Skip to content

L
linux
Commit 49af681b authored by Florian Westphal's avatar Florian Westphal Committed by Jakub Kicinski
Browse files
Options

selftests: netfilter: nft_nat.sh: move to lib.sh infra 

Use busywait helper to wait until socat listener is up to avoid "sleep" calls.
This reduces script execution time slighty (12s to 7s).
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240411233624.8129-16-fw@strlen.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 53e94262
Hide whitespace changes
Inline Side-by-side
Showing with 206 additions and 274 deletions
tools/testing/selftests/net/netfilter/nft_nat.sh
View file @ 49af681b
...@@ -3,77 +3,60 @@ ...@@ -3,77 +3,60 @@
# This test is for basic NAT functionality: snat, dnat, redirect, masquerade. # This test is for basic NAT functionality: snat, dnat, redirect, masquerade.
# #
# Kselftest framework requirement - SKIP code is 4. source lib.sh
ksft_skip=4
ret=0 ret=0
test_inet_nat=true test_inet_nat=true
sfx=$(mktemp -u "XXXXXXXX") checktool "nft --version" "run test without nft tool"
ns0="ns0-$sfx" checktool "socat -h" "run test without socat"
ns1="ns1-$sfx"
ns2="ns2-$sfx"
cleanup() cleanup()
{ {
for i in 0 1 2; do ip netns del ns$i-"$sfx";done ip netns pids "$ns0" | xargs kill 2>/dev/null
} ip netns pids "$ns1" | xargs kill 2>/dev/null
ip netns pids "$ns2" | xargs kill 2>/dev/null
nft --version > /dev/null 2>&1 rm -f "$INFILE" "$OUTFILE"
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without nft tool"
exit $ksft_skip
fi
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without ip tool"
exit $ksft_skip
fi
ip netns add "$ns0" cleanup_all_ns
if [ $? -ne 0 ];then }
echo "SKIP: Could not create net namespace $ns0"
exit $ksft_skip
fi
trap cleanup EXIT trap cleanup EXIT
ip netns add "$ns1" INFILE=$(mktemp)
if [ $? -ne 0 ];then OUTFILE=$(mktemp)
echo "SKIP: Could not create net namespace $ns1"
exit $ksft_skip
fi
ip netns add "$ns2" setup_ns ns0 ns1 ns2
if [ $? -ne 0 ];then
echo "SKIP: Could not create net namespace $ns2"
exit $ksft_skip
fi
ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1 if ! ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1;then
if [ $? -ne 0 ];then
echo "SKIP: No virtual ethernet pair device support in kernel" echo "SKIP: No virtual ethernet pair device support in kernel"
exit $ksft_skip exit $ksft_skip
fi fi
ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2" ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2"
ip -net "$ns0" link set lo up
ip -net "$ns0" link set veth0 up ip -net "$ns0" link set veth0 up
ip -net "$ns0" addr add 10.0.1.1/24 dev veth0 ip -net "$ns0" addr add 10.0.1.1/24 dev veth0
ip -net "$ns0" addr add dead:1::1/64 dev veth0 ip -net "$ns0" addr add dead:1::1/64 dev veth0 nodad
ip -net "$ns0" link set veth1 up ip -net "$ns0" link set veth1 up
ip -net "$ns0" addr add 10.0.2.1/24 dev veth1 ip -net "$ns0" addr add 10.0.2.1/24 dev veth1
ip -net "$ns0" addr add dead:2::1/64 dev veth1 ip -net "$ns0" addr add dead:2::1/64 dev veth1 nodad
for i in 1 2; do do_config()
ip -net ns$i-$sfx link set lo up {
ip -net ns$i-$sfx link set eth0 up ns="$1"
ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0 subnet="$2"
ip -net ns$i-$sfx route add default via 10.0.$i.1
ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0 ip -net "$ns" link set eth0 up
ip -net ns$i-$sfx route add default via dead:$i::1 ip -net "$ns" addr add "10.0.$subnet.99/24" dev eth0
done ip -net "$ns" route add default via "10.0.$subnet.1"
ip -net "$ns" addr add "dead:$subnet::99/64" dev eth0 nodad
ip -net "$ns" route add default via "dead:$subnet::1"
}
do_config "$ns1" 1
do_config "$ns2" 2
bad_counter() bad_counter()
{ {
...@@ -83,7 +66,7 @@ bad_counter() ...@@ -83,7 +66,7 @@ bad_counter()
local tag=$4 local tag=$4
echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2 echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2
ip netns exec $ns nft list counter inet filter $counter 1>&2 ip netns exec "$ns" nft list counter inet filter "$counter" 1>&2
} }
check_counters() check_counters()
...@@ -91,26 +74,23 @@ check_counters() ...@@ -91,26 +74,23 @@ check_counters()
ns=$1 ns=$1
local lret=0 local lret=0
cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84") if ! ip netns exec "$ns" nft list counter inet filter ns0in | grep -q "packets 1 bytes 84";then
if [ $? -ne 0 ]; then bad_counter "$ns" ns0in "packets 1 bytes 84" "check_counters 1"
bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1"
lret=1 lret=1
fi fi
cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
if [ $? -ne 0 ]; then if ! ip netns exec "$ns" nft list counter inet filter ns0out | grep -q "packets 1 bytes 84";then
bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2" bad_counter "$ns" ns0out "packets 1 bytes 84" "check_counters 2"
lret=1 lret=1
fi fi
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect") if ! ip netns exec "$ns" nft list counter inet filter ns0in6 | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns" ns0in6 "$expect" "check_counters 3"
bad_counter $ns ns0in6 "$expect" "check_counters 3"
lret=1 lret=1
fi fi
cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect") if ! ip netns exec "$ns" nft list counter inet filter ns0out6 | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns" ns0out6 "$expect" "check_counters 4"
bad_counter $ns ns0out6 "$expect" "check_counters 4"
lret=1 lret=1
fi fi
...@@ -122,41 +102,35 @@ check_ns0_counters() ...@@ -122,41 +102,35 @@ check_ns0_counters()
local ns=$1 local ns=$1
local lret=0 local lret=0
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0") if ! ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1" bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0") if ! ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns0in6 "packets 0 bytes 0" bad_counter "$ns0" ns0in6 "packets 0 bytes 0"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0") if ! ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2" bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0") if ! ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 " bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 "
lret=1 lret=1
fi fi
for dir in "in" "out" ; do for dir in "in" "out" ; do
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "${ns}${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns0" "$ns${dir}" "$expect" "check_ns0_counters 4"
bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4"
lret=1 lret=1
fi fi
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "${ns}${dir}6" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns0" "$ns${dir}6" "$expect" "check_ns0_counters 5"
bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5"
lret=1 lret=1
fi fi
done done
...@@ -166,8 +140,8 @@ check_ns0_counters() ...@@ -166,8 +140,8 @@ check_ns0_counters()
reset_counters() reset_counters()
{ {
for i in 0 1 2;do for i in "$ns0" "$ns1" "$ns2" ;do
ip netns exec ns$i-$sfx nft reset counters inet > /dev/null ip netns exec "$i" nft reset counters inet > /dev/null
done done
} }
...@@ -177,7 +151,7 @@ test_local_dnat6() ...@@ -177,7 +151,7 @@ test_local_dnat6()
local lret=0 local lret=0
local IPF="" local IPF=""
if [ $family = "inet" ];then if [ "$family" = "inet" ];then
IPF="ip6" IPF="ip6"
fi fi
...@@ -195,8 +169,7 @@ EOF ...@@ -195,8 +169,7 @@ EOF
fi fi
# ping netns1, expect rewrite to netns2 # ping netns1, expect rewrite to netns2
ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null if ! ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null;then
if [ $? -ne 0 ]; then
lret=1 lret=1
echo "ERROR: ping6 failed" echo "ERROR: ping6 failed"
return $lret return $lret
...@@ -204,8 +177,7 @@ EOF ...@@ -204,8 +177,7 @@ EOF
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1" bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1"
lret=1 lret=1
fi fi
...@@ -213,8 +185,7 @@ EOF ...@@ -213,8 +185,7 @@ EOF
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2" bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2"
lret=1 lret=1
fi fi
...@@ -223,8 +194,7 @@ EOF ...@@ -223,8 +194,7 @@ EOF
# expect 0 count in ns1 # expect 0 count in ns1
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns0${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3" bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3"
lret=1 lret=1
fi fi
...@@ -233,8 +203,7 @@ EOF ...@@ -233,8 +203,7 @@ EOF
# expect 1 packet in ns2 # expect 1 packet in ns2
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter "ns0${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4" bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4"
lret=1 lret=1
fi fi
...@@ -252,7 +221,7 @@ test_local_dnat() ...@@ -252,7 +221,7 @@ test_local_dnat()
local lret=0 local lret=0
local IPF="" local IPF=""
if [ $family = "inet" ];then if [ "$family" = "inet" ];then
IPF="ip" IPF="ip"
fi fi
...@@ -265,7 +234,7 @@ table $family nat { ...@@ -265,7 +234,7 @@ table $family nat {
} }
EOF EOF
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
if [ $family = "inet" ];then if [ "$family" = "inet" ];then
echo "SKIP: inet nat tests" echo "SKIP: inet nat tests"
test_inet_nat=false test_inet_nat=false
return $ksft_skip return $ksft_skip
...@@ -275,8 +244,7 @@ EOF ...@@ -275,8 +244,7 @@ EOF
fi fi
# ping netns1, expect rewrite to netns2 # ping netns1, expect rewrite to netns2
ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null if ! ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ]; then
lret=1 lret=1
echo "ERROR: ping failed" echo "ERROR: ping failed"
return $lret return $lret
...@@ -284,18 +252,16 @@ EOF ...@@ -284,18 +252,16 @@ EOF
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns0" "ns1$dir" "$expect" "test_local_dnat 1"
bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1"
lret=1 lret=1
fi fi
done done
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns0" "ns2$dir" "$expect" "test_local_dnat 2"
bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2"
lret=1 lret=1
fi fi
done done
...@@ -303,9 +269,8 @@ EOF ...@@ -303,9 +269,8 @@ EOF
# expect 0 count in ns1 # expect 0 count in ns1
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns1" "ns0$dir" "$expect" "test_local_dnat 3"
bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3"
lret=1 lret=1
fi fi
done done
...@@ -313,20 +278,18 @@ EOF ...@@ -313,20 +278,18 @@ EOF
# expect 1 packet in ns2 # expect 1 packet in ns2
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns2" "ns0$dir" "$expect" "test_local_dnat 4"
bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4"
lret=1 lret=1
fi fi
done done
test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2" test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2"
ip netns exec "$ns0" nft flush chain $family nat output ip netns exec "$ns0" nft flush chain "$family" nat output
reset_counters reset_counters
ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null if ! ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ]; then
lret=1 lret=1
echo "ERROR: ping failed" echo "ERROR: ping failed"
return $lret return $lret
...@@ -334,16 +297,14 @@ EOF ...@@ -334,16 +297,14 @@ EOF
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5" bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5"
lret=1 lret=1
fi fi
done done
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6" bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6"
lret=1 lret=1
fi fi
...@@ -352,8 +313,7 @@ EOF ...@@ -352,8 +313,7 @@ EOF
# expect 1 count in ns1 # expect 1 count in ns1
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns0${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7" bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7"
lret=1 lret=1
fi fi
...@@ -362,8 +322,7 @@ EOF ...@@ -362,8 +322,7 @@ EOF
# expect 0 packet in ns2 # expect 0 packet in ns2
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter "ns0${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8" bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8"
lret=1 lret=1
fi fi
...@@ -374,13 +333,19 @@ EOF ...@@ -374,13 +333,19 @@ EOF
return $lret return $lret
} }
listener_ready()
{
local ns="$1"
local port="$2"
local proto="$3"
ss -N "$ns" -ln "$proto" -o "sport = :$port" | grep -q "$port"
}
test_local_dnat_portonly() test_local_dnat_portonly()
{ {
local family=$1 local family=$1
local daddr=$2 local daddr=$2
local lret=0 local lret=0
local sr_s
local sr_r
ip netns exec "$ns0" nft -f /dev/stdin <<EOF ip netns exec "$ns0" nft -f /dev/stdin <<EOF
table $family nat { table $family nat {
...@@ -392,7 +357,7 @@ table $family nat { ...@@ -392,7 +357,7 @@ table $family nat {
} }
EOF EOF
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
if [ $family = "inet" ];then if [ "$family" = "inet" ];then
echo "SKIP: inet port test" echo "SKIP: inet port test"
test_inet_nat=false test_inet_nat=false
return return
...@@ -401,17 +366,16 @@ EOF ...@@ -401,17 +366,16 @@ EOF
return return
fi fi
echo SERVER-$family | ip netns exec "$ns1" timeout 5 socat -u STDIN TCP-LISTEN:2000 & echo "SERVER-$family" | ip netns exec "$ns1" timeout 3 socat -u STDIN TCP-LISTEN:2000 &
sc_s=$!
sleep 1 busywait $BUSYWAIT_TIMEOUT listener_ready "$ns1" 2000 "-t"
result=$(ip netns exec "$ns0" timeout 1 socat TCP:$daddr:2000 STDOUT) result=$(ip netns exec "$ns0" timeout 1 socat -u TCP:"$daddr":2000 STDOUT)
if [ "$result" = "SERVER-inet" ];then if [ "$result" = "SERVER-inet" ];then
echo "PASS: inet port rewrite without l3 address" echo "PASS: inet port rewrite without l3 address"
else else
echo "ERROR: inet port rewrite" echo "ERROR: inet port rewrite without l3 address, got $result"
ret=1 ret=1
fi fi
} }
...@@ -424,24 +388,20 @@ test_masquerade6() ...@@ -424,24 +388,20 @@ test_masquerade6()
ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 via ipv6" echo "ERROR: cannot ping $ns1 from $ns2 via ipv6"
return 1 return 1
lret=1
fi fi
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns1" "ns2$dir" "$expect" "test_masquerade6 1"
bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns2" "ns1$dir" "$expect" "test_masquerade6 2"
bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2"
lret=1 lret=1
fi fi
done done
...@@ -462,8 +422,7 @@ EOF ...@@ -462,8 +422,7 @@ EOF
return $ksft_skip return $ksft_skip
fi fi
ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags" echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
lret=1 lret=1
fi fi
...@@ -471,14 +430,12 @@ EOF ...@@ -471,14 +430,12 @@ EOF
# ns1 should have seen packets from ns0, due to masquerade # ns1 should have seen packets from ns0, due to masquerade
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns0${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3" bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4" bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4"
lret=1 lret=1
fi fi
...@@ -487,27 +444,23 @@ EOF ...@@ -487,27 +444,23 @@ EOF
# ns1 should not have seen packets from ns2, due to masquerade # ns1 should not have seen packets from ns2, due to masquerade
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5" bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns0" "ns1$dir" "$expect" "test_masquerade6 6"
bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6"
lret=1 lret=1
fi fi
done done
ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)" echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)"
lret=1 lret=1
fi fi
ip netns exec "$ns0" nft flush chain $family nat postrouting if ! ip netns exec "$ns0" nft flush chain "$family" nat postrouting;then
if [ $? -ne 0 ]; then
echo "ERROR: Could not flush $family nat postrouting" 1>&2 echo "ERROR: Could not flush $family nat postrouting" 1>&2
lret=1 lret=1
fi fi
...@@ -526,23 +479,20 @@ test_masquerade() ...@@ -526,23 +479,20 @@ test_masquerade()
ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ] ; then echo "ERROR: cannot ping $ns1 from $ns2 $natflags"
echo "ERROR: cannot ping $ns1 from "$ns2" $natflags"
lret=1 lret=1
fi fi
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns1" "ns2$dir" "$expect" "test_masquerade 1"
bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns2" "ns1$dir" "$expect" "test_masquerade 2"
bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2"
lret=1 lret=1
fi fi
done done
...@@ -563,8 +513,7 @@ EOF ...@@ -563,8 +513,7 @@ EOF
return $ksft_skip return $ksft_skip
fi fi
ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags" echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
lret=1 lret=1
fi fi
...@@ -572,15 +521,13 @@ EOF ...@@ -572,15 +521,13 @@ EOF
# ns1 should have seen packets from ns0, due to masquerade # ns1 should have seen packets from ns0, due to masquerade
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns0${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns1" "ns0$dir" "$expect" "test_masquerade 3"
bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns2" "ns1$dir" "$expect" "test_masquerade 4"
bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4"
lret=1 lret=1
fi fi
done done
...@@ -588,27 +535,23 @@ EOF ...@@ -588,27 +535,23 @@ EOF
# ns1 should not have seen packets from ns2, due to masquerade # ns1 should not have seen packets from ns2, due to masquerade
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns1" "ns0$dir" "$expect" "test_masquerade 5"
bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns0" "ns1$dir" "$expect" "test_masquerade 6"
bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6"
lret=1 lret=1
fi fi
done done
ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)" echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)"
lret=1 lret=1
fi fi
ip netns exec "$ns0" nft flush chain $family nat postrouting if ! ip netns exec "$ns0" nft flush chain "$family" nat postrouting; then
if [ $? -ne 0 ]; then
echo "ERROR: Could not flush $family nat postrouting" 1>&2 echo "ERROR: Could not flush $family nat postrouting" 1>&2
lret=1 lret=1
fi fi
...@@ -625,22 +568,19 @@ test_redirect6() ...@@ -625,22 +568,19 @@ test_redirect6()
ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6" echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6"
lret=1 lret=1
fi fi
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1" bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter "ns1${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2" bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2"
lret=1 lret=1
fi fi
...@@ -662,8 +602,7 @@ EOF ...@@ -662,8 +602,7 @@ EOF
return $ksft_skip return $ksft_skip
fi fi
ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect" echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect"
lret=1 lret=1
fi fi
...@@ -671,8 +610,7 @@ EOF ...@@ -671,8 +610,7 @@ EOF
# ns1 should have seen no packets from ns2, due to redirection # ns1 should have seen no packets from ns2, due to redirection
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3" bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3"
lret=1 lret=1
fi fi
...@@ -681,15 +619,13 @@ EOF ...@@ -681,15 +619,13 @@ EOF
# ns0 should have seen packets from ns2, due to masquerade # ns0 should have seen packets from ns2, due to masquerade
expect="packets 1 bytes 104" expect="packets 1 bytes 104"
for dir in "in6" "out6" ; do for dir in "in6" "out6" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4" bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4"
lret=1 lret=1
fi fi
done done
ip netns exec "$ns0" nft delete table $family nat if ! ip netns exec "$ns0" nft delete table "$family" nat;then
if [ $? -ne 0 ]; then
echo "ERROR: Could not delete $family nat table" 1>&2 echo "ERROR: Could not delete $family nat table" 1>&2
lret=1 lret=1
fi fi
...@@ -707,22 +643,19 @@ test_redirect() ...@@ -707,22 +643,19 @@ test_redirect()
ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2" echo "ERROR: cannot ping $ns1 from $ns2"
lret=1 lret=1
fi fi
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then bad_counter "$ns1" "$ns2$dir" "$expect" "test_redirect 1"
bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2" bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2"
lret=1 lret=1
fi fi
...@@ -744,8 +677,7 @@ EOF ...@@ -744,8 +677,7 @@ EOF
return $ksft_skip return $ksft_skip
fi fi
ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect" echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect"
lret=1 lret=1
fi fi
...@@ -754,8 +686,7 @@ EOF ...@@ -754,8 +686,7 @@ EOF
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3" bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3"
lret=1 lret=1
fi fi
...@@ -764,15 +695,13 @@ EOF ...@@ -764,15 +695,13 @@ EOF
# ns0 should have seen packets from ns2, due to masquerade # ns0 should have seen packets from ns2, due to masquerade
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter "ns2${dir}" | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4" bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4"
lret=1 lret=1
fi fi
done done
ip netns exec "$ns0" nft delete table $family nat if ! ip netns exec "$ns0" nft delete table "$family" nat;then
if [ $? -ne 0 ]; then
echo "ERROR: Could not delete $family nat table" 1>&2 echo "ERROR: Could not delete $family nat table" 1>&2
lret=1 lret=1
fi fi
...@@ -803,13 +732,13 @@ test_port_shadow() ...@@ -803,13 +732,13 @@ test_port_shadow()
# make shadow entry, from client (ns2), going to (ns1), port 41404, sport 1405. # make shadow entry, from client (ns2), going to (ns1), port 41404, sport 1405.
