tools/testing/selftests/net/srv6_encap_lookup_l3vpn_test.sh

#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# author: Andrea Mayer <andrea.mayer@uniroma2.it>

# This test evaluates the SRv6 encap "lookup" attribute. After encapsulation
# the router looks up the route for the first SID, that is the outer IPv6
# destination of the encapsulated packet. The attribute selects the FIB table
# used for this post-encap SID route lookup.
#
# Two routers (rt-1, rt-2) provide L3 VPN services over an IPv6 underlay
# (fd00::/64). Each router uses a separate VRF per tenant, with default
# blackhole routes (IPv4 and IPv6) to prevent traffic from leaking out of
# the VRF. Tenant traffic is encapsulated, then decapsulated with an
# End.DT46. Each router proxies both NDP and ARP.
#
# The routes that match the first SIDs are installed in a dedicated underlay
# table (500) rather than the main table (254). The encap routes use
# "lookup 500" to select this table for the post-encap SID route lookup.
#
# Without the "lookup" attribute, the route for the first SID cannot be found:
#  - on the input path (forwarded traffic), the lookup stays in the VRF
#    and hits the blackhole;
#  - on the output path (locally originated traffic), the lookup falls
#    through to the main table, with no route to the first SID.
#
#
# Legend (specific per-tenant addresses are in the instantiation tables below):
#   X          = tenant id and VRF table id; two tenants: 100 and 200
#                ("tX" means tenant X, e.g. t100, t200)
#   a, b       = the two host ids of the tenant
#   HA, HB     = addresses of host a, host b
#   RLO1, RLO2 = rlo-X router loopback address on rt-1, rt-2 (tenant gateway
#                for the output path, dual-stack)
#   vrf-X      = per-tenant VRF on each router (table X)
#
# Constants (same for every tenant):
#   underlay   = table 500; post-encap SID route lookup (via "lookup 500")
#   localsid   = table 90; holds the decap SIDs (End.DT46)
#   fd00::/64  = underlay link between rt-1 and rt-2
#   veth-tX    = cafe::254/10.0.0.254 (tenant gateway on veth, both routers)
#
#
# +-------------------+                                   +-------------------+
# |                   |                                   |                   |
# |   hs-tX-a netns   |                                   |   hs-tX-b netns   |
# |                   |                                   |                   |
# |  +-------------+  |                                   |  +-------------+  |
# |  |    veth0    |  |                                   |  |    veth0    |  |
# |  |     HA      |  |                                   |  |     HB      |  |
# |  +-------------+  |                                   |  +-------------+  |
# |        .          |                                   |         .         |
# +-------------------+                                   +-------------------+
#          .                                                        .
#          .                                                        .
# +-----------------------------------+   +-----------------------------------+
# |        .                          |   |                         .         |
# | +---------------+                 |   |                 +---------------+ |
# | |   veth-tX     |   +----------+  |   |  +----------+   |   veth-tX     | |
# | |  ::254/.254   |   | localsid |  |   |  | localsid |   |  ::254/.254   | |
# | +-------+-------+   +----------+  |   |  +----------+   +-------+-------+ |
# |         |           +----------+  |   |  +----------+           |         |
# |    +----+----+      | underlay |  |   |  | underlay |      +----+----+    |
# |    | vrf-X   |      +----------+  |   |  +----------+      | vrf-X   |    |
# |    +----+----+                    |   |                    +----+----+    |
# |         |                         |   |                         |         |
# |   +-----+----+    +------------+  |   |  +------------+    +----+-----+   |
# |   |  rlo-X   |    |   veth0    |  |   |  |   veth0    |    |  rlo-X   |   |
# |   |   RLO1   |    | fd00::1/64 |..|...|..| fd00::2/64 |    |   RLO2   |   |
# |   +----------+    +------------+  |   |  +------------+    +----------+   |
# |              rt-1 netns           |   |          rt-2 netns               |
# +-----------------------------------+   +-----------------------------------+
#
#
# Per-tenant instantiation:
# +-----+------+-------------------+-------------------+
# |  X  | a, b | HA                | HB                |
# +-----+------+-------------------+-------------------+
# | 100 | 1, 2 | cafe::1, 10.0.0.1 | cafe::2, 10.0.0.2 |
# | 200 | 3, 4 | cafe::3, 10.0.0.3 | cafe::4, 10.0.0.4 |
# +-----+------+-------------------+-------------------+
#
# Router loopback (rlo-X) addresses, per tenant:
# +-----+-----------------------+-----------------------+
# |  X  | RLO1 (rt-1)           | RLO2 (rt-2)           |
# +-----+-----------------------+-----------------------+
# | 100 | cafe::101, 10.0.0.101 | cafe::102, 10.0.0.102 |
# | 200 | cafe::201, 10.0.0.201 | cafe::202, 10.0.0.202 |
# +-----+-----------------------+-----------------------+
#
#
# Network configuration
# =====================
#
# rt-1: localsid table (table 90)
# +--------+--------------------+----------------------------------+
# | tenant | SID                | Action                           |
# +--------+--------------------+----------------------------------+
# |  100   | fc00:2:1:100::0d46 | apply SRv6 End.DT46 vrftable 100 |
# |  200   | fc00:2:1:200::0d46 | apply SRv6 End.DT46 vrftable 200 |
# +--------+--------------------+----------------------------------+
#
# rt-1: underlay table (table 500) - post-encap SID route lookup
# +--------+--------------------+-------------------------------+
# | tenant | SID                | Action                        |
# +--------+--------------------+-------------------------------+
# |  100   | fc00:1:2:100::0d46 | forward via fd00::2 dev veth0 |
# |  200   | fc00:1:2:200::0d46 | forward via fd00::2 dev veth0 |
# +--------+--------------------+-------------------------------+
#
# rt-1: VRF tables (per tenant: vrf-X = table X)
# +--------+------------+------------------------------------------+
# | tenant | dst        | encap action                             |
# +--------+------------+------------------------------------------+
# | 100    | cafe::2    | encap segs fc00:1:2:100::0d46 lookup 500 |
# |        | 10.0.0.2   |                                          |
# |        | cafe::102  |                                          |
# |        | 10.0.0.102 |                                          |
# | 200    | cafe::4    | encap segs fc00:1:2:200::0d46 lookup 500 |
# |        | 10.0.0.4   |                                          |
# |        | cafe::202  |                                          |
# |        | 10.0.0.202 |                                          |
# +--------+------------+------------------------------------------+
#
#
# rt-2: localsid table (table 90)
# +--------+--------------------+----------------------------------+
# | tenant | SID                | Action                           |
# +--------+--------------------+----------------------------------+
# |  100   | fc00:1:2:100::0d46 | apply SRv6 End.DT46 vrftable 100 |
# |  200   | fc00:1:2:200::0d46 | apply SRv6 End.DT46 vrftable 200 |
# +--------+--------------------+----------------------------------+
#
# rt-2: underlay table (table 500) - post-encap SID route lookup
# +--------+--------------------+-------------------------------+
# | tenant | SID                | Action                        |
# +--------+--------------------+-------------------------------+
# |  100   | fc00:2:1:100::0d46 | forward via fd00::1 dev veth0 |
# |  200   | fc00:2:1:200::0d46 | forward via fd00::1 dev veth0 |
# +--------+--------------------+-------------------------------+
#
# rt-2: VRF tables (per tenant: vrf-X = table X)
# +--------+------------+------------------------------------------+
# | tenant | dst        | encap action                             |
# +--------+------------+------------------------------------------+
# | 100    | cafe::1    | encap segs fc00:2:1:100::0d46 lookup 500 |
# |        | 10.0.0.1   |                                          |
# |        | cafe::101  |                                          |
# |        | 10.0.0.101 |                                          |
# | 200    | cafe::3    | encap segs fc00:2:1:200::0d46 lookup 500 |
# |        | 10.0.0.3   |                                          |
# |        | cafe::201  |                                          |
# |        | 10.0.0.201 |                                          |
# +--------+------------+------------------------------------------+
# Within a tenant, a single SID reaches the adjacent router (its loopback)
# and the remote host connected to it, in both IPv4 and IPv6.
#
# For both rt-1 and rt-2, each VRF also has the connected host prefix (cafe::/64
# or 10.0.0.0/24) and a default blackhole (IPv4 and IPv6).
#
#
# Locally originated traffic (output path)
# ========================================
#
# The configuration above covers forwarded traffic, where packets arrive from
# a host and are encapsulated by the router. To also test router-originated
# traffic, each router pings the other router's loopback address through
# the VPN.
#
# Example (tenant 100), rt-1 pings cafe::102 (rt-2's loopback):
#   1. rt-1 looks up cafe::102 in vrf-100 and encapsulates it (SID
#      fc00:1:2:100::0d46), then "lookup 500" finds the route for the SID in the
#      underlay table (next hop fd00::2) and forwards it;
#   2. rt-2 decapsulates it (localsid, End.DT46) and delivers it locally
#      (cafe::102 is on the rlo-100 interface);
#   3. rt-2 replies with destination cafe::101 (rt-1's loopback). rt-2 looks up
#      cafe::101 in vrf-100 and encapsulates it back to rt-1 (again via "lookup
#      500"). rt-1 decapsulates it and delivers it.

# shellcheck source=lib.sh
source lib.sh

readonly LOCALSID_TABLE_ID=90
readonly UNDERLAY_TABLE_ID=500
readonly IPv6_RT_NETWORK=fd00
readonly IPv6_HS_NETWORK=cafe
readonly IPv4_HS_NETWORK=10.0.0
readonly VPN_LOCATOR_SERVICE=fc00
readonly DT46_FUNC=0d46
readonly DUMMY_DEVNAME=dum0
readonly IPv6_TESTS_ADDR=2001:db8::1
readonly TESTS_TABLE_ID=54321
PING_TIMEOUT_SEC=4

SETUP_ERR=1

ret=${ksft_skip}
nsuccess=0
nfail=0

PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}

log_test()
{
	local rc="$1"
	local expected="$2"
	local msg="$3"

	if [ "${rc}" -eq "${expected}" ]; then
		nsuccess=$((nsuccess+1))
		printf "\n    TEST: %-60s  [ OK ]\n" "${msg}"
	else
		ret=1
		nfail=$((nfail+1))
		printf "\n    TEST: %-60s  [FAIL]\n" "${msg}"
		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
			echo
			echo "hit enter to continue, 'q' to quit"
			read -r a
			[ "$a" = "q" ] && exit 1
		fi
	fi
}

print_log_test_results()
{
	printf "\nTests passed: %3d\n" "${nsuccess}"
	printf "Tests failed: %3d\n"   "${nfail}"

	# when a test fails, the value of 'ret' is set to 1 (error code).
	# Conversely, when all tests are passed successfully, the 'ret' value
	# is set to 0 (success code).
	if [ "${ret}" -ne 1 ]; then
		ret=0
	fi
}

log_section()
{
	echo
	echo "################################################################################"
	echo "TEST SECTION: $*"
	echo "################################################################################"
}

get_rtname()
{
	local rtid="$1"

	echo "rt_${rtid}"
}

get_rt_nsname()
{
	local rtid="$1"
	local varname

	varname="$(get_rtname "${rtid}")"
	echo "${!varname}"
}

get_hsname()
{
	local tid="$1"
	local hsid="$2"

	echo "hs_t${tid}_${hsid}"
}

get_hs_nsname()
{
	local tid="$1"
	local hsid="$2"
	local varname

	varname="$(get_hsname "${tid}" "${hsid}")"
	echo "${!varname}"
}

cleanup()
{
	ip link del veth-rt-1 2>/dev/null || true
	ip link del veth-rt-2 2>/dev/null || true

	cleanup_all_ns

	# check whether the setup phase was completed successfully or not. In
	# case of an error during the setup phase of the testing environment,
	# the selftest is considered as "skipped".
	if [ "${SETUP_ERR}" -ne 0 ]; then
		echo "SKIP: Setting up the testing environment failed"
		exit "${ksft_skip}"
	fi

	exit "${ret}"
}

# Host id of the router loopback (rlo) for a (router, tenant) pair.
# E.g. rt-1/tenant 100 -> 101, rt-2/tenant 200 -> 202.
get_rlo_hostid()
{
	local rtid="$1"
	local tid="$2"

	echo "$((tid + rtid))"
}

build_vpn_sid()
{
	local rtsrc="$1"
	local rtdst="$2"
	local tid="$3"

	echo "${VPN_LOCATOR_SERVICE}:${rtsrc}:${rtdst}:${tid}::${DT46_FUNC}"
}

# Install a dual-stack (IPv6 and IPv4) encap route in a VRF on the given
# router.
# args:
#  $1 - router id
#  $2 - host part of the IPv6 destination
#  $3 - host part of the IPv4 destination
#  $4 - SRv6 SID used as the encap destination
#  $5 - tenant id
#  $6 - if "true", add the "lookup" attribute to the encap route
__set_encap_route()
{
	local rt="$1"
	local dst6="$2"
	local dst4="$3"
	local sid="$4"
	local tid="$5"
	local use_lookup="$6"
	local lookup=''
	local rtname

	rtname="$(get_rt_nsname "${rt}")"

	if [ "${use_lookup}" = "true" ]; then
		lookup="lookup ${UNDERLAY_TABLE_ID}"
	fi

	# shellcheck disable=SC2086
	ip -netns "${rtname}" -6 route replace \
		"${IPv6_HS_NETWORK}::${dst6}/128" vrf "vrf-${tid}" \
		encap seg6 mode encap segs "${sid}" ${lookup} dev veth0

	# shellcheck disable=SC2086
	ip -netns "${rtname}" -4 route replace \
		"${IPv4_HS_NETWORK}.${dst4}/32" vrf "vrf-${tid}" \
		encap seg6 mode encap segs "${sid}" ${lookup} dev veth0
}

# Install the dual-stack encap route for a tenant host on rt, with the
# "lookup" attribute so the first SID is looked up in the underlay table.
# args:
#  $1 - router id where the encap route is installed
#  $2 - host destination id (host part of cafe::<id>/128 and 10.0.0.<id>/32)
#  $3 - SRv6 SID used as the encap destination
#  $4 - tenant id
set_host_encap_route()
{
	local rt="$1"
	local hsdst="$2"
	local sid="$3"
	local tid="$4"

	__set_encap_route "${rt}" "${hsdst}" "${hsdst}" "${sid}" "${tid}" true
}

set_host_encap_route_nolookup()
{
	local rt="$1"
	local hsdst="$2"
	local sid="$3"
	local tid="$4"

	__set_encap_route "${rt}" "${hsdst}" "${hsdst}" "${sid}" "${tid}" false
}

# Install the dual-stack encap route on rtsrc toward rtdst's rlo loopback
# (RLO1 or RLO2, see header), with the "lookup" attribute so the first
# SID is looked up in the underlay table.
# args:
#  $1 - router id where the encap route is installed
#  $2 - router id whose loopback address is the route destination
#  $3 - SRv6 SID used as the encap destination
#  $4 - tenant id
set_gw_encap_route()
{
	local rtsrc="$1"
	local rtdst="$2"
	local sid="$3"
	local tid="$4"
	local dst

	dst="$(get_rlo_hostid "${rtdst}" "${tid}")"

	__set_encap_route "${rtsrc}" "${dst}" "${dst}" "${sid}" "${tid}" true
}

set_gw_encap_route_nolookup()
{
	local rtsrc="$1"
	local rtdst="$2"
	local sid="$3"
	local tid="$4"
	local dst

	dst="$(get_rlo_hostid "${rtdst}" "${tid}")"

	__set_encap_route "${rtsrc}" "${dst}" "${dst}" "${sid}" "${tid}" false
}

# Setup the basic networking for a router
setup_rt_networking()
{
	local id="$1"
	local nsname

	nsname="$(get_rt_nsname "${id}")"

	ip link set "veth-rt-${id}" netns "${nsname}"
	ip -netns "${nsname}" link set "veth-rt-${id}" name veth0

	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.all.accept_dad=0
	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.default.accept_dad=0

	ip -netns "${nsname}" addr add "${IPv6_RT_NETWORK}::${id}/64" dev veth0 nodad
	ip -netns "${nsname}" link set veth0 up

	ip netns exec "${nsname}" sysctl -wq net.ipv4.ip_forward=1
	ip netns exec "${nsname}" sysctl -wq net.ipv6.conf.all.forwarding=1
}

# Setup a host namespace and attach it to its gateway
setup_hs()
{
	local hid="$1"
	local rid="$2"
	local tid="$3"
	local rtveth="veth-t${tid}"
	local hsname
	local rtname

	hsname="$(get_hs_nsname "${tid}" "${hid}")"
	rtname="$(get_rt_nsname "${rid}")"

	ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.all.accept_dad=0
	ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.default.accept_dad=0

	ip -netns "${hsname}" link add veth0 type veth peer name "${rtveth}"
	ip -netns "${hsname}" link set "${rtveth}" netns "${rtname}"

	ip -netns "${hsname}" addr add \
		"${IPv6_HS_NETWORK}::${hid}/64" dev veth0 nodad
	ip -netns "${hsname}" addr add \
		"${IPv4_HS_NETWORK}.${hid}/24" dev veth0

	ip -netns "${hsname}" link set veth0 up
}

# Setup the per-tenant VRF on a router (gateway, loopback, blackhole)
setup_rt()
{
	local rid="$1"
	local tid="$2"
	local rtveth="veth-t${tid}"
	local rlo_dev="rlo-${tid}"
	local rtname
	local gw_addr_v6
	local gw_addr_v4

	rtname="$(get_rt_nsname "${rid}")"

	gw_addr_v6="${IPv6_HS_NETWORK}::$(get_rlo_hostid "${rid}" "${tid}")"
	gw_addr_v4="${IPv4_HS_NETWORK}.$(get_rlo_hostid "${rid}" "${tid}")"

	ip -netns "${rtname}" link add "vrf-${tid}" type vrf table "${tid}"
	ip -netns "${rtname}" link set "vrf-${tid}" up

	ip -netns "${rtname}" link set "${rtveth}" master "vrf-${tid}"

	ip -netns "${rtname}" addr add \
		"${IPv6_HS_NETWORK}::254/64" dev "${rtveth}" nodad
	ip -netns "${rtname}" addr add \
		"${IPv4_HS_NETWORK}.254/24" dev "${rtveth}"

	ip -netns "${rtname}" link set "${rtveth}" up

	ip netns exec "${rtname}" \
		sysctl -wq "net.ipv6.conf.${rtveth}.proxy_ndp=1"
	ip netns exec "${rtname}" \
		sysctl -wq "net.ipv4.conf.${rtveth}.proxy_arp=1"

	ip netns exec "${rtname}" sh -c "echo 1 > /proc/sys/net/vrf/strict_mode"

	# router loopback interface for locally originated traffic
	ip -netns "${rtname}" link add "${rlo_dev}" type dummy
	ip -netns "${rtname}" link set "${rlo_dev}" master "vrf-${tid}"

	ip -netns "${rtname}" addr add "${gw_addr_v6}/128" \
		dev "${rlo_dev}" nodad
	ip -netns "${rtname}" addr add "${gw_addr_v4}/32" \
		dev "${rlo_dev}"

	ip -netns "${rtname}" link set "${rlo_dev}" up

	# default blackhole routes in the VRF: any traffic that does not match
	# a specific route is dropped. Without the "lookup" attribute on the
	# encap route, the route for the first SID cannot be found from within
	# the VRF.
	ip -netns "${rtname}" -6 route add blackhole default metric 4278198272 \
		vrf "vrf-${tid}"
	ip -netns "${rtname}" -4 route add blackhole default metric 4278198272 \
		vrf "vrf-${tid}"
}

# Configure a one-way VPN path towards hsdst (on rtdst) for tenant tid.
# The encap side is set up on rtsrc and the decap side on rtdst.
# args:
#  $1 - router id where the encap side is set up
#  $2 - host id of the destination host
#  $3 - router id of the destination router (connected to the destination host)
#  $4 - tenant id
setup_vpn_config()
{
	local rtsrc="$1"
	local hsdst="$2"
	local rtdst="$3"
	local tid="$4"
	local rtveth="veth-t${tid}"
	local rtsrc_name
	local rtdst_name
	local vpn_sid

	rtsrc_name="$(get_rt_nsname "${rtsrc}")"
	rtdst_name="$(get_rt_nsname "${rtdst}")"
	vpn_sid="$(build_vpn_sid "${rtsrc}" "${rtdst}" "${tid}")"

	ip -netns "${rtsrc_name}" -6 neigh add proxy \
		"${IPv6_HS_NETWORK}::${hsdst}" dev "${rtveth}"
	set_host_encap_route "${rtsrc}" "${hsdst}" "${vpn_sid}" "${tid}"

	ip -netns "${rtsrc_name}" -6 route add "${vpn_sid}/128" \
		table "${UNDERLAY_TABLE_ID}" \
		via "fd00::${rtdst}" dev veth0

	# set the decap route for decapsulating packets arriving from rtsrc
	# and destined to hsdst
	ip -netns "${rtdst_name}" -6 route add "${vpn_sid}/128" \
		table "${LOCALSID_TABLE_ID}" \
		encap seg6local action End.DT46 \
		vrftable "${tid}" dev "vrf-${tid}"

	# all SIDs for VPNs start with a common locator which is fc00::/16.
	# Routes for handling the SRv6 End.DT* behavior instances are grouped
	# together in the 'localsid' table.
	#
	# NOTE: added only once
	if ! ip -netns "${rtdst_name}" -6 rule show | \
	    grep -q "to ${VPN_LOCATOR_SERVICE}::/16 lookup ${LOCALSID_TABLE_ID}"; then
		ip -netns "${rtdst_name}" -6 rule add \
			to "${VPN_LOCATOR_SERVICE}::/16" \
			lookup "${LOCALSID_TABLE_ID}" prio 999
	fi
}

# Configure rtsrc to reach rtdst's loopback address through the VPN.
# args:
#  $1 - router id where the encap route is installed
#  $2 - router id whose loopback is the destination
#  $3 - tenant id
setup_vpn_gw_encap()
{
	local rtsrc="$1"
	local rtdst="$2"
	local tid="$3"
	local sid

	sid="$(build_vpn_sid "${rtsrc}" "${rtdst}" "${tid}")"

	set_gw_encap_route "${rtsrc}" "${rtdst}" "${sid}" "${tid}"
}

setup()
{
	ip link add veth-rt-1 type veth peer name veth-rt-2
	setup_ns rt_1 rt_2
	setup_rt_networking 1
	setup_rt_networking 2

	# setup two hosts for the tenant 100.
	#  - host hs-t100-1 is directly connected to the router rt-1;
	#  - host hs-t100-2 is directly connected to the router rt-2.
	setup_ns hs_t100_1 hs_t100_2
	setup_hs 1 1 100
	setup_hs 2 2 100

	# setup two hosts for the tenant 200.
	#  - host hs-t200-3 is directly connected to the router rt-1;
	#  - host hs-t200-4 is directly connected to the router rt-2.
	setup_ns hs_t200_3 hs_t200_4
	setup_hs 3 1 200
	setup_hs 4 2 200

	# configure each router for each tenant: VRF, blackhole routes,
	# router loopback interface
	setup_rt 1 100
	setup_rt 2 100
	setup_rt 1 200
	setup_rt 2 200

	# setup the L3 VPN which connects the host hs-t100-1 and host hs-t100-2
	# within the same tenant 100.
	setup_vpn_config 1 2 2 100
	setup_vpn_config 2 1 1 100

	# setup the L3 VPN which connects the host hs-t200-3 and host hs-t200-4
	# within the same tenant 200.
	setup_vpn_config 1 4 2 200
	setup_vpn_config 2 3 1 200

	# allow each router to reach the other's loopback through the VPN
	setup_vpn_gw_encap 2 1 100
	setup_vpn_gw_encap 1 2 100
	setup_vpn_gw_encap 2 1 200
	setup_vpn_gw_encap 1 2 200

	# testing environment was set up successfully
	SETUP_ERR=0
}

check_rt_connectivity()
{
	local rtsrc="$1"
	local rtdst="$2"
	local nsname

	nsname="$(get_rt_nsname "${rtsrc}")"

	ip netns exec "${nsname}" ping -c 1 -W 1 "${IPv6_RT_NETWORK}::${rtdst}" \
		>/dev/null 2>&1
}

check_and_log_rt_connectivity()
{
	local rtsrc="$1"
	local rtdst="$2"

	check_rt_connectivity "${rtsrc}" "${rtdst}"
	log_test $? 0 "Routers connectivity: rt-${rtsrc} -> rt-${rtdst}"
}

check_hs_ipv6_connectivity()
{
	local hssrc="$1"
	local hsdst="$2"
	local tid="$3"
	local nsname

	nsname="$(get_hs_nsname "${tid}" "${hssrc}")"

	ip netns exec "${nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
		"${IPv6_HS_NETWORK}::${hsdst}" >/dev/null 2>&1
}

check_hs_ipv4_connectivity()
{
	local hssrc="$1"
	local hsdst="$2"
	local tid="$3"
	local nsname

	nsname="$(get_hs_nsname "${tid}" "${hssrc}")"

	ip netns exec "${nsname}" ping -c 1 -W "${PING_TIMEOUT_SEC}" \
		"${IPv4_HS_NETWORK}.${hsdst}" >/dev/null 2>&1
}

check_and_log_hs_connectivity()
{
	local hssrc="$1"
	local hsdst="$2"
	local tid="$3"

	check_hs_ipv6_connectivity "${hssrc}" "${hsdst}" "${tid}"
	log_test $? 0 "IPv6 connectivity: hs-t${tid}-${hssrc} -> hs-t${tid}-${hsdst} (tenant ${tid})"

	check_hs_ipv4_connectivity "${hssrc}" "${hsdst}" "${tid}"
	log_test $? 0 "IPv4 connectivity: hs-t${tid}-${hssrc} -> hs-t${tid}-${hsdst} (tenant ${tid})"
}

check_and_log_hs_isolation()
{
	local hssrc="$1"
	local tidsrc="$2"
	local hsdst="$3"
	local tiddst="$4"

	check_hs_ipv6_connectivity "${hssrc}" "${hsdst}" "${tidsrc}"
	log_test $? 1 "IPv6 isolation: hs-t${tidsrc}-${hssrc} -X-> hs-t${tiddst}-${hsdst}"

	check_hs_ipv4_connectivity "${hssrc}" "${hsdst}" "${tidsrc}"
	log_test $? 1 "IPv4 isolation: hs-t${tidsrc}-${hssrc} -X-> hs-t${tiddst}-${hsdst}"
}

check_and_log_hs2gw_connectivity()
{
	local hssrc="$1"
	local tid="$2"

	check_hs_ipv6_connectivity "${hssrc}" 254 "${tid}"
	log_test $? 0 "IPv6 connectivity: hs-t${tid}-${hssrc} -> gw (tenant ${tid})"

	check_hs_ipv4_connectivity "${hssrc}" 254 "${tid}"
	log_test $? 0 "IPv4 connectivity: hs-t${tid}-${hssrc} -> gw (tenant ${tid})"
}

router_tests()
{
	log_section "IPv6 routers connectivity test"

	check_and_log_rt_connectivity 1 2
	check_and_log_rt_connectivity 2 1
}

host2gateway_tests()
{
	log_section "Connectivity test among hosts and gateway"

	check_and_log_hs2gw_connectivity 1 100
	check_and_log_hs2gw_connectivity 2 100

	check_and_log_hs2gw_connectivity 3 200
	check_and_log_hs2gw_connectivity 4 200
}

host_vpn_tests()
{
	log_section "SRv6 VPN connectivity test among hosts in the same tenant"

	check_and_log_hs_connectivity 1 2 100
	check_and_log_hs_connectivity 2 1 100

	check_and_log_hs_connectivity 3 4 200
	check_and_log_hs_connectivity 4 3 200
}

host_vpn_isolation_tests()
{
	local l1="1 2"
	local l2="3 4"
	local t1=100
	local t2=200
	local i
	local j
	local tmp

	log_section "SRv6 VPN isolation test among hosts in different tenants"

	for _ in 0 1; do
		for i in ${l1}; do
			for j in ${l2}; do
				check_and_log_hs_isolation "${i}" "${t1}" "${j}" "${t2}"
			done
		done

		# let us test the reverse path
		tmp="${l1}"; l1="${l2}"; l2="${tmp}"
		tmp=${t1}; t1=${t2}; t2=${tmp}
	done
}

__test_nolookup()
{
	local hssrc="$1"
	local hsdst="$2"
	local rtsrc="$3"
	local rtdst="$4"
	local tid="$5"
	local vpn_sid

	vpn_sid="$(build_vpn_sid "${rtsrc}" "${rtdst}" "${tid}")"

	# replace encap route(s) without "lookup" attribute
	set_host_encap_route_nolookup "${rtsrc}" "${hsdst}" "${vpn_sid}" "${tid}"

	check_hs_ipv6_connectivity "${hssrc}" "${hsdst}" "${tid}"
	log_test $? 1 "IPv6 w/o lookup: hs-t${tid}-${hssrc} -X-> hs-t${tid}-${hsdst} (tenant ${tid})"

	check_hs_ipv4_connectivity "${hssrc}" "${hsdst}" "${tid}"
	log_test $? 1 "IPv4 w/o lookup: hs-t${tid}-${hssrc} -X-> hs-t${tid}-${hsdst} (tenant ${tid})"

	# restore encap route(s) with "lookup" for subsequent tests
	set_host_encap_route "${rtsrc}" "${hsdst}" "${vpn_sid}" "${tid}"
}

host_vpn_nolookup_tests()
{
	log_section "SRv6 VPN connectivity test among hosts w/o lookup"

	__test_nolookup 1 2 1 2 100
	__test_nolookup 2 1 2 1 100

	__test_nolookup 3 4 1 2 200
	__test_nolookup 4 3 2 1 200
}

check_gw_ipv6_connectivity()
{
	local rtsrc="$1"
	local rtdst="$2"
	local tidsrc="$3"
	local tiddst="$4"
	local rtname
	local src_v6
	local dst_v6

	rtname="$(get_rt_nsname "${rtsrc}")"
	src_v6="${IPv6_HS_NETWORK}::$(get_rlo_hostid "${rtsrc}" "${tidsrc}")"
	dst_v6="${IPv6_HS_NETWORK}::$(get_rlo_hostid "${rtdst}" "${tiddst}")"

	ip netns exec "${rtname}" ip vrf exec "vrf-${tidsrc}" \
		ping -c 1 -W "${PING_TIMEOUT_SEC}" \
		-I "${src_v6}" "${dst_v6}" >/dev/null 2>&1
}

check_gw_ipv4_connectivity()
{
	local rtsrc="$1"
	local rtdst="$2"
	local tidsrc="$3"
	local tiddst="$4"
	local rtname
	local src_v4
	local dst_v4

	rtname="$(get_rt_nsname "${rtsrc}")"
	src_v4="${IPv4_HS_NETWORK}.$(get_rlo_hostid "${rtsrc}" "${tidsrc}")"
	dst_v4="${IPv4_HS_NETWORK}.$(get_rlo_hostid "${rtdst}" "${tiddst}")"

	ip netns exec "${rtname}" ip vrf exec "vrf-${tidsrc}" \
		ping -c 1 -W "${PING_TIMEOUT_SEC}" \
		-I "${src_v4}" "${dst_v4}" >/dev/null 2>&1
}

check_and_log_gw_connectivity()
{
	local rtsrc="$1"
	local rtdst="$2"
	local tid="$3"

	check_gw_ipv6_connectivity "${rtsrc}" "${rtdst}" "${tid}" "${tid}"
	log_test $? 0 "IPv6 connectivity: rt-${rtsrc} -> rt-${rtdst} (tenant ${tid})"

	check_gw_ipv4_connectivity "${rtsrc}" "${rtdst}" "${tid}" "${tid}"
	log_test $? 0 "IPv4 connectivity: rt-${rtsrc} -> rt-${rtdst} (tenant ${tid})"
}

check_and_log_gw_isolation()
{
	local rtsrc="$1"
	local rtdst="$2"
	local tidsrc="$3"
	local tiddst="$4"

	check_gw_ipv6_connectivity "${rtsrc}" "${rtdst}" "${tidsrc}" "${tiddst}"
	log_test $? 1 "IPv6 isolation: rt-${rtsrc} -X-> rt-${rtdst} (tenants ${tidsrc}/${tiddst})"

	check_gw_ipv4_connectivity "${rtsrc}" "${rtdst}" "${tidsrc}" "${tiddst}"
	log_test $? 1 "IPv4 isolation: rt-${rtsrc} -X-> rt-${rtdst} (tenants ${tidsrc}/${tiddst})"
}

gw_vpn_isolation_tests()
{
	log_section "SRv6 VPN isolation test among routers in different tenants"

	check_and_log_gw_isolation 1 2 100 200
	check_and_log_gw_isolation 2 1 100 200

	check_and_log_gw_isolation 1 2 200 100
	check_and_log_gw_isolation 2 1 200 100
}

gw_vpn_tests()
{
	log_section "SRv6 VPN connectivity test among routers in the same tenant"

	check_and_log_gw_connectivity 1 2 100
	check_and_log_gw_connectivity 2 1 100

	check_and_log_gw_connectivity 1 2 200
	check_and_log_gw_connectivity 2 1 200
}

__test_gw_nolookup()
{
	local rtsrc="$1"
	local rtdst="$2"
	local tid="$3"
	local sid

	sid="$(build_vpn_sid "${rtsrc}" "${rtdst}" "${tid}")"

	# replace gw encap route without "lookup" attribute
	set_gw_encap_route_nolookup "${rtsrc}" "${rtdst}" "${sid}" "${tid}"

	check_gw_ipv6_connectivity "${rtsrc}" "${rtdst}" "${tid}" "${tid}"
	log_test $? 1 "IPv6 w/o lookup: rt-${rtsrc} -X-> rt-${rtdst} (tenant ${tid})"

	check_gw_ipv4_connectivity "${rtsrc}" "${rtdst}" "${tid}" "${tid}"
	log_test $? 1 "IPv4 w/o lookup: rt-${rtsrc} -X-> rt-${rtdst} (tenant ${tid})"

	# restore gw encap route with "lookup" for subsequent tests
	set_gw_encap_route "${rtsrc}" "${rtdst}" "${sid}" "${tid}"
}

gw_vpn_nolookup_tests()
{
	log_section "SRv6 VPN connectivity test among routers w/o lookup"

	__test_gw_nolookup 1 2 100
	__test_gw_nolookup 2 1 100

	__test_gw_nolookup 1 2 200
	__test_gw_nolookup 2 1 200
}

test_command_or_ksft_skip()
{
	local cmd="$1"

	if [ ! -x "$(command -v "${cmd}")" ]; then
		echo "SKIP: Could not run test without \"${cmd}\" tool"
		exit "${ksft_skip}"
	fi
}

test_vrf_or_ksft_skip()
{
	modprobe vrf &>/dev/null || true
	if [ ! -e /proc/sys/net/vrf/strict_mode ]; then
		echo "SKIP: vrf sysctl does not exist"
		exit "${ksft_skip}"
	fi
}

test_dummy_dev_or_ksft_skip()
{
	local test_netns

	setup_ns test_netns

	modprobe dummy &>/dev/null || true
	if ! ip -netns "${test_netns}" link add "${DUMMY_DEVNAME}" \
			type dummy; then
		cleanup_ns "${test_netns}"
		echo "SKIP: dummy dev not supported"
		exit "${ksft_skip}"
	fi

	cleanup_ns "${test_netns}"
}

test_encap_lookup_supp_or_ksft_skip()
{
	local nsname

	setup_ns nsname

	ip -netns "${nsname}" link add "${DUMMY_DEVNAME}" type dummy
	ip -netns "${nsname}" link set "${DUMMY_DEVNAME}" up

	if ! ip -netns "${nsname}" -6 route add "${IPv6_TESTS_ADDR}/128" \
			encap seg6 mode encap segs fc00::1 \
			lookup "${TESTS_TABLE_ID}" \
			dev "${DUMMY_DEVNAME}" 2>/dev/null; then
		cleanup_ns "${nsname}"
		echo "SKIP: seg6 encap lookup attribute not supported"
		exit "${ksft_skip}"
	fi

	# An old kernel with a recent iproute2 accepts the route but
	# silently ignores the lookup attribute. Dump the route and check
	# the attribute is really there, otherwise the test falsely passes.
	if ! ip -netns "${nsname}" -6 route show "${IPv6_TESTS_ADDR}/128" | \
			grep -q "lookup ${TESTS_TABLE_ID}"; then
		cleanup_ns "${nsname}"
		echo "SKIP: seg6 encap lookup attribute not supported"
		exit "${ksft_skip}"
	fi

	cleanup_ns "${nsname}"
}

if [ "$(id -u)" -ne 0 ]; then
	echo "SKIP: Need root privileges"
	exit "${ksft_skip}"
fi

# required programs to carry out this selftest
test_command_or_ksft_skip ip
test_command_or_ksft_skip ping
test_command_or_ksft_skip sysctl
test_command_or_ksft_skip grep

test_dummy_dev_or_ksft_skip
test_vrf_or_ksft_skip
test_encap_lookup_supp_or_ksft_skip

set -e
trap cleanup EXIT

setup
set +e

router_tests
host2gateway_tests
host_vpn_tests
host_vpn_isolation_tests
host_vpn_nolookup_tests
gw_vpn_tests
gw_vpn_isolation_tests
gw_vpn_nolookup_tests

print_log_test_results