aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/tools/testing/selftests/netfilter
diff options
context:
space:
mode:
Diffstat (limited to '')
-rwxr-xr-xtools/testing/selftests/net/netfilter/nft_concat_range.sh (renamed from tools/testing/selftests/netfilter/nft_concat_range.sh)366
-rw-r--r--tools/testing/selftests/netfilter/Makefile12
-rwxr-xr-xtools/testing/selftests/netfilter/bridge_brouter.sh146
-rw-r--r--tools/testing/selftests/netfilter/config8
-rwxr-xr-xtools/testing/selftests/netfilter/conntrack_icmp_related.sh283
-rwxr-xr-xtools/testing/selftests/netfilter/ipvs.sh228
-rw-r--r--tools/testing/selftests/netfilter/nf-queue.c352
-rwxr-xr-xtools/testing/selftests/netfilter/nft_conntrack_helper.sh175
-rwxr-xr-xtools/testing/selftests/netfilter/nft_flowtable.sh421
-rwxr-xr-xtools/testing/selftests/netfilter/nft_meta.sh124
-rwxr-xr-xtools/testing/selftests/netfilter/nft_nat.sh869
-rwxr-xr-xtools/testing/selftests/netfilter/nft_queue.sh332
-rwxr-xr-xtools/testing/selftests/netfilter/nft_trans_stress.sh78
13 files changed, 273 insertions, 3121 deletions
diff --git a/tools/testing/selftests/netfilter/nft_concat_range.sh b/tools/testing/selftests/net/netfilter/nft_concat_range.sh
index 5a4938d6dcf2..47088b005390 100755
--- a/tools/testing/selftests/netfilter/nft_concat_range.sh
+++ b/tools/testing/selftests/net/netfilter/nft_concat_range.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# nft_concat_range.sh - Tests for sets with concatenation of ranged fields
@@ -7,10 +7,10 @@
#
# Author: Stefano Brivio <sbrivio@redhat.com>
#
-# shellcheck disable=SC2154,SC2034,SC2016,SC2030,SC2031
+# shellcheck disable=SC2154,SC2034,SC2016,SC2030,SC2031,SC2317
# ^ Configuration and templates sourced with eval, counters reused in subshells
-KSELFTEST_SKIP=4
+source lib.sh
# Available test groups:
# - reported_issues: check for issues that were reported in the past
@@ -19,19 +19,19 @@ KSELFTEST_SKIP=4
# - timeout: check that packets match entries until they expire
# - performance: estimate matching rate, compare with rbtree and hash baselines
TESTS="reported_issues correctness concurrency timeout"
-[ "${quicktest}" != "1" ] && TESTS="${TESTS} performance"
+[ -n "$NFT_CONCAT_RANGE_TESTS" ] && TESTS="${NFT_CONCAT_RANGE_TESTS}"
# Set types, defined by TYPE_ variables below
TYPES="net_port port_net net6_port port_proto net6_port_mac net6_port_mac_proto
- net_port_net net_mac net_mac_icmp net6_mac_icmp net6_port_net6_port
- net_port_mac_proto_net"
+ net_port_net net_mac mac_net net_mac_icmp net6_mac_icmp
+ net6_port_net6_port net_port_mac_proto_net"
# Reported bugs, also described by TYPE_ variables below
-BUGS="flush_remove_add"
+BUGS="flush_remove_add reload net_port_proto_match"
# List of possible paths to pktgen script from kernel tree for performance tests
PKTGEN_SCRIPT_PATHS="
- ../../../samples/pktgen/pktgen_bench_xmit_mode_netif_receive.sh
+ ../../../../../samples/pktgen/pktgen_bench_xmit_mode_netif_receive.sh
pktgen/pktgen_bench_xmit_mode_netif_receive.sh"
# Definition of set types:
@@ -66,7 +66,7 @@ src
start 1
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip bash
proto udp
race_repeat 3
@@ -91,7 +91,7 @@ src
start 1
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp
race_repeat 3
@@ -116,7 +116,7 @@ src
start 10
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp6
race_repeat 3
@@ -141,7 +141,7 @@ src
start 1
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp
race_repeat 0
@@ -163,7 +163,7 @@ src mac
start 10
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp6
race_repeat 0
@@ -185,7 +185,7 @@ src mac proto
start 10
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp6
race_repeat 0
@@ -207,7 +207,7 @@ src addr4
start 1
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp
race_repeat 3
@@ -227,7 +227,7 @@ src addr6 port
start 10
count 5
src_delta 2000
-tools sendip nc
+tools sendip socat
proto udp6
race_repeat 3
@@ -247,7 +247,7 @@ src mac proto addr4
start 1
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp
race_repeat 0
@@ -264,7 +264,7 @@ src mac
start 1
count 5
src_delta 2000
-tools sendip nc bash
+tools sendip socat bash
proto udp
race_repeat 0
@@ -277,6 +277,23 @@ perf_entries 1000
perf_proto ipv4
"
+TYPE_mac_net="
+display mac,net
+type_spec ether_addr . ipv4_addr
+chain_spec ether saddr . ip saddr
+dst
+src mac addr4
+start 1
+count 5
+src_delta 2000
+tools sendip socat bash
+proto udp
+
+race_repeat 0
+
+perf_duration 0
+"
+
TYPE_net_mac_icmp="
display net,mac - ICMP
type_spec ipv4_addr . ether_addr
@@ -320,7 +337,7 @@ src addr4
start 1
count 5
src_delta 2000
-tools sendip nc
+tools sendip socat
proto udp
race_repeat 3
@@ -337,6 +354,39 @@ TYPE_flush_remove_add="
display Add two elements, flush, re-add
"
+TYPE_reload="
+display net,mac with reload
+type_spec ipv4_addr . ether_addr
+chain_spec ip daddr . ether saddr
+dst addr4
+src mac
+start 1
+count 1
+src_delta 2000
+tools sendip socat bash
+proto udp
+
+race_repeat 0
+
+perf_duration 0
+"
+
+TYPE_net_port_proto_match="
+display net,port,proto
+type_spec ipv4_addr . inet_service . inet_proto
+chain_spec ip daddr . udp dport . meta l4proto
+dst addr4 port proto
+src
+start 1
+count 9
+src_delta 9
+tools sendip bash
+proto udp
+
+race_repeat 0
+
+perf_duration 0
+"
# Set template for all tests, types and rules are filled in depending on test
set_template='
flush ruleset
@@ -439,8 +489,6 @@ setup_veth() {
B() {
ip netns exec B "$@" >/dev/null 2>&1
}
-
- sleep 2
}
# Fill in set template and initialise set
@@ -454,12 +502,6 @@ check_tools() {
__tools=
for tool in ${tools}; do
- if [ "${tool}" = "nc" ] && [ "${proto}" = "udp6" ] && \
- ! nc -u -w0 1.1.1.1 1 2>/dev/null; then
- # Some GNU netcat builds might not support IPv6
- __tools="${__tools} netcat-openbsd"
- continue
- fi
__tools="${__tools} ${tool}"
command -v "${tool}" >/dev/null && return 0
@@ -507,25 +549,20 @@ setup_send_udp() {
dst_port=
src_addr4=
}
- elif command -v nc >/dev/null; then
- if nc -u -w0 1.1.1.1 1 2>/dev/null; then
- # OpenBSD netcat
- nc_opt="-w0"
- else
- # GNU netcat
- nc_opt="-q0"
- fi
-
+ elif command -v socat -v >/dev/null; then
send_udp() {
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}" dev veth_b
- __src_addr4="-s ${src_addr4}"
+ __socatbind=",bind=${src_addr4}"
+ if [ -n "${src_port}" ];then
+ __socatbind="${__socatbind}:${src_port}"
+ fi
fi
+
ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
- [ -n "${src_port}" ] && src_port="-p ${src_port}"
+ [ -z "${dst_port}" ] && dst_port=12345
- echo "" | B nc -u "${nc_opt}" "${__src_addr4}" \
- "${src_port}" "${dst_addr4}" "${dst_port}"
+ echo "test4" | B socat -t 0.01 STDIN UDP4-DATAGRAM:"$dst_addr4":"$dst_port""${__socatbind}"
src_addr4=
src_port=
@@ -572,24 +609,24 @@ setup_send_udp6() {
dst_port=
src_addr6=
}
- elif command -v nc >/dev/null && nc -u -w0 1.1.1.1 1 2>/dev/null; then
- # GNU netcat might not work with IPv6, try next tool
+ elif command -v socat -v >/dev/null; then
send_udp6() {
ip -6 addr add "${dst_addr6}" dev veth_a nodad \
2>/dev/null
+
+ __socatbind6=
+
if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad
- else
- src_addr6="2001:db8::2"
- fi
- [ -n "${src_port}" ] && src_port="-p ${src_port}"
- # shellcheck disable=SC2086 # this needs split options
- echo "" | B nc -u w0 "-s${src_addr6}" ${src_port} \
- ${dst_addr6} ${dst_port}
+ __socatbind6=",bind=[${src_addr6}]"
- src_addr6=
- src_port=
+ if [ -n "${src_port}" ] ;then
+ __socatbind6="${__socatbind6}:${src_port}"
+ fi
+ fi
+
+ echo "test6" | B socat -t 0.01 STDIN UDP6-DATAGRAM:["$dst_addr6"]:"$dst_port""${__socatbind6}"
}
elif [ -z "$(bash -c 'type -p')" ]; then
send_udp6() {
@@ -604,10 +641,17 @@ setup_send_udp6() {
fi
}
+listener_ready()
+{
+ port="$1"
+ ss -lnt -o "sport = :$port" | grep -q "$port"
+}
+
# Set up function to send TCP traffic on IPv4
setup_flood_tcp() {
if command -v iperf3 >/dev/null; then
flood_tcp() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b
@@ -624,7 +668,7 @@ setup_flood_tcp() {
# shellcheck disable=SC2086 # this needs split options
iperf3 -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options
B iperf3 -c "${dst_addr4}" ${dst_port} ${src_port} \
@@ -636,6 +680,7 @@ setup_flood_tcp() {
}
elif command -v iperf >/dev/null; then
flood_tcp() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b
@@ -652,7 +697,7 @@ setup_flood_tcp() {
# shellcheck disable=SC2086 # this needs split options
iperf -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options
B iperf -c "${dst_addr4}" ${dst_port} ${src_addr4} \
@@ -664,6 +709,7 @@ setup_flood_tcp() {
}
elif command -v netperf >/dev/null; then
flood_tcp() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b
@@ -680,7 +726,7 @@ setup_flood_tcp() {
# shellcheck disable=SC2086 # this needs split options
netserver -4 ${dst_port} -L "${dst_addr4}" \
>/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "${n_port}"
# shellcheck disable=SC2086 # this needs split options
B netperf -4 -H "${dst_addr4}" ${dst_port} \
@@ -699,6 +745,7 @@ setup_flood_tcp() {
setup_flood_tcp6() {
if command -v iperf3 >/dev/null; then
flood_tcp6() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad
@@ -715,7 +762,7 @@ setup_flood_tcp6() {
# shellcheck disable=SC2086 # this needs split options
iperf3 -s -DB "${dst_addr6}" ${dst_port} >/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "${n_port}"
# shellcheck disable=SC2086 # this needs split options
B iperf3 -c "${dst_addr6}" ${dst_port} \
@@ -727,6 +774,7 @@ setup_flood_tcp6() {
}
elif command -v iperf >/dev/null; then
flood_tcp6() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad
@@ -743,7 +791,7 @@ setup_flood_tcp6() {
# shellcheck disable=SC2086 # this needs split options
iperf -s -VDB "${dst_addr6}" ${dst_port} >/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options
B iperf -c "${dst_addr6}" -V ${dst_port} \
@@ -755,6 +803,7 @@ setup_flood_tcp6() {
}
elif command -v netperf >/dev/null; then
flood_tcp6() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr6}" ]; then
B ip addr add "${src_addr6}" dev veth_b nodad
@@ -771,7 +820,7 @@ setup_flood_tcp6() {
# shellcheck disable=SC2086 # this needs split options
netserver -6 ${dst_port} -L "${dst_addr6}" \
>/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options
B netperf -6 -H "${dst_addr6}" ${dst_port} \
@@ -790,6 +839,7 @@ setup_flood_tcp6() {
setup_flood_udp() {
if command -v iperf3 >/dev/null; then
flood_udp() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b
@@ -806,7 +856,7 @@ setup_flood_udp() {
# shellcheck disable=SC2086 # this needs split options
iperf3 -s -DB "${dst_addr4}" ${dst_port}
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options
B iperf3 -u -c "${dst_addr4}" -Z -b 100M -l16 -t1000 \
@@ -818,6 +868,7 @@ setup_flood_udp() {
}
elif command -v iperf >/dev/null; then
flood_udp() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b
@@ -834,7 +885,7 @@ setup_flood_udp() {
# shellcheck disable=SC2086 # this needs split options
iperf -u -sDB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options
B iperf -u -c "${dst_addr4}" -b 100M -l1 -t1000 \
@@ -846,6 +897,7 @@ setup_flood_udp() {
}
elif command -v netperf >/dev/null; then
flood_udp() {
+ local n_port="${dst_port}"
[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
if [ -n "${src_addr4}" ]; then
B ip addr add "${src_addr4}/16" dev veth_b
@@ -862,7 +914,7 @@ setup_flood_udp() {
