Skip to content

L
linux
Commit 8442f8ba authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files
Options

Merge branch 'testing-make-netfilter-selftests-functional-in-vng-environment' 

Florian Westphal says:

====================
testing: make netfilter selftests functional in vng environment

This is the second batch of the netfilter selftest move.

Changes since v1:
- makefile and kernel config are updated to have all required features
- fix makefile with missing bits to make kselftest-install work
- test it via vng as per
   https://github.com/linux-netdev/nipa/wiki/How-to-run-netdev-selftests-CI-style
   (Thanks Jakub!)
- squash a few fixes, e.g. nft_queue.sh v1 had a race w. NFNETLINK_QUEUE=m
- add a settings file with 8m timeout, for nft_concat_range.sh sake.
  That script can be sped up a bit, I think, but its not contained in
  this batch yet.
- toss the first two bogus rebase artifacts (Matthieu Baerts)

scripts are moved to lib.sh infra. This allows to use busywait helper
and ditch various 'sleep 2' all over the place.

Tested on Fedora 39:

vng --build  --config tools/testing/selftests/net/netfilter/config
make -C tools/testing/selftests/ TARGETS=net/netfilter
vng -v --run . --user root --cpus 2 -- \
        make -C tools/testing/selftests TARGETS=net/netfilter run_tests

... all tests pass except nft_audit.sh which SKIPs due to nft version mismatch
(Fedora is on nft 1.0.7 which lacks reset keyword support).

Missing/WIP bits:
- speed up nf_concat_range.sh test
- extend flowtable selftest
- shellcheck fixups for remaining scripts
====================

Link: https://lore.kernel.org/r/20240418152744.15105-1-fw@strlen.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 4cad4efa 0b2e1db9
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 498 additions and 520 deletions
tools/testing/selftests/net/netfilter/Makefile
View file @ 8442f8ba
......@@ -42,3 +42,8 @@ $(OUTPUT)/nf_queue: LDLIBS += $(MNL_LDLIBS)
$(OUTPUT)/conntrack_dump_flush: CFLAGS += $(MNL_CFLAGS)
$(OUTPUT)/conntrack_dump_flush: LDLIBS += $(MNL_LDLIBS)
TEST_FILES := lib.sh
TEST_INCLUDES := \
../lib.sh
tools/testing/selftests/net/netfilter/config
View file @ 8442f8ba
CONFIG_AUDIT=y
CONFIG_BPF_SYSCALL=y
CONFIG_BRIDGE=m
CONFIG_BRIDGE_EBT_BROUTE=m
CONFIG_BRIDGE_EBT_IP=m
CONFIG_BRIDGE_EBT_REDIRECT=m
CONFIG_BRIDGE_EBT_T_FILTER=m
CONFIG_BRIDGE_NETFILTER=m
CONFIG_BRIDGE_NF_EBTABLES=m
CONFIG_CGROUP_BPF=y
CONFIG_DUMMY=m
CONFIG_INET_ESP=m
CONFIG_IP_NF_MATCH_RPFILTER=m
CONFIG_IP6_NF_MATCH_RPFILTER=m
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP6_NF_IPTABLES=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP6_NF_FILTER=m
CONFIG_IP_NF_RAW=m
CONFIG_IP6_NF_RAW=m
CONFIG_IP_SCTP=m
CONFIG_IP_VS=m
CONFIG_IP_VS_PROTO_TCP=y
CONFIG_IP_VS_RR=m
CONFIG_IPV6=y
CONFIG_IPV6_MULTIPLE_TABLES=y
CONFIG_MACVLAN=m
CONFIG_NAMESPACES=y
CONFIG_NET_CLS_U32=m
CONFIG_NET_L3_MASTER_DEV=y
CONFIG_NET_NS=y
CONFIG_NET_SCH_NETEM=m
CONFIG_NET_SCH_HTB=m
CONFIG_NET_IPIP=m
CONFIG_NET_VRF=y
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_NETFILTER_NETLINK=m
CONFIG_NETFILTER_NETLINK_QUEUE=m
CONFIG_NETFILTER_SYNPROXY=m
CONFIG_NETFILTER_XTABLES=m
CONFIG_NETFILTER_XT_NAT=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_TARGET_REDIRECT=m
CONFIG_NF_CONNTRACK=m
CONFIG_NF_CONNTRACK_EVENTS=m
CONFIG_NF_CONNTRACK_EVENTS=y
CONFIG_NF_CONNTRACK_FTP=m
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_ZONES=y
CONFIG_NF_CT_NETLINK=m
CONFIG_NF_CT_PROTO_SCTP=y
CONFIG_NF_FLOW_TABLE=m
CONFIG_NF_LOG_IPV4=m
CONFIG_NF_LOG_IPV6=m
CONFIG_NF_NAT=m
CONFIG_NF_NAT_REDIRECT=y
CONFIG_NF_NAT_MASQUERADE=y
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_BRIDGE=m
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_IPV4=y
CONFIG_NF_TABLES_IPV6=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NF_FLOW_TABLE_INET=m
CONFIG_NFT_BRIDGE_META=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_CT=m
CONFIG_NFT_FIB=m
CONFIG_NFT_FIB_INET=m
CONFIG_NFT_FIB_IPV4=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_NFT_FLOW_OFFLOAD=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_NAT=m
CONFIG_NFT_NUMGEN=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_QUOTA=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_SYNPROXY=m
CONFIG_VETH=m
CONFIG_VLAN_8021Q=m
CONFIG_XFRM_USER=m
CONFIG_XFRM_STATISTICS=y
tools/testing/selftests/net/netfilter/conntrack_ipip_mtu.sh
View file @ 8442f8ba
......@@ -31,7 +31,7 @@ setup_ns r_a r_b r_w c_a c_b
cleanup() {
cleanup_all_ns
rm -f ${rx}
rm -f "$rx"
}
trap cleanup EXIT
......@@ -46,20 +46,20 @@ listener_ready()
test_path() {
msg="$1"
ip netns exec ${c_b} socat -t 3 - udp4-listen:5000,reuseaddr > ${rx} < /dev/null &
ip netns exec "$c_b" socat -t 3 - udp4-listen:5000,reuseaddr > "$rx" < /dev/null &
busywait $BUSYWAIT_TIMEOUT listener_ready "$c_b" 5000
for i in 1 2 3; do
head -c1400 /dev/zero | tr "\000" "a" | \
ip netns exec ${c_a} socat -t 1 -u STDIN UDP:192.168.20.2:5000
ip netns exec "$c_a" socat -t 1 -u STDIN UDP:192.168.20.2:5000
done
wait
bytes=$(wc -c < ${rx})
bytes=$(wc -c < "$rx")
if [ $bytes -eq 1400 ];then
if [ "$bytes" -eq 1400 ];then
echo "OK: PMTU $msg connection tracking"
else
echo "FAIL: PMTU $msg connection tracking: got $bytes, expected 1400"
......@@ -78,24 +78,24 @@ test_path() {
# 10.4.4.1 via 10.2.2.254 (Router B via Wanrouter)
# No iptables rules at all.
ip link add veth0 netns ${r_a} type veth peer name veth0 netns ${r_w}
ip link add veth1 netns ${r_a} type veth peer name veth0 netns ${c_a}
ip link add veth0 netns "$r_a" type veth peer name veth0 netns "$r_w"
ip link add veth1 netns "$r_a" type veth peer name veth0 netns "$c_a"
l_addr="10.2.2.1"
r_addr="10.4.4.1"
ip netns exec ${r_a} ip link add ipip0 type ipip local ${l_addr} remote ${r_addr} mode ipip || exit $ksft_skip
ip netns exec "$r_a" ip link add ipip0 type ipip local "$l_addr" remote "$r_addr" mode ipip || exit $ksft_skip
for dev in lo veth0 veth1 ipip0; do
ip -net ${r_a} link set $dev up
ip -net "$r_a" link set "$dev" up
done
ip -net ${r_a} addr add 10.2.2.1/24 dev veth0
ip -net ${r_a} addr add 192.168.10.1/24 dev veth1
ip -net "$r_a" addr add 10.2.2.1/24 dev veth0
ip -net "$r_a" addr add 192.168.10.1/24 dev veth1
ip -net ${r_a} route add 192.168.20.0/24 dev ipip0
ip -net ${r_a} route add 10.4.4.0/24 via 10.2.2.254
ip -net "$r_a" route add 192.168.20.0/24 dev ipip0
ip -net "$r_a" route add 10.4.4.0/24 via 10.2.2.254
ip netns exec ${r_a} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
ip netns exec "$r_a" sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
# Detailed setup for Router B
# ---------------------------
......@@ -108,46 +108,46 @@ ip netns exec ${r_a} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
# 10.2.2.1 via 10.4.4.254 (Router A via Wanrouter)
# No iptables rules at all.
ip link add veth0 netns ${r_b} type veth peer name veth1 netns ${r_w}
ip link add veth1 netns ${r_b} type veth peer name veth0 netns ${c_b}
ip link add veth0 netns "$r_b" type veth peer name veth1 netns "$r_w"
ip link add veth1 netns "$r_b" type veth peer name veth0 netns "$c_b"
l_addr="10.4.4.1"
r_addr="10.2.2.1"
ip netns exec ${r_b} ip link add ipip0 type ipip local ${l_addr} remote ${r_addr} mode ipip || exit $ksft_skip
ip netns exec "$r_b" ip link add ipip0 type ipip local "${l_addr}" remote "${r_addr}" mode ipip || exit $ksft_skip
for dev in veth0 veth1 ipip0; do
ip -net ${r_b} link set $dev up
ip -net "$r_b" link set $dev up
done
ip -net ${r_b} addr add 10.4.4.1/24 dev veth0
ip -net ${r_b} addr add 192.168.20.1/24 dev veth1
ip -net "$r_b" addr add 10.4.4.1/24 dev veth0
ip -net "$r_b" addr add 192.168.20.1/24 dev veth1
ip -net ${r_b} route add 192.168.10.0/24 dev ipip0
ip -net ${r_b} route add 10.2.2.0/24 via 10.4.4.254
ip netns exec ${r_b} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
ip -net "$r_b" route add 192.168.10.0/24 dev ipip0
ip -net "$r_b" route add 10.2.2.0/24 via 10.4.4.254
ip netns exec "$r_b" sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
# Client A
ip -net ${c_a} addr add 192.168.10.2/24 dev veth0
ip -net ${c_a} link set dev veth0 up
ip -net ${c_a} route add default via 192.168.10.1
ip -net "$c_a" addr add 192.168.10.2/24 dev veth0
ip -net "$c_a" link set dev veth0 up
ip -net "$c_a" route add default via 192.168.10.1
# Client A
ip -net ${c_b} addr add 192.168.20.2/24 dev veth0
ip -net ${c_b} link set dev veth0 up
ip -net ${c_b} route add default via 192.168.20.1
ip -net "$c_b" addr add 192.168.20.2/24 dev veth0
ip -net "$c_b" link set dev veth0 up
ip -net "$c_b" route add default via 192.168.20.1
# Wan
ip -net ${r_w} addr add 10.2.2.254/24 dev veth0
ip -net ${r_w} addr add 10.4.4.254/24 dev veth1
ip -net "$r_w" addr add 10.2.2.254/24 dev veth0
ip -net "$r_w" addr add 10.4.4.254/24 dev veth1
ip -net ${r_w} link set dev veth0 up mtu 1400
ip -net ${r_w} link set dev veth1 up mtu 1400
ip -net "$r_w" link set dev veth0 up mtu 1400
ip -net "$r_w" link set dev veth1 up mtu 1400
ip -net ${r_a} link set dev veth0 mtu 1400
ip -net ${r_b} link set dev veth0 mtu 1400
ip -net "$r_a" link set dev veth0 mtu 1400
ip -net "$r_b" link set dev veth0 mtu 1400
ip netns exec ${r_w} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
ip netns exec "$r_w" sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
# Path MTU discovery
# ------------------
......@@ -187,5 +187,5 @@ test_path "without"
#packet is too big (1400) for the tunnel PMTU (1380) to Router B, it is
#dropped on Router A before sending.
ip netns exec ${r_a} iptables -A FORWARD -m conntrack --ctstate NEW
ip netns exec "$r_a" iptables -A FORWARD -m conntrack --ctstate NEW
test_path "with"
tools/testing/selftests/net/netfilter/nft_audit.sh
View file @ 8442f8ba
......@@ -6,11 +6,33 @@
SKIP_RC=4
RC=0
if [ -r /var/run/auditd.pid ];then
read pid < /var/run/auditd.pid
p=$(pgrep ^auditd$)
if [ "$pid" -eq "$p" ]; then
echo "SKIP: auditd is running"
exit $SKIP_RC
fi
fi
nft --version >/dev/null 2>&1 || {
echo "SKIP: missing nft tool"
exit $SKIP_RC
}
# nft must be recent enough to support "reset" keyword.
nft --check -f /dev/stdin >/dev/null 2>&1 <<EOF
add table t
add chain t c
reset rules t c
EOF
if [ "$?" -ne 0 ];then
echo "SKIP: nft reset feature test failed"
exit $SKIP_RC
fi
# Run everything in a separate network namespace
[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
......@@ -73,7 +95,7 @@ done
for ((i = 0; i < 500; i++)); do
echo "add rule t2 c3 counter accept comment \"rule $i\""
done >$rulefile
done > "$rulefile"
do_test "nft -f $rulefile" \
'table=t2 family=2 entries=500 op=nft_register_rule'
......@@ -101,7 +123,7 @@ do_test 'nft add counter t2 c1; add counter t2 c2' \
for ((i = 3; i <= 500; i++)); do
echo "add counter t2 c$i"
done >$rulefile
done > "$rulefile"
do_test "nft -f $rulefile" \
'table=t2 family=2 entries=498 op=nft_register_obj'
......@@ -115,7 +137,7 @@ do_test 'nft add quota t2 q1 { 10 bytes }; add quota t2 q2 { 10 bytes }' \
for ((i = 3; i <= 500; i++)); do
echo "add quota t2 q$i { 10 bytes }"
done >$rulefile
done > "$rulefile"
do_test "nft -f $rulefile" \
'table=t2 family=2 entries=498 op=nft_register_obj'
......@@ -157,7 +179,7 @@ table=t2 family=2 entries=135 op=nft_reset_rule'
# resetting sets and elements
elem=(22 ,80 ,443)
elem=(22 ",80" ",443")
relem=""
for i in {1..3}; do
relem+="${elem[((i - 1))]}"
......
tools/testing/selftests/net/netfilter/nft_fib.sh
View file @ 8442f8ba
......@@ -16,7 +16,7 @@ cleanup()
{
cleanup_all_ns
[ $log_netns -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns=$log_netns
[ "$log_netns" -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns=$log_netns
}
checktool "nft --version" "run test without nft"
......@@ -25,8 +25,7 @@ setup_ns nsrouter ns1 ns2
trap cleanup EXIT
dmesg | grep -q ' nft_rpfilter: '
if [ $? -eq 0 ]; then
if dmesg | grep -q ' nft_rpfilter: ';then
dmesg -c | grep ' nft_rpfilter: '
echo "WARN: a previous test run has failed" 1>&2
fi
......@@ -36,7 +35,7 @@ sysctl -q net.netfilter.nf_log_all_netns=1
load_ruleset() {
local netns=$1
ip netns exec ${netns} nft -f /dev/stdin <<EOF
ip netns exec "$netns" nft -f /dev/stdin <<EOF
table inet filter {
chain prerouting {
type filter hook prerouting priority 0; policy accept;
......@@ -49,7 +48,7 @@ EOF
load_pbr_ruleset() {
local netns=$1
ip netns exec ${netns} nft -f /dev/stdin <<EOF
ip netns exec "$netns" nft -f /dev/stdin <<EOF
table inet filter {
chain forward {
type filter hook forward priority raw;
......@@ -63,7 +62,7 @@ EOF
load_ruleset_count() {
local netns=$1
ip netns exec ${netns} nft -f /dev/stdin <<EOF
ip netns exec "$netns" nft -f /dev/stdin <<EOF
table inet filter {
chain prerouting {
type filter hook prerouting priority 0; policy accept;
......@@ -89,52 +88,49 @@ check_fib_counter() {
local ns=$2
local address=$3
line=$(ip netns exec ${ns} nft list table inet filter | grep 'fib saddr . iif' | grep $address | grep "packets $want" )
ret=$?
