From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.netfilter.org (mail.netfilter.org [217.70.190.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 87BEB2BCF5F; Thu, 22 May 2025 16:53:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.190.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747932822; cv=none; b=QD78MrrG9TOgj1VoBF/Bu3xNCxJIiRjVrKYe65Z/l/LEpapWGtT6RP1JOAck71/VJHL6FPbhm/pCO7uacG9uZ3za+FZS9relI2wwBRlcu/vVpLBlCmnR0nrd4bMYbri25CXeiBjpjgn3AGG9b8BOx1xndY0hQorja68+3kx8wHo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747932822; c=relaxed/simple; bh=+WyuSzY8iTXakgKPrZTOoJAzKr6no3oaF9Hoo6viGco=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ttSWi19fC6lZ8e10EEORExhO69MsPUL/yazll+0pd+j8/7h/NkmlbkLqk8HHLlkFvriAW8tRoVAp42NCaJ3lpxqLVSVO+gaXQrsC/ejnKJ1WIM08T6BZOqrRy1hOArh3BxQd8cIpHMuDMqgGJjDIpaL8CsYOCTZ/hRXfxSPQC0k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org; spf=pass smtp.mailfrom=netfilter.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b=dYdatpep; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b=aZN+ZgTA; arc=none smtp.client-ip=217.70.190.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=netfilter.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b="dYdatpep"; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b="aZN+ZgTA" Received: by mail.netfilter.org (Postfix, from userid 109) id 350226070B; Thu, 22 May 2025 18:53:39 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org; s=2025; t=1747932819; bh=fgtfte1RQBzSglXlyusqVeme6v6O+BEQRvyDXs0vEDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dYdatpeph32JOoBRgFUK91ZAjlCfdFQm17J4vX1qftDJnGY11k79zk/cAkh7T4Kq1 J1V2ohw/erkwYHr69B3C+B2KQYp6sNKuKRMW/dXFhRjrZnRTAiJUIRAdDWkcY1wJUi b0c593PEQ+fwWZ9b78ans/vx08+JO8LrBcAtR/D2EkeRwlLgCXmvQnaUBVZ56Ymcbi DBOe1GmShAIl8P7JROCe7oH3fpQpgHpuRfivUWpgKb8JCywv4j8tk00zWswfb0BLq0 vX5IOAEFaRmmc8mEckYbk7CSMUZHMg60Mu4EGZxNV/zzHzD/4kxN01OxT6vmCAtJu7 9653RLiL4q1qg== X-Spam-Level: Received: from localhost.localdomain (mail-agni [217.70.190.124]) by mail.netfilter.org (Postfix) with ESMTPSA id 605BE60726; Thu, 22 May 2025 18:53:04 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org; s=2025; t=1747932784; bh=fgtfte1RQBzSglXlyusqVeme6v6O+BEQRvyDXs0vEDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aZN+ZgTAQyrMz2c8vFRP6QFqF92lWZRMZsjGfnsY1ehl+6gHvfotlTbg1HVpe8HZn qv0S0tJf2u0QW8S2MIgbdYHcfVkS14ug+IkeqLsnhUEY4pYpIRNakQ6nfJEVwO5XU4 dBl5Q7h1TsOBpZ3wiUfeGNvTRifo2kSpFx/DLzfCUNbtNhH+s3SIre49bV17FTlEEo u66sVb0i1AqGZ1xitRRSSJfWJl/Pymzgpyylrf0bfx1Msn1l6ducLp++o5Aicv6Gvp SXiVee9df61WOkwHE9WfzJMvPi/urFaTeu8rit6BsrvaMrfo71T+dHhb733krs9YAS 4jG1O8S/THDXw== From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@google.com, fw@strlen.de, horms@kernel.org Subject: [PATCH net-next 26/26] selftests: netfilter: Torture nftables netdev hooks Date: Thu, 22 May 2025 18:52:38 +0200 Message-Id: <20250522165238.378456-27-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20250522165238.378456-1-pablo@netfilter.org> References: <20250522165238.378456-1-pablo@netfilter.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Phil Sutter Add a ruleset which binds to various interface names via netdev-family chains and flowtables and massage the notifiers by frequently renaming interfaces to match these names. While doing so: - Keep an 'nft monitor' running in background to receive the notifications - Loop over 'nft list ruleset' to exercise ruleset dump codepath - Have iperf running so the involved chains/flowtables see traffic If supported, also test interface wildcard support separately by creating a flowtable with 'wild*' interface spec and quickly add/remove matching dummy interfaces. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- .../testing/selftests/net/netfilter/Makefile | 1 + .../net/netfilter/nft_interface_stress.sh | 151 ++++++++++++++++++ 2 files changed, 152 insertions(+) create mode 100755 tools/testing/selftests/net/netfilter/nft_interface_stress.sh diff --git a/tools/testing/selftests/net/netfilter/Makefile b/tools/testing/selftests/net/netfilter/Makefile index 3bdcbbdba925..e9b2f553588d 100644 --- a/tools/testing/selftests/net/netfilter/Makefile +++ b/tools/testing/selftests/net/netfilter/Makefile @@ -24,6 +24,7 @@ TEST_PROGS += nft_concat_range.sh TEST_PROGS += nft_conntrack_helper.sh TEST_PROGS += nft_fib.sh TEST_PROGS += nft_flowtable.sh +TEST_PROGS += nft_interface_stress.sh TEST_PROGS += nft_meta.sh TEST_PROGS += nft_nat.sh TEST_PROGS += nft_nat_zones.sh diff --git a/tools/testing/selftests/net/netfilter/nft_interface_stress.sh b/tools/testing/selftests/net/netfilter/nft_interface_stress.sh new file mode 100755 index 000000000000..11d82d11495e --- /dev/null +++ b/tools/testing/selftests/net/netfilter/nft_interface_stress.sh @@ -0,0 +1,151 @@ +#!/bin/bash -e +# +# SPDX-License-Identifier: GPL-2.0 +# +# Torture nftables' netdevice notifier callbacks and related code by frequent +# renaming of interfaces which netdev-family chains and flowtables hook into. + +source lib.sh + +checktool "nft --version" "run test without nft tool" +checktool "iperf3 --version" "run test without iperf3 tool" + +# how many seconds to torture the kernel? +# default to 80% of max run time but don't exceed 48s +TEST_RUNTIME=$((${kselftest_timeout:-60} * 8 / 10)) +[[ $TEST_RUNTIME -gt 48 ]] && TEST_RUNTIME=48 + +trap "cleanup_all_ns" EXIT + +setup_ns nsc nsr nss + +ip -net $nsc link add cr0 type veth peer name rc0 netns $nsr +ip -net $nsc addr add 10.0.0.1/24 dev cr0 +ip -net $nsc link set cr0 up +ip -net $nsc route add default via 10.0.0.2 + +ip -net $nss link add sr0 type veth peer name rs0 netns $nsr +ip -net $nss addr add 10.1.0.1/24 dev sr0 +ip -net $nss link set sr0 up +ip -net $nss route add default via 10.1.0.2 + +ip -net $nsr addr add 10.0.0.2/24 dev rc0 +ip -net $nsr link set rc0 up +ip -net $nsr addr add 10.1.0.2/24 dev rs0 +ip -net $nsr link set rs0 up +ip netns exec $nsr sysctl -q net.ipv4.ip_forward=1 +ip netns exec $nsr sysctl -q net.ipv4.conf.all.forwarding=1 + +{ + echo "table netdev t {" + for ((i = 0; i < 10; i++)); do + cat <<-EOF + chain chain_rc$i { + type filter hook ingress device rc$i priority 0 + counter + } + chain chain_rs$i { + type filter hook ingress device rs$i priority 0 + counter + } + EOF + done + echo "}" + echo "table ip t {" + for ((i = 0; i < 10; i++)); do + cat <<-EOF + flowtable ft_${i} { + hook ingress priority 0 + devices = { rc$i, rs$i } + } + EOF + done + echo "chain c {" + echo "type filter hook forward priority 0" + for ((i = 0; i < 10; i++)); do + echo -n "iifname rc$i oifname rs$i " + echo "ip protocol tcp counter flow add @ft_${i}" + done + echo "counter" + echo "}" + echo "}" +} | ip netns exec $nsr nft -f - || { + echo "SKIP: Could not load nft ruleset" + exit $ksft_skip +} + +for ((o=0, n=1; ; o=n, n++, n %= 10)); do + ip -net $nsr link set rc$o name rc$n + ip -net $nsr link set rs$o name rs$n +done & +rename_loop_pid=$! + +while true; do ip netns exec $nsr nft list ruleset >/dev/null 2>&1; done & +nft_list_pid=$! + +ip netns exec $nsr nft monitor >/dev/null & +nft_monitor_pid=$! + +ip netns exec $nss iperf3 --server --daemon -1 +summary_expr='s,^\[SUM\] .* \([0-9\.]\+\) Kbits/sec .* receiver,\1,p' +rate=$(ip netns exec $nsc iperf3 \ + --format k -c 10.1.0.1 --time $TEST_RUNTIME \ + --length 56 --parallel 10 -i 0 | sed -n "$summary_expr") + +kill $nft_list_pid +kill $nft_monitor_pid +kill $rename_loop_pid +wait + +ip netns exec $nsr nft -f - <