mirror of
https://github.com/torvalds/linux.git
synced 2026-05-31 18:43:33 +02:00
selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic
Introduce the capability to send TCP traffic over IPv6 to nft_flowtable netfilter selftest. Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Lorenzo Bianconi
Pablo Neira Ayuso
parent
c4cbe4a4df
commit
c0bd21682a
|
|
@ -127,6 +127,8 @@ ip -net "$nsr1" addr add fee1:2::1/64 dev veth1 nodad
|
|||
ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0
|
||||
ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad
|
||||
|
||||
ip netns exec "$nsr1" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
|
||||
ip netns exec "$nsr2" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
|
||||
for i in 0 1; do
|
||||
ip netns exec "$nsr1" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
|
||||
ip netns exec "$nsr2" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
|
||||
|
|
@ -153,7 +155,9 @@ ip -net "$ns1" route add default via dead:1::1
|
|||
ip -net "$ns2" route add default via dead:2::1
|
||||
|
||||
ip -net "$nsr1" route add default via 192.168.10.2
|
||||
ip -6 -net "$nsr1" route add default via fee1:2::2
|
||||
ip -net "$nsr2" route add default via 192.168.10.1
|
||||
ip -6 -net "$nsr2" route add default via fee1:2::1
|
||||
|
||||
ip netns exec "$nsr1" nft -f - <<EOF
|
||||
table inet filter {
|
||||
|
|
@ -352,8 +356,9 @@ test_tcp_forwarding_ip()
|
|||
local nsa=$1
|
||||
local nsb=$2
|
||||
local pmtu=$3
|
||||
local dstip=$4
|
||||
local dstport=$5
|
||||
local proto=$4
|
||||
local dstip=$5
|
||||
local dstport=$6
|
||||
local lret=0
|
||||
local socatc
|
||||
local socatl
|
||||
|
|
@ -363,12 +368,14 @@ test_tcp_forwarding_ip()
|
|||
infile="$nsin_small"
|
||||
fi
|
||||
|
||||
timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
|
||||
timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -${proto} \
|
||||
TCP"${proto}"-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
|
||||
lpid=$!
|
||||
|
||||
busywait 1000 listener_ready
|
||||
|
||||
timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
|
||||
timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -${proto} \
|
||||
TCP"${proto}":"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
|
||||
socatc=$?
|
||||
|
||||
wait $lpid
|
||||
|
|
@ -394,8 +401,11 @@ test_tcp_forwarding_ip()
|
|||
test_tcp_forwarding()
|
||||
{
|
||||
local pmtu="$3"
|
||||
local proto="$4"
|
||||
local dstip="$5"
|
||||
local dstport="$6"
|
||||
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.0.2.99 12345
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
|
||||
|
||||
return $?
|
||||
}
|
||||
|
|
@ -403,6 +413,9 @@ test_tcp_forwarding()
|
|||
test_tcp_forwarding_set_dscp()
|
||||
{
|
||||
local pmtu="$3"
|
||||
local proto="$4"
|
||||
local dstip="$5"
|
||||
local dstport="$6"
|
||||
|
||||
ip netns exec "$nsr1" nft -f - <<EOF
|
||||
table netdev dscpmangle {
|
||||
|
|
@ -413,7 +426,7 @@ table netdev dscpmangle {
|
|||
}
|
||||
EOF
|
||||
if [ $? -eq 0 ]; then
|
||||
test_tcp_forwarding_ip "$1" "$2" "$3" 10.0.2.99 12345
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
|
||||
check_dscp "dscp_ingress" "$pmtu"
|
||||
|
||||
ip netns exec "$nsr1" nft delete table netdev dscpmangle
|
||||
|
|
@ -430,7 +443,7 @@ table netdev dscpmangle {
|
|||
}
|
||||
EOF
|
||||
if [ $? -eq 0 ]; then
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.0.2.99 12345
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
|
||||
check_dscp "dscp_egress" "$pmtu"
|
||||
|
||||
ip netns exec "$nsr1" nft delete table netdev dscpmangle
|
||||
|
|
@ -441,7 +454,7 @@ fi
|
|||
# partial. If flowtable really works, then both dscp-is-0 and dscp-is-cs3
|
||||
# counters should have seen packets (before and after ft offload kicks in).
|
||||
ip netns exec "$nsr1" nft -a insert rule inet filter forward ip dscp set cs3
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.0.2.99 12345
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
|
||||
check_dscp "dscp_fwd" "$pmtu"
|
||||
}
|
||||
|
||||
|
|
@ -455,7 +468,7 @@ test_tcp_forwarding_nat()
|
|||
|
||||
[ "$pmtu" -eq 0 ] && what="$what (pmtu disabled)"
|
||||
|
||||
test_tcp_forwarding_ip "$nsa" "$nsb" "$pmtu" 10.0.2.99 12345
|
||||
test_tcp_forwarding_ip "$nsa" "$nsb" "$pmtu" 4 10.0.2.99 12345
|
||||
lret=$?
