How to test the kernel netfilter logic?

How to test the kernel netfilter logic?

[Konstantin Khorenko]

Hello,

are there any tests for netfilter kernel logic?

i've taken a look at iptables and nftables repo,
there are a lot of tests, but all of them (if i see correctly)
are about loading/unloading rules, chains, etc,
but not actually checking that those rules work properly.

i mean i did not find tests which configure some rules,
then send traffic and check if the traffic is changed by the rule
in the expected way.

i understand that this is not userspace's work to process the traffic,
so i'd expect the tests somehow are bound to the kernel,
but did not find netfilter tests in kernel git repo as well.

Can you please help me?

Thank you in advance!

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

Re: How to test the kernel netfilter logic?

[Stefano Brivio]

Hi Konstantin,

On Mon, 25 May 2020 11:37:57 +0300
Konstantin Khorenko <khorenko@virtuozzo.com> wrote:

> but did not find netfilter tests in kernel git repo as well.

Have a look at tools/testing/selftests/netfilter/, some of the tests
there actually send traffic and check the outcome.

-- 
Stefano

Re: How to test the kernel netfilter logic?

[Konstantin Khorenko]

On 05/25/2020 03:50 PM, Stefano Brivio wrote:
> Hi Konstantin,
>
> On Mon, 25 May 2020 11:37:57 +0300
> Konstantin Khorenko <khorenko@virtuozzo.com> wrote:
>
>> but did not find netfilter tests in kernel git repo as well.
>
> Have a look at tools/testing/selftests/netfilter/, some of the tests
> there actually send traffic and check the outcome.

Hi Stefano,

thank you very much for the answer!

Yes, you are right, i know about that place, i just thought it's just for "smoke" testing:
"iptables" and "nftables" repos have many more testcases (for add/del rules),
so i thought there is some additional place with similar very detailed tests for kernel part.

If not, well, it's great we have a least those! :)

Have a nice day!

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

Re: How to test the kernel netfilter logic?

[Stefano Brivio]

On Mon, 25 May 2020 17:00:24 +0300
Konstantin Khorenko <khorenko@virtuozzo.com> wrote:

> On 05/25/2020 03:50 PM, Stefano Brivio wrote:
> > Hi Konstantin,
> >
> > On Mon, 25 May 2020 11:37:57 +0300
> > Konstantin Khorenko <khorenko@virtuozzo.com> wrote:
> >  
> >> but did not find netfilter tests in kernel git repo as well.  
> >
> > Have a look at tools/testing/selftests/netfilter/, some of the tests
> > there actually send traffic and check the outcome.  
> 
> Hi Stefano,
> 
> thank you very much for the answer!
> 
> Yes, you are right, i know about that place, i just thought it's just
> for "smoke" testing:

Well, I'd say it's a bit more than that, some tests there cover
specific functionalities rather extensively. Still:

> "iptables" and "nftables" repos have many more testcases (for add/del
> rules), so i thought there is some additional place with similar very
> detailed tests for kernel part.

...I'm not aware of any (except for ipset cases that actually test both
sides with packets, see http://git.netfilter.org/ipset/tree/tests).

Sure, I think it would be great to have something with actual traffic
at the same level of detail as nft tests, though.

-- 
Stefano

Re: How to test the kernel netfilter logic?

[Konstantin Khorenko]

On 05/26/2020 02:12 AM, Stefano Brivio wrote:
>> Yes, you are right, i know about that place, i just thought it's just
>> for "smoke" testing:
>
> Well, I'd say it's a bit more than that, some tests there cover
> specific functionalities rather extensively.

Yes, i take it back, taking more closer look reveals those tests
are quite big in size and perform deep testing.
Not for all functionality surely, but still - very good! :)

Thank you once again!

--
Best regards,

Konstantin Khorenko