[Devel] [PATCH vz10 v2 1/5] selftests: net: turn ip_forward off in setup_ns

[Devel] [PATCH vz10 v2 1/5] selftests: net: turn ip_forward off in setup_ns

[Eva Kurchatova]

A new network namespace takes net.ipv4.ip_forward from the namespace it
is created in:

  # sysctl -wq net.ipv4.ip_forward=1
  # ip netns add probe
  # ip netns exec probe cat /proc/sys/net/ipv4/ip_forward
  1

so on a machine that routes, every test namespace forwards. nft_fib.sh
is one that cannot work that way: the two hosts either side of its
router forward the test packets back at it until the TTL runs out, and
the fib expressions the test checks see the wrong thing.

setup_ns already takes rp_filter out of the way for the same reason, so
take ip_forward too, and let the tests that want a router turn it on
themselves, which the ones that need it already do.

net.ipv6.conf.all.forwarding is not inherited, verified the same way, so
it needs no such treatment.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/lib.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
index c712a5897075..0a38c1ed4b49 100644
--- a/tools/testing/selftests/net/lib.sh
+++ b/tools/testing/selftests/net/lib.sh
@@ -219,6 +219,7 @@ setup_ns()
 		ip -n "${!ns_name}" link set lo up
 		ip netns exec "${!ns_name}" sysctl -wq net.ipv4.conf.all.rp_filter=0
 		ip netns exec "${!ns_name}" sysctl -wq net.ipv4.conf.default.rp_filter=0
+		ip netns exec "${!ns_name}" sysctl -wq net.ipv4.ip_forward=0
 		ns_list+=("${!ns_name}")
 	done
 	NS_LIST+=("${ns_list[@]}")
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 v2 2/5] selftests: netfilter: let the router send redirects

[Eva Kurchatova]

The icmp_redirect part of conntrack_icmp_related.sh waits for the router
to send an ICMP redirect, but a new namespace takes send_redirects from
the namespace it is created in, and it is commonly turned off there:

  # ip netns exec "$nsrouter1" \
  #     cat /proc/sys/net/ipv4/conf/all/send_redirects
  0

with nothing sent, the test times out waiting. Ask for it on the router
that is supposed to send them.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 .../selftests/net/netfilter/conntrack_icmp_related.sh       | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh b/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh
index c63d840ead61..44a98c53d085 100755
--- a/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh
+++ b/tools/testing/selftests/net/netfilter/conntrack_icmp_related.sh
@@ -253,6 +253,12 @@ else
 fi
 
 # add 'bad' route,  expect icmp REDIRECT to be generated
+# A new namespace inherits send_redirects from the host, where it is
+# often turned off; without it the router never sends the redirect this
+# part of the test waits for.
+ip netns exec "$nsrouter1" sysctl -q net.ipv4.conf.all.send_redirects=1
+ip netns exec "$nsrouter1" sysctl -q net.ipv4.conf.default.send_redirects=1
+
 ip netns exec "${nsclient1}" ip route add 192.168.1.42 via 192.168.1.1
 ip netns exec "${nsclient1}" ip route add dead:1::42 via dead:1::1
 
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 v2 3/5] selftests: netfilter: add the veth pair from inside the namespace

[Eva Kurchatova]

Both tests add a veth by name while running in the initial namespace.
The name of the new device is taken there, not in the namespace passed to
netns, so a device of that name left behind by another test makes the add
fail and the test then runs with no connectivity at all:

  # RTNETLINK answers: File exists
  # Cannot find device "veth1"
  # FAIL: socat cannot connect via NAT'd address

Add the pair from inside one of the namespaces instead. Those are made
by setup_ns and are empty, and the peer is created directly in its own
namespace, so no name from the initial namespace is in the way.

br_netfilter.sh checked only the first of its four adds, so a failure of
any of the others was silent and turned up 90 lines later as a ping to a
namespace that had no interface. Check all four.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 .../selftests/net/netfilter/br_netfilter.sh   | 21 ++++++++++++-------
 .../selftests/net/netfilter/nf_nat_edemux.sh  | 12 +++++++----
 2 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/tools/testing/selftests/net/netfilter/br_netfilter.sh b/tools/testing/selftests/net/netfilter/br_netfilter.sh
index 011de8763094..e4480c9db86e 100755
--- a/tools/testing/selftests/net/netfilter/br_netfilter.sh
+++ b/tools/testing/selftests/net/netfilter/br_netfilter.sh
@@ -60,14 +60,19 @@ bcast_ping()
 	done
 }
 
-if ! ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns1"; then
-	echo "SKIP: Can't create veth device"
-	exit $ksft_skip
-fi
-
-ip link add veth2 netns "$ns0" type veth peer name eth0 netns "$ns2"
-ip link add veth3 netns "$ns0" type veth peer name eth0 netns "$ns3"
-ip link add veth4 netns "$ns0" type veth peer name eth0 netns "$ns4"
+# Add the pairs from inside ns0: the name of the new device is taken in the
+# namespace the command runs in, so adding them here would fail if a device
+# of that name was left behind in the initial namespace.  Only veth1 used to
+# be checked, and a silent failure for one of the others left a namespace
+# with no interface at all, which showed up as a ping failure much later.
+for i in $(seq 1 4); do
+	nsvar="ns$i"
+	if ! ip -net "$ns0" link add "veth$i" type veth \
+		peer name eth0 netns "${!nsvar}"; then
+		echo "SKIP: Can't create veth device"
+		exit $ksft_skip
+	fi
+done
 
 for i in $(seq 1 4); do
   ip -net "$ns0" link set "veth$i" up
diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
index 1014551dd769..9d655d525104 100755
--- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
+++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
@@ -22,10 +22,14 @@ trap cleanup EXIT
 
 setup_ns ns1 ns2
 
-# Connect the namespaces using a veth pair
-ip link add name veth2 type veth peer name veth1
-ip link set netns "$ns1" dev veth1
-ip link set netns "$ns2" dev veth2
+# Connect the namespaces using a veth pair.  Add it from inside ns1: the
+# name of the new device is taken in the namespace the command runs in, so
+# adding it here would fail if a device of that name was left behind in the
+# initial namespace, and the test would then run without connectivity.
+if ! ip -net "$ns1" link add name veth1 type veth peer name veth2 netns "$ns2"; then
+	echo "SKIP: Can't create veth device"
+	exit $ksft_skip
+fi
 
 ip netns exec "$ns1" ip link set up dev lo
 ip netns exec "$ns1" ip link set up dev veth1
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 v2 4/5] selftests: netfilter: skip rpath.sh without the nft tool

[Eva Kurchatova]

Every other netfilter test that needs nft checks for it. rpath.sh does
not, and without the tool it reports "nft IPv4 match not effective"
instead of skipping.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/netfilter/rpath.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/testing/selftests/net/netfilter/rpath.sh b/tools/testing/selftests/net/netfilter/rpath.sh
index 90cc21233235..5c71cb43ae0a 100755
--- a/tools/testing/selftests/net/netfilter/rpath.sh
+++ b/tools/testing/selftests/net/netfilter/rpath.sh
@@ -3,6 +3,9 @@
 
 source lib.sh
 
+checktool "nft --version" "run test without nft tool"
+checktool "ip -Version" "run test without ip tool"
+
 # search for legacy iptables (it uses the xtables extensions
 if iptables-legacy --version >/dev/null 2>&1; then
 	iptables='iptables-legacy'
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 v2 5/5] selftests: netfilter: account for a per-namespace nf_conntrack_expect_max

[Eva Kurchatova]

The test requires it to be settable from init_net only, while vz
virtualizes it deliberately:

  commit 6d854968102f ("ve/netfilter: Implement pernet expect_max / virtualize "net.netfilter.nf_conntrack_expect_max" sysctl")

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix vz selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/netfilter/conntrack_resize.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/netfilter/conntrack_resize.sh b/tools/testing/selftests/net/netfilter/conntrack_resize.sh
index aa1ba07eaf50..324259632daa 100755
--- a/tools/testing/selftests/net/netfilter/conntrack_resize.sh
+++ b/tools/testing/selftests/net/netfilter/conntrack_resize.sh
@@ -457,8 +457,10 @@ check_max_alias 262000
 
 setup_ns nsclient1 nsclient2
 
-# check this only works from init_net
-for n in netfilter.nf_conntrack_buckets netfilter.nf_conntrack_expect_max net.nf_conntrack_max;do
+# check this only works from init_net.  nf_conntrack_expect_max is left
+# out: vz virtualizes it on purpose, see "ve/netfilter: Implement pernet
+# expect_max".
+for n in netfilter.nf_conntrack_buckets net.nf_conntrack_max;do
 	check_sysctl_immutable "$nsclient1" "net.$n" 1
 done
 
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel