Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:
====================
Netfilter/IPVS fixes for net
The following patchset contains Netfilter/IPVS fixes for your net tree:
1) Add a selftest for icmp packet too big errors with conntrack, from
Florian Westphal.
2) Validate inner header in ICMP error message does not lie to us
in conntrack, also from Florian.
3) Initialize ct->timeout to calm down KASAN, from Alexander Potapenko.
4) Skip ICMP error messages from tunnels in IPVS, from Julian Anastasov.
5) Use a hash to expose conntrack and expectation ID, from Florian Westphal.
6) Prevent shift wrap in nft_chain_parse_hook(), from Dan Carpenter.
7) Fix broken ICMP ID randomization with NAT, also from Florian.
8) Remove WARN_ON in ebtables compat that is reached via syzkaller,
from Florian Westphal.
9) Fix broken timestamps since fb420d5d91 ("tcp/fq: move back to
CLOCK_MONOTONIC"), from Florian.
10) Fix logging of invalid packets in conntrack, from Andrei Vagin.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller
@@ -1,6 +1,6 @@
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
# Makefile for netfilter selftests
|
||||
|
||||
TEST_PROGS := nft_trans_stress.sh nft_nat.sh
|
||||
TEST_PROGS := nft_trans_stress.sh nft_nat.sh conntrack_icmp_related.sh
|
||||
|
||||
include ../lib.mk
|
||||
|
||||
283
tools/testing/selftests/netfilter/conntrack_icmp_related.sh
Executable file
283
tools/testing/selftests/netfilter/conntrack_icmp_related.sh
Executable file
@@ -0,0 +1,283 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# check that ICMP df-needed/pkttoobig icmp are set are set as related
|
||||
# state
|
||||
#
|
||||
# Setup is:
|
||||
#
|
||||
# nsclient1 -> nsrouter1 -> nsrouter2 -> nsclient2
|
||||
# MTU 1500, except for nsrouter2 <-> nsclient2 link (1280).
|
||||
# ping nsclient2 from nsclient1, checking that conntrack did set RELATED
|
||||
# 'fragmentation needed' icmp packet.
|
||||
#
|
||||
# In addition, nsrouter1 will perform IP masquerading, i.e. also
|
||||
# check the icmp errors are propagated to the correct host as per
|
||||
# nat of "established" icmp-echo "connection".
|
||||
|
||||
# Kselftest framework requirement - SKIP code is 4.
|
||||
ksft_skip=4
|
||||
ret=0
|
||||
|
||||
nft --version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
echo "SKIP: Could not run test without nft tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
ip -Version > /dev/null 2>&1
|
||||
if [ $? -ne 0 ];then
|
||||
echo "SKIP: Could not run test without ip tool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
|
||||
cleanup() {
|
||||
for i in 1 2;do ip netns del nsclient$i;done
|
||||
for i in 1 2;do ip netns del nsrouter$i;done
|
||||
}
|
||||
|
||||
ipv4() {
|
||||
echo -n 192.168.$1.2
|
||||
}
|
||||
|
||||
ipv6 () {
|
||||
echo -n dead:$1::2
|
||||
}
|
||||
|
||||
check_counter()
|
||||
{
|
||||
ns=$1
|
||||
name=$2
|
||||
expect=$3
|
||||
local lret=0
|
||||
|
||||
cnt=$(ip netns exec $ns nft list counter inet filter "$name" | grep -q "$expect")
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
|
||||
ip netns exec $ns nft list counter inet filter "$name" 1>&2
|
||||
lret=1
|
||||
fi
|
||||
|
||||
return $lret
|
||||
}
|
||||
|
||||
check_unknown()
|
||||
{
|
||||
expect="packets 0 bytes 0"
|
||||
for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
|
||||
check_counter $n "unknown" "$expect"
|
||||
if [ $? -ne 0 ] ;then
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
|
||||
ip netns add $n
|
||||
ip -net $n link set lo up
|
||||
done
|
||||
|
||||
DEV=veth0
|
||||
ip link add $DEV netns nsclient1 type veth peer name eth1 netns nsrouter1
|
||||
