Skip to content

L
linux
Commit f03c528e authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files
Options

Merge branch 'selftest-netfilter-additional-cleanups' 

Florian Westphal says:

====================
selftest: netfilter: additional cleanups

This is the last planned series of the netfilter-selftest-move.
It contains cleanups (and speedups) and a few small updates to
scripts to improve error/skip reporting.

I intend to route future changes, if any, via nf(-next) trees
now that the 'massive code churn' phase is over.
====================

Link: https://lore.kernel.org/r/20240423130604.7013-1-fw@strlen.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 66270920 99bc5950
Hide whitespace changes
Inline Side-by-side
Showing with 263 additions and 255 deletions
tools/testing/selftests/net/netfilter/br_netfilter.sh
View file @ f03c528e
...@@ -124,6 +124,10 @@ table bridge filter { ...@@ -124,6 +124,10 @@ table bridge filter {
} }
} }
EOF EOF
if [ "$?" -ne 0 ];then
echo "SKIP: could not add nftables ruleset"
exit $ksft_skip
fi
# place 1, 2 & 3 in same subnet, connected via ns0:br0. # place 1, 2 & 3 in same subnet, connected via ns0:br0.
# ns4 is placed in same subnet as well, but its not # ns4 is placed in same subnet as well, but its not
......
tools/testing/selftests/net/netfilter/conntrack_vrf.sh
View file @ f03c528e
...@@ -43,15 +43,9 @@ cleanup() ...@@ -43,15 +43,9 @@ cleanup()
cleanup_all_ns cleanup_all_ns
} }
if ! nft --version > /dev/null 2>&1;then checktool "nft --version" "run test without nft"
echo "SKIP: Could not run test without nft tool" checktool "conntrack --version" "run test without conntrack"
exit $ksft_skip checktool "socat -h" "run test without socat"
fi
if ! conntrack --version > /dev/null 2>&1;then
echo "SKIP: Could not run test without conntrack tool"
exit $ksft_skip
fi
trap cleanup EXIT trap cleanup EXIT
...@@ -79,7 +73,15 @@ ip -net "$ns1" li set veth0 up ...@@ -79,7 +73,15 @@ ip -net "$ns1" li set veth0 up
ip -net "$ns0" addr add $IP0/$PFXL dev veth0 ip -net "$ns0" addr add $IP0/$PFXL dev veth0
ip -net "$ns1" addr add $IP1/$PFXL dev veth0 ip -net "$ns1" addr add $IP1/$PFXL dev veth0
ip netns exec "$ns1" iperf3 -s > /dev/null 2>&1 & listener_ready()
{
local ns="$1"
ss -N "$ns" -l -n -t -o "sport = :55555" | grep -q "55555"
}
ip netns exec "$ns1" socat -u -4 TCP-LISTEN:55555,reuseaddr,fork STDOUT > /dev/null &
busywait $BUSYWAIT_TIMEOUT listener_ready "$ns1"
# test vrf ingress handling. # test vrf ingress handling.
# The incoming connection should be placed in conntrack zone 1, # The incoming connection should be placed in conntrack zone 1,
...@@ -160,16 +162,16 @@ table ip nat { ...@@ -160,16 +162,16 @@ table ip nat {
} }
} }
EOF EOF
if ! ip netns exec "$ns0" ip vrf exec tvrf iperf3 -t 1 -c $IP1 >/dev/null; then if ! ip netns exec "$ns0" ip vrf exec tvrf socat -u -4 STDIN TCP:"$IP1":55555 < /dev/null > /dev/null;then
echo "FAIL: iperf3 connect failure with masquerade + sport rewrite on vrf device" echo "FAIL: connect failure with masquerade + sport rewrite on vrf device"
ret=1 ret=1
return return
fi fi
# must also check that nat table was evaluated on second (lower device) iteration. # must also check that nat table was evaluated on second (lower device) iteration.
ip netns exec "$ns0" nft list table ip nat |grep -q 'counter packets 2' && if ip netns exec "$ns0" nft list table ip nat |grep -q 'counter packets 1' &&
if ip netns exec "$ns0" nft list table ip nat |grep -q 'untracked counter packets [1-9]'; then ip netns exec "$ns0" nft list table ip nat |grep -q 'untracked counter packets [1-9]'; then
echo "PASS: iperf3 connect with masquerade + sport rewrite on vrf device ($qdisc qdisc)" echo "PASS: connect with masquerade + sport rewrite on vrf device ($qdisc qdisc)"
else else
echo "FAIL: vrf rules have unexpected counter value" echo "FAIL: vrf rules have unexpected counter value"
ret=1 ret=1
...@@ -195,15 +197,15 @@ table ip nat { ...@@ -195,15 +197,15 @@ table ip nat {
} }
} }
EOF EOF
if ! ip netns exec "$ns0" ip vrf exec tvrf iperf3 -t 1 -c $IP1 > /dev/null; then if ! ip netns exec "$ns0" ip vrf exec tvrf socat -u -4 STDIN TCP:"$IP1":55555 < /dev/null > /dev/null;then
echo "FAIL: iperf3 connect failure with masquerade + sport rewrite on veth device" echo "FAIL: connect failure with masquerade + sport rewrite on veth device"
ret=1 ret=1
return return
fi fi
# must also check that nat table was evaluated on second (lower device) iteration. # must also check that nat table was evaluated on second (lower device) iteration.
if ip netns exec "$ns0" nft list table ip nat |grep -q 'counter packets 2'; then if ip netns exec "$ns0" nft list table ip nat |grep -q 'counter packets 1'; then
echo "PASS: iperf3 connect with masquerade + sport rewrite on veth device" echo "PASS: connect with masquerade + sport rewrite on veth device"
else else
echo "FAIL: vrf masq rule has unexpected counter value" echo "FAIL: vrf masq rule has unexpected counter value"
ret=1 ret=1
......
tools/testing/selftests/net/netfilter/nft_audit.sh
View file @ f03c528e
...@@ -29,7 +29,8 @@ reset rules t c ...@@ -29,7 +29,8 @@ reset rules t c
EOF EOF
if [ "$?" -ne 0 ];then if [ "$?" -ne 0 ];then
echo "SKIP: nft reset feature test failed" echo -n "SKIP: nft reset feature test failed: "
nft --version
exit $SKIP_RC exit $SKIP_RC
fi fi
......
tools/testing/selftests/net/netfilter/nft_concat_range.sh
View file @ f03c528e
#!/bin/sh #!/bin/bash
# SPDX-License-Identifier: GPL-2.0 # SPDX-License-Identifier: GPL-2.0
# #
# nft_concat_range.sh - Tests for sets with concatenation of ranged fields # nft_concat_range.sh - Tests for sets with concatenation of ranged fields
...@@ -7,10 +7,10 @@ ...@@ -7,10 +7,10 @@
# #
# Author: Stefano Brivio <sbrivio@redhat.com> # Author: Stefano Brivio <sbrivio@redhat.com>
# #
# shellcheck disable=SC2154,SC2034,SC2016,SC2030,SC2031 # shellcheck disable=SC2154,SC2034,SC2016,SC2030,SC2031,SC2317
# ^ Configuration and templates sourced with eval, counters reused in subshells # ^ Configuration and templates sourced with eval, counters reused in subshells
KSELFTEST_SKIP=4 source lib.sh
# Available test groups: # Available test groups:
# - reported_issues: check for issues that were reported in the past # - reported_issues: check for issues that were reported in the past
...@@ -66,7 +66,7 @@ src ...@@ -66,7 +66,7 @@ src
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip nc bash tools sendip bash
proto udp proto udp
race_repeat 3 race_repeat 3
...@@ -91,7 +91,7 @@ src ...@@ -91,7 +91,7 @@ src
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp proto udp
race_repeat 3 race_repeat 3
...@@ -116,7 +116,7 @@ src ...@@ -116,7 +116,7 @@ src
start 10 start 10
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp6 proto udp6
race_repeat 3 race_repeat 3
...@@ -141,7 +141,7 @@ src ...@@ -141,7 +141,7 @@ src
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp proto udp
race_repeat 0 race_repeat 0
...@@ -163,7 +163,7 @@ src mac ...@@ -163,7 +163,7 @@ src mac
start 10 start 10
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp6 proto udp6
race_repeat 0 race_repeat 0
...@@ -185,7 +185,7 @@ src mac proto ...@@ -185,7 +185,7 @@ src mac proto
start 10 start 10
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp6 proto udp6
race_repeat 0 race_repeat 0
...@@ -207,7 +207,7 @@ src addr4 ...@@ -207,7 +207,7 @@ src addr4
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp proto udp
race_repeat 3 race_repeat 3
...@@ -227,7 +227,7 @@ src addr6 port ...@@ -227,7 +227,7 @@ src addr6 port
start 10 start 10
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc tools sendip socat
proto udp6 proto udp6
race_repeat 3 race_repeat 3
...@@ -247,7 +247,7 @@ src mac proto addr4 ...@@ -247,7 +247,7 @@ src mac proto addr4
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp proto udp
race_repeat 0 race_repeat 0
...@@ -264,7 +264,7 @@ src mac ...@@ -264,7 +264,7 @@ src mac
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp proto udp
race_repeat 0 race_repeat 0
...@@ -286,7 +286,7 @@ src mac addr4 ...@@ -286,7 +286,7 @@ src mac addr4
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp proto udp
race_repeat 0 race_repeat 0
...@@ -337,7 +337,7 @@ src addr4 ...@@ -337,7 +337,7 @@ src addr4
start 1 start 1
count 5 count 5
src_delta 2000 src_delta 2000
tools sendip socat nc tools sendip socat
proto udp proto udp
race_repeat 3 race_repeat 3
...@@ -363,7 +363,7 @@ src mac ...@@ -363,7 +363,7 @@ src mac
start 1 start 1
count 1 count 1
src_delta 2000 src_delta 2000
tools sendip socat nc bash tools sendip socat bash
proto udp proto udp
race_repeat 0 race_repeat 0
...@@ -473,8 +473,6 @@ setup_veth() { ...@@ -473,8 +473,6 @@ setup_veth() {
B() { B() {
ip netns exec B "$@" >/dev/null 2>&1 ip netns exec B "$@" >/dev/null 2>&1
} }
sleep 2
} }
# Fill in set template and initialise set # Fill in set template and initialise set
...@@ -488,12 +486,6 @@ check_tools() { ...@@ -488,12 +486,6 @@ check_tools() {
__tools= __tools=
for tool in ${tools}; do for tool in ${tools}; do
if [ "${tool}" = "nc" ] && [ "${proto}" = "udp6" ] && \
! nc -u -w0 1.1.1.1 1 2>/dev/null; then
# Some GNU netcat builds might not support IPv6
__tools="${__tools} netcat-openbsd"
continue
fi
__tools="${__tools} ${tool}" __tools="${__tools} ${tool}"
command -v "${tool}" >/dev/null && return 0 command -v "${tool}" >/dev/null && return 0
...@@ -554,30 +546,7 @@ setup_send_udp() { ...@@ -554,30 +546,7 @@ setup_send_udp() {
ip addr add "${dst_addr4}" dev veth_a 2>/dev/null ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
[ -z "${dst_port}" ] && dst_port=12345 [ -z "${dst_port}" ] && dst_port=12345
echo "test4" | B socat -t 0.01 STDIN UDP4-DATAGRAM:${dst_addr4}:${dst_port}"${__socatbind}" echo "test4" | B socat -t 0.01 STDIN UDP4-DATAGRAM:"$dst_addr4":"$dst_port""${__socatbind}"
src_addr4=
src_port=
}
elif command -v nc >/dev/null; then
if nc -u -w0 1.1.1.1 1 2>/dev/null; then
# OpenBSD netcat
nc_opt="-w0"
else
# GNU netcat
nc_opt="-q0"
fi
send_udp() {
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}" dev veth_b
__src_addr4="-s ${src_addr4}"
fi
ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
[ -n "${src_port}" ] && src_port="-p ${src_port}"
echo "" | B nc -u "${nc_opt}" "${__src_addr4}" \
"${src_port}" "${dst_addr4}" "${dst_port}"
src_addr4= src_addr4=
src_port= src_port=
...@@ -632,11 +601,7 @@ setup_send_udp6() { ...@@ -632,11 +601,7 @@ setup_send_udp6() {
__socatbind6= __socatbind6=
if [ -n "${src_addr6}" ]; then if [ -n "${src_addr6}" ]; then
if [ -n "${src_addr6} != "${src_addr6_added} ]; then B ip addr add "${src_addr6}" dev veth_b nodad
B ip addr add "${src_addr6}" dev veth_b nodad
src_addr6_added=${src_addr6}
fi
__socatbind6=",bind=[${src_addr6}]" __socatbind6=",bind=[${src_addr6}]"
...@@ -645,26 +610,7 @@ setup_send_udp6() { ...@@ -645,26 +610,7 @@ setup_send_udp6() {
fi fi
fi fi
echo "test6" | B socat -t 0.01 STDIN UDP6-DATAGRAM:[${dst_addr6}]:${dst_port}"${__socatbind6}" echo "test6" | B socat -t 0.01 STDIN UDP6-DATAGRAM:["$dst_addr6"]:"$dst_port""${__socatbind6}"
}
elif command -v nc >/dev/null && nc -u -w0 1.1.1.1 1 2>/dev/null; then
# GNU netcat might not work with IPv6, try next tool
send_udp6() {
ip -6 addr add "${dst_addr6}" dev veth_a nodad \
2>/dev/null
if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad
else
src_addr6="2001:db8::2"
fi
[ -n "${src_port}" ] && src_port="-p ${src_port}"
# shellcheck disable=SC2086 # this needs split options
echo "" | B nc -u w0 "-s${src_addr6}" ${src_port} \
${dst_addr6} ${dst_port}
src_addr6=
src_port=
} }
elif [ -z "$(bash -c 'type -p')" ]; then elif [ -z "$(bash -c 'type -p')" ]; then
send_udp6() { send_udp6() {
...@@ -679,10 +625,17 @@ setup_send_udp6() { ...@@ -679,10 +625,17 @@ setup_send_udp6() {
fi fi
} }
listener_ready()
{
port="$1"
ss -lnt -o "sport = :$port" | grep -q "$port"
}
# Set up function to send TCP traffic on IPv4 # Set up function to send TCP traffic on IPv4
setup_flood_tcp() { setup_flood_tcp() {
if command -v iperf3 >/dev/null; then if command -v iperf3 >/dev/null; then
flood_tcp() { flood_tcp() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b B ip addr add "${src_addr4}/16" dev veth_b
...@@ -699,7 +652,7 @@ setup_flood_tcp() { ...@@ -699,7 +652,7 @@ setup_flood_tcp() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
iperf3 -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1 iperf3 -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B iperf3 -c "${dst_addr4}" ${dst_port} ${src_port} \ B iperf3 -c "${dst_addr4}" ${dst_port} ${src_port} \
...@@ -711,6 +664,7 @@ setup_flood_tcp() { ...@@ -711,6 +664,7 @@ setup_flood_tcp() {
} }
elif command -v iperf >/dev/null; then elif command -v iperf >/dev/null; then
flood_tcp() { flood_tcp() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b B ip addr add "${src_addr4}/16" dev veth_b
...@@ -727,7 +681,7 @@ setup_flood_tcp() { ...@@ -727,7 +681,7 @@ setup_flood_tcp() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
iperf -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1 iperf -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B iperf -c "${dst_addr4}" ${dst_port} ${src_addr4} \ B iperf -c "${dst_addr4}" ${dst_port} ${src_addr4} \
...@@ -739,6 +693,7 @@ setup_flood_tcp() { ...@@ -739,6 +693,7 @@ setup_flood_tcp() {
} }
elif command -v netperf >/dev/null; then elif command -v netperf >/dev/null; then
flood_tcp() { flood_tcp() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b B ip addr add "${src_addr4}/16" dev veth_b
...@@ -755,7 +710,7 @@ setup_flood_tcp() { ...@@ -755,7 +710,7 @@ setup_flood_tcp() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
netserver -4 ${dst_port} -L "${dst_addr4}" \ netserver -4 ${dst_port} -L "${dst_addr4}" \
>/dev/null 2>&1 >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "${n_port}"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B netperf -4 -H "${dst_addr4}" ${dst_port} \ B netperf -4 -H "${dst_addr4}" ${dst_port} \
...@@ -774,6 +729,7 @@ setup_flood_tcp() { ...@@ -774,6 +729,7 @@ setup_flood_tcp() {
setup_flood_tcp6() { setup_flood_tcp6() {
if command -v iperf3 >/dev/null; then if command -v iperf3 >/dev/null; then
flood_tcp6() { flood_tcp6() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr6}" ]; then if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad B ip addr add "${src_addr6}" dev veth_b nodad
...@@ -790,7 +746,7 @@ setup_flood_tcp6() { ...@@ -790,7 +746,7 @@ setup_flood_tcp6() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
iperf3 -s -DB "${dst_addr6}" ${dst_port} >/dev/null 2>&1 iperf3 -s -DB "${dst_addr6}" ${dst_port} >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "${n_port}"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B iperf3 -c "${dst_addr6}" ${dst_port} \ B iperf3 -c "${dst_addr6}" ${dst_port} \
...@@ -802,6 +758,7 @@ setup_flood_tcp6() { ...@@ -802,6 +758,7 @@ setup_flood_tcp6() {
} }
elif command -v iperf >/dev/null; then elif command -v iperf >/dev/null; then
flood_tcp6() { flood_tcp6() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr6}" ]; then if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad B ip addr add "${src_addr6}" dev veth_b nodad
...@@ -818,7 +775,7 @@ setup_flood_tcp6() { ...@@ -818,7 +775,7 @@ setup_flood_tcp6() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
iperf -s -VDB "${dst_addr6}" ${dst_port} >/dev/null 2>&1 iperf -s -VDB "${dst_addr6}" ${dst_port} >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B iperf -c "${dst_addr6}" -V ${dst_port} \ B iperf -c "${dst_addr6}" -V ${dst_port} \
...@@ -830,6 +787,7 @@ setup_flood_tcp6() { ...@@ -830,6 +787,7 @@ setup_flood_tcp6() {
} }
elif command -v netperf >/dev/null; then elif command -v netperf >/dev/null; then
flood_tcp6() { flood_tcp6() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr6}" ]; then if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad B ip addr add "${src_addr6}" dev veth_b nodad
...@@ -846,7 +804,7 @@ setup_flood_tcp6() { ...@@ -846,7 +804,7 @@ setup_flood_tcp6() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
netserver -6 ${dst_port} -L "${dst_addr6}" \ netserver -6 ${dst_port} -L "${dst_addr6}" \
>/dev/null 2>&1 >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B netperf -6 -H "${dst_addr6}" ${dst_port} \ B netperf -6 -H "${dst_addr6}" ${dst_port} \
...@@ -865,6 +823,7 @@ setup_flood_tcp6() { ...@@ -865,6 +823,7 @@ setup_flood_tcp6() {
setup_flood_udp() { setup_flood_udp() {
if command -v iperf3 >/dev/null; then if command -v iperf3 >/dev/null; then
flood_udp() { flood_udp() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b B ip addr add "${src_addr4}/16" dev veth_b
...@@ -881,7 +840,7 @@ setup_flood_udp() { ...@@ -881,7 +840,7 @@ setup_flood_udp() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
iperf3 -s -DB "${dst_addr4}" ${dst_port} iperf3 -s -DB "${dst_addr4}" ${dst_port}
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B iperf3 -u -c "${dst_addr4}" -Z -b 100M -l16 -t1000 \ B iperf3 -u -c "${dst_addr4}" -Z -b 100M -l16 -t1000 \
...@@ -893,6 +852,7 @@ setup_flood_udp() { ...@@ -893,6 +852,7 @@ setup_flood_udp() {
} }
elif command -v iperf >/dev/null; then elif command -v iperf >/dev/null; then
flood_udp() { flood_udp() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b B ip addr add "${src_addr4}/16" dev veth_b
...@@ -909,7 +869,7 @@ setup_flood_udp() { ...@@ -909,7 +869,7 @@ setup_flood_udp() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
iperf -u -sDB "${dst_addr4}" ${dst_port} >/dev/null 2>&1 iperf -u -sDB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B iperf -u -c "${dst_addr4}" -b 100M -l1 -t1000 \ B iperf -u -c "${dst_addr4}" -b 100M -l1 -t1000 \
...@@ -921,6 +881,7 @@ setup_flood_udp() { ...@@ -921,6 +881,7 @@ setup_flood_udp() {
} }
elif command -v netperf >/dev/null; then elif command -v netperf >/dev/null; then
flood_udp() { flood_udp() {
local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}" [ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b B ip addr add "${src_addr4}/16" dev veth_b
...@@ -937,7 +898,7 @@ setup_flood_udp() { ...@@ -937,7 +898,7 @@ setup_flood_udp() {
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
netserver -4 ${dst_port} -L "${dst_addr4}" \ netserver -4 ${dst_port} -L "${dst_addr4}" \
>/dev/null 2>&1 >/dev/null 2>&1
sleep 2 busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options # shellcheck disable=SC2086 # this needs split options
B netperf -4 -H "${dst_addr4}" ${dst_port} \ B netperf -4 -H "${dst_addr4}" ${dst_port} \
...@@ -982,6 +943,7 @@ cleanup() { ...@@ -982,6 +943,7 @@ cleanup() {
ip link del dummy0 2>/dev/null ip link del dummy0 2>/dev/null
ip route del default 2>/dev/null ip route del default 2>/dev/null
ip -6 route del default 2>/dev/null ip -6 route del default 2>/dev/null
ip netns pids B 2>/dev/null | xargs kill 2>/dev/null
ip netns del B 2>/dev/null ip netns del B 2>/dev/null
ip link del veth_a 2>/dev/null ip link del veth_a 2>/dev/null
timeout= timeout=
...@@ -989,15 +951,14 @@ cleanup() { ...@@ -989,15 +951,14 @@ cleanup() {
killall iperf 2>/dev/null killall iperf 2>/dev/null
killall netperf 2>/dev/null killall netperf 2>/dev/null
killall netserver 2>/dev/null killall netserver 2>/dev/null
rm -f ${tmp} rm -f "$tmp"
sleep 2
} }
# Entry point for setup functions # Entry point for setup functions
setup() { setup() {
if [ "$(id -u)" -ne 0 ]; then if [ "$(id -u)" -ne 0 ]; then
echo " need to run as root" echo " need to run as root"
exit ${KSELFTEST_SKIP} exit ${ksft_skip}
fi fi
cleanup cleanup
...@@ -1258,7 +1219,7 @@ send_nomatch() { ...@@ -1258,7 +1219,7 @@ send_nomatch() {
# - check that packets outside range don't match it # - check that packets outside range don't match it
# - remove some elements, check that packets don't match anymore # - remove some elements, check that packets don't match anymore
test_correctness() { test_correctness() {
setup veth send_"${proto}" set || return ${KSELFTEST_SKIP} setup veth send_"${proto}" set || return ${ksft_skip}
range_size=1 range_size=1
for i in $(seq "${start}" $((start + count))); do for i in $(seq "${start}" $((start + count))); do
