Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Two easy cases of overlapping changes. Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller
@@ -6,12 +6,14 @@ if [ $(id -u) != 0 ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
ret=0
|
||||
echo "--------------------"
|
||||
echo "running psock_fanout test"
|
||||
echo "--------------------"
|
||||
./in_netns.sh ./psock_fanout
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "[FAIL]"
|
||||
ret=1
|
||||
else
|
||||
echo "[PASS]"
|
||||
fi
|
||||
@@ -22,6 +24,7 @@ echo "--------------------"
|
||||
./in_netns.sh ./psock_tpacket
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "[FAIL]"
|
||||
ret=1
|
||||
else
|
||||
echo "[PASS]"
|
||||
fi
|
||||
@@ -32,6 +35,8 @@ echo "--------------------"
|
||||
./in_netns.sh ./txring_overwrite
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "[FAIL]"
|
||||
ret=1
|
||||
else
|
||||
echo "[PASS]"
|
||||
fi
|
||||
exit $ret
|
||||
|
||||
@@ -7,7 +7,7 @@ echo "--------------------"
|
||||
./socket
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "[FAIL]"
|
||||
exit 1
|
||||
else
|
||||
echo "[PASS]"
|
||||
fi
|
||||
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
# Makefile for netfilter selftests
|
||||
|
||||
TEST_PROGS := nft_trans_stress.sh nft_nat.sh bridge_brouter.sh
|
||||
TEST_PROGS := nft_trans_stress.sh nft_nat.sh bridge_brouter.sh \
|
||||
conntrack_icmp_related.sh
|
||||
|
||||
include ../lib.mk
|
||||
|
||||
283
tools/testing/selftests/netfilter/conntrack_icmp_related.sh
Executable file
283
tools/testing/selftests/netfilter/conntrack_icmp_related.sh
Executable file
@@ -0,0 +1,283 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# check that ICMP df-needed/pkttoobig icmp are set are set as related
|
||||
# state
|
||||
#
|
||||
# Setup is:
|
||||
#
|
||||
# nsclient1 -> nsrouter1 -> nsrouter2 -> nsclient2
|
||||
# MTU 1500, except for nsrouter2 <-> nsclient2 link (1280).
|
||||
# ping nsclient2 from nsclient1, checking that conntrack did set RELATED
|
||||
# 'fragmentation needed' icmp packet.
|
||||
#
|
||||
# In addition, nsrouter1 will perform IP masquerading, i.e. also
|
||||
# check the icmp errors are propagated to the correct host as per
|
||||
# nat of "established" icmp-echo "connection".
|
||||
|
||||
# Kselftest framework requirement - SKIP code is 4.
|
||||
ksft_skip=4
|
||||
ret=0
|
||||
|
||||
nft --version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
echo "SKIP: Could not run test without nft tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
ip -Version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
echo "SKIP: Could not run test without ip tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
cleanup() {
|
||||
for i in 1 2;do ip netns del nsclient$i;done
|
||||
for i in 1 2;do ip netns del nsrouter$i;done
|
||||
}
|
||||
|
||||
ipv4() {
|
||||
echo -n 192.168.$1.2
|
||||
}
|
||||
|
||||
ipv6 () {
|
||||
echo -n dead:$1::2
|
||||
}
|
||||
|
||||
check_counter()
|
||||
{
|
||||
ns=$1
|
||||
name=$2
|
||||
expect=$3
|
||||
local lret=0
|
||||
|
||||
cnt=$(ip netns exec $ns nft list counter inet filter "$name" | grep -q "$expect")
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
|
||||
ip netns exec $ns nft list counter inet filter "$name" 1>&2
|
||||
lret=1
|
||||
fi
|
||||
|
||||
return $lret
|
||||
}
|
||||
|
||||
check_unknown()
|
||||
{
|
||||
expect="packets 0 bytes 0"
|
||||
for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
|
||||
check_counter $n "unknown" "$expect"
|
||||
if [ $? -ne 0 ] ;then
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
|
||||
ip netns add $n
|
||||
ip -net $n link set lo up
|
||||
done
|
||||
|
||||
DEV=veth0
|
||||
ip link add $DEV netns nsclient1 type veth peer name eth1 netns nsrouter1
|
||||
DEV=veth0
|
||||
ip link add $DEV netns nsclient2 type veth peer name eth1 netns nsrouter2
|
||||
|
||||
DEV=veth0
|
||||
ip link add $DEV netns nsrouter1 type veth peer name eth2 netns nsrouter2
|
||||
|
||||
DEV=veth0
|
||||
for i in 1 2; do
|
||||
ip -net nsclient$i link set $DEV up
|
||||
ip -net nsclient$i addr add $(ipv4 $i)/24 dev $DEV
|
||||
ip -net nsclient$i addr add $(ipv6 $i)/64 dev $DEV
|
||||
done
|
||||
|
||||
ip -net nsrouter1 link set eth1 up
|
||||
ip -net nsrouter1 link set veth0 up
|
||||
|
||||
ip -net nsrouter2 link set eth1 up
|
||||
ip -net nsrouter2 link set eth2 up
|
||||
|
||||
ip -net nsclient1 route add default via 192.168.1.1
|
||||
ip -net nsclient1 -6 route add default via dead:1::1
|
||||
|
||||
ip -net nsclient2 route add default via 192.168.2.1
|
||||
ip -net nsclient2 route add default via dead:2::1
|
||||
|
||||
i=3
|
||||
ip -net nsrouter1 addr add 192.168.1.1/24 dev eth1
|
||||
ip -net nsrouter1 addr add 192.168.3.1/24 dev veth0
|
||||
ip -net nsrouter1 addr add dead:1::1/64 dev eth1
|
||||
ip -net nsrouter1 addr add dead:3::1/64 dev veth0
|
||||
ip -net nsrouter1 route add default via 192.168.3.10
|
||||
ip -net nsrouter1 -6 route add default via dead:3::10
|
||||
|
||||
ip -net nsrouter2 addr add 192.168.2.1/24 dev eth1
|
||||
ip -net nsrouter2 addr add 192.168.3.10/24 dev eth2
|
||||
ip -net nsrouter2 addr add dead:2::1/64 dev eth1
|
||||
ip -net nsrouter2 addr add dead:3::10/64 dev eth2
|
||||
ip -net nsrouter2 route add default via 192.168.3.1
|
||||
ip -net nsrouter2 route add default via dead:3::1
|
||||
|
||||
sleep 2
|
||||
for i in 4 6; do
|
||||
ip netns exec nsrouter1 sysctl -q net.ipv$i.conf.all.forwarding=1
|
||||
ip netns exec nsrouter2 sysctl -q net.ipv$i.conf.all.forwarding=1
|
||||
done
|
||||
|
||||
for netns in nsrouter1 nsrouter2; do
|
||||
ip netns exec $netns nft -f - <<EOF
|
||||
table inet filter {
|
||||
counter unknown { }
|
||||
counter related { }
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy accept;
|
||||
meta l4proto icmpv6 icmpv6 type "packet-too-big" ct state "related" counter name "related" accept
|
||||
meta l4proto icmp icmp type "destination-unreachable" ct state "related" counter name "related" accept
|
||||
meta l4proto { icmp, icmpv6 } ct state new,established accept
|
||||
counter name "unknown" drop
|
||||
}
|
||||
}
|
||||
EOF
|
||||
done
|
||||
|
||||
ip netns exec nsclient1 nft -f - <<EOF
|
||||
table inet filter {
|
||||
counter unknown { }
|
||||
counter related { }
|
||||
chain input {
|
||||
type filter hook input priority 0; policy accept;
|
||||
meta l4proto { icmp, icmpv6 } ct state established,untracked accept
|
||||
|
||||
meta l4proto { icmp, icmpv6 } ct state "related" counter name "related" accept
|
||||
counter name "unknown" drop
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
ip netns exec nsclient2 nft -f - <<EOF
|
||||
table inet filter {
|
||||
counter unknown { }
|
||||
counter new { }
|
||||
counter established { }
|
||||
|
||||
chain input {
|
||||
type filter hook input priority 0; policy accept;
|
||||
meta l4proto { icmp, icmpv6 } ct state established,untracked accept
|
||||
|
||||
meta l4proto { icmp, icmpv6 } ct state "new" counter name "new" accept
|
||||
meta l4proto { icmp, icmpv6 } ct state "established" counter name "established" accept
|
||||
counter name "unknown" drop
|
||||
}
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
meta l4proto { icmp, icmpv6 } ct state established,untracked accept
|
||||
|
||||
meta l4proto { icmp, icmpv6 } ct state "new" counter name "new"
|
||||
meta l4proto { icmp, icmpv6 } ct state "established" counter name "established"
|
||||
counter name "unknown" drop
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
|
||||
# make sure NAT core rewrites adress of icmp error if nat is used according to
|
||||
# conntrack nat information (icmp error will be directed at nsrouter1 address,
|
||||
# but it needs to be routed to nsclient1 address).
|
||||
ip netns exec nsrouter1 nft -f - <<EOF
|
||||
table ip nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
ip protocol icmp oifname "veth0" counter masquerade
|
||||
}
|
||||
}
|
||||
table ip6 nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
ip6 nexthdr icmpv6 oifname "veth0" counter masquerade
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
ip netns exec nsrouter2 ip link set eth1 mtu 1280
|
||||
ip netns exec nsclient2 ip link set veth0 mtu 1280
|
||||
sleep 1
|
||||
|
||||
ip netns exec nsclient1 ping -c 1 -s 1000 -q -M do 192.168.2.2 >/dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: netns ip routing/connectivity broken" 1>&2
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
ip netns exec nsclient1 ping6 -q -c 1 -s 1000 dead:2::2 >/dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: netns ipv6 routing/connectivity broken" 1>&2
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
|
||||
check_unknown
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
|
||||
expect="packets 0 bytes 0"
|
||||
for netns in nsrouter1 nsrouter2 nsclient1;do
|
||||
check_counter "$netns" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
done
|
||||
|
||||
expect="packets 2 bytes 2076"
|
||||
check_counter nsclient2 "new" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
|
||||
ip netns exec nsclient1 ping -q -c 1 -s 1300 -M do 192.168.2.2 > /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "ERROR: ping should have failed with PMTU too big error" 1>&2
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# nsrouter2 should have generated the icmp error, so
|
||||
# related counter should be 0 (its in forward).
|
||||
expect="packets 0 bytes 0"
|
||||
check_counter "nsrouter2" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# but nsrouter1 should have seen it, same for nsclient1.
|
||||
expect="packets 1 bytes 576"
|
||||
for netns in nsrouter1 nsclient1;do
|
||||
check_counter "$netns" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
done
|
||||
|
||||
ip netns exec nsclient1 ping6 -c 1 -s 1300 dead:2::2 > /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "ERROR: ping6 should have failed with PMTU too big error" 1>&2
|
||||
ret=1
|
||||
fi
|
||||
|
||||
expect="packets 2 bytes 1856"
|
||||
for netns in nsrouter1 nsclient1;do
|
||||
check_counter "$netns" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
done
|
||||
|
||||
if [ $ret -eq 0 ];then
|
||||
echo "PASS: icmp mtu error had RELATED state"
|
||||
else
|
||||
echo "ERROR: icmp error RELATED state test has failed"
|
||||
fi
|
||||
|
||||
cleanup
|
||||
exit $ret
|
||||
@@ -347,6 +347,7 @@ EOF
|
||||
test_masquerade6()
|
||||
{
|
||||
local family=$1
|
||||
local natflags=$1
|
||||
local lret=0
|
||||
|
||||
ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
|
||||
@@ -380,7 +381,7 @@ ip netns exec ns0 nft -f - <<EOF
|
||||
table $family nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
meta oif veth0 masquerade
|
||||
meta oif veth0 masquerade $natflags
|
||||
}
|
||||
}
|
||||
EOF
|
||||
@@ -391,7 +392,11 @@ EOF
|
||||
|
||||
ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
<<<<<<< HEAD
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active $family masquerading"
|
||||
=======
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags"
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
lret=1
|
||||
fi
|
||||
|
||||
@@ -428,20 +433,38 @@ EOF
|
||||
fi
|
||||
done
|
||||
|
||||
<<<<<<< HEAD
|
||||
ip netns exec ns0 nft flush chain $family nat postrouting
|
||||
=======
|
||||
ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
ip netns exec ns0 nft flush chain ip6 nat postrouting
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: Could not flush $family nat postrouting" 1>&2
|
||||
lret=1
|
||||
fi
|
||||
|
||||
<<<<<<< HEAD
|
||||
test $lret -eq 0 && echo "PASS: $family IPv6 masquerade for ns2"
|
