname}" addr \
	add "${net_prefix}::${rt}/64" dev "${devname}" nodad

	ip -netns "${nsname}" link set "${devname}" up
	done

	ip -netns "${nsname}" link add "${DUMMY_DEVNAME}" type dummy

	ip -netns "${nsname}" link set "${DUMMY_DEVNAME}" up
	ip -netns "${nsname}" link set lo up

	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.all.accept_dad=0
	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.default.accept_dad=0
	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.all.forwarding=1

	ip netns exec "${nsname}" sysctl -wq net.ipv4.conf.all.rp_filter=0
	ip netns exec "${nsname}" sysctl -wq net.ipv4.conf.default.rp_filter=0
	ip netns exec "${nsname}" sysctl -wq net.ipv4.ip_forward=1
	}

	# Setup local SIDs for an SRv6 router
	setup_rt_local_sids()
	{
	local rt="$1"
	local rt_neighs="$2"
	local net_prefix
	local devname
	local nsname
	local neigh

	nsname="$(get_rtname "${rt}")"

	for neigh in ${rt_neighs}; do
	devname="veth-rt-${rt}-${neigh}"

	net_prefix="$(get_network_prefix "${rt}" "${neigh}")"

	# set underlay network routes for SIDs reachability
	ip -netns "${nsname}" -6 route \
	add "${VPN_LOCATOR_SERVICE}:${neigh}::/32" \
	table "${LOCALSID_TABLE_ID}" \
	via "${net_prefix}::${neigh}" dev "${devname}"
	done

	# Local End behavior (note that dev "${DUMMY_DEVNAME}" is a dummy
	# interface)
	ip -netns "${nsname}" -6 route \
	add "${VPN_LOCATOR_SERVICE}:${rt}::${END_FUNC}" \
	table "${LOCALSID_TABLE_ID}" \
	encap seg6local action End dev "${DUMMY_DEVNAME}"

	# all SIDs for VPNs start with a common locator. Routes and SRv6
	# Endpoint behaviors instaces are grouped together in the 'localsid'
	# table.
	ip -netns "${nsname}" -6 rule add \
	to "${VPN_LOCATOR_SERVICE}::/16" \
	lookup "${LOCALSID_TABLE_ID}" prio 999
	}

	# build and install the SRv6 policy into the ingress SRv6 router.
	# args:
	# $1 - destination host (i.e. cafe::x host)
	# $2 - SRv6 router configured for enforcing the SRv6 Policy
	# $3 - SRv6 routers configured for steering traffic (End behaviors)
	# $4 - SRv6 router configured for removing the SRv6 Policy (router connected
	# to the destination host)
	# $5 - encap mode (full or red)
	# $6 - traffic type (IPv6 or IPv4)
	__setup_rt_policy()
	{
	local dst="$1"
	local encap_rt="$2"
	local end_rts="$3"
	local dec_rt="$4"
	local mode="$5"
	local traffic="$6"
	local nsname
	local policy=''
	local n

	nsname="$(get_rtname "${encap_rt}")"

	for n in ${end_rts}; do
	policy="${policy}${VPN_LOCATOR_SERVICE}:${n}::${END_FUNC},"
	done

	policy="${policy}${VPN_LOCATOR_SERVICE}:${dec_rt}::${DX2_FUNC}"

	# add SRv6 policy to incoming traffic sent by connected hosts
	if [ "${traffic}" -eq 6 ]; then
	ip -netns "${nsname}" -6 route \
	add "${IPv6_HS_NETWORK}::${dst}" \
	encap seg6 mode "${mode}" segs "${policy}" \
	dev dum0
	else
	ip -netns "${nsname}" -4 route \
	add "${IPv4_HS_NETWORK}.${dst}" \
	encap seg6 mode "${mode}" segs "${policy}" \
	dev dum0
	fi
	}

	# see __setup_rt_policy
	setup_rt_policy_ipv6()
	{
	__setup_rt_policy "$1" "$2" "$3" "$4" "$5" 6
	}

	#see __setup_rt_policy
	setup_rt_policy_ipv4()
	{
	__setup_rt_policy "$1" "$2" "$3" "$4" "$5" 4
	}

	setup_decap()
	{
	local rt="$1"
	local nsname

	nsname="$(get_rtname "${rt}")"

	# Local End.DX2 behavior
	ip -netns "${nsname}" -6 route \
	add "${VPN_LOCATOR_SERVICE}:${rt}::${DX2_FUNC}" \
	table "${LOCALSID_TABLE_ID}" \
	encap seg6local action End.DX2 oif "${RT2HS_DEVNAME}" \
	dev "${RT2HS_DEVNAME}"
	}

	setup_hs()
	{
	local hs="$1"
	local rt="$2"
	local hsname
	local rtname

	hsname="$(get_hsname "${hs}")"
	rtname="$(get_rtname "${rt}")"

	ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.all.accept_dad=0
	ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.default.accept_dad=0

	ip -netns "${hsname}" link add "${HS_VETH_NAME}" type veth \
	peer name "${RT2HS_DEVNAME}" netns "${rtname}"

	ip -netns "${hsname}" addr add "${IPv6_HS_NETWORK}::${hs}/64" \
	dev "${HS_VETH_NAME}" nodad
	ip -netns "${hsname}" addr add "${IPv4_HS_NETWORK}.${hs}/24" \
	dev "${HS_VETH_NAME}"

	ip -netns "${hsname}" link set "${HS_VETH_NAME}" up
	ip -netns "${hsname}" link set lo up

	ip -netns "${rtname}" addr add "${IPv6_HS_NETWORK}::254/64" \
	dev "${RT2HS_DEVNAME}" nodad
	ip -netns "${rtname}" addr \
	add "${IPv4_HS_NETWORK}.254/24" dev "${RT2HS_DEVNAME}"

	ip -netns "${rtname}" link set "${RT2HS_DEVNAME}" up

	# disable the rp_filter otherwise the kernel gets confused about how
	# to route decap ipv4 packets.
	ip netns exec "${rtname}" \
	sysctl -wq net.ipv4.conf."${RT2HS_DEVNAME}".rp_filter=0
	}

	# set an auto-generated mac address
	# args:
	# $1 - name of the node (e.g.: hs-1, rt-3, etc)
	# $2 - id of the node (e.g.: 1 for hs-1, 3 for rt-3, etc)
	# $3 - host part of the IPv6 network address
	# $4 - name of the network interface to which the generated mac address must
	# be set.
	set_mac_address()
	{
	local nodename="$1"
	local nodeid="$2"
	local host="$3"
	local ifname="$4"
	local nsname

	nsname=$(get_nodename "${nodename}")

	ip -netns "${nsname}" link set dev "${ifname}" down

	ip -netns "${nsname}" link set address "${MAC_PREFIX}:${nodeid}" \
	dev "${ifname}"

	# the IPv6 address must be set once again after the MAC address has
	# been changed.
	ip -netns "${nsname}" addr add "${IPv6_HS_NETWORK}::${host}/64" \
	dev "${ifname}" nodad

	ip -netns "${nsname}" link set dev "${ifname}" up
	}

	set_host_l2peer()
	{
	local hssrc="$1"
	local hsdst="$2"
	local ipprefix="$3"
	local proto="$4"
	local hssrc_name
	local ipaddr

	hssrc_name="$(get_hsname "${hssrc}")"

	if [ "${proto}" -eq 6 ]; then
	ipaddr="${ipprefix}::${hsdst}"
	else
	ipaddr="${ipprefix}.${hsdst}"
	fi

	ip -netns "${hssrc_name}" route add "${ipaddr}" dev "${HS_VETH_NAME}"

	ip -netns "${hssrc_name}" neigh \
	add "${ipaddr}" lladdr "${MAC_PREFIX}:${hsdst}" \
	dev "${HS_VETH_NAME}"
	}

	# setup an SRv6 L2 VPN between host hs-x and hs-y (currently, the SRv6
	# subsystem only supports L2 frames whose layer-3 is IPv4/IPv6).
	# args:
	# $1 - source host
	# $2 - SRv6 routers configured for steering tunneled traffic
	# $3 - destination host
	setup_l2vpn()
	{
	local hssrc="$1"
	local end_rts="$2"
	local hsdst="$3"
	local rtsrc="${hssrc}"
	local rtdst="${hsdst}"

	# set fixed mac for source node and the neigh MAC address
	set_mac_address "hs-${hssrc}" "${hssrc}" "${hssrc}" "${HS_VETH_NAME}"
	set_host_l2peer "${hssrc}" "${hsdst}" "${IPv6_HS_NETWORK}" 6
	set_host_l2peer "${hssrc}" "${hsdst}" "${IPv4_HS_NETWORK}" 4

	# we have to set the mac address of the veth-host (on ingress router)
	# to the mac address of the remote peer (L2 VPN destination host).
	# Otherwise, traffic coming from the source host is dropped at the
	# ingress router.
	set_mac_address "rt-${rtsrc}" "${hsdst}" 254 "${RT2HS_DEVNAME}"

	# set the SRv6 Policies at the ingress router
	setup_rt_policy_ipv6 "${hsdst}" "${rtsrc}" "${end_rts}" "${rtdst}" \
	l2encap.red 6
	setup_rt_policy_ipv4 "${hsdst}" "${rtsrc}" "${end_rts}" "${rtdst}" \
	l2encap.red 4

	# set the decap behavior
	setup_decap "${rtsrc}"
	}

	setup()
	{
	local i

	# create routers
	ROUTERS="1 2 3 4"; readonly ROUTERS
	for i in ${ROUTERS}; do
	create_router "${i}"
	done

	# create hosts
	HOSTS="1 2"; readonly HOSTS
	for i in ${HOSTS}; do
	create_host "${i}"
	done

	# set up the links for connecting routers
	add_link_rt_pairs 1 "2 3 4"
	add_link_rt_pairs 2 "3 4"
	add_link_rt_pairs 3 "4"

	# set up the basic connectivity of routers and routes required for
	# reachability of SIDs.
	setup_rt_networking 1 "2 3 4"
	setup_rt_networking 2 "1 3 4"
	setup_rt_networking 3 "1 2 4"
	setup_rt_networking 4 "1 2 3"

	# set up the hosts connected to routers
	setup_hs 1 1
	setup_hs 2 2

	# set up default SRv6 Endpoints (i.e. SRv6 End and SRv6 End.DX2)
	setup_rt_local_sids 1 "2 3 4"
	setup_rt_local_sids 2 "1 3 4"
	setup_rt_local_sids 3 "1 2 4"
	setup_rt_local_sids 4 "1 2 3"

	# create a L2 VPN between hs-1 and hs-2.
	# NB: currently, H.L2Encap* enables tunneling of L2 frames whose
	# layer-3 is IPv4/IPv6.
	#
	# the network path between hs-1 and hs-2 traverses several routers
	# depending on the direction of traffic.
	#
	# Direction hs-1 -> hs-2 (H.L2Encaps.Red)
	# - rt-2 (SRv6 End.DX2 behavior)
	#
	# Direction hs-2 -> hs-1 (H.L2Encaps.Red)
	# - rt-4,rt-3 (SRv6 End behaviors)
	# - rt-1 (SRv6 End.DX2 behavior)
	setup_l2vpn 1 "" 2
	setup_l2vpn 2 "4 3" 1

	# testing environment was set up successfully
	SETUP_ERR=0
	}

	check_rt_connectivity()
	{
	local rtsrc="$1"
	local rtdst="$2"
	local prefix
	local rtsrc_nsname

	rtsrc_nsname="$(get_rtname "${rtsrc}")"

	prefix="$(get_network_prefix "${rtsrc}" "${rtdst}")"

	ip netns exec "${rtsrc_nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
	"${prefix}::${rtdst}" >/dev/null 2>&1
	}

	check_and_log_rt_connectivity()
	{
	local rtsrc="$1"
	local rtdst="$2"

	check_rt_connectivity "${rtsrc}" "${rtdst}"
	log_test $? 0 "Routers connectivity: rt-${rtsrc} -> rt-${rtdst}"
	}

	check_hs_ipv6_connectivity()
	{
	local hssrc="$1"
	local hsdst="$2"
	local hssrc_nsname

	hssrc_nsname="$(get_hsname "${hssrc}")"

	ip netns exec "${hssrc_nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
	"${IPv6_HS_NETWORK}::${hsdst}" >/dev/null 2>&1
	}

	check_hs_ipv4_connectivity()
	{
	local hssrc="$1"
	local hsdst="$2"
	local hssrc_nsname

	hssrc_nsname="$(get_hsname "${hssrc}")"

	ip netns exec "${hssrc_nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
	"${IPv4_HS_NETWORK}.${hsdst}" >/dev/null 2>&1
	}

	check_and_log_hs2gw_connectivity()
	{
	local hssrc="$1"

	check_hs_ipv6_connectivity "${hssrc}" 254
	log_test $? 0 "IPv6 Hosts connectivity: hs-${hssrc} -> gw"

	check_hs_ipv4_connectivity "${hssrc}" 254
	log_test $? 0 "IPv4 Hosts connectivity: hs-${hssrc} -> gw"
	}

	check_and_log_hs_ipv6_connectivity()
	{
	local hssrc="$1"
	local hsdst="$2"

	check_hs_ipv6_connectivity "${hssrc}" "${hsdst}"
	log_test $? 0 "IPv6 Hosts connectivity: hs-${hssrc} -> hs-${hsdst}"
	}

	check_and_log_hs_ipv4_connectivity()
	{
	local hssrc="$1"
	local hsdst="$2"

	check_hs_ipv4_connectivity "${hssrc}" "${hsdst}"
	log_test $? 0 "IPv4 Hosts connectivity: hs-${hssrc} -> hs-${hsdst}"
	}

	check_and_log_hs_connectivity()
	{
	local hssrc="$1"
	local hsdst="$2"

	check_and_log_hs_ipv4_connectivity "${hssrc}" "${hsdst}"
	check_and_log_hs_ipv6_connectivity "${hssrc}" "${hsdst}"
	}

	router_tests()
	{
	local i
	local j

	log_section "IPv6 routers connectivity test"

	for i in ${ROUTERS}; do
	for j in ${ROUTERS}; do
	if [ "${i}" -eq "${j}" ]; then
	continue
	fi

	check_and_log_rt_connectivity "${i}" "${j}"
	done
	done
	}

	host2gateway_tests()
	{
	local hs

	log_section "IPv4/IPv6 connectivity test among hosts and gateways"

	for hs in ${HOSTS}; do
	check_and_log_hs2gw_connectivity "${hs}"
	done
	}

	host_vpn_tests()
	{
	log_section "SRv6 L2 VPN connectivity test hosts (h1 <-> h2)"

	check_and_log_hs_connectivity 1 2
	check_and_log_hs_connectivity 2 1
	}

	test_dummy_dev_or_ksft_skip()
	{
	local test_netns

	test_netns="dummy-$(mktemp -u XXXXXXXX)"

	if ! ip netns add "${test_netns}"; then
	echo "SKIP: Cannot set up netns for testing dummy dev support"
	exit "${ksft_skip}"
	fi

	modprobe dummy &>/dev/null \|\| true
	if ! ip -netns "${test_netns}" link \
	add "${DUMMY_DEVNAME}" type dummy; then
	echo "SKIP: dummy dev not supported"

	ip netns del "${test_netns}"
	exit "${ksft_skip}"
	fi

	ip netns del "${test_netns}"
	}

	test_iproute2_supp_or_ksft_skip()
	{
	if ! ip route help 2>&1 \| grep -qo "l2encap.red"; then
	echo "SKIP: Missing SRv6 l2encap.red support in iproute2"
	exit "${ksft_skip}"
	fi
	}

	if [ "$(id -u)" -ne 0 ]; then
	echo "SKIP: Need root privileges"
	exit "${ksft_skip}"
	fi

	# required programs to carry out this selftest
	test_command_or_ksft_skip ip
	test_command_or_ksft_skip ping
	test_command_or_ksft_skip sysctl
	test_command_or_ksft_skip grep

	test_iproute2_supp_or_ksft_skip
	test_dummy_dev_or_ksft_skip

	set -e
	trap cleanup EXIT

	setup
	set +e

	router_tests
	host2gateway_tests
	host_vpn_tests

	print_log_test_results