...@@ -1273,7 +1234,7 @@ test_correctness() { ...@@ -1273,7 +1234,7 @@ test_correctness() {
srcend=$((end + src_delta)) srcend=$((end + src_delta))
add "$(format)" || return 1 add "$(format)" || return 1
for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
send_match "${j}" $((j + src_delta)) || return 1 send_match "${j}" $((j + src_delta)) || return 1
done done
send_nomatch $((end + 1)) $((end + 1 + src_delta)) || return 1 send_nomatch $((end + 1)) $((end + 1 + src_delta)) || return 1
...@@ -1281,7 +1242,7 @@ test_correctness() { ...@@ -1281,7 +1242,7 @@ test_correctness() {
# Delete elements now and then # Delete elements now and then
if [ $((i % 3)) -eq 0 ]; then if [ $((i % 3)) -eq 0 ]; then
del "$(format)" || return 1 del "$(format)" || return 1
for j in $(seq ${start} \ for j in $(seq "$start" \
$((range_size / 2 + 1)) ${end}); do $((range_size / 2 + 1)) ${end}); do
send_nomatch "${j}" $((j + src_delta)) \ send_nomatch "${j}" $((j + src_delta)) \
|| return 1 || return 1
...@@ -1307,12 +1268,12 @@ test_concurrency() { ...@@ -1307,12 +1268,12 @@ test_concurrency() {
proto=${flood_proto} proto=${flood_proto}
tools=${flood_tools} tools=${flood_tools}
chain_spec=${flood_spec} chain_spec=${flood_spec}
setup veth flood_"${proto}" set || return ${KSELFTEST_SKIP} setup veth flood_"${proto}" set || return ${ksft_skip}
range_size=1 range_size=1
cstart=${start} cstart=${start}
flood_pids= flood_pids=
for i in $(seq ${start} $((start + count))); do for i in $(seq "$start" $((start + count))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
...@@ -1325,7 +1286,7 @@ test_concurrency() { ...@@ -1325,7 +1286,7 @@ test_concurrency() {
start=$((end + range_size)) start=$((end + range_size))
done done
sleep 10 sleep $((RANDOM%10))
pids= pids=
for c in $(seq 1 "$(nproc)"); do ( for c in $(seq 1 "$(nproc)"); do (
...@@ -1335,7 +1296,7 @@ test_concurrency() { ...@@ -1335,7 +1296,7 @@ test_concurrency() {
# $start needs to be local to this subshell # $start needs to be local to this subshell
# shellcheck disable=SC2030 # shellcheck disable=SC2030
start=${cstart} start=${cstart}
for i in $(seq ${start} $((start + count))); do for i in $(seq "$start" $((start + count))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
...@@ -1350,7 +1311,7 @@ test_concurrency() { ...@@ -1350,7 +1311,7 @@ test_concurrency() {
range_size=1 range_size=1
start=${cstart} start=${cstart}
for i in $(seq ${start} $((start + count))); do for i in $(seq "$start" $((start + count))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
...@@ -1366,7 +1327,7 @@ test_concurrency() { ...@@ -1366,7 +1327,7 @@ test_concurrency() {
range_size=1 range_size=1
start=${cstart} start=${cstart}
for i in $(seq ${start} $((start + count))); do for i in $(seq "$start" $((start + count))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
...@@ -1379,7 +1340,7 @@ test_concurrency() { ...@@ -1379,7 +1340,7 @@ test_concurrency() {
range_size=1 range_size=1
start=${cstart} start=${cstart}
for i in $(seq ${start} $((start + count))); do for i in $(seq "$start" $((start + count))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
...@@ -1407,18 +1368,18 @@ test_concurrency() { ...@@ -1407,18 +1368,18 @@ test_concurrency() {
# - add all the elements with 3s timeout while checking that packets match # - add all the elements with 3s timeout while checking that packets match
# - wait 3s after the last insertion, check that packets don't match any entry # - wait 3s after the last insertion, check that packets don't match any entry
test_timeout() { test_timeout() {
setup veth send_"${proto}" set || return ${KSELFTEST_SKIP} setup veth send_"${proto}" set || return ${ksft_skip}
timeout=3 timeout=3
range_size=1 range_size=1
for i in $(seq "${start}" $((start + count))); do for i in $(seq "$start" $((start + count))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
add "$(format)" || return 1 add "$(format)" || return 1
for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
send_match "${j}" $((j + src_delta)) || return 1 send_match "${j}" $((j + src_delta)) || return 1
done done
...@@ -1426,12 +1387,12 @@ test_timeout() { ...@@ -1426,12 +1387,12 @@ test_timeout() {
start=$((end + range_size)) start=$((end + range_size))
done done
sleep 3 sleep 3
for i in $(seq ${start} $((start + count))); do for i in $(seq "$start" $((start + count))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
send_nomatch "${j}" $((j + src_delta)) || return 1 send_nomatch "${j}" $((j + src_delta)) || return 1
done done
...@@ -1450,13 +1411,13 @@ test_performance() { ...@@ -1450,13 +1411,13 @@ test_performance() {
chain_spec=${perf_spec} chain_spec=${perf_spec}
dst="${perf_dst}" dst="${perf_dst}"
src="${perf_src}" src="${perf_src}"
setup veth perf set || return ${KSELFTEST_SKIP} setup veth perf set || return ${ksft_skip}
first=${start} first=${start}
range_size=1 range_size=1
for set in test norange noconcat; do for set in test norange noconcat; do
start=${first} start=${first}
for i in $(seq ${start} $((start + perf_entries))); do for i in $(seq "$start" $((start + perf_entries))); do
end=$((start + range_size)) end=$((start + range_size))
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
...@@ -1464,7 +1425,7 @@ test_performance() { ...@@ -1464,7 +1425,7 @@ test_performance() {
if [ $((end / 65534)) -gt $((start / 65534)) ]; then if [ $((end / 65534)) -gt $((start / 65534)) ]; then
start=${end} start=${end}
end=$((end + 1)) end=$((end + 1))
elif [ ${start} -eq ${end} ]; then elif [ "$start" -eq "$end" ]; then
end=$((start + 1)) end=$((start + 1))
fi fi
...@@ -1475,7 +1436,7 @@ test_performance() { ...@@ -1475,7 +1436,7 @@ test_performance() {
nft -f "${tmp}" nft -f "${tmp}"
done done
perf $((end - 1)) ${srcstart} perf $((end - 1)) "$srcstart"
sleep 2 sleep 2
...@@ -1522,11 +1483,11 @@ test_bug_flush_remove_add() { ...@@ -1522,11 +1483,11 @@ test_bug_flush_remove_add() {
set_cmd='{ set s { type ipv4_addr . inet_service; flags interval; }; }' set_cmd='{ set s { type ipv4_addr . inet_service; flags interval; }; }'
elem1='{ 10.0.0.1 . 22-25, 10.0.0.1 . 10-20 }' elem1='{ 10.0.0.1 . 22-25, 10.0.0.1 . 10-20 }'
elem2='{ 10.0.0.1 . 10-20, 10.0.0.1 . 22-25 }' elem2='{ 10.0.0.1 . 10-20, 10.0.0.1 . 22-25 }'
for i in `seq 1 100`; do for i in $(seq 1 100); do
nft add table t ${set_cmd} || return ${KSELFTEST_SKIP} nft add table t "$set_cmd" || return ${ksft_skip}
nft add element t s ${elem1} 2>/dev/null || return 1 nft add element t s "$elem1" 2>/dev/null || return 1
nft flush set t s 2>/dev/null || return 1 nft flush set t s 2>/dev/null || return 1
nft add element t s ${elem2} 2>/dev/null || return 1 nft add element t s "$elem2" 2>/dev/null || return 1
done done
nft flush ruleset nft flush ruleset
} }
...@@ -1534,7 +1495,7 @@ test_bug_flush_remove_add() { ...@@ -1534,7 +1495,7 @@ test_bug_flush_remove_add() {
# - add ranged element, check that packets match it # - add ranged element, check that packets match it
# - reload the set, check packets still match # - reload the set, check packets still match
test_bug_reload() { test_bug_reload() {
setup veth send_"${proto}" set || return ${KSELFTEST_SKIP} setup veth send_"${proto}" set || return ${ksft_skip}
rstart=${start} rstart=${start}
range_size=1 range_size=1
...@@ -1573,7 +1534,7 @@ test_bug_reload() { ...@@ -1573,7 +1534,7 @@ test_bug_reload() {
srcstart=$((start + src_delta)) srcstart=$((start + src_delta))
srcend=$((end + src_delta)) srcend=$((end + src_delta))
for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
send_match "${j}" $((j + src_delta)) || return 1 send_match "${j}" $((j + src_delta)) || return 1
done done
...@@ -1596,7 +1557,7 @@ trap cleanup EXIT ...@@ -1596,7 +1557,7 @@ trap cleanup EXIT
# Entry point for test runs # Entry point for test runs
passed=0 passed=0
for name in ${TESTS}; do for name in ${TESTS}; do
printf "TEST: %s\n" "$(echo ${name} | tr '_' ' ')" printf "TEST: %s\n" "$(echo "$name" | tr '_' ' ')"
if [ "${name}" = "reported_issues" ]; then if [ "${name}" = "reported_issues" ]; then
SUBTESTS="${BUGS}" SUBTESTS="${BUGS}"
else else
...@@ -1635,11 +1596,11 @@ for name in ${TESTS}; do ...@@ -1635,11 +1596,11 @@ for name in ${TESTS}; do
printf "[FAIL]\n" printf "[FAIL]\n"
err_flush err_flush
exit 1 exit 1
elif [ $ret -eq ${KSELFTEST_SKIP} ]; then elif [ $ret -eq ${ksft_skip} ]; then
printf "[SKIP]\n" printf "[SKIP]\n"
err_flush err_flush
fi fi
done done
done done
[ ${passed} -eq 0 ] && exit ${KSELFTEST_SKIP} || exit 0 [ ${passed} -eq 0 ] && exit ${ksft_skip} || exit 0
tools/testing/selftests/net/netfilter/nft_flowtable.sh
View file @ f03c528e
...@@ -37,17 +37,17 @@ cleanup() { ...@@ -37,17 +37,17 @@ cleanup() {
rm -f "$nsin" "$ns1out" "$ns2out" rm -f "$nsin" "$ns1out" "$ns2out"
[ $log_netns -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns=$log_netns [ "$log_netns" -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns="$log_netns"
} }
trap cleanup EXIT trap cleanup EXIT
sysctl -q net.netfilter.nf_log_all_netns=1 sysctl -q net.netfilter.nf_log_all_netns=1
ip link add veth0 netns $nsr1 type veth peer name eth0 netns $ns1 ip link add veth0 netns "$nsr1" type veth peer name eth0 netns "$ns1"
ip link add veth1 netns $nsr1 type veth peer name veth0 netns $nsr2 ip link add veth1 netns "$nsr1" type veth peer name veth0 netns "$nsr2"
ip link add veth1 netns $nsr2 type veth peer name eth0 netns $ns2 ip link add veth1 netns "$nsr2" type veth peer name eth0 netns "$ns2"
for dev in veth0 veth1; do for dev in veth0 veth1; do
ip -net "$nsr1" link set "$dev" up ip -net "$nsr1" link set "$dev" up
...@@ -90,17 +90,25 @@ do ...@@ -90,17 +90,25 @@ do
esac esac
done done
if ! ip -net $nsr1 link set veth0 mtu $omtu; then if ! ip -net "$nsr1" link set veth0 mtu "$omtu"; then
exit 1 exit 1
fi fi
ip -net $ns1 link set eth0 mtu $omtu ip -net "$ns1" link set eth0 mtu "$omtu"
if ! ip -net $nsr2 link set veth1 mtu $rmtu; then if ! ip -net "$nsr2" link set veth1 mtu "$rmtu"; then
exit 1 exit 1
fi fi
ip -net $ns2 link set eth0 mtu $rmtu if ! ip -net "$nsr1" link set veth1 mtu "$lmtu"; then
exit 1
fi
if ! ip -net "$nsr2" link set veth0 mtu "$lmtu"; then
exit 1
fi
ip -net "$ns2" link set eth0 mtu "$rmtu"
# transfer-net between nsr1 and nsr2. # transfer-net between nsr1 and nsr2.
# these addresses are not used for connections. # these addresses are not used for connections.
...@@ -111,35 +119,34 @@ ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0 ...@@ -111,35 +119,34 @@ ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0
ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad
for i in 0 1; do for i in 0 1; do
ip netns exec $nsr1 sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null ip netns exec "$nsr1" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
ip netns exec $nsr2 sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null ip netns exec "$nsr2" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
done done
for ns in $ns1 $ns2;do for ns in "$ns1" "$ns2";do
ip -net $ns link set lo up ip -net "$ns" link set eth0 up
ip -net $ns link set eth0 up
if ! ip netns exec $ns sysctl net.ipv4.tcp_no_metrics_save=1 > /dev/null; then if ! ip netns exec "$ns" sysctl net.ipv4.tcp_no_metrics_save=1 > /dev/null; then
echo "ERROR: Check Originator/Responder values (problem during address addition)" echo "ERROR: Check Originator/Responder values (problem during address addition)"
exit 1 exit 1
fi fi
# don't set ip DF bit for first two tests # don't set ip DF bit for first two tests
ip netns exec $ns sysctl net.ipv4.ip_no_pmtu_disc=1 > /dev/null ip netns exec "$ns" sysctl net.ipv4.ip_no_pmtu_disc=1 > /dev/null
done done
ip -net $ns1 addr add 10.0.1.99/24 dev eth0 ip -net "$ns1" addr add 10.0.1.99/24 dev eth0
ip -net $ns2 addr add 10.0.2.99/24 dev eth0 ip -net "$ns2" addr add 10.0.2.99/24 dev eth0
ip -net $ns1 route add default via 10.0.1.1 ip -net "$ns1" route add default via 10.0.1.1
ip -net $ns2 route add default via 10.0.2.1 ip -net "$ns2" route add default via 10.0.2.1
ip -net $ns1 addr add dead:1::99/64 dev eth0 nodad ip -net "$ns1" addr add dead:1::99/64 dev eth0 nodad
ip -net $ns2 addr add dead:2::99/64 dev eth0 nodad ip -net "$ns2" addr add dead:2::99/64 dev eth0 nodad
ip -net $ns1 route add default via dead:1::1 ip -net "$ns1" route add default via dead:1::1
ip -net $ns2 route add default via dead:2::1 ip -net "$ns2" route add default via dead:2::1
ip -net $nsr1 route add default via 192.168.10.2 ip -net "$nsr1" route add default via 192.168.10.2
ip -net $nsr2 route add default via 192.168.10.1 ip -net "$nsr2" route add default via 192.168.10.1
ip netns exec $nsr1 nft -f - <<EOF ip netns exec "$nsr1" nft -f - <<EOF
table inet filter { table inet filter {
flowtable f1 { flowtable f1 {
hook ingress priority 0 hook ingress priority 0
...@@ -171,7 +178,7 @@ if [ $? -ne 0 ]; then ...@@ -171,7 +178,7 @@ if [ $? -ne 0 ]; then
exit $ksft_skip exit $ksft_skip
fi fi
ip netns exec $ns2 nft -f - <<EOF ip netns exec "$ns2" nft -f - <<EOF
table inet filter { table inet filter {
counter ip4dscp0 { } counter ip4dscp0 { }
counter ip4dscp3 { } counter ip4dscp3 { }
...@@ -187,17 +194,18 @@ table inet filter { ...@@ -187,17 +194,18 @@ table inet filter {
EOF EOF
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
echo "SKIP: Could not load nft ruleset" echo -n "SKIP: Could not load ruleset: "
nft --version
exit $ksft_skip exit $ksft_skip
fi fi
# test basic connectivity # test basic connectivity
if ! ip netns exec $ns1 ping -c 1 -q 10.0.2.99 > /dev/null; then if ! ip netns exec "$ns1" ping -c 1 -q 10.0.2.99 > /dev/null; then
echo "ERROR: $ns1 cannot reach ns2" 1>&2 echo "ERROR: $ns1 cannot reach ns2" 1>&2
exit 1 exit 1
fi fi
if ! ip netns exec $ns2 ping -c 1 -q 10.0.1.99 > /dev/null; then if ! ip netns exec "$ns2" ping -c 1 -q 10.0.1.99 > /dev/null; then
echo "ERROR: $ns2 cannot reach $ns1" 1>&2 echo "ERROR: $ns2 cannot reach $ns1" 1>&2
exit 1 exit 1
fi fi
...@@ -227,23 +235,27 @@ check_counters() ...@@ -227,23 +235,27 @@ check_counters()
local what=$1 local what=$1
local ok=1 local ok=1
local orig=$(ip netns exec $nsr1 nft reset counter inet filter routed_orig | grep packets) local orig repl
local repl=$(ip netns exec $nsr1 nft reset counter inet filter routed_repl | grep packets) orig=$(ip netns exec "$nsr1" nft reset counter inet filter routed_orig | grep packets)
repl=$(ip netns exec "$nsr1" nft reset counter inet filter routed_repl | grep packets)
local orig_cnt=${orig#*bytes} local orig_cnt=${orig#*bytes}
local repl_cnt=${repl#*bytes} local repl_cnt=${repl#*bytes}
local fs=$(du -sb $nsin) local fs
fs=$(du -sb "$nsin")
local max_orig=${fs%%/*} local max_orig=${fs%%/*}
local max_repl=$((max_orig/4)) local max_repl=$((max_orig/4))
if [ $orig_cnt -gt $max_orig ];then # flowtable fastpath should bypass normal routing one, i.e. the counters in forward hook
# should always be lower than the size of the transmitted file (max_orig).
if [ "$orig_cnt" -gt "$max_orig" ];then
echo "FAIL: $what: original counter $orig_cnt exceeds expected value $max_orig" 1>&2 echo "FAIL: $what: original counter $orig_cnt exceeds expected value $max_orig" 1>&2
ret=1 ret=1
ok=0 ok=0
fi fi
if [ $repl_cnt -gt $max_repl ];then if [ "$repl_cnt" -gt $max_repl ];then
echo "FAIL: $what: reply counter $repl_cnt exceeds expected value $max_repl" 1>&2 echo "FAIL: $what: reply counter $repl_cnt exceeds expected value $max_repl" 1>&2
ret=1 ret=1
ok=0 ok=0
...@@ -259,39 +271,40 @@ check_dscp() ...@@ -259,39 +271,40 @@ check_dscp()
local what=$1 local what=$1
local ok=1 local ok=1
local counter=$(ip netns exec $ns2 nft reset counter inet filter ip4dscp3 | grep packets) local counter
counter=$(ip netns exec "$ns2" nft reset counter inet filter ip4dscp3 | grep packets)
local pc4=${counter%*bytes*} local pc4=${counter%*bytes*}
local pc4=${pc4#*packets} local pc4=${pc4#*packets}
local counter=$(ip netns exec $ns2 nft reset counter inet filter ip4dscp0 | grep packets) counter=$(ip netns exec "$ns2" nft reset counter inet filter ip4dscp0 | grep packets)
local pc4z=${counter%*bytes*} local pc4z=${counter%*bytes*}
local pc4z=${pc4z#*packets} local pc4z=${pc4z#*packets}
case "$what" in case "$what" in
"dscp_none") "dscp_none")
if [ $pc4 -gt 0 ] || [ $pc4z -eq 0 ]; then if [ "$pc4" -gt 0 ] || [ "$pc4z" -eq 0 ]; then
echo "FAIL: dscp counters do not match, expected dscp3 == 0, dscp0 > 0, but got $pc4,$pc4z" 1>&2 echo "FAIL: dscp counters do not match, expected dscp3 == 0, dscp0 > 0, but got $pc4,$pc4z" 1>&2
ret=1 ret=1
ok=0 ok=0
fi fi
;; ;;
"dscp_fwd") "dscp_fwd")
if [ $pc4 -eq 0 ] || [ $pc4z -eq 0 ]; then if [ "$pc4" -eq 0 ] || [ "$pc4z" -eq 0 ]; then
echo "FAIL: dscp counters do not match, expected dscp3 and dscp0 > 0 but got $pc4,$pc4z" 1>&2 echo "FAIL: dscp counters do not match, expected dscp3 and dscp0 > 0 but got $pc4,$pc4z" 1>&2
ret=1 ret=1
ok=0 ok=0
fi fi
;; ;;
"dscp_ingress") "dscp_ingress")
if [ $pc4 -eq 0 ] || [ $pc4z -gt 0 ]; then if [ "$pc4" -eq 0 ] || [ "$pc4z" -gt 0 ]; then
echo "FAIL: dscp counters do not match, expected dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2 echo "FAIL: dscp counters do not match, expected dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2
ret=1 ret=1
ok=0 ok=0
fi fi
;; ;;
"dscp_egress") "dscp_egress")
if [ $pc4 -eq 0 ] || [ $pc4z -gt 0 ]; then if [ "$pc4" -eq 0 ] || [ "$pc4z" -gt 0 ]; then
echo "FAIL: dscp counters do not match, expected dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2 echo "FAIL: dscp counters do not match, expected dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2
ret=1 ret=1
ok=0 ok=0
...@@ -303,7 +316,7 @@ check_dscp() ...@@ -303,7 +316,7 @@ check_dscp()
ok=0 ok=0
esac esac
if [ $ok -eq 1 ] ;then if [ "$ok" -eq 1 ] ;then
echo "PASS: $what: dscp packet counters match" echo "PASS: $what: dscp packet counters match"
fi fi
} }
...@@ -348,10 +361,12 @@ test_tcp_forwarding_ip() ...@@ -348,10 +361,12 @@ test_tcp_forwarding_ip()
if ! check_transfer "$nsin" "$ns2out" "ns1 -> ns2"; then if ! check_transfer "$nsin" "$ns2out" "ns1 -> ns2"; then
lret=1 lret=1
ret=1
fi fi
if ! check_transfer "$nsin" "$ns1out" "ns1 <- ns2"; then if ! check_transfer "$nsin" "$ns1out" "ns1 <- ns2"; then
lret=1 lret=1
ret=1
fi fi
return $lret return $lret
...@@ -368,7 +383,7 @@ test_tcp_forwarding_set_dscp() ...@@ -368,7 +383,7 @@ test_tcp_forwarding_set_dscp()
{ {
check_dscp "dscp_none" check_dscp "dscp_none"
ip netns exec $nsr1 nft -f - <<EOF ip netns exec "$nsr1" nft -f - <<EOF
table netdev dscpmangle { table netdev dscpmangle {
chain setdscp0 { chain setdscp0 {
type filter hook ingress device "veth0" priority 0; policy accept type filter hook ingress device "veth0" priority 0; policy accept
...@@ -380,12 +395,12 @@ if [ $? -eq 0 ]; then ...@@ -380,12 +395,12 @@ if [ $? -eq 0 ]; then
test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345
check_dscp "dscp_ingress" check_dscp "dscp_ingress"
ip netns exec $nsr1 nft delete table netdev dscpmangle ip netns exec "$nsr1" nft delete table netdev dscpmangle
else else
echo "SKIP: Could not load netdev:ingress for veth0" echo "SKIP: Could not load netdev:ingress for veth0"
fi fi
ip netns exec $nsr1 nft -f - <<EOF ip netns exec "$nsr1" nft -f - <<EOF
table netdev dscpmangle { table netdev dscpmangle {
chain setdscp0 { chain setdscp0 {
type filter hook egress device "veth1" priority 0; policy accept type filter hook egress device "veth1" priority 0; policy accept
...@@ -397,14 +412,14 @@ if [ $? -eq 0 ]; then ...@@ -397,14 +412,14 @@ if [ $? -eq 0 ]; then
test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345
check_dscp "dscp_egress" check_dscp "dscp_egress"
ip netns exec $nsr1 nft flush table netdev dscpmangle ip netns exec "$nsr1" nft flush table netdev dscpmangle
else else
echo "SKIP: Could not load netdev:egress for veth1" echo "SKIP: Could not load netdev:egress for veth1"
fi fi
# partial. If flowtable really works, then both dscp-is-0 and dscp-is-cs3 # partial. If flowtable really works, then both dscp-is-0 and dscp-is-cs3
# counters should have seen packets (before and after ft offload kicks in). # counters should have seen packets (before and after ft offload kicks in).
ip netns exec $nsr1 nft -a insert rule inet filter forward ip dscp set cs3 ip netns exec "$nsr1" nft -a insert rule inet filter forward ip dscp set cs3
test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345
check_dscp "dscp_fwd" check_dscp "dscp_fwd"
} }
...@@ -420,8 +435,8 @@ test_tcp_forwarding_nat() ...@@ -420,8 +435,8 @@ test_tcp_forwarding_nat()
pmtu=$3 pmtu=$3
what=$4 what=$4
if [ $lret -eq 0 ] ; then if [ "$lret" -eq 0 ] ; then
if [ $pmtu -eq 1 ] ;then if [ "$pmtu" -eq 1 ] ;then
check_counters "flow offload for ns1/ns2 with masquerade and pmtu discovery $what" check_counters "flow offload for ns1/ns2 with masquerade and pmtu discovery $what"
else else
echo "PASS: flow offload for ns1/ns2 with masquerade $what" echo "PASS: flow offload for ns1/ns2 with masquerade $what"
...@@ -429,9 +444,9 @@ test_tcp_forwarding_nat() ...@@ -429,9 +444,9 @@ test_tcp_forwarding_nat()
test_tcp_forwarding_ip "$1" "$2" 10.6.6.6 1666 test_tcp_forwarding_ip "$1" "$2" 10.6.6.6 1666
lret=$? lret=$?
if [ $pmtu -eq 1 ] ;then if [ "$pmtu" -eq 1 ] ;then
check_counters "flow offload for ns1/ns2 with dnat and pmtu discovery $what" check_counters "flow offload for ns1/ns2 with dnat and pmtu discovery $what"
elif [ $lret -eq 0 ] ; then elif [ "$lret" -eq 0 ] ; then
echo "PASS: flow offload for ns1/ns2 with dnat $what" echo "PASS: flow offload for ns1/ns2 with dnat $what"
fi fi
fi fi
...@@ -446,25 +461,25 @@ make_file "$nsin" ...@@ -446,25 +461,25 @@ make_file "$nsin"
# Due to MTU mismatch in both directions, all packets (except small packets like pure # Due to MTU mismatch in both directions, all packets (except small packets like pure
# acks) have to be handled by normal forwarding path. Therefore, packet counters # acks) have to be handled by normal forwarding path. Therefore, packet counters
# are not checked. # are not checked.
if test_tcp_forwarding $ns1 $ns2; then if test_tcp_forwarding "$ns1" "$ns2"; then
echo "PASS: flow offloaded for ns1/ns2" echo "PASS: flow offloaded for ns1/ns2"
else else
echo "FAIL: flow offload for ns1/ns2:" 1>&2 echo "FAIL: flow offload for ns1/ns2:" 1>&2
ip netns exec $nsr1 nft list ruleset ip netns exec "$nsr1" nft list ruleset
ret=1 ret=1
fi fi
# delete default route, i.e. ns2 won't be able to reach ns1 and # delete default route, i.e. ns2 won't be able to reach ns1 and
# will depend on ns1 being masqueraded in nsr1. # will depend on ns1 being masqueraded in nsr1.
# expect ns1 has nsr1 address. # expect ns1 has nsr1 address.
ip -net $ns2 route del default via 10.0.2.1 ip -net "$ns2" route del default via 10.0.2.1
ip -net $ns2 route del default via dead:2::1 ip -net "$ns2" route del default via dead:2::1
ip -net $ns2 route add 192.168.10.1 via 10.0.2.1 ip -net "$ns2" route add 192.168.10.1 via 10.0.2.1
# Second test: # Second test:
# Same, but with NAT enabled. Same as in first test: we expect normal forward path # Same, but with NAT enabled. Same as in first test: we expect normal forward path
# to handle most packets. # to handle most packets.
ip netns exec $nsr1 nft -f - <<EOF ip netns exec "$nsr1" nft -f - <<EOF
table ip nat { table ip nat {
chain prerouting { chain prerouting {
type nat hook prerouting priority 0; policy accept; type nat hook prerouting priority 0; policy accept;
...@@ -478,14 +493,14 @@ table ip nat { ...@@ -478,14 +493,14 @@ table ip nat {
} }
EOF EOF
if ! test_tcp_forwarding_set_dscp $ns1 $ns2 0 ""; then if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 0 ""; then
echo "FAIL: flow offload for ns1/ns2 with dscp update" 1>&2 echo "FAIL: flow offload for ns1/ns2 with dscp update" 1>&2
exit 0 exit 0
fi fi
if ! test_tcp_forwarding_nat $ns1 $ns2 0 ""; then if ! test_tcp_forwarding_nat "$ns1" "$ns2" 0 ""; then
echo "FAIL: flow offload for ns1/ns2 with NAT" 1>&2 echo "FAIL: flow offload for ns1/ns2 with NAT" 1>&2
ip netns exec $nsr1 nft list ruleset ip netns exec "$nsr1" nft list ruleset
ret=1 ret=1
fi fi
...@@ -493,35 +508,40 @@ fi ...@@ -493,35 +508,40 @@ fi
# Same as second test, but with PMTU discovery enabled. This # Same as second test, but with PMTU discovery enabled. This
# means that we expect the fastpath to handle packets as soon # means that we expect the fastpath to handle packets as soon
# as the endpoints adjust the packet size. # as the endpoints adjust the packet size.
ip netns exec $ns1 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null ip netns exec "$ns1" sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
ip netns exec $ns2 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null ip netns exec "$ns2" sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
# reset counters. # reset counters.
# With pmtu in-place we'll also check that nft counters # With pmtu in-place we'll also check that nft counters
# are lower than file size and packets were forwarded via flowtable layer. # are lower than file size and packets were forwarded via flowtable layer.
# For earlier tests (large mtus), packets cannot be handled via flowtable # For earlier tests (large mtus), packets cannot be handled via flowtable
# (except pure acks and other small packets). # (except pure acks and other small packets).
ip netns exec $nsr1 nft reset counters table inet filter >/dev/null ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
if ! test_tcp_forwarding_nat $ns1 $ns2 1 ""; then if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 ""; then
echo "FAIL: flow offload for ns1/ns2 with NAT and pmtu discovery" 1>&2 echo "FAIL: flow offload for ns1/ns2 with NAT and pmtu discovery" 1>&2
ip netns exec $nsr1 nft list ruleset ip netns exec "$nsr1" nft list ruleset
fi fi
# Another test: # Another test:
# Add bridge interface br0 to Router1, with NAT enabled. # Add bridge interface br0 to Router1, with NAT enabled.
ip -net $nsr1 link add name br0 type bridge test_bridge() {
ip -net $nsr1 addr flush dev veth0 if ! ip -net "$nsr1" link add name br0 type bridge 2>/dev/null;then
ip -net $nsr1 link set up dev veth0 echo "SKIP: could not add bridge br0"
ip -net $nsr1 link set veth0 master br0 [ "$ret" -eq 0 ] && ret=$ksft_skip
ip -net $nsr1 addr add 10.0.1.1/24 dev br0 return
ip -net $nsr1 addr add dead:1::1/64 dev br0 nodad fi
ip -net $nsr1 link set up dev br0 ip -net "$nsr1" addr flush dev veth0
ip -net "$nsr1" link set up dev veth0
ip -net "$nsr1" link set veth0 master br0
ip -net "$nsr1" addr add 10.0.1.1/24 dev br0
ip -net "$nsr1" addr add dead:1::1/64 dev br0 nodad
ip -net "$nsr1" link set up dev br0
ip netns exec $nsr1 sysctl net.ipv4.conf.br0.forwarding=1 > /dev/null ip netns exec "$nsr1" sysctl net.ipv4.conf.br0.forwarding=1 > /dev/null
# br0 with NAT enabled. # br0 with NAT enabled.
ip netns exec $nsr1 nft -f - <<EOF ip netns exec "$nsr1" nft -f - <<EOF
flush table ip nat flush table ip nat
table ip nat { table ip nat {
chain prerouting { chain prerouting {
...@@ -536,56 +556,59 @@ table ip nat { ...@@ -536,56 +556,59 @@ table ip nat {
} }
EOF EOF
if ! test_tcp_forwarding_nat $ns1 $ns2 1 "on bridge"; then if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "on bridge"; then
echo "FAIL: flow offload for ns1/ns2 with bridge NAT" 1>&2 echo "FAIL: flow offload for ns1/ns2 with bridge NAT" 1>&2
ip netns exec $nsr1 nft list ruleset ip netns exec "$nsr1" nft list ruleset
ret=1 ret=1
fi fi
# Another test: # Another test:
# Add bridge interface br0 to Router1, with NAT and VLAN. # Add bridge interface br0 to Router1, with NAT and VLAN.
ip -net $nsr1 link set veth0 nomaster ip -net "$nsr1" link set veth0 nomaster
ip -net $nsr1 link set down dev veth0 ip -net "$nsr1" link set down dev veth0
ip -net $nsr1 link add link veth0 name veth0.10 type vlan id 10 ip -net "$nsr1" link add link veth0 name veth0.10 type vlan id 10
ip -net $nsr1 link set up dev veth0 ip -net "$nsr1" link set up dev veth0
ip -net $nsr1 link set up dev veth0.10 ip -net "$nsr1" link set up dev veth0.10
ip -net $nsr1 link set veth0.10 master br0 ip -net "$nsr1" link set veth0.10 master br0
ip -net $ns1 addr flush dev eth0 ip -net "$ns1" addr flush dev eth0
ip -net $ns1 link add link eth0 name eth0.10 type vlan id 10 ip -net "$ns1" link add link eth0 name eth0.10 type vlan id 10
ip -net $ns1 link set eth0 up ip -net "$ns1" link set eth0 up
ip -net $ns1 link set eth0.10 up ip -net "$ns1" link set eth0.10 up
ip -net $ns1 addr add 10.0.1.99/24 dev eth0.10 ip -net "$ns1" addr add 10.0.1.99/24 dev eth0.10
ip -net $ns1 route add default via 10.0.1.1 ip -net "$ns1" route add default via 10.0.1.1
ip -net $ns1 addr add dead:1::99/64 dev eth0.10 nodad ip -net "$ns1" addr add dead:1::99/64 dev eth0.10 nodad
if ! test_tcp_forwarding_nat $ns1 $ns2 1 "bridge and VLAN"; then if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "bridge and VLAN"; then
echo "FAIL: flow offload for ns1/ns2 with bridge NAT and VLAN" 1>&2 echo "FAIL: flow offload for ns1/ns2 with bridge NAT and VLAN" 1>&2
ip netns exec $nsr1 nft list ruleset ip netns exec "$nsr1" nft list ruleset
ret=1 ret=1
fi fi
# restore test topology (remove bridge and VLAN) # restore test topology (remove bridge and VLAN)
ip -net $nsr1 link set veth0 nomaster ip -net "$nsr1" link set veth0 nomaster
ip -net $nsr1 link set veth0 down ip -net "$nsr1" link set veth0 down
ip -net $nsr1 link set veth0.10 down ip -net "$nsr1" link set veth0.10 down
ip -net $nsr1 link delete veth0.10 type vlan ip -net "$nsr1" link delete veth0.10 type vlan
ip -net $nsr1 link delete br0 type bridge ip -net "$nsr1" link delete br0 type bridge
ip -net $ns1 addr flush dev eth0.10 ip -net "$ns1" addr flush dev eth0.10
ip -net $ns1 link set eth0.10 down ip -net "$ns1" link set eth0.10 down
ip -net $ns1 link set eth0 down ip -net "$ns1" link set eth0 down
ip -net $ns1 link delete eth0.10 type vlan ip -net "$ns1" link delete eth0.10 type vlan
# restore address in ns1 and nsr1 # restore address in ns1 and nsr1
ip -net $ns1 link set eth0 up ip -net "$ns1" link set eth0 up
ip -net $ns1 addr add 10.0.1.99/24 dev eth0 ip -net "$ns1" addr add 10.0.1.99/24 dev eth0
ip -net $ns1 route add default via 10.0.1.1 ip -net "$ns1" route add default via 10.0.1.1
ip -net $ns1 addr add dead:1::99/64 dev eth0 nodad ip -net "$ns1" addr add dead:1::99/64 dev eth0 nodad
ip -net $ns1 route add default via dead:1::1 ip -net "$ns1" route add default via dead:1::1
ip -net $nsr1 addr add 10.0.1.1/24 dev veth0 ip -net "$nsr1" addr add 10.0.1.1/24 dev veth0
ip -net $nsr1 addr add dead:1::1/64 dev veth0 nodad ip -net "$nsr1" addr add dead:1::1/64 dev veth0 nodad
ip -net $nsr1 link set up dev veth0 ip -net "$nsr1" link set up dev veth0
}
test_bridge
KEY_SHA="0x"$(ps -af | sha1sum | cut -d " " -f 1) KEY_SHA="0x"$(ps -af | sha1sum | cut -d " " -f 1)
KEY_AES="0x"$(ps -af | md5sum | cut -d " " -f 1) KEY_AES="0x"$(ps -af | md5sum | cut -d " " -f 1)
...@@ -605,25 +628,25 @@ do_esp() { ...@@ -605,25 +628,25 @@ do_esp() {
local spi_out=$6 local spi_out=$6
local spi_in=$7 local spi_in=$7
ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $rnet dst $lnet ip -net "$ns" xfrm state add src "$remote" dst "$me" proto esp spi "$spi_in" enc aes "$KEY_AES" auth sha1 "$KEY_SHA" mode tunnel sel src "$rnet" dst "$lnet"
ip -net $ns xfrm state add src $me dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet ip -net "$ns" xfrm state add src "$me" dst "$remote" proto esp spi "$spi_out" enc aes "$KEY_AES" auth sha1 "$KEY_SHA" mode tunnel sel src "$lnet" dst "$rnet"
# to encrypt packets as they go out (includes forwarded packets that need encapsulation) # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 1 action allow ip -net "$ns" xfrm policy add src "$lnet" dst "$rnet" dir out tmpl src "$me" dst "$remote" proto esp mode tunnel priority 1 action allow
# to fwd decrypted packets after esp processing: # to fwd decrypted packets after esp processing:
ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 1 action allow ip -net "$ns" xfrm policy add src "$rnet" dst "$lnet" dir fwd tmpl src "$remote" dst "$me" proto esp mode tunnel priority 1 action allow
} }
do_esp $nsr1 192.168.10.1 192.168.10.2 10.0.1.0/24 10.0.2.0/24 $SPI1 $SPI2 do_esp "$nsr1" 192.168.10.1 192.168.10.2 10.0.1.0/24 10.0.2.0/24 "$SPI1" "$SPI2"
do_esp $nsr2 192.168.10.2 192.168.10.1 10.0.2.0/24 10.0.1.0/24 $SPI2 $SPI1 do_esp "$nsr2" 192.168.10.2 192.168.10.1 10.0.2.0/24 10.0.1.0/24 "$SPI2" "$SPI1"
ip netns exec $nsr1 nft delete table ip nat ip netns exec "$nsr1" nft delete table ip nat
# restore default routes # restore default routes
ip -net $ns2 route del 192.168.10.1 via 10.0.2.1 ip -net "$ns2" route del 192.168.10.1 via 10.0.2.1
ip -net $ns2 route add default via 10.0.2.1 ip -net "$ns2" route add default via 10.0.2.1
ip -net $ns2 route add default via dead:2::1 ip -net "$ns2" route add default via dead:2::1
if test_tcp_forwarding "$ns1" "$ns2"; then if test_tcp_forwarding "$ns1" "$ns2"; then
check_counters "ipsec tunnel mode for ns1/ns2" check_counters "ipsec tunnel mode for ns1/ns2"
...@@ -633,4 +656,15 @@ else ...@@ -633,4 +656,15 @@ else
ip netns exec "$nsr1" cat /proc/net/xfrm_stat 1>&2 ip netns exec "$nsr1" cat /proc/net/xfrm_stat 1>&2
fi fi
if [ "$1" = "" ]; then
low=1280
mtu=$((65536 - low))
o=$(((RANDOM%mtu) + low))
l=$(((RANDOM%mtu) + low))
r=$(((RANDOM%mtu) + low))
echo "re-run with random mtus: -o $o -l $l -r $r"
$0 -o "$o" -l "$l" -r "$r"
fi
exit $ret exit $ret
tools/testing/selftests/net/netfilter/rpath.sh
View file @ f03c528e
...@@ -64,12 +64,18 @@ ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad ...@@ -64,12 +64,18 @@ ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad
# firewall matches to test # firewall matches to test
[ -n "$iptables" ] && { [ -n "$iptables" ] && {
common='-t raw -A PREROUTING -s 192.168.0.0/16' common='-t raw -A PREROUTING -s 192.168.0.0/16'
ip netns exec "$ns2" "$iptables" $common -m rpfilter if ! ip netns exec "$ns2" "$iptables" $common -m rpfilter;then
echo "Cannot add rpfilter rule"
exit $ksft_skip
fi
ip netns exec "$ns2" "$iptables" $common -m rpfilter --invert ip netns exec "$ns2" "$iptables" $common -m rpfilter --invert
} }
[ -n "$ip6tables" ] && { [ -n "$ip6tables" ] && {
common='-t raw -A PREROUTING -s fec0::/16' common='-t raw -A PREROUTING -s fec0::/16'
ip netns exec "$ns2" "$ip6tables" $common -m rpfilter if ! ip netns exec "$ns2" "$ip6tables" $common -m rpfilter;then
echo "Cannot add rpfilter rule"
exit $ksft_skip
fi
ip netns exec "$ns2" "$ip6tables" $common -m rpfilter --invert ip netns exec "$ns2" "$ip6tables" $common -m rpfilter --invert
} }
[ -n "$nft" ] && ip netns exec "$ns2" $nft -f - <<EOF [ -n "$nft" ] && ip netns exec "$ns2" $nft -f - <<EOF
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7