History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Wait for rcu grace period after releasing netns in ctnetlink, from Florian Westphal. 2) Incorrect command type in flowtable offload ndo invocation, from wenxu. 3) Incorrect callback type in flowtable offload flow tuple updates, also from wenxu. 4) Fix compile warning on flowtable offload infrastructure due to possible reference to uninitialized variable, from Nathan Chancellor. 5) Do not inline nf_ct_resolve_clash(), this is called from slow path / stress situations. From Florian Westphal. 6) Missing IPv6 flow selector description in flowtable offload. 7) Missing check for NETDEV_UNREGISTER in nf_tables offload infrastructure, from wenxu. 8) Update NAT selftest to use randomized netns names, from Florian Westphal. 9) Restore nfqueue bridge support, from Marco Oliverio. 10) Compilation warning in SCTP_CHUNKMAP_*() on xt_sctp header. From Phil Sutter. 11) Fix bogus lookup/get match for non-anonymous rbtree sets. 12) Missing netlink validation for NFT_SET_ELEM_INTERVAL_END elements. 13) Missing netlink validation for NFT_DATA_VALUE after nft_data_init(). 14) If rule specifies no actions, offload infrastructure returns EOPNOTSUPP. 15) Module refcount leak in object updates. 16) Missing sanitization for ARP traffic from br_netfilter, from Eric Dumazet. 17) Compilation breakage on big-endian due to incorrect memcpy() size in the flowtable offload infrastructure. ====================

David S. Miller committed 6 years ago

Commit 7da538c2 parents f8fc57e 7acd93713 files · +288 −213Browse files

Unified · Split

13 files
  1. include/uapi/linux/netfilter/xt_sctp.h +3 −3
  2. net/bridge/br_netfilter_hooks.c +3 −0
  3. net/netfilter/nf_conntrack_core.c +4 −3
  4. net/netfilter/nf_conntrack_netlink.c +3 −0
  5. net/netfilter/nf_flow_table_offload.c +45 −38
  6. net/netfilter/nf_queue.c +1 −1
  7. net/netfilter/nf_tables_api.c +13 −5
  8. net/netfilter/nf_tables_offload.c +6 −0
  9. net/netfilter/nft_bitwise.c +2 −2
  10. net/netfilter/nft_cmp.c +6 −0
  11. net/netfilter/nft_range.c +10 −0
  12. net/netfilter/nft_set_rbtree.c +16 −5
  13. tools/testing/selftests/netfilter/nft_nat.sh +176 −156
include/uapi/linux/netfilter/xt_sctp.h+3−3
@@ -41,19 +41,19 @@ struct xt_sctp_info { · 40 unmodified lines
41#define SCTP_CHUNKMAP_SET(chunkmap, type) \41#define SCTP_CHUNKMAP_SET(chunkmap, type) \
42 do { \42 do { \
43 (chunkmap)[type / bytes(__u32)] |= \43 (chunkmap)[type / bytes(__u32)] |= \
44 1 << (type % bytes(__u32)); \44 1u << (type % bytes(__u32)); \
45 } while (0)45 } while (0)
46 46
47#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \47#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
48 do { \48 do { \
49 (chunkmap)[type / bytes(__u32)] &= \49 (chunkmap)[type / bytes(__u32)] &= \
50 ~(1 << (type % bytes(__u32))); \50 ~(1u << (type % bytes(__u32))); \
51 } while (0)51 } while (0)
52 52
53#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \53#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
54({ \54({ \
55 ((chunkmap)[type / bytes (__u32)] & \55 ((chunkmap)[type / bytes (__u32)] & \
56 (1 << (type % bytes (__u32)))) ? 1: 0; \56 (1u << (type % bytes (__u32)))) ? 1: 0; \
57})57})
58 58
59#define SCTP_CHUNKMAP_RESET(chunkmap) \59#define SCTP_CHUNKMAP_RESET(chunkmap) \
net/bridge/br_netfilter_hooks.c+3−0
@@ -662,6 +662,9 @@ static unsigned int br_nf_forward_arp(void *priv, · 661 unmodified lines
662 nf_bridge_pull_encap_header(skb);662 nf_bridge_pull_encap_header(skb);
663 }663 }
664 664
665 if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))
666 return NF_DROP;
667
665 if (arp_hdr(skb)->ar_pln != 4) {668 if (arp_hdr(skb)->ar_pln != 4) {
666 if (is_vlan_arp(skb, state->net))669 if (is_vlan_arp(skb, state->net))
667 nf_bridge_push_encap_header(skb);670 nf_bridge_push_encap_header(skb);
net/netfilter/nf_conntrack_core.c+4−3
@@ -895,9 +895,10 @@ static void nf_ct_acct_merge(struct nf_conn *ct, enum ip_conntrack_info ctinfo, · 894 unmodified lines
895}895}
896 896
897/* Resolve race on insertion if this protocol allows this. */897/* Resolve race on insertion if this protocol allows this. */
