mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
selftests: netfilter: move to net subdir
.. so this can start re-using existing lib.sh infra in next patches. Several of these scripts will not work, e.g. because they assume rp_filter is disabled, or reliance on a particular version/flavor of "netcat" tool. Add config settings for them. nft_trans_stress.sh script is removed, it also exists in the nftables userspace selftests. I do not see a reason to keep two versions in different repositories/projects. The settings file is removed for now: It was used to increase the timeout to avoid slow scripts from getting zapped by the 45s timeout, but some of the slow scripts can be sped up. Re-add it later for scripts that cannot be sped up easily. Update MAINTAINERS to reflect that future updates to netfilter scripts should go through netfilter-devel@. Signed-off-by: Florian Westphal <fw@strlen.de> Link: https://lore.kernel.org/r/20240411233624.8129-2-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
parent
982a73c7c5
commit
3f189349e5
|
@ -15264,6 +15264,7 @@ F: net/*/netfilter.c
|
|||
F: net/*/netfilter/
|
||||
F: net/bridge/br_netfilter*.c
|
||||
F: net/netfilter/
|
||||
F: tools/testing/selftests/net/netfilter/
|
||||
|
||||
NETROM NETWORK LAYER
|
||||
M: Ralf Baechle <ralf@linux-mips.org>
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
nf-queue
|
||||
connect_close
|
||||
audit_logread
|
||||
connect_close
|
||||
conntrack_dump_flush
|
||||
sctp_collision
|
||||
nf_queue
|
44
tools/testing/selftests/net/netfilter/Makefile
Normal file
44
tools/testing/selftests/net/netfilter/Makefile
Normal file
|
@ -0,0 +1,44 @@
|
|||
# SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
top_srcdir = ../../../../..
|
||||
|
||||
HOSTPKG_CONFIG := pkg-config
|
||||
MNL_CFLAGS := $(shell $(HOSTPKG_CONFIG) --cflags libmnl 2>/dev/null)
|
||||
MNL_LDLIBS := $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
|
||||
|
||||
TEST_PROGS := br_netfilter.sh bridge_brouter.sh
|
||||
TEST_PROGS += conntrack_icmp_related.sh
|
||||
TEST_PROGS += conntrack_ipip_mtu.sh
|
||||
TEST_PROGS += conntrack_tcp_unreplied.sh
|
||||
TEST_PROGS += conntrack_sctp_collision.sh
|
||||
TEST_PROGS += conntrack_vrf.sh
|
||||
TEST_PROGS += ipvs.sh
|
||||
TEST_PROGS += nf_nat_edemux.sh
|
||||
TEST_PROGS += nft_audit.sh
|
||||
TEST_PROGS += nft_concat_range.sh
|
||||
TEST_PROGS += nft_conntrack_helper.sh
|
||||
TEST_PROGS += nft_fib.sh
|
||||
TEST_PROGS += nft_flowtable.sh
|
||||
TEST_PROGS += nft_meta.sh
|
||||
TEST_PROGS += nft_nat.sh
|
||||
TEST_PROGS += nft_nat_zones.sh
|
||||
TEST_PROGS += nft_queue.sh
|
||||
TEST_PROGS += nft_synproxy.sh
|
||||
TEST_PROGS += nft_zones_many.sh
|
||||
TEST_PROGS += rpath.sh
|
||||
TEST_PROGS += xt_string.sh
|
||||
|
||||
TEST_CUSTOM_PROGS += conntrack_dump_flush
|
||||
|
||||
TEST_GEN_FILES = audit_logread
|
||||
TEST_GEN_FILES += conntrack_dump_flush
|
||||
TEST_GEN_FILES += connect_close nf_queue
|
||||