||||
=======
|
||||
test $lret -eq 0 && echo "PASS: IPv6 masquerade $natflags for ns2"
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
|
||||
return $lret
|
||||
}
|
||||
|
||||
test_masquerade()
|
||||
{
|
||||
<<<<<<< HEAD
|
||||
local family=$1
|
||||
=======
|
||||
local natflags=$1
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
local lret=0
|
||||
|
||||
ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
|
||||
@@ -449,7 +472,7 @@ test_masquerade()
|
||||
|
||||
ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: canot ping ns1 from ns2"
|
||||
echo "ERROR: cannot ping ns1 from ns2 $natflags"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
@@ -475,7 +498,7 @@ ip netns exec ns0 nft -f - <<EOF
|
||||
table $family nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
meta oif veth0 masquerade
|
||||
meta oif veth0 masquerade $natflags
|
||||
}
|
||||
}
|
||||
EOF
|
||||
@@ -486,7 +509,11 @@ EOF
|
||||
|
||||
ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
<<<<<<< HEAD
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active $family masquerading"
|
||||
=======
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ip masquere $natflags"
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
lret=1
|
||||
fi
|
||||
|
||||
@@ -522,13 +549,27 @@ EOF
|
||||
fi
|
||||
done
|
||||
|
||||
<<<<<<< HEAD
|
||||
ip netns exec ns0 nft flush chain $family nat postrouting
|
||||
=======
|
||||
ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
ip netns exec ns0 nft flush chain ip nat postrouting
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: Could not flush $family nat postrouting" 1>&2
|
||||
lret=1
|
||||
fi
|
||||
|
||||
<<<<<<< HEAD
|
||||
test $lret -eq 0 && echo "PASS: $family IP masquerade for ns2"
|
||||
=======
|
||||
test $lret -eq 0 && echo "PASS: IP masquerade $natflags for ns2"
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
|
||||
return $lret
|
||||
}
|
||||
@@ -802,11 +843,20 @@ $test_inet_nat && test_local_dnat inet
|
||||
$test_inet_nat && test_local_dnat6 inet
|
||||
|
||||
reset_counters
|
||||
<<<<<<< HEAD
|
||||
test_masquerade ip
|
||||
test_masquerade6 ip6
|
||||
reset_counters
|
||||
$test_inet_nat && test_masquerade inet
|
||||
$test_inet_nat && test_masquerade6 inet
|
||||
=======
|
||||
test_masquerade ""
|
||||
test_masquerade6 ""
|
||||
|
||||
reset_counters
|
||||
test_masquerade "fully-random"
|
||||
test_masquerade6 "fully-random"
|
||||
>>>>>>> cd8dead0c39457e58ec1d36db93aedca811d48f1
|
||||
|
||||
reset_counters
|
||||
test_redirect ip
|
||||
|
||||
@@ -187,8 +187,8 @@ static int make_exe(const uint8_t *payload, size_t len)
|
||||
ph.p_offset = 0;
|
||||
ph.p_vaddr = VADDR;
|
||||
ph.p_paddr = 0;
|
||||
ph.p_filesz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + sizeof(payload);
|
||||
ph.p_memsz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + sizeof(payload);
|
||||
ph.p_filesz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len;
|
||||
ph.p_memsz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len;
|
||||
ph.p_align = 4096;
|
||||
|
||||
fd = openat(AT_FDCWD, "/tmp", O_WRONLY|O_EXCL|O_TMPFILE, 0700);
|
||||
|
||||
@@ -46,12 +46,9 @@ static void fail(const char *fmt, unsigned long a, unsigned long b)
|
||||
|
||||
int main(void)
|
||||
{
|
||||
const unsigned int PAGE_SIZE = sysconf(_SC_PAGESIZE);
|
||||
#ifdef __arm__
|
||||
unsigned long va = 2 * PAGE_SIZE;
|
||||
#else
|
||||
unsigned long va = 0;
|
||||
#endif
|
||||
const int PAGE_SIZE = sysconf(_SC_PAGESIZE);
|
||||
const unsigned long va_max = 1UL << 32;
|
||||
unsigned long va;
|
||||
void *p;
|
||||
int fd;
|
||||
unsigned long a, b;
|
||||
@@ -60,10 +57,13 @@ int main(void)
|
||||
if (fd == -1)
|
||||
return 1;
|
||||
|
||||
p = mmap((void *)va, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
|
||||
if (p == MAP_FAILED) {
|
||||
if (errno == EPERM)
|
||||
return 4;
|
||||
for (va = 0; va < va_max; va += PAGE_SIZE) {
|
||||
p = mmap((void *)va, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
|
||||
if (p == (void *)va)
|
||||
break;
|
||||
}
|
||||
if (va == va_max) {
|
||||
fprintf(stderr, "error: mmap doesn't like you\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user