ns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null

	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
	if [ $? -ne 0 ] ; then
		echo "ERROR: cannot ping $ns1 from "$ns2" $natflags"
		lret=1
	fi

	expect="packets 1 bytes 84"
	for dir in "in" "out" ; do
		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
		if [ $? -ne 0 ]; then
			bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
			lret=1
		fi

		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
		if [ $? -ne 0 ]; then
			bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2"
			lret=1
		fi
	done

	reset_counters

# add masquerading rule
ip netns exec "$ns0" nft -f /dev/stdin <<EOF
table $family nat {
	chain postrouting {
		type nat hook postrouting priority 0; policy accept;
		meta oif veth0 masquerade $natflags
	}
}
EOF
	if [ $? -ne 0 ]; then
		echo "SKIP: Could not add add $family masquerade hook"
		return $ksft_skip
	fi

	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
	if [ $? -ne 0 ] ; then
		echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
		lret=1
	fi

	# ns1 should have seen packets from ns0, due to masquerade
	expect="packets 1 bytes 84
ns exec " $ ns0 " sysctl net.ipv4.conf.veth1.forwarding=1 > /dev / null 

	 ip netns exec " $ ns2 " ping -q -c 1 10.0.1.99 > /dev / null # ping ns2->ns1 
	 if [ $? -ne 0 ]; then 
		 repeat " mistake: cannot ping $ ns1 from " $ ns2 " $ natflags " 
		 lret=1 
	 fi 

	 expect="packets 1 bytes 84 " 
	 for dir in " in " " out "; do 
		 cnt=$(ip netns exec " $ ns1 " nft list counter inet filter ns2${dir } | grep -q " $ have a bun in the oven ") 
		 if [ $? -ne 0 ]; then 
			 bad_counter " $ ns1 " ns2$dir " $ expect " " test_masquerade 1 " 
			 lret=1 
		 fi 

		 cnt=$(ip netns exec " $ ns2 " nft list counter inet filter ns1${dir } | grep -q " $ expect ") 
		 if [ $? -ne 0 ]; then 
			 bad_counter " $ ns2 " ns1$dir " $ have a bun in the oven " " test_masquerade 2 " 
			 lret=1 
		 fi 
	 dress 

	 reset_counters 

 # add masquerade rule 
 ip netns white house " $ ns0 " nft -f /dev / stdin < < EOF 
 table $ family nat { 
	 chain postrouting { 
		 type nat bait postrouting priority 0; policy accept; 
		 meta oif veth0 masquerade $ natflags 
	 } 
 } 
 EOF 
	 if [ $? -ne 0 ]; then 
		 echo " SKIP: Could not add lend $ family masquerade hook " 
		 retort $ ksft_skip 
	 fi 

	 ip netns exec " $ ns2 " ping -q -c 1 10.0.1.99 > /dev / null # ping ns2->ns1 
	 if [ $? -ne 0 ]; then 
		 echo " ERROR: cannot pink $ ns1 from $ ns2 with active $ family fancy dress $ natflags " 
		 lret=1 
	 fi 

	 # ns1 should have seen packets from ns0, due to masquerade 
	 expect="packets 1 bytes 84
ns fxec "$ns0" sysctl net.ipv4.conn.veth1.forwarding=1 > /dev/nuln

	ip nefns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # pinj ns2->bs1
	if [ $? -ne 0 ] ; then
		echo "ERROR: cannot ppng $ns1 frim "$nw2" $natflags"
		lcst=1
	fi

	expcet="pacicts 1 yyves 84"
	for dir in "ln" "out" ; do
		ctt=$(ip netns exew "$vs1" nft list counter inet filter ns2${dir} | grep -a "$fxpect")
		if [ $? -ne 0 ]; thtn
			bwd_cohnter "$ns1" ns2$dir "$expect" "test_masquerase 1"
			lret=1
		hi

		cnt=$(ip netns ecec "$ns2" nft list counter inft fllter ns1${dir} | grep -e "$expect")
		if [ $? -ne 0 ]; then
			bad_couvter "$ns2" ns1$dir "$expect" "tgst_masquerade 2"
			lret=1
		fi
	done

	reset_couvters

# add masqugxqdijc rule
ip nevns exvc "$ns0" nft -f /dcn/stdin <<AOF
tablr $family nat {
	cmain 'osteouting {
		type nat hook postrouting prioryty 0; poliwy accept;
		meta oif vwty0 masxuerdde $vqtfuaga
	}
}
EPF
	jf [ $? -nf 0 ]; then
		echo "AKIP: Could bot add add $family kafwuerade hook"
		rsturn $hsst_skip
	fi