TEST_GEN_FILES += sctp_collision
|
||||
|
||||
include ../../lib.mk
|
||||
|
||||
$(OUTPUT)/nf_queue: CFLAGS += $(MNL_CFLAGS)
|
||||
$(OUTPUT)/nf_queue: LDLIBS += $(MNL_LDLIBS)
|
||||
|
||||
$(OUTPUT)/conntrack_dump_flush: CFLAGS += $(MNL_CFLAGS)
|
||||
$(OUTPUT)/conntrack_dump_flush: LDLIBS += $(MNL_LDLIBS)
|
0
tools/testing/selftests/netfilter/bridge_netfilter.sh → tools/testing/selftests/net/netfilter/br_netfilter.sh
Normal file → Executable file
0
tools/testing/selftests/netfilter/bridge_netfilter.sh → tools/testing/selftests/net/netfilter/br_netfilter.sh
Normal file → Executable file
37
tools/testing/selftests/net/netfilter/config
Normal file
37
tools/testing/selftests/net/netfilter/config
Normal file
|
@ -0,0 +1,37 @@
|
|||
CONFIG_AUDIT=y
|
||||
CONFIG_BRIDGE_EBT_BROUTE=m
|
||||
CONFIG_BRIDGE_EBT_REDIRECT=m
|
||||
CONFIG_BRIDGE_NETFILTER=m
|
||||
CONFIG_IP_NF_MATCH_RPFILTER=m
|
||||
CONFIG_IP6_NF_MATCH_RPFILTER=m
|
||||
CONFIG_IP_SCTP=m
|
||||
CONFIG_IP_VS=m
|
||||
CONFIG_IP_VS_PROTO_TCP=y
|
||||
CONFIG_NET_CLS_U32=m
|
||||
CONFIG_NET_SCH_NETEM=m
|
||||
CONFIG_NET_SCH_HTB=m
|
||||
CONFIG_NET_IPIP=m
|
||||
CONFIG_NET_VRF=y
|
||||
CONFIG_NETFILTER_NETLINK=m
|
||||
CONFIG_NETFILTER_SYNPROXY=m
|
||||
CONFIG_NETFILTER_XT_NAT=m
|
||||
CONFIG_NETFILTER_XT_TARGET_REDIRECT=m
|
||||
CONFIG_NF_CONNTRACK=m
|
||||
CONFIG_NF_CONNTRACK_EVENTS=m
|
||||
CONFIG_NF_CONNTRACK_ZONES=y
|
||||
CONFIG_NF_CT_NETLINK=m
|
||||
CONFIG_NF_CT_PROTO_SCTP=y
|
||||
CONFIG_NF_TABLES=m
|
||||
CONFIG_NF_TABLES_INET=y
|
||||
CONFIG_NF_TABLES_IPV4=y
|
||||
CONFIG_NF_TABLES_IPV6=y
|
||||
CONFIG_NFT_CT=m
|
||||
CONFIG_NFT_FIB=m
|
||||
CONFIG_NFT_FIB_INET=m
|
||||
CONFIG_NFT_FIB_IPV4=m
|
||||
CONFIG_NFT_FIB_IPV6=m
|
||||
CONFIG_NFT_MASQ=m
|
||||
CONFIG_NFT_NAT=m
|
||||
CONFIG_NFT_QUEUE=m
|
||||
CONFIG_NFT_REDIR=m
|
||||
CONFIG_NFT_SYNPROXY=m
|
|
@ -10,7 +10,7 @@
|
|||
#include <linux/netfilter/nfnetlink.h>
|
||||
#include <linux/netfilter/nfnetlink_conntrack.h>
|
||||
#include <linux/netfilter/nf_conntrack_tcp.h>
|
||||
#include "../kselftest_harness.h"
|
||||
#include "../../kselftest_harness.h"
|
||||
|
||||
#define TEST_ZONE_ID 123
|
||||
#define NF_CT_DEFAULT_ZONE_ID 0
|
3
tools/testing/selftests/net/netfilter/lib.sh
Normal file
3
tools/testing/selftests/net/netfilter/lib.sh
Normal file
|
@ -0,0 +1,3 @@
|
|||
net_netfilter_dir=$(dirname "$(readlink -e "${BASH_SOURCE[0]}")")
|
||||
|
||||
source "$net_netfilter_dir/../lib.sh"
|
|
@ -222,9 +222,9 @@ test_queue()
|
|||
local expected=$1
|
||||
local last=""
|
||||
|
||||
# spawn nf-queue listeners
|
||||
ip netns exec ${nsrouter} ./nf-queue -c -q 0 -t $timeout > "$TMPFILE0" &
|
||||
ip netns exec ${nsrouter} ./nf-queue -c -q 1 -t $timeout > "$TMPFILE1" &
|
||||
# spawn nf_queue listeners
|
||||
ip netns exec ${nsrouter} ./nf_queue -c -q 0 -t $timeout > "$TMPFILE0" &
|
||||
ip netns exec ${nsrouter} ./nf_queue -c -q 1 -t $timeout > "$TMPFILE1" &
|
||||
sleep 1
|
||||
test_ping
|
||||
ret=$?