echo "fake-entry" | ip netns exec "$ns2" timeout 1 socat -u STDIN UDP:"$daddrc":41404,sourceport=1405 echo "fake-entry" | ip netns exec "$ns2" timeout 1 socat -u STDIN UDP:"$daddrc":41404,sourceport=1405
echo ROUTER | ip netns exec "$ns0" timeout 5 socat -u STDIN UDP4-LISTEN:1405 & echo ROUTER | ip netns exec "$ns0" timeout 3 socat -T 3 -u STDIN UDP4-LISTEN:1405 2>/dev/null &
sc_r=$! local sc_r=$!
echo CLIENT | ip netns exec "$ns2" timeout 3 socat -T 3 -u STDIN UDP4-LISTEN:1405,reuseport 2>/dev/null &
local sc_c=$!
echo CLIENT | ip netns exec "$ns2" timeout 5 socat -u STDIN UDP4-LISTEN:1405,reuseport & busywait $BUSYWAIT_TIMEOUT listener_ready "$ns0" 1405 "-u"
sc_c=$! busywait $BUSYWAIT_TIMEOUT listener_ready "$ns2" 1405 "-u"
sleep 0.3
# ns1 tries to connect to ns0:1405. With default settings this should connect # ns1 tries to connect to ns0:1405. With default settings this should connect
# to client, it matches the conntrack entry created above. # to client, it matches the conntrack entry created above.
...@@ -846,7 +775,7 @@ table $family filter { ...@@ -846,7 +775,7 @@ table $family filter {
EOF EOF
test_port_shadow "port-filter" "ROUTER" test_port_shadow "port-filter" "ROUTER"
ip netns exec "$ns0" nft delete table $family filter ip netns exec "$ns0" nft delete table "$family" filter
} }
# This prevents port shadow of router service via notrack. # This prevents port shadow of router service via notrack.
...@@ -868,7 +797,7 @@ table $family raw { ...@@ -868,7 +797,7 @@ table $family raw {
EOF EOF
test_port_shadow "port-notrack" "ROUTER" test_port_shadow "port-notrack" "ROUTER"
ip netns exec "$ns0" nft delete table $family raw ip netns exec "$ns0" nft delete table "$family" raw
} }
# This prevents port shadow of router service via sport remap. # This prevents port shadow of router service via sport remap.
...@@ -886,21 +815,19 @@ table $family pat { ...@@ -886,21 +815,19 @@ table $family pat {
EOF EOF
test_port_shadow "pat" "ROUTER" test_port_shadow "pat" "ROUTER"
ip netns exec "$ns0" nft delete table $family pat ip netns exec "$ns0" nft delete table "$family" pat
} }
test_port_shadowing() test_port_shadowing()
{ {
local family="ip" local family="ip"
conntrack -h >/dev/null 2>&1 if ! conntrack -h >/dev/null 2>&1;then
if [ $? -ne 0 ];then
echo "SKIP: Could not run nat port shadowing test without conntrack tool" echo "SKIP: Could not run nat port shadowing test without conntrack tool"
return return
fi fi
socat -h > /dev/null 2>&1 if ! socat -h > /dev/null 2>&1;then
if [ $? -ne 0 ];then
echo "SKIP: Could not run nat port shadowing test without socat tool" echo "SKIP: Could not run nat port shadowing test without socat tool"
return return
fi fi
...@@ -946,8 +873,7 @@ test_stateless_nat_ip() ...@@ -946,8 +873,7 @@ test_stateless_nat_ip()
ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 before loading stateless rules" echo "ERROR: cannot ping $ns1 from $ns2 before loading stateless rules"
return 1 return 1
fi fi
...@@ -981,23 +907,20 @@ EOF ...@@ -981,23 +907,20 @@ EOF
reset_counters reset_counters
ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 if ! ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null; then
if [ $? -ne 0 ] ; then
echo "ERROR: cannot ping $ns1 from $ns2 with stateless rules" echo "ERROR: cannot ping $ns1 from $ns2 with stateless rules"
lret=1 lret=1
fi fi
# ns1 should have seen packets from .2.2, due to stateless rewrite. # ns1 should have seen packets from .2.2, due to stateless rewrite.
expect="packets 1 bytes 84" expect="packets 1 bytes 84"
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0insl | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter ns0insl | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0insl "$expect" "test_stateless 1" bad_counter "$ns1" ns0insl "$expect" "test_stateless 1"
lret=1 lret=1
fi fi
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns2" ns1$dir "$expect" "test_stateless 2" bad_counter "$ns2" ns1$dir "$expect" "test_stateless 2"
lret=1 lret=1
fi fi
...@@ -1006,14 +929,12 @@ EOF ...@@ -1006,14 +929,12 @@ EOF
# ns1 should not have seen packets from ns2, due to masquerade # ns1 should not have seen packets from ns2, due to masquerade
expect="packets 0 bytes 0" expect="packets 0 bytes 0"
for dir in "in" "out" ; do for dir in "in" "out" ; do
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0$dir "$expect" "test_stateless 3" bad_counter "$ns1" ns0$dir "$expect" "test_stateless 3"
lret=1 lret=1
fi fi
cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect") if ! ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns0" ns1$dir "$expect" "test_stateless 4" bad_counter "$ns0" ns1$dir "$expect" "test_stateless 4"
lret=1 lret=1
fi fi
...@@ -1021,8 +942,7 @@ EOF ...@@ -1021,8 +942,7 @@ EOF
reset_counters reset_counters
socat -h > /dev/null 2>&1 if ! socat -h > /dev/null 2>&1;then
if [ $? -ne 0 ];then
echo "SKIP: Could not run stateless nat frag test without socat tool" echo "SKIP: Could not run stateless nat frag test without socat tool"
if [ $lret -eq 0 ]; then if [ $lret -eq 0 ]; then
return $ksft_skip return $ksft_skip
...@@ -1032,42 +952,36 @@ EOF ...@@ -1032,42 +952,36 @@ EOF
return $lret return $lret
fi fi
local tmpfile=$(mktemp) dd if=/dev/urandom of="$INFILE" bs=4096 count=1 2>/dev/null
dd if=/dev/urandom of=$tmpfile bs=4096 count=1 2>/dev/null
local outfile=$(mktemp) ip netns exec "$ns1" timeout 3 socat -u UDP4-RECV:4233 OPEN:"$OUTFILE" < /dev/null 2>/dev/null &
ip netns exec "$ns1" timeout 3 socat -u UDP4-RECV:4233 OPEN:$outfile < /dev/null &
sc_r=$! busywait $BUSYWAIT_TIMEOUT listener_ready "$ns1" 4233 "-u"
sleep 1
# re-do with large ping -> ip fragmentation # re-do with large ping -> ip fragmentation
ip netns exec "$ns2" timeout 3 socat - UDP4-SENDTO:"10.0.1.99:4233" < "$tmpfile" > /dev/null if ! ip netns exec "$ns2" timeout 3 socat -u STDIN UDP4-SENDTO:"10.0.1.99:4233" < "$INFILE" > /dev/null;then
if [ $? -ne 0 ] ; then
echo "ERROR: failed to test udp $ns1 to $ns2 with stateless ip nat" 1>&2 echo "ERROR: failed to test udp $ns1 to $ns2 with stateless ip nat" 1>&2
lret=1 lret=1
fi fi
wait wait
cmp "$tmpfile" "$outfile" if ! cmp "$INFILE" "$OUTFILE";then
if [ $? -ne 0 ]; then ls -l "$INFILE" "$OUTFILE"
ls -l "$tmpfile" "$outfile"
echo "ERROR: in and output file mismatch when checking udp with stateless nat" 1>&2 echo "ERROR: in and output file mismatch when checking udp with stateless nat" 1>&2
lret=1 lret=1
fi fi
rm -f "$tmpfile" "$outfile" :> "$OUTFILE"
# ns1 should have seen packets from 2.2, due to stateless rewrite. # ns1 should have seen packets from 2.2, due to stateless rewrite.
expect="packets 3 bytes 4164" expect="packets 3 bytes 4164"
cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0insl | grep -q "$expect") if ! ip netns exec "$ns1" nft list counter inet filter ns0insl | grep -q "$expect";then
if [ $? -ne 0 ]; then
bad_counter "$ns1" ns0insl "$expect" "test_stateless 5" bad_counter "$ns1" ns0insl "$expect" "test_stateless 5"
lret=1 lret=1
fi fi
ip netns exec "$ns0" nft delete table ip stateless if ! ip netns exec "$ns0" nft delete table ip stateless; then
if [ $? -ne 0 ]; then
echo "ERROR: Could not delete table ip stateless" 1>&2 echo "ERROR: Could not delete table ip stateless" 1>&2
lret=1 lret=1
fi fi
...@@ -1078,8 +992,8 @@ EOF ...@@ -1078,8 +992,8 @@ EOF
} }
# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 # ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99
for i in 0 1 2; do for i in "$ns0" "$ns1" "$ns2" ;do
ip netns exec ns$i-$sfx nft -f /dev/stdin <<EOF ip netns exec "$i" nft -f /dev/stdin <<EOF
table inet filter { table inet filter {
counter ns0in {} counter ns0in {}
counter ns1in {} counter ns1in {}
...@@ -1145,7 +1059,7 @@ done ...@@ -1145,7 +1059,7 @@ done
# special case for stateless nat check, counter needs to # special case for stateless nat check, counter needs to
# be done before (input) ip defragmentation # be done before (input) ip defragmentation
ip netns exec ns1-$sfx nft -f /dev/stdin <<EOF ip netns exec "$ns1" nft -f /dev/stdin <<EOF
table inet filter { table inet filter {
counter ns0insl {} counter ns0insl {}
...@@ -1156,31 +1070,49 @@ table inet filter { ...@@ -1156,31 +1070,49 @@ table inet filter {
} }
EOF EOF
sleep 3 ping_basic()
# test basic connectivity {
for i in 1 2; do i="$1"
ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null if ! ip netns exec "$ns0" ping -c 1 -q 10.0."$i".99 > /dev/null;then
if [ $? -ne 0 ];then echo "ERROR: Could not reach other namespace(s)" 1>&2
echo "ERROR: Could not reach other namespace(s)" 1>&2 ret=1
ret=1 fi
fi
if ! ip netns exec "$ns0" ping -c 1 -q dead:"$i"::99 > /dev/null;then
ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
if [ $? -ne 0 ];then ret=1
echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2 fi
ret=1 }
fi
check_counters ns$i-$sfx test_basic_conn()
if [ $? -ne 0 ]; then {
ret=1 local nsexec
fi name="$1"
check_ns0_counters ns$i nsexec=$(eval echo \$"$1")
if [ $? -ne 0 ]; then
ret=1 ping_basic 1
fi ping_basic 2
reset_counters
done if ! check_counters "$nsexec";then
return 1
fi
if ! check_ns0_counters "$name";then
return 1
fi
reset_counters
return 0
}
if ! test_basic_conn "ns1" ; then
echo "ERROR: basic test for ns1 failed" 1>&2
exit 1
fi
if ! test_basic_conn "ns2"; then
echo "ERROR: basic test for ns1 failed" 1>&2
fi
if [ $ret -eq 0 ];then if [ $ret -eq 0 ];then
echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2" echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7