[PATCH net 02/11] selftests: netfilter: extend nfqueue tests to cover vrf device

STALE1793d SUPERSEDED

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2021-11-18 22:26:34
Also in: netfilter-devel
Subsystem: kernel selftest framework, the rest · Maintainers: Shuah Khan, Shuah Khan, Linus Torvalds

Revision v1 of 266 in this series.

Revisions (266)

2012-11-22 v1
2013-02-26 v1
2013-04-12 v1
2013-04-19 v1
2013-06-17 v1
2013-09-17 v1
2013-10-23 v1
2013-11-21 v1
2013-12-07 v1
2013-12-13 v1
2014-01-07 v1
2014-02-19 v1
2014-04-05 v1
2014-04-14 v1
2014-05-09 v1
2014-06-18 v1
2014-08-11 v1
2014-10-20 v1
2014-10-27 v1
2014-11-20 v1
2015-03-22 v1
2015-04-27 v1
2015-05-16 v1
2015-05-22 v1
2015-07-08 v1
2015-08-10 v1
2015-09-03 v1
2015-09-18 v1
2015-10-19 v1
2015-11-04 v1
2015-11-11 v1
2015-12-14 v1
2015-12-22 v1
2016-01-20 v1
2016-02-16 v1
2016-03-28 v1
2016-04-13 v1
2016-05-09 v1
2016-06-01 v1
2016-06-17 v1
2016-08-10 v1
2016-08-10 v1
2016-08-18 v1
2016-08-30 v1
2016-09-13 v1
2016-10-21 v1
2016-11-10 v1
2016-11-30 v1
2017-01-05 v1
2017-01-26 v1
2017-02-23 v1
2017-02-27 v1
2017-03-03 v1
2017-03-15 v1
2017-03-29 v1
2017-04-14 v1
2017-05-29 v1
2017-07-06 v1
2017-07-18 v1
2017-08-24 v1
2017-09-20 v1
2017-11-01 v1
2017-12-13 v1
2018-01-05 v1
2018-02-01 v1
2018-02-07 v1
2018-02-20 v1
2018-03-12 v1
2018-03-24 v1
2018-06-13 v1
2018-06-27 v1
2018-07-09 v1
2018-07-24 v1
2018-09-11 v1
2018-10-02 v1
2018-10-23 v1
2018-11-06 v1
2018-11-28 v1
2018-12-13 v1
2018-12-29 v1
2019-01-14 v1
2019-02-05 v1
2019-02-11 v1
2019-03-11 v1
2019-03-21 v1
2019-05-13 v1
2019-06-17 v1
2019-07-19 v1
2019-07-31 v1
2019-08-14 v1
2019-08-19 v1
2019-08-30 v1
2019-09-04 v1
2019-09-25 v1
2019-10-02 v1
2019-11-06 v1
2019-12-09 v1
2019-12-26 v1
2020-01-08 v1
2020-01-25 v1
2020-01-31 v1
2020-02-18 v1
2020-02-26 v1
2020-03-06 v1
2020-03-20 v1
2020-03-24 v1
2020-04-07 v1
2020-04-21 v1
2020-04-29 v1
2020-05-14 v1
2020-05-25 v1
2020-05-27 v1
2020-06-14 v1
2020-06-25 v1
2020-07-04 v1
2020-08-04 v1
2020-08-15 v1
2020-08-24 v1
2020-08-31 v1
2020-09-08 v1
2020-10-07 v1
2020-10-13 v1
2020-10-22 v1
2020-10-31 v1
2020-11-21 v1
2020-11-27 v1
2020-12-09 v1
2020-12-18 v1
2021-01-03 v1
2021-01-12 v1
2021-01-27 v1
2021-02-05 v1
2021-02-09 v1
2021-03-06 v1
2021-03-19 v1
2021-04-12 v1
2021-05-07 v1
2021-05-14 v1
2021-06-02 v1
2021-06-10 v1
2021-06-22 v1
2021-07-07 v1
2021-07-23 v1
2021-08-06 v1
2021-08-06 v2 [diff vs current]
2021-09-03 v1
2021-09-29 v1
2021-11-18 v1 current
2021-12-09 v1
2021-12-17 v1
2022-01-06 v1
2022-01-20 v1
2022-01-27 v1
2022-02-04 v1
2022-02-10 v1
2022-02-21 v1
2022-02-22 v2 [diff vs current]
2022-03-01 v1
2022-03-12 v1
2022-03-17 v1
2022-03-28 v1
2022-04-05 v1
2022-04-12 v1
2022-04-25 v1
2022-04-28 v1
2022-05-18 v1
2022-05-26 v1
2022-05-27 v1
2022-05-31 v1
2022-06-06 v1
2022-06-21 v1
2022-06-29 v1
2022-07-02 v1
2022-07-11 v1
2022-08-09 v1
2022-08-24 v1
2022-10-19 v1
2022-11-09 v1
2022-11-18 v1
2022-11-22 v1
2022-11-30 v1
2023-01-02 v1
2023-01-11 v1
2023-01-13 v1
2023-01-23 v1
2023-01-24 v1
2023-01-31 v1
2023-03-01 v1
2023-03-07 v1
2023-03-09 v1
2023-04-18 v1
2023-04-20 v1
2023-04-21 v1
2023-05-03 v1
2023-06-06 v1
2023-06-08 v1
2023-06-27 v1
2023-07-05 v1
2023-08-10 v1
2023-08-30 v1
2023-09-13 v1
2023-10-25 v1
2023-11-08 v1
2023-11-15 v1
2023-12-06 v1
2023-12-20 v1
2023-12-22 v1
2024-01-03 v1
2024-01-17 v1
2024-01-18 v2 [diff vs current]
2024-01-24 v1
2024-01-31 v1
2024-02-07 v1
2024-02-08 v2 [diff vs current]
2024-02-14 v1
2024-02-22 v1
2024-02-29 v1
2024-03-07 v1
2024-03-21 v1
2024-03-21 v2 [diff vs current]
2024-03-28 v1
2024-04-04 v1
2024-04-11 v1
2024-04-18 v1
2024-05-22 v1
2024-05-23 v2 [diff vs current]
2024-05-28 v3 [diff vs current]
2024-06-11 v1
2024-06-19 v1
2024-06-26 v1
2024-07-11 v1
2024-07-31 v1
2024-08-14 v1
2024-08-22 v1
2024-08-22 v2 [diff vs current]
2024-08-28 v1
2024-09-11 v1
2024-09-24 v1
2024-09-26 v2 [diff vs current]
2024-10-02 v1
2024-10-09 v1
2024-10-31 v1
2024-11-14 v1
2024-11-28 v1
2024-11-28 v2 [diff vs current]
2024-12-05 v1
2024-12-11 v1
2025-03-06 v1
2025-04-03 v1
2025-04-10 v1
2025-06-05 v1
2025-07-17 v1
2025-08-07 v1
2026-03-25 v2 [diff vs current]
2026-04-01 v1
2026-04-28 v2 [diff vs current]
2026-05-01 v1
2026-05-07 v1
2026-06-10 v1
2026-06-19 v1
2026-06-20 v2 [diff vs current]
2026-06-23 v1
2026-08-21 v1
2026-08-27 v2 [diff vs current]
2026-09-11 v2 [diff vs current]
2026-09-13 v2 [diff vs current]

From: Florian Westphal <fw@strlen.de>

VRF device calls the output/postrouting hooks so packet should be seeon
with oifname tvrf and once with eth0.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 .../testing/selftests/netfilter/nft_queue.sh  | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/tools/testing/selftests/netfilter/nft_queue.sh b/tools/testing/selftests/netfilter/nft_queue.sh
index 3d202b90b33d..7d27f1f3bc01 100755
--- a/tools/testing/selftests/netfilter/nft_queue.sh
+++ b/tools/testing/selftests/netfilter/nft_queue.sh

@@ -16,6 +16,10 @@ timeout=4
 
 cleanup()
 {
+	ip netns pids ${ns1} | xargs kill 2>/dev/null
+	ip netns pids ${ns2} | xargs kill 2>/dev/null
+	ip netns pids ${nsrouter} | xargs kill 2>/dev/null
+
 	ip netns del ${ns1}
 	ip netns del ${ns2}
 	ip netns del ${nsrouter}

@@ -332,6 +336,55 @@ EOF
 	echo "PASS: tcp via loopback and re-queueing"
 }
 
+test_icmp_vrf() {
+	ip -net $ns1 link add tvrf type vrf table 9876
+	if [ $? -ne 0 ];then
+		echo "SKIP: Could not add vrf device"
+		return
+	fi
+
+	ip -net $ns1 li set eth0 master tvrf
+	ip -net $ns1 li set tvrf up
+
+	ip -net $ns1 route add 10.0.2.0/24 via 10.0.1.1 dev eth0 table 9876
+ip netns exec ${ns1} nft -f /dev/stdin <<EOF
+flush ruleset
+table inet filter {
+	chain output {
+		type filter hook output priority 0; policy accept;
+		meta oifname "tvrf" icmp type echo-request counter queue num 1
+		meta oifname "eth0" icmp type echo-request counter queue num 1
+	}
+	chain post {
+		type filter hook postrouting priority 0; policy accept;
+		meta oifname "tvrf" icmp type echo-request counter queue num 1
+		meta oifname "eth0" icmp type echo-request counter queue num 1
+	}
+}
+EOF
+	ip netns exec ${ns1} ./nf-queue -q 1 -t $timeout &
+	local nfqpid=$!
+
+	sleep 1
+	ip netns exec ${ns1} ip vrf exec tvrf ping -c 1 10.0.2.99 > /dev/null
+
+	for n in output post; do
+		for d in tvrf eth0; do
+			ip netns exec ${ns1} nft list chain inet filter $n | grep -q "oifname \"$d\" icmp type echo-request counter packets 1"
+			if [ $? -ne 0 ] ; then
+				echo "FAIL: chain $n: icmp packet counter mismatch for device $d" 1>&2
+				ip netns exec ${ns1} nft list ruleset
+				ret=1
+				return
+			fi
+		done
+	done
+
+	wait $nfqpid
+	[ $? -eq 0 ] && echo "PASS: icmp+nfqueue via vrf"
+	wait 2>/dev/null
+}
+
 ip netns exec ${nsrouter} sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
 ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
 ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null

@@ -372,5 +425,6 @@ test_queue 20
 test_tcp_forward
 test_tcp_localhost
 test_tcp_localhost_requeue
+test_icmp_vrf
 
 exit $ret

-- 
2.30.2

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help