if [ $ret -ne 0 ];then
if ! ip netns exec "$ns" nft list table inet filter | grep 'fib saddr . iif' | grep "$address" | grep -q "packets $want";then
echo "Netns $ns fib counter doesn't match expected packet count of $want for $address" 1>&2
ip netns exec ${ns} nft list table inet filter
ip netns exec "$ns" nft list table inet filter
return 1
fi
if [ $want -gt 0 ]; then
if [ "$want" -gt 0 ]; then
echo "PASS: fib expression did drop packets for $address"
fi
return 0
}
load_ruleset ${nsrouter}
load_ruleset ${ns1}
load_ruleset ${ns2}
load_ruleset "$nsrouter"
load_ruleset "$ns1"
load_ruleset "$ns2"
if ! ip link add veth0 netns "$nsrouter" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1; then
echo "SKIP: No virtual ethernet pair device support in kernel"
exit $ksft_skip
fi
ip link add veth1 netns ${nsrouter} type veth peer name eth0 netns ${ns2}
ip link add veth1 netns "$nsrouter" type veth peer name eth0 netns "$ns2"
ip -net ${nsrouter} link set veth0 up
ip -net ${nsrouter} addr add 10.0.1.1/24 dev veth0
ip -net ${nsrouter} addr add dead:1::1/64 dev veth0 nodad
ip -net "$nsrouter" link set veth0 up
ip -net "$nsrouter" addr add 10.0.1.1/24 dev veth0
ip -net "$nsrouter" addr add dead:1::1/64 dev veth0 nodad
ip -net ${nsrouter} link set veth1 up
ip -net ${nsrouter} addr add 10.0.2.1/24 dev veth1
ip -net ${nsrouter} addr add dead:2::1/64 dev veth1 nodad
ip -net "$nsrouter" link set veth1 up
ip -net "$nsrouter" addr add 10.0.2.1/24 dev veth1
ip -net "$nsrouter" addr add dead:2::1/64 dev veth1 nodad
ip -net ${ns1} link set eth0 up
ip -net ${ns2} link set eth0 up
ip -net "$ns1" link set eth0 up
ip -net "$ns2" link set eth0 up
ip -net ${ns1} addr add 10.0.1.99/24 dev eth0
ip -net ${ns1} addr add dead:1::99/64 dev eth0 nodad
ip -net ${ns1} route add default via 10.0.1.1
ip -net ${ns1} route add default via dead:1::1
ip -net "$ns1" addr add 10.0.1.99/24 dev eth0
ip -net "$ns1" addr add dead:1::99/64 dev eth0 nodad
ip -net "$ns1" route add default via 10.0.1.1
ip -net "$ns1" route add default via dead:1::1
ip -net ${ns2} addr add 10.0.2.99/24 dev eth0
ip -net ${ns2} addr add dead:2::99/64 dev eth0 nodad
ip -net ${ns2} route add default via 10.0.2.1
ip -net ${ns2} route add default via dead:2::1
ip -net "$ns2" addr add 10.0.2.99/24 dev eth0
ip -net "$ns2" addr add dead:2::99/64 dev eth0 nodad
ip -net "$ns2" route add default via 10.0.2.1
ip -net "$ns2" route add default via dead:2::1
test_ping() {
local daddr4=$1
......@@ -155,11 +151,11 @@ test_ping() {
return 0
}
ip netns exec ${nsrouter} sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
ip netns exec ${nsrouter} sysctl net.ipv4.conf.all.rp_filter=0 > /dev/null
ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.rp_filter=0 > /dev/null
ip netns exec "$nsrouter" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
ip netns exec "$nsrouter" sysctl net.ipv4.conf.all.rp_filter=0 > /dev/null
ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.rp_filter=0 > /dev/null
test_ping 10.0.2.1 dead:2::1 || exit 1
check_drops || exit 1
......@@ -169,69 +165,67 @@ check_drops || exit 1
echo "PASS: fib expression did not cause unwanted packet drops"
ip netns exec ${nsrouter} nft flush table inet filter
ip netns exec "$nsrouter" nft flush table inet filter
ip -net ${ns1} route del default
ip -net ${ns1} -6 route del default
ip -net "$ns1" route del default
ip -net "$ns1" -6 route del default
ip -net ${ns1} addr del 10.0.1.99/24 dev eth0
ip -net ${ns1} addr del dead:1::99/64 dev eth0
ip -net "$ns1" addr del 10.0.1.99/24 dev eth0
ip -net "$ns1" addr del dead:1::99/64 dev eth0
ip -net ${ns1} addr add 10.0.2.99/24 dev eth0
ip -net "$ns1" addr add 10.0.2.99/24 dev eth0
ip -net "$ns1" addr add dead:2::99/64 dev eth0 nodad
ip -net ${ns1} route add default via 10.0.2.1
ip -net ${ns1} -6 route add default via dead:2::1
ip -net "$ns1" route add default via 10.0.2.1
ip -net "$ns1" -6 route add default via dead:2::1
ip -net "$nsrouter" addr add dead:2::1/64 dev veth0 nodad
# switch to ruleset that doesn't log, this time
# its expected that this does drop the packets.
load_ruleset_count ${nsrouter}
load_ruleset_count "$nsrouter"