|
||||
|
||||
if [ "$lret" -eq 0 ] ; then
|
||||
|
|
@ -465,7 +478,7 @@ test_tcp_forwarding_nat()
|
|||
echo "PASS: flow offload for ns1/ns2 with masquerade $what"
|
||||
fi
|
||||
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.6.6.6 1666
|
||||
test_tcp_forwarding_ip "$1" "$2" "$pmtu" 4 10.6.6.6 1666
|
||||
lret=$?
|
||||
if [ "$pmtu" -eq 1 ] ;then
|
||||
check_counters "flow offload for ns1/ns2 with dnat $what"
|
||||
|
|
@ -487,7 +500,7 @@ make_file "$nsin_small" "$filesize_small"
|
|||
# Due to MTU mismatch in both directions, all packets (except small packets like pure
|
||||
# acks) have to be handled by normal forwarding path. Therefore, packet counters
|
||||
# are not checked.
|
||||
if test_tcp_forwarding "$ns1" "$ns2" 0; then
|
||||
if test_tcp_forwarding "$ns1" "$ns2" 0 4 10.0.2.99 12345; then
|
||||
echo "PASS: flow offloaded for ns1/ns2"
|
||||
else
|
||||
echo "FAIL: flow offload for ns1/ns2:" 1>&2
|
||||
|
|
@ -495,6 +508,14 @@ else
|
|||
ret=1
|
||||
fi
|
||||
|
||||
if test_tcp_forwarding "$ns1" "$ns2" 0 6 "[dead:2::99]" 12345; then
|
||||
echo "PASS: IPv6 flow offloaded for ns1/ns2"
|
||||
else
|
||||
echo "FAIL: IPv6 flow offload for ns1/ns2:" 1>&2
|
||||
ip netns exec "$nsr1" nft list ruleset
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# delete default route, i.e. ns2 won't be able to reach ns1 and
|
||||
# will depend on ns1 being masqueraded in nsr1.
|
||||
# expect ns1 has nsr1 address.
|
||||
|
|
@ -520,7 +541,7 @@ table ip nat {
|
|||
EOF
|
||||
|
||||
check_dscp "dscp_none" "0"
|
||||
if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 0 ""; then
|
||||
if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 0 4 10.0.2.99 12345; then
|
||||
echo "FAIL: flow offload for ns1/ns2 with dscp update and no pmtu discovery" 1>&2
|
||||
exit 0
|
||||
fi
|
||||
|
|
@ -546,7 +567,7 @@ ip netns exec "$ns2" sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
|
|||
ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
|
||||
ip netns exec "$ns2" nft reset counters table inet filter >/dev/null
|
||||
|
||||
if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 1 ""; then
|
||||
if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
|
||||
echo "FAIL: flow offload for ns1/ns2 with dscp update and pmtu discovery" 1>&2
|
||||
exit 0
|
||||
fi
|
||||
|
|
@ -752,7 +773,7 @@ ip -net "$ns2" route del 192.168.10.1 via 10.0.2.1
|
|||
ip -net "$ns2" route add default via 10.0.2.1
|
||||
ip -net "$ns2" route add default via dead:2::1
|
||||
|
||||
if test_tcp_forwarding "$ns1" "$ns2" 1; then
|
||||
if test_tcp_forwarding "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
|
||||
check_counters "ipsec tunnel mode for ns1/ns2"
|
||||
else
|
||||
echo "FAIL: ipsec tunnel mode for ns1/ns2"
|
||||
|
|
@ -760,6 +781,14 @@ else
|
|||
ip netns exec "$nsr1" cat /proc/net/xfrm_stat 1>&2
|
||||
fi
|
||||
|
||||
if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then
|
||||
check_counters "IPv6 ipsec tunnel mode for ns1/ns2"
|
||||
else
|
||||
echo "FAIL: IPv6 ipsec tunnel mode for ns1/ns2"
|
||||
ip netns exec "$nsr1" nft list ruleset 1>&2
|
||||
ip netns exec "$nsr1" cat /proc/net/xfrm_stat 1>&2
|
||||
fi
|
||||
|
||||
if [ "$1" = "" ]; then
|
||||
low=1280
|
||||
mtu=$((65536 - low))
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user