* [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing
@ 2025-01-06 8:10 Hangbin Liu
2025-01-06 8:10 ` [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft Hangbin Liu
` (2 more replies)
0 siblings, 3 replies; 14+ messages in thread
From: Hangbin Liu @ 2025-01-06 8:10 UTC (permalink / raw)
To: netdev
Cc: Jason A. Donenfeld, Jakub Kicinski, Shuah Khan, David S. Miller,
Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek,
Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel,
Hangbin Liu
This patch set convert iptables to nftables for wireguard testing, as
iptables is deparated and nftables is the default framework of most releases.
v3: drop iptables directly (Jason A. Donenfeld)
Also convert to using nft for qemu testing (Jason A. Donenfeld)
v2: use one nft table for testing (Phil Sutter)
Hangbin Liu (2):
selftests: wireguards: convert iptables to nft
selftests: wireguard: update to using nft for qemu test
tools/testing/selftests/wireguard/netns.sh | 29 +++++++++-----
.../testing/selftests/wireguard/qemu/Makefile | 40 ++++++++++++++-----
.../selftests/wireguard/qemu/kernel.config | 7 ++--
3 files changed, 53 insertions(+), 23 deletions(-)
--
2.46.0
^ permalink raw reply [flat|nested] 14+ messages in thread* [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft 2025-01-06 8:10 [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu @ 2025-01-06 8:10 ` Hangbin Liu 2025-03-19 16:10 ` Jason A. Donenfeld 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test Hangbin Liu 2025-03-18 10:24 ` [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu 2 siblings, 1 reply; 14+ messages in thread From: Hangbin Liu @ 2025-01-06 8:10 UTC (permalink / raw) To: netdev Cc: Jason A. Donenfeld, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel, Hangbin Liu Convert iptabels to nft as it is the replacement for iptables, which is used by default in most releases. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> --- tools/testing/selftests/wireguard/netns.sh | 29 ++++++++++++++-------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh index 55500f901fbc..4032384e6747 100755 --- a/tools/testing/selftests/wireguard/netns.sh +++ b/tools/testing/selftests/wireguard/netns.sh @@ -75,6 +75,11 @@ pp ip netns add $netns1 pp ip netns add $netns2 ip0 link set up dev lo +# init nft tables +n0 nft add table ip wgtest +n1 nft add table ip wgtest +n2 nft add table ip wgtest + ip0 link add dev wg0 type wireguard ip0 link set wg0 netns $netns1 ip0 link add dev wg0 type wireguard @@ -196,13 +201,14 @@ ip1 link set wg0 mtu 1300 ip2 link set wg0 mtu 1300 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2 n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1 -n0 iptables -A INPUT -m length --length 1360 -j DROP +n0 nft add chain ip wgtest INPUT { type filter hook input priority filter \; policy accept \; } +n0 nft add rule ip wgtest INPUT meta length 1360 counter drop n1 ip route add 192.168.241.2/32 dev wg0 mtu 1299 n2 ip route add 192.168.241.1/32 dev wg0 mtu 1299 n2 ping -c 1 -W 1 -s 1269 192.168.241.1 n2 ip route delete 192.168.241.1/32 dev wg0 mtu 1299 n1 ip route delete 192.168.241.2/32 dev wg0 mtu 1299 -n0 iptables -F INPUT +n0 nft flush table ip wgtest ip1 link set wg0 mtu $orig_mtu ip2 link set wg0 mtu $orig_mtu @@ -335,7 +341,8 @@ n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward' [[ -e /proc/sys/net/netfilter/nf_conntrack_udp_timeout ]] || modprobe nf_conntrack n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout' n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream' -n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT --to 10.0.0.1 +n0 nft add chain ip wgtest POSTROUTING { type nat hook postrouting priority srcnat\; policy accept \; } +n0 nft add rule ip wgtest POSTROUTING ip saddr 192.168.1.0/24 ip daddr 10.0.0.0/24 counter snat to 10.0.0.1 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.100:2 persistent-keepalive 1 n1 ping -W 1 -c 1 192.168.241.2 @@ -349,10 +356,11 @@ n1 wg set wg0 peer "$pub2" persistent-keepalive 0 # Test that sk_bound_dev_if works n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # What about when the mark changes and the packet must be rerouted? -n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1 +n1 nft add chain ip wgtest OUTPUT { type route hook output priority mangle\; policy accept \; } +n1 nft add rule ip wgtest OUTPUT counter meta mark set 0x1 n1 ping -c 1 -W 1 192.168.241.2 # First the boring case n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case -n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1 +n1 nft flush table ip wgtest # Test that onion routing works, even when it loops n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5 @@ -386,16 +394,17 @@ n1 ping -W 1 -c 100 -f 192.168.99.7 n1 ping -W 1 -c 100 -f abab::1111 # Have ns2 NAT into wg0 packets from ns0, but return an icmp error along the right route. -n2 iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 192.168.241.0/24 -j SNAT --to 192.168.241.2 -n0 iptables -t filter -A INPUT \! -s 10.0.0.0/24 -i vethrs -j DROP # Manual rpfilter just to be explicit. +n2 nft add chain ip wgtest POSTROUTING { type nat hook postrouting priority srcnat\; policy accept \; } +n2 nft add rule ip wgtest POSTROUTING ip saddr 10.0.0.0/24 ip daddr 192.168.241.0/24 counter snat to 192.168.241.2 +n0 nft add chain ip wgtest INPUT { type filter hook input priority filter \; policy accept \; } +n0 nft add rule ip wgtest INPUT iifname "vethrs" ip saddr != 10.0.0.0/24 counter drop n2 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward' ip0 -4 route add 192.168.241.1 via 10.0.0.100 n2 wg set wg0 peer "$pub1" remove [[ $(! n0 ping -W 1 -c 1 192.168.241.1 || false) == *"From 10.0.0.100 icmp_seq=1 Destination Host Unreachable"* ]] -n0 iptables -t nat -F -n0 iptables -t filter -F -n2 iptables -t nat -F +n0 nft flush table ip wgtest +n2 nft flush table ip wgtest ip0 link del vethrc ip0 link del vethrs ip1 link del wg0 -- 2.46.0 ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft Hangbin Liu @ 2025-03-19 16:10 ` Jason A. Donenfeld 0 siblings, 0 replies; 14+ messages in thread From: Jason A. Donenfeld @ 2025-03-19 16:10 UTC (permalink / raw) To: Hangbin Liu Cc: netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Mon, Jan 06, 2025 at 08:10:42AM +0000, Hangbin Liu wrote: > +n0 nft add rule ip wgtest INPUT meta length 1360 counter drop What's the point of `counter` here? It's never read back. > +n0 nft add rule ip wgtest POSTROUTING ip saddr 192.168.1.0/24 ip daddr 10.0.0.0/24 counter snat to 10.0.0.1 Ditto. > +n1 nft add rule ip wgtest OUTPUT counter meta mark set 0x1 Ditto. > +n2 nft add rule ip wgtest POSTROUTING ip saddr 10.0.0.0/24 ip daddr 192.168.241.0/24 counter snat to 192.168.241.2 Ditto. > +n0 nft add rule ip wgtest INPUT iifname "vethrs" ip saddr != 10.0.0.0/24 counter drop Ditto. ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-01-06 8:10 [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft Hangbin Liu @ 2025-01-06 8:10 ` Hangbin Liu 2025-03-19 16:15 ` Jason A. Donenfeld 2025-03-18 10:24 ` [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu 2 siblings, 1 reply; 14+ messages in thread From: Hangbin Liu @ 2025-01-06 8:10 UTC (permalink / raw) To: netdev Cc: Jason A. Donenfeld, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel, Hangbin Liu Since we will replace iptables with nft for wireguard netns testing, let's also convert the qemu test to use nft at the same time. Co-developed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> --- .../testing/selftests/wireguard/qemu/Makefile | 40 ++++++++++++++----- .../selftests/wireguard/qemu/kernel.config | 7 ++-- 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/tools/testing/selftests/wireguard/qemu/Makefile b/tools/testing/selftests/wireguard/qemu/Makefile index 35856b11c143..10e79449fefa 100644 --- a/tools/testing/selftests/wireguard/qemu/Makefile +++ b/tools/testing/selftests/wireguard/qemu/Makefile @@ -40,7 +40,9 @@ endef $(eval $(call tar_download,IPERF,iperf,3.11,.tar.gz,https://downloads.es.net/pub/iperf/,de8cb409fad61a0574f4cb07eb19ce1159707403ac2dc01b5d175e91240b7e5f)) $(eval $(call tar_download,BASH,bash,5.1.16,.tar.gz,https://ftp.gnu.org/gnu/bash/,5bac17218d3911834520dad13cd1f85ab944e1c09ae1aba55906be1f8192f558)) $(eval $(call tar_download,IPROUTE2,iproute2,5.17.0,.tar.gz,https://www.kernel.org/pub/linux/utils/net/iproute2/,bda331d5c4606138892f23a565d78fca18919b4d508a0b7ca8391c2da2db68b9)) -$(eval $(call tar_download,IPTABLES,iptables,1.8.7,.tar.bz2,https://www.netfilter.org/projects/iptables/files/,c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0)) +$(eval $(call tar_download,LIBMNL,libmnl,1.0.5,.tar.bz2,https://www.netfilter.org/projects/libmnl/files/,274b9b919ef3152bfb3da3a13c950dd60d6e2bcd54230ffeca298d03b40d0525)) +$(eval $(call tar_download,LIBNFTNL,libnftnl,1.2.8,.tar.xz,https://www.netfilter.org/projects/libnftnl/files/,37fea5d6b5c9b08de7920d298de3cdc942e7ae64b1a3e8b880b2d390ae67ad95)) +$(eval $(call tar_download,NFTABLES,nftables,1.1.1,.tar.xz,https://www.netfilter.org/projects/nftables/files/,6358830f3a64f31e39b0ad421d7dadcd240b72343ded48d8ef13b8faf204865a)) $(eval $(call tar_download,NMAP,nmap,7.92,.tgz,https://nmap.org/dist/,064183ea642dc4c12b1ab3b5358ce1cef7d2e7e11ffa2849f16d339f5b717117)) $(eval $(call tar_download,IPUTILS,iputils,s20190709,.tar.gz,https://github.com/iputils/iputils/archive/s20190709.tar.gz/#,a15720dd741d7538dd2645f9f516d193636ae4300ff7dbc8bfca757bf166490a)) $(eval $(call tar_download,WIREGUARD_TOOLS,wireguard-tools,1.0.20210914,.tar.xz,https://git.zx2c4.com/wireguard-tools/snapshot/,97ff31489217bb265b7ae850d3d0f335ab07d2652ba1feec88b734bc96bd05ac)) @@ -322,11 +324,12 @@ $(BUILD_PATH)/init-cpio-spec.txt: $(TOOLCHAIN_PATH)/.installed $(BUILD_PATH)/ini echo "file /bin/ss $(IPROUTE2_PATH)/misc/ss 755 0 0" >> $@ echo "file /bin/ping $(IPUTILS_PATH)/ping 755 0 0" >> $@ echo "file /bin/ncat $(NMAP_PATH)/ncat/ncat 755 0 0" >> $@ - echo "file /bin/xtables-legacy-multi $(IPTABLES_PATH)/iptables/xtables-legacy-multi 755 0 0" >> $@ - echo "slink /bin/iptables xtables-legacy-multi 777 0 0" >> $@ + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ echo "slink /bin/ping6 ping 777 0 0" >> $@ echo "dir /lib 755 0 0" >> $@ echo "file /lib/libc.so $(TOOLCHAIN_PATH)/$(CHOST)/lib/libc.so 755 0 0" >> $@ + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ echo "slink $$($(CHOST)-readelf -p .interp '$(BUILD_PATH)/init'| grep -o '/lib/.