898static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb,898static __cold noinline int
899 enum ip_conntrack_info ctinfo,899nf_ct_resolve_clash(struct net *net, struct sk_buff *skb,
900 struct nf_conntrack_tuple_hash *h)900 enum ip_conntrack_info ctinfo,
901 struct nf_conntrack_tuple_hash *h)
901{902{
902 /* This is the conntrack entry already in hashes that won race. */903 /* This is the conntrack entry already in hashes that won race. */
903 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);904 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
net/netfilter/nf_conntrack_netlink.c+3−0
@@ -3626,6 +3626,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list) · 3625 unmodified lines
3626 3626
3627 list_for_each_entry(net, net_exit_list, exit_list)3627 list_for_each_entry(net, net_exit_list, exit_list)
3628 ctnetlink_net_exit(net);3628 ctnetlink_net_exit(net);
3629
3630 /* wait for other cpus until they are done with ctnl_notifiers */
3631 synchronize_rcu();
3629}3632}
3630 3633
3631static struct pernet_operations ctnetlink_net_ops = {3634static struct pernet_operations ctnetlink_net_ops = {
net/netfilter/nf_flow_table_offload.c+45−38
@@ -28,6 +28,7 @@ struct nf_flow_key { · 27 unmodified lines
28 struct flow_dissector_key_basic basic;28 struct flow_dissector_key_basic basic;
29 union {29 union {
30 struct flow_dissector_key_ipv4_addrs ipv4;30 struct flow_dissector_key_ipv4_addrs ipv4;
31 struct flow_dissector_key_ipv6_addrs ipv6;
31 };32 };
32 struct flow_dissector_key_tcp tcp;33 struct flow_dissector_key_tcp tcp;
33 struct flow_dissector_key_ports tp;34 struct flow_dissector_key_ports tp;
@@ -57,6 +58,7 @@ static int nf_flow_rule_match(struct nf_flow_match *match, · 23 unmodified lines
57 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_CONTROL, control);58 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_CONTROL, control);
58 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_BASIC, basic);59 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_BASIC, basic);
59 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4);60 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4);
61 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6);
60 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_TCP, tcp);62 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_TCP, tcp);
61 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_PORTS, tp);63 NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_PORTS, tp);
62 64
@@ -69,9 +71,18 @@ static int nf_flow_rule_match(struct nf_flow_match *match, · 6 unmodified lines
69 key->ipv4.dst = tuple->dst_v4.s_addr;71 key->ipv4.dst = tuple->dst_v4.s_addr;
70 mask->ipv4.dst = 0xffffffff;72 mask->ipv4.dst = 0xffffffff;
71 break;73 break;
74 case AF_INET6:
75 key->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
76 key->basic.n_proto = htons(ETH_P_IPV6);
77 key->ipv6.src = tuple->src_v6;
78 memset(&mask->ipv6.src, 0xff, sizeof(mask->ipv6.src));
79 key->ipv6.dst = tuple->dst_v6;
80 memset(&mask->ipv6.dst, 0xff, sizeof(mask->ipv6.dst));
81 break;
72 default:82 default:
73 return -EOPNOTSUPP;83 return -EOPNOTSUPP;
74 }84 }
85 match->dissector.used_keys |= BIT(key->control.addr_type);
75 mask->basic.n_proto = 0xffff;86 mask->basic.n_proto = 0xffff;
76 87
77 switch (tuple->l4proto) {88 switch (tuple->l4proto) {
@@ -96,14 +107,13 @@ static int nf_flow_rule_match(struct nf_flow_match *match, · 18 unmodified lines
96 107
97 match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CONTROL) |108 match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CONTROL) |
98 BIT(FLOW_DISSECTOR_KEY_BASIC) |109 BIT(FLOW_DISSECTOR_KEY_BASIC) |
99 BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
100 BIT(FLOW_DISSECTOR_KEY_PORTS);110 BIT(FLOW_DISSECTOR_KEY_PORTS);
101 return 0;111 return 0;
102}112}
103 113
104static void flow_offload_mangle(struct flow_action_entry *entry,114static void flow_offload_mangle(struct flow_action_entry *entry,
105 enum flow_action_mangle_base htype,115 enum flow_action_mangle_base htype, u32 offset,
