[PATCH] tests: shell: add test to cover ct offload by using nft flowtables To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress").

[PATCH] tests: shell: add test to cover ct offload by using nft flowtables To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress").

[yiche]

From: Yi Chen <yiche@redhat.com>

Signed-off-by: Yi Chen <yiche@redhat.com>
---
 tests/shell/testcases/packetpath/flowtables | 96 +++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100755 tests/shell/testcases/packetpath/flowtables

diff --git a/tests/shell/testcases/packetpath/flowtables b/tests/shell/testcases/packetpath/flowtables
new file mode 100755
index 00000000..852a05c6
--- /dev/null
+++ b/tests/shell/testcases/packetpath/flowtables
@@ -0,0 +1,96 @@
+#! /bin/bash -x
+
+# NFT_TEST_SKIP(NFT_TEST_SKIP_slow)
+
+rnd=$(mktemp -u XXXXXXXX)
+R="flowtable-router-$rnd"
+C="flowtable-client-$rnd"
+S="flowtbale-server-$rnd"
+
+cleanup()
+{
+	for i in $R $C $S;do
+		kill $(ip netns pid $i) 2>/dev/null
+		ip netns del $i
+	done
+}
+
+trap cleanup EXIT
+
+ip netns add $R
+ip netns add $S
+ip netns add $C
+
+ip link add s_r netns $S type veth peer name r_s netns $R
+ip netns exec $S ip link set s_r up
+ip netns exec $R ip link set r_s up
+ip link add c_r netns $C type veth peer name r_c netns $R
+ip netns exec $R ip link set r_c up
+ip netns exec $C ip link set c_r up
+
+ip netns exec $S ip -6 addr add 2001:db8:ffff:22::1/64 dev s_r
+ip netns exec $C ip -6 addr add 2001:db8:ffff:21::2/64 dev c_r
+ip netns exec $R ip -6 addr add 2001:db8:ffff:22::fffe/64 dev r_s
+ip netns exec $R ip -6 addr add 2001:db8:ffff:21::fffe/64 dev r_c
+ip netns exec $R sysctl -w net.ipv6.conf.all.forwarding=1
+ip netns exec $C ip route add 2001:db8:ffff:22::/64 via 2001:db8:ffff:21::fffe dev c_r
+ip netns exec $S ip route add 2001:db8:ffff:21::/64 via 2001:db8:ffff:22::fffe dev s_r
+ip netns exec $S ethtool -K s_r tso off
+ip netns exec $C ethtool -K c_r tso off
+
+sleep 3
+ip netns exec $C ping -6 2001:db8:ffff:22::1 -c1 || exit 1
+
+ip netns exec $R nft -f - <<EOF
+table ip6 filter {
+        flowtable f1 {
+                hook ingress priority -100
+                devices = { r_c, r_s }
+        }
+
+        chain forward {
+                type filter hook forward priority filter; policy accept;
+                ip6 nexthdr tcp ct state established,related counter packets 0 bytes 0 flow add @f1 counter packets 0 bytes 0
+                ip6 nexthdr tcp ct state invalid counter packets 0 bytes 0 drop
+                tcp flags fin,rst counter packets 0 bytes 0 accept
+                meta l4proto tcp meta length < 100 counter packets 0 bytes 0 accept
+                ip6 nexthdr tcp counter packets 0 bytes 0 log drop
+        }
+}
+EOF
+
+if [ ! -r /proc/net/nf_conntrack ]
+then
+	echo "E: nf_conntrack unreadable, skipping" >&2	
+	exit 77
+fi
+
+ip netns exec $R nft list ruleset
+ip netns exec $R sysctl -w net.netfilter.nf_flowtable_tcp_timeout=5 || {
+	echo "E: set net.netfilter.nf_flowtable_tcp_timeout fail, skipping" >&2
+        exit 77
+}
+ip netns exec $R sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=86400 || {
+        echo "E: set net.netfilter.nf_conntrack_tcp_timeout_established fail, skipping" >&2
+        exit 77
+
+}
+
+# A trick to control the timing to send a packet
+ip netns exec $S socat TCP6-LISTEN:10001 GOPEN:pipefile,ignoreeof &
+sleep 1
+ip netns exec $C socat -b 2048 PIPE:pipefile TCP:[2001:db8:ffff:22::1]:10001 &
+sleep 1
+ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   || { echo "check [OFFLOAD] tag (failed)"; exit 1; }
+ip netns exec $R cat /proc/net/nf_conntrack
+sleep 6
+ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   && { echo "CT OFFLOAD timeout, fail back to classical path (failed)"; exit 1; }
+ip netns exec $R grep '8639[0-9]' /proc/net/nf_conntrack || { echo "check nf_conntrack_tcp_timeout_established (failed)"; exit 1; }
+ip netns exec $C echo "send sth" >> pipefile
+ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   || { echo "traffic seen, back to OFFLOAD path (failed)"; exit 1; }
+ip netns exec $C sleep 3
+ip netns exec $C echo "send sth" >> pipefile
+ip netns exec $C sleep 3
+ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   || { echo "Traffic seen in 5s (nf_flowtable_tcp_timeout), so stay in OFFLOAD (failed)"; exit 1; }
+
+exit 0
-- 
2.43.0

Re: [PATCH] tests: shell: add test to cover ct offload by using nft flowtables To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress").

[Pablo Neira Ayuso]

Hi,

This test reports:

I: [OK]         1/1 testcases/packetpath/flowtables

or did you see any issue on your end?

Thanks!

On Tue, Jan 23, 2024 at 12:26:40AM +0800, yiche@redhat.com wrote:
> From: Yi Chen <yiche@redhat.com>
> 
> Signed-off-by: Yi Chen <yiche@redhat.com>
> ---
>  tests/shell/testcases/packetpath/flowtables | 96 +++++++++++++++++++++
>  1 file changed, 96 insertions(+)
>  create mode 100755 tests/shell/testcases/packetpath/flowtables
> 
> diff --git a/tests/shell/testcases/packetpath/flowtables b/tests/shell/testcases/packetpath/flowtables
> new file mode 100755
> index 00000000..852a05c6
> --- /dev/null
> +++ b/tests/shell/testcases/packetpath/flowtables
> @@ -0,0 +1,96 @@
> +#! /bin/bash -x
> +
> +# NFT_TEST_SKIP(NFT_TEST_SKIP_slow)
> +
> +rnd=$(mktemp -u XXXXXXXX)
> +R="flowtable-router-$rnd"
> +C="flowtable-client-$rnd"
> +S="flowtbale-server-$rnd"
> +
> +cleanup()
> +{
> +	for i in $R $C $S;do
> +		kill $(ip netns pid $i) 2>/dev/null
> +		ip netns del $i
> +	done
> +}
> +
> +trap cleanup EXIT
> +
> +ip netns add $R
> +ip netns add $S
> +ip netns add $C
> +
> +ip link add s_r netns $S type veth peer name r_s netns $R
> +ip netns exec $S ip link set s_r up
> +ip netns exec $R ip link set r_s up
> +ip link add c_r netns $C type veth peer name r_c netns $R
> +ip netns exec $R ip link set r_c up
> +ip netns exec $C ip link set c_r up
> +
> +ip netns exec $S ip -6 addr add 2001:db8:ffff:22::1/64 dev s_r
> +ip netns exec $C ip -6 addr add 2001:db8:ffff:21::2/64 dev c_r
> +ip netns exec $R ip -6 addr add 2001:db8:ffff:22::fffe/64 dev r_s
> +ip netns exec $R ip -6 addr add 2001:db8:ffff:21::fffe/64 dev r_c
> +ip netns exec $R sysctl -w net.ipv6.conf.all.forwarding=1
> +ip netns exec $C ip route add 2001:db8:ffff:22::/64 via 2001:db8:ffff:21::fffe dev c_r
> +ip netns exec $S ip route add 2001:db8:ffff:21::/64 via 2001:db8:ffff:22::fffe dev s_r
> +ip netns exec $S ethtool -K s_r tso off
> +ip netns exec $C ethtool -K c_r tso off
> +
> +sleep 3
> +ip netns exec $C ping -6 2001:db8:ffff:22::1 -c1 || exit 1
> +
> +ip netns exec $R nft -f - <<EOF
> +table ip6 filter {
> +        flowtable f1 {
> +                hook ingress priority -100
> +                devices = { r_c, r_s }
> +        }
> +
> +        chain forward {
> +                type filter hook forward priority filter; policy accept;
> +                ip6 nexthdr tcp ct state established,related counter packets 0 bytes 0 flow add @f1 counter packets 0 bytes 0
> +                ip6 nexthdr tcp ct state invalid counter packets 0 bytes 0 drop
> +                tcp flags fin,rst counter packets 0 bytes 0 accept
> +                meta l4proto tcp meta length < 100 counter packets 0 bytes 0 accept
> +                ip6 nexthdr tcp counter packets 0 bytes 0 log drop
> +        }
> +}
> +EOF
> +
> +if [ ! -r /proc/net/nf_conntrack ]
> +then
> +	echo "E: nf_conntrack unreadable, skipping" >&2	
> +	exit 77
> +fi
> +
> +ip netns exec $R nft list ruleset
> +ip netns exec $R sysctl -w net.netfilter.nf_flowtable_tcp_timeout=5 || {
> +	echo "E: set net.netfilter.nf_flowtable_tcp_timeout fail, skipping" >&2
> +        exit 77
> +}
> +ip netns exec $R sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=86400 || {
> +        echo "E: set net.netfilter.nf_conntrack_tcp_timeout_established fail, skipping" >&2
> +        exit 77
> +
> +}
> +
> +# A trick to control the timing to send a packet
> +ip netns exec $S socat TCP6-LISTEN:10001 GOPEN:pipefile,ignoreeof &
> +sleep 1
> +ip netns exec $C socat -b 2048 PIPE:pipefile TCP:[2001:db8:ffff:22::1]:10001 &
> +sleep 1
> +ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   || { echo "check [OFFLOAD] tag (failed)"; exit 1; }
> +ip netns exec $R cat /proc/net/nf_conntrack
> +sleep 6
> +ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   && { echo "CT OFFLOAD timeout, fail back to classical path (failed)"; exit 1; }
> +ip netns exec $R grep '8639[0-9]' /proc/net/nf_conntrack || { echo "check nf_conntrack_tcp_timeout_established (failed)"; exit 1; }
> +ip netns exec $C echo "send sth" >> pipefile
> +ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   || { echo "traffic seen, back to OFFLOAD path (failed)"; exit 1; }
> +ip netns exec $C sleep 3
> +ip netns exec $C echo "send sth" >> pipefile
> +ip netns exec $C sleep 3
> +ip netns exec $R grep 'OFFLOAD' /proc/net/nf_conntrack   || { echo "Traffic seen in 5s (nf_flowtable_tcp_timeout), so stay in OFFLOAD (failed)"; exit 1; }
> +
> +exit 0
> -- 
> 2.43.0
> 
> 

