Re: [PATCH v10 nf-next 3/3] selftests: netfilter: Add conntrack_bridge.sh

On Sat, Mar 15, 2025 at 09:00:33PM +0100, Eric Woudstra wrote:

Check conntrack bridge is functional in various vlan setups.

Only conntrack bridge support is tested here, patch 2/3 does not seem to be covered :(

Signed-off-by: Eric Woudstra ericwouds@gmail.com

.../testing/selftests/net/netfilter/Makefile | 1 + .../net/netfilter/conntrack_bridge.sh | 176 ++++++++++++++++++ 2 files changed, 177 insertions(+) create mode 100755 tools/testing/selftests/net/netfilter/conntrack_bridge.sh

diff --git a/tools/testing/selftests/net/netfilter/Makefile b/tools/testing/selftests/net/netfilter/Makefile index ffe161fac8b5..bee403d423f5 100644 --- a/tools/testing/selftests/net/netfilter/Makefile +++ b/tools/testing/selftests/net/netfilter/Makefile @@ -8,6 +8,7 @@ MNL_LDLIBS := $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl) TEST_PROGS := br_netfilter.sh bridge_brouter.sh TEST_PROGS += br_netfilter_queue.sh +TEST_PROGS += conntrack_bridge.sh TEST_PROGS += conntrack_dump_flush.sh TEST_PROGS += conntrack_icmp_related.sh TEST_PROGS += conntrack_ipip_mtu.sh diff --git a/tools/testing/selftests/net/netfilter/conntrack_bridge.sh b/tools/testing/selftests/net/netfilter/conntrack_bridge.sh new file mode 100755 index 000000000000..806551ef8cc2 --- /dev/null +++ b/tools/testing/selftests/net/netfilter/conntrack_bridge.sh @@ -0,0 +1,176 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 +# +# Check conntrack bridge is functional in various vlan setups. +# +# Setup is: +# +# nsclient1 -> nsbr -> nsclient2 +# ping nsclient2 from nsclient1, checking that conntrack established +# packets are seen. +#

+source lib.sh

+if ! nft --version > /dev/null 2>&1;then

• echo "SKIP: Could not run test without nft tool"
• exit $ksft_skip

+fi

+cleanup() {

• cleanup_all_ns

+}

+trap cleanup EXIT

+setup_ns nsclient1 nsclient2 nsbr

+ret=0

+add_addr() +{

• ns=$1
• dev=$2
• i=$3
• ip -net "$ns" link set "$dev" up
• ip -net "$ns" addr add "192.168.1.$i/24" dev "$dev"
• ip -net "$ns" addr add "dead:1::$i/64" dev "$dev" nodad
• ip -net "$ns" route add default dev "$dev"

+}

+del_addr() +{

• ns=$1
• dev=$2
• i=$3
• ip -net "$ns" route del default dev "$dev"
• ip -net "$ns" addr del "dead:1::$i/64" dev "$dev" nodad
• ip -net "$ns" addr del "192.168.1.$i/24" dev "$dev"
• ip -net "$ns" link set "$dev" down

+}

+send_pings() +{

• for ad in "$@"; do

• if ! ip netns exec "$nsclient1" ping -c 1 -s 962 -q "$ad" >/dev/null; then
  

• 	echo "ERROR: netns routing/connectivity broken to $ad" 1>&2
  

• 	exit 1
  

• fi
  

• done

+}

+check_counter() +{

• ns=$1
• name=$2
• expect=$3
• local lret=0
• if ! ip netns exec "$ns" nft list counter bridge filter "$name" | grep -q "$expect"; then

• echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
  

• ip netns exec "$ns" nft list counter bridge filter "$name" 1>&2
  

• lret=1
  

• fi
• ip netns exec "$ns" nft reset counters >/dev/null
• return $lret

+}

+BR=br0 +if ! ip -net "$nsbr" link add $BR type bridge; then

• echo "SKIP: Can't create bridge $BR"
• exit $ksft_skip

+fi

+DEV=veth0 +ip link add "$DEV" netns "$nsclient1" type veth peer name eth1 netns "$nsbr" +ip link add "$DEV" netns "$nsclient2" type veth peer name eth2 netns "$nsbr"

+ip -net "$nsbr" link set eth1 master $BR up +ip -net "$nsbr" link set eth2 master $BR up +ip -net "$nsbr" link set $BR up

+ip netns exec "$nsbr" nft -f - <<EOF +table bridge filter {

• counter established { }
• chain forward {

• type filter hook forward priority 0; policy accept;
  

• ct state "established" counter name "established"
  

• }

+} +EOF

+a=1; +for ns in "$nsclient1" "$nsclient2"; do

• add_addr "$ns" "$DEV" $a
• ((a++))

+done

+send_pings "192.168.1.2" "dead:1::2" +expect="packets 2 bytes 2000" +if ! check_counter "$nsbr" "established" "$expect"; then

• msg+="\nFAIL: without vlan, established packets not seen"
• ret=1

+fi

+a=1; +for ns in "$nsclient1" "$nsclient2"; do

• del_addr "$ns" "$DEV" $a
• ip -net "$ns" link add link "$DEV" name "$DEV.10" type vlan id 10
• ip -net "$ns" link set "$DEV" up
• add_addr "$ns" "$DEV.10" $a
• ((a++))

+done

+send_pings "192.168.1.2" "dead:1::2" +expect="packets 2 bytes 2000" +if ! check_counter "$nsbr" "established" "$expect"; then

• msg+="\nFAIL: with single vlan, established packets not seen"
• ret=1

+fi

+a=1; +for ns in "$nsclient1" "$nsclient2"; do

• del_addr "$ns" "$DEV.10" $a
• ip -net "$ns" link add link "$DEV.10" name "$DEV.10.20" type vlan id 20
• ip -net "$ns" link set "$DEV.10" up
• add_addr "$ns" "$DEV.10.20" $a
• ((a++))

+done

+send_pings "192.168.1.2" "dead:1::2" +expect="packets 2 bytes 2008" +if ! check_counter "$nsbr" "established" "$expect"; then

• msg+="\nFAIL: with double q vlan, established packets not seen"
• ret=1

+fi

+a=1; +for ns in "$nsclient1" "$nsclient2"; do

• del_addr "$ns" "$DEV.10.20" $a
• ip -net "$ns" link del "$DEV.10.20"
• ip -net "$ns" link del "$DEV.10"
• ip -net "$ns" link add link "$DEV" name "$DEV.10" type vlan id 10 protocol 802.1ad
• ip -net "$ns" link add link "$DEV.10" name "$DEV.10.20" type vlan id 20
• ip -net "$ns" link set "$DEV.10" up
• add_addr "$ns" "$DEV.10.20" $a
• ((a++))

+done

+send_pings "192.168.1.2" "dead:1::2" +expect="packets 2 bytes 2008" +if ! check_counter "$nsbr" "established" "$expect"; then

• msg+="\nFAIL: with 802.1ad vlan, established packets not seen "
• ret=1

+fi

+if [ $ret -eq 0 ];then

• echo "PASS: established packets seen in all cases"

+else

• echo -e "$msg"

+fi

+exit $ret

-- 2.47.1