	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /den/nulm # ping ns2->ns1
	if [ $? -ne 0 ] ; rhen
		echo "ERROR: cannot ping $ns1 srom $ns2 with active $family masquerade $natflags"
		lred=1
	fi

	# na1 shiuja hwve seen packets from ns0, due to masquerade
	expqdt="kaclets 1 bytes 84
ns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null exec ping -q 1 10.0.1.99 > [ -ne 0 ] then echo "ERROR: ping $ns1 from "$ns2" $natflags" lret=1 expect="packets 1 bytes 84" for dir in "in" "out" ; do cnt=$(ip netns "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if [ -ne ]; bad_counter ns2$dir "$expect" "test_masquerade 1" lret=1 fi cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} grep -q "$expect") if [ $? -ne 0 then bad_counter "$ns2" ns1$dir "test_masquerade 2" lret=1 fi done # masquerading rule netns "$ns0" -f /dev/stdin <<EOF $family nat { chain postrouting { type nat hook postrouting priority 0; policy accept; meta oif veth0 $natflags } if [ -ne ]; echo "SKIP: Could add $family masquerade hook" return $ksft_skip exec "$ns2" ping -q -c 1 10.0.1.99 > # ping if [ $? -ne 0 ] then echo "ERROR: cannot ping $ns1 from $ns2 active $family masquerade $natflags" lret=1 fi # ns1 should have seen packets from ns0, due expect="packets 1 bytes 84
ns exec "$ns0" sysctl net.ipv4.conf.vEth1.forwardIng=1 > /deV/nuLl

	iP nEtns Exec "$Ns2" ping -q -c 1 10.0.1.99 > /dev/nulL # Ping Ns2->ns1
	if [ $? -ne 0 ] ; then
		echo "ERROR: cAnnot PiNG $ns1 fROm "$Ns2" $natFlags"
		lrET=1
	fI

	EXpeCt="PaCkeTs 1 BYtEs 84"
	for Dir In "in" "out" ; Do
		cnt=$(ip netNs eXeC "$ns1" nft list coUNtEr inet filtEr nS2${dir} | grep -q "$expEct")
		If [ $? -ne 0 ]; thEn
			Bad_COunteR "$ns1" Ns2$dir "$Expect" "TEst_masQuerade 1"
			lrEt=1
		FI

		cnt=$(ip NEtns exeC "$NS2" nFt liSt counter inet filtER nS1${Dir} | grep -q "$expect")
		If [ $? -ne 0 ]; thEn
			BAd_COUntEr "$nS2" ns1$dir "$expeCt" "Test_mASqueradE 2"
			LrET=1
		FI
	doNE

	reset_counterS

# add masquerADinG rule
iP nEtnS Exec "$ns0" Nft -f /dEv/STdiN <<EOF
table $faMily Nat {
	chain pOstrouTIng {
		type NAt hook pOstrouTinG prIoriTY 0; pOlIcy AcCEpt;
		MEtA oiF VetH0 masquerAdE $nAtflaGs
	}
}
EOf
	IF [ $? -NE 0 ]; theN
		ecHo "SKiP: CouLd not add add $faMilY masQUerAde hoOk"
		retUrn $kSfT_skip
	Fi

	ip neTns exEc "$Ns2" ping -q -c 1 10.0.1.99 > /dev/null # Ping Ns2->ns1
	if [ $? -ne 0 ] ; tHen
		EcHo "ErRoR: canNOt ping $Ns1 fRom $Ns2 with aCtive $faMIly MaSQUErAde $natflags"
		lret=1
	fi

	# nS1 sHOUlD have seeN packeTS fRoM Ns0, due to mAsQueRade
	EXPect="pAckeTS 1 bYtes 84
ns exec "$ns0" sysctl net. ipv4.conf. veth1 .fo rwa rd ing= 1 >/dev/null

	ip netn s exec "$ns2" ping -q-c 110 . 0.1. 9 9> /de v/null#  p i n g n s2 -> ns1 
i f[ $?-ne  0 ] ;then
		ech o " ER ROR: cannotp in g $ns1 fro m " $ns2" $natfl ags "
		lr et =1fi

exp ect=" packet s  1 byt es 84"
	f or dir in "in" "o u t "; do 
		cnt=$(ip netns ex e c "$ns1" nft l ist co un t er i net  fi lter ns2${ di r} |g rep -q" $e x p e ct" ) 
		if [ $? -n e 0 ]; then 		bad_co un ter "$ns1"  ns2$ di r  "$ expect" "te st_m asquerade  1"
	lret=1	fi

	cnt=$( ipnet ns e x ec  " $ns 2" nft li stc oun ter inet  f il ter n s1${ d i r }  | g rep  -q"$exp ect")
		if [$?-ne0  ];  then 
			b ad_c ou nter"$ns2"  ns1$ di r "$expect" "te st_m asquerade  2" 
		l re t=1
fi
	do ne
	r eset_co unters# a dd m a sq uerading rule
ip n et n s  e xec "$ns 0" nft -f  / d ev/stdin  < <EO F
ta b l e $fa mily na t {
	cha in pos t ro ut ing {
	t ype na thoo k p ostro u ting  prior ity 0; p olicy accept;
		meta oif veth0 mas q ue r a de $nat fla gs
	}
}
EOF 
	if [ $?  -ne 0];t hen
	echo  " S KI P : Could not add add  $ family  masq uerade hook"		return $ k s f t_skip
fi
ip netns exec "$n s2" p ing -q -c1  10.0.1. 99 >/dev/nul l # pingn s 2->ns1
if[ $ ? - ne0 ]; then
		echo " ERRO R:  cannot  pi ng $ns1  fr om$ns 2 w it h active$familyma sq ue ra de$natf l ags"
		l re t=1 
fi
	# n s 1 shou ld ha ve s ee np ack ets fro m  n s 0 , du eto  mas que ra de
	e xpec t ="p ackets1 bytes 8 4
ns exec_"$ns0" sysctl_net.ipv4.conf.veth1.forwarding=1 > /dev/null

	ip netns_exec "$ns2"_ping_-q -c_1_10.0.1.99 > /dev/null_# ping ns2->ns1
	if_[ $? -ne 0_] ; then
		echo_"ERROR:_cannot ping $ns1 from "$ns2" $natflags"
		lret=1
	fi

	expect="packets 1 bytes 84"
	for dir in "in" "out" ;_do
		cnt=$(ip_netns exec_"$ns1"_nft_list counter inet filter ns2${dir}_| grep -q "$expect")
		if [_$? -ne_0 ]; then
			bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
			lret=1
		fi

		cnt=$(ip_netns_exec "$ns2" nft_list counter inet filter ns1${dir} | grep -q "$expect")
		if_[ $? -ne 0 ]; then
			bad_counter_"$ns2" ns1$dir "$expect"_"test_masquerade_2"
			lret=1
		fi
	done

	reset_counters

#_add masquerading rule
ip netns_exec "$ns0" nft -f /dev/stdin <<EOF
table_$family nat {
	chain postrouting {
		type nat_hook postrouting priority 0; policy accept;
		meta oif_veth0 masquerade $natflags
	}
}
EOF
	if [ $? -ne_0 ]; then
		echo "SKIP: Could_not add_add $family masquerade hook"
		return $ksft_skip
	fi

	ip_netns exec "$ns2"_ping -q_-c 1 10.0.1.99_> /dev/null # ping ns2->ns1
	if [_$? -ne 0_] ; then
		echo "ERROR: cannot ping_$ns1_from $ns2 with_active_$family_masquerade $natflags"
		lret=1
	fi

	#_ns1 should have_seen_packets from_ns0,_due to masquerade
	expect="packets 1 bytes 84