From: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
To: khorenko@virtuozzo.com
Cc: devel@openvz.org
Subject: [Devel] [PATCH vz10 v2 1/5] selftests: net: turn ip_forward off in setup_ns
Date: Tue, 1 Sep 2026 02:45:29 +0300 [thread overview]
Message-ID: <20260831234610.1650091-1-eva.kurchatova@virtuozzo.com> (raw)
A new network namespace takes net.ipv4.ip_forward from the namespace it
is created in:
# sysctl -wq net.ipv4.ip_forward=1
# ip netns add probe
# ip netns exec probe cat /proc/sys/net/ipv4/ip_forward
1
so on a machine that routes, every test namespace forwards. nft_fib.sh
is one that cannot work that way: the two hosts either side of its
router forward the test packets back at it until the TTL runs out, and
the fib expressions the test checks see the wrong thing.
setup_ns already takes rp_filter out of the way for the same reason, so
take ip_forward too, and let the tests that want a router turn it on
themselves, which the ones that need it already do.
net.ipv6.conf.all.forwarding is not inherited, verified the same way, so
it needs no such treatment.
https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
tools/testing/selftests/net/lib.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
index c712a5897075..0a38c1ed4b49 100644
--- a/tools/testing/selftests/net/lib.sh
+++ b/tools/testing/selftests/net/lib.sh
@@ -219,6 +219,7 @@ setup_ns()
ip -n "${!ns_name}" link set lo up
ip netns exec "${!ns_name}" sysctl -wq net.ipv4.conf.all.rp_filter=0
ip netns exec "${!ns_name}" sysctl -wq net.ipv4.conf.default.rp_filter=0
+ ip netns exec "${!ns_name}" sysctl -wq net.ipv4.ip_forward=0
ns_list+=("${!ns_name}")
done
NS_LIST+=("${ns_list[@]}")
--
2.55.0
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
next reply other threads:[~2026-08-31 23:47 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-31 23:45 Eva Kurchatova [this message]
2026-08-31 23:45 ` [Devel] [PATCH vz10 v2 2/5] selftests: netfilter: let the router send redirects Eva Kurchatova
2026-08-31 23:45 ` [Devel] [PATCH vz10 v2 3/5] selftests: netfilter: add the veth pair from inside the namespace Eva Kurchatova
2026-08-31 23:45 ` [Devel] [PATCH vz10 v2 4/5] selftests: netfilter: skip rpath.sh without the nft tool Eva Kurchatova
2026-08-31 23:45 ` [Devel] [PATCH vz10 v2 5/5] selftests: netfilter: account for a per-namespace nf_conntrack_expect_max Eva Kurchatova
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260831234610.1650091-1-eva.kurchatova@virtuozzo.com \
--to=eva.kurchatova@virtuozzo.com \
--cc=devel@openvz.org \
--cc=khorenko@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox