selftests: net/fcnal: Test --{force,no}-bind-key-ifindex

Test that applications binding listening sockets to VRFs without
specifying TCP_MD5SIG_FLAG_IFINDEX will work as expected. This would
be broken if __tcp_md5_do_lookup always made a strict comparison on
l3index. See this email:

https://lore.kernel.org/netdev/209548b5-27d2-2059-f2e9-2148f5a0291b@gmail.com/

Applications using tcp_l3mdev_accept=1 and a single global socket (not
bound to any interface) also should have a way to specify keys that are
only for the default VRF, this is done by --force-bind-key-ifindex
without otherwise binding to a device.

Signed-off-by: Leonard Crestez <cdleonard@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index 13350cd5c8ac35ddfbe278145e7bcae264296b88..8e67a252b672f853d8483787553e508b493e3f6c 100755 (executable)
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -289,6 +289,12 @@ set_sysctl()
        run_cmd sysctl -q -w $*
 }
 
+# get sysctl values in NS-A
+get_sysctl()
+{
+       ${NSA_CMD} sysctl -n $*
+}
+
 ################################################################################
 # Setup for tests
 
@@ -1003,6 +1009,60 @@ ipv4_tcp_md5()
        run_cmd nettest -s -I ${NSA_DEV} -M ${MD5_PW} -m ${NS_NET}
        log_test $? 1 "MD5: VRF: Device must be a VRF - prefix"
 
+       test_ipv4_md5_vrf__vrf_server__no_bind_ifindex
+       test_ipv4_md5_vrf__global_server__bind_ifindex0
+}
+
+test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()
+{
+       log_start
+       show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"
+       run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+       sleep 1
+       run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+       log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"
+
+       log_start
+       show_hint "Binding both the socket and the key is not required but it works"
+       run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+       sleep 1
+       run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+       log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"
+}
+
+test_ipv4_md5_vrf__global_server__bind_ifindex0()
+{
+       # This particular test needs tcp_l3mdev_accept=1 for Global server to accept VRF connections
+       local old_tcp_l3mdev_accept
+       old_tcp_l3mdev_accept=$(get_sysctl net.ipv4.tcp_l3mdev_accept)
+       set_sysctl net.ipv4.tcp_l3mdev_accept=1
+
+       log_start
+       run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+       sleep 1
+       run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+       log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"
+
+       log_start
+       run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+       sleep 1
+       run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+       log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"
+       log_start
+
+       run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+       sleep 1
+       run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+       log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"
+
+       log_start
+       run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+       sleep 1
+       run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+       log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
+
+       # restore value
+       set_sysctl net.ipv4.tcp_l3mdev_accept="$old_tcp_l3mdev_accept"
 }
 
 ipv4_tcp_novrf()