From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eva Kurchatova (Virtuozzo) Date: Wed, 26 Aug 2026 01:58:56 +0300 Subject: Re: [Devel] [PATCH vz10] selftests: drv-net: avoid host firewall interference In-Reply-To: References: <20260624223441.1147332-1-eva.kurchatova@virtuozzo.com> Message-ID: <72bbeac6-9c70-4801-b261-7d71bf621778@virtuozzo.com> List-Id: On 8/18/26 20:43, Konstantin Khorenko wrote: > Please check hci-tests.vhistrg repo for the following commit: > https://bitbucket.org/virtuozzocore/hci-tests.vhistrg/commits/00e524341ea1e55a11d9de5cb2ab03cb21118208 > > commit 00e524341ea1e55a11d9de5cb2ab03cb21118208 > Author: Aleksei Oladko > Date: Wed Feb 18 09:33:35 2026 +0000 > > hci-kselftests: stop firewalld to prevent test hangs > > Some net/forwarding kselftests disable the default timeout and wait > for generated packets to be received. If firewall rules are active, > the packets may be dropped and the test can hang indefinitely. > > The hci-kselftest previously attempted to clear firewall rules > with "nft flush ruleset", but firewalld restored them, causing the > tests to hang. > > Stop firewalld instead to ensure the rules are not reinstalled > during test execution. > > vstorage-ui-agent service monitors availability of firewalld and > restores it if needed => need to disable it as well. > > /etc/firewalld/firewalld.conf CleanupOnExit option might cause > firewalld not to clear rules on a service stop => > clean up rules additionally just in case. > > https://virtuozzo.atlassian.net/browse/VSTOR-125054 > > Signed-off-by: Aleksei Oladko > > > It should already disable all iptables and Co. > > And taking this into account - do we still need this patch? > If yes - why? > > > -- > Best regards, > > Konstantin Khorenko, > Virtuozzo Linux Kernel Team > > On 6/25/26 00:33, Eva Kurchatova wrote: >> The NetDrvEpEnv test environment creates a netdevsim device in >> init_net and a peer in a separate network namespace. Tests such as >> ping.py's test_tcp start a socat listener in init_net and expect the >> remote namespace to connect to it via random port. >> >> When a host firewall (e.g. firewalld with nftables backend) is active, >> its INPUT chain rejects inbound TCP connections to ports not in its >> allow-list. ICMP is explicitly permitted, so ping tests pass, but >> TCP-based tests hang indefinitely: the socat listener never receives a >> connection, and bkg(exit_wait=True) waits forever for it to exit, >> resulting in a timeout failure. >> >> Fix this by adding the local netdevsim interface to the firewalld >> trusted zone after creating the test topology in create_local(). >> The trusted zone accepts all traffic unconditionally, bypassing any >> filtering rules. The interface is removed from the zone during >> cleanup in __del__(). Both operations use fail=False so they are >> silently skipped on systems without firewalld. >> >> Signed-off-by: Eva Kurchatova >> >> https://virtuozzo.atlassian.net/browse/VSTOR-135793 >> Feature: fix selftests >> >> --- >> tools/testing/selftests/drivers/net/lib/py/env.py | 13 +++++++++++++ >> 1 file changed, 13 insertions(+) >> >> diff --git a/tools/testing/selftests/drivers/net/lib/py/env.py b/tools/testing/selftests/drivers/net/lib/py/env.py >> index 1ea9bb695e94..b3d4c1accb25 100644 >> --- a/tools/testing/selftests/drivers/net/lib/py/env.py >> +++ b/tools/testing/selftests/drivers/net/lib/py/env.py >> @@ -92,6 +92,7 @@ class NetDrvEpEnv: >> self._netns = None >> self._ns = None >> self._ns_peer = None >> + self._fw_ifname = None >> >> if "NETIF" in self.env: >> if nsim_test is True: >> @@ -156,6 +157,13 @@ class NetDrvEpEnv: >> ip(f"-6 addr add dev {self._ns_peer.nsims[0].ifname} {self.nsim_v6_pfx}2/64 nodad", ns=self._netns) >> ip(f" link set dev {self._ns_peer.nsims[0].ifname} up", ns=self._netns) >> >> + # Allow all inbound traffic on the local test interface. >> + # A host firewall (e.g. firewalld) may reject connections to >> + # random test ports, causing TCP-based tests to time out. >> + self._fw_ifname = self._ns.nsims[0].ifname >> + cmd(f"firewall-cmd --zone=trusted --add-interface={self._fw_ifname}", >> + fail=False) >> + >> def _check_env(self): >> vars_needed = [ >> ["LOCAL_V4", "LOCAL_V6"], >> @@ -190,6 +198,11 @@ class NetDrvEpEnv: >> self.__del__() >> >> def __del__(self): >> + if self._fw_ifname: >> + cmd(f"firewall-cmd --zone=trusted " >> + f"--remove-interface={self._fw_ifname}", >> + fail=False) >> + self._fw_ifname = None >> if self._ns: >> self._ns.remove() >> self._ns = None The commit "selftests: drv-net: avoid host firewall interference" is superseded by the newer commits to kselftests harnesses, which all use dedicated per-test netns as opposed to altering the host firewall. This patch should be dropped. Note however, that the "hci-kselftests: stop firewalld to prevent test hangs" commit by Alexey Oladko did not originally fix the issue as it stands, as it only alters the behavior of tests under "net*" wildcard, which for example "drivers.net.netdevsim" did not fall under.