# shellcheck disable=SC2086 # this needs split options
netserver -4 ${dst_port} -L "${dst_addr4}" \
>/dev/null 2>&1
- sleep 2
+ busywait "$BUSYWAIT_TIMEOUT" listener_ready "$n_port"
# shellcheck disable=SC2086 # this needs split options
B netperf -4 -H "${dst_addr4}" ${dst_port} \
@@ -907,6 +959,7 @@ cleanup() {
ip link del dummy0 2>/dev/null
ip route del default 2>/dev/null
ip -6 route del default 2>/dev/null
+ ip netns pids B 2>/dev/null | xargs kill 2>/dev/null
ip netns del B 2>/dev/null
ip link del veth_a 2>/dev/null
timeout=
@@ -914,15 +967,18 @@ cleanup() {
killall iperf 2>/dev/null
killall netperf 2>/dev/null
killall netserver 2>/dev/null
- rm -f ${tmp}
- sleep 2
+}
+
+cleanup_exit() {
+ cleanup
+ rm -f "$tmp"
}
# Entry point for setup functions
setup() {
if [ "$(id -u)" -ne 0 ]; then
echo " need to run as root"
- exit ${KSELFTEST_SKIP}
+ exit ${ksft_skip}
fi
cleanup
@@ -984,7 +1040,8 @@ format() {
fi
done
for f in ${src}; do
- __expr="${__expr} . "
+ [ "${__expr}" != "{ " ] && __expr="${__expr} . "
+
__start="$(eval format_"${f}" "${srcstart}")"
__end="$(eval format_"${f}" "${srcend}")"
@@ -1182,7 +1239,7 @@ send_nomatch() {
# - check that packets outside range don't match it
# - remove some elements, check that packets don't match anymore
test_correctness() {
- setup veth send_"${proto}" set || return ${KSELFTEST_SKIP}
+ setup veth send_"${proto}" set || return ${ksft_skip}
range_size=1
for i in $(seq "${start}" $((start + count))); do
@@ -1197,7 +1254,7 @@ test_correctness() {
srcend=$((end + src_delta))
add "$(format)" || return 1
- for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do
+ for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
send_match "${j}" $((j + src_delta)) || return 1
done
send_nomatch $((end + 1)) $((end + 1 + src_delta)) || return 1
@@ -1205,7 +1262,7 @@ test_correctness() {
# Delete elements now and then
if [ $((i % 3)) -eq 0 ]; then
del "$(format)" || return 1
- for j in $(seq ${start} \
+ for j in $(seq "$start" \
$((range_size / 2 + 1)) ${end}); do
send_nomatch "${j}" $((j + src_delta)) \
|| return 1
@@ -1231,12 +1288,12 @@ test_concurrency() {
proto=${flood_proto}
tools=${flood_tools}
chain_spec=${flood_spec}
- setup veth flood_"${proto}" set || return ${KSELFTEST_SKIP}
+ setup veth flood_"${proto}" set || return ${ksft_skip}
range_size=1
cstart=${start}
flood_pids=
- for i in $(seq ${start} $((start + count))); do
+ for i in $(seq "$start" $((start + count))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
@@ -1249,7 +1306,7 @@ test_concurrency() {
start=$((end + range_size))
done
- sleep 10
+ sleep $((RANDOM%10))
pids=
for c in $(seq 1 "$(nproc)"); do (
@@ -1259,7 +1316,7 @@ test_concurrency() {
# $start needs to be local to this subshell
# shellcheck disable=SC2030
start=${cstart}
- for i in $(seq ${start} $((start + count))); do
+ for i in $(seq "$start" $((start + count))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
@@ -1274,7 +1331,7 @@ test_concurrency() {
range_size=1
start=${cstart}
- for i in $(seq ${start} $((start + count))); do
+ for i in $(seq "$start" $((start + count))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
@@ -1290,7 +1347,7 @@ test_concurrency() {
range_size=1
start=${cstart}
- for i in $(seq ${start} $((start + count))); do
+ for i in $(seq "$start" $((start + count))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
@@ -1303,7 +1360,7 @@ test_concurrency() {
range_size=1
start=${cstart}
- for i in $(seq ${start} $((start + count))); do
+ for i in $(seq "$start" $((start + count))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
@@ -1331,31 +1388,34 @@ test_concurrency() {
# - add all the elements with 3s timeout while checking that packets match
# - wait 3s after the last insertion, check that packets don't match any entry
test_timeout() {
- setup veth send_"${proto}" set || return ${KSELFTEST_SKIP}
+ setup veth send_"${proto}" set || return ${ksft_skip}
timeout=3
+
+ [ "$KSFT_MACHINE_SLOW" = "yes" ] && timeout=8
+
range_size=1
- for i in $(seq "${start}" $((start + count))); do
+ for i in $(seq "$start" $((start + count))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
add "$(format)" || return 1
- for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do
+ for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
send_match "${j}" $((j + src_delta)) || return 1
done
range_size=$((range_size + 1))
start=$((end + range_size))
done
- sleep 3
- for i in $(seq ${start} $((start + count))); do
+ sleep $timeout
+ for i in $(seq "$start" $((start + count))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
- for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do
+ for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
send_nomatch "${j}" $((j + src_delta)) || return 1
done
@@ -1374,13 +1434,13 @@ test_performance() {
chain_spec=${perf_spec}
dst="${perf_dst}"
src="${perf_src}"
- setup veth perf set || return ${KSELFTEST_SKIP}
+ setup veth perf set || return ${ksft_skip}
first=${start}
range_size=1
for set in test norange noconcat; do
start=${first}
- for i in $(seq ${start} $((start + perf_entries))); do
+ for i in $(seq "$start" $((start + perf_entries))); do
end=$((start + range_size))
srcstart=$((start + src_delta))
srcend=$((end + src_delta))
@@ -1388,7 +1448,7 @@ test_performance() {
if [ $((end / 65534)) -gt $((start / 65534)) ]; then
start=${end}
end=$((end + 1))
- elif [ ${start} -eq ${end} ]; then
+ elif [ "$start" -eq "$end" ]; then
end=$((start + 1))
fi
@@ -1399,7 +1459,7 @@ test_performance() {
nft -f "${tmp}"
done
- perf $((end - 1)) ${srcstart}
+ perf $((end - 1)) "$srcstart"
sleep 2
@@ -1443,15 +1503,129 @@ test_performance() {
}
test_bug_flush_remove_add() {
+ rounds=100
+ [ "$KSFT_MACHINE_SLOW" = "yes" ] && rounds=10
+
set_cmd='{ set s { type ipv4_addr . inet_service; flags interval; }; }'
elem1='{ 10.0.0.1 . 22-25, 10.0.0.1 . 10-20 }'
elem2='{ 10.0.0.1 . 10-20, 10.0.0.1 . 22-25 }'
- for i in `seq 1 100`; do
- nft add table t ${set_cmd} || return ${KSELFTEST_SKIP}
- nft add element t s ${elem1} 2>/dev/null || return 1
+ for i in $(seq 1 $rounds); do
+ nft add table t "$set_cmd" || return ${ksft_skip}
+ nft add element t s "$elem1" 2>/dev/null || return 1
nft flush set t s 2>/dev/null || return 1
- nft add element t s ${elem2} 2>/dev/null || return 1
+ nft add element t s "$elem2" 2>/dev/null || return 1
+ done
+ nft flush ruleset
+}
+
+# - add ranged element, check that packets match it
+# - reload the set, check packets still match
+test_bug_reload() {
+ setup veth send_"${proto}" set || return ${ksft_skip}
+ rstart=${start}
+
+ range_size=1
+ for i in $(seq "${start}" $((start + count))); do
+ end=$((start + range_size))
+
+ # Avoid negative or zero-sized port ranges
+ if [ $((end / 65534)) -gt $((start / 65534)) ]; then
+ start=${end}
+ end=$((end + 1))
+ fi
+ srcstart=$((start + src_delta))
+ srcend=$((end + src_delta))
+
+ add "$(format)" || return 1
+ range_size=$((range_size + 1))
+ start=$((end + range_size))
+ done
+
+ # check kernel does allocate pcpu sctrach map
+ # for reload with no elemet add/delete
+ ( echo flush set inet filter test ;
+ nft list set inet filter test ) | nft -f -
+
+ start=${rstart}
+ range_size=1
+
+ for i in $(seq "${start}" $((start + count))); do
+ end=$((start + range_size))
+
+ # Avoid negative or zero-sized port ranges
+ if [ $((end / 65534)) -gt $((start / 65534)) ]; then
+ start=${end}
+ end=$((end + 1))
+ fi
+ srcstart=$((start + src_delta))
+ srcend=$((end + src_delta))
+
+ for j in $(seq "$start" $((range_size / 2 + 1)) ${end}); do
+ send_match "${j}" $((j + src_delta)) || return 1
+ done
+
+ range_size=$((range_size + 1))
+ start=$((end + range_size))
+ done
+
+ nft flush ruleset
+}
+
+# - add ranged element, check that packets match it
+# - delete element again, check it is gone
+test_bug_net_port_proto_match() {
+ setup veth send_"${proto}" set || return ${ksft_skip}
+ rstart=${start}
+
+ range_size=1
+ for i in $(seq 1 10); do
+ for j in $(seq 1 20) ; do
+ elem=$(printf "10.%d.%d.0/24 . %d1-%d0 . 6-17 " ${i} ${j} ${i} "$((i+1))")
+
+ nft "add element inet filter test { $elem }" || return 1
+ nft "get element inet filter test { $elem }" | grep -q "$elem"
+ if [ $? -ne 0 ];then
+ local got=$(nft "get element inet filter test { $elem }")
+ err "post-add: should have returned $elem but got $got"
+ return 1
+ fi
+ done
+ done
+
+ # recheck after set was filled
+ for i in $(seq 1 10); do
+ for j in $(seq 1 20) ; do
+ elem=$(printf "10.%d.%d.0/24 . %d1-%d0 . 6-17 " ${i} ${j} ${i} "$((i+1))")
+
+ nft "get element inet filter test { $elem }" | grep -q "$elem"
+ if [ $? -ne 0 ];then
+ local got=$(nft "get element inet filter test { $elem }")
+ err "post-fill: should have returned $elem but got $got"
+ return 1
+ fi
+ done
+ done
+
+ # random del and re-fetch
+ for i in $(seq 1 10); do
+ for j in $(seq 1 20) ; do
+ local rnd=$((RANDOM%10))
+ local got=""
+
+ elem=$(printf "10.%d.%d.0/24 . %d1-%d0 . 6-17 " ${i} ${j} ${i} "$((i+1))")
+ if [ $rnd -gt 0 ];then
+ continue
+ fi
+
+ nft "delete element inet filter test { $elem }"
+ got=$(nft "get element inet filter test { $elem }" 2>/dev/null)
+ if [ $? -eq 0 ];then
+ err "post-delete: query for $elem returned $got instead of error."
+ return 1
+ fi
+ done
done
+
nft flush ruleset
}
@@ -1462,12 +1636,12 @@ test_reported_issues() {
# Run everything in a separate network namespace
[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
tmp="$(mktemp)"
-trap cleanup EXIT
+trap cleanup_exit EXIT
# Entry point for test runs
passed=0
for name in ${TESTS}; do
- printf "TEST: %s\n" "$(echo ${name} | tr '_' ' ')"
+ printf "TEST: %s\n" "$(echo "$name" | tr '_' ' ')"
if [ "${name}" = "reported_issues" ]; then
SUBTESTS="${BUGS}"
else
@@ -1494,10 +1668,16 @@ for name in ${TESTS}; do
continue
fi
- printf " %-60s " "${display}"
+ [ "$KSFT_MACHINE_SLOW" = "yes" ] && count=1
+
+ printf " %-32s " "${display}"
+ tthen=$(date +%s)
eval test_"${name}"
ret=$?
+ tnow=$(date +%s)
+ printf "%5ds%-30s" $((tnow-tthen))
+
if [ $ret -eq 0 ]; then
printf "[ OK ]\n"
info_flush
@@ -1506,11 +1686,11 @@ for name in ${TESTS}; do
printf "[FAIL]\n"
err_flush
exit 1
- elif [ $ret -eq ${KSELFTEST_SKIP} ]; then
+ elif [ $ret -eq ${ksft_skip} ]; then
printf "[SKIP]\n"
err_flush
fi
done
done
-[ ${passed} -eq 0 ] && exit ${KSELFTEST_SKIP}
+[ ${passed} -eq 0 ] && exit ${ksft_skip} || exit 0
diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
deleted file mode 100644
index a374e10ef506..000000000000
--- a/tools/testing/selftests/netfilter/Makefile
+++ /dev/null
@@ -1,12 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-# Makefile for netfilter selftests
-
-TEST_PROGS := nft_trans_stress.sh nft_nat.sh bridge_brouter.sh \
- conntrack_icmp_related.sh nft_flowtable.sh ipvs.sh \
- nft_concat_range.sh nft_conntrack_helper.sh \
- nft_queue.sh nft_meta.sh
-
-LDLIBS = -lmnl
-TEST_GEN_FILES = nf-queue
-
-include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/bridge_brouter.sh b/tools/testing/selftests/netfilter/bridge_brouter.sh
deleted file mode 100755
index 29f3955b9af7..000000000000
--- a/tools/testing/selftests/netfilter/bridge_brouter.sh
+++ /dev/null
@@ -1,146 +0,0 @@
-#!/bin/bash
-#
-# This test is for bridge 'brouting', i.e. make some packets being routed
-# rather than getting bridged even though they arrive on interface that is
-# part of a bridge.
-
-# eth0 br0 eth0
-# setup is: ns1 <-> ns0 <-> ns2
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-ebtables -V > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without ebtables"
- exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without ip tool"
- exit $ksft_skip
-fi
-
-ip netns add ns0
-ip netns add ns1
-ip netns add ns2
-
-ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
-if [ $? -ne 0 ]; then
- echo "SKIP: Can't create veth device"
- exit $ksft_skip
-fi
-ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
-
-ip -net ns0 link set lo up
-ip -net ns0 link set veth0 up
-ip -net ns0 link set veth1 up
-
-ip -net ns0 link add br0 type bridge
-if [ $? -ne 0 ]; then
- echo "SKIP: Can't create bridge br0"
- exit $ksft_skip
-fi
-
-ip -net ns0 link set veth0 master br0
-ip -net ns0 link set veth1 master br0
-ip -net ns0 link set br0 up
-ip -net ns0 addr add 10.0.0.1/24 dev br0
-
-# place both in same subnet, ns1 and ns2 connected via ns0:br0
-for i in 1 2; do
- ip -net ns$i link set lo up
- ip -net ns$i link set eth0 up
- ip -net ns$i addr add 10.0.0.1$i/24 dev eth0
-done
-
-test_ebtables_broute()
-{
- local cipt
-
- # redirect is needed so the dstmac is rewritten to the bridge itself,
- # ip stack won't process OTHERHOST (foreign unicast mac) packets.
- ip netns exec ns0 ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP
- if [ $? -ne 0 ]; then
- echo "SKIP: Could not add ebtables broute redirect rule"
- return $ksft_skip
- fi
-
- # ping netns1, expected to not work (ip forwarding is off)
- ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null 2>&1
- if [ $? -eq 0 ]; then
- echo "ERROR: ping works, should have failed" 1>&2
- return 1
- fi
-
- # enable forwarding on both interfaces.
- # neither needs an ip address, but at least the bridge needs
- # an ip address in same network segment as ns1 and ns2 (ns0
- # needs to be able to determine route for to-be-forwarded packet).
- ip netns exec ns0 sysctl -q net.ipv4.conf.veth0.forwarding=1
- ip netns exec ns0 sysctl -q net.ipv4.conf.veth1.forwarding=1
-
- sleep 1
-
- ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null
- if [ $? -ne 0 ]; then
- echo "ERROR: ping did not work, but it should (broute+forward)" 1>&2
- return 1
- fi
-
- echo "PASS: ns1/ns2 connectivity with active broute rule"
- ip netns exec ns0 ebtables -t broute -F
-
- # ping netns1, expected to work (frames are bridged)
- ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null
- if [ $? -ne 0 ]; then
- echo "ERROR: ping did not work, but it should (bridged)" 1>&2
- return 1
- fi
-
- ip netns exec ns0 ebtables -t filter -A FORWARD -p ipv4 --ip-protocol icmp -j DROP
-
- # ping netns1, expected to not work (DROP in bridge forward)
- ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null 2>&1
- if [ $? -eq 0 ]; then
- echo "ERROR: ping works, should have failed (icmp forward drop)" 1>&2
- return 1
- fi
-
- # re-activate brouter
- ip netns exec ns0 ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP
-
- ip netns exec ns2 ping -q -c 1 10.0.0.11 > /dev/null
- if [ $? -ne 0 ]; then
- echo "ERROR: ping did not work, but it should (broute+forward 2)" 1>&2
- return 1
- fi
-
- echo "PASS: ns1/ns2 connectivity with active broute rule and bridge forward drop"
- return 0
-}
-
-# test basic connectivity
-ip netns exec ns1 ping -c 1 -q 10.0.0.12 > /dev/null
-if [ $? -ne 0 ]; then
- echo "ERROR: Could not reach ns2 from ns1" 1>&2
- ret=1
-fi
-
-ip netns exec ns2 ping -c 1 -q 10.0.0.11 > /dev/null
-if [ $? -ne 0 ]; then
- echo "ERROR: Could not reach ns1 from ns2" 1>&2
- ret=1
-fi
-
-if [ $ret -eq 0 ];then
- echo "PASS: netns connectivity: ns1 and ns2 can reach each other"
-fi
-
-test_ebtables_broute
-ret=$?
-for i in 0 1 2; do ip netns del ns$i;done
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
deleted file mode 100644
index 4faf2ce021d9..000000000000
--- a/tools/testing/selftests/netfilter/config
+++ /dev/null
@@ -1,8 +0,0 @@
-CONFIG_NET_NS=y
-CONFIG_NF_TABLES_INET=y
-CONFIG_NFT_QUEUE=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_REDIR=m
-CONFIG_NFT_MASQ=m
-CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NF_CT_NETLINK=m
diff --git a/tools/testing/selftests/netfilter/conntrack_icmp_related.sh b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
deleted file mode 100755
index b48e1833bc89..000000000000
--- a/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
+++ /dev/null
@@ -1,283 +0,0 @@
-#!/bin/bash
-#
-# check that ICMP df-needed/pkttoobig icmp are set are set as related
-# state
-#
-# Setup is:
-#
-# nsclient1 -> nsrouter1 -> nsrouter2 -> nsclient2
-# MTU 1500, except for nsrouter2 <-> nsclient2 link (1280).
-# ping nsclient2 from nsclient1, checking that conntrack did set RELATED
-# 'fragmentation needed' icmp packet.
-#
-# In addition, nsrouter1 will perform IP masquerading, i.e. also
-# check the icmp errors are propagated to the correct host as per
-# nat of "established" icmp-echo "connection".
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without nft tool"
- exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without ip tool"
- exit $ksft_skip
-fi
-
-cleanup() {
- for i in 1 2;do ip netns del nsclient$i;done
- for i in 1 2;do ip netns del nsrouter$i;done
-}
-
-ipv4() {
- echo -n 192.168.$1.2
-}
-
-ipv6 () {
- echo -n dead:$1::2
-}
-
-check_counter()
-{
- ns=$1
- name=$2
- expect=$3
- local lret=0
-
- cnt=$(ip netns exec $ns nft list counter inet filter "$name" | grep -q "$expect")
- if [ $? -ne 0 ]; then
- echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
- ip netns exec $ns nft list counter inet filter "$name" 1>&2
- lret=1
- fi
-
- return $lret
-}
-
-check_unknown()
-{
- expect="packets 0 bytes 0"
- for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
- check_counter $n "unknown" "$expect"
- if [ $? -ne 0 ] ;then
- return 1
- fi
- done
-
- return 0
-}
-
-for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
- ip netns add $n
- ip -net $n link set lo up
-done
-
-DEV=veth0
-ip link add $DEV netns nsclient1 type veth peer name eth1 netns nsrouter1
-DEV=veth0
-ip link add $DEV netns nsclient2 type veth peer name eth1 netns nsrouter2
-
-DEV=veth0
-ip link add $DEV netns nsrouter1 type veth peer name eth2 netns nsrouter2
-
-DEV=veth0
-for i in 1 2; do
- ip -net nsclient$i link set $DEV up
- ip -net nsclient$i addr add $(ipv4 $i)/24 dev $DEV
- ip -net nsclient$i addr add $(ipv6 $i)/64 dev $DEV
-done
-
-ip -net nsrouter1 link set eth1 up
-ip -net nsrouter1 link set veth0 up
-
-ip -net nsrouter2 link set eth1 up
-ip -net nsrouter2 link set eth2 up
-
-ip -net nsclient1 route add default via 192.168.1.1
-ip -net nsclient1 -6 route add default via dead:1::1
-
-ip -net nsclient2 route add default via 192.168.2.1
-ip -net nsclient2 route add default via dead:2::1
-
-i=3
-ip -net nsrouter1 addr add 192.168.1.1/24 dev eth1
-ip -net nsrouter1 addr add 192.168.3.1/24 dev veth0
-ip -net nsrouter1 addr add dead:1::1/64 dev eth1
-ip -net nsrouter1 addr add dead:3::1/64 dev veth0
-ip -net nsrouter1 route add default via 192.168.3.10
-ip -net nsrouter1 -6 route add default via dead:3::10
-
-ip -net nsrouter2 addr add 192.168.2.1/24 dev eth1
-ip -net nsrouter2 addr add 192.168.3.10/24 dev eth2
-ip -net nsrouter2 addr add dead:2::1/64 dev eth1
-ip -net nsrouter2 addr add dead:3::10/64 dev eth2
-ip -net nsrouter2 route add default via 192.168.3.1
-ip -net nsrouter2 route add default via dead:3::1
-
-sleep 2
-for i in 4 6; do
- ip netns exec nsrouter1 sysctl -q net.ipv$i.conf.all.forwarding=1
- ip netns exec nsrouter2 sysctl -q net.ipv$i.conf.all.forwarding=1
-done
-
-for netns in nsrouter1 nsrouter2; do
-ip netns exec $netns nft -f - <<EOF
-table inet filter {
- counter unknown { }
- counter related { }
- chain forward {
- type filter hook forward priority 0; policy accept;
- meta l4proto icmpv6 icmpv6 type "packet-too-big" ct state "related" counter name "related" accept
- meta l4proto icmp icmp type "destination-unreachable" ct state "related" counter name "related" accept
- meta l4proto { icmp, icmpv6 } ct state new,established accept
- counter name "unknown" drop
- }
-}
-EOF
-done
-
-ip netns exec nsclient1 nft -f - <<EOF
-table inet filter {
- counter unknown { }
- counter related { }
- chain input {
- type filter hook input priority 0; policy accept;
- meta l4proto { icmp, icmpv6 } ct state established,untracked accept
-
- meta l4proto { icmp, icmpv6 } ct state "related" counter name "related" accept
- counter name "unknown" drop
- }
-}
-EOF
-
-ip netns exec nsclient2 nft -f - <<EOF
-table inet filter {
- counter unknown { }
- counter new { }
- counter established { }
-
- chain input {
- type filter hook input priority 0; policy accept;
- meta l4proto { icmp, icmpv6 } ct state established,untracked accept
-
- meta l4proto { icmp, icmpv6 } ct state "new" counter name "new" accept
- meta l4proto { icmp, icmpv6 } ct state "established" counter name "established" accept
- counter name "unknown" drop
- }
- chain output {
- type filter hook output priority 0; policy accept;
- meta l4proto { icmp, icmpv6 } ct state established,untracked accept
-
- meta l4proto { icmp, icmpv6 } ct state "new" counter name "new"
- meta l4proto { icmp, icmpv6 } ct state "established" counter name "established"
- counter name "unknown" drop
- }
-}
-EOF
-
-
-# make sure NAT core rewrites adress of icmp error if nat is used according to
-# conntrack nat information (icmp error will be directed at nsrouter1 address,
-# but it needs to be routed to nsclient1 address).
-ip netns exec nsrouter1 nft -f - <<EOF
-table ip nat {
- chain postrouting {
- type nat hook postrouting priority 0; policy accept;
- ip protocol icmp oifname "veth0" counter masquerade
- }
-}
-table ip6 nat {
- chain postrouting {
- type nat hook postrouting priority 0; policy accept;
- ip6 nexthdr icmpv6 oifname "veth0" counter masquerade
- }
-}
-EOF
-
-ip netns exec nsrouter2 ip link set eth1 mtu 1280
-ip netns exec nsclient2 ip link set veth0 mtu 1280
-sleep 1
-
-ip netns exec nsclient1 ping -c 1 -s 1000 -q -M do 192.168.2.2 >/dev/null
-if [ $? -ne 0 ]; then
- echo "ERROR: netns ip routing/connectivity broken" 1>&2
- cleanup
- exit 1
-fi
-ip netns exec nsclient1 ping6 -q -c 1 -s 1000 dead:2::2 >/dev/null
-if [ $? -ne 0 ]; then
- echo "ERROR: netns ipv6 routing/connectivity broken" 1>&2
- cleanup
- exit 1
-fi
-
-check_unknown
-if [ $? -ne 0 ]; then
- ret=1
-fi
-
-expect="packets 0 bytes 0"
-for netns in nsrouter1 nsrouter2 nsclient1;do
- check_counter "$netns" "related" "$expect"
- if [ $? -ne 0 ]; then
- ret=1
- fi
-done
-
-expect="packets 2 bytes 2076"
-check_counter nsclient2 "new" "$expect"
-if [ $? -ne 0 ]; then
- ret=1
-fi
-
-ip netns exec nsclient1 ping -q -c 1 -s 1300 -M do 192.168.2.2 > /dev/null
-if [ $? -eq 0 ]; then
- echo "ERROR: ping should have failed with PMTU too big error" 1>&2
- ret=1
-fi
-
-# nsrouter2 should have generated the icmp error, so
-# related counter should be 0 (its in forward).
-expect="packets 0 bytes 0"
-check_counter "nsrouter2" "related" "$expect"
-if [ $? -ne 0 ]; then
- ret=1
-fi
-
-# but nsrouter1 should have seen it, same for nsclient1.
-expect="packets 1 bytes 576"
-for netns in nsrouter1 nsclient1;do
- check_counter "$netns" "related" "$expect"
- if [ $? -ne 0 ]; then
- ret=1
- fi
-done
-
-ip netns exec nsclient1 ping6 -c 1 -s 1300 dead:2::2 > /dev/null
-if [ $? -eq 0 ]; then
- echo "ERROR: ping6 should have failed with PMTU too big error" 1>&2
- ret=1
-fi
-
-expect="packets 2 bytes 1856"
-for netns in nsrouter1 nsclient1;do
- check_counter "$netns" "related" "$expect"
- if [ $? -ne 0 ]; then
- ret=1
- fi
-done
-
-if [ $ret -eq 0 ];then
- echo "PASS: icmp mtu error had RELATED state"
-else
- echo "ERROR: icmp error RELATED state test has failed"
-fi
-
-cleanup
-exit $ret
diff --git a/tools/testing/selftests/netfilter/ipvs.sh b/tools/testing/selftests/netfilter/ipvs.sh
deleted file mode 100755
index c3b8f90c497e..000000000000
--- a/tools/testing/selftests/netfilter/ipvs.sh
+++ /dev/null
@@ -1,228 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: GPL-2.0
-#
-# End-to-end ipvs test suite
-# Topology:
-#--------------------------------------------------------------+
-# | |
-# ns0 | ns1 |
-# ----------- | ----------- ----------- |
-# | veth01 | --------- | veth10 | | veth12 | |
-# ----------- peer ----------- ----------- |
-# | | | |
-# ----------- | | |
-# | br0 | |----------------- peer |--------------|
-# ----------- | | |
-# | | | |
-# ---------- peer ---------- ----------- |
-# | veth02 | --------- | veth20 | | veth21 | |
-# ---------- | ---------- ----------- |
-# | ns2 |
-# | |
-#--------------------------------------------------------------+
-#
-# We assume that all network driver are loaded
-#
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-GREEN='\033[0;92m'
-RED='\033[0;31m'
-NC='\033[0m' # No Color
-
-readonly port=8080
-
-readonly vip_v4=207.175.44.110
-readonly cip_v4=10.0.0.2
-readonly gip_v4=10.0.0.1
-readonly dip_v4=172.16.0.1
-readonly rip_v4=172.16.0.2
-readonly sip_v4=10.0.0.3
-
-readonly infile="$(mktemp)"
-readonly outfile="$(mktemp)"
-readonly datalen=32
-
-sysipvsnet="/proc/sys/net/ipv4/vs/"
-if [ ! -d $sysipvsnet ]; then
- modprobe -q ip_vs
- if [ $? -ne 0 ]; then
- echo "skip: could not run test without ipvs module"
- exit $ksft_skip
- fi
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ]; then
- echo "SKIP: Could not run test without ip tool"
- exit $ksft_skip
-fi
-
-ipvsadm -v > /dev/null 2>&1
-if [ $? -ne 0 ]; then
- echo "SKIP: Could not run test without ipvsadm"
- exit $ksft_skip
-fi
-
-setup() {
- ip netns add ns0
- ip netns add ns1
- ip netns add ns2
-
- ip link add veth01 netns ns0 type veth peer name veth10 netns ns1
- ip link add veth02 netns ns0 type veth peer name veth20 netns ns2
- ip link add veth12 netns ns1 type veth peer name veth21 netns ns2
-
- ip netns exec ns0 ip link set veth01 up
- ip netns exec ns0 ip link set veth02 up
- ip netns exec ns0 ip link add br0 type bridge
- ip netns exec ns0 ip link set veth01 master br0
- ip netns exec ns0 ip link set veth02 master br0
- ip netns exec ns0 ip link set br0 up
- ip netns exec ns0 ip addr add ${cip_v4}/24 dev br0
-
- ip netns exec ns1 ip link set lo up
- ip netns exec ns1 ip link set veth10 up
- ip netns exec ns1 ip addr add ${gip_v4}/24 dev veth10
- ip netns exec ns1 ip link set veth12 up
- ip netns exec ns1 ip addr add ${dip_v4}/24 dev veth12
-
- ip netns exec ns2 ip link set lo up
- ip netns exec ns2 ip link set veth21 up
- ip netns exec ns2 ip addr add ${rip_v4}/24 dev veth21
- ip netns exec ns2 ip link set veth20 up
- ip netns exec ns2 ip addr add ${sip_v4}/24 dev veth20
-
- sleep 1
-
- dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none
-}
-
-cleanup() {
- for i in 0 1 2
- do
- ip netns del ns$i > /dev/null 2>&1
- done
-
- if [ -f "${outfile}" ]; then
- rm "${outfile}"
- fi
- if [ -f "${infile}" ]; then
- rm "${infile}"
- fi
-}
-
-server_listen() {
- ip netns exec ns2 nc -l -p 8080 > "${outfile}" &
- server_pid=$!
- sleep 0.2
-}
-
-client_connect() {
- ip netns exec ns0 timeout 2 nc -w 1 ${vip_v4} ${port} < "${infile}"
-}
-
-verify_data() {
- wait "${server_pid}"
- cmp "$infile" "$outfile" 2>/dev/null
-}
-
-test_service() {
- server_listen
- client_connect
- verify_data
-}
-
-
-test_dr() {
- ip netns exec ns0 ip route add ${vip_v4} via ${gip_v4} dev br0
-
- ip netns exec ns1 sysctl -qw net.ipv4.ip_forward=1
- ip netns exec ns1 ipvsadm -A -t ${vip_v4}:${port} -s rr
- ip netns exec ns1 ipvsadm -a -t ${vip_v4}:${port} -r ${rip_v4}:${port}
- ip netns exec ns1 ip addr add ${vip_v4}/32 dev lo:1
-
- # avoid incorrect arp response
- ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_ignore=1
- ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_announce=2
- # avoid reverse route lookup
- ip netns exec ns2 sysctl -qw net.ipv4.conf.all.rp_filter=0
- ip netns exec ns2 sysctl -qw net.ipv4.conf.veth21.rp_filter=0
- ip netns exec ns2 ip addr add ${vip_v4}/32 dev lo:1
-
- test_service
-}
-
-test_nat() {
- ip netns exec ns0 ip route add ${vip_v4} via ${gip_v4} dev br0
-
- ip netns exec ns1 sysctl -qw net.ipv4.ip_forward=1
- ip netns exec ns1 ipvsadm -A -t ${vip_v4}:${port} -s rr
- ip netns exec ns1 ipvsadm -a -m -t ${vip_v4}:${port} -r ${rip_v4}:${port}
- ip netns exec ns1 ip addr add ${vip_v4}/32 dev lo:1
-
- ip netns exec ns2 ip link del veth20
- ip netns exec ns2 ip route add default via ${dip_v4} dev veth21
-
- test_service
-}
-
-test_tun() {
- ip netns exec ns0 ip route add ${vip_v4} via ${gip_v4} dev br0
-
- ip netns exec ns1 modprobe ipip
- ip netns exec ns1 ip link set tunl0 up
- ip netns exec ns1 sysctl -qw net.ipv4.ip_forward=0
- ip netns exec ns1 sysctl -qw net.ipv4.conf.all.send_redirects=0
- ip netns exec ns1 sysctl -qw net.ipv4.conf.default.send_redirects=0
- ip netns exec ns1 ipvsadm -A -t ${vip_v4}:${port} -s rr
- ip netns exec ns1 ipvsadm -a -i -t ${vip_v4}:${port} -r ${rip_v4}:${port}
- ip netns exec ns1 ip addr add ${vip_v4}/32 dev lo:1
-
- ip netns exec ns2 modprobe ipip
- ip netns exec ns2 ip link set tunl0 up
- ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_ignore=1
- ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_announce=2
- ip netns exec ns2 sysctl -qw net.ipv4.conf.all.rp_filter=0
- ip netns exec ns2 sysctl -qw net.ipv4.conf.tunl0.rp_filter=0
- ip netns exec ns2 sysctl -qw net.ipv4.conf.veth21.rp_filter=0
- ip netns exec ns2 ip addr add ${vip_v4}/32 dev lo:1
-
- test_service
-}
-
-run_tests() {
- local errors=
-
- echo "Testing DR mode..."
- cleanup
- setup
- test_dr
- errors=$(( $errors + $? ))
-
- echo "Testing NAT mode..."
- cleanup
- setup
- test_nat
- errors=$(( $errors + $? ))
-
- echo "Testing Tunnel mode..."
- cleanup
- setup
- test_tun
- errors=$(( $errors + $? ))
-
- return $errors
-}
-
-trap cleanup EXIT
-
-run_tests
-
-if [ $? -ne 0 ]; then
- echo -e "$(basename $0): ${RED}FAIL${NC}"
- exit 1
-fi
-echo -e "$(basename $0): ${GREEN}PASS${NC}"
-exit 0
diff --git a/tools/testing/selftests/netfilter/nf-queue.c b/tools/testing/selftests/netfilter/nf-queue.c
deleted file mode 100644
index 29c73bce38fa..000000000000
--- a/tools/testing/selftests/netfilter/nf-queue.c
+++ /dev/null
@@ -1,352 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-
-#include <errno.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <time.h>
-#include <arpa/inet.h>
-
-#include <libmnl/libmnl.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter/nfnetlink.h>
-#include <linux/netfilter/nfnetlink_queue.h>
-
-struct options {
- bool count_packets;
- int verbose;
- unsigned int queue_num;
- unsigned int timeout;
-};
-
-static unsigned int queue_stats[5];
-static struct options opts;
-
-static void help(const char *p)
-{
- printf("Usage: %s [-c|-v [-vv] ] [-t timeout] [-q queue_num]\n", p);
-}
-
-static int parse_attr_cb(const struct nlattr *attr, void *data)
-{
- const struct nlattr **tb = data;
- int type = mnl_attr_get_type(attr);
-
- /* skip unsupported attribute in user-space */
- if (mnl_attr_type_valid(attr, NFQA_MAX) < 0)
- return MNL_CB_OK;
-
- switch (type) {
- case NFQA_MARK:
- case NFQA_IFINDEX_INDEV:
- case NFQA_IFINDEX_OUTDEV:
- case NFQA_IFINDEX_PHYSINDEV:
- case NFQA_IFINDEX_PHYSOUTDEV:
- if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) {
- perror("mnl_attr_validate");
- return MNL_CB_ERROR;
- }
- break;
- case NFQA_TIMESTAMP:
- if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
- sizeof(struct nfqnl_msg_packet_timestamp)) < 0) {
- perror("mnl_attr_validate2");
- return MNL_CB_ERROR;
- }
- break;
- case NFQA_HWADDR:
- if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
- sizeof(struct nfqnl_msg_packet_hw)) < 0) {
- perror("mnl_attr_validate2");
- return MNL_CB_ERROR;
- }
- break;
- case NFQA_PAYLOAD:
- break;
- }
- tb[type] = attr;
- return MNL_CB_OK;
-}
-
-static int queue_cb(const struct nlmsghdr *nlh, void *data)
-{
- struct nlattr *tb[NFQA_MAX+1] = { 0 };
- struct nfqnl_msg_packet_hdr *ph = NULL;
- uint32_t id = 0;
-
- (void)data;
-
- mnl_attr_parse(nlh, sizeof(struct nfgenmsg), parse_attr_cb, tb);
- if (tb[NFQA_PACKET_HDR]) {
- ph = mnl_attr_get_payload(tb[NFQA_PACKET_HDR]);
- id = ntohl(ph->packet_id);
-
- if (opts.verbose > 0)
- printf("packet hook=%u, hwproto 0x%x",
- ntohs(ph->hw_protocol), ph->hook);
-
- if (ph->hook >= 5) {
- fprintf(stderr, "Unknown hook %d\n", ph->hook);
- return MNL_CB_ERROR;
- }
-
- if (opts.verbose > 0) {
- uint32_t skbinfo = 0;
-
- if (tb[NFQA_SKB_INFO])
- skbinfo = ntohl(mnl_attr_get_u32(tb[NFQA_SKB_INFO]));
- if (skbinfo & NFQA_SKB_CSUMNOTREADY)
- printf(" csumnotready");
- if (skbinfo & NFQA_SKB_GSO)
- printf(" gso");
- if (skbinfo & NFQA_SKB_CSUM_NOTVERIFIED)
- printf(" csumnotverified");
- puts("");
- }
-
- if (opts.count_packets)
- queue_stats[ph->hook]++;
- }
-
- return MNL_CB_OK + id;
-}
-
-static struct nlmsghdr *
-nfq_build_cfg_request(char *buf, uint8_t command, int queue_num)
-{
- struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
- struct nfqnl_msg_config_cmd cmd = {
- .command = command,
- .pf = htons(AF_INET),
- };
- struct nfgenmsg *nfg;
-
- nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_CONFIG;
- nlh->nlmsg_flags = NLM_F_REQUEST;
-
- nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
-
- nfg->nfgen_family = AF_UNSPEC;
- nfg->version = NFNETLINK_V0;
- nfg->res_id = htons(queue_num);
-
- mnl_attr_put(nlh, NFQA_CFG_CMD, sizeof(cmd), &cmd);
-
- return nlh;
-}
-
-static struct nlmsghdr *
-nfq_build_cfg_params(char *buf, uint8_t mode, int range, int queue_num)
-{
- struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
- struct nfqnl_msg_config_params params = {
- .copy_range = htonl(range),
- .copy_mode = mode,
- };
- struct nfgenmsg *nfg;
-
- nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_CONFIG;
- nlh->nlmsg_flags = NLM_F_REQUEST;
-
- nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
- nfg->nfgen_family = AF_UNSPEC;
- nfg->version = NFNETLINK_V0;
- nfg->res_id = htons(queue_num);
-
- mnl_attr_put(nlh, NFQA_CFG_PARAMS, sizeof(params), &params);
-