Re: [PATCH] tests: shell: add test to cover ct offload by using nft flowtables To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress").

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Hi,
> 
> This test reports:
> 
> I: [OK]         1/1 testcases/packetpath/flowtables
> 
> or did you see any issue on your end?

Yes, this scenario got broken in the past, e.g.
via 41f2c7c342d3 ("net/sched: act_ct: Fix promotion of offloaded
unreplied tuple").

nf.git is fine, but I think its good to have a test case to prevent
obvious breakage in the future.

Re: [PATCH] tests: shell: add test to cover ct offload by using nft flowtables To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress").

[Yi Chen]

> Hi,
>
> This test reports:
>
> I: [OK]         1/1 testcases/packetpath/flowtables
>
> or did you see any issue on your end?
Yes, on the latest rhel-9 kernel 5.14.0-408.el9 which hasn't involved
this patch:
a67db600fd38e08 netfilter: nf_tables: set transport offset from mac
header for netdev/egress

 it report:
W: [FAILED]     1/1 testcases/packetpath/flowtables

This test case existed before and caught this issue.

Re: [PATCH] tests: shell: add test to cover ct offload by using nft flowtables To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress").

[Pablo Neira Ayuso]

On Tue, Jan 23, 2024 at 11:26:47AM +0800, Yi Chen wrote:
> > Hi,
> >
> > This test reports:
> >
> > I: [OK]         1/1 testcases/packetpath/flowtables
> >
> > or did you see any issue on your end?
>
> Yes, on the latest rhel-9 kernel 5.14.0-408.el9 which hasn't involved
> this patch:
> a67db600fd38e08 netfilter: nf_tables: set transport offset from mac
> header for netdev/egress
> 
>  it report:
> W: [FAILED]     1/1 testcases/packetpath/flowtables
> 
> This test case existed before and caught this issue.

Great, thanks for submitting this