Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Wait for rcu grace period after releasing netns in ctnetlink, from Florian Westphal. 2) Incorrect command type in flowtable offload ndo invocation, from wenxu. 3) Incorrect callback type in flowtable offload flow tuple updates, also from wenxu. 4) Fix compile warning on flowtable offload infrastructure due to possible reference to uninitialized variable, from Nathan Chancellor. 5) Do not inline nf_ct_resolve_clash(), this is called from slow path / stress situations. From Florian Westphal. 6) Missing IPv6 flow selector description in flowtable offload. 7) Missing check for NETDEV_UNREGISTER in nf_tables offload infrastructure, from wenxu. 8) Update NAT selftest to use randomized netns names, from Florian Westphal. 9) Restore nfqueue bridge support, from Marco Oliverio. 10) Compilation warning in SCTP_CHUNKMAP_*() on xt_sctp header. From Phil Sutter. 11) Fix bogus lookup/get match for non-anonymous rbtree sets. 12) Missing netlink validation for NFT_SET_ELEM_INTERVAL_END elements. 13) Missing netlink validation for NFT_DATA_VALUE after nft_data_init(). 14) If rule specifies no actions, offload infrastructure returns EOPNOTSUPP. 15) Module refcount leak in object updates. 16) Missing sanitization for ARP traffic from br_netfilter, from Eric Dumazet. 17) Compilation breakage on big-endian due to incorrect memcpy() size in the flowtable offload infrastructure. ====================

David S. Miller committed 6 years ago

Commit 7da538c2 parents f8fc57e 7acd93713 files · +288 −213Browse files

Unified · Split

13 files

include/uapi/linux/netfilter/xt_sctp.h +3 −3
net/bridge/br_netfilter_hooks.c +3 −0
net/netfilter/nf_conntrack_core.c +4 −3
net/netfilter/nf_conntrack_netlink.c +3 −0
net/netfilter/nf_flow_table_offload.c +45 −38
net/netfilter/nf_queue.c +1 −1
net/netfilter/nf_tables_api.c +13 −5
net/netfilter/nf_tables_offload.c +6 −0
net/netfilter/nft_bitwise.c +2 −2
net/netfilter/nft_cmp.c +6 −0
net/netfilter/nft_range.c +10 −0
net/netfilter/nft_set_rbtree.c +16 −5
tools/testing/selftests/netfilter/nft_nat.sh +176 −156

include/uapi/linux/netfilter/xt_sctp.h+3−3

@@ -41,19 +41,19 @@ struct xt_sctp_info { · 40 unmodified lines
41	41	#define SCTP_CHUNKMAP_SET(chunkmap, type) \
42	42	do { \
43	43	(chunkmap)[type / bytes(__u32)] \|= \
44		− 1 << (type % bytes(__u32)); \
	44	+ 1u << (type % bytes(__u32)); \
45	45	} while (0)
46	46
47	47	#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
48	48	do { \
49	49	(chunkmap)[type / bytes(__u32)] &= \
50		− ~(1 << (type % bytes(__u32))); \
	50	+ ~(1u << (type % bytes(__u32))); \
51	51	} while (0)
52	52
53	53	#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
54	54	({ \
55	55	((chunkmap)[type / bytes (__u32)] & \
56		− (1 << (type % bytes (__u32)))) ? 1: 0; \
	56	+ (1u << (type % bytes (__u32)))) ? 1: 0; \
57	57	})
58	58
59	59	#define SCTP_CHUNKMAP_RESET(chunkmap) \

net/bridge/br_netfilter_hooks.c+3−0

@@ -662,6 +662,9 @@ static unsigned int br_nf_forward_arp(void *priv, · 661 unmodified lines
662	662	nf_bridge_pull_encap_header(skb);
663	663	}
664	664
	665	+ if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))
	666	+ return NF_DROP;
	667	+
665	668	if (arp_hdr(skb)->ar_pln != 4) {
666	669	if (is_vlan_arp(skb, state->net))
667	670	nf_bridge_push_encap_header(skb);

net/netfilter/nf_conntrack_core.c+4−3

@@ -895,9 +895,10 @@ static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo, · 894 unmodified lines
895	895	}
896	896
897	897	/* Resolve race on insertion if this protocol allows this. */
898		−static int nf_ct_resolve_clash(struct net net, struct sk_buff skb,
899		− enum ip_conntrack_info ctinfo,
900		− struct nf_conntrack_tuple_hash *h)
	898	+static __cold noinline int
	899	+nf_ct_resolve_clash(struct net net, struct sk_buff skb,
	900	+ enum ip_conntrack_info ctinfo,
	901	+ struct nf_conntrack_tuple_hash *h)
901	902	{
902	903	/* This is the conntrack entry already in hashes that won race. */
903	904	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);

net/netfilter/nf_conntrack_netlink.c+3−0

@@ -3626,6 +3626,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list) · 3625 unmodified lines
3626	3626
3627	3627	list_for_each_entry(net, net_exit_list, exit_list)
3628	3628	ctnetlink_net_exit(net);
	3629	+
	3630	+ /* wait for other cpus until they are done with ctnl_notifiers */
	3631	+ synchronize_rcu();
3629	3632	}
3630	3633
3631	3634	static struct pernet_operations ctnetlink_net_ops = {