# ns1 has a default route, but nsrouter does not.
# must not check return value, ping to 1.1.1.1 will
# fail.
check_fib_counter 0 ${nsrouter} 1.1.1.1 || exit 1
check_fib_counter 0 ${nsrouter} 1c3::c01d || exit 1
check_fib_counter 0 "$nsrouter" 1.1.1.1 || exit 1
check_fib_counter 0 "$nsrouter" 1c3::c01d || exit 1
ip netns exec "$ns1" ping -W 0.5 -c 1 -q 1.1.1.1 > /dev/null
check_fib_counter 1 ${nsrouter} 1.1.1.1 || exit 1
check_fib_counter 1 "$nsrouter" 1.1.1.1 || exit 1
ip netns exec "$ns1" ping -W 0.5 -i 0.1 -c 3 -q 1c3::c01d > /dev/null
check_fib_counter 3 ${nsrouter} 1c3::c01d || exit 1
check_fib_counter 3 "$nsrouter" 1c3::c01d || exit 1
# delete all rules
ip netns exec ${ns1} nft flush ruleset
ip netns exec ${ns2} nft flush ruleset
ip netns exec ${nsrouter} nft flush ruleset
ip netns exec "$ns1" nft flush ruleset
ip netns exec "$ns2" nft flush ruleset
ip netns exec "$nsrouter" nft flush ruleset
ip -net ${ns1} addr add 10.0.1.99/24 dev eth0
ip -net "$ns1" addr add 10.0.1.99/24 dev eth0
ip -net "$ns1" addr add dead:1::99/64 dev eth0 nodad
ip -net ${ns1} addr del 10.0.2.99/24 dev eth0
ip -net ${ns1} addr del dead:2::99/64 dev eth0
ip -net "$ns1" addr del 10.0.2.99/24 dev eth0
ip -net "$ns1" addr del dead:2::99/64 dev eth0
ip -net ${nsrouter} addr del dead:2::1/64 dev veth0
ip -net "$nsrouter" addr del dead:2::1/64 dev veth0
# ... pbr ruleset for the router, check iif+oif.
load_pbr_ruleset ${nsrouter}
if [ $? -ne 0 ] ; then
if ! load_pbr_ruleset "$nsrouter";then
echo "SKIP: Could not load fib forward ruleset"
exit $ksft_skip
fi
ip -net ${nsrouter} rule add from all table 128
ip -net ${nsrouter} rule add from all iif veth0 table 129
ip -net ${nsrouter} route add table 128 to 10.0.1.0/24 dev veth0
ip -net ${nsrouter} route add table 129 to 10.0.2.0/24 dev veth1
ip -net "$nsrouter" rule add from all table 128
ip -net "$nsrouter" rule add from all iif veth0 table 129
ip -net "$nsrouter" route add table 128 to 10.0.1.0/24 dev veth0
ip -net "$nsrouter" route add table 129 to 10.0.2.0/24 dev veth1
# drop main ipv4 table
ip -net ${nsrouter} -4 rule delete table main
ip -net "$nsrouter" -4 rule delete table main
test_ping 10.0.2.99 dead:2::99
if [ $? -ne 0 ] ; then
ip -net ${nsrouter} nft list ruleset
if ! test_ping 10.0.2.99 dead:2::99;then
ip -net "$nsrouter" nft list ruleset
echo "FAIL: fib mismatch in pbr setup"
exit 1
fi
......
tools/testing/selftests/net/netfilter/nft_meta.sh
View file @ 8442f8ba
......@@ -91,10 +91,10 @@ check_one_counter()
local want="packets $2"
local verbose="$3"
if ! ip netns exec "$ns0" nft list counter inet filter $cname | grep -q "$want"; then
if ! ip netns exec "$ns0" nft list counter inet filter "$cname" | grep -q "$want"; then
echo "FAIL: $cname, want \"$want\", got"
ret=1
ip netns exec "$ns0" nft list counter inet filter $cname
ip netns exec "$ns0" nft list counter inet filter "$cname"
fi
}
......
tools/testing/selftests/net/netfilter/nft_synproxy.sh
View file @ 8442f8ba
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# Kselftest framework requirement - SKIP code is 4.
