From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eva Kurchatova Date: Fri, 21 Aug 2026 18:18:45 +0300 Subject: [Devel] [PATCH vz10 2/4] selftests: netfilter: add the veth pair from inside the namespace In-Reply-To: <20260821151850.796438-1-eva.kurchatova@virtuozzo.com> References: <20260821151850.796438-1-eva.kurchatova@virtuozzo.com> Message-ID: <20260821151850.796438-2-eva.kurchatova@virtuozzo.com> List-Id: Both tests add a veth by name while running in the initial namespace. The name of the new device is taken there, not in the namespace passed to netns, so a device of that name left behind by another test makes the add fail and the test then runs with no connectivity at all: # RTNETLINK answers: File exists # Cannot find device "veth1" # FAIL: socat cannot connect via NAT'd address Add the pair from inside one of the namespaces instead. Those are made by setup_ns and are empty, and the peer is created directly in its own namespace, so no name from the initial namespace is in the way. br_netfilter.sh checked only the first of its four adds, so a failure of any of the others was silent and turned up 90 lines later as a ping to a namespace that had no interface. Check all four. https://virtuozzo.atlassian.net/browse/VSTOR-139651 Feature: fix selftests Signed-off-by: Eva Kurchatova --- .../selftests/net/netfilter/br_netfilter.sh | 21 ++++++++++++------- .../selftests/net/netfilter/nf_nat_edemux.sh | 12 +++++++---- 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/tools/testing/selftests/net/netfilter/br_netfilter.sh b/tools/testing/selftests/net/netfilter/br_netfilter.sh index 011de8763094..e4480c9db86e 100755 --- a/tools/testing/selftests/net/netfilter/br_netfilter.sh +++ b/tools/testing/selftests/net/netfilter/br_netfilter.sh @@ -60,14 +60,19 @@ bcast_ping() done } -if ! ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns1"; then - echo "SKIP: Can't create veth device" - exit $ksft_skip -fi - -ip link add veth2 netns "$ns0" type veth peer name eth0 netns "$ns2" -ip link add veth3 netns "$ns0" type veth peer name eth0 netns "$ns3" -ip link add veth4 netns "$ns0" type veth peer name eth0 netns "$ns4" +# Add the pairs from inside ns0: the name of the new device is taken in the +# namespace the command runs in, so adding them here would fail if a device +# of that name was left behind in the initial namespace. Only veth1 used to +# be checked, and a silent failure for one of the others left a namespace +# with no interface at all, which showed up as a ping failure much later. +for i in $(seq 1 4); do + nsvar="ns$i" + if ! ip -net "$ns0" link add "veth$i" type veth \ + peer name eth0 netns "${!nsvar}"; then + echo "SKIP: Can't create veth device" + exit $ksft_skip + fi +done for i in $(seq 1 4); do ip -net "$ns0" link set "veth$i" up diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh index 1014551dd769..9d655d525104 100755 --- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh +++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh @@ -22,10 +22,14 @@ trap cleanup EXIT setup_ns ns1 ns2 -# Connect the namespaces using a veth pair -ip link add name veth2 type veth peer name veth1 -ip link set netns "$ns1" dev veth1 -ip link set netns "$ns2" dev veth2 +# Connect the namespaces using a veth pair. Add it from inside ns1: the +# name of the new device is taken in the namespace the command runs in, so +# adding it here would fail if a device of that name was left behind in the +# initial namespace, and the test would then run without connectivity. +if ! ip -net "$ns1" link add name veth1 type veth peer name veth2 netns "$ns2"; then + echo "SKIP: Can't create veth device" + exit $ksft_skip +fi ip netns exec "$ns1" ip link set up dev lo ip netns exec "$ns1" ip link set up dev veth1 -- 2.55.0