106 u32 offset, u8 *value, u8 *mask)116 const __be32 *value, const __be32 *mask)
107{117{
108 entry->id = FLOW_ACTION_MANGLE;118 entry->id = FLOW_ACTION_MANGLE;
109 entry->mangle.htype = htype;119 entry->mangle.htype = htype;
@@ -140,12 +150,12 @@ static int flow_offload_eth_src(struct net *net, · 30 unmodified lines
140 memcpy(&val16, dev->dev_addr, 2);150 memcpy(&val16, dev->dev_addr, 2);
141 val = val16 << 16;151 val = val16 << 16;
142 flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,152 flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
143 (u8 *)&val, (u8 *)&mask);153 &val, &mask);
144 154
145 mask = ~0xffffffff;155 mask = ~0xffffffff;
146 memcpy(&val, dev->dev_addr + 2, 4);156 memcpy(&val, dev->dev_addr + 2, 4);
147 flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 8,157 flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 8,
148 (u8 *)&val, (u8 *)&mask);158 &val, &mask);
149 dev_put(dev);159 dev_put(dev);
150 160
151 return 0;161 return 0;
@@ -170,13 +180,13 @@ static int flow_offload_eth_dst(struct net *net, · 18 unmodified lines
170 mask = ~0xffffffff;180 mask = ~0xffffffff;
171 memcpy(&val, n->ha, 4);181 memcpy(&val, n->ha, 4);
172 flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,182 flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,
173 (u8 *)&val, (u8 *)&mask);183 &val, &mask);
174 184
175 mask = ~0x0000ffff;185 mask = ~0x0000ffff;
176 memcpy(&val16, n->ha + 4, 2);186 memcpy(&val16, n->ha + 4, 2);
177 val = val16;187 val = val16;
178 flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,188 flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
179 (u8 *)&val, (u8 *)&mask);189 &val, &mask);
180 neigh_release(n);190 neigh_release(n);
181 191
182 return 0;192 return 0;
@@ -206,7 +216,7 @@ static void flow_offload_ipv4_snat(struct net *net, · 23 unmodified lines
206 }216 }
207 217
208 flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset,218 flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset,
209 (u8 *)&addr, (u8 *)&mask);219 &addr, &mask);
210}220}
211 221
212static void flow_offload_ipv4_dnat(struct net *net,222static void flow_offload_ipv4_dnat(struct net *net,
@@ -233,12 +243,12 @@ static void flow_offload_ipv4_dnat(struct net *net, · 20 unmodified lines
233 }243 }
234 244
235 flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset,245 flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset,
236 (u8 *)&addr, (u8 *)&mask);246 &addr, &mask);
237}247}
238 248
239static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule,249static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule,
240 unsigned int offset,250 unsigned int offset,
241 u8 *addr, u8 *mask)251 const __be32 *addr, const __be32 *mask)
242{252{
243 struct flow_action_entry *entry;253 struct flow_action_entry *entry;
244 int i;254 int i;
@@ -246,8 +256,7 @@ static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, · 1 unmodified line
246 for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i += sizeof(u32)) {256 for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i += sizeof(u32)) {
247 entry = flow_action_entry_next(flow_rule);257 entry = flow_action_entry_next(flow_rule);
248 flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP6,258 flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP6,
249 offset + i,259 offset + i, &addr[i], mask);
250 &addr[i], mask);
251 }260 }
252}261}
253 262
@@ -257,23 +266,23 @@ static void flow_offload_ipv6_snat(struct net *net, · 3 unmodified lines
257 struct nf_flow_rule *flow_rule)266 struct nf_flow_rule *flow_rule)
258{267{
259 u32 mask = ~htonl(0xffffffff);268 u32 mask = ~htonl(0xffffffff);
260 const u8 *addr;269 const __be32 *addr;
261 u32 offset;270 u32 offset;
262 271
263 switch (dir) {272 switch (dir) {
264 case FLOW_OFFLOAD_DIR_ORIGINAL:273 case FLOW_OFFLOAD_DIR_ORIGINAL:
265 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6.s6_addr;274 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6.s6_addr32;
266 offset = offsetof(struct ipv6hdr, saddr);275 offset = offsetof(struct ipv6hdr, saddr);
267 break;276 break;
268 case FLOW_OFFLOAD_DIR_REPLY:277 case FLOW_OFFLOAD_DIR_REPLY:
269 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6.s6_addr;278 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6.s6_addr32;
270 offset = offsetof(struct ipv6hdr, daddr);279 offset = offsetof(struct ipv6hdr, daddr);
271 break;280 break;
272 default:281 default:
273 return;282 return;
274 }283 }
275 284
276 flow_offload_ipv6_mangle(flow_rule, offset, (u8 *)addr, (u8 *)&mask);285 flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask);
277}286}
278 287
279static void flow_offload_ipv6_dnat(struct net *net,288static void flow_offload_ipv6_dnat(struct net *net,
@@ -282,23 +291,23 @@ static void flow_offload_ipv6_dnat(struct net *net, · 2 unmodified lines
282 struct nf_flow_rule *flow_rule)291 struct nf_flow_rule *flow_rule)
283{292{
284 u32 mask = ~htonl(0xffffffff);293 u32 mask = ~htonl(0xffffffff);
285 const u8 *addr;294 const __be32 *addr;
286 u32 offset;295 u32 offset;
287 296
288 switch (dir) {297 switch (dir) {
289 case FLOW_OFFLOAD_DIR_ORIGINAL:298 case FLOW_OFFLOAD_DIR_ORIGINAL:
290 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6.s6_addr;299 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6.s6_addr32;
291 offset = offsetof(struct ipv6hdr, daddr);300 offset = offsetof(struct ipv6hdr, daddr);
292 break;301 break;
293 case FLOW_OFFLOAD_DIR_REPLY:302 case FLOW_OFFLOAD_DIR_REPLY:
294 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6.s6_addr;303 addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6.s6_addr32;
295 offset = offsetof(struct ipv6hdr, saddr);304 offset = offsetof(struct ipv6hdr, saddr);
296 break;305 break;
297 default:306 default:
298 return;307 return;
299 }308 }
300 309
301 flow_offload_ipv6_mangle(flow_rule, offset, (u8 *)addr, (u8 *)&mask);310 flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask);
302}311}
303 312
304static int flow_offload_l4proto(const struct flow_offload *flow)313static int flow_offload_l4proto(const struct flow_offload *flow)
@@ -326,25 +335,24 @@ static void flow_offload_port_snat(struct net *net, · 21 unmodified lines
326 struct nf_flow_rule *flow_rule)335 struct nf_flow_rule *flow_rule)
327{336{
328 struct flow_action_entry *entry = flow_action_entry_next(flow_rule);337 struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
329 u32 mask = ~htonl(0xffff0000);338 u32 mask = ~htonl(0xffff0000), port;
330 __be16 port;
331 u32 offset;339 u32 offset;
332 340
333 switch (dir) {341 switch (dir) {
334 case FLOW_OFFLOAD_DIR_ORIGINAL:342 case FLOW_OFFLOAD_DIR_ORIGINAL:
335 port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;343 port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
336 offset = 0; /* offsetof(struct tcphdr, source); */344 offset = 0; /* offsetof(struct tcphdr, source); */
337 break;345 break;
338 case FLOW_OFFLOAD_DIR_REPLY:346 case FLOW_OFFLOAD_DIR_REPLY:
339 port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;347 port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
340 offset = 0; /* offsetof(struct tcphdr, dest); */348 offset = 0; /* offsetof(struct tcphdr, dest); */
341 break;349 break;
342 default:350 default:
343 break;351 return;
344 }352 }
345 353 port = htonl(port << 16);
346 flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,354 flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
347 (u8 *)&port, (u8 *)&mask);355 &port, &mask);
348}356}
349 357
350static void flow_offload_port_dnat(struct net *net,358static void flow_offload_port_dnat(struct net *net,
@@ -353,25 +361,24 @@ static void flow_offload_port_dnat(struct net *net, · 2 unmodified lines
353 struct nf_flow_rule *flow_rule)361 struct nf_flow_rule *flow_rule)
354{362{
355 struct flow_action_entry *entry = flow_action_entry_next(flow_rule);363 struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
356 u32 mask = ~htonl(0xffff);364 u32 mask = ~htonl(0xffff), port;
357 __be16 port;
358 u32 offset;365 u32 offset;
359 366
360 switch (dir) {367 switch (dir) {
361 case FLOW_OFFLOAD_DIR_ORIGINAL:368 case FLOW_OFFLOAD_DIR_ORIGINAL:
362 port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;369 port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
