#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# Run traceroute/traceroute6 tests
#

source lib.sh
VERBOSE=0
PAUSE_ON_FAIL=no

################################################################################
#
run_cmd()
{
	local ns
	local cmd
	local out
	local rc

	ns="$1"
	shift
	cmd="$*"

	if [ "$VERBOSE" = "1" ]; then
		printf "    COMMAND: $cmd\n"
	fi

	out=$(eval ip netns exec ${ns} ${cmd} 2>&1)
	rc=$?
	if [ "$VERBOSE" = "1" -a -n "$out" ]; then
		echo "    $out"
	fi

	[ "$VERBOSE" = "1" ] && echo

	return $rc
}

################################################################################
# create namespaces and interconnects

create_ns()
{
	local ns=$1
	local addr=$2
	local addr6=$3

	[ -z "${addr}" ] && addr="-"
	[ -z "${addr6}" ] && addr6="-"

	if [ "${addr}" != "-" ]; then
		ip netns exec ${ns} ip addr add dev lo ${addr}
	fi
	if [ "${addr6}" != "-" ]; then
		ip netns exec ${ns} ip -6 addr add dev lo ${addr6}
	fi

	ip netns exec ${ns} ip ro add unreachable default metric 8192
	ip netns exec ${ns} ip -6 ro add unreachable default metric 8192

	ip netns exec ${ns} sysctl -qw net.ipv4.ip_forward=1
	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
}

# create veth pair to connect namespaces and apply addresses.
connect_ns()
{
	local ns1=$1
	local ns1_dev=$2
	local ns1_addr=$3
	local ns1_addr6=$4
	local ns2=$5
	local ns2_dev=$6
	local ns2_addr=$7
	local ns2_addr6=$8

	ip netns exec ${ns1} ip li add ${ns1_dev} type veth peer name tmp
	ip netns exec ${ns1} ip li set ${ns1_dev} up
	ip netns exec ${ns1} ip li set tmp netns ${ns2} name ${ns2_dev}
	ip netns exec ${ns2} ip li set ${ns2_dev} up

	if [ "${ns1_addr}" != "-" ]; then
		ip netns exec ${ns1} ip addr add dev ${ns1_dev} ${ns1_addr}
	fi

	if [ "${ns2_addr}" != "-" ]; then
		ip netns exec ${ns2} ip addr add dev ${ns2_dev} ${ns2_addr}
	fi

	if [ "${ns1_addr6}" != "-" ]; then
		ip netns exec ${ns1} ip addr add dev ${ns1_dev} ${ns1_addr6}
	fi

	if [ "${ns2_addr6}" != "-" ]; then
		ip netns exec ${ns2} ip addr add dev ${ns2_dev} ${ns2_addr6}
	fi
}

################################################################################
# traceroute6 test
#
# Verify that in this scenario
#
#        ------------------------ N2
#         |                    |
#       ------              ------  N3  ----
#       | R1 |              | R2 |------|H2|
#       ------              ------      ----
#         |                    |
#        ------------------------ N1
#                  |
#                 ----
#                 |H1|
#                 ----
#
# where H1's default route goes through R1 and R1's default route goes
# through R2 over N2, traceroute6 from H1 to H2 reports R2's address
# on N2 and not N1.
#
# Addresses are assigned as follows:
#
# N1: 2000:101::/64
# N2: 2000:102::/64
# N3: 2000:103::/64
#
# R1's host part of address: 1
# R2's host part of address: 2
# H1's host part of address: 3
# H2's host part of address: 4
#
# For example:
# the IPv6 address of R1's interface on N2 is 2000:102::1/64

cleanup_traceroute6()
{
	cleanup_ns $h1 $h2 $r1 $r2
}

setup_traceroute6()
{
	brdev=br0

	# start clean
	cleanup_traceroute6

	set -e
	setup_ns h1 h2 r1 r2
	create_ns $h1
	create_ns $h2
	create_ns $r1
	create_ns $r2

	# Setup N3
	connect_ns $r2 eth3 - 2000:103::2/64 $h2 eth3 - 2000:103::4/64
	ip netns exec $h2 ip route add default via 2000:103::2

	# Setup N2
	connect_ns $r1 eth2 - 2000:102::1/64 $r2 eth2 - 2000:102::2/64
	ip netns exec $r1 ip route add default via 2000:102::2

	# Setup N1. host-1 and router-2 connect to a bridge in router-1.
	ip netns exec $r1 ip link add name ${brdev} type bridge
	ip netns exec $r1 ip link set ${brdev} up
	ip netns exec $r1 ip addr add 2000:101::1/64 dev ${brdev}

	connect_ns $h1 eth0 - 2000:101::3/64 $r1 eth0 - -
	ip netns exec $r1 ip link set dev eth0 master ${brdev}
	ip netns exec $h1 ip route add default via 2000:101::1

	connect_ns $r2 eth1 - 2000:101::2/64 $r1 eth1 - -
	ip netns exec $r1 ip link set dev eth1 master ${brdev}

	# Prime the network
	ip netns exec $h1 ping6 -c5 2000:103::4 >/dev/null 2>&1

	set +e
}

run_traceroute6()
{
	setup_traceroute6

	RET=0

	# traceroute6 host-2 from host-1 (expects 2000:102::2)
	run_cmd $h1 "traceroute6 2000:103::4 | grep -q 2000:102::2"
	check_err $? "traceroute6 did not return 2000:102::2"
	log_test "IPv6 traceroute"

	cleanup_traceroute6
}

################################################################################
# traceroute6 with VRF test
#
# Verify that in this scenario
#
#        ------------------------ N2
#         |                    |
#       ------              ------  N3  ----
#       | R1 |              | R2 |------|H2|
#       ------              ------      ----
#         |                    |
#        ------------------------ N1
#                  |
#                 ----
#                 |H1|
#                 ----
#
# Where H1's default route goes through R1 and R1's default route goes through
# R2 over N2, traceroute6 from H1 to H2 reports R2's address on N2 and not N1.
# The interfaces connecting R2 to the different subnets are membmer in a VRF
# and the intention is to check that traceroute6 does not report the VRF's
# address.
#
# Addresses are assigned as follows:
#
# N1: 2000:101::/64
# N2: 2000:102::/64
# N3: 2000:103::/64
#
# R1's host part of address: 1
# R2's host part of address: 2
# H1's host part of address: 3
# H2's host part of address: 4
#
# For example:
# the IPv6 address of R1's interface on N2 is 2000:102::1/64

cleanup_traceroute6_vrf()
{
	cleanup_all_ns
}

setup_traceroute6_vrf()
{
	# Start clean
	cleanup_traceroute6_vrf

	setup_ns h1 h2 r1 r2
	create_ns "$h1"
	create_ns "$h2"
	create_ns "$r1"
	create_ns "$r2"

	ip -n "$r2" link add name vrf100 up type vrf table 100
	ip -n "$r2" addr add 2001:db8:100::1/64 dev vrf100

	# Setup N3
	connect_ns "$r2" eth3 - 2000:103::2/64 "$h2" eth3 - 2000:103::4/64

	ip -n "$r2" link set dev eth3 master vrf100

	ip -n "$h2" route add default via 2000:103::2

	# Setup N2
	connect_ns "$r1" eth2 - 2000:102::1/64 "$r2" eth2 - 2000:102::2/64

	ip -n "$r1" route add default via 2000:102::2

	ip -n "$r2" link set dev eth2 master vrf100

	# Setup N1. host-1 and router-2 connect to a bridge in router-1.
	ip -n "$r1" link add name br100 up type bridge
	ip -n "$r1" addr add 2000:101::1/64 dev br100

	connect_ns "$h1" eth0 - 2000:101::3/64 "$r1" eth0 - -

	ip -n "$h1" route add default via 2000:101::1

	ip -n "$r1" link set dev eth0 master br100

	connect_ns "$r2" eth1 - 2000:101::2/64 "$r1" eth1 - -

	ip -n "$r2" link set dev eth1 master vrf100

	ip -n "$r1" link set dev eth1 master br100

	# Prime the network
	ip netns exec "$h1" ping6 -c5 2000:103::4 >/dev/null 2>&1
}

run_traceroute6_vrf()
{
	setup_traceroute6_vrf

	RET=0

	# traceroute6 host-2 from host-1 (expects 2000:102::2)
	run_cmd "$h1" "traceroute6 2000:103::4 | grep 2000:102::2"
	check_err $? "traceroute6 did not return 2000:102::2"
	log_test "IPv6 traceroute with VRF"

	cleanup_traceroute6_vrf
}

################################################################################
# traceroute test
#
# Verify that traceroute from H1 to H2 shows 1.0.3.1 and 1.0.1.1 when
# traceroute uses 1.0.3.3 and 1.0.1.3 as the source IP, respectively.
#
#      1.0.3.3/24    1.0.3.1/24
# ---- 1.0.1.3/24    1.0.1.1/24 ---- 1.0.2.1/24    1.0.2.4/24 ----
# |H1|--------------------------|R1|--------------------------|H2|
# ----            N1            ----            N2            ----
#
# where net.ipv4.icmp_errors_use_inbound_ifaddr is set on R1 and 1.0.3.1/24 and
# 1.0.1.1/24 are R1's primary addresses on N1. The kernel is expected to prefer
# a source address that is on the same subnet as the destination IP of the ICMP
# error message.