ksft_skip=4
ret=0
rnd=$(mktemp -u XXXXXXXX)
nsr="nsr-$rnd" # synproxy machine
ns1="ns1-$rnd" # iperf client
ns2="ns2-$rnd" # iperf server
source lib.sh
checktool (){
if ! $1 > /dev/null 2>&1; then
echo "SKIP: Could not $2"
exit $ksft_skip
fi
}
ret=0
checktool "nft --version" "run test without nft tool"
checktool "ip -Version" "run test without ip tool"
checktool "iperf3 --version" "run test without iperf3"
checktool "ip netns add $nsr" "create net namespace"
modprobe -q nf_conntrack
setup_ns nsr ns1 ns2
ip netns add $ns1
ip netns add $ns2
modprobe -q nf_conntrack
cleanup() {
ip netns pids $ns1 | xargs kill 2>/dev/null
ip netns pids $ns2 | xargs kill 2>/dev/null
ip netns del $ns1
ip netns del $ns2
ip netns pids "$ns1" | xargs kill 2>/dev/null
ip netns pids "$ns2" | xargs kill 2>/dev/null
ip netns del $nsr
cleanup_all_ns
}
trap cleanup EXIT
ip link add veth0 netns $nsr type veth peer name eth0 netns $ns1
ip link add veth1 netns $nsr type veth peer name eth0 netns $ns2
ip link add veth0 netns "$nsr" type veth peer name eth0 netns "$ns1"
ip link add veth1 netns "$nsr" type veth peer name eth0 netns "$ns2"
for dev in lo veth0 veth1; do
ip -net $nsr link set $dev up
for dev in veth0 veth1; do
ip -net "$nsr" link set "$dev" up
done
ip -net $nsr addr add 10.0.1.1/24 dev veth0
ip -net $nsr addr add 10.0.2.1/24 dev veth1
ip -net "$nsr" addr add 10.0.1.1/24 dev veth0
ip -net "$nsr" addr add 10.0.2.1/24 dev veth1
ip netns exec $nsr sysctl -q net.ipv4.conf.veth0.forwarding=1
ip netns exec $nsr sysctl -q net.ipv4.conf.veth1.forwarding=1
ip netns exec $nsr sysctl -q net.netfilter.nf_conntrack_tcp_loose=0
ip netns exec "$nsr" sysctl -q net.ipv4.conf.veth0.forwarding=1
ip netns exec "$nsr" sysctl -q net.ipv4.conf.veth1.forwarding=1
ip netns exec "$nsr" sysctl -q net.netfilter.nf_conntrack_tcp_loose=0
for n in $ns1 $ns2; do
ip -net $n link set lo up
ip -net $n link set eth0 up
ip -net "$n" link set eth0 up
done
ip -net $ns1 addr add 10.0.1.99/24 dev eth0
ip -net $ns2 addr add 10.0.2.99/24 dev eth0
ip -net $ns1 route add default via 10.0.1.1
ip -net $ns2 route add default via 10.0.2.1
ip -net "$ns1" addr add 10.0.1.99/24 dev eth0
ip -net "$ns2" addr add 10.0.2.99/24 dev eth0
ip -net "$ns1" route add default via 10.0.1.1
ip -net "$ns2" route add default via 10.0.2.1
# test basic connectivity
if ! ip netns exec $ns1 ping -c 1 -q 10.0.2.99 > /dev/null; then
if ! ip netns exec "$ns1" ping -c 1 -q 10.0.2.99 > /dev/null; then
echo "ERROR: $ns1 cannot reach $ns2" 1>&2
exit 1
fi
if ! ip netns exec $ns2 ping -c 1 -q 10.0.1.99 > /dev/null; then
if ! ip netns exec "$ns2" ping -c 1 -q 10.0.1.99 > /dev/null; then
echo "ERROR: $ns2 cannot reach $ns1" 1>&2
exit 1
fi
ip netns exec $ns2 iperf3 -s > /dev/null 2>&1 &
ip netns exec "$ns2" iperf3 -s > /dev/null 2>&1 &
# ip netns exec $nsr tcpdump -vvv -n -i veth1 tcp | head -n 10 &
sleep 1
ip netns exec $nsr nft -f - <<EOF
ip netns exec "$nsr" nft -f - <<EOF
table inet filter {
chain prerouting {
type filter hook prerouting priority -300; policy accept;
......@@ -104,12 +85,10 @@ if [ $? -ne 0 ]; then
exit $ksft_skip
fi
ip netns exec $ns1 timeout 5 iperf3 -c 10.0.2.99 -n $((1 * 1024 * 1024)) > /dev/null
if [ $? -ne 0 ]; then
if ! ip netns exec "$ns1" timeout 5 iperf3 -c 10.0.2.99 -n $((1 * 1024 * 1024)) > /dev/null; then
echo "FAIL: iperf3 returned an error" 1>&2
ret=$?
ip netns exec $nsr nft list ruleset
ret=1
ip netns exec "$nsr" nft list ruleset
else
echo "PASS: synproxy connection successful"
fi
......
tools/testing/selftests/net/netfilter/nft_zones_many.sh
View file @ 8442f8ba
......@@ -3,11 +3,7 @@
# Test insertion speed for packets with identical addresses/ports
# that are all placed in distinct conntrack zones.
sfx=$(mktemp -u "XXXXXXXX")
ns="ns-$sfx"
