selftests: netfilter: conntrack_tcp_unreplied.sh: move to lib.sh infra
Replace nc with socat. Too many different implementations of nc
are around with incompatible options ("nc: cannot use -p and -l").
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240411233624.8129-6-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Florian Westphal
Jakub Kicinski
parent
96f6c27371
commit
6f864d391b
@ -4,37 +4,29 @@
|
||||
# Check that UNREPLIED tcp conntrack will eventually timeout.
|
||||
#
|
||||
|
||||
# Kselftest framework requirement - SKIP code is 4.
|
||||
ksft_skip=4
|
||||
ret=0
|
||||
source lib.sh
|
||||
|
||||
waittime=20
|
||||
sfx=$(mktemp -u "XXXXXXXX")
|
||||
ns1="ns1-$sfx"
|
||||
ns2="ns2-$sfx"
|
||||
|
||||
nft --version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
if ! nft --version > /dev/null 2>&1;then
|
||||
echo "SKIP: Could not run test without nft tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
ip -Version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
echo "SKIP: Could not run test without ip tool"
|
||||
if ! conntrack --version > /dev/null 2>&1;then
|
||||
echo "SKIP: Could not run test without conntrack tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
cleanup() {
|
||||
ip netns pids $ns1 | xargs kill 2>/dev/null
|
||||
ip netns pids $ns2 | xargs kill 2>/dev/null
|
||||
ret=0
|
||||
|
||||
ip netns del $ns1
|
||||
ip netns del $ns2
|
||||
cleanup() {
|
||||
ip netns pids "$ns1" | xargs kill 2>/dev/null
|
||||
ip netns pids "$ns2" | xargs kill 2>/dev/null
|
||||
|
||||
cleanup_all_ns
|
||||
}
|
||||
|
||||
ipv4() {
|
||||
echo -n 192.168.$1.2
|
||||
echo -n 192.168."$1".2
|
||||
}
|
||||
|
||||
check_counter()
|
||||
@ -44,51 +36,53 @@ check_counter()
|
||||
expect=$3
|
||||
local lret=0
|
||||
|
||||
cnt=$(ip netns exec $ns2 nft list counter inet filter "$name" | grep -q "$expect")
|
||||
if [ $? -ne 0 ]; then
|
||||
if ! ip netns exec "$ns2" nft list counter inet filter "$name" | grep -q "$expect"; then
|
||||
echo "ERROR: counter $name in $ns2 has unexpected value (expected $expect)" 1>&2
|
||||
ip netns exec $ns2 nft list counter inet filter "$name" 1>&2
|
||||
ip netns exec "$ns2" nft list counter inet filter "$name" 1>&2
|
||||
lret=1
|
||||
fi
|
||||
|
||||
return $lret
|
||||
}
|
||||
|
||||
# Create test namespaces
|
||||
ip netns add $ns1 || exit 1
|
||||
|
||||
trap cleanup EXIT
|
||||
|
||||
ip netns add $ns2 || exit 1
|
||||
# Create test namespaces
|
||||
setup_ns ns1 ns2
|
||||
|
||||
# Connect the namespace to the host using a veth pair
|
||||
ip -net $ns1 link add name veth1 type veth peer name veth2
|
||||
ip -net $ns1 link set netns $ns2 dev veth2
|
||||
ip -net "$ns1" link add name veth1 type veth peer name veth2
|
||||
ip -net "$ns1" link set netns "$ns2" dev veth2
|
||||
|
||||
ip -net $ns1 link set up dev lo
|
||||
ip -net $ns2 link set up dev lo
|
||||
ip -net $ns1 link set up dev veth1
|
||||
ip -net $ns2 link set up dev veth2
|
||||
ip -net "$ns1" link set up dev lo
|
||||
ip -net "$ns2" link set up dev lo
|
||||
ip -net "$ns1" link set up dev veth1
|
||||
ip -net "$ns2" link set up dev veth2
|
||||
|
||||
ip -net $ns2 addr add 10.11.11.2/24 dev veth2
|
||||
ip -net $ns2 route add default via 10.11.11.1
|
||||
ip -net "$ns2" addr add 10.11.11.2/24 dev veth2
|
||||
ip -net "$ns2" route add default via 10.11.11.1
|
||||
|
||||
ip netns exec $ns2 sysctl -q net.ipv4.conf.veth2.forwarding=1
|
||||
ip netns exec "$ns2" sysctl -q net.ipv4.conf.veth2.forwarding=1
|
||||
|
||||
