Lines Matching +full:ip +full:- +full:block
2 # SPDX-License-Identifier: GPL-2.0
8 # ns1 ---- ns3 ----- ns4 ---- ns2
21 # Kselftest framework requirement - SKIP code is 4.
39 …ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tu…
41 …ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tu…
53 …ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in enc aes $KEY_AES auth sha1 …
54 …ip -net $ns xfrm state add src $me dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 …
61 # re-built.
76 ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
79 ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
82 ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
87 # also has to be merged too, including source-sorted subtrees.
98 # the sub-tree. As no duplicates are allowed, policies in
108 ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
113 …ip -net $ns xfrm policy add src 10.253.1.$((RANDOM%255))/$p dst 10.254.1.$((RANDOM%255))/$p dir fw…
123 ip -net $ns xfrm policy get src $lnet dst $rnet dir out > /dev/null
124 if [ $? -ne 0 ] && [ $policy_checks_ok -eq 1 ] ;then
126 echo "FAIL: ip -net $ns xfrm policy get src $lnet dst $rnet dir out"
130 ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd > /dev/null
131 if [ $? -ne 0 ] && [ $policy_checks_ok -eq 1 ] ;then
133 echo "FAIL: ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd"
146 ip -net $ns xfrm policy add dst $plain dir out priority 10 action allow
149 …ip -net $ns xfrm policy add dst $encryptip dir out tmpl src $me dst $remote proto esp mode tunnel …
158 echo netns exec $ns ip xfrm policy add src 0.0.0.0/0 dst 10.$i.99.0/30 dir out action block
159 echo netns exec $ns ip xfrm policy add src 10.$i.99.0/30 dst 0.0.0.0/0 dir out action block
161 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/30 dst 10.$i.$j.0/30 dir out action block
163 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/29 dst 10.$i.$j.0/29 dir out action block
165 … echo netns exec $ns ip xfrm policy add src 10.$i.1.0/24 dst 10.$i.$j.0/24 dir out action block
166 … echo netns exec $ns ip xfrm policy add src 10.$i.$j.0/24 dst 10.$i.1.0/24 dir fwd action block
168 done | ip -batch /dev/stdin
176 … echo netns exec $ns ip xfrm policy add src dead:$i::/64 dst dead:$i:$j::/64 dir out action block
177 … echo netns exec $ns ip xfrm policy add src dead:$i:$j::/64 dst dead:$i::/24 dir fwd action block
179 done | ip -batch /dev/stdin
186 ip netns exec $ns iptables-save -c |grep policy | ( read c rest
187 ip netns exec $ns iptables -Z
201 # 0: iptables -m policy rule count == 0
202 # 1: iptables -m policy rule count != 0
204 ip=$2
207 ip netns exec ns1 ping -q -c 1 10.0.2.$ip > /dev/null
210 if [ $? -ne $rval ] ; then
214 if [ $? -ne $rval ] ; then
218 ip netns exec ns2 ping -q -c 1 10.0.1.$ip > /dev/null
221 if [ $? -ne $rval ] ; then
225 if [ $? -ne $rval ] ; then
239 if [ $? -ne 0 ]; then
248 if [ $? -ne 0 ]; then
257 if [ $? -ne 0 ]; then
273 …ip -net ns1 xfrm policy update src e000:0001::0000 dst ff01::0014:0000:0001 dir in tmpl src :: dst…
274 ip -net ns1 xfrm policy set hthresh6 0 28 || break
276 …ip -net ns1 xfrm policy update src e000:0001::0000 dst ff01::01 dir in tmpl src :: dst :: proto es…
277 ip -net ns1 xfrm policy set hthresh6 0 28 || break
280 if [ $i -ne 10 ] ;then
291 if [ "$(id -u)" -ne 0 ];then
296 ip -Version 2>/dev/null >/dev/null
297 if [ $? -ne 0 ];then
298 echo "SKIP: Could not run test without the ip tool"
303 iptables --version 2>/dev/null >/dev/null
304 if [ $? -ne 0 ];then
310 ip netns add ns$i
311 ip -net ns$i link set lo up
315 ip link add $DEV netns ns1 type veth peer name eth1 netns ns3
316 ip link add $DEV netns ns2 type veth peer name eth1 netns ns4
318 ip link add $DEV netns ns3 type veth peer name veth0 netns ns4
322 ip -net ns$i link set $DEV up
323 ip -net ns$i addr add 10.0.$i.2/24 dev $DEV
324 ip -net ns$i addr add dead:$i::2/64 dev $DEV
326 ip -net ns$i addr add 10.0.$i.253 dev $DEV
327 ip -net ns$i addr add 10.0.$i.254 dev $DEV
328 ip -net ns$i addr add dead:$i::fd dev $DEV
329 ip -net ns$i addr add dead:$i::fe dev $DEV
333 ip -net ns$i link set eth1 up
334 ip -net ns$i link set veth0 up
337 ip -net ns1 route add default via 10.0.1.1
338 ip -net ns2 route add default via 10.0.2.1
340 ip -net ns3 addr add 10.0.1.1/24 dev eth1
341 ip -net ns3 addr add 10.0.3.1/24 dev veth0
342 ip -net ns3 addr add 2001:1::1/64 dev eth1
343 ip -net ns3 addr add 2001:3::1/64 dev veth0
345 ip -net ns3 route add default via 10.0.3.10
347 ip -net ns4 addr add 10.0.2.1/24 dev eth1
348 ip -net ns4 addr add 10.0.3.10/24 dev veth0
349 ip -net ns4 addr add 2001:2::1/64 dev eth1
350 ip -net ns4 addr add 2001:3::10/64 dev veth0
351 ip -net ns4 route add default via 10.0.3.1
355 ip netns exec ns$i sysctl net.ipv$j.conf.eth1.forwarding=1 > /dev/null
356 ip netns exec ns$i sysctl net.ipv$j.conf.veth0.forwarding=1 > /dev/null
361 ip netns exec ns3 iptables -p icmp -A FORWARD -m policy --dir out --pol ipsec
362 ip netns exec ns4 iptables -p icmp -A FORWARD -m policy --dir out --pol ipsec
363 if [ $? -ne 0 ];then
365 for i in 1 2 3 4;do ip netns del ns$i;done
385 if [ $? -ne 0 ]; then
401 if [ $? -ne 0 ]; then
405 # insert block policies with adjacent/overlapping netmasks
408 check_exceptions "exceptions and block policies"
409 if [ $? -ne 0 ]; then
414 ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
418 check_exceptions "exceptions and block policies after hresh changes"
421 ip -net ns3 xfrm policy flush
427 ip -net ns3 xfrm policy set hthresh4 16 16
430 check_exceptions "exceptions and block policies after hthresh change in ns3"
432 # restore original hthresh settings -- move policies back to tables
434 ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128
437 check_exceptions "exceptions and block policies after htresh change to normal"
441 for i in 1 2 3 4;do ip netns del ns$i;done