[Devel] [PATCH hci-8.1 v3 0/5] selftests: netfilter: make the suite pass on a routing host

[Devel] [PATCH hci-8.1 v3 0/5] selftests: netfilter: make the suite pass on a routing host

[Konstantin Khorenko]

The net/netfilter selftests fail on the hci nodes for reasons outside
the code under test: a new network namespace copies ip_forward and
send_redirects from init_net, so a routing host with redirects turned
off breaks nft_fib.sh and conntrack_icmp_related.sh; a veth name left
behind in init_net by another test makes br_netfilter.sh and
nf_nat_edemux.sh add their pairs into nothing; rpath.sh fails instead
of skipping without nft; and conntrack_resize.sh expects
nf_conntrack_expect_max to be read-only outside init_net, which vz
virtualizes on purpose.

Changes since v2:
- patches 1 and 2: the messages said the sysctls are inherited from the
  creating namespace; they are copied from init_net (devinet_init_net
  in the default devconf_inherit_init_net mode), which is what matters
  inside a container. Reworded.
- patch 3: the comments in br_netfilter.sh and nf_nat_edemux.sh retold
  the commit message over four and five lines; one line each now. The
  "90 lines later" in the message is "much later".
- patch 5: the comment is reflowed; the commit reference in the message
  is wrapped at 74 columns so the commit-msg hook accepts it.
- Reviewed-by added to every patch.

Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
Eva Kurchatova (5):
      selftests: net: turn ip_forward off in setup_ns
      selftests: netfilter: let the router send redirects
      selftests: netfilter: add the veth pair from inside the namespace
      selftests: netfilter: skip rpath.sh without the nft tool
      selftests: netfilter: account for a per-namespace nf_conntrack_expect_max

 tools/testing/selftests/net/lib.sh                      |  1 +
 tools/testing/selftests/net/netfilter/br_netfilter.sh   | 17 +++++++++--------
 .../selftests/net/netfilter/conntrack_icmp_related.sh   |  6 ++++++
 .../testing/selftests/net/netfilter/conntrack_resize.sh |  6 ++++--
 tools/testing/selftests/net/netfilter/nf_nat_edemux.sh  |  9 +++++----
 tools/testing/selftests/net/netfilter/rpath.sh          |  3 +++
 6 files changed, 28 insertions(+), 14 deletions(-)
---
base-commit: b3bd8f01bee9ae791ea9c5f89c94a64c49614062
change-id: 20260924-b4-prep-netfilter-edf816137359

Best regards,
--  
Konstantin Khorenko <khorenko@virtuozzo.com>

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v3 1/5] selftests: net: turn ip_forward off in setup_ns

[Konstantin Khorenko]

From: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

A new network namespace takes net.ipv4.ip_forward from init_net, no
matter which namespace it is created from:

  # sysctl -wq net.ipv4.ip_forward=1
  # ip netns add probe
  # ip netns exec probe cat /proc/sys/net/ipv4/ip_forward
  1

so on a machine that routes, every test namespace forwards. nft_fib.sh
is one that cannot work that way: the two hosts either side of its
router forward the test packets back at it until the TTL runs out, and
the fib expressions the test checks see the wrong thing.

setup_ns already takes rp_filter out of the way for the same reason, so
take ip_forward too, and let the tests that want a router turn it on
themselves, which the ones that need it already do.

net.ipv6.conf.all.forwarding is not inherited, verified the same way, so
it needs no such treatment.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
v3: say the value is copied from init_net rather than from the
    creating namespace.
---
 tools/testing/selftests/net/lib.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
index c712a5897075d..0a38c1ed4b498 100644
--- a/tools/testing/selftests/net/lib.sh
+++ b/tools/testing/selftests/net/lib.sh
@@ -219,6 +219,7 @@ setup_ns()
 		ip -n "${!ns_name}" link set lo up
 		ip netns exec "${!ns_name}" sysctl -wq net.ipv4.conf.all.rp_filter=0
 		ip netns exec "${!ns_name}" sysctl -wq net.ipv4.conf.default.rp_filter=0
+		ip netns exec "${!ns_name}" sysctl -wq net.ipv4.ip_forward=0
 		ns_list+=("${!ns_name}")
 	done
 	NS_LIST+=("${ns_list[@]}")