# add a rule inside NS so we enable conntrack
|
||||
ip netns exec $ns1 iptables -A INPUT -m state --state established,related -j ACCEPT
|
||||
ip netns exec "$ns1" nft -f - <<EOF
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy accept;
|
||||
ct state established accept
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
ip -net $ns1 addr add 10.11.11.1/24 dev veth1
|
||||
ip -net $ns1 route add 10.99.99.99 via 10.11.11.2
|
||||
ip -net "$ns1" addr add 10.11.11.1/24 dev veth1
|
||||
ip -net "$ns1" route add 10.99.99.99 via 10.11.11.2
|
||||
|
||||
# Check connectivity works
|
||||
ip netns exec $ns1 ping -q -c 2 10.11.11.2 >/dev/null || exit 1
|
||||
ip netns exec "$ns1" ping -q -c 2 10.11.11.2 >/dev/null || exit 1
|
||||
|
||||
ip netns exec $ns2 nc -l -p 8080 < /dev/null &
|
||||
ip netns exec "$ns2" socat -u -4 TCP-LISTEN:8080,reuseaddr STDOUT &
|
||||
|
||||
# however, conntrack entries are there
|
||||
|
||||
ip netns exec $ns2 nft -f - <<EOF
|
||||
ip netns exec "$ns2" nft -f - <<EOF
|
||||
table inet filter {
|
||||
counter connreq { }
|
||||
counter redir { }
|
||||
@ -104,17 +98,15 @@ if [ $? -ne 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ip netns exec $ns2 sysctl -q net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10
|
||||
ip netns exec "$ns2" sysctl -q net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10
|
||||
|
||||
echo "INFO: connect $ns1 -> $ns2 to the virtual ip"
|
||||
ip netns exec $ns1 bash -c 'while true ; do
|
||||
nc -p 60000 10.99.99.99 80
|
||||
sleep 1
|
||||
ip netns exec "$ns1" bash -c 'for i in $(seq 1 $BUSYWAIT_TIMEOUT) ; do
|
||||
socat -u STDIN TCP:10.99.99.99:80 < /dev/null
|
||||
sleep 0.1
|
||||
done' &
|
||||
|
||||
sleep 1
|
||||
|
||||
ip netns exec $ns2 nft -f - <<EOF
|
||||
ip netns exec "$ns2" nft -f - <<EOF
|
||||
table inet nat {
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority 0; policy accept;
|
||||
@ -127,34 +119,28 @@ if [ $? -ne 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
count=$(ip netns exec $ns2 conntrack -L -p tcp --dport 80 2>/dev/null | wc -l)
|
||||
if [ $count -eq 0 ]; then
|
||||
count=$(ip netns exec "$ns2" conntrack -L -p tcp --dport 80 2>/dev/null | wc -l)
|
||||
if [ "$count" -eq 0 ]; then
|
||||
echo "ERROR: $ns2 did not pick up tcp connection from peer"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "INFO: NAT redirect added in ns $ns2, waiting for $waittime seconds for nat to take effect"
|
||||
for i in $(seq 1 $waittime); do
|
||||
echo -n "."
|
||||
|
||||
sleep 1
|
||||
|
||||
count=$(ip netns exec $ns2 conntrack -L -p tcp --reply-port-src 8080 2>/dev/null | wc -l)
|
||||
if [ $count -gt 0 ]; then
|
||||
echo
|
||||
echo "PASS: redirection took effect after $i seconds"
|
||||
break
|
||||
wait_for_redirect()
|
||||
{
|
||||
count=$(ip netns exec "$ns2" conntrack -L -p tcp --reply-port-src 8080 2>/dev/null | wc -l)
|
||||
if [ "$count" -gt 0 ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
m=$((i%20))
|
||||
if [ $m -eq 0 ]; then
|
||||
echo " waited for $i seconds"
|
||||
fi
|
||||
done
|
||||
return 1
|
||||
}
|
||||
echo "INFO: NAT redirect added in ns $ns2, waiting for $BUSYWAIT_TIMEOUT ms for nat to take effect"
|
||||
|
||||
busywait $BUSYWAIT_TIMEOUT wait_for_redirect
|
||||
ret=$?
|
||||
|
||||
expect="packets 1 bytes 60"
|
||||
check_counter "$ns2" "redir" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
if ! check_counter "$ns2" "redir" "$expect"; then
|
||||
ret=1
|
||||
fi
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user