From: Hangbin Liu <[email protected]> During the conversion, we retain the same filter and chain names previously used by iptables/ip6tables. Counters are not added to accept rules because the test does not inspect them. The syn mark rule is removed as it is only for debugging, which could be added easily when needed.
After conversion, the generated output matches the original iptables/ip6tables behavior. Signed-off-by: Hangbin Liu <[email protected]> Reviewed-by: Matthieu Baerts (NGI0) <[email protected]> Signed-off-by: Matthieu Baerts (NGI0) <[email protected]> --- To: Shuah Khan <[email protected]> Cc: [email protected] v2: - Use nft --version + JSON to support old/weird versions. (Clashiko) - Remove syn mark rule. (Clashiko) --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 9 +++- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 53 ++++++++++++---------- 2 files changed, 36 insertions(+), 26 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh index b9d14647f401..20853d0198ff 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,14 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"*) + "nft") + if ! nft --version &> /dev/null || \ + ! nft -j list ruleset &> /dev/null; then + mptcp_lib_pr_skip "Could not run all tests without nft -j" + exit ${KSFT_SKIP} + fi + ;; + "iptables"* | "ip6tables"* | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh index e850a87429b6..ef2738720e24 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh @@ -15,8 +15,6 @@ cin="" cout="" timeout_poll=30 timeout_test=$((timeout_poll * 2 + 1)) -iptables="iptables" -ip6tables="ip6tables" ns1="" ns2="" @@ -49,16 +47,22 @@ add_mark_rules() local ns=$1 local m=$2 - local t - for t in ${iptables} ${ip6tables}; do - # just to debug: check we have multiple subflows connection requests - ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT + local table + for table in ip ip6; do + ip netns exec "$ns" nft -f - <<-EOF + add table $table filter + add chain $table filter OUTPUT \ + { type filter hook output priority 0; policy accept; } - # RST packets might be handled by a internal dummy socket - ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT + # RST packets might be handled by a internal dummy socket + add rule $table filter OUTPUT \ + tcp flags & rst == rst meta mark 0x0 accept - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark $m accept + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark 0 counter drop + EOF done } @@ -105,32 +109,31 @@ cleanup() mptcp_lib_check_mptcp mptcp_lib_check_kallsyms -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}" +mptcp_lib_check_tools ip nft jq check_mark() { local ns=$1 local af=$2 - local tables=${iptables} + local tables="ip" if [ $af -eq 6 ];then - tables=${ip6tables} + tables="ip6" fi - local counters values - counters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP) - values=${counters%DROP*} + local drops + drops=$(ip netns exec "$ns" nft -j list table "$tables" filter | \ + jq '.nftables[] | select(has("rule")) | .rule | + select (.chain=="OUTPUT" and any(.expr[]; has("drop"))) | + .expr[] | select(has("counter")) | .counter.packets') - local v - for v in $values; do - if [ $v -ne 0 ]; then - mptcp_lib_pr_fail "got $tables $values in ns $ns," \ - "not 0 - not all expected packets marked" - ret=${KSFT_FAIL} - return 1 - fi - done + if [ -z "$drops" ] || [ "$drops" -ne 0 ]; then + mptcp_lib_pr_fail "got $tables $drops in ns $ns," \ + "not 0 - not all expected packets marked" + ret=${KSFT_FAIL} + return 1 + fi return 0 } -- 2.55.0
