1*4882a593Smuzhiyun#!/bin/sh 2*4882a593Smuzhiyun# SPDX-License-Identifier: GPL-2.0 3*4882a593Smuzhiyun# 4*4882a593Smuzhiyun# Run a couple of IP defragmentation tests. 5*4882a593Smuzhiyun 6*4882a593Smuzhiyunset +x 7*4882a593Smuzhiyunset -e 8*4882a593Smuzhiyun 9*4882a593Smuzhiyunmodprobe -q nf_defrag_ipv6 10*4882a593Smuzhiyun 11*4882a593Smuzhiyunreadonly NETNS="ns-$(mktemp -u XXXXXX)" 12*4882a593Smuzhiyun 13*4882a593Smuzhiyunsetup() { 14*4882a593Smuzhiyun ip netns add "${NETNS}" 15*4882a593Smuzhiyun ip -netns "${NETNS}" link set lo up 16*4882a593Smuzhiyun 17*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_high_thresh=9000000 >/dev/null 2>&1 18*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_low_thresh=7000000 >/dev/null 2>&1 19*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_time=1 >/dev/null 2>&1 20*4882a593Smuzhiyun 21*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_high_thresh=9000000 >/dev/null 2>&1 22*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_low_thresh=7000000 >/dev/null 2>&1 23*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_time=1 >/dev/null 2>&1 24*4882a593Smuzhiyun 25*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000 >/dev/null 2>&1 26*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_low_thresh=7000000 >/dev/null 2>&1 27*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_timeout=1 >/dev/null 2>&1 28*4882a593Smuzhiyun 29*4882a593Smuzhiyun # DST cache can get full with a lot of frags, with GC not keeping up with the test. 30*4882a593Smuzhiyun ip netns exec "${NETNS}" sysctl -w net.ipv6.route.max_size=65536 >/dev/null 2>&1 31*4882a593Smuzhiyun} 32*4882a593Smuzhiyun 33*4882a593Smuzhiyuncleanup() { 34*4882a593Smuzhiyun ip netns del "${NETNS}" 35*4882a593Smuzhiyun} 36*4882a593Smuzhiyun 37*4882a593Smuzhiyuntrap cleanup EXIT 38*4882a593Smuzhiyunsetup 39*4882a593Smuzhiyun 40*4882a593Smuzhiyunecho "ipv4 defrag" 41*4882a593Smuzhiyunip netns exec "${NETNS}" ./ip_defrag -4 42*4882a593Smuzhiyun 43*4882a593Smuzhiyunecho "ipv4 defrag with overlaps" 44*4882a593Smuzhiyunip netns exec "${NETNS}" ./ip_defrag -4o 45*4882a593Smuzhiyun 46*4882a593Smuzhiyunecho "ipv6 defrag" 47*4882a593Smuzhiyunip netns exec "${NETNS}" ./ip_defrag -6 48*4882a593Smuzhiyun 49*4882a593Smuzhiyunecho "ipv6 defrag with overlaps" 50*4882a593Smuzhiyunip netns exec "${NETNS}" ./ip_defrag -6o 51*4882a593Smuzhiyun 52*4882a593Smuzhiyun# insert an nf_conntrack rule so that the codepath in nf_conntrack_reasm.c taken 53*4882a593Smuzhiyunip netns exec "${NETNS}" ip6tables -A INPUT -m conntrack --ctstate INVALID -j ACCEPT 54*4882a593Smuzhiyun 55*4882a593Smuzhiyunecho "ipv6 nf_conntrack defrag" 56*4882a593Smuzhiyunip netns exec "${NETNS}" ./ip_defrag -6 57*4882a593Smuzhiyun 58*4882a593Smuzhiyunecho "ipv6 nf_conntrack defrag with overlaps" 59*4882a593Smuzhiyun# netfilter will drop some invalid packets, so we run the test in 60*4882a593Smuzhiyun# permissive mode: i.e. pass the test if the packet is correctly assembled 61*4882a593Smuzhiyun# even if we sent an overlap 62*4882a593Smuzhiyunip netns exec "${NETNS}" ./ip_defrag -6op 63*4882a593Smuzhiyun 64*4882a593Smuzhiyunecho "all tests done" 65