- return nlh;
-}
-
-static struct nlmsghdr *
-nfq_build_verdict(char *buf, int id, int queue_num, int verd)
-{
- struct nfqnl_msg_verdict_hdr vh = {
- .verdict = htonl(verd),
- .id = htonl(id),
- };
- struct nlmsghdr *nlh;
- struct nfgenmsg *nfg;
-
- nlh = mnl_nlmsg_put_header(buf);
- nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_VERDICT;
- nlh->nlmsg_flags = NLM_F_REQUEST;
- nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
- nfg->nfgen_family = AF_UNSPEC;
- nfg->version = NFNETLINK_V0;
- nfg->res_id = htons(queue_num);
-
- mnl_attr_put(nlh, NFQA_VERDICT_HDR, sizeof(vh), &vh);
-
- return nlh;
-}
-
-static void print_stats(void)
-{
- unsigned int last, total;
- int i;
-
- if (!opts.count_packets)
- return;
-
- total = 0;
- last = queue_stats[0];
-
- for (i = 0; i < 5; i++) {
- printf("hook %d packets %08u\n", i, queue_stats[i]);
- last = queue_stats[i];
- total += last;
- }
-
- printf("%u packets total\n", total);
-}
-
-struct mnl_socket *open_queue(void)
-{
- char buf[MNL_SOCKET_BUFFER_SIZE];
- unsigned int queue_num;
- struct mnl_socket *nl;
- struct nlmsghdr *nlh;
- struct timeval tv;
- uint32_t flags;
-
- nl = mnl_socket_open(NETLINK_NETFILTER);
- if (nl == NULL) {
- perror("mnl_socket_open");
- exit(EXIT_FAILURE);
- }
-
- if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
- perror("mnl_socket_bind");
- exit(EXIT_FAILURE);
- }
-
- queue_num = opts.queue_num;
- nlh = nfq_build_cfg_request(buf, NFQNL_CFG_CMD_BIND, queue_num);
-
- if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
- perror("mnl_socket_sendto");
- exit(EXIT_FAILURE);
- }
-
- nlh = nfq_build_cfg_params(buf, NFQNL_COPY_PACKET, 0xFFFF, queue_num);
-
- flags = NFQA_CFG_F_GSO | NFQA_CFG_F_UID_GID;
- mnl_attr_put_u32(nlh, NFQA_CFG_FLAGS, htonl(flags));
- mnl_attr_put_u32(nlh, NFQA_CFG_MASK, htonl(flags));
-
- if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
- perror("mnl_socket_sendto");
- exit(EXIT_FAILURE);
- }
-
- memset(&tv, 0, sizeof(tv));
- tv.tv_sec = opts.timeout;
- if (opts.timeout && setsockopt(mnl_socket_get_fd(nl),
- SOL_SOCKET, SO_RCVTIMEO,
- &tv, sizeof(tv))) {
- perror("setsockopt(SO_RCVTIMEO)");
- exit(EXIT_FAILURE);
- }
-
- return nl;
-}
-
-static int mainloop(void)
-{
- unsigned int buflen = 64 * 1024 + MNL_SOCKET_BUFFER_SIZE;
- struct mnl_socket *nl;
- struct nlmsghdr *nlh;
- unsigned int portid;
- char *buf;
- int ret;
-
- buf = malloc(buflen);
- if (!buf) {
- perror("malloc");
- exit(EXIT_FAILURE);
- }
-
- nl = open_queue();
- portid = mnl_socket_get_portid(nl);
-
- for (;;) {
- uint32_t id;
-
- ret = mnl_socket_recvfrom(nl, buf, buflen);
- if (ret == -1) {
- if (errno == ENOBUFS)
- continue;
-
- if (errno == EAGAIN) {
- errno = 0;
- ret = 0;
- break;
- }
-
- perror("mnl_socket_recvfrom");
- exit(EXIT_FAILURE);
- }
-
- ret = mnl_cb_run(buf, ret, 0, portid, queue_cb, NULL);
- if (ret < 0) {
- perror("mnl_cb_run");
- exit(EXIT_FAILURE);
- }
-
- id = ret - MNL_CB_OK;
- nlh = nfq_build_verdict(buf, id, opts.queue_num, NF_ACCEPT);
- if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
- perror("mnl_socket_sendto");
- exit(EXIT_FAILURE);
- }
- }
-
- mnl_socket_close(nl);
-
- return ret;
-}
-
-static void parse_opts(int argc, char **argv)
-{
- int c;
-
- while ((c = getopt(argc, argv, "chvt:q:")) != -1) {
- switch (c) {
- case 'c':
- opts.count_packets = true;
- break;
- case 'h':
- help(argv[0]);
- exit(0);
- break;
- case 'q':
- opts.queue_num = atoi(optarg);
- if (opts.queue_num > 0xffff)
- opts.queue_num = 0;
- break;
- case 't':
- opts.timeout = atoi(optarg);
- break;
- case 'v':
- opts.verbose++;
- break;
- }
- }
-}
-
-int main(int argc, char *argv[])
-{
- int ret;
-
- parse_opts(argc, argv);
-
- ret = mainloop();
- if (opts.count_packets)
- print_stats();
-
- return ret;
-}
diff --git a/tools/testing/selftests/netfilter/nft_conntrack_helper.sh b/tools/testing/selftests/netfilter/nft_conntrack_helper.sh
deleted file mode 100755
index edf0a48da6bf..000000000000
--- a/tools/testing/selftests/netfilter/nft_conntrack_helper.sh
+++ /dev/null
@@ -1,175 +0,0 @@
-#!/bin/bash
-#
-# This tests connection tracking helper assignment:
-# 1. can attach ftp helper to a connection from nft ruleset.
-# 2. auto-assign still works.
-#
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-sfx=$(mktemp -u "XXXXXXXX")
-ns1="ns1-$sfx"
-ns2="ns2-$sfx"
-testipv6=1
-
-cleanup()
-{
- ip netns del ${ns1}
- ip netns del ${ns2}
-}
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without nft tool"
- exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without ip tool"
- exit $ksft_skip
-fi
-
-conntrack -V > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without conntrack tool"
- exit $ksft_skip
-fi
-
-which nc >/dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without netcat tool"
- exit $ksft_skip
-fi
-
-trap cleanup EXIT
-
-ip netns add ${ns1}
-ip netns add ${ns2}
-
-ip link add veth0 netns ${ns1} type veth peer name veth0 netns ${ns2} > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: No virtual ethernet pair device support in kernel"
- exit $ksft_skip
-fi
-
-ip -net ${ns1} link set lo up
-ip -net ${ns1} link set veth0 up
-
-ip -net ${ns2} link set lo up
-ip -net ${ns2} link set veth0 up
-
-ip -net ${ns1} addr add 10.0.1.1/24 dev veth0
-ip -net ${ns1} addr add dead:1::1/64 dev veth0
-
-ip -net ${ns2} addr add 10.0.1.2/24 dev veth0
-ip -net ${ns2} addr add dead:1::2/64 dev veth0
-
-load_ruleset_family() {
- local family=$1
- local ns=$2
-
-ip netns exec ${ns} nft -f - <<EOF
-table $family raw {
- ct helper ftp {
- type "ftp" protocol tcp
- }
- chain pre {
- type filter hook prerouting priority 0; policy accept;
- tcp dport 2121 ct helper set "ftp"
- }
- chain output {
- type filter hook output priority 0; policy accept;
- tcp dport 2121 ct helper set "ftp"
- }
-}
-EOF
- return $?
-}
-
-check_for_helper()
-{
- local netns=$1
- local message=$2
- local port=$3
-
- ip netns exec ${netns} conntrack -L -p tcp --dport $port 2> /dev/null |grep -q 'helper=ftp'
- if [ $? -ne 0 ] ; then
- echo "FAIL: ${netns} did not show attached helper $message" 1>&2
- ret=1
- fi
-
- echo "PASS: ${netns} connection on port $port has ftp helper attached" 1>&2
- return 0
-}
-
-test_helper()
-{
- local port=$1
- local msg=$2
-
- sleep 3 | ip netns exec ${ns2} nc -w 2 -l -p $port > /dev/null &
-
- sleep 1
- sleep 1 | ip netns exec ${ns1} nc -w 2 10.0.1.2 $port > /dev/null &
-
- check_for_helper "$ns1" "ip $msg" $port
- check_for_helper "$ns2" "ip $msg" $port
-
- wait
-
- if [ $testipv6 -eq 0 ] ;then
- return 0
- fi
-
- ip netns exec ${ns1} conntrack -F 2> /dev/null
- ip netns exec ${ns2} conntrack -F 2> /dev/null
-
- sleep 3 | ip netns exec ${ns2} nc -w 2 -6 -l -p $port > /dev/null &
-
- sleep 1
- sleep 1 | ip netns exec ${ns1} nc -w 2 -6 dead:1::2 $port > /dev/null &
-
- check_for_helper "$ns1" "ipv6 $msg" $port
- check_for_helper "$ns2" "ipv6 $msg" $port
-
- wait
-}
-
-load_ruleset_family ip ${ns1}
-if [ $? -ne 0 ];then
- echo "FAIL: ${ns1} cannot load ip ruleset" 1>&2
- exit 1
-fi
-
-load_ruleset_family ip6 ${ns1}
-if [ $? -ne 0 ];then
- echo "SKIP: ${ns1} cannot load ip6 ruleset" 1>&2
- testipv6=0
-fi
-
-load_ruleset_family inet ${ns2}
-if [ $? -ne 0 ];then
- echo "SKIP: ${ns1} cannot load inet ruleset" 1>&2
- load_ruleset_family ip ${ns2}
- if [ $? -ne 0 ];then
- echo "FAIL: ${ns2} cannot load ip ruleset" 1>&2
- exit 1
- fi
-
- if [ $testipv6 -eq 1 ] ;then
- load_ruleset_family ip6 ${ns2}
- if [ $? -ne 0 ];then
- echo "FAIL: ${ns2} cannot load ip6 ruleset" 1>&2
- exit 1
- fi
- fi
-fi
-
-test_helper 2121 "set via ruleset"
-ip netns exec ${ns1} sysctl -q 'net.netfilter.nf_conntrack_helper=1'
-ip netns exec ${ns2} sysctl -q 'net.netfilter.nf_conntrack_helper=1'
-test_helper 21 "auto-assign"
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_flowtable.sh b/tools/testing/selftests/netfilter/nft_flowtable.sh
deleted file mode 100755
index 431296c0f91c..000000000000
--- a/tools/testing/selftests/netfilter/nft_flowtable.sh
+++ /dev/null
@@ -1,421 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: GPL-2.0
-#
-# This tests basic flowtable functionality.
-# Creates following default topology:
-#
-# Originator (MTU 9000) <-Router1-> MTU 1500 <-Router2-> Responder (MTU 2000)
-# Router1 is the one doing flow offloading, Router2 has no special
-# purpose other than having a link that is smaller than either Originator
-# and responder, i.e. TCPMSS announced values are too large and will still
-# result in fragmentation and/or PMTU discovery.
-#
-# You can check with different Orgininator/Link/Responder MTU eg:
-# nft_flowtable.sh -o8000 -l1500 -r2000
-#
-
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-ns1in=""
-ns2in=""
-ns1out=""
-ns2out=""
-
-log_netns=$(sysctl -n net.netfilter.nf_log_all_netns)
-
-checktool (){
- if ! $1 > /dev/null 2>&1; then
- echo "SKIP: Could not $2"
- exit $ksft_skip
- fi
-}
-
-checktool "nft --version" "run test without nft tool"
-checktool "ip -Version" "run test without ip tool"
-checktool "which nc" "run test without nc (netcat)"
-checktool "ip netns add nsr1" "create net namespace"
-
-ip netns add ns1
-ip netns add ns2
-
-ip netns add nsr2
-
-cleanup() {
- for i in 1 2; do
- ip netns del ns$i
- ip netns del nsr$i
- done
-
- rm -f "$ns1in" "$ns1out"
- rm -f "$ns2in" "$ns2out"
-
- [ $log_netns -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns=$log_netns
-}
-
-trap cleanup EXIT
-
-sysctl -q net.netfilter.nf_log_all_netns=1
-
-ip link add veth0 netns nsr1 type veth peer name eth0 netns ns1
-ip link add veth1 netns nsr1 type veth peer name veth0 netns nsr2
-
-ip link add veth1 netns nsr2 type veth peer name eth0 netns ns2
-
-for dev in lo veth0 veth1; do
- for i in 1 2; do
- ip -net nsr$i link set $dev up
- done
-done
-
-ip -net nsr1 addr add 10.0.1.1/24 dev veth0
-ip -net nsr1 addr add dead:1::1/64 dev veth0
-
-ip -net nsr2 addr add 10.0.2.1/24 dev veth1
-ip -net nsr2 addr add dead:2::1/64 dev veth1
-
-# set different MTUs so we need to push packets coming from ns1 (large MTU)
-# to ns2 (smaller MTU) to stack either to perform fragmentation (ip_no_pmtu_disc=1),
-# or to do PTMU discovery (send ICMP error back to originator).
-# ns2 is going via nsr2 with a smaller mtu, so that TCPMSS announced by both peers
-# is NOT the lowest link mtu.
-
-omtu=9000
-lmtu=1500
-rmtu=2000
-
-usage(){
- echo "nft_flowtable.sh [OPTIONS]"
- echo
- echo "MTU options"
- echo " -o originator"
- echo " -l link"
- echo " -r responder"
- exit 1
-}
-
-while getopts "o:l:r:" o
-do
- case $o in
- o) omtu=$OPTARG;;
- l) lmtu=$OPTARG;;
- r) rmtu=$OPTARG;;
- *) usage;;
- esac
-done
-
-if ! ip -net nsr1 link set veth0 mtu $omtu; then
- exit 1
-fi
-
-ip -net ns1 link set eth0 mtu $omtu
-
-if ! ip -net nsr2 link set veth1 mtu $rmtu; then
- exit 1
-fi
-
-ip -net ns2 link set eth0 mtu $rmtu
-
-# transfer-net between nsr1 and nsr2.
-# these addresses are not used for connections.
-ip -net nsr1 addr add 192.168.10.1/24 dev veth1
-ip -net nsr1 addr add fee1:2::1/64 dev veth1
-
-ip -net nsr2 addr add 192.168.10.2/24 dev veth0
-ip -net nsr2 addr add fee1:2::2/64 dev veth0
-
-for i in 1 2; do
- ip netns exec nsr$i sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
- ip netns exec nsr$i sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
- ip -net ns$i link set lo up
- ip -net ns$i link set eth0 up
- ip -net ns$i addr add 10.0.$i.99/24 dev eth0
- ip -net ns$i route add default via 10.0.$i.1
- ip -net ns$i addr add dead:$i::99/64 dev eth0
- ip -net ns$i route add default via dead:$i::1
- if ! ip netns exec ns$i sysctl net.ipv4.tcp_no_metrics_save=1 > /dev/null; then
- echo "ERROR: Check Originator/Responder values (problem during address addition)"
- exit 1
- fi
-
- # don't set ip DF bit for first two tests
- ip netns exec ns$i sysctl net.ipv4.ip_no_pmtu_disc=1 > /dev/null
-done
-
-ip -net nsr1 route add default via 192.168.10.2
-ip -net nsr2 route add default via 192.168.10.1
-
-ip netns exec nsr1 nft -f - <<EOF
-table inet filter {
- flowtable f1 {
- hook ingress priority 0
- devices = { veth0, veth1 }
- }
-
- chain forward {
- type filter hook forward priority 0; policy drop;
-
- # flow offloaded? Tag ct with mark 1, so we can detect when it fails.
- meta oif "veth1" tcp dport 12345 flow offload @f1 counter
-
- # use packet size to trigger 'should be offloaded by now'.
- # otherwise, if 'flow offload' expression never offloads, the
- # test will pass.
- tcp dport 12345 meta length gt 200 ct mark set 1 counter
-
- # this turns off flow offloading internally, so expect packets again
- tcp flags fin,rst ct mark set 0 accept
-
- # this allows large packets from responder, we need this as long
- # as PMTUd is off.
- # This rule is deleted for the last test, when we expect PMTUd
- # to kick in and ensure all packets meet mtu requirements.
- meta length gt $lmtu accept comment something-to-grep-for
-
- # next line blocks connection w.o. working offload.
- # we only do this for reverse dir, because we expect packets to
- # enter slow path due to MTU mismatch of veth0 and veth1.
- tcp sport 12345 ct mark 1 counter log prefix "mark failure " drop
-
- ct state established,related accept
-
- # for packets that we can't offload yet, i.e. SYN (any ct that is not confirmed)
- meta length lt 200 oif "veth1" tcp dport 12345 counter accept
-
- meta nfproto ipv4 meta l4proto icmp accept
- meta nfproto ipv6 meta l4proto icmpv6 accept
- }
-}
-EOF
-
-if [ $? -ne 0 ]; then
- echo "SKIP: Could not load nft ruleset"
- exit $ksft_skip
-fi
-
-# test basic connectivity
-if ! ip netns exec ns1 ping -c 1 -q 10.0.2.99 > /dev/null; then
- echo "ERROR: ns1 cannot reach ns2" 1>&2
- bash
- exit 1
-fi
-
-if ! ip netns exec ns2 ping -c 1 -q 10.0.1.99 > /dev/null; then
- echo "ERROR: ns2 cannot reach ns1" 1>&2
- exit 1
-fi
-
-if [ $ret -eq 0 ];then
- echo "PASS: netns routing/connectivity: ns1 can reach ns2"
-fi
-
-ns1in=$(mktemp)
-ns1out=$(mktemp)
-ns2in=$(mktemp)
-ns2out=$(mktemp)
-
-make_file()
-{
- name=$1
-
- SIZE=$((RANDOM % (1024 * 8)))
- TSIZE=$((SIZE * 1024))
-
- dd if=/dev/urandom of="$name" bs=1024 count=$SIZE 2> /dev/null
-
- SIZE=$((RANDOM % 1024))
- SIZE=$((SIZE + 128))
- TSIZE=$((TSIZE + SIZE))
- dd if=/dev/urandom conf=notrunc of="$name" bs=1 count=$SIZE 2> /dev/null
-}
-
-check_transfer()
-{
- in=$1
- out=$2
- what=$3
-
- if ! cmp "$in" "$out" > /dev/null 2>&1; then
- echo "FAIL: file mismatch for $what" 1>&2
- ls -l "$in"
- ls -l "$out"
- return 1
- fi
-
- return 0
-}
-
-test_tcp_forwarding_ip()
-{
- local nsa=$1
- local nsb=$2
- local dstip=$3
- local dstport=$4
- local lret=0
-
- ip netns exec $nsb nc -w 5 -l -p 12345 < "$ns2in" > "$ns2out" &
- lpid=$!
-
- sleep 1
- ip netns exec $nsa nc -w 4 "$dstip" "$dstport" < "$ns1in" > "$ns1out" &
- cpid=$!
-
- sleep 3
-
- if ps -p $lpid > /dev/null;then
- kill $lpid
- fi
-
- if ps -p $cpid > /dev/null;then
- kill $cpid
- fi
-
- wait
-
- if ! check_transfer "$ns1in" "$ns2out" "ns1 -> ns2"; then
- lret=1
- fi
-
- if ! check_transfer "$ns2in" "$ns1out" "ns1 <- ns2"; then
- lret=1
- fi
-
- return $lret
-}
-
-test_tcp_forwarding()
-{
- test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345
-
- return $?
-}
-
-test_tcp_forwarding_nat()
-{
- local lret
-
- test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345
- lret=$?
-
- if [ $lret -eq 0 ] ; then
- test_tcp_forwarding_ip "$1" "$2" 10.6.6.6 1666
- lret=$?
- fi
-
- return $lret
-}
-
-make_file "$ns1in"
-make_file "$ns2in"
-
-# First test:
-# No PMTU discovery, nsr1 is expected to fragment packets from ns1 to ns2 as needed.
-if test_tcp_forwarding ns1 ns2; then
- echo "PASS: flow offloaded for ns1/ns2"
-else
- echo "FAIL: flow offload for ns1/ns2:" 1>&2
- ip netns exec nsr1 nft list ruleset
- ret=1
-fi
-
-# delete default route, i.e. ns2 won't be able to reach ns1 and
-# will depend on ns1 being masqueraded in nsr1.
-# expect ns1 has nsr1 address.
-ip -net ns2 route del default via 10.0.2.1
-ip -net ns2 route del default via dead:2::1
-ip -net ns2 route add 192.168.10.1 via 10.0.2.1
-
-# Second test:
-# Same, but with NAT enabled.
-ip netns exec nsr1 nft -f - <<EOF
-table ip nat {
- chain prerouting {
- type nat hook prerouting priority 0; policy accept;
- meta iif "veth0" ip daddr 10.6.6.6 tcp dport 1666 counter dnat ip to 10.0.2.99:12345
- }
-
- chain postrouting {
- type nat hook postrouting priority 0; policy accept;
- meta oifname "veth1" counter masquerade
- }
-}
-EOF
-
-if test_tcp_forwarding_nat ns1 ns2; then
- echo "PASS: flow offloaded for ns1/ns2 with NAT"
-else
- echo "FAIL: flow offload for ns1/ns2 with NAT" 1>&2
- ip netns exec nsr1 nft list ruleset
- ret=1
-fi
-
-# Third test:
-# Same as second test, but with PMTU discovery enabled.
-handle=$(ip netns exec nsr1 nft -a list table inet filter | grep something-to-grep-for | cut -d \# -f 2)
-
-if ! ip netns exec nsr1 nft delete rule inet filter forward $handle; then
- echo "FAIL: Could not delete large-packet accept rule"
- exit 1
-fi
-
-ip netns exec ns1 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
-ip netns exec ns2 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
-
-if test_tcp_forwarding_nat ns1 ns2; then
- echo "PASS: flow offloaded for ns1/ns2 with NAT and pmtu discovery"
-else
- echo "FAIL: flow offload for ns1/ns2 with NAT and pmtu discovery" 1>&2
- ip netns exec nsr1 nft list ruleset
-fi
-
-KEY_SHA="0x"$(ps -xaf | sha1sum | cut -d " " -f 1)
-KEY_AES="0x"$(ps -xaf | md5sum | cut -d " " -f 1)
-SPI1=$RANDOM
-SPI2=$RANDOM
-
-if [ $SPI1 -eq $SPI2 ]; then
- SPI2=$((SPI2+1))
-fi
-
-do_esp() {
- local ns=$1
- local me=$2
- local remote=$3
- local lnet=$4
- local rnet=$5
- local spi_out=$6
- local spi_in=$7
-
- ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $rnet dst $lnet
- ip -net $ns xfrm state add src $me dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
-
- # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
- ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 1 action allow
- # to fwd decrypted packets after esp processing:
- ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 1 action allow
-
-}
-
-do_esp nsr1 192.168.10.1 192.168.10.2 10.0.1.0/24 10.0.2.0/24 $SPI1 $SPI2
-
-do_esp nsr2 192.168.10.2 192.168.10.1 10.0.2.0/24 10.0.1.0/24 $SPI2 $SPI1
-
-ip netns exec nsr1 nft delete table ip nat
-
-# restore default routes
-ip -net ns2 route del 192.168.10.1 via 10.0.2.1
-ip -net ns2 route add default via 10.0.2.1
-ip -net ns2 route add default via dead:2::1
-
-if test_tcp_forwarding ns1 ns2; then
- echo "PASS: ipsec tunnel mode for ns1/ns2"
-else
- echo "FAIL: ipsec tunnel mode for ns1/ns2"
- ip netns exec nsr1 nft list ruleset 1>&2
- ip netns exec nsr1 cat /proc/net/xfrm_stat 1>&2
-fi
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh
deleted file mode 100755
index d250b84dd5bc..000000000000
--- a/tools/testing/selftests/netfilter/nft_meta.sh
+++ /dev/null
@@ -1,124 +0,0 @@
-#!/bin/bash
-
-# check iif/iifname/oifgroup/iiftype match.
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-sfx=$(mktemp -u "XXXXXXXX")
-ns0="ns0-$sfx"
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without nft tool"
- exit $ksft_skip
-fi
-
-cleanup()
-{
- ip netns del "$ns0"
-}
-
-ip netns add "$ns0"
-ip -net "$ns0" link set lo up
-ip -net "$ns0" addr add 127.0.0.1 dev lo
-
-trap cleanup EXIT
-
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table inet filter {
- counter iifcount {}
- counter iifnamecount {}
- counter iifgroupcount {}
- counter iiftypecount {}
- counter infproto4count {}
- counter il4protocounter {}
- counter imarkcounter {}
-
- counter oifcount {}
- counter oifnamecount {}
- counter oifgroupcount {}
- counter oiftypecount {}
- counter onfproto4count {}
- counter ol4protocounter {}
- counter oskuidcounter {}
- counter oskgidcounter {}
- counter omarkcounter {}
-
- chain input {
- type filter hook input priority 0; policy accept;
-
- meta iif lo counter name "iifcount"
- meta iifname "lo" counter name "iifnamecount"
- meta iifgroup "default" counter name "iifgroupcount"
- meta iiftype "loopback" counter name "iiftypecount"
- meta nfproto ipv4 counter name "infproto4count"
- meta l4proto icmp counter name "il4protocounter"
- meta mark 42 counter name "imarkcounter"
- }
-
- chain output {
- type filter hook output priority 0; policy accept;
- meta oif lo counter name "oifcount" counter
- meta oifname "lo" counter name "oifnamecount"
- meta oifgroup "default" counter name "oifgroupcount"
- meta oiftype "loopback" counter name "oiftypecount"
- meta nfproto ipv4 counter name "onfproto4count"
- meta l4proto icmp counter name "ol4protocounter"
- meta skuid 0 counter name "oskuidcounter"
- meta skgid 0 counter name "oskgidcounter"
- meta mark 42 counter name "omarkcounter"
- }
-}
-EOF
-
-if [ $? -ne 0 ]; then
- echo "SKIP: Could not add test ruleset"
- exit $ksft_skip
-fi
-
-ret=0
-
-check_one_counter()
-{
- local cname="$1"
- local want="packets $2"
- local verbose="$3"
-
- cnt=$(ip netns exec "$ns0" nft list counter inet filter $cname | grep -q "$want")
- if [ $? -ne 0 ];then
- echo "FAIL: $cname, want \"$want\", got"
- ret=1
- ip netns exec "$ns0" nft list counter inet filter $counter
- fi
-}
-
-check_lo_counters()
-{
- local want="$1"
- local verbose="$2"
- local counter
-
- for counter in iifcount iifnamecount iifgroupcount iiftypecount infproto4count \
- oifcount oifnamecount oifgroupcount oiftypecount onfproto4count \
- il4protocounter \
- ol4protocounter \
- ; do
- check_one_counter "$counter" "$want" "$verbose"
- done
-}
-
-check_lo_counters "0" false
-ip netns exec "$ns0" ping -q -c 1 127.0.0.1 -m 42 > /dev/null
-
-check_lo_counters "2" true
-
-check_one_counter oskuidcounter "1" true
-check_one_counter oskgidcounter "1" true
-check_one_counter imarkcounter "1" true
-check_one_counter omarkcounter "1" true
-
-if [ $ret -eq 0 ];then
- echo "OK: nftables meta iif/oif counters at expected values"
-fi
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
deleted file mode 100755
index d7e07f4c3d7f..000000000000
--- a/tools/testing/selftests/netfilter/nft_nat.sh
+++ /dev/null
@@ -1,869 +0,0 @@
-#!/bin/bash
-#
-# This test is for basic NAT functionality: snat, dnat, redirect, masquerade.