# Kselftest framework requirement - SKIP code is 4.
ksft_skip=4
source lib.sh
zones=2000
have_ct_tool=0
......@@ -15,35 +11,25 @@ ret=0
cleanup()
{
ip netns del $ns
}
checktool (){
if ! $1 > /dev/null 2>&1; then
echo "SKIP: Could not $2"
exit $ksft_skip
fi
cleanup_all_ns
}
checktool "nft --version" "run test without nft tool"
checktool "ip -Version" "run test without ip tool"
checktool "socat -V" "run test without socat tool"
checktool "ip netns add $ns" "create net namespace"
setup_ns ns1
trap cleanup EXIT
conntrack -V > /dev/null 2>&1
if [ $? -eq 0 ];then
if conntrack -V > /dev/null 2>&1; then
have_ct_tool=1
fi
ip -net "$ns" link set lo up
test_zones() {
local max_zones=$1
ip netns exec $ns sysctl -q net.netfilter.nf_conntrack_udp_timeout=3600
ip netns exec $ns nft -f /dev/stdin<<EOF
ip netns exec "$ns1" sysctl -q net.netfilter.nf_conntrack_udp_timeout=3600
ip netns exec "$ns1" nft -f /dev/stdin<<EOF
flush ruleset
table inet raw {
map rndzone {
......@@ -56,29 +42,36 @@ table inet raw {
}
}
EOF
if [ "$?" -ne 0 ];then
echo "SKIP: Cannot add nftables rules"
exit $ksft_skip
fi
(
echo "add element inet raw rndzone {"
for i in $(seq 1 $max_zones);do
for i in $(seq 1 "$max_zones");do
echo -n "$i : $i"
if [ $i -lt $max_zones ]; then
if [ "$i" -lt "$max_zones" ]; then
echo ","
else
echo "}"
fi
done
) | ip netns exec $ns nft -f /dev/stdin
) | ip netns exec "$ns1" nft -f /dev/stdin
local i=0
local j=0
local outerstart=$(date +%s%3N)
local stop=$outerstart
while [ $i -lt $max_zones ]; do
local start=$(date +%s%3N)
local outerstart
local stop
outerstart=$(date +%s%3N)
stop=$outerstart
while [ "$i" -lt "$max_zones" ]; do
local start
start=$(date +%s%3N)
i=$((i + 1000))
j=$((j + 1))
# nft rule in output places each packet in a different zone.
dd if=/dev/zero of=/dev/stdout bs=8k count=1000 2>/dev/null | ip netns exec "$ns" socat STDIN UDP:127.0.0.1:12345,sourceport=12345
dd if=/dev/zero bs=8k count=1000 2>/dev/null | ip netns exec "$ns1" socat -u STDIN UDP:127.0.0.1:12345,sourceport=12345
if [ $? -ne 0 ] ;then
ret=1
break
......@@ -89,14 +82,15 @@ EOF
echo "PASS: added 1000 entries in $duration ms (now $i total, loop $j)"
done
if [ $have_ct_tool -eq 1 ]; then
local count=$(ip netns exec "$ns" conntrack -C)
local duration=$((stop-outerstart))
if [ "$have_ct_tool" -eq 1 ]; then
local count duration
count=$(ip netns exec "$ns1" conntrack -C)
duration=$((stop-outerstart))
if [ $count -eq $max_zones ]; then
if [ "$count" -eq "$max_zones" ]; then
echo "PASS: inserted $count entries from packet path in $duration ms total"
else
ip netns exec $ns conntrack -S 1>&2
ip netns exec "$ns1" conntrack -S 1>&2
echo "FAIL: inserted $count entries from packet path in $duration ms total, expected $max_zones entries"
ret=1
fi
......@@ -110,18 +104,19 @@ EOF
test_conntrack_tool() {
local max_zones=$1
ip netns exec $ns conntrack -F >/dev/null 2>/dev/null
ip netns exec "$ns1" conntrack -F >/dev/null 2>/dev/null
local outerstart=$(date +%s%3N)
local start=$(date +%s%3N)
local stop=$start
local i=0
while [ $i -lt $max_zones ]; do
local outerstart start stop i
outerstart=$(date +%s%3N)
start=$(date +%s%3N)
stop="$start"
i=0
while [ "$i" -lt "$max_zones" ]; do
i=$((i + 1))
ip netns exec "$ns" conntrack -I -s 1.1.1.1 -d 2.2.2.2 --protonum 6 \
ip netns exec "$ns1" conntrack -I -s 1.1.1.1 -d 2.2.2.2 --protonum 6 \
--timeout 3600 --state ESTABLISHED --sport 12345 --dport 1000 --zone $i >/dev/null 2>&1
if [ $? -ne 0 ];then
ip netns exec "$ns" conntrack -I -s 1.1.1.1 -d 2.2.2.2 --protonum 6 \
ip netns exec "$ns1" conntrack -I -s 1.1.1.1 -d 2.2.2.2 --protonum 6 \
--timeout 3600 --state ESTABLISHED --sport 12345 --dport 1000 --zone $i > /dev/null
echo "FAIL: conntrack -I returned an error"
ret=1
......@@ -137,13 +132,15 @@ test_conntrack_tool() {
fi
done
local count=$(ip netns exec "$ns" conntrack -C)
local duration=$((stop-outerstart))
local count
local duration
count=$(ip netns exec "$ns1" conntrack -C)
duration=$((stop-outerstart))
if [ $count -eq $max_zones ]; then
if [ "$count" -eq "$max_zones" ]; then
echo "PASS: inserted $count entries via ctnetlink in $duration ms"
else
ip netns exec $ns conntrack -S 1>&2
ip netns exec "$ns1" conntrack -S 1>&2
echo "FAIL: inserted $count entries via ctnetlink in $duration ms, expected $max_zones entries ($duration ms)"
ret=1
fi
......@@ -151,7 +148,7 @@ test_conntrack_tool() {
test_zones $zones
if [ $have_ct_tool -eq 1 ];then
if [ "$have_ct_tool" -eq 1 ];then
test_conntrack_tool $zones
else
echo "SKIP: Could not run ctnetlink insertion test without conntrack tool"
......