net/netfilter/nf_flow_table_offload.c+45−38

@@ -28,6 +28,7 @@ struct nf_flow_key { · 27 unmodified lines
28	28	struct flow_dissector_key_basic basic;
29	29	union {
30	30	struct flow_dissector_key_ipv4_addrs ipv4;
	31	+ struct flow_dissector_key_ipv6_addrs ipv6;
31	32	};
32	33	struct flow_dissector_key_tcp tcp;
33	34	struct flow_dissector_key_ports tp;
@@ -57,6 +58,7 @@ static int nf_flow_rule_match(struct nf_flow_match *match, · 23 unmodified lines
57	58	NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_CONTROL, control);
58	59	NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_BASIC, basic);
59	60	NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4);
	61	+ NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6);
60	62	NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_TCP, tcp);
61	63	NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_PORTS, tp);
62	64
@@ -69,9 +71,18 @@ static int nf_flow_rule_match(struct nf_flow_match *match, · 6 unmodified lines
69	71	key->ipv4.dst = tuple->dst_v4.s_addr;
70	72	mask->ipv4.dst = 0xffffffff;
71	73	break;
	74	+ case AF_INET6:
	75	+ key->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
	76	+ key->basic.n_proto = htons(ETH_P_IPV6);
	77	+ key->ipv6.src = tuple->src_v6;
	78	+ memset(&mask->ipv6.src, 0xff, sizeof(mask->ipv6.src));
	79	+ key->ipv6.dst = tuple->dst_v6;
	80	+ memset(&mask->ipv6.dst, 0xff, sizeof(mask->ipv6.dst));
	81	+ break;
72	82	default:
73	83	return -EOPNOTSUPP;
74	84	}
	85	+ match->dissector.used_keys \|= BIT(key->control.addr_type);
75	86	mask->basic.n_proto = 0xffff;
76	87
77	88	switch (tuple->l4proto) {
@@ -96,14 +107,13 @@ static int nf_flow_rule_match(struct nf_flow_match *match, · 18 unmodified lines
96	107
97	108	match->dissector.used_keys \|= BIT(FLOW_DISSECTOR_KEY_CONTROL) \|
98	109	BIT(FLOW_DISSECTOR_KEY_BASIC) \|
99		− BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) \|
100	110	BIT(FLOW_DISSECTOR_KEY_PORTS);
101	111	return 0;
102	112	}
103	113
104	114	static void flow_offload_mangle(struct flow_action_entry *entry,
105		− enum flow_action_mangle_base htype,
106		− u32 offset, u8 value, u8 mask)
	115	+ enum flow_action_mangle_base htype, u32 offset,
	116	+ const __be32 value, const __be32 mask)
107	117	{
108	118	entry->id = FLOW_ACTION_MANGLE;
109	119	entry->mangle.htype = htype;
@@ -140,12 +150,12 @@ static int flow_offload_eth_src(struct net *net, · 30 unmodified lines
140	150	memcpy(&val16, dev->dev_addr, 2);
141	151	val = val16 << 16;
142	152	flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
143		− (u8 )&val, (u8 )&mask);
	153	+ &val, &mask);
144	154
145	155	mask = ~0xffffffff;
146	156	memcpy(&val, dev->dev_addr + 2, 4);
147	157	flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 8,
148		− (u8 )&val, (u8 )&mask);
	158	+ &val, &mask);
149	159	dev_put(dev);
150	160
151	161	return 0;
@@ -170,13 +180,13 @@ static int flow_offload_eth_dst(struct net *net, · 18 unmodified lines
170	180	mask = ~0xffffffff;
171	181	memcpy(&val, n->ha, 4);
172	182	flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,
173		− (u8 )&val, (u8 )&mask);
	183	+ &val, &mask);
174	184
175	185	mask = ~0x0000ffff;
176	186	memcpy(&val16, n->ha + 4, 2);
177	187	val = val16;
178	188	flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
179		− (u8 )&val, (u8 )&mask);
	189	+ &val, &mask);
180	190	neigh_release(n);
181	191
182	192	return 0;
@@ -206,7 +216,7 @@ static void flow_offload_ipv4_snat(struct net *net, · 23 unmodified lines
206	216	}
207	217
208	218	flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset,
209		− (u8 )&addr, (u8 )&mask);
	219	+ &addr, &mask);
210	220	}
211	221
212	222	static void flow_offload_ipv4_dnat(struct net *net,
@@ -233,12 +243,12 @@ static void flow_offload_ipv4_dnat(struct net *net, · 20 unmodified lines
233	243	}
234	244
235	245	flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset,
236		− (u8 )&addr, (u8 )&mask);
	246	+ &addr, &mask);
237	247	}
238	248
239	249	static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule,
240	250	unsigned int offset,
241		− u8 addr, u8 mask)
	251	+ const __be32 addr, const __be32 mask)
242	252	{
243	253	struct flow_action_entry *entry;
244	254	int i;
@@ -246,8 +256,7 @@ static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, · 1 unmodified line
246	256	for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i += sizeof(u32)) {
247	257	entry = flow_action_entry_next(flow_rule);
248	258	flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP6,
249		− offset + i,
250		− &addr[i], mask);
	259	+ offset + i, &addr[i], mask);
251	260	}
252	261	}
253	262
@@ -257,23 +266,23 @@ static void flow_offload_ipv6_snat(struct net *net, · 3 unmodified lines
257	266	struct nf_flow_rule *flow_rule)
258	267	{
259	268	u32 mask = ~htonl(0xffffffff);
260		− const u8 *addr;
	269	+ const __be32 *addr;
261	270	u32 offset;
262	271
263	272	switch (dir) {
264	273	case FLOW_OFFLOAD_DIR_ORIGINAL:
265		− addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6.s6_addr;
	274	+ addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6.s6_addr32;
266	275	offset = offsetof(struct ipv6hdr, saddr);
267	276	break;
268	277	case FLOW_OFFLOAD_DIR_REPLY:
269		− addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6.s6_addr;
	278	+ addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6.s6_addr32;
270	279	offset = offsetof(struct ipv6hdr, daddr);
271	280	break;
272	281	default:
273	282	return;
274	283	}
275	284
276		− flow_offload_ipv6_mangle(flow_rule, offset, (u8 )addr, (u8 )&mask);
	285	+ flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask);
277	286	}
278	287
279	288	static void flow_offload_ipv6_dnat(struct net *net,
@@ -282,23 +291,23 @@ static void flow_offload_ipv6_dnat(struct net *net, · 2 unmodified lines
282	291	struct nf_flow_rule *flow_rule)
283	292	{
284	293	u32 mask = ~htonl(0xffffffff);
285		− const u8 *addr;
	294	+ const __be32 *addr;
286	295	u32 offset;
287	296
288	297	switch (dir) {
289	298	case FLOW_OFFLOAD_DIR_ORIGINAL:
290		− addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6.s6_addr;
	299	+ addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6.s6_addr32;
291	300	offset = offsetof(struct ipv6hdr, daddr);
292	301	break;
293	302	case FLOW_OFFLOAD_DIR_REPLY:
294		− addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6.s6_addr;
	303	+ addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6.s6_addr32;
295	304	offset = offsetof(struct ipv6hdr, saddr);
296	305	break;
297	306	default:
298	307	return;
299	308	}
300	309
301		− flow_offload_ipv6_mangle(flow_rule, offset, (u8 )addr, (u8 )&mask);
	310	+ flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask);
302	311	}
303	312
304	313	static int flow_offload_l4proto(const struct flow_offload *flow)
@@ -326,25 +335,24 @@ static void flow_offload_port_snat(struct net *net, · 21 unmodified lines
326	335	struct nf_flow_rule *flow_rule)
327	336	{
328	337	struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
329		− u32 mask = ~htonl(0xffff0000);
330		− __be16 port;
	338	+ u32 mask = ~htonl(0xffff0000), port;
331	339	u32 offset;
332	340
333	341	switch (dir) {
334	342	case FLOW_OFFLOAD_DIR_ORIGINAL:
335		− port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;
	343	+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
336	344	offset = 0; /* offsetof(struct tcphdr, source); */
337	345	break;
338	346	case FLOW_OFFLOAD_DIR_REPLY:
339		− port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
	347	+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
340	348	offset = 0; /* offsetof(struct tcphdr, dest); */
341	349	break;
342	350	default:
343		− break;
	351	+ return;
344	352	}
345		−
	353	+ port = htonl(port << 16);
346	354	flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
347		− (u8 )&port, (u8 )&mask);
	355	+ &port, &mask);
348	356	}
349	357
350	358	static void flow_offload_port_dnat(struct net *net,
@@ -353,25 +361,24 @@ static void flow_offload_port_dnat(struct net *net, · 2 unmodified lines
353	361	struct nf_flow_rule *flow_rule)
354	362	{
355	363	struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
356		− u32 mask = ~htonl(0xffff);
357		− __be16 port;
	364	+ u32 mask = ~htonl(0xffff), port;
358	365	u32 offset;
359	366
360	367	switch (dir) {
361	368	case FLOW_OFFLOAD_DIR_ORIGINAL:
362		− port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;
	369	+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
363	370	offset = 0; /* offsetof(struct tcphdr, source); */
364	371	break;
365	372	case FLOW_OFFLOAD_DIR_REPLY:
366		− port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
	373	+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
367	374	offset = 0; /* offsetof(struct tcphdr, dest); */
368	375	break;
369	376	default:
370		− break;
	377	+ return;
371	378	}
372		−
	379	+ port = htonl(port);
373	380	flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
374		− (u8 )&port, (u8 )&mask);
	381	+ &port, &mask);
375	382	}
376	383
377	384	static void flow_offload_ipv4_checksum(struct net *net,
@@ -574,7 +581,7 @@ static int flow_offload_tuple_add(struct flow_offload_work *offload, · 196 unmodified lines
574	581	cls_flow.rule = flow_rule->rule;
575	582
576	583	list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list) {
577		− err = block_cb->cb(TC_SETUP_FT, &cls_flow,
	584	+ err = block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow,
578	585	block_cb->cb_priv);
579	586	if (err < 0)
580	587	continue;
@@ -599,7 +606,7 @@ static void flow_offload_tuple_del(struct flow_offload_work *offload, · 18 unmodified lines
599	606	&offload->flow->tuplehash[dir].tuple, &extack);
600	607
601	608	list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list)
602		− block_cb->cb(TC_SETUP_FT, &cls_flow, block_cb->cb_priv);
	609	+ block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow, block_cb->cb_priv);
603	610
604	611	offload->flow->flags \|= FLOW_OFFLOAD_HW_DEAD;
605	612	}
@@ -656,7 +663,7 @@ static void flow_offload_tuple_stats(struct flow_offload_work *offload, · 50 unmodified lines
656	663	&offload->flow->tuplehash[dir].tuple, &extack);
657	664
658	665	list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list)
659		− block_cb->cb(TC_SETUP_FT, &cls_flow, block_cb->cb_priv);
	666	+ block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow, block_cb->cb_priv);
660	667	memcpy(stats, &cls_flow.stats, sizeof(*stats));
661	668	}
662	669
@@ -822,7 +829,7 @@ int nf_flow_table_offload_setup(struct nf_flowtable *flowtable, · 159 unmodified lines
822	829	bo.extack = &extack;
823	830	INIT_LIST_HEAD(&bo.cb_list);
824	831
825		− err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
	832	+ err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, &bo);
826	833	if (err < 0)
827	834	return err;
828	835

net/netfilter/nf_queue.c+1−1

@@ -189,7 +189,7 @@ static int __nf_queue(struct sk_buff skb, const struct nf_hook_state state, · 188 unmodified lines
189	189	goto err;
190	190	}
191	191
192		− if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
	192	+ if (skb_dst(skb) && !skb_dst_force(skb)) {
193	193	status = -ENETDOWN;
194	194	goto err;
195	195	}

net/netfilter/nf_tables_api.c+13−5

@@ -4519,8 +4519,10 @@ static int nft_get_set_elem(struct nft_ctx ctx, struct nft_set set, · 4518 unmodified lines
4519	4519	return err;
4520	4520
4521	4521	err = -EINVAL;
4522		− if (desc.type != NFT_DATA_VALUE \|\| desc.len != set->klen)
	4522	+ if (desc.type != NFT_DATA_VALUE \|\| desc.len != set->klen) {
	4523	+ nft_data_release(&elem.key.val, desc.type);
4523	4524	return err;
	4525	+ }
4524	4526
4525	4527	priv = set->ops->get(ctx->net, set, &elem, flags);
4526	4528	if (IS_ERR(priv))
@@ -4756,14 +4758,20 @@ static int nft_add_set_elem(struct nft_ctx ctx, struct nft_set set, · 229 unmodified lines
4756	4758	if (nla[NFTA_SET_ELEM_DATA] == NULL &&
4757	4759	!(flags & NFT_SET_ELEM_INTERVAL_END))
4758	4760	return -EINVAL;
4759		− if (nla[NFTA_SET_ELEM_DATA] != NULL &&
4760		− flags & NFT_SET_ELEM_INTERVAL_END)
4761		− return -EINVAL;
4762	4761	} else {
4763	4762	if (nla[NFTA_SET_ELEM_DATA] != NULL)
4764	4763	return -EINVAL;
4765	4764	}
4766	4765
	4766	+ if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
	4767	+ (nla[NFTA_SET_ELEM_DATA] \|\|
	4768	+ nla[NFTA_SET_ELEM_OBJREF] \|\|
	4769	+ nla[NFTA_SET_ELEM_TIMEOUT] \|\|
	4770	+ nla[NFTA_SET_ELEM_EXPIRATION] \|\|
	4771	+ nla[NFTA_SET_ELEM_USERDATA] \|\|
	4772	+ nla[NFTA_SET_ELEM_EXPR]))
	4773	+ return -EINVAL;
	4774	+
4767	4775	timeout = 0;
4768	4776	if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4769	4777	if (!(set->flags & NFT_SET_TIMEOUT))
@@ -5476,7 +5484,7 @@ static int nf_tables_newobj(struct net net, struct sock nlsk, · 706 unmodified lines
5476	5484	if (nlh->nlmsg_flags & NLM_F_REPLACE)
5477	5485	return -EOPNOTSUPP;
5478	5486
5479		− type = nft_obj_type_get(net, objtype);
	5487	+ type = __nft_obj_type_get(objtype);
5480	5488	nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5481	5489
5482	5490	return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);

net/netfilter/nf_tables_offload.c+6−0

@@ -44,6 +44,9 @@ struct nft_flow_rule nft_flow_rule_create(struct net net, · 43 unmodified lines
44	44	expr = nft_expr_next(expr);
45	45	}
46	46
	47	+ if (num_actions == 0)
	48	+ return ERR_PTR(-EOPNOTSUPP);
	49	+
47	50	flow = nft_flow_rule_alloc(num_actions);
48	51	if (!flow)
49	52	return ERR_PTR(-ENOMEM);
@@ -577,6 +580,9 @@ static int nft_offload_netdev_event(struct notifier_block *this, · 527 unmodified lines
577	580	struct net *net = dev_net(dev);
578	581	struct nft_chain *chain;
579	582
	583	+ if (event != NETDEV_UNREGISTER)
	584	+ return NOTIFY_DONE;
	585	+
580	586	mutex_lock(&net->nft.commit_mutex);
581	587	chain = __nft_offload_get_chain(dev);
582	588	if (chain)

