Re: How to test the kernel netfilter logic?

[Stefano Brivio <sbrivio@redhat.com>]

On Mon, 25 May 2020 17:00:24 +0300
Konstantin Khorenko <khorenko@virtuozzo.com> wrote:

> On 05/25/2020 03:50 PM, Stefano Brivio wrote:
> > Hi Konstantin,
> >
> > On Mon, 25 May 2020 11:37:57 +0300
> > Konstantin Khorenko <khorenko@virtuozzo.com> wrote:
> >  
> >> but did not find netfilter tests in kernel git repo as well.  
> >
> > Have a look at tools/testing/selftests/netfilter/, some of the tests
> > there actually send traffic and check the outcome.  
> 
> Hi Stefano,
> 
> thank you very much for the answer!
> 
> Yes, you are right, i know about that place, i just thought it's just
> for "smoke" testing:

Well, I'd say it's a bit more than that, some tests there cover
specific functionalities rather extensively. Still:

> "iptables" and "nftables" repos have many more testcases (for add/del
> rules), so i thought there is some additional place with similar very
> detailed tests for kernel part.

...I'm not aware of any (except for ipset cases that actually test both
sides with packets, see http://git.netfilter.org/ipset/tree/tests).

Sure, I think it would be great to have something with actual traffic
at the same level of detail as nft tests, though.

-- 
Stefano