-- 
2.43.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v3 2/5] selftests: netfilter: let the router send redirects

[Konstantin Khorenko]

From: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

The icmp_redirect part of conntrack_icmp_related.sh waits for the router
to send an ICMP redirect, but a new namespace takes send_redirects from
init_net, and it is commonly turned off there:

  # ip netns exec "$nsrouter1" \
  #     cat /proc/sys/net/ipv4/conf/all/send_redirects
  0

with nothing sent, the test times out waiting. Ask for it on the router
that is supposed to send them.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
v3: say the value is copied from init_net rather than from the
    creating namespace.
---
 tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh b/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh
index c63d840ead61f..44a98c53d085e 100755
--- a/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh
+++ b/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh
@@ -253,6 +253,12 @@ else
 fi
 
 # add 'bad' route,  expect icmp REDIRECT to be generated
+# A new namespace inherits send_redirects from the host, where it is
+# often turned off; without it the router never sends the redirect this
+# part of the test waits for.
+ip netns exec "$nsrouter1" sysctl -q net.ipv4.conf.all.send_redirects=1
+ip netns exec "$nsrouter1" sysctl -q net.ipv4.conf.default.send_redirects=1
+
 ip netns exec "${nsclient1}" ip route add 192.168.1.42 via 192.168.1.1
 ip netns exec "${nsclient1}" ip route add dead:1::42 via dead:1::1
 

-- 
2.43.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v3 3/5] selftests: netfilter: add the veth pair from inside the namespace

[Konstantin Khorenko]

From: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

Both tests add a veth by name while running in the initial namespace.
The name of the new device is taken there, not in the namespace passed to
netns, so a device of that name left behind by another test makes the add
fail and the test then runs with no connectivity at all:

  # RTNETLINK answers: File exists
  # Cannot find device "veth1"
  # FAIL: socat cannot connect via NAT'd address

Add the pair from inside one of the namespaces instead. Those are made
by setup_ns and are empty, and the peer is created directly in its own
namespace, so no name from the initial namespace is in the way.

br_netfilter.sh checked only the first of its four adds, so a failure of
any of the others was silent and turned up much later as a ping to a
namespace that had no interface. Check all four.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
v3: one-line comments instead of a retelling of this message; drop
    the line count from the text.
---
 tools/testing/selftests/net/netfilter/br_netfilter.sh  | 17 +++++++++--------
 tools/testing/selftests/net/netfilter/nf_nat_edemux.sh |  9 +++++----
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/tools/testing/selftests/net/netfilter/br_netfilter.sh b/tools/testing/selftests/net/netfilter/br_netfilter.sh
index 011de87630940..8648f07871090 100755
--- a/tools/testing/selftests/net/netfilter/br_netfilter.sh
+++ b/tools/testing/selftests/net/netfilter/br_netfilter.sh
@@ -60,14 +60,15 @@ bcast_ping()
 	done
 }
 
-if ! ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns1"; then
-	echo "SKIP: Can't create veth device"
-	exit $ksft_skip
-fi
-
-ip link add veth2 netns "$ns0" type veth peer name eth0 netns "$ns2"
-ip link add veth3 netns "$ns0" type veth peer name eth0 netns "$ns3"
-ip link add veth4 netns "$ns0" type veth peer name eth0 netns "$ns4"
+# add from inside the netns so a stale vethN in init_net cannot get in the way
+for i in $(seq 1 4); do
+	nsvar="ns$i"
+	if ! ip -net "$ns0" link add "veth$i" type veth \
+		peer name eth0 netns "${!nsvar}"; then
+		echo "SKIP: Can't create veth device"
+		exit $ksft_skip
+	fi
+done
 
 for i in $(seq 1 4); do
   ip -net "$ns0" link set "veth$i" up
diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
index 1014551dd7694..0ddea0f79e55c 100755
--- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
+++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
@@ -22,10 +22,11 @@ trap cleanup EXIT
 
 setup_ns ns1 ns2
 
-# Connect the namespaces using a veth pair
-ip link add name veth2 type veth peer name veth1
-ip link set netns "$ns1" dev veth1
-ip link set netns "$ns2" dev veth2
+# add from inside the netns so a stale veth1 in init_net cannot get in the way
+if ! ip -net "$ns1" link add name veth1 type veth peer name veth2 netns "$ns2"; then
+	echo "SKIP: Can't create veth device"
+	exit $ksft_skip
+fi
 
 ip netns exec "$ns1" ip link set up dev lo
 ip netns exec "$ns1" ip link set up dev veth1

-- 
2.43.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v3 4/5] selftests: netfilter: skip rpath.sh without the nft tool

[Konstantin Khorenko]

From: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

Every other netfilter test that needs nft checks for it. rpath.sh does
not, and without the tool it reports "nft IPv4 match not effective"
instead of skipping.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
 tools/testing/selftests/net/netfilter/rpath.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/testing/selftests/net/netfilter/rpath.sh b/tools/testing/selftests/net/netfilter/rpath.sh
index 90cc212332350..5c71cb43ae0aa 100755
--- a/tools/testing/selftests/net/netfilter/rpath.sh
+++ b/tools/testing/selftests/net/netfilter/rpath.sh
@@ -3,6 +3,9 @@
 
 source lib.sh
 
+checktool "nft --version" "run test without nft tool"
+checktool "ip -Version" "run test without ip tool"
+
 # search for legacy iptables (it uses the xtables extensions
 if iptables-legacy --version >/dev/null 2>&1; then
 	iptables='iptables-legacy'

-- 
2.43.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v3 5/5] selftests: netfilter: account for a per-namespace nf_conntrack_expect_max

[Konstantin Khorenko]

From: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

The test requires it to be settable from init_net only, while vz
virtualizes it deliberately:

  commit 6d854968102f ("ve/netfilter: Implement pernet expect_max /
  virtualize "net.netfilter.nf_conntrack_expect_max" sysctl")

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix vz selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
v3: reflow the comment; wrap the commit reference at 74 columns.
---
 tools/testing/selftests/net/netfilter/conntrack_resize.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/netfilter/conntrack_resize.sh b/tools/testing/selftests/net/netfilter/conntrack_resize.sh
index aa1ba07eaf50c..b5ce4f9b5d1b1 100755
--- a/tools/testing/selftests/net/netfilter/conntrack_resize.sh
+++ b/tools/testing/selftests/net/netfilter/conntrack_resize.sh
@@ -457,8 +457,10 @@ check_max_alias 262000
 
 setup_ns nsclient1 nsclient2
 
-# check this only works from init_net
-for n in netfilter.nf_conntrack_buckets netfilter.nf_conntrack_expect_max net.nf_conntrack_max;do
+# check this only works from init_net.
+# nf_conntrack_expect_max is left out: vz virtualizes it on purpose,
+# see "ve/netfilter: Implement pernet expect_max".
+for n in netfilter.nf_conntrack_buckets net.nf_conntrack_max;do
 	check_sysctl_immutable "$nsclient1" "net.$n" 1
 done
 

-- 
2.43.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v3 0/5] selftests: netfilter: make the suite pass on a routing host

[Konstantin Khorenko]

On Thu, 24 Sep 2026 13:06:05 +0200, Konstantin Khorenko wrote:
> selftests: netfilter: make the suite pass on a routing host
> 
> The net/netfilter selftests fail on the hci nodes for reasons outside
> the code under test: a new network namespace copies ip_forward and
> send_redirects from init_net, so a routing host with redirects turned
> off breaks nft_fib.sh and conntrack_icmp_related.sh; a veth name left
> behind in init_net by another test makes br_netfilter.sh and
> nf_nat_edemux.sh add their pairs into nothing; rpath.sh fails instead
> of skipping without nft; and conntrack_resize.sh expects
> nf_conntrack_expect_max to be read-only outside init_net, which vz
> virtualizes on purpose.
> 
> [...]

Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.3.vz10, thanks!

[1/5] selftests: net: turn ip_forward off in setup_ns
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/1e7d1447efd6
[2/5] selftests: netfilter: let the router send redirects
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/ec4a461f489f
[3/5] selftests: netfilter: add the veth pair from inside the namespace
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/21d20beb231d
[4/5] selftests: netfilter: skip rpath.sh without the nft tool
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/29f7cd8389f2
[5/5] selftests: netfilter: account for a per-namespace nf_conntrack_expect_max
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/ad76ffbef974

-- 
Konstantin Khorenko <khorenko@virtuozzo.com>

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel