Re: [PATCH nft] tests: Run in separate network namespace, don't break connectivity

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Jun 14, 2020 at 11:41:57PM +0200, Stefano Brivio wrote:
> It might be convenient to run tests from a development branch that
> resides on another host, and if we break connectivity on the test
> host as tests are executed, we can't run them this way.
> 
> If kernel implementation (CONFIG_NET_NS), unshare(1), or Python
> bindings for unshare() are not available, warn and continue.
> 
> Suggested-by: Phil Sutter <phil@nwl.cc>
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
> ---
>  tests/py/nft-test.py     | 6 ++++++
>  tests/shell/run-tests.sh | 9 +++++++++
>  2 files changed, 15 insertions(+)
> 
> diff --git a/tests/py/nft-test.py b/tests/py/nft-test.py
> index 01ee6c980ad4..df97ed8eefb7 100755
> --- a/tests/py/nft-test.py
> +++ b/tests/py/nft-test.py
> @@ -1394,6 +1394,12 @@ def main():
>      # Change working directory to repository root
>      os.chdir(TESTS_PATH + "/../..")
>  
> +    try:
> +        import unshare
> +        unshare.unshare(unshare.CLONE_NEWNET)
> +    except:
> +        print_warning("cannot run in own namespace, connectivity might break")
> +

In iptables-tests.py, there is an option for this:

        parser.add_argument('-N', '--netns', action='store_true',
                            help='Test netnamespace path')

Is it worth keeping this in sync with it?