Skip to content

L
linux
Commit fa03bb7c authored by Florian Westphal's avatar Florian Westphal Committed by Jakub Kicinski
Browse files
Options

selftests: netfilter: nft_conntrack_helper.sh: test to lib.sh infra 

prefer socat over nc, nc has too many incompatible versions around.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240411233624.8129-13-fw@strlen.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent f51fe025
Show whitespace changes
Inline Side-by-side
Showing with 53 additions and 79 deletions
tools/testing/selftests/net/netfilter/nft_conntrack_helper.sh
View file @ fa03bb7c
...@@ -5,72 +5,48 @@ ...@@ -5,72 +5,48 @@
# 2. auto-assign still works. # 2. auto-assign still works.
# #
# Kselftest framework requirement - SKIP code is 4. # Kselftest framework requirement - SKIP code is 4.
ksft_skip=4
source lib.sh
ret=0 ret=0
sfx=$(mktemp -u "XXXXXXXX")
ns1="ns1-$sfx"
ns2="ns2-$sfx"
testipv6=1 testipv6=1
checktool "socat -h" "run test without socat"
checktool "conntrack --version" "run test without conntrack"
checktool "nft --version" "run test without nft"
cleanup() cleanup()
{ {
ip netns del ${ns1} ip netns pids "$ns1" | xargs kill 2>/dev/null
ip netns del ${ns2}
}
nft --version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without nft tool"
exit $ksft_skip
fi
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without ip tool"
exit $ksft_skip
fi
conntrack -V > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without conntrack tool"
exit $ksft_skip
fi
which nc >/dev/null 2>&1 ip netns del "$ns1"
if [ $? -ne 0 ];then ip netns del "$ns2"
echo "SKIP: Could not run test without netcat tool" }
exit $ksft_skip
fi
trap cleanup EXIT trap cleanup EXIT
ip netns add ${ns1} setup_ns ns1 ns2
ip netns add ${ns2}
ip link add veth0 netns ${ns1} type veth peer name veth0 netns ${ns2} > /dev/null 2>&1 if ! ip link add veth0 netns "$ns1" type veth peer name veth0 netns "$ns2" > /dev/null 2>&1;then
if [ $? -ne 0 ];then
echo "SKIP: No virtual ethernet pair device support in kernel" echo "SKIP: No virtual ethernet pair device support in kernel"
exit $ksft_skip exit $ksft_skip
fi fi
ip -net ${ns1} link set lo up ip -net "$ns1" link set veth0 up
ip -net ${ns1} link set veth0 up ip -net "$ns2" link set veth0 up
ip -net ${ns2} link set lo up
ip -net ${ns2} link set veth0 up
ip -net ${ns1} addr add 10.0.1.1/24 dev veth0 ip -net "$ns1" addr add 10.0.1.1/24 dev veth0
ip -net ${ns1} addr add dead:1::1/64 dev veth0 ip -net "$ns1" addr add dead:1::1/64 dev veth0 nodad
ip -net ${ns2} addr add 10.0.1.2/24 dev veth0 ip -net "$ns2" addr add 10.0.1.2/24 dev veth0
ip -net ${ns2} addr add dead:1::2/64 dev veth0 ip -net "$ns2" addr add dead:1::2/64 dev veth0 nodad
load_ruleset_family() { load_ruleset_family() {
local family=$1 local family=$1
local ns=$2 local ns=$2
ip netns exec ${ns} nft -f - <<EOF ip netns exec "$ns" nft -f - <<EOF
table $family raw { table $family raw {
ct helper ftp { ct helper ftp {
type "ftp" protocol tcp type "ftp" protocol tcp
...@@ -94,22 +70,21 @@ check_for_helper() ...@@ -94,22 +70,21 @@ check_for_helper()
local message=$2 local message=$2
local port=$3 local port=$3
if echo $message |grep -q 'ipv6';then if echo "$message" |grep -q 'ipv6';then
local family="ipv6" local family="ipv6"
else else
local family="ipv4" local family="ipv4"
fi fi
ip netns exec ${netns} conntrack -L -f $family -p tcp --dport $port 2> /dev/null |grep -q 'helper=ftp' if ! ip netns exec "$netns" conntrack -L -f $family -p tcp --dport "$port" 2> /dev/null |grep -q 'helper=ftp';then
if [ $? -ne 0 ] ; then if [ "$autoassign" -eq 0 ] ;then
if [ $autoassign -eq 0 ] ;then
echo "FAIL: ${netns} did not show attached helper $message" 1>&2 echo "FAIL: ${netns} did not show attached helper $message" 1>&2
ret=1 ret=1
else else
echo "PASS: ${netns} did not show attached helper $message" 1>&2 echo "PASS: ${netns} did not show attached helper $message" 1>&2
fi fi
else else
if [ $autoassign -eq 0 ] ;then if [ "$autoassign" -eq 0 ] ;then
echo "PASS: ${netns} connection on port $port has ftp helper attached" 1>&2 echo "PASS: ${netns} connection on port $port has ftp helper attached" 1>&2
else else
echo "FAIL: ${netns} connection on port $port has ftp helper attached" 1>&2 echo "FAIL: ${netns} connection on port $port has ftp helper attached" 1>&2
...@@ -120,69 +95,68 @@ check_for_helper() ...@@ -120,69 +95,68 @@ check_for_helper()
return 0 return 0
} }
listener_ready()
{
ns="$1"
port="$2"
proto="$3"
ss -N "$ns" -lnt -o "sport = :$port" | grep -q "$port"
}
test_helper() test_helper()
{ {
local port=$1 local port=$1
local autoassign=$2 local autoassign=$2
if [ $autoassign -eq 0 ] ;then if [ "$autoassign" -eq 0 ] ;then
msg="set via ruleset" msg="set via ruleset"
else else
msg="auto-assign" msg="auto-assign"
fi fi
sleep 3 | ip netns exec ${ns2} nc -w 2 -l -p $port > /dev/null & ip netns exec "$ns2" socat -t 3 -u -4 TCP-LISTEN:"$port",reuseaddr STDOUT > /dev/null &
busywait "$BUSYWAIT_TIMEOUT" listener_ready "$ns2" "$port" "-4"
sleep 1 | ip netns exec ${ns1} nc -w 2 10.0.1.2 $port > /dev/null & ip netns exec "$ns1" socat -u -4 STDIN TCP:10.0.1.2:"$port" < /dev/null > /dev/null
sleep 1
check_for_helper "$ns1" "ip $msg" $port $autoassign check_for_helper "$ns1" "ip $msg" "$port" "$autoassign"
check_for_helper "$ns2" "ip $msg" $port $autoassign check_for_helper "$ns2" "ip $msg" "$port" "$autoassign"
wait
if [ $testipv6 -eq 0 ] ;then if [ $testipv6 -eq 0 ] ;then
return 0 return 0
fi fi
ip netns exec ${ns1} conntrack -F 2> /dev/null ip netns exec "$ns1" conntrack -F 2> /dev/null
ip netns exec ${ns2} conntrack -F 2> /dev/null ip netns exec "$ns2" conntrack -F 2> /dev/null
sleep 3 | ip netns exec ${ns2} nc -w 2 -6 -l -p $port > /dev/null &
sleep 1 | ip netns exec ${ns1} nc -w 2 -6 dead:1::2 $port > /dev/null & ip netns exec "$ns2" socat -t 3 -u -6 TCP-LISTEN:"$port",reuseaddr STDOUT > /dev/null &
sleep 1 busywait $BUSYWAIT_TIMEOUT listener_ready "$ns2" "$port" "-6"
check_for_helper "$ns1" "ipv6 $msg" $port ip netns exec "$ns1" socat -t 3 -u -6 STDIN TCP:"[dead:1::2]":"$port" < /dev/null > /dev/null
check_for_helper "$ns2" "ipv6 $msg" $port
wait check_for_helper "$ns1" "ipv6 $msg" "$port"
check_for_helper "$ns2" "ipv6 $msg" "$port"
} }
load_ruleset_family ip ${ns1} if ! load_ruleset_family ip "$ns1"; then
if [ $? -ne 0 ];then
echo "FAIL: ${ns1} cannot load ip ruleset" 1>&2 echo "FAIL: ${ns1} cannot load ip ruleset" 1>&2
exit 1 exit 1
fi fi
load_ruleset_family ip6 ${ns1} if ! load_ruleset_family ip6 "$ns1"; then
if [ $? -ne 0 ];then
echo "SKIP: ${ns1} cannot load ip6 ruleset" 1>&2 echo "SKIP: ${ns1} cannot load ip6 ruleset" 1>&2
testipv6=0 testipv6=0
fi fi
load_ruleset_family inet ${ns2} if ! load_ruleset_family inet "${ns2}"; then
if [ $? -ne 0 ];then
echo "SKIP: ${ns1} cannot load inet ruleset" 1>&2 echo "SKIP: ${ns1} cannot load inet ruleset" 1>&2
load_ruleset_family ip ${ns2} if ! load_ruleset_family ip "${ns2}"; then
if [ $? -ne 0 ];then
echo "FAIL: ${ns2} cannot load ip ruleset" 1>&2 echo "FAIL: ${ns2} cannot load ip ruleset" 1>&2
exit 1 exit 1
fi fi
if [ $testipv6 -eq 1 ] ;then if [ "$testipv6" -eq 1 ] ;then
load_ruleset_family ip6 ${ns2} if ! load_ruleset_family ip6 "$ns2"; then
if [ $? -ne 0 ];then
echo "FAIL: ${ns2} cannot load ip6 ruleset" 1>&2 echo "FAIL: ${ns2} cannot load ip6 ruleset" 1>&2
exit 1 exit 1
fi fi
...@@ -190,8 +164,8 @@ if [ $? -ne 0 ];then ...@@ -190,8 +164,8 @@ if [ $? -ne 0 ];then
fi fi
test_helper 2121 0 test_helper 2121 0
ip netns exec ${ns1} sysctl -qe 'net.netfilter.nf_conntrack_helper=1' ip netns exec "$ns1" sysctl -qe 'net.netfilter.nf_conntrack_helper=1'
ip netns exec ${ns2} sysctl -qe 'net.netfilter.nf_conntrack_helper=1' ip netns exec "$ns2" sysctl -qe 'net.netfilter.nf_conntrack_helper=1'
test_helper 21 1 test_helper 21 1
exit $ret exit $ret
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7