2025-11-21, 01:20:39 +0100, Antonio Quartulli wrote:
diff --git a/tools/testing/selftests/net/ovpn/ovpn-cli.c b/tools/testing/selftests/net/ovpn/ovpn-cli.c index baabb4c9120e..4df596d29b8c 100644 --- a/tools/testing/selftests/net/ovpn/ovpn-cli.c +++ b/tools/testing/selftests/net/ovpn/ovpn-cli.c @@ -1693,12 +1705,13 @@ static void usage(const char *cmd) fprintf(stderr, "\tvpnaddr: peer VPN IP\n"); fprintf(stderr,
"* new_multi_peer <iface> <lport> <peers_file>: add multiple peers as listed in the file\n");
"* new_multi_peer <iface> <lport> <peers_file> [mark]: add multiple peers as listed in the file\n");
- fprintf(stderr, "\t\t<peer_id> <tx_id> <raddr> <rport> <laddr> <lport> <vpnaddr>\n");
- fprintf(stderr, "\t\t<peer_id> <tx_id> <raddr> <rport> <laddr> <lport> <vpnaddr> [mark]\n");
This line should be dropped, this patch doesn't have the corresponding change to parse mark while we're looping over the lines of peers_file.
diff --git a/tools/testing/selftests/net/ovpn/test-mark.sh b/tools/testing/selftests/net/ovpn/test-mark.sh new file mode 100755 index 000000000000..a4bfe938118d --- /dev/null +++ b/tools/testing/selftests/net/ovpn/test-mark.sh
[...]
+for p in $(seq 1 3); do
- ip netns exec peer0 ${OVPN_CLI} set_peer tun0 ${p} 60 120
- ip netns exec peer${p} ${OVPN_CLI} set_peer tun${p} $((${p} + 9)) 60 120
+done
+sleep 1
+for p in $(seq 1 3); do
- ip netns exec peer0 ping -qfc 500 -s 3000 -w 3 5.5.5.$((${p} + 1))
Any reason this ping (and the final one) uses -s 3000 while the one we expect to fail doesn't?
+done
+echo "Adding an nftables drop rule based on mark value ${MARK}" +ip netns exec peer0 nft flush ruleset +ip netns exec peer0 nft 'add table inet filter' +ip netns exec peer0 nft 'add chain inet filter output { type filter hook output priority 0; policy accept; }' +ip netns exec peer0 nft add rule inet filter output meta mark == ${MARK} counter drop
+DROP_COUNTER=$(ip netns exec peer0 nft list chain inet filter output | sed -n 's/.*packets ([0-9]*).*/\1/p') +sleep 1
+# ping should fail +for p in $(seq 1 3); do
- PING_OUTPUT=$(ip netns exec peer0 ping -qfc 500 -w 1 5.5.5.$((p+1)) 2>&1) && exit 1
nit: inconsistent syntax for p+1 compared to the other pings ($((p+1)) vs $((${p} + 1)))
- echo "${PING_OUTPUT}"
- LOST_PACKETS=$(echo "$PING_OUTPUT" | grep 'packets transmitted' | awk '{ print $1 }')
- # increment the drop counter by the amount of lost packets
- DROP_COUNTER=$(($DROP_COUNTER+$LOST_PACKETS))
+done
+# check if the final nft counter matches our counter +TOTAL_COUNT=$(ip netns exec peer0 nft list chain inet filter output | sed -n 's/.*packets ([0-9]*).*/\1/p') +[ ${DROP_COUNTER} -eq ${TOTAL_COUNT} ] || exit 1
Maybe add something like echo "Expected ${TOTAL_COUNT} drops, got ${DROP_COUNTER}" if we're failing at this stage?
+echo "Removing the drop rule" +ip netns exec peer0 nft flush ruleset +sleep 1
+for p in $(seq 1 3); do
- ip netns exec peer0 ping -qfc 500 -s 3000 -w 3 5.5.5.$((${p} + 1))
+done
+cleanup
+modprobe -r ovpn || true