net/netfilter/nft_bitwise.c+2−2

@@ -80,7 +80,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, · 79 unmodified lines
80	80	tb[NFTA_BITWISE_MASK]);
81	81	if (err < 0)
82	82	return err;
83		− if (d1.len != priv->len) {
	83	+ if (d1.type != NFT_DATA_VALUE \|\| d1.len != priv->len) {
84	84	err = -EINVAL;
85	85	goto err1;
86	86	}
@@ -89,7 +89,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, · 2 unmodified lines
89	89	tb[NFTA_BITWISE_XOR]);
90	90	if (err < 0)
91	91	goto err1;
92		− if (d2.len != priv->len) {
	92	+ if (d2.type != NFT_DATA_VALUE \|\| d2.len != priv->len) {
93	93	err = -EINVAL;
94	94	goto err2;
95	95	}

net/netfilter/nft_cmp.c+6−0

@@ -81,6 +81,12 @@ static int nft_cmp_init(const struct nft_ctx ctx, const struct nft_expr expr, · 80 unmodified lines
81	81	if (err < 0)
82	82	return err;
83	83
	84	+ if (desc.type != NFT_DATA_VALUE) {
	85	+ err = -EINVAL;
	86	+ nft_data_release(&priv->data, desc.type);
	87	+ return err;
	88	+ }
	89	+
84	90	priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
85	91	err = nft_validate_register_load(priv->sreg, desc.len);
86	92	if (err < 0)

net/netfilter/nft_range.c+10−0

@@ -66,11 +66,21 @@ static int nft_range_init(const struct nft_ctx ctx, const struct nft_expr expr · 65 unmodified lines
66	66	if (err < 0)
67	67	return err;
68	68
	69	+ if (desc_from.type != NFT_DATA_VALUE) {
	70	+ err = -EINVAL;
	71	+ goto err1;
	72	+ }
	73	+
69	74	err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to),
70	75	&desc_to, tb[NFTA_RANGE_TO_DATA]);
71	76	if (err < 0)
72	77	goto err1;
73	78
	79	+ if (desc_to.type != NFT_DATA_VALUE) {
	80	+ err = -EINVAL;
	81	+ goto err2;
	82	+ }
	83	+
74	84	if (desc_from.len != desc_to.len) {
75	85	err = -EINVAL;
76	86	goto err2;

net/netfilter/nft_set_rbtree.c+16−5

@@ -74,8 +74,13 @@ static bool __nft_rbtree_lookup(const struct net net, const struct nft_set set · 73 unmodified lines
74	74	parent = rcu_dereference_raw(parent->rb_left);
75	75	continue;
76	76	}
77		− if (nft_rbtree_interval_end(rbe))
78		− goto out;
	77	+ if (nft_rbtree_interval_end(rbe)) {
	78	+ if (nft_set_is_anonymous(set))
	79	+ return false;
	80	+ parent = rcu_dereference_raw(parent->rb_left);
	81	+ interval = NULL;
	82	+ continue;
	83	+ }
79	84
80	85	*ext = &rbe->ext;
81	86	return true;
@@ -88,7 +93,7 @@ static bool __nft_rbtree_lookup(const struct net net, const struct nft_set set · 6 unmodified lines
88	93	*ext = &interval->ext;
89	94	return true;
90	95	}
91		−out:
	96	+
92	97	return false;
93	98	}
94	99
@@ -139,8 +144,10 @@ static bool __nft_rbtree_get(const struct net net, const struct nft_set set, · 44 unmodified lines
139	144	if (flags & NFT_SET_ELEM_INTERVAL_END)
140	145	interval = rbe;
141	146	} else {
142		− if (!nft_set_elem_active(&rbe->ext, genmask))
	147	+ if (!nft_set_elem_active(&rbe->ext, genmask)) {
143	148	parent = rcu_dereference_raw(parent->rb_left);
	149	+ continue;
	150	+ }
144	151
145	152	if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) \|\|
146	153	(*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==
@@ -148,7 +155,11 @@ static bool __nft_rbtree_get(const struct net net, const struct nft_set set, · 1 unmodified line
148	155	*elem = rbe;
149	156	return true;
150	157	}
151		− return false;
	158	+
	159	+ if (nft_rbtree_interval_end(rbe))
	160	+ interval = NULL;
	161	+
	162	+ parent = rcu_dereference_raw(parent->rb_left);
152	163	}
153	164	}
154	165