-#
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-test_inet_nat=true
-
-sfx=$(mktemp -u "XXXXXXXX")
-ns0="ns0-$sfx"
-ns1="ns1-$sfx"
-ns2="ns2-$sfx"
-
-cleanup()
-{
- for i in 0 1 2; do ip netns del ns$i-"$sfx";done
-}
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without nft tool"
- exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without ip tool"
- exit $ksft_skip
-fi
-
-ip netns add "$ns0"
-if [ $? -ne 0 ];then
- echo "SKIP: Could not create net namespace $ns0"
- exit $ksft_skip
-fi
-
-trap cleanup EXIT
-
-ip netns add "$ns1"
-if [ $? -ne 0 ];then
- echo "SKIP: Could not create net namespace $ns1"
- exit $ksft_skip
-fi
-
-ip netns add "$ns2"
-if [ $? -ne 0 ];then
- echo "SKIP: Could not create net namespace $ns2"
- exit $ksft_skip
-fi
-
-ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: No virtual ethernet pair device support in kernel"
- exit $ksft_skip
-fi
-ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2"
-
-ip -net "$ns0" link set lo up
-ip -net "$ns0" link set veth0 up
-ip -net "$ns0" addr add 10.0.1.1/24 dev veth0
-ip -net "$ns0" addr add dead:1::1/64 dev veth0
-
-ip -net "$ns0" link set veth1 up
-ip -net "$ns0" addr add 10.0.2.1/24 dev veth1
-ip -net "$ns0" addr add dead:2::1/64 dev veth1
-
-for i in 1 2; do
- ip -net ns$i-$sfx link set lo up
- ip -net ns$i-$sfx link set eth0 up
- ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0
- ip -net ns$i-$sfx route add default via 10.0.$i.1
- ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0
- ip -net ns$i-$sfx route add default via dead:$i::1
-done
-
-bad_counter()
-{
- local ns=$1
- local counter=$2
- local expect=$3
- local tag=$4
-
- echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2
- ip netns exec $ns nft list counter inet filter $counter 1>&2
-}
-
-check_counters()
-{
- ns=$1
- local lret=0
-
- cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
- if [ $? -ne 0 ]; then
- bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1"
- lret=1
- fi
- cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
- if [ $? -ne 0 ]; then
- bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2"
- lret=1
- fi
-
- expect="packets 1 bytes 104"
- cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter $ns ns0in6 "$expect" "check_counters 3"
- lret=1
- fi
- cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter $ns ns0out6 "$expect" "check_counters 4"
- lret=1
- fi
-
- return $lret
-}
-
-check_ns0_counters()
-{
- local ns=$1
- local lret=0
-
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns0in6 "packets 0 bytes 0"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2"
- lret=1
- fi
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 "
- lret=1
- fi
-
- for dir in "in" "out" ; do
- expect="packets 1 bytes 84"
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4"
- lret=1
- fi
-
- expect="packets 1 bytes 104"
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5"
- lret=1
- fi
- done
-
- return $lret
-}
-
-reset_counters()
-{
- for i in 0 1 2;do
- ip netns exec ns$i-$sfx nft reset counters inet > /dev/null
- done
-}
-
-test_local_dnat6()
-{
- local family=$1
- local lret=0
- local IPF=""
-
- if [ $family = "inet" ];then
- IPF="ip6"
- fi
-
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
- chain output {
- type nat hook output priority 0; policy accept;
- ip6 daddr dead:1::99 dnat $IPF to dead:2::99
- }
-}
-EOF
- if [ $? -ne 0 ]; then
- echo "SKIP: Could not add add $family dnat hook"
- return $ksft_skip
- fi
-
- # ping netns1, expect rewrite to netns2
- ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null
- if [ $? -ne 0 ]; then
- lret=1
- echo "ERROR: ping6 failed"
- return $lret
- fi
-
- expect="packets 0 bytes 0"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1"
- lret=1
- fi
- done
-
- expect="packets 1 bytes 104"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2"
- lret=1
- fi
- done
-
- # expect 0 count in ns1
- expect="packets 0 bytes 0"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3"
- lret=1
- fi
- done
-
- # expect 1 packet in ns2
- expect="packets 1 bytes 104"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4"
- lret=1
- fi
- done
-
- test $lret -eq 0 && echo "PASS: ipv6 ping to $ns1 was $family NATted to $ns2"
- ip netns exec "$ns0" nft flush chain ip6 nat output
-
- return $lret
-}
-
-test_local_dnat()
-{
- local family=$1
- local lret=0
- local IPF=""
-
- if [ $family = "inet" ];then
- IPF="ip"
- fi
-
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF 2>/dev/null
-table $family nat {
- chain output {
- type nat hook output priority 0; policy accept;
- ip daddr 10.0.1.99 dnat $IPF to 10.0.2.99
- }
-}
-EOF
- if [ $? -ne 0 ]; then
- if [ $family = "inet" ];then
- echo "SKIP: inet nat tests"
- test_inet_nat=false
- return $ksft_skip
- fi
- echo "SKIP: Could not add add $family dnat hook"
- return $ksft_skip
- fi
-
- # ping netns1, expect rewrite to netns2
- ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
- if [ $? -ne 0 ]; then
- lret=1
- echo "ERROR: ping failed"
- return $lret
- fi
-
- expect="packets 0 bytes 0"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1"
- lret=1
- fi
- done
-
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2"
- lret=1
- fi
- done
-
- # expect 0 count in ns1
- expect="packets 0 bytes 0"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3"
- lret=1
- fi
- done
-
- # expect 1 packet in ns2
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4"
- lret=1
- fi
- done
-
- test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2"
-
- ip netns exec "$ns0" nft flush chain $family nat output
-
- reset_counters
- ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
- if [ $? -ne 0 ]; then
- lret=1
- echo "ERROR: ping failed"
- return $lret
- fi
-
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5"
- lret=1
- fi
- done
- expect="packets 0 bytes 0"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6"
- lret=1
- fi
- done
-
- # expect 1 count in ns1
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7"
- lret=1
- fi
- done
-
- # expect 0 packet in ns2
- expect="packets 0 bytes 0"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8"
- lret=1
- fi
- done
-
- test $lret -eq 0 && echo "PASS: ping to $ns1 OK after $family nat output chain flush"
-
- return $lret
-}
-
-
-test_masquerade6()
-{
- local family=$1
- local natflags=$2
- local lret=0
-
- ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
-
- ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2 via ipv6"
- return 1
- lret=1
- fi
-
- expect="packets 1 bytes 104"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2"
- lret=1
- fi
- done
-
- reset_counters
-
-# add masquerading rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
- chain postrouting {
- type nat hook postrouting priority 0; policy accept;
- meta oif veth0 masquerade $natflags
- }
-}
-EOF
- if [ $? -ne 0 ]; then
- echo "SKIP: Could not add add $family masquerade hook"
- return $ksft_skip
- fi
-
- ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
- lret=1
- fi
-
- # ns1 should have seen packets from ns0, due to masquerade
- expect="packets 1 bytes 104"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4"
- lret=1
- fi
- done
-
- # ns1 should not have seen packets from ns2, due to masquerade
- expect="packets 0 bytes 0"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6"
- lret=1
- fi
- done
-
- ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)"
- lret=1
- fi
-
- ip netns exec "$ns0" nft flush chain $family nat postrouting
- if [ $? -ne 0 ]; then
- echo "ERROR: Could not flush $family nat postrouting" 1>&2
- lret=1
- fi
-
- test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for $ns2"
-
- return $lret
-}
-
-test_masquerade()
-{
- local family=$1
- local natflags=$2
- local lret=0
-
- ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
- ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
- ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from "$ns2" $natflags"
- lret=1
- fi
-
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2"
- lret=1
- fi
- done
-
- reset_counters
-
-# add masquerading rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
- chain postrouting {
- type nat hook postrouting priority 0; policy accept;
- meta oif veth0 masquerade $natflags
- }
-}
-EOF
- if [ $? -ne 0 ]; then
- echo "SKIP: Could not add add $family masquerade hook"
- return $ksft_skip
- fi
-
- ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
- lret=1
- fi
-
- # ns1 should have seen packets from ns0, due to masquerade
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4"
- lret=1
- fi
- done
-
- # ns1 should not have seen packets from ns2, due to masquerade
- expect="packets 0 bytes 0"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6"
- lret=1
- fi
- done
-
- ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)"
- lret=1
- fi
-
- ip netns exec "$ns0" nft flush chain $family nat postrouting
- if [ $? -ne 0 ]; then
- echo "ERROR: Could not flush $family nat postrouting" 1>&2
- lret=1
- fi
-
- test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for $ns2"
-
- return $lret
-}
-
-test_redirect6()
-{
- local family=$1
- local lret=0
-
- ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
-
- ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6"
- lret=1
- fi
-
- expect="packets 1 bytes 104"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2"
- lret=1
- fi
- done
-
- reset_counters
-
-# add redirect rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
- chain prerouting {
- type nat hook prerouting priority 0; policy accept;
- meta iif veth1 meta l4proto icmpv6 ip6 saddr dead:2::99 ip6 daddr dead:1::99 redirect
- }
-}
-EOF
- if [ $? -ne 0 ]; then
- echo "SKIP: Could not add add $family redirect hook"
- return $ksft_skip
- fi
-
- ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect"
- lret=1
- fi
-
- # ns1 should have seen no packets from ns2, due to redirection
- expect="packets 0 bytes 0"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3"
- lret=1
- fi
- done
-
- # ns0 should have seen packets from ns2, due to masquerade
- expect="packets 1 bytes 104"
- for dir in "in6" "out6" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4"
- lret=1
- fi
- done
-
- ip netns exec "$ns0" nft delete table $family nat
- if [ $? -ne 0 ]; then
- echo "ERROR: Could not delete $family nat table" 1>&2
- lret=1
- fi
-
- test $lret -eq 0 && echo "PASS: $family IPv6 redirection for $ns2"
-
- return $lret
-}
-
-test_redirect()
-{
- local family=$1
- local lret=0
-
- ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
- ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
- ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2"
- lret=1
- fi
-
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1"
- lret=1
- fi
-
- cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2"
- lret=1
- fi
- done
-
- reset_counters
-
-# add redirect rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
- chain prerouting {
- type nat hook prerouting priority 0; policy accept;
- meta iif veth1 ip protocol icmp ip saddr 10.0.2.99 ip daddr 10.0.1.99 redirect
- }
-}
-EOF
- if [ $? -ne 0 ]; then
- echo "SKIP: Could not add add $family redirect hook"
- return $ksft_skip
- fi
-
- ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
- if [ $? -ne 0 ] ; then
- echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect"
- lret=1
- fi
-
- # ns1 should have seen no packets from ns2, due to redirection
- expect="packets 0 bytes 0"
- for dir in "in" "out" ; do
-
- cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3"
- lret=1
- fi
- done
-
- # ns0 should have seen packets from ns2, due to masquerade
- expect="packets 1 bytes 84"
- for dir in "in" "out" ; do
- cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
- if [ $? -ne 0 ]; then
- bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4"
- lret=1
- fi
- done
-
- ip netns exec "$ns0" nft delete table $family nat
- if [ $? -ne 0 ]; then
- echo "ERROR: Could not delete $family nat table" 1>&2
- lret=1
- fi
-
- test $lret -eq 0 && echo "PASS: $family IP redirection for $ns2"
-
- return $lret
-}
-
-
-# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99
-for i in 0 1 2; do
-ip netns exec ns$i-$sfx nft -f /dev/stdin <<EOF
-table inet filter {
- counter ns0in {}
- counter ns1in {}
- counter ns2in {}
-
- counter ns0out {}
- counter ns1out {}
- counter ns2out {}
-
- counter ns0in6 {}
- counter ns1in6 {}
- counter ns2in6 {}
-
- counter ns0out6 {}
- counter ns1out6 {}
- counter ns2out6 {}
-
- map nsincounter {
- type ipv4_addr : counter
- elements = { 10.0.1.1 : "ns0in",
- 10.0.2.1 : "ns0in",
- 10.0.1.99 : "ns1in",
- 10.0.2.99 : "ns2in" }
- }
-
- map nsincounter6 {
- type ipv6_addr : counter
- elements = { dead:1::1 : "ns0in6",
- dead:2::1 : "ns0in6",
- dead:1::99 : "ns1in6",
- dead:2::99 : "ns2in6" }
- }
-
- map nsoutcounter {
- type ipv4_addr : counter
- elements = { 10.0.1.1 : "ns0out",
- 10.0.2.1 : "ns0out",
- 10.0.1.99: "ns1out",
- 10.0.2.99: "ns2out" }
- }
-
- map nsoutcounter6 {
- type ipv6_addr : counter
- elements = { dead:1::1 : "ns0out6",
- dead:2::1 : "ns0out6",
- dead:1::99 : "ns1out6",
- dead:2::99 : "ns2out6" }
- }
-
- chain input {
- type filter hook input priority 0; policy accept;
- counter name ip saddr map @nsincounter
- icmpv6 type { "echo-request", "echo-reply" } counter name ip6 saddr map @nsincounter6
- }
- chain output {
- type filter hook output priority 0; policy accept;
- counter name ip daddr map @nsoutcounter
- icmpv6 type { "echo-request", "echo-reply" } counter name ip6 daddr map @nsoutcounter6
- }
-}
-EOF
-done
-
-sleep 3
-# test basic connectivity
-for i in 1 2; do
- ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null
- if [ $? -ne 0 ];then
- echo "ERROR: Could not reach other namespace(s)" 1>&2
- ret=1
- fi
-
- ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null
- if [ $? -ne 0 ];then
- echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
- ret=1
- fi
- check_counters ns$i-$sfx
- if [ $? -ne 0 ]; then
- ret=1
- fi
-
- check_ns0_counters ns$i
- if [ $? -ne 0 ]; then
- ret=1
- fi
- reset_counters
-done
-
-if [ $ret -eq 0 ];then
- echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2"
-fi
-
-reset_counters
-test_local_dnat ip
-test_local_dnat6 ip6
-reset_counters
-$test_inet_nat && test_local_dnat inet
-$test_inet_nat && test_local_dnat6 inet
-
-for flags in "" "fully-random"; do
-reset_counters
-test_masquerade ip $flags
-test_masquerade6 ip6 $flags
-reset_counters
-$test_inet_nat && test_masquerade inet $flags
-$test_inet_nat && test_masquerade6 inet $flags
-done
-
-reset_counters
-test_redirect ip
-test_redirect6 ip6
-reset_counters
-$test_inet_nat && test_redirect inet
-$test_inet_nat && test_redirect6 inet
-
-if [ $ret -ne 0 ];then
- echo -n "FAIL: "
- nft --version
-fi
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_queue.sh b/tools/testing/selftests/netfilter/nft_queue.sh
deleted file mode 100755
index 6898448b4266..000000000000
--- a/tools/testing/selftests/netfilter/nft_queue.sh
+++ /dev/null
@@ -1,332 +0,0 @@
-#!/bin/bash
-#
-# This tests nf_queue:
-# 1. can process packets from all hooks
-# 2. support running nfqueue from more than one base chain
-#
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-sfx=$(mktemp -u "XXXXXXXX")
-ns1="ns1-$sfx"
-ns2="ns2-$sfx"
-nsrouter="nsrouter-$sfx"
-
-cleanup()
-{
- ip netns del ${ns1}
- ip netns del ${ns2}
- ip netns del ${nsrouter}
- rm -f "$TMPFILE0"
- rm -f "$TMPFILE1"
-}
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without nft tool"
- exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without ip tool"
- exit $ksft_skip
-fi
-
-ip netns add ${nsrouter}
-if [ $? -ne 0 ];then
- echo "SKIP: Could not create net namespace"
- exit $ksft_skip
-fi
-
-TMPFILE0=$(mktemp)
-TMPFILE1=$(mktemp)
-trap cleanup EXIT
-
-ip netns add ${ns1}
-ip netns add ${ns2}
-
-ip link add veth0 netns ${nsrouter} type veth peer name eth0 netns ${ns1} > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: No virtual ethernet pair device support in kernel"
- exit $ksft_skip
-fi
-ip link add veth1 netns ${nsrouter} type veth peer name eth0 netns ${ns2}
-
-ip -net ${nsrouter} link set lo up
-ip -net ${nsrouter} link set veth0 up
-ip -net ${nsrouter} addr add 10.0.1.1/24 dev veth0
-ip -net ${nsrouter} addr add dead:1::1/64 dev veth0
-
-ip -net ${nsrouter} link set veth1 up
-ip -net ${nsrouter} addr add 10.0.2.1/24 dev veth1
-ip -net ${nsrouter} addr add dead:2::1/64 dev veth1
-
-ip -net ${ns1} link set lo up
-ip -net ${ns1} link set eth0 up
-
-ip -net ${ns2} link set lo up
-ip -net ${ns2} link set eth0 up
-
-ip -net ${ns1} addr add 10.0.1.99/24 dev eth0
-ip -net ${ns1} addr add dead:1::99/64 dev eth0
-ip -net ${ns1} route add default via 10.0.1.1
-ip -net ${ns1} route add default via dead:1::1
-
-ip -net ${ns2} addr add 10.0.2.99/24 dev eth0
-ip -net ${ns2} addr add dead:2::99/64 dev eth0
-ip -net ${ns2} route add default via 10.0.2.1
-ip -net ${ns2} route add default via dead:2::1
-
-load_ruleset() {
- local name=$1
- local prio=$2
-
-ip netns exec ${nsrouter} nft -f - <<EOF
-table inet $name {
- chain nfq {
- ip protocol icmp queue bypass
- icmpv6 type { "echo-request", "echo-reply" } queue num 1 bypass
- }
- chain pre {
- type filter hook prerouting priority $prio; policy accept;
- jump nfq
- }
- chain input {
- type filter hook input priority $prio; policy accept;
- jump nfq
- }
- chain forward {
- type filter hook forward priority $prio; policy accept;
- tcp dport 12345 queue num 2
- jump nfq
- }
- chain output {
- type filter hook output priority $prio; policy accept;
- tcp dport 12345 queue num 3
- jump nfq
- }
- chain post {
- type filter hook postrouting priority $prio; policy accept;
- jump nfq
- }
-}
-EOF
-}
-
-load_counter_ruleset() {
- local prio=$1
-
-ip netns exec ${nsrouter} nft -f - <<EOF
-table inet countrules {
- chain pre {
- type filter hook prerouting priority $prio; policy accept;
- counter
- }
- chain input {
- type filter hook input priority $prio; policy accept;
- counter
- }
- chain forward {
- type filter hook forward priority $prio; policy accept;
- counter
- }
- chain output {
- type filter hook output priority $prio; policy accept;
- counter
- }
- chain post {
- type filter hook postrouting priority $prio; policy accept;
- counter
- }
-}
-EOF
-}
-
-test_ping() {
- ip netns exec ${ns1} ping -c 1 -q 10.0.2.99 > /dev/null
- if [ $? -ne 0 ];then
- return 1
- fi
-
- ip netns exec ${ns1} ping -c 1 -q dead:2::99 > /dev/null
- if [ $? -ne 0 ];then
- return 1
- fi
-
- return 0
-}
-
-test_ping_router() {
- ip netns exec ${ns1} ping -c 1 -q 10.0.2.1 > /dev/null
- if [ $? -ne 0 ];then
- return 1
- fi
-
- ip netns exec ${ns1} ping -c 1 -q dead:2::1 > /dev/null
- if [ $? -ne 0 ];then
- return 1
- fi
-
- return 0
-}
-
-test_queue_blackhole() {
- local proto=$1
-
-ip netns exec ${nsrouter} nft -f - <<EOF
-table $proto blackh {
- chain forward {
- type filter hook forward priority 0; policy accept;
- queue num 600
- }
-}
-EOF
- if [ $proto = "ip" ] ;then
- ip netns exec ${ns1} ping -c 1 -q 10.0.2.99 > /dev/null
- lret=$?
- elif [ $proto = "ip6" ]; then
- ip netns exec ${ns1} ping -c 1 -q dead:2::99 > /dev/null
- lret=$?
- else
- lret=111
- fi
-
- # queue without bypass keyword should drop traffic if no listener exists.
- if [ $lret -eq 0 ];then
- echo "FAIL: $proto expected failure, got $lret" 1>&2
- exit 1
- fi
-
- ip netns exec ${nsrouter} nft delete table $proto blackh
- if [ $? -ne 0 ] ;then
- echo "FAIL: $proto: Could not delete blackh table"
- exit 1
- fi
-
- echo "PASS: $proto: statement with no listener results in packet drop"
-}
-
-test_queue()
-{
- local expected=$1
- local last=""
-
- # spawn nf-queue listeners
- ip netns exec ${nsrouter} ./nf-queue -c -q 0 -t 3 > "$TMPFILE0" &
- ip netns exec ${nsrouter} ./nf-queue -c -q 1 -t 3 > "$TMPFILE1" &
- sleep 1
- test_ping
- ret=$?
- if [ $ret -ne 0 ];then
- echo "FAIL: netns routing/connectivity with active listener on queue $queue: $ret" 1>&2
- exit $ret
- fi
-
- test_ping_router
- ret=$?
- if [ $ret -ne 0 ];then
- echo "FAIL: netns router unreachable listener on queue $queue: $ret" 1>&2
- exit $ret
- fi
-
- wait
- ret=$?
-
- for file in $TMPFILE0 $TMPFILE1; do
- last=$(tail -n1 "$file")
- if [ x"$last" != x"$expected packets total" ]; then
- echo "FAIL: Expected $expected packets total, but got $last" 1>&2
- cat "$file" 1>&2
-
- ip netns exec ${nsrouter} nft list ruleset
- exit 1
- fi
- done
-
- echo "PASS: Expected and received $last"
-}
-
-test_tcp_forward()
-{
- ip netns exec ${nsrouter} ./nf-queue -q 2 -t 10 &
- local nfqpid=$!
-
- tmpfile=$(mktemp) || exit 1
- dd conv=sparse status=none if=/dev/zero bs=1M count=100 of=$tmpfile
- ip netns exec ${ns2} nc -w 5 -l -p 12345 <"$tmpfile" >/dev/null &
- local rpid=$!
-
- sleep 1
- ip netns exec ${ns1} nc -w 5 10.0.2.99 12345 <"$tmpfile" >/dev/null &
-
- rm -f "$tmpfile"
-
- wait $rpid
- wait $lpid
- [ $? -eq 0 ] && echo "PASS: tcp and nfqueue in forward chain"
-}
-
-test_tcp_localhost()
-{
- tc -net "${nsrouter}" qdisc add dev lo root netem loss random 1%
-
- tmpfile=$(mktemp) || exit 1
-
- dd conv=sparse status=none if=/dev/zero bs=1M count=900 of=$tmpfile
- ip netns exec ${nsrouter} nc -w 5 -l -p 12345 <"$tmpfile" >/dev/null &
- local rpid=$!
-
- ip netns exec ${nsrouter} ./nf-queue -q 3 -t 30 &
- local nfqpid=$!
-
- sleep 1
- ip netns exec ${nsrouter} nc -w 5 127.0.0.1 12345 <"$tmpfile" > /dev/null
- rm -f "$tmpfile"
-
- wait $rpid
- [ $? -eq 0 ] && echo "PASS: tcp via loopback"
-}
-
-ip netns exec ${nsrouter} sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
-ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
-ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
-load_ruleset "filter" 0
-
-sleep 3
-
-test_ping
-ret=$?
-if [ $ret -eq 0 ];then
- # queue bypass works (rules were skipped, no listener)
- echo "PASS: ${ns1} can reach ${ns2}"
-else
- echo "FAIL: ${ns1} cannot reach ${ns2}: $ret" 1>&2
- exit $ret
-fi
-
-test_queue_blackhole ip
-test_queue_blackhole ip6
-
-# dummy ruleset to add base chains between the
-# queueing rules. We don't want the second reinject
-# to re-execute the old hooks.
-load_counter_ruleset 10
-
-# we are hooking all: prerouting/input/forward/output/postrouting.
-# we ping ${ns2} from ${ns1} via ${nsrouter} using ipv4 and ipv6, so:
-# 1x icmp prerouting,forward,postrouting -> 3 queue events (6 incl. reply).
-# 1x icmp prerouting,input,output postrouting -> 4 queue events incl. reply.
-# so we expect that userspace program receives 10 packets.
-test_queue 10
-
-# same. We queue to a second program as well.
-load_ruleset "filter2" 20
-test_queue 20
-
-test_tcp_forward
-test_tcp_localhost
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
deleted file mode 100755
index f1affd12c4b1..000000000000
--- a/tools/testing/selftests/netfilter/nft_trans_stress.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/bin/bash
-#
-# This test is for stress-testing the nf_tables config plane path vs.
-# packet path processing: Make sure we never release rules that are
-# still visible to other cpus.
-#
-# set -e
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-
-testns=testns1
-tables="foo bar baz quux"
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without nft tool"
- exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
- echo "SKIP: Could not run test without ip tool"
- exit $ksft_skip
-fi
-
-tmp=$(mktemp)
-
-for table in $tables; do
- echo add table inet "$table" >> "$tmp"
- echo flush table inet "$table" >> "$tmp"
-
- echo "add chain inet $table INPUT { type filter hook input priority 0; }" >> "$tmp"
- echo "add chain inet $table OUTPUT { type filter hook output priority 0; }" >> "$tmp"
- for c in $(seq 1 400); do
- chain=$(printf "chain%03u" "$c")
- echo "add chain inet $table $chain" >> "$tmp"
- done
-
- for c in $(seq 1 400); do
- chain=$(printf "chain%03u" "$c")
- for BASE in INPUT OUTPUT; do
- echo "add rule inet $table $BASE counter jump $chain" >> "$tmp"
- done
- echo "add rule inet $table $chain counter return" >> "$tmp"
- done
-done
-
-ip netns add "$testns"
-ip -netns "$testns" link set lo up
-
-lscpu | grep ^CPU\(s\): | ( read cpu cpunum ;
-cpunum=$((cpunum-1))
-for i in $(seq 0 $cpunum);do
- mask=$(printf 0x%x $((1<<$i)))
- ip netns exec "$testns" taskset $mask ping -4 127.0.0.1 -fq > /dev/null &
- ip netns exec "$testns" taskset $mask ping -6 ::1 -fq > /dev/null &
-done)
-
-sleep 1
-
-for i in $(seq 1 10) ; do ip netns exec "$testns" nft -f "$tmp" & done
-
-for table in $tables;do
- randsleep=$((RANDOM%10))
- sleep $randsleep
- ip netns exec "$testns" nft delete table inet $table 2>/dev/null
-done
-
-randsleep=$((RANDOM%10))
-sleep $randsleep
-
-pkill -9 ping
-
-wait
-
-rm -f "$tmp"
-ip netns del "$testns"
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.