diff options
| author |   Florian Westphal <fw@strlen.de> | 2020-03-23 17:34:30 +0100 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2020-03-24 20:00:12 +0100 |
| commit | a64d558d8cf98424cc5eb9ae6631782cd8bf789c (patch) | |
| tree | 42a2e03e5bfa5e70bd281e9fedfe9f196786ed00 /tools/testing/selftests/netfilter/config | |
| parent | netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress (diff) | |
| download | wireguard-linux-a64d558d8cf98424cc5eb9ae6631782cd8bf789c.tar.xz wireguard-linux-a64d558d8cf98424cc5eb9ae6631782cd8bf789c.zip | |
selftests: netfilter: add nfqueue test case
Add a test case to check nf queue infrastructure.
Could be extended in the future to also cover serialization of
conntrack, uid and secctx attributes in nfqueue.
For now, this checks that 'queue bypass' works, that a queue rule with
no bypass option blocks traffic and that userspace receives the expected
number of packets.
For this we add two queues and hook all of
prerouting/input/forward/output/postrouting.
Packets get queued twice with a dummy base chain in between:
This passes with current nf tree, but reverting
commit 946c0d8e6ed4 ("netfilter: nf_queue: fix reinject verdict handling")
makes this trip (it processes 30 instead of expected 20 packets).
v2: update config file with queue and other options missing/needed for
other tests.
v3: also test with tcp, this reveals problem with commit
28f8bfd1ac94 ("netfilter: Support iif matches in POSTROUTING"), due to
skb->dev pointing at another skb in the retransmit rbtree (skb->dev
aliases to rbnode child).
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/testing/selftests/netfilter/config')
| -rw-r--r-- | tools/testing/selftests/netfilter/config | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config index 59caa8f71cd8..4faf2ce021d9 100644 --- a/tools/testing/selftests/netfilter/config +++ b/tools/testing/selftests/netfilter/config @@ -1,2 +1,8 @@ CONFIG_NET_NS=y CONFIG_NF_TABLES_INET=y +CONFIG_NFT_QUEUE=m +CONFIG_NFT_NAT=m +CONFIG_NFT_REDIR=m +CONFIG_NFT_MASQ=m +CONFIG_NFT_FLOW_OFFLOAD=m +CONFIG_NF_CT_NETLINK=m |