DEV=veth0
|
||||
ip link add $DEV netns nsclient2 type veth peer name eth1 netns nsrouter2
|
||||
|
||||
DEV=veth0
|
||||
ip link add $DEV netns nsrouter1 type veth peer name eth2 netns nsrouter2
|
||||
|
||||
DEV=veth0
|
||||
for i in 1 2; do
|
||||
ip -net nsclient$i link set $DEV up
|
||||
ip -net nsclient$i addr add $(ipv4 $i)/24 dev $DEV
|
||||
ip -net nsclient$i addr add $(ipv6 $i)/64 dev $DEV
|
||||
done
|
||||
|
||||
ip -net nsrouter1 link set eth1 up
|
||||
ip -net nsrouter1 link set veth0 up
|
||||
|
||||
ip -net nsrouter2 link set eth1 up
|
||||
ip -net nsrouter2 link set eth2 up
|
||||
|
||||
ip -net nsclient1 route add default via 192.168.1.1
|
||||
ip -net nsclient1 -6 route add default via dead:1::1
|
||||
|
||||
ip -net nsclient2 route add default via 192.168.2.1
|
||||
ip -net nsclient2 route add default via dead:2::1
|
||||
|
||||
i=3
|
||||
ip -net nsrouter1 addr add 192.168.1.1/24 dev eth1
|
||||
ip -net nsrouter1 addr add 192.168.3.1/24 dev veth0
|
||||
ip -net nsrouter1 addr add dead:1::1/64 dev eth1
|
||||
ip -net nsrouter1 addr add dead:3::1/64 dev veth0
|
||||
ip -net nsrouter1 route add default via 192.168.3.10
|
||||
ip -net nsrouter1 -6 route add default via dead:3::10
|
||||
|
||||
ip -net nsrouter2 addr add 192.168.2.1/24 dev eth1
|
||||
ip -net nsrouter2 addr add 192.168.3.10/24 dev eth2
|
||||
ip -net nsrouter2 addr add dead:2::1/64 dev eth1
|
||||
ip -net nsrouter2 addr add dead:3::10/64 dev eth2
|
||||
ip -net nsrouter2 route add default via 192.168.3.1
|
||||
ip -net nsrouter2 route add default via dead:3::1
|
||||
|
||||
sleep 2
|
||||
for i in 4 6; do
|
||||
ip netns exec nsrouter1 sysctl -q net.ipv$i.conf.all.forwarding=1
|
||||
ip netns exec nsrouter2 sysctl -q net.ipv$i.conf.all.forwarding=1
|
||||
done
|
||||
|
||||
for netns in nsrouter1 nsrouter2; do
|
||||
ip netns exec $netns nft -f - <<EOF
|
||||
table inet filter {
|
||||
counter unknown { }
|
||||
counter related { }
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy accept;
|
||||
meta l4proto icmpv6 icmpv6 type "packet-too-big" ct state "related" counter name "related" accept
|
||||
meta l4proto icmp icmp type "destination-unreachable" ct state "related" counter name "related" accept
|
||||
meta l4proto { icmp, icmpv6 } ct state new,established accept
|
||||
counter name "unknown" drop
|
||||
}
|
||||
}
|
||||
EOF
|
||||
done
|
||||
|
||||
ip netns exec nsclient1 nft -f - <<EOF
|
||||
table inet filter {
|
||||
counter unknown { }
|
||||
counter related { }
|
||||
chain input {
|
||||
type filter hook input priority 0; policy accept;
|
||||
meta l4proto { icmp, icmpv6 } ct state established,untracked accept
|
||||
|
||||
meta l4proto { icmp, icmpv6 } ct state "related" counter name "related" accept
|
||||
counter name "unknown" drop
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
ip netns exec nsclient2 nft -f - <<EOF
|
||||
table inet filter {
|
||||
counter unknown { }
|
||||
counter new { }
|
||||
counter established { }
|
||||
|
||||
chain input {
|
||||
type filter hook input priority 0; policy accept;
|
||||
meta l4proto { icmp, icmpv6 } ct state established,untracked accept
|
||||
|
||||
meta l4proto { icmp, icmpv6 } ct state "new" counter name "new" accept
|
||||
meta l4proto { icmp, icmpv6 } ct state "established" counter name "established" accept
|
||||
counter name "unknown" drop
|
||||
}
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
meta l4proto { icmp, icmpv6 } ct state established,untracked accept
|
||||
|
||||
meta l4proto { icmp, icmpv6 } ct state "new" counter name "new"
|
||||
meta l4proto { icmp, icmpv6 } ct state "established" counter name "established"
|
||||
counter name "unknown" drop
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
|
||||
# make sure NAT core rewrites adress of icmp error if nat is used according to
|
||||
# conntrack nat information (icmp error will be directed at nsrouter1 address,
|
||||
# but it needs to be routed to nsclient1 address).
|
||||
ip netns exec nsrouter1 nft -f - <<EOF
|
||||
table ip nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
ip protocol icmp oifname "veth0" counter masquerade
|
||||
}
|
||||
}
|
||||
table ip6 nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
ip6 nexthdr icmpv6 oifname "veth0" counter masquerade
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
ip netns exec nsrouter2 ip link set eth1 mtu 1280
|
||||
ip netns exec nsclient2 ip link set veth0 mtu 1280
|
||||
sleep 1
|
||||
|
||||
ip netns exec nsclient1 ping -c 1 -s 1000 -q -M do 192.168.2.2 >/dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: netns ip routing/connectivity broken" 1>&2
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
ip netns exec nsclient1 ping6 -q -c 1 -s 1000 dead:2::2 >/dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: netns ipv6 routing/connectivity broken" 1>&2
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
|
||||
check_unknown
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
|
||||
expect="packets 0 bytes 0"
|
||||
for netns in nsrouter1 nsrouter2 nsclient1;do
|
||||
check_counter "$netns" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
done
|
||||
|
||||
expect="packets 2 bytes 2076"
|
||||
check_counter nsclient2 "new" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
|
||||
ip netns exec nsclient1 ping -q -c 1 -s 1300 -M do 192.168.2.2 > /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "ERROR: ping should have failed with PMTU too big error" 1>&2
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# nsrouter2 should have generated the icmp error, so
|
||||
# related counter should be 0 (its in forward).
|
||||
expect="packets 0 bytes 0"
|
||||
check_counter "nsrouter2" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# but nsrouter1 should have seen it, same for nsclient1.
|
||||
expect="packets 1 bytes 576"
|
||||
for netns in nsrouter1 nsclient1;do
|
||||
check_counter "$netns" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
done
|
||||
|
||||
ip netns exec nsclient1 ping6 -c 1 -s 1300 dead:2::2 > /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "ERROR: ping6 should have failed with PMTU too big error" 1>&2
|
||||
ret=1
|
||||
fi
|
||||
|
||||
expect="packets 2 bytes 1856"
|
||||
for netns in nsrouter1 nsclient1;do
|
||||
check_counter "$netns" "related" "$expect"
|
||||
if [ $? -ne 0 ]; then
|
||||
ret=1
|
||||
fi
|
||||
done
|
||||
|
||||
if [ $ret -eq 0 ];then
|
||||
echo "PASS: icmp mtu error had RELATED state"
|
||||
else
|
||||
echo "ERROR: icmp error RELATED state test has failed"
|
||||
fi
|
||||
|
||||
cleanup
|
||||
exit $ret
|
||||
@@ -321,6 +321,7 @@ EOF
|
||||
|
||||
test_masquerade6()
|
||||
{
|
||||
local natflags=$1
|
||||
local lret=0
|
||||
|
||||
ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
|
||||
@@ -354,13 +355,13 @@ ip netns exec ns0 nft -f - <<EOF
|
||||
table ip6 nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
meta oif veth0 masquerade
|
||||
meta oif veth0 masquerade $natflags
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading"
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
@@ -397,19 +398,26 @@ EOF
|
||||
fi
|
||||
done
|
||||
|
||||
ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
ip netns exec ns0 nft flush chain ip6 nat postrouting
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: Could not flush ip6 nat postrouting" 1>&2
|
||||
lret=1
|
||||
fi
|
||||
|
||||
test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2"
|
||||
test $lret -eq 0 && echo "PASS: IPv6 masquerade $natflags for ns2"
|
||||
|
||||
return $lret
|
||||
}
|
||||
|
||||
test_masquerade()
|
||||
{
|
||||
local natflags=$1
|
||||
local lret=0
|
||||
|
||||
ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
|
||||
@@ -417,7 +425,7 @@ test_masquerade()
|
||||
|
||||
ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: canot ping ns1 from ns2"
|
||||
echo "ERROR: cannot ping ns1 from ns2 $natflags"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
@@ -443,13 +451,13 @@ ip netns exec ns0 nft -f - <<EOF
|
||||
table ip nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 0; policy accept;
|
||||
meta oif veth0 masquerade
|
||||
meta oif veth0 masquerade $natflags
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading"
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ip masquere $natflags"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
@@ -485,13 +493,19 @@ EOF
|
||||
fi
|
||||
done
|
||||
|
||||
ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
|
||||
if [ $? -ne 0 ] ; then
|
||||
echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)"
|
||||
lret=1
|
||||
fi
|
||||
|
||||
ip netns exec ns0 nft flush chain ip nat postrouting
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: Could not flush nat postrouting" 1>&2
|
||||
lret=1
|
||||
fi
|
||||
|
||||
test $lret -eq 0 && echo "PASS: IP masquerade for ns2"
|
||||
test $lret -eq 0 && echo "PASS: IP masquerade $natflags for ns2"
|
||||
|
||||
return $lret
|
||||
}
|
||||
@@ -750,8 +764,12 @@ test_local_dnat
|
||||
test_local_dnat6
|
||||
|
||||
reset_counters
|
||||
test_masquerade
|
||||
test_masquerade6
|
||||
test_masquerade ""
|
||||
test_masquerade6 ""
|
||||
|
||||
reset_counters
|
||||
test_masquerade "fully-random"
|
||||
test_masquerade6 "fully-random"
|
||||
|
||||
reset_counters
|
||||
test_redirect
|
||||
|
||||
Reference in New Issue
Block a user