*') libc.so 777 0 0" >> $@ $(KERNEL_BUILD_PATH)/.config: $(TOOLCHAIN_PATH)/.installed kernel.config arch/$(ARCH).config @@ -338,7 +341,7 @@ $(KERNEL_BUILD_PATH)/.config: $(TOOLCHAIN_PATH)/.installed kernel.config arch/$( cd $(KERNEL_BUILD_PATH) && ARCH=$(KERNEL_ARCH) $(KERNEL_PATH)/scripts/kconfig/merge_config.sh -n $(KERNEL_BUILD_PATH)/.config $(KERNEL_BUILD_PATH)/minimal.config $(if $(findstring yes,$(DEBUG_KERNEL)),cp debug.config $(KERNEL_BUILD_PATH) && cd $(KERNEL_BUILD_PATH) && ARCH=$(KERNEL_ARCH) $(KERNEL_PATH)/scripts/kconfig/merge_config.sh -n $(KERNEL_BUILD_PATH)/.config debug.config,) -$(KERNEL_BZIMAGE): $(TOOLCHAIN_PATH)/.installed $(KERNEL_BUILD_PATH)/.config $(BUILD_PATH)/init-cpio-spec.txt $(IPERF_PATH)/src/iperf3 $(IPUTILS_PATH)/ping $(BASH_PATH)/bash $(IPROUTE2_PATH)/misc/ss $(IPROUTE2_PATH)/ip/ip $(IPTABLES_PATH)/iptables/xtables-legacy-multi $(NMAP_PATH)/ncat/ncat $(WIREGUARD_TOOLS_PATH)/src/wg $(BUILD_PATH)/init +$(KERNEL_BZIMAGE): $(TOOLCHAIN_PATH)/.installed $(KERNEL_BUILD_PATH)/.config $(BUILD_PATH)/init-cpio-spec.txt $(IPERF_PATH)/src/iperf3 $(IPUTILS_PATH)/ping $(BASH_PATH)/bash $(IPROUTE2_PATH)/misc/ss $(IPROUTE2_PATH)/ip/ip $(LIBMNL_PATH)/libmnl $(LIBNFTNL_PATH)/libnftnl $(NFTABLES_PATH)/src/nft $(NMAP_PATH)/ncat/ncat $(WIREGUARD_TOOLS_PATH)/src/wg $(BUILD_PATH)/init $(MAKE) -C $(KERNEL_PATH) O=$(KERNEL_BUILD_PATH) ARCH=$(KERNEL_ARCH) CROSS_COMPILE=$(CROSS_COMPILE) .PHONY: $(KERNEL_BZIMAGE) @@ -421,15 +424,34 @@ $(IPROUTE2_PATH)/misc/ss: | $(IPROUTE2_PATH)/.installed $(USERSPACE_DEPS) $(MAKE) -C $(IPROUTE2_PATH) PREFIX=/ misc/ss $(STRIP) -s $@ -$(IPTABLES_PATH)/.installed: $(IPTABLES_TAR) +$(LIBMNL_PATH)/.installed: $(LIBMNL_TAR) mkdir -p $(BUILD_PATH) flock -s $<.lock tar -C $(BUILD_PATH) -xf $< - sed -i -e "/nfnetlink=[01]/s:=[01]:=0:" -e "/nfconntrack=[01]/s:=[01]:=0:" $(IPTABLES_PATH)/configure touch $@ -$(IPTABLES_PATH)/iptables/xtables-legacy-multi: | $(IPTABLES_PATH)/.installed $(USERSPACE_DEPS) - cd $(IPTABLES_PATH) && ./configure --prefix=/ $(CROSS_COMPILE_FLAG) --enable-static --disable-shared --disable-nftables --disable-bpf-compiler --disable-nfsynproxy --disable-libipq --disable-connlabel --with-kernel=$(BUILD_PATH)/include - $(MAKE) -C $(IPTABLES_PATH) +$(LIBMNL_PATH)/libmnl: | $(LIBMNL_PATH)/.installed $(USERSPACE_DEPS) + cd $(LIBMNL_PATH) && ./configure --prefix=$(TOOLCHAIN_PATH) $(CROSS_COMPILE_FLAG) + $(MAKE) -C $(LIBMNL_PATH) install + $(STRIP) -s $(TOOLCHAIN_PATH)/lib/libmnl.so.0 + +$(LIBNFTNL_PATH)/.installed: $(LIBNFTNL_TAR) + mkdir -p $(BUILD_PATH) + flock -s $<.lock tar -C $(BUILD_PATH) -xf $< + touch $@ + +$(LIBNFTNL_PATH)/libnftnl: | $(LIBNFTNL_PATH)/.installed $(USERSPACE_DEPS) + cd $(LIBNFTNL_PATH) && PKG_CONFIG_PATH="$(TOOLCHAIN_PATH)/lib/pkgconfig" ./configure --prefix=$(TOOLCHAIN_PATH) $(CROSS_COMPILE_FLAG) + $(MAKE) -C $(LIBNFTNL_PATH) install + $(STRIP) -s $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 + +$(NFTABLES_PATH)/.installed: $(NFTABLES_TAR) + mkdir -p $(BUILD_PATH) + flock -s $<.lock tar -C $(BUILD_PATH) -xf $< + touch $@ + +$(NFTABLES_PATH)/src/nft: | $(NFTABLES_PATH)/.installed $(USERSPACE_DEPS) + cd $(NFTABLES_PATH) && PKG_CONFIG_PATH="$(TOOLCHAIN_PATH)/lib/pkgconfig" ./configure --prefix=/ $(CROSS_COMPILE_FLAG) --enable-static --disable-shared --disable-debug --disable-man-doc --with-mini-gmp --without-cli + $(MAKE) -C $(NFTABLES_PATH) PREFIX=/ $(STRIP) -s $@ $(NMAP_PATH)/.installed: $(NMAP_TAR) diff --git a/tools/testing/selftests/wireguard/qemu/kernel.config b/tools/testing/selftests/wireguard/qemu/kernel.config index f314d3789f17..9930116ecd81 100644 --- a/tools/testing/selftests/wireguard/qemu/kernel.config +++ b/tools/testing/selftests/wireguard/qemu/kernel.config @@ -19,10 +19,9 @@ CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_MATCH_LENGTH=y CONFIG_NETFILTER_XT_MARK=y -CONFIG_IP_NF_IPTABLES=y -CONFIG_IP_NF_FILTER=y -CONFIG_IP_NF_MANGLE=y -CONFIG_IP_NF_NAT=y +CONFIG_NF_TABLES=m +CONFIG_NF_TABLES_INET=y +CONFIG_NFT_NAT=y CONFIG_IP_ADVANCED_ROUTER=y CONFIG_IP_MULTIPLE_TABLES=y CONFIG_IPV6_MULTIPLE_TABLES=y -- 2.46.0 ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test Hangbin Liu @ 2025-03-19 16:15 ` Jason A. Donenfeld 2025-03-21 10:40 ` Hangbin Liu 0 siblings, 1 reply; 14+ messages in thread From: Jason A. Donenfeld @ 2025-03-19 16:15 UTC (permalink / raw) To: Hangbin Liu Cc: netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Mon, Jan 06, 2025 at 08:10:43AM +0000, Hangbin Liu wrote: > + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ > + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ > + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ Can't these be statically linked into the nft binary? ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-03-19 16:15 ` Jason A. Donenfeld @ 2025-03-21 10:40 ` Hangbin Liu 2025-03-21 11:42 ` Phil Sutter 0 siblings, 1 reply; 14+ messages in thread From: Hangbin Liu @ 2025-03-21 10:40 UTC (permalink / raw) To: Phil Sutter, Jason A. Donenfeld Cc: netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel Hi Jason, Phil, On Wed, Mar 19, 2025 at 05:15:41PM +0100, Jason A. Donenfeld wrote: > On Mon, Jan 06, 2025 at 08:10:43AM +0000, Hangbin Liu wrote: > > + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ > > + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ > > + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ > > Can't these be statically linked into the nft binary? If I omit these, I will got error like mnl_attr_put: symbol not found Even though I set `--enable-static` in nft build. Do you know what's the reason? Thanks Hangbin ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-03-21 10:40 ` Hangbin Liu @ 2025-03-21 11:42 ` Phil Sutter 2025-03-21 12:45 ` Hangbin Liu 0 siblings, 1 reply; 14+ messages in thread From: Phil Sutter @ 2025-03-21 11:42 UTC (permalink / raw) To: Hangbin Liu Cc: Jason A. Donenfeld, netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel Hi Hangbin, On Fri, Mar 21, 2025 at 10:40:25AM +0000, Hangbin Liu wrote: > Hi Jason, Phil, > On Wed, Mar 19, 2025 at 05:15:41PM +0100, Jason A. Donenfeld wrote: > > On Mon, Jan 06, 2025 at 08:10:43AM +0000, Hangbin Liu wrote: > > > + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ > > > + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ > > > + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ > > > > Can't these be statically linked into the nft binary? > > If I omit these, I will got error like > > mnl_attr_put: symbol not found > > Even though I set `--enable-static` in nft build. > > Do you know what's the reason? I was able to have nft linked statically against built libmnl and libnftnl by passing '--disable-shared --enable-static' to configure calls of all three build systems. With --enable-shared in library configure calls, nftables build preferred to link against the DSOs and I did not find a way to change this. Cheers, Phil ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-03-21 11:42 ` Phil Sutter @ 2025-03-21 12:45 ` Hangbin Liu 2025-03-21 12:51 ` Jason A. Donenfeld 2025-03-21 14:40 ` Phil Sutter 0 siblings, 2 replies; 14+ messages in thread From: Hangbin Liu @ 2025-03-21 12:45 UTC (permalink / raw) To: Phil Sutter Cc: Jason A. Donenfeld, netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Fri, Mar 21, 2025 at 12:42:42PM +0100, Phil Sutter wrote: > Hi Hangbin, > > On Fri, Mar 21, 2025 at 10:40:25AM +0000, Hangbin Liu wrote: > > Hi Jason, Phil, > > On Wed, Mar 19, 2025 at 05:15:41PM +0100, Jason A. Donenfeld wrote: > > > On Mon, Jan 06, 2025 at 08:10:43AM +0000, Hangbin Liu wrote: > > > > + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ > > > > + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ > > > > + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ > > > > > > Can't these be statically linked into the nft binary? > > > > If I omit these, I will got error like > > > > mnl_attr_put: symbol not found > > > > Even though I set `--enable-static` in nft build. > > > > Do you know what's the reason? > > I was able to have nft linked statically against built libmnl and > libnftnl by passing '--disable-shared --enable-static' to configure > calls of all three build systems. With --enable-shared in library > configure calls, nftables build preferred to link against the DSOs and I > did not find a way to change this. The patch is using "./configure --prefix=/ $(CROSS_COMPILE_FLAG) --enable-static \ --disable-shared --disable-debug --disable-man-doc --with-mini-gmp --without-cli" to build nft. I don't know why it's not linked static. Thanks Hangbin ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-03-21 12:45 ` Hangbin Liu @ 2025-03-21 12:51 ` Jason A. Donenfeld 2025-03-21 14:40 ` Phil Sutter 1 sibling, 0 replies; 14+ messages in thread From: Jason A. Donenfeld @ 2025-03-21 12:51 UTC (permalink / raw) To: Hangbin Liu Cc: Phil Sutter, netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Fri, Mar 21, 2025 at 12:45:17PM +0000, Hangbin Liu wrote: > On Fri, Mar 21, 2025 at 12:42:42PM +0100, Phil Sutter wrote: > > Hi Hangbin, > > > > On Fri, Mar 21, 2025 at 10:40:25AM +0000, Hangbin Liu wrote: > > > Hi Jason, Phil, > > > On Wed, Mar 19, 2025 at 05:15:41PM +0100, Jason A. Donenfeld wrote: > > > > On Mon, Jan 06, 2025 at 08:10:43AM +0000, Hangbin Liu wrote: > > > > > + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ > > > > > + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ > > > > > + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ > > > > > > > > Can't these be statically linked into the nft binary? > > > > > > If I omit these, I will got error like > > > > > > mnl_attr_put: symbol not found > > > > > > Even though I set `--enable-static` in nft build. > > > > > > Do you know what's the reason? > > > > I was able to have nft linked statically against built libmnl and > > libnftnl by passing '--disable-shared --enable-static' to configure > > calls of all three build systems. With --enable-shared in library > > configure calls, nftables build preferred to link against the DSOs and I > > did not find a way to change this. > > The patch is using > "./configure --prefix=/ $(CROSS_COMPILE_FLAG) --enable-static \ > --disable-shared --disable-debug --disable-man-doc --with-mini-gmp --without-cli" > to build nft. > > I don't know why it's not linked static. All three DSOs... ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-03-21 12:45 ` Hangbin Liu 2025-03-21 12:51 ` Jason A. Donenfeld @ 2025-03-21 14:40 ` Phil Sutter 2025-03-22 9:25 ` Hangbin Liu 1 sibling, 1 reply; 14+ messages in thread From: Phil Sutter @ 2025-03-21 14:40 UTC (permalink / raw) To: Hangbin Liu Cc: Jason A. Donenfeld, netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Fri, Mar 21, 2025 at 12:45:17PM +0000, Hangbin Liu wrote: > On Fri, Mar 21, 2025 at 12:42:42PM +0100, Phil Sutter wrote: > > Hi Hangbin, > > > > On Fri, Mar 21, 2025 at 10:40:25AM +0000, Hangbin Liu wrote: > > > Hi Jason, Phil, > > > On Wed, Mar 19, 2025 at 05:15:41PM +0100, Jason A. Donenfeld wrote: > > > > On Mon, Jan 06, 2025 at 08:10:43AM +0000, Hangbin Liu wrote: > > > > > + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ > > > > > + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ > > > > > + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ > > > > > > > > Can't these be statically linked into the nft binary? > > > > > > If I omit these, I will got error like > > > > > > mnl_attr_put: symbol not found > > > > > > Even though I set `--enable-static` in nft build. > > > > > > Do you know what's the reason? > > > > I was able to have nft linked statically against built libmnl and > > libnftnl by passing '--disable-shared --enable-static' to configure > > calls of all three build systems. With --enable-shared in library > > configure calls, nftables build preferred to link against the DSOs and I > > did not find a way to change this. > > The patch is using > "./configure --prefix=/ $(CROSS_COMPILE_FLAG) --enable-static \ > --disable-shared --disable-debug --disable-man-doc --with-mini-gmp --without-cli" > to build nft. Do you pass that to the configure calls for libnftnl and libmnl, too? I didn't find a way to force static linking in nftables build system, so I disabled building of shared libmnl/libnftnl libraries. Cheers, Phil ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test 2025-03-21 14:40 ` Phil Sutter @ 2025-03-22 9:25 ` Hangbin Liu 0 siblings, 0 replies; 14+ messages in thread From: Hangbin Liu @ 2025-03-22 9:25 UTC (permalink / raw) To: Phil Sutter, Jason A. Donenfeld Cc: netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Fri, Mar 21, 2025 at 03:40:20PM +0100, Phil Sutter wrote: > On Fri, Mar 21, 2025 at 12:45:17PM +0000, Hangbin Liu wrote: > > On Fri, Mar 21, 2025 at 12:42:42PM +0100, Phil Sutter wrote: > > > Hi Hangbin, > > > > > > On Fri, Mar 21, 2025 at 10:40:25AM +0000, Hangbin Liu wrote: > > > > Hi Jason, Phil, > > > > On Wed, Mar 19, 2025 at 05:15:41PM +0100, Jason A. Donenfeld wrote: > > > > > On Mon, Jan 06, 2025 at 08:10:43AM +0000, Hangbin Liu wrote: > > > > > > + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ > > > > > > + echo "file /lib/libmnl.so.0 $(TOOLCHAIN_PATH)/lib/libmnl.so.0 755 0 0" >> $@ > > > > > > + echo "file /lib/libnftnl.so.11 $(TOOLCHAIN_PATH)/lib/libnftnl.so.11 755 0 0" >> $@ > > > > > > > > > > Can't these be statically linked into the nft binary? > > > > > > > > If I omit these, I will got error like > > > > > > > > mnl_attr_put: symbol not found > > > > > > > > Even though I set `--enable-static` in nft build. > > > > > > > > Do you know what's the reason? > > > > > > I was able to have nft linked statically against built libmnl and > > > libnftnl by passing '--disable-shared --enable-static' to configure > > > calls of all three build systems. With --enable-shared in library > > > configure calls, nftables build preferred to link against the DSOs and I > > > did not find a way to change this. > > > > The patch is using > > "./configure --prefix=/ $(CROSS_COMPILE_FLAG) --enable-static \ > > --disable-shared --disable-debug --disable-man-doc --with-mini-gmp --without-cli" > > to build nft. > > Do you pass that to the configure calls for libnftnl and libmnl, too? I > didn't find a way to force static linking in nftables build system, so I > disabled building of shared libmnl/libnftnl libraries. > It works after pass that to libnftnl and libmnl. Thanks Hangbin ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing 2025-01-06 8:10 [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft Hangbin Liu 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test Hangbin Liu @ 2025-03-18 10:24 ` Hangbin Liu 2025-03-19 16:11 ` Jason A. Donenfeld 2 siblings, 1 reply; 14+ messages in thread From: Hangbin Liu @ 2025-03-18 10:24 UTC (permalink / raw) To: Jason A. Donenfeld, netdev Cc: Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel Hi Jason, I saw the patch status[1] is still "Awaiting Upstream". Is there anything I need to do? https://patchwork.kernel.org/project/netdevbpf/patch/20250106081043.2073169-2-liuhangbin@gmail.com/ Thanks Hangbin On Mon, Jan 06, 2025 at 08:10:41AM +0000, Hangbin Liu wrote: > This patch set convert iptables to nftables for wireguard testing, as > iptables is deparated and nftables is the default framework of most releases. > > v3: drop iptables directly (Jason A. Donenfeld) > Also convert to using nft for qemu testing (Jason A. Donenfeld) > v2: use one nft table for testing (Phil Sutter) > > Hangbin Liu (2): > selftests: wireguards: convert iptables to nft > selftests: wireguard: update to using nft for qemu test > > tools/testing/selftests/wireguard/netns.sh | 29 +++++++++----- > .../testing/selftests/wireguard/qemu/Makefile | 40 ++++++++++++++----- > .../selftests/wireguard/qemu/kernel.config | 7 ++-- > 3 files changed, 53 insertions(+), 23 deletions(-) > > -- > 2.46.0 > ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing 2025-03-18 10:24 ` [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu @ 2025-03-19 16:11 ` Jason A. Donenfeld 2025-03-20 7:40 ` Hangbin Liu 0 siblings, 1 reply; 14+ messages in thread From: Jason A. Donenfeld @ 2025-03-19 16:11 UTC (permalink / raw) To: Hangbin Liu Cc: netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Tue, Mar 18, 2025 at 10:24:40AM +0000, Hangbin Liu wrote: > I saw the patch status[1] is still "Awaiting Upstream". > Is there anything I need to do? I'm looking at it now, but the subject line of your series says, "selftests: wireguards: " which is really not the same as all the other patches that touch these files. Jason ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing 2025-03-19 16:11 ` Jason A. Donenfeld @ 2025-03-20 7:40 ` Hangbin Liu 0 siblings, 0 replies; 14+ messages in thread From: Hangbin Liu @ 2025-03-20 7:40 UTC (permalink / raw) To: Jason A. Donenfeld Cc: netdev, Jakub Kicinski, Shuah Khan, David S. Miller, Simon Horman, Phil Sutter, Florian Westphal, Petr Mladek, Yoann Congal, wireguard, bpf, linux-kselftest, linux-kernel On Wed, Mar 19, 2025 at 05:11:15PM +0100, Jason A. Donenfeld wrote: > On Tue, Mar 18, 2025 at 10:24:40AM +0000, Hangbin Liu wrote: > > I saw the patch status[1] is still "Awaiting Upstream". > > Is there anything I need to do? > > I'm looking at it now, but the subject line of your series says, > "selftests: wireguards: " which is really not the same as all the other > patches that touch these files. Oh, I will fix the name in next patch. Hangbin ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2025-03-22 9:25 UTC | newest] Thread overview: 14+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-01-06 8:10 [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft Hangbin Liu 2025-03-19 16:10 ` Jason A. Donenfeld 2025-01-06 8:10 ` [PATCHv4 RESEND net-next 2/2] selftests: wireguard: update to using nft for qemu test Hangbin Liu 2025-03-19 16:15 ` Jason A. Donenfeld 2025-03-21 10:40 ` Hangbin Liu 2025-03-21 11:42 ` Phil Sutter 2025-03-21 12:45 ` Hangbin Liu 2025-03-21 12:51 ` Jason A. Donenfeld 2025-03-21 14:40 ` Phil Sutter 2025-03-22 9:25 ` Hangbin Liu 2025-03-18 10:24 ` [PATCHv4 RESEND net-next 0/2] selftests: wireguards: use nftables for testing Hangbin Liu 2025-03-19 16:11 ` Jason A. Donenfeld 2025-03-20 7:40 ` Hangbin Liu
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).