Skip to content

Commit 8442f8b

Browse files
kuba-mookuba-moo
committed
Merge branch 'testing-make-netfilter-selftests-functional-in-vng-environment'
Florian Westphal says: ==================== testing: make netfilter selftests functional in vng environment This is the second batch of the netfilter selftest move. Changes since v1: - makefile and kernel config are updated to have all required features - fix makefile with missing bits to make kselftest-install work - test it via vng as per https://github.com/linux-netdev/nipa/wiki/How-to-run-netdev-selftests-CI-style (Thanks Jakub!) - squash a few fixes, e.g. nft_queue.sh v1 had a race w. NFNETLINK_QUEUE=m - add a settings file with 8m timeout, for nft_concat_range.sh sake. That script can be sped up a bit, I think, but its not contained in this batch yet. - toss the first two bogus rebase artifacts (Matthieu Baerts) scripts are moved to lib.sh infra. This allows to use busywait helper and ditch various 'sleep 2' all over the place. Tested on Fedora 39: vng --build --config tools/testing/selftests/net/netfilter/config make -C tools/testing/selftests/ TARGETS=net/netfilter vng -v --run . --user root --cpus 2 -- \ make -C tools/testing/selftests TARGETS=net/netfilter run_tests ... all tests pass except nft_audit.sh which SKIPs due to nft version mismatch (Fedora is on nft 1.0.7 which lacks reset keyword support). Missing/WIP bits: - speed up nf_concat_range.sh test - extend flowtable selftest - shellcheck fixups for remaining scripts ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2 parents 4cad4ef + 0b2e1db commit 8442f8b

File tree

12 files changed

+498
-520
lines changed

12 files changed

+498
-520
lines changed

‎tools/testing/selftests/net/netfilter/Makefile‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,8 @@ $(OUTPUT)/nf_queue: LDLIBS += $(MNL_LDLIBS)
4242

4343
$(OUTPUT)/conntrack_dump_flush: CFLAGS += $(MNL_CFLAGS)
4444
$(OUTPUT)/conntrack_dump_flush: LDLIBS += $(MNL_LDLIBS)
45+
46+
TEST_FILES := lib.sh
47+
48+
TEST_INCLUDES := \
49+
../lib.sh

‎tools/testing/selftests/net/netfilter/config‎

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,87 @@
11
CONFIG_AUDIT=y
2+
CONFIG_BPF_SYSCALL=y
3+
CONFIG_BRIDGE=m
24
CONFIG_BRIDGE_EBT_BROUTE=m
5+
CONFIG_BRIDGE_EBT_IP=m
36
CONFIG_BRIDGE_EBT_REDIRECT=m
7+
CONFIG_BRIDGE_EBT_T_FILTER=m
48
CONFIG_BRIDGE_NETFILTER=m
9+
CONFIG_BRIDGE_NF_EBTABLES=m
10+
CONFIG_CGROUP_BPF=y
11+
CONFIG_DUMMY=m
12+
CONFIG_INET_ESP=m
513
CONFIG_IP_NF_MATCH_RPFILTER=m
614
CONFIG_IP6_NF_MATCH_RPFILTER=m
15+
CONFIG_IP_NF_IPTABLES=m
16+
CONFIG_IP6_NF_IPTABLES=m
17+
CONFIG_IP_NF_FILTER=m
18+
CONFIG_IP6_NF_FILTER=m
19+
CONFIG_IP_NF_RAW=m
20+
CONFIG_IP6_NF_RAW=m
721
CONFIG_IP_SCTP=m
822
CONFIG_IP_VS=m
923
CONFIG_IP_VS_PROTO_TCP=y
24+
CONFIG_IP_VS_RR=m
25+
CONFIG_IPV6=y
26+
CONFIG_IPV6_MULTIPLE_TABLES=y
27+
CONFIG_MACVLAN=m
28+
CONFIG_NAMESPACES=y
1029
CONFIG_NET_CLS_U32=m
30+
CONFIG_NET_L3_MASTER_DEV=y
31+
CONFIG_NET_NS=y
1132
CONFIG_NET_SCH_NETEM=m
1233
CONFIG_NET_SCH_HTB=m
1334
CONFIG_NET_IPIP=m
1435
CONFIG_NET_VRF=y
36+
CONFIG_NETFILTER=y
37+
CONFIG_NETFILTER_ADVANCED=y
1538
CONFIG_NETFILTER_NETLINK=m
39+
CONFIG_NETFILTER_NETLINK_QUEUE=m
1640
CONFIG_NETFILTER_SYNPROXY=m
41+
CONFIG_NETFILTER_XTABLES=m
1742
CONFIG_NETFILTER_XT_NAT=m
43+
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
44+
CONFIG_NETFILTER_XT_MATCH_STATE=m
45+
CONFIG_NETFILTER_XT_MATCH_STRING=m
1846
CONFIG_NETFILTER_XT_TARGET_REDIRECT=m
1947
CONFIG_NF_CONNTRACK=m
20-
CONFIG_NF_CONNTRACK_EVENTS=m
48+
CONFIG_NF_CONNTRACK_EVENTS=y
49+
CONFIG_NF_CONNTRACK_FTP=m
50+
CONFIG_NF_CONNTRACK_MARK=y
2151
CONFIG_NF_CONNTRACK_ZONES=y
2252
CONFIG_NF_CT_NETLINK=m
2353
CONFIG_NF_CT_PROTO_SCTP=y
54+
CONFIG_NF_FLOW_TABLE=m
55+
CONFIG_NF_LOG_IPV4=m
56+
CONFIG_NF_LOG_IPV6=m
57+
CONFIG_NF_NAT=m
58+
CONFIG_NF_NAT_REDIRECT=y
59+
CONFIG_NF_NAT_MASQUERADE=y
2460
CONFIG_NF_TABLES=m
61+
CONFIG_NF_TABLES_BRIDGE=m
2562
CONFIG_NF_TABLES_INET=y
2663
CONFIG_NF_TABLES_IPV4=y
2764
CONFIG_NF_TABLES_IPV6=y
65+
CONFIG_NF_TABLES_NETDEV=y
66+
CONFIG_NF_FLOW_TABLE_INET=m
67+
CONFIG_NFT_BRIDGE_META=m
68+
CONFIG_NFT_COMPAT=m
2869
CONFIG_NFT_CT=m
2970
CONFIG_NFT_FIB=m
3071
CONFIG_NFT_FIB_INET=m
3172
CONFIG_NFT_FIB_IPV4=m
3273
CONFIG_NFT_FIB_IPV6=m
74+
CONFIG_NFT_FLOW_OFFLOAD=m
75+
CONFIG_NFT_LIMIT=m
76+
CONFIG_NFT_LOG=m
3377
CONFIG_NFT_MASQ=m
3478
CONFIG_NFT_NAT=m
79+
CONFIG_NFT_NUMGEN=m
3580
CONFIG_NFT_QUEUE=m
81+
CONFIG_NFT_QUOTA=m
3682
CONFIG_NFT_REDIR=m
3783
CONFIG_NFT_SYNPROXY=m
84+
CONFIG_VETH=m
85+
CONFIG_VLAN_8021Q=m
86+
CONFIG_XFRM_USER=m
87+
CONFIG_XFRM_STATISTICS=y

‎tools/testing/selftests/net/netfilter/conntrack_ipip_mtu.sh‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ setup_ns r_a r_b r_w c_a c_b
3131

3232
cleanup() {
3333
cleanup_all_ns
34-
rm -f ${rx}
34+
rm -f "$rx"
3535
}
3636

3737
trap cleanup EXIT
@@ -46,20 +46,20 @@ listener_ready()
4646
test_path() {
4747
msg="$1"
4848

49-
ip netns exec ${c_b} socat -t 3 - udp4-listen:5000,reuseaddr > ${rx} < /dev/null &
49+
ip netns exec "$c_b" socat -t 3 - udp4-listen:5000,reuseaddr > "$rx" < /dev/null &
5050

5151
busywait $BUSYWAIT_TIMEOUT listener_ready "$c_b" 5000
5252

5353
for i in 1 2 3; do
5454
head -c1400 /dev/zero | tr "\000" "a" | \
55-
ip netns exec ${c_a} socat -t 1 -u STDIN UDP:192.168.20.2:5000
55+
ip netns exec "$c_a" socat -t 1 -u STDIN UDP:192.168.20.2:5000
5656
done
5757

5858
wait
5959

60-
bytes=$(wc -c < ${rx})
60+
bytes=$(wc -c < "$rx")
6161

62-
if [ $bytes -eq 1400 ];then
62+
if [ "$bytes" -eq 1400 ];then
6363
echo "OK: PMTU $msg connection tracking"
6464
else
6565
echo "FAIL: PMTU $msg connection tracking: got $bytes, expected 1400"
@@ -78,24 +78,24 @@ test_path() {
7878
# 10.4.4.1 via 10.2.2.254 (Router B via Wanrouter)
7979
# No iptables rules at all.
8080

81-
ip link add veth0 netns ${r_a} type veth peer name veth0 netns ${r_w}
82-
ip link add veth1 netns ${r_a} type veth peer name veth0 netns ${c_a}
81+
ip link add veth0 netns "$r_a" type veth peer name veth0 netns "$r_w"
82+
ip link add veth1 netns "$r_a" type veth peer name veth0 netns "$c_a"
8383

8484
l_addr="10.2.2.1"
8585
r_addr="10.4.4.1"
86-
ip netns exec ${r_a} ip link add ipip0 type ipip local ${l_addr} remote ${r_addr} mode ipip || exit $ksft_skip
86+
ip netns exec "$r_a" ip link add ipip0 type ipip local "$l_addr" remote "$r_addr" mode ipip || exit $ksft_skip
8787

8888
for dev in lo veth0 veth1 ipip0; do
89-
ip -net ${r_a} link set $dev up
89+
ip -net "$r_a" link set "$dev" up
9090
done
9191

92-
ip -net ${r_a} addr add 10.2.2.1/24 dev veth0
93-
ip -net ${r_a} addr add 192.168.10.1/24 dev veth1
92+
ip -net "$r_a" addr add 10.2.2.1/24 dev veth0
93+
ip -net "$r_a" addr add 192.168.10.1/24 dev veth1
9494

95-
ip -net ${r_a} route add 192.168.20.0/24 dev ipip0
96-
ip -net ${r_a} route add 10.4.4.0/24 via 10.2.2.254
95+
ip -net "$r_a" route add 192.168.20.0/24 dev ipip0
96+
ip -net "$r_a" route add 10.4.4.0/24 via 10.2.2.254
9797

98-
ip netns exec ${r_a} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
98+
ip netns exec "$r_a" sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
9999

100100
# Detailed setup for Router B
101101
# ---------------------------
@@ -108,46 +108,46 @@ ip netns exec ${r_a} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
108108
# 10.2.2.1 via 10.4.4.254 (Router A via Wanrouter)
109109
# No iptables rules at all.
110110

111-
ip link add veth0 netns ${r_b} type veth peer name veth1 netns ${r_w}
112-
ip link add veth1 netns ${r_b} type veth peer name veth0 netns ${c_b}
111+
ip link add veth0 netns "$r_b" type veth peer name veth1 netns "$r_w"
112+
ip link add veth1 netns "$r_b" type veth peer name veth0 netns "$c_b"
113113

114114
l_addr="10.4.4.1"
115115
r_addr="10.2.2.1"
116116

117-
ip netns exec ${r_b} ip link add ipip0 type ipip local ${l_addr} remote ${r_addr} mode ipip || exit $ksft_skip
117+
ip netns exec "$r_b" ip link add ipip0 type ipip local "${l_addr}" remote "${r_addr}" mode ipip || exit $ksft_skip
118118

119119
for dev in veth0 veth1 ipip0; do
120-
ip -net ${r_b} link set $dev up
120+
ip -net "$r_b" link set $dev up
121121
done
122122

123-
ip -net ${r_b} addr add 10.4.4.1/24 dev veth0
124-
ip -net ${r_b} addr add 192.168.20.1/24 dev veth1
123+
ip -net "$r_b" addr add 10.4.4.1/24 dev veth0
124+
ip -net "$r_b" addr add 192.168.20.1/24 dev veth1
125125

126-
ip -net ${r_b} route add 192.168.10.0/24 dev ipip0
127-
ip -net ${r_b} route add 10.2.2.0/24 via 10.4.4.254
128-
ip netns exec ${r_b} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
126+
ip -net "$r_b" route add 192.168.10.0/24 dev ipip0
127+
ip -net "$r_b" route add 10.2.2.0/24 via 10.4.4.254
128+
ip netns exec "$r_b" sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
129129

130130
# Client A
131-
ip -net ${c_a} addr add 192.168.10.2/24 dev veth0
132-
ip -net ${c_a} link set dev veth0 up
133-
ip -net ${c_a} route add default via 192.168.10.1
131+
ip -net "$c_a" addr add 192.168.10.2/24 dev veth0
132+
ip -net "$c_a" link set dev veth0 up
133+
ip -net "$c_a" route add default via 192.168.10.1
134134

135135
# Client A
136-
ip -net ${c_b} addr add 192.168.20.2/24 dev veth0
137-
ip -net ${c_b} link set dev veth0 up
138-
ip -net ${c_b} route add default via 192.168.20.1
136+
ip -net "$c_b" addr add 192.168.20.2/24 dev veth0
137+
ip -net "$c_b" link set dev veth0 up
138+
ip -net "$c_b" route add default via 192.168.20.1
139139

140140
# Wan
141-
ip -net ${r_w} addr add 10.2.2.254/24 dev veth0
142-
ip -net ${r_w} addr add 10.4.4.254/24 dev veth1
141+
ip -net "$r_w" addr add 10.2.2.254/24 dev veth0
142+
ip -net "$r_w" addr add 10.4.4.254/24 dev veth1
143143

144-
ip -net ${r_w} link set dev veth0 up mtu 1400
145-
ip -net ${r_w} link set dev veth1 up mtu 1400
144+
ip -net "$r_w" link set dev veth0 up mtu 1400
145+
ip -net "$r_w" link set dev veth1 up mtu 1400
146146

147-
ip -net ${r_a} link set dev veth0 mtu 1400
148-
ip -net ${r_b} link set dev veth0 mtu 1400
147+
ip -net "$r_a" link set dev veth0 mtu 1400
148+
ip -net "$r_b" link set dev veth0 mtu 1400
149149

150-
ip netns exec ${r_w} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
150+
ip netns exec "$r_w" sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
151151

152152
# Path MTU discovery
153153
# ------------------
@@ -187,5 +187,5 @@ test_path "without"
187187
#packet is too big (1400) for the tunnel PMTU (1380) to Router B, it is
188188
#dropped on Router A before sending.
189189

190-
ip netns exec ${r_a} iptables -A FORWARD -m conntrack --ctstate NEW
190+
ip netns exec "$r_a" iptables -A FORWARD -m conntrack --ctstate NEW
191191
test_path "with"

‎tools/testing/selftests/net/netfilter/nft_audit.sh‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,33 @@
66
SKIP_RC=4
77
RC=0
88

9+
if [ -r /var/run/auditd.pid ];then
10+
read pid < /var/run/auditd.pid
11+
p=$(pgrep ^auditd$)
12+
13+
if [ "$pid" -eq "$p" ]; then
14+
echo "SKIP: auditd is running"
15+
exit $SKIP_RC
16+
fi
17+
fi
18+
919
nft --version >/dev/null 2>&1 || {
1020
echo "SKIP: missing nft tool"
1121
exit $SKIP_RC
1222
}
1323

24+
# nft must be recent enough to support "reset" keyword.
25+
nft --check -f /dev/stdin >/dev/null 2>&1 <<EOF
26+
add table t
27+
add chain t c
28+
reset rules t c
29+
EOF
30+
31+
if [ "$?" -ne 0 ];then
32+
echo "SKIP: nft reset feature test failed"
33+
exit $SKIP_RC
34+
fi
35+
1436
# Run everything in a separate network namespace
1537
[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
1638

@@ -73,7 +95,7 @@ done
7395

7496
for ((i = 0; i < 500; i++)); do
7597
echo "add rule t2 c3 counter accept comment \"rule $i\""
76-
done >$rulefile
98+
done > "$rulefile"
7799
do_test "nft -f $rulefile" \
78100
'table=t2 family=2 entries=500 op=nft_register_rule'
79101

@@ -101,7 +123,7 @@ do_test 'nft add counter t2 c1; add counter t2 c2' \
101123

102124
for ((i = 3; i <= 500; i++)); do
103125
echo "add counter t2 c$i"
104-
done >$rulefile
126+
done > "$rulefile"
105127
do_test "nft -f $rulefile" \
106128
'table=t2 family=2 entries=498 op=nft_register_obj'
107129

@@ -115,7 +137,7 @@ do_test 'nft add quota t2 q1 { 10 bytes }; add quota t2 q2 { 10 bytes }' \
115137

116138
for ((i = 3; i <= 500; i++)); do
117139
echo "add quota t2 q$i { 10 bytes }"
118-
done >$rulefile
140+
done > "$rulefile"
119141
do_test "nft -f $rulefile" \
120142
'table=t2 family=2 entries=498 op=nft_register_obj'
121143

@@ -157,7 +179,7 @@ table=t2 family=2 entries=135 op=nft_reset_rule'
157179

158180
# resetting sets and elements
159181

160-
elem=(22 ,80 ,443)
182+
elem=(22 ",80" ",443")
161183
relem=""
162184
for i in {1..3}; do
163185
relem+="${elem[((i - 1))]}"

0 commit comments

Comments
 (0)