tools/testing/selftests/net/netfilter/xt_string.sh
View file @ 8442f8ba
......@@ -5,53 +5,57 @@
ksft_skip=4
rc=0
if ! iptables --version >/dev/null 2>&1; then
echo "SKIP: Test needs iptables"
exit $ksft_skip
fi
if ! ip -V >/dev/null 2>&1; then
echo "SKIP: Test needs iproute2"
exit $ksft_skip
fi
if ! nc -h >/dev/null 2>&1; then
echo "SKIP: Test needs netcat"
exit $ksft_skip
fi
source lib.sh
checktool "socat -h" "run test without socat"
checktool "iptables --version" "test needs iptables"
infile=$(mktemp)
cleanup()
{
ip netns del "$netns"
rm -f "$infile"
}
trap cleanup EXIT
setup_ns netns
ip -net "$netns" link add d0 type dummy
ip -net "$netns" link set d0 up
ip -net "$netns" addr add 10.1.2.1/24 dev d0
pattern="foo bar baz"
patlen=11
hdrlen=$((20 + 8)) # IPv4 + UDP
ns="ns-$(mktemp -u XXXXXXXX)"
trap 'ip netns del $ns' EXIT
ip netns add "$ns"
ip -net "$ns" link add d0 type dummy
ip -net "$ns" link set d0 up
ip -net "$ns" addr add 10.1.2.1/24 dev d0
#ip netns exec "$ns" tcpdump -npXi d0 &
#ip netns exec "$netns" tcpdump -npXi d0 &
#tcpdump_pid=$!
#trap 'kill $tcpdump_pid; ip netns del $ns' EXIT
#trap 'kill $tcpdump_pid; ip netns del $netns' EXIT
add_rule() { # (alg, from, to)
ip netns exec "$ns" \
ip netns exec "$netns" \
iptables -A OUTPUT -o d0 -m string \
--string "$pattern" --algo $1 --from $2 --to $3
--string "$pattern" --algo "$1" --from "$2" --to "$3"
}
showrules() { # ()
ip netns exec "$ns" iptables -v -S OUTPUT | grep '^-A'
ip netns exec "$netns" iptables -v -S OUTPUT | grep '^-A'
}
zerorules() {
ip netns exec "$ns" iptables -Z OUTPUT
ip netns exec "$netns" iptables -Z OUTPUT
}
countrule() { # (pattern)
showrules | grep -c -- "$*"
}
send() { # (offset)
( for ((i = 0; i < $1 - $hdrlen; i++)); do
printf " "
( for ((i = 0; i < $1 - hdrlen; i++)); do
echo -n " "
done
printf "$pattern"
) | ip netns exec "$ns" nc -w 1 -u 10.1.2.2 27374
echo -n "$pattern"
) > "$infile"
ip netns exec "$netns" socat -t 1 -u STDIN UDP-SENDTO:10.1.2.2:27374 < "$infile"
}
add_rule bm 1000 1500
......@@ -61,8 +65,8 @@ add_rule kmp 1400 1600
zerorules
send 0
send $((1000 - $patlen))
if [ $(countrule -c 0 0) -ne 4 ]; then
send $((1000 - patlen))
if [ "$(countrule -c 0 0)" -ne 4 ]; then
echo "FAIL: rules match data before --from"
showrules
((rc--))
......@@ -70,16 +74,16 @@ fi
zerorules
send 1000
send $((1400 - $patlen))
if [ $(countrule -c 2) -ne 2 ]; then
send $((1400 - patlen))
if [ "$(countrule -c 2)" -ne 2 ]; then
echo "FAIL: only two rules should match at low offset"
showrules
((rc--))
fi
zerorules
send $((1500 - $patlen))
if [ $(countrule -c 1) -ne 4 ]; then
send $((1500 - patlen))
if [ "$(countrule -c 1)" -ne 4 ]; then
echo "FAIL: all rules should match at end of packet"
showrules
((rc--))
......@@ -87,7 +91,7 @@ fi
zerorules
send 1495
if [ $(countrule -c 1) -ne 1 ]; then
if [ "$(countrule -c 1)" -ne 1 ]; then
echo "FAIL: only kmp with proper --to should match pattern spanning fragments"
showrules
((rc--))
......@@ -95,23 +99,23 @@ fi
zerorules
send 1500
if [ $(countrule -c 1) -ne 2 ]; then
if [ "$(countrule -c 1)" -ne 2 ]; then
echo "FAIL: two rules should match pattern at start of second fragment"
showrules
((rc--))
fi
zerorules
send $((1600 - $patlen))
if [ $(countrule -c 1) -ne 2 ]; then
send $((1600 - patlen))
if [ "$(countrule -c 1)" -ne 2 ]; then
echo "FAIL: two rules should match pattern at end of largest --to"
showrules
((rc--))
fi
zerorules
send $((1600 - $patlen + 1))
if [ $(countrule -c 1) -ne 0 ]; then
send $((1600 - patlen + 1))
if [ "$(countrule -c 1)" -ne 0 ]; then
echo "FAIL: no rules should match pattern extending largest --to"
showrules
((rc--))
......@@ -119,10 +123,11 @@ fi
zerorules
send 1600
if [ $(countrule -c 1) -ne 0 ]; then
if [ "$(countrule -c 1)" -ne 0 ]; then
echo "FAIL: no rule should match pattern past largest --to"
showrules
((rc--))
fi
[ $rc -eq 0 ] && echo "PASS: string match tests"
exit $rc
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7