[Devel] [PATCH vz10 2/4] selftests/bpf: run the network tests in their own netns

[Eva Kurchatova <eva.kurchatova@virtuozzo.com>]

Three tests use the initial namespace and fail on what the machine has
in it rather than on the kernel under test.

test_sock binds 127.0.0.1:5000, which a web server on the machine holds,
and test_xdp_features binds an IPv6 control socket that the machine's
firewall refuses:

  Failed connecting to the Device Under Test control socket

test_xdp_features also always names its device v1 and traps cleanup for
signals only, not for a normal exit, so a failed run leaves the device
and the namespace behind and every later run stops in setup with nothing
printed at all.  Five namespaces were left over after one suite run here.

test_tunnel has the same problem and two more of its own: it needs the
fou module, which nothing loads, and it asks for encapsulations this
kernel may not have.  Load the module, and let check() probe the kernel
so the callers skip an encapsulation that is missing instead of failing.

Run all three in a namespace of their own: no rule and no service of the
machine applies, and whatever they leave behind goes away with it.

https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/bpf/test_sock.c       | 17 +++++++
 tools/testing/selftests/bpf/test_tunnel.sh    | 50 +++++++++++++++----
 .../selftests/bpf/test_xdp_features.sh        | 13 +++++
 3 files changed, 69 insertions(+), 11 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index 810c3740b2cc..0298ff2e5cf7 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -1,7 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2018 Facebook
 
+#define _GNU_SOURCE
+#include <sched.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <unistd.h>
 
 #include <arpa/inet.h>
@@ -536,6 +539,20 @@ int main(int argc, char **argv)
 	int cgfd = -1;
 	int err = 0;
 
+	/* The tests bind fixed ports on the loopback address, and one of
+	 * them retries on 5000, which a service on the machine may well be
+	 * listening on.  Take a network namespace of our own so that only
+	 * the sockets of this test are in it.
+	 */
+	if (unshare(CLONE_NEWNET)) {
+		log_err("unshare(CLONE_NEWNET)");
+		return -1;
+	}
+	if (system("ip link set lo up")) {
+		log_err("bringing loopback up");
+		return -1;
+	}
+
 	cgfd = cgroup_setup_and_join(CG_PATH);
 	if (cgfd < 0)
 		goto err;
diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
index d9661b9988ba..172aac4dae4f 100755
--- a/tools/testing/selftests/bpf/test_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tunnel.sh
@@ -45,6 +45,22 @@
 # 5) Tunnel protocol handler, ex: vxlan_rcv, decap the packet
 # 6) Forward the packet to the overlay tnl dev
 
+# The tunnels are built between this namespace and at_ns0, so a firewall
+# on the machine filters the encapsulated traffic: our nodes reject IPv6
+# with admin-prohibited, which the ip6geneve case never survives.  A
+# namespace of our own has no such rules, and takes the devices with it
+# when the test ends.
+if [ -z "${BPF_TUNNEL_NETNS:-}" ]; then
+	BPF_TUNNEL_NETNS=1 export BPF_TUNNEL_NETNS
+	exec unshare -n sh -c 'ip link set lo up; exec "$0" "$@"' "$0" "$@"
+fi
+
+# The BPF object refers to the FOU kfuncs, and libbpf has to resolve them
+# against kernel or module BTF before it can load the object at all, also
+# for the tunnel types that do not use FOU.  Nothing to do where FOU is
+# built in.
+modprobe fou 2>/dev/null
+
 BPF_FILE="test_tunnel_kern.bpf.o"
 BPF_PIN_TUNNEL_DIR="/sys/fs/bpf/tc/tunnel"
 PING_ARG="-c 3 -w 10 -q"
@@ -241,7 +257,7 @@ test_gre()
 	DEV=gretap11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_gre_tunnel 2
 	attach_bpf $DEV gre_set_tunnel gre_get_tunnel
@@ -265,7 +281,7 @@ test_gre_no_tunnel_key()
 	DEV=gre11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_gre_tunnel
 	attach_bpf $DEV gre_set_tunnel_no_key gre_get_tunnel
@@ -289,7 +305,7 @@ test_ip6gre()
 	DEV=ip6gre11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	# reuse the ip6gretap function
 	add_ip6gretap_tunnel
@@ -319,7 +335,7 @@ test_ip6gretap()
 	DEV=ip6gretap11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6gretap_tunnel
 	attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel
@@ -348,7 +364,7 @@ test_erspan()
 	DEV=erspan11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_erspan_tunnel $1
 	attach_bpf $DEV erspan_set_tunnel erspan_get_tunnel
@@ -372,7 +388,7 @@ test_ip6erspan()
 	DEV=ip6erspan11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6erspan_tunnel $1
 	attach_bpf $DEV ip4ip6erspan_set_tunnel ip4ip6erspan_get_tunnel
@@ -395,7 +411,7 @@ test_geneve()
 	DEV=geneve11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_geneve_tunnel
 	attach_bpf $DEV geneve_set_tunnel geneve_get_tunnel
@@ -419,7 +435,7 @@ test_ip6geneve()
 	DEV=ip6geneve11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6geneve_tunnel
 	attach_bpf $DEV ip6geneve_set_tunnel ip6geneve_get_tunnel
@@ -443,7 +459,7 @@ test_ipip()
 	DEV=ipip11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ipip_tunnel
 	ip link set dev veth1 mtu 1500
@@ -468,7 +484,7 @@ test_ipip6()
 	DEV=ipip6tnl11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6tnl_tunnel
 	ip link set dev veth1 mtu 1500
@@ -496,7 +512,7 @@ test_ip6ip6()
 	DEV=ip6ip6tnl11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6tnl_tunnel
 	ip link set dev veth1 mtu 1500
@@ -563,6 +579,18 @@ check()
 	cleanup
 	return 1
 	fi
+
+	# The kernel can be built without a tunnel type, and then rtnetlink
+	# has no ops for it and says so.
+	if ip link add dev "probe_$1" type "$1" 2>&1 | \
+	   grep -q "Unknown device type"; then
+		echo "SKIP $1: kernel does not support $1"
+		cleanup
+		return 1
+	fi
+	ip link del dev "probe_$1" 2>/dev/null
+
+	return 0
 }
 
 enable_debug()
diff --git a/tools/testing/selftests/bpf/test_xdp_features.sh b/tools/testing/selftests/bpf/test_xdp_features.sh
index 0aa71c4455c0..1f6be4af6718 100755
--- a/tools/testing/selftests/bpf/test_xdp_features.sh
+++ b/tools/testing/selftests/bpf/test_xdp_features.sh
@@ -1,6 +1,19 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+# The device under test listens on the veth address of the namespace this
+# script runs in and the tester connects to it, so a firewall on the
+# machine can refuse the control connection:
+#   Failed connecting to the Device Under Test control socket
+# That side of the pair is also always called v1, and cleanup only runs
+# on a signal, so a failed run leaves the device behind and every later
+# run stops in setup.  A namespace of our own has no such rules, and
+# takes the leftovers with it when the test ends.
+if [ -z "${XDP_FEATURES_NETNS:-}" ]; then
+	XDP_FEATURES_NETNS=1 export XDP_FEATURES_NETNS
+	exec unshare -n sh -c 'ip link set lo up; exec "$0" "$@"' "$0" "$@"
+fi
+
 readonly NS="ns1-$(mktemp -u XXXXXX)"
 readonly V0_IP4=10.10.0.11
 readonly V1_IP4=10.10.0.1
-- 
2.55.0