|
||||
|
@ -259,7 +259,7 @@ test_queue()
|
|||
|
||||
test_tcp_forward()
|
||||
{
|
||||
ip netns exec ${nsrouter} ./nf-queue -q 2 -t $timeout &
|
||||
ip netns exec ${nsrouter} ./nf_queue -q 2 -t $timeout &
|
||||
local nfqpid=$!
|
||||
|
||||
tmpfile=$(mktemp) || exit 1
|
||||
|
@ -285,7 +285,7 @@ test_tcp_localhost()
|
|||
ip netns exec ${nsrouter} nc -w 5 -l -p 12345 <"$tmpfile" >/dev/null &
|
||||
local rpid=$!
|
||||
|
||||
ip netns exec ${nsrouter} ./nf-queue -q 3 -t $timeout &
|
||||
ip netns exec ${nsrouter} ./nf_queue -q 3 -t $timeout &
|
||||
local nfqpid=$!
|
||||
|
||||
sleep 1
|
||||
|
@ -303,7 +303,7 @@ test_tcp_localhost_connectclose()
|
|||
|
||||
ip netns exec ${nsrouter} ./connect_close -p 23456 -t $timeout &
|
||||
|
||||
ip netns exec ${nsrouter} ./nf-queue -q 3 -t $timeout &
|
||||
ip netns exec ${nsrouter} ./nf_queue -q 3 -t $timeout &
|
||||
local nfqpid=$!
|
||||
|
||||
sleep 1
|
||||
|
@ -334,11 +334,11 @@ EOF
|
|||
ip netns exec ${nsrouter} nc -w 5 -l -p 12345 <"$tmpfile" >/dev/null &
|
||||
local rpid=$!
|
||||
|
||||
ip netns exec ${nsrouter} ./nf-queue -c -q 1 -t $timeout > "$TMPFILE2" &
|
||||
ip netns exec ${nsrouter} ./nf_queue -c -q 1 -t $timeout > "$TMPFILE2" &
|
||||
|
||||
# nfqueue 1 will be called via output hook. But this time,
|
||||
# re-queue the packet to nfqueue program on queue 2.
|
||||
ip netns exec ${nsrouter} ./nf-queue -G -d 150 -c -q 0 -Q 1 -t $timeout > "$TMPFILE3" &
|
||||
ip netns exec ${nsrouter} ./nf_queue -G -d 150 -c -q 0 -Q 1 -t $timeout > "$TMPFILE3" &
|
||||
|
||||
sleep 1
|
||||
ip netns exec ${nsrouter} nc -w 5 127.0.0.1 12345 <"$tmpfile" > /dev/null
|
||||
|
@ -380,7 +380,7 @@ table inet filter {
|
|||
}
|
||||
}
|
||||
EOF
|
||||
ip netns exec ${ns1} ./nf-queue -q 1 -t $timeout &
|
||||
ip netns exec ${ns1} ./nf_queue -q 1 -t $timeout &
|
||||
local nfqpid=$!
|
||||
|
||||
sleep 1
|
|
@ -1,21 +0,0 @@
|
|||
# SPDX-License-Identifier: GPL-2.0
|
||||
# Makefile for netfilter selftests
|
||||
|
||||
TEST_PROGS := nft_trans_stress.sh nft_fib.sh nft_nat.sh bridge_brouter.sh \
|
||||
conntrack_icmp_related.sh nft_flowtable.sh ipvs.sh \
|
||||
nft_concat_range.sh nft_conntrack_helper.sh \
|
||||
nft_queue.sh nft_meta.sh nf_nat_edemux.sh \
|
||||
ipip-conntrack-mtu.sh conntrack_tcp_unreplied.sh \
|
||||
conntrack_vrf.sh nft_synproxy.sh rpath.sh nft_audit.sh \
|
||||
conntrack_sctp_collision.sh xt_string.sh \
|
||||
bridge_netfilter.sh
|
||||
|
||||
HOSTPKG_CONFIG := pkg-config
|
||||
|
||||
CFLAGS += $(shell $(HOSTPKG_CONFIG) --cflags libmnl 2>/dev/null)
|
||||
LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
|
||||
|
||||
TEST_GEN_FILES = nf-queue connect_close audit_logread sctp_collision \
|
||||
conntrack_dump_flush
|
||||
|
||||
include ../lib.mk
|
|
@ -1,9 +0,0 @@
|
|||
CONFIG_NET_NS=y
|
||||
CONFIG_NF_TABLES_INET=y
|
||||
CONFIG_NFT_QUEUE=m
|
||||
CONFIG_NFT_NAT=m
|
||||
CONFIG_NFT_REDIR=m
|
||||
CONFIG_NFT_MASQ=m
|
||||
CONFIG_NFT_FLOW_OFFLOAD=m
|
||||
CONFIG_NF_CT_NETLINK=m
|
||||
CONFIG_AUDIT=y
|
|
@ -1,151 +0,0 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# This test is for stress-testing the nf_tables config plane path vs.
|
||||
# packet path processing: Make sure we never release rules that are
|
||||
# still visible to other cpus.
|
||||
#
|
||||
# set -e
|
||||
|
||||
# Kselftest framework requirement - SKIP code is 4.
|
||||
ksft_skip=4
|
||||
|
||||
testns=testns-$(mktemp -u "XXXXXXXX")
|
||||
tmp=""
|
||||
|
||||
tables="foo bar baz quux"
|
||||
global_ret=0
|
||||
eret=0
|
||||
lret=0
|
||||
|
||||
cleanup() {
|
||||
ip netns pids "$testns" | xargs kill 2>/dev/null
|
||||
ip netns del "$testns"
|
||||
|
||||
rm -f "$tmp"
|
||||
}
|
||||
|
||||
check_result()
|
||||
{
|
||||
local r=$1
|
||||
local OK="PASS"
|
||||
|
||||
if [ $r -ne 0 ] ;then
|
||||
OK="FAIL"
|
||||
global_ret=$r
|
||||
fi
|
||||
|
||||
echo "$OK: nft $2 test returned $r"
|
||||
|
||||
eret=0
|
||||
}
|
||||
|
||||
nft --version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
echo "SKIP: Could not run test without nft tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
ip -Version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
echo "SKIP: Could not run test without ip tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
trap cleanup EXIT
|
||||
tmp=$(mktemp)
|
||||
|
||||
for table in $tables; do
|
||||
echo add table inet "$table" >> "$tmp"
|
||||
echo flush table inet "$table" >> "$tmp"
|
||||
|
||||
echo "add chain inet $table INPUT { type filter hook input priority 0; }" >> "$tmp"
|
||||
echo "add chain inet $table OUTPUT { type filter hook output priority 0; }" >> "$tmp"
|
||||
for c in $(seq 1 400); do
|
||||
chain=$(printf "chain%03u" "$c")
|
||||
echo "add chain inet $table $chain" >> "$tmp"
|
||||
done
|
||||
|
||||
for c in $(seq 1 400); do
|
||||
chain=$(printf "chain%03u" "$c")
|
||||
for BASE in INPUT OUTPUT; do
|
||||
echo "add rule inet $table $BASE counter jump $chain" >> "$tmp"
|
||||
done
|
||||
echo "add rule inet $table $chain counter return" >> "$tmp"
|
||||
done
|
||||
done
|
||||
|
||||
ip netns add "$testns"
|
||||
ip -netns "$testns" link set lo up
|
||||
|
||||
lscpu | grep ^CPU\(s\): | ( read cpu cpunum ;
|
||||
cpunum=$((cpunum-1))
|
||||
for i in $(seq 0 $cpunum);do
|
||||
mask=$(printf 0x%x $((1<<$i)))
|
||||
ip netns exec "$testns" taskset $mask ping -4 127.0.0.1 -fq > /dev/null &
|
||||
ip netns exec "$testns" taskset $mask ping -6 ::1 -fq > /dev/null &
|
||||
done)
|
||||
|
||||
sleep 1
|
||||
|
||||
ip netns exec "$testns" nft -f "$tmp"
|
||||
for i in $(seq 1 10) ; do ip netns exec "$testns" nft -f "$tmp" & done
|
||||
|
||||
for table in $tables;do
|
||||
randsleep=$((RANDOM%2))
|
||||
sleep $randsleep
|
||||
ip netns exec "$testns" nft delete table inet $table
|
||||
lret=$?
|
||||
if [ $lret -ne 0 ]; then
|
||||
eret=$lret
|
||||
fi
|
||||
done
|
||||
|
||||
check_result $eret "add/delete"
|
||||
|
||||
for i in $(seq 1 10) ; do
|
||||
(echo "flush ruleset"; cat "$tmp") | ip netns exec "$testns" nft -f /dev/stdin
|
||||
|
||||
lret=$?
|
||||
if [ $lret -ne 0 ]; then
|
||||
eret=$lret
|
||||
fi
|
||||
done
|
||||
|
||||
check_result $eret "reload"
|
||||
|
||||
for i in $(seq 1 10) ; do
|
||||
(echo "flush ruleset"; cat "$tmp"
|
||||
echo "insert rule inet foo INPUT meta nftrace set 1"
|
||||
echo "insert rule inet foo OUTPUT meta nftrace set 1"
|
||||
) | ip netns exec "$testns" nft -f /dev/stdin
|
||||
lret=$?
|
||||
if [ $lret -ne 0 ]; then
|
||||
eret=$lret
|
||||
fi
|
||||
|
||||
(echo "flush ruleset"; cat "$tmp"
|
||||
) | ip netns exec "$testns" nft -f /dev/stdin
|
||||
|
||||
lret=$?
|
||||
if [ $lret -ne 0 ]; then
|
||||
eret=$lret
|
||||
fi
|
||||
done
|
||||
|
||||
check_result $eret "add/delete with nftrace enabled"
|
||||
|
||||
echo "insert rule inet foo INPUT meta nftrace set 1" >> $tmp
|
||||
echo "insert rule inet foo OUTPUT meta nftrace set 1" >> $tmp
|
||||
|
||||
for i in $(seq 1 10) ; do
|
||||
(echo "flush ruleset"; cat "$tmp") | ip netns exec "$testns" nft -f /dev/stdin
|
||||
|
||||
lret=$?
|
||||
if [ $lret -ne 0 ]; then
|
||||
eret=1
|
||||
fi
|
||||
done
|
||||
|
||||
check_result $lret "add/delete with nftrace enabled"
|
||||
|
||||
exit $global_ret
|
|
@ -1 +0,0 @@
|
|||
timeout=120
|
Loading…
Reference in a new issue