tools/testing/selftests/netfilter/nft_nat.sh+176−156

@@ -8,9 +8,14 @@ ksft_skip=4 · 7 unmodified lines
8	8	ret=0
9	9	test_inet_nat=true
10	10
	11	+sfx=$(mktemp -u "XXXXXXXX")
	12	+ns0="ns0-$sfx"
	13	+ns1="ns1-$sfx"
	14	+ns2="ns2-$sfx"
	15	+
11	16	cleanup()
12	17	{
13		− for i in 0 1 2; do ip netns del ns$i;done
	18	+ for i in 0 1 2; do ip netns del ns$i-"$sfx";done
14	19	}
15	20
16	21	nft --version > /dev/null 2>&1
@@ -25,40 +30,49 @@ if [ $? -ne 0 ];then · 8 unmodified lines
25	30	exit $ksft_skip
26	31	fi
27	32
28		−ip netns add ns0
	33	+ip netns add "$ns0"
29	34	if [ $? -ne 0 ];then
30		− echo "SKIP: Could not create net namespace"
	35	+ echo "SKIP: Could not create net namespace $ns0"
31	36	exit $ksft_skip
32	37	fi
33	38
34	39	trap cleanup EXIT
35	40
36		−ip netns add ns1
37		−ip netns add ns2
	41	+ip netns add "$ns1"
	42	+if [ $? -ne 0 ];then
	43	+ echo "SKIP: Could not create net namespace $ns1"
	44	+ exit $ksft_skip
	45	+fi
	46	+
	47	+ip netns add "$ns2"
	48	+if [ $? -ne 0 ];then
	49	+ echo "SKIP: Could not create net namespace $ns2"
	50	+ exit $ksft_skip
	51	+fi
38	52
39		−ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 > /dev/null 2>&1
	53	+ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1
40	54	if [ $? -ne 0 ];then
41	55	echo "SKIP: No virtual ethernet pair device support in kernel"
42	56	exit $ksft_skip
43	57	fi
44		−ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
	58	+ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2"
45	59
46		−ip -net ns0 link set lo up
47		−ip -net ns0 link set veth0 up
48		−ip -net ns0 addr add 10.0.1.1/24 dev veth0
49		−ip -net ns0 addr add dead:1::1/64 dev veth0
	60	+ip -net "$ns0" link set lo up
	61	+ip -net "$ns0" link set veth0 up
	62	+ip -net "$ns0" addr add 10.0.1.1/24 dev veth0
	63	+ip -net "$ns0" addr add dead:1::1/64 dev veth0
50	64
51		−ip -net ns0 link set veth1 up
52		−ip -net ns0 addr add 10.0.2.1/24 dev veth1
53		−ip -net ns0 addr add dead:2::1/64 dev veth1
	65	+ip -net "$ns0" link set veth1 up
	66	+ip -net "$ns0" addr add 10.0.2.1/24 dev veth1
	67	+ip -net "$ns0" addr add dead:2::1/64 dev veth1
54	68
55	69	for i in 1 2; do
56		− ip -net ns$i link set lo up
57		− ip -net ns$i link set eth0 up
58		− ip -net ns$i addr add 10.0.$i.99/24 dev eth0
59		− ip -net ns$i route add default via 10.0.$i.1
60		− ip -net ns$i addr add dead:$i::99/64 dev eth0
61		− ip -net ns$i route add default via dead:$i::1
	70	+ ip -net ns$i-$sfx link set lo up
	71	+ ip -net ns$i-$sfx link set eth0 up
	72	+ ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0
	73	+ ip -net ns$i-$sfx route add default via 10.0.$i.1
	74	+ ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0
	75	+ ip -net ns$i-$sfx route add default via dead:$i::1
62	76	done
63	77
64	78	bad_counter()
@@ -66,8 +80,9 @@ bad_counter() · 1 unmodified line
66	80	local ns=$1
67	81	local counter=$2
68	82	local expect=$3
	83	+ local tag=$4
69	84
70		− echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2
	85	+ echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2
71	86	ip netns exec $ns nft list counter inet filter $counter 1>&2
72	87	}
73	88
@@ -78,24 +93,24 @@ check_counters() · 4 unmodified lines
78	93
79	94	cnt=$(ip netns exec $ns nft list counter inet filter ns0in \| grep -q "packets 1 bytes 84")
80	95	if [ $? -ne 0 ]; then
81		− bad_counter $ns ns0in "packets 1 bytes 84"
	96	+ bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1"
82	97	lret=1
83	98	fi
84	99	cnt=$(ip netns exec $ns nft list counter inet filter ns0out \| grep -q "packets 1 bytes 84")
85	100	if [ $? -ne 0 ]; then
86		− bad_counter $ns ns0out "packets 1 bytes 84"
	101	+ bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2"
87	102	lret=1
88	103	fi
89	104
90	105	expect="packets 1 bytes 104"
91	106	cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 \| grep -q "$expect")
92	107	if [ $? -ne 0 ]; then
93		− bad_counter $ns ns0in6 "$expect"
	108	+ bad_counter $ns ns0in6 "$expect" "check_counters 3"
94	109	lret=1
95	110	fi
96	111	cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 \| grep -q "$expect")
97	112	if [ $? -ne 0 ]; then
98		− bad_counter $ns ns0out6 "$expect"
	113	+ bad_counter $ns ns0out6 "$expect" "check_counters 4"
99	114	lret=1
100	115	fi
101	116
@@ -107,41 +122,41 @@ check_ns0_counters() · 5 unmodified lines
107	122	local ns=$1
108	123	local lret=0
109	124
110		− cnt=$(ip netns exec ns0 nft list counter inet filter ns0in \| grep -q "packets 0 bytes 0")
	125	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in \| grep -q "packets 0 bytes 0")
111	126	if [ $? -ne 0 ]; then
112		− bad_counter ns0 ns0in "packets 0 bytes 0"
	127	+ bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1"
113	128	lret=1
114	129	fi
115	130
116		− cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 \| grep -q "packets 0 bytes 0")
	131	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 \| grep -q "packets 0 bytes 0")
117	132	if [ $? -ne 0 ]; then
118		− bad_counter ns0 ns0in6 "packets 0 bytes 0"
	133	+ bad_counter "$ns0" ns0in6 "packets 0 bytes 0"
119	134	lret=1
120	135	fi
121	136
122		− cnt=$(ip netns exec ns0 nft list counter inet filter ns0out \| grep -q "packets 0 bytes 0")
	137	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out \| grep -q "packets 0 bytes 0")
123	138	if [ $? -ne 0 ]; then
124		− bad_counter ns0 ns0out "packets 0 bytes 0"
	139	+ bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2"
125	140	lret=1
126	141	fi
127		− cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 \| grep -q "packets 0 bytes 0")
	142	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 \| grep -q "packets 0 bytes 0")
128	143	if [ $? -ne 0 ]; then
129		− bad_counter ns0 ns0out6 "packets 0 bytes 0"
	144	+ bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 "
130	145	lret=1
131	146	fi
132	147
133	148	for dir in "in" "out" ; do
134	149	expect="packets 1 bytes 84"
135		− cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} \| grep -q "$expect")
	150	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} \| grep -q "$expect")
136	151	if [ $? -ne 0 ]; then
137		− bad_counter ns0 $ns$dir "$expect"
	152	+ bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4"
138	153	lret=1
139	154	fi
140	155
141	156	expect="packets 1 bytes 104"
142		− cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 \| grep -q "$expect")
	157	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 \| grep -q "$expect")
143	158	if [ $? -ne 0 ]; then
144		− bad_counter ns0 $ns$dir6 "$expect"
	159	+ bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5"
145	160	lret=1
146	161	fi
147	162	done
@@ -152,7 +167,7 @@ check_ns0_counters() · 4 unmodified lines
152	167	reset_counters()
153	168	{
154	169	for i in 0 1 2;do
155		− ip netns exec ns$i nft reset counters inet > /dev/null
	170	+ ip netns exec ns$i-$sfx nft reset counters inet > /dev/null
156	171	done
157	172	}
158	173
@@ -166,7 +181,7 @@ test_local_dnat6() · 7 unmodified lines
166	181	IPF="ip6"
167	182	fi
168	183
169		−ip netns exec ns0 nft -f - <<EOF
	184	+ip netns exec "$ns0" nft -f /dev/stdin <<EOF
170	185	table $family nat {
171	186	chain output {
172	187	type nat hook output priority 0; policy accept;
@@ -180,7 +195,7 @@ EOF · 7 unmodified lines
180	195	fi
181	196
182	197	# ping netns1, expect rewrite to netns2
183		− ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null
	198	+ ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null
184	199	if [ $? -ne 0 ]; then
185	200	lret=1
186	201	echo "ERROR: ping6 failed"
@@ -189,18 +204,18 @@ EOF · 2 unmodified lines
189	204
190	205	expect="packets 0 bytes 0"
191	206	for dir in "in6" "out6" ; do
192		− cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	207	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} \| grep -q "$expect")
193	208	if [ $? -ne 0 ]; then
194		− bad_counter ns0 ns1$dir "$expect"
	209	+ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1"
195	210	lret=1
196	211	fi
197	212	done
198	213
199	214	expect="packets 1 bytes 104"
200	215	for dir in "in6" "out6" ; do
201		− cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	216	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} \| grep -q "$expect")
202	217	if [ $? -ne 0 ]; then
203		− bad_counter ns0 ns2$dir "$expect"
	218	+ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2"
204	219	lret=1
205	220	fi
206	221	done
@@ -208,9 +223,9 @@ EOF · 1 unmodified line
208	223	# expect 0 count in ns1
209	224	expect="packets 0 bytes 0"
210	225	for dir in "in6" "out6" ; do
211		− cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	226	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} \| grep -q "$expect")
212	227	if [ $? -ne 0 ]; then
213		− bad_counter ns1 ns0$dir "$expect"
	228	+ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3"
214	229	lret=1
215	230	fi
216	231	done
@@ -218,15 +233,15 @@ EOF · 1 unmodified line
218	233	# expect 1 packet in ns2
219	234	expect="packets 1 bytes 104"
220	235	for dir in "in6" "out6" ; do
221		− cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	236	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} \| grep -q "$expect")
222	237	if [ $? -ne 0 ]; then
223		− bad_counter ns2 ns0$dir "$expect"
	238	+ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4"
224	239	lret=1
225	240	fi
226	241	done
227	242
228		− test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was $family NATted to ns2"
229		− ip netns exec ns0 nft flush chain ip6 nat output
	243	+ test $lret -eq 0 && echo "PASS: ipv6 ping to $ns1 was $family NATted to $ns2"
	244	+ ip netns exec "$ns0" nft flush chain ip6 nat output
230	245
231	246	return $lret
232	247	}
@@ -241,7 +256,7 @@ test_local_dnat() · 8 unmodified lines
241	256	IPF="ip"
242	257	fi
243	258
244		−ip netns exec ns0 nft -f - <<EOF 2>/dev/null
	259	+ip netns exec "$ns0" nft -f /dev/stdin <<EOF 2>/dev/null
245	260	table $family nat {
246	261	chain output {
247	262	type nat hook output priority 0; policy accept;
@@ -260,7 +275,7 @@ EOF · 12 unmodified lines
260	275	fi
261	276
262	277	# ping netns1, expect rewrite to netns2
263		− ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
	278	+ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
264	279	if [ $? -ne 0 ]; then
265	280	lret=1
266	281	echo "ERROR: ping failed"
@@ -269,18 +284,18 @@ EOF · 2 unmodified lines
269	284
270	285	expect="packets 0 bytes 0"
271	286	for dir in "in" "out" ; do
272		− cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	287	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} \| grep -q "$expect")
273	288	if [ $? -ne 0 ]; then
274		− bad_counter ns0 ns1$dir "$expect"
	289	+ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1"
275	290	lret=1
276	291	fi
277	292	done
278	293
279	294	expect="packets 1 bytes 84"
280	295	for dir in "in" "out" ; do
281		− cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	296	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} \| grep -q "$expect")
282	297	if [ $? -ne 0 ]; then
283		− bad_counter ns0 ns2$dir "$expect"
	298	+ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2"
284	299	lret=1
285	300	fi
286	301	done
@@ -288,9 +303,9 @@ EOF · 1 unmodified line
288	303	# expect 0 count in ns1
289	304	expect="packets 0 bytes 0"
290	305	for dir in "in" "out" ; do
291		− cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	306	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} \| grep -q "$expect")
292	307	if [ $? -ne 0 ]; then
293		− bad_counter ns1 ns0$dir "$expect"
	308	+ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3"
294	309	lret=1
295	310	fi
296	311	done
@@ -298,19 +313,19 @@ EOF · 1 unmodified line
298	313	# expect 1 packet in ns2
299	314	expect="packets 1 bytes 84"
300	315	for dir in "in" "out" ; do
301		− cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	316	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} \| grep -q "$expect")
302	317	if [ $? -ne 0 ]; then
303		− bad_counter ns2 ns0$dir "$expect"
	318	+ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4"
304	319	lret=1
305	320	fi
306	321	done
307	322
308		− test $lret -eq 0 && echo "PASS: ping to ns1 was $family NATted to ns2"
	323	+ test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2"
309	324
310		− ip netns exec ns0 nft flush chain $family nat output
	325	+ ip netns exec "$ns0" nft flush chain $family nat output
311	326
312	327	reset_counters
313		− ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
	328	+ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
314	329	if [ $? -ne 0 ]; then
315	330	lret=1
316	331	echo "ERROR: ping failed"
@@ -319,17 +334,17 @@ EOF · 2 unmodified lines
319	334
320	335	expect="packets 1 bytes 84"
321	336	for dir in "in" "out" ; do
322		− cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	337	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} \| grep -q "$expect")
323	338	if [ $? -ne 0 ]; then
324		− bad_counter ns1 ns1$dir "$expect"
	339	+ bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5"
325	340	lret=1
326	341	fi
327	342	done
328	343	expect="packets 0 bytes 0"
329	344	for dir in "in" "out" ; do
330		− cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	345	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} \| grep -q "$expect")
331	346	if [ $? -ne 0 ]; then
332		− bad_counter ns0 ns2$dir "$expect"
	347	+ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6"
333	348	lret=1
334	349	fi
335	350	done
@@ -337,9 +352,9 @@ EOF · 1 unmodified line
337	352	# expect 1 count in ns1
338	353	expect="packets 1 bytes 84"
339	354	for dir in "in" "out" ; do
340		− cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	355	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} \| grep -q "$expect")
341	356	if [ $? -ne 0 ]; then
342		− bad_counter ns0 ns0$dir "$expect"
	357	+ bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7"
343	358	lret=1
344	359	fi
345	360	done
@@ -347,14 +362,14 @@ EOF · 1 unmodified line
347	362	# expect 0 packet in ns2
348	363	expect="packets 0 bytes 0"
349	364	for dir in "in" "out" ; do
350		− cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	365	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} \| grep -q "$expect")
351	366	if [ $? -ne 0 ]; then
352		− bad_counter ns2 ns2$dir "$expect"
	367	+ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8"
353	368	lret=1
354	369	fi
355	370	done
356	371
357		− test $lret -eq 0 && echo "PASS: ping to ns1 OK after $family nat output chain flush"
	372	+ test $lret -eq 0 && echo "PASS: ping to $ns1 OK after $family nat output chain flush"
358	373
359	374	return $lret
360	375	}
@@ -366,26 +381,26 @@ test_masquerade6() · 5 unmodified lines
366	381	local natflags=$2
367	382	local lret=0
368	383
369		− ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
	384	+ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
370	385
371		− ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
	386	+ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
372	387	if [ $? -ne 0 ] ; then
373		− echo "ERROR: cannot ping ns1 from ns2 via ipv6"
	388	+ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6"
374	389	return 1
375	390	lret=1
376	391	fi
377	392
378	393	expect="packets 1 bytes 104"
379	394	for dir in "in6" "out6" ; do
380		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	395	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
381	396	if [ $? -ne 0 ]; then
382		− bad_counter ns1 ns2$dir "$expect"
	397	+ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1"
383	398	lret=1
384	399	fi
385	400
386		− cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	401	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} \| grep -q "$expect")
387	402	if [ $? -ne 0 ]; then
388		− bad_counter ns2 ns1$dir "$expect"
	403	+ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2"
389	404	lret=1
390	405	fi
391	406	done
@@ -393,7 +408,7 @@ test_masquerade6() · 1 unmodified line
393	408	reset_counters
394	409
395	410	# add masquerading rule
396		−ip netns exec ns0 nft -f - <<EOF
	411	+ip netns exec "$ns0" nft -f /dev/stdin <<EOF
397	412	table $family nat {
398	413	chain postrouting {
399	414	type nat hook postrouting priority 0; policy accept;
@@ -406,24 +421,24 @@ EOF · 6 unmodified lines
406	421	return $ksft_skip
407	422	fi
408	423
409		− ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
	424	+ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
410	425	if [ $? -ne 0 ] ; then
411		− echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags"
	426	+ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
412	427	lret=1
413	428	fi
414	429
415	430	# ns1 should have seen packets from ns0, due to masquerade
416	431	expect="packets 1 bytes 104"
417	432	for dir in "in6" "out6" ; do
418		− cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	433	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} \| grep -q "$expect")
419	434	if [ $? -ne 0 ]; then
420		− bad_counter ns1 ns0$dir "$expect"
	435	+ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3"
421	436	lret=1
422	437	fi
423	438
424		− cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	439	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} \| grep -q "$expect")
425	440	if [ $? -ne 0 ]; then
426		− bad_counter ns2 ns1$dir "$expect"
	441	+ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4"
427	442	lret=1
428	443	fi
429	444	done
@@ -431,32 +446,32 @@ EOF · 1 unmodified line
431	446	# ns1 should not have seen packets from ns2, due to masquerade
432	447	expect="packets 0 bytes 0"
433	448	for dir in "in6" "out6" ; do
434		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	449	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
435	450	if [ $? -ne 0 ]; then
436		− bad_counter ns1 ns0$dir "$expect"
	451	+ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5"
437	452	lret=1
438	453	fi
439	454
440		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	455	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} \| grep -q "$expect")
441	456	if [ $? -ne 0 ]; then
442		− bad_counter ns2 ns1$dir "$expect"
	457	+ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6"
443	458	lret=1
444	459	fi
445	460	done
446	461
447		− ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
	462	+ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
448	463	if [ $? -ne 0 ] ; then
449		− echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)"
	464	+ echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)"
450	465	lret=1
451	466	fi
452	467
453		− ip netns exec ns0 nft flush chain $family nat postrouting
	468	+ ip netns exec "$ns0" nft flush chain $family nat postrouting
454	469	if [ $? -ne 0 ]; then
455	470	echo "ERROR: Could not flush $family nat postrouting" 1>&2
456	471	lret=1
457	472	fi
458	473
459		− test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for ns2"
	474	+ test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for $ns2"
460	475
461	476	return $lret
462	477	}
@@ -467,26 +482,26 @@ test_masquerade() · 4 unmodified lines
467	482	local natflags=$2
468	483	local lret=0
469	484
470		− ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
471		− ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
	485	+ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
	486	+ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
472	487
473		− ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
	488	+ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
474	489	if [ $? -ne 0 ] ; then
475		− echo "ERROR: cannot ping ns1 from ns2 $natflags"
	490	+ echo "ERROR: cannot ping $ns1 from "$ns2" $natflags"
476	491	lret=1
477	492	fi
478	493
479	494	expect="packets 1 bytes 84"
480	495	for dir in "in" "out" ; do
481		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	496	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
482	497	if [ $? -ne 0 ]; then
483		− bad_counter ns1 ns2$dir "$expect"
	498	+ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
484	499	lret=1
485	500	fi
486	501
487		− cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	502	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} \| grep -q "$expect")
488	503	if [ $? -ne 0 ]; then
489		− bad_counter ns2 ns1$dir "$expect"
	504	+ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2"
490	505	lret=1
491	506	fi
492	507	done
@@ -494,7 +509,7 @@ test_masquerade() · 1 unmodified line
494	509	reset_counters
495	510
496	511	# add masquerading rule
497		−ip netns exec ns0 nft -f - <<EOF
	512	+ip netns exec "$ns0" nft -f /dev/stdin <<EOF
498	513	table $family nat {
499	514	chain postrouting {
500	515	type nat hook postrouting priority 0; policy accept;
@@ -507,24 +522,24 @@ EOF · 6 unmodified lines
507	522	return $ksft_skip
508	523	fi
509	524
510		− ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
	525	+ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
511	526	if [ $? -ne 0 ] ; then
512		− echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags"
	527	+ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
513	528	lret=1
514	529	fi
515	530
516	531	# ns1 should have seen packets from ns0, due to masquerade
517	532	expect="packets 1 bytes 84"
518	533	for dir in "in" "out" ; do
519		− cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} \| grep -q "$expect")
	534	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} \| grep -q "$expect")
520	535	if [ $? -ne 0 ]; then
521		− bad_counter ns1 ns0$dir "$expect"
	536	+ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3"
522	537	lret=1
523	538	fi
524	539
525		− cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	540	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} \| grep -q "$expect")
526	541	if [ $? -ne 0 ]; then
527		− bad_counter ns2 ns1$dir "$expect"
	542	+ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4"
528	543	lret=1
529	544	fi
530	545	done
@@ -532,32 +547,32 @@ EOF · 1 unmodified line
532	547	# ns1 should not have seen packets from ns2, due to masquerade
533	548	expect="packets 0 bytes 0"
534	549	for dir in "in" "out" ; do
535		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	550	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
536	551	if [ $? -ne 0 ]; then
537		− bad_counter ns1 ns0$dir "$expect"
	552	+ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5"
538	553	lret=1
539	554	fi
540	555
541		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	556	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} \| grep -q "$expect")
542	557	if [ $? -ne 0 ]; then
543		− bad_counter ns2 ns1$dir "$expect"
	558	+ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6"
544	559	lret=1
545	560	fi
546	561	done
547	562
548		− ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
	563	+ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
549	564	if [ $? -ne 0 ] ; then
550		− echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)"
	565	+ echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)"
551	566	lret=1
552	567	fi
553	568
554		− ip netns exec ns0 nft flush chain $family nat postrouting
	569	+ ip netns exec "$ns0" nft flush chain $family nat postrouting
555	570	if [ $? -ne 0 ]; then
556	571	echo "ERROR: Could not flush $family nat postrouting" 1>&2
557	572	lret=1
558	573	fi
559	574
560		− test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for ns2"
	575	+ test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for $ns2"
561	576
562	577	return $lret
563	578	}
@@ -567,25 +582,25 @@ test_redirect6() · 3 unmodified lines
567	582	local family=$1
568	583	local lret=0
569	584
570		− ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
	585	+ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
571	586
572		− ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
	587	+ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
573	588	if [ $? -ne 0 ] ; then
574		− echo "ERROR: cannnot ping ns1 from ns2 via ipv6"
	589	+ echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6"
575	590	lret=1
576	591	fi
577	592
578	593	expect="packets 1 bytes 104"
579	594	for dir in "in6" "out6" ; do
580		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	595	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
581	596	if [ $? -ne 0 ]; then
582		− bad_counter ns1 ns2$dir "$expect"
	597	+ bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1"
583	598	lret=1
584	599	fi
585	600
586		− cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	601	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} \| grep -q "$expect")
587	602	if [ $? -ne 0 ]; then
588		− bad_counter ns2 ns1$dir "$expect"
	603	+ bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2"
589	604	lret=1
590	605	fi
591	606	done
@@ -593,7 +608,7 @@ test_redirect6() · 1 unmodified line
593	608	reset_counters
594	609
595	610	# add redirect rule
596		−ip netns exec ns0 nft -f - <<EOF
	611	+ip netns exec "$ns0" nft -f /dev/stdin <<EOF
597	612	table $family nat {
598	613	chain prerouting {
599	614	type nat hook prerouting priority 0; policy accept;
@@ -606,18 +621,18 @@ EOF · 6 unmodified lines
606	621	return $ksft_skip
607	622	fi
608	623
609		− ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
	624	+ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
610	625	if [ $? -ne 0 ] ; then
611		− echo "ERROR: cannot ping ns1 from ns2 via ipv6 with active $family redirect"
	626	+ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect"
612	627	lret=1
613	628	fi
614	629
615	630	# ns1 should have seen no packets from ns2, due to redirection
616	631	expect="packets 0 bytes 0"
617	632	for dir in "in6" "out6" ; do
618		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	633	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
619	634	if [ $? -ne 0 ]; then
620		− bad_counter ns1 ns0$dir "$expect"
	635	+ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3"
621	636	lret=1
622	637	fi
623	638	done
@@ -625,20 +640,20 @@ EOF · 1 unmodified line
625	640	# ns0 should have seen packets from ns2, due to masquerade
626	641	expect="packets 1 bytes 104"
627	642	for dir in "in6" "out6" ; do
628		− cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	643	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} \| grep -q "$expect")
629	644	if [ $? -ne 0 ]; then
630		− bad_counter ns1 ns0$dir "$expect"
	645	+ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4"
631	646	lret=1
632	647	fi
633	648	done
634	649
635		− ip netns exec ns0 nft delete table $family nat
	650	+ ip netns exec "$ns0" nft delete table $family nat
636	651	if [ $? -ne 0 ]; then
637	652	echo "ERROR: Could not delete $family nat table" 1>&2
638	653	lret=1
639	654	fi
640	655
641		− test $lret -eq 0 && echo "PASS: $family IPv6 redirection for ns2"
	656	+ test $lret -eq 0 && echo "PASS: $family IPv6 redirection for $ns2"
642	657
643	658	return $lret
644	659	}
@@ -648,26 +663,26 @@ test_redirect() · 3 unmodified lines
648	663	local family=$1
649	664	local lret=0
650	665
651		− ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
652		− ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
	666	+ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
	667	+ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
653	668
654		− ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
	669	+ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
655	670	if [ $? -ne 0 ] ; then
656		− echo "ERROR: cannot ping ns1 from ns2"
	671	+ echo "ERROR: cannot ping $ns1 from $ns2"
657	672	lret=1
658	673	fi
659	674
660	675	expect="packets 1 bytes 84"
661	676	for dir in "in" "out" ; do
662		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	677	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
663	678	if [ $? -ne 0 ]; then
664		− bad_counter ns1 ns2$dir "$expect"
	679	+ bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1"
665	680	lret=1
666	681	fi
667	682
668		− cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} \| grep -q "$expect")
	683	+ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} \| grep -q "$expect")
669	684	if [ $? -ne 0 ]; then
670		− bad_counter ns2 ns1$dir "$expect"
	685	+ bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2"
671	686	lret=1
672	687	fi
673	688	done
@@ -675,7 +690,7 @@ test_redirect() · 1 unmodified line
675	690	reset_counters
676	691
677	692	# add redirect rule
678		−ip netns exec ns0 nft -f - <<EOF
	693	+ip netns exec "$ns0" nft -f /dev/stdin <<EOF
679	694	table $family nat {
680	695	chain prerouting {
681	696	type nat hook prerouting priority 0; policy accept;
@@ -688,9 +703,9 @@ EOF · 6 unmodified lines
688	703	return $ksft_skip
689	704	fi
690	705
691		− ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
	706	+ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
692	707	if [ $? -ne 0 ] ; then
693		− echo "ERROR: cannot ping ns1 from ns2 with active $family ip redirect"
	708	+ echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect"
694	709	lret=1
695	710	fi
696	711
@@ -698,9 +713,9 @@ EOF · 1 unmodified line
698	713	expect="packets 0 bytes 0"
699	714	for dir in "in" "out" ; do
700	715
701		− cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	716	+ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} \| grep -q "$expect")
702	717	if [ $? -ne 0 ]; then
703		− bad_counter ns1 ns0$dir "$expect"
	718	+ bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3"
704	719	lret=1
705	720	fi
706	721	done
@@ -708,28 +723,28 @@ EOF · 1 unmodified line
708	723	# ns0 should have seen packets from ns2, due to masquerade
709	724	expect="packets 1 bytes 84"
710	725	for dir in "in" "out" ; do
711		− cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} \| grep -q "$expect")
	726	+ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} \| grep -q "$expect")
712	727	if [ $? -ne 0 ]; then
713		− bad_counter ns1 ns0$dir "$expect"
	728	+ bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4"
714	729	lret=1
715	730	fi
716	731	done
717	732
718		− ip netns exec ns0 nft delete table $family nat
	733	+ ip netns exec "$ns0" nft delete table $family nat
719	734	if [ $? -ne 0 ]; then
720	735	echo "ERROR: Could not delete $family nat table" 1>&2
721	736	lret=1
722	737	fi
723	738
724		− test $lret -eq 0 && echo "PASS: $family IP redirection for ns2"
	739	+ test $lret -eq 0 && echo "PASS: $family IP redirection for $ns2"
725	740
726	741	return $lret
727	742	}
728	743
729	744
730		−# ip netns exec ns0 ping -c 1 -q 10.0.$i.99
	745	+# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99
731	746	for i in 0 1 2; do
732		−ip netns exec ns$i nft -f - <<EOF
	747	+ip netns exec ns$i-$sfx nft -f /dev/stdin <<EOF
733	748	table inet filter {
734	749	counter ns0in {}
735	750	counter ns1in {}
@@ -796,18 +811,18 @@ done · 60 unmodified lines
796	811	sleep 3
797	812	# test basic connectivity
798	813	for i in 1 2; do
799		− ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null
	814	+ ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null
800	815	if [ $? -ne 0 ];then
801	816	echo "ERROR: Could not reach other namespace(s)" 1>&2
802	817	ret=1
803	818	fi
804	819
805		− ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null
	820	+ ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null
806	821	if [ $? -ne 0 ];then
807	822	echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
808	823	ret=1
809	824	fi
810		− check_counters ns$i
	825	+ check_counters ns$i-$sfx
811	826	if [ $? -ne 0 ]; then
812	827	ret=1
813	828	fi
@@ -820,7 +835,7 @@ for i in 1 2; do · 6 unmodified lines
820	835	done
821	836
822	837	if [ $ret -eq 0 ];then
823		− echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2"
	838	+ echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2"
824	839	fi
825	840
826	841	reset_counters
@@ -846,4 +861,9 @@ reset_counters · 19 unmodified lines
846	861	$test_inet_nat && test_redirect inet
847	862	$test_inet_nat && test_redirect6 inet
848	863
	864	+if [ $ret -ne 0 ];then
	865	+ echo -n "FAIL: "
	866	+ nft --version
	867	+fi
	868	+
849	869	exit $ret

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code