cleanup_traceroute()
{
	cleanup_ns $h1 $h2 $router
}

setup_traceroute()
{
	# start clean
	cleanup_traceroute

	set -e
	setup_ns h1 h2 router
	create_ns $h1
	create_ns $h2
	create_ns $router

	connect_ns $h1 eth0 1.0.1.3/24 - \
	           $router eth1 1.0.3.1/24 -
	ip -n "$h1" addr add 1.0.3.3/24 dev eth0
	ip netns exec $h1 ip route add default via 1.0.1.1

	ip netns exec $router ip addr add 1.0.1.1/24 dev eth1
	ip netns exec $router sysctl -qw \
				net.ipv4.icmp_errors_use_inbound_ifaddr=1

	connect_ns $h2 eth0 1.0.2.4/24 - \
	           $router eth2 1.0.2.1/24 -
	ip netns exec $h2 ip route add default via 1.0.2.1

	# Prime the network
	ip netns exec $h1 ping -c5 1.0.2.4 >/dev/null 2>&1

	set +e
}

run_traceroute()
{
	setup_traceroute

	RET=0

	# traceroute host-2 from host-1. Expect a source IP that is on the same
	# subnet as destination IP of the ICMP error message.
	run_cmd "$h1" "traceroute -s 1.0.1.3 1.0.2.4 | grep -q 1.0.1.1"
	check_err $? "traceroute did not return 1.0.1.1"
	run_cmd "$h1" "traceroute -s 1.0.3.3 1.0.2.4 | grep -q 1.0.3.1"
	check_err $? "traceroute did not return 1.0.3.1"
	log_test "IPv4 traceroute"

	cleanup_traceroute
}

################################################################################
# traceroute with VRF test
#
# Verify that traceroute from H1 to H2 shows 1.0.3.1 and 1.0.1.1 when
# traceroute uses 1.0.3.3 and 1.0.1.3 as the source IP, respectively. The
# intention is to check that the kernel does not choose an IP assigned to the
# VRF device, but rather an address from the VRF port (eth1) that received the
# packet that generates the ICMP error message.
#
#                          1.0.4.1/24 (vrf100)
#      1.0.3.3/24    1.0.3.1/24
# ---- 1.0.1.3/24    1.0.1.1/24 ---- 1.0.2.1/24    1.0.2.4/24 ----
# |H1|--------------------------|R1|--------------------------|H2|
# ----            N1            ----            N2            ----

cleanup_traceroute_vrf()
{
	cleanup_all_ns
}

setup_traceroute_vrf()
{
	# Start clean
	cleanup_traceroute_vrf

	setup_ns h1 h2 router
	create_ns "$h1"
	create_ns "$h2"
	create_ns "$router"

	ip -n "$router" link add name vrf100 up type vrf table 100
	ip -n "$router" addr add 1.0.4.1/24 dev vrf100

	connect_ns "$h1" eth0 1.0.1.3/24 - \
	           "$router" eth1 1.0.1.1/24 -

	ip -n "$h1" addr add 1.0.3.3/24 dev eth0
	ip -n "$h1" route add default via 1.0.1.1

	ip -n "$router" link set dev eth1 master vrf100
	ip -n "$router" addr add 1.0.3.1/24 dev eth1
	ip netns exec "$router" sysctl -qw \
		net.ipv4.icmp_errors_use_inbound_ifaddr=1

	connect_ns "$h2" eth0 1.0.2.4/24 - \
	           "$router" eth2 1.0.2.1/24 -

	ip -n "$h2" route add default via 1.0.2.1

	ip -n "$router" link set dev eth2 master vrf100

	# Prime the network
	ip netns exec "$h1" ping -c5 1.0.2.4 >/dev/null 2>&1
}

run_traceroute_vrf()
{
	setup_traceroute_vrf

	RET=0

	# traceroute host-2 from host-1. Expect a source IP that is on the same
	# subnet as destination IP of the ICMP error message.
	run_cmd "$h1" "traceroute -s 1.0.1.3 1.0.2.4 | grep 1.0.1.1"
	check_err $? "traceroute did not return 1.0.1.1"
	run_cmd "$h1" "traceroute -s 1.0.3.3 1.0.2.4 | grep 1.0.3.1"
	check_err $? "traceroute did not return 1.0.3.1"
	log_test "IPv4 traceroute with VRF"

	cleanup_traceroute_vrf
}

################################################################################
# Run tests

run_tests()
{
	run_traceroute6
	run_traceroute6_vrf
	run_traceroute
	run_traceroute_vrf
}

################################################################################
# main

while getopts :pv o
do
	case $o in
		p) PAUSE_ON_FAIL=yes;;
		v) VERBOSE=$(($VERBOSE + 1));;
		*) exit 1;;
	esac
done

require_command traceroute6
require_command traceroute

run_tests

exit "${EXIT_STATUS}"