363 offset = 0; /* offsetof(struct tcphdr, source); */370 offset = 0; /* offsetof(struct tcphdr, source); */
364 break;371 break;
365 case FLOW_OFFLOAD_DIR_REPLY:372 case FLOW_OFFLOAD_DIR_REPLY:
366 port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;373 port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
367 offset = 0; /* offsetof(struct tcphdr, dest); */374 offset = 0; /* offsetof(struct tcphdr, dest); */
368 break;375 break;
369 default:376 default:
370 break;377 return;
371 }378 }
372 379 port = htonl(port);
373 flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,380 flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
374 (u8 *)&port, (u8 *)&mask);381 &port, &mask);
375}382}
376 383
377static void flow_offload_ipv4_checksum(struct net *net,384static void flow_offload_ipv4_checksum(struct net *net,
@@ -574,7 +581,7 @@ static int flow_offload_tuple_add(struct flow_offload_work *offload, · 196 unmodified lines
574 cls_flow.rule = flow_rule->rule;581 cls_flow.rule = flow_rule->rule;
575 582
576 list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list) {583 list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list) {
577 err = block_cb->cb(TC_SETUP_FT, &cls_flow,584 err = block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow,
578 block_cb->cb_priv);585 block_cb->cb_priv);
579 if (err < 0)586 if (err < 0)
580 continue;587 continue;
@@ -599,7 +606,7 @@ static void flow_offload_tuple_del(struct flow_offload_work *offload, · 18 unmodified lines
599 &offload->flow->tuplehash[dir].tuple, &extack);606 &offload->flow->tuplehash[dir].tuple, &extack);
600 607
601 list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list)608 list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list)
602 block_cb->cb(TC_SETUP_FT, &cls_flow, block_cb->cb_priv);609 block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow, block_cb->cb_priv);
603 610
604 offload->flow->flags |= FLOW_OFFLOAD_HW_DEAD;611 offload->flow->flags |= FLOW_OFFLOAD_HW_DEAD;
605}612}
@@ -656,7 +663,7 @@ static void flow_offload_tuple_stats(struct flow_offload_work *offload, · 50 unmodified lines
656 &offload->flow->tuplehash[dir].tuple, &extack);663 &offload->flow->tuplehash[dir].tuple, &extack);
657 664
658 list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list)665 list_for_each_entry(block_cb, &flowtable->flow_block.cb_list, list)
659 block_cb->cb(TC_SETUP_FT, &cls_flow, block_cb->cb_priv);666 block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow, block_cb->cb_priv);
660 memcpy(stats, &cls_flow.stats, sizeof(*stats));667 memcpy(stats, &cls_flow.stats, sizeof(*stats));
661}668}
662 669
@@ -822,7 +829,7 @@ int nf_flow_table_offload_setup(struct nf_flowtable *flowtable, · 159 unmodified lines
822 bo.extack = &extack;829 bo.extack = &extack;
823 INIT_LIST_HEAD(&bo.cb_list);830 INIT_LIST_HEAD(&bo.cb_list);
824 831
825 err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);832 err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, &bo);
826 if (err < 0)833 if (err < 0)
827 return err;834 return err;
828 835
net/netfilter/nf_queue.c+1−1
@@ -189,7 +189,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, · 188 unmodified lines
189 goto err;189 goto err;
190 }190 }
191 191
192 if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {192 if (skb_dst(skb) && !skb_dst_force(skb)) {
193 status = -ENETDOWN;193 status = -ENETDOWN;
194 goto err;194 goto err;
195 }195 }
net/netfilter/nf_tables_api.c+13−5
@@ -4519,8 +4519,10 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, · 4518 unmodified lines
4519 return err;4519 return err;
4520 4520
4521 err = -EINVAL;4521 err = -EINVAL;
4522 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)4522 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
4523 nft_data_release(&elem.key.val, desc.type);
4523 return err;4524 return err;
4525 }
4524 4526
4525 priv = set->ops->get(ctx->net, set, &elem, flags);4527 priv = set->ops->get(ctx->net, set, &elem, flags);
4526 if (IS_ERR(priv))4528 if (IS_ERR(priv))
@@ -4756,14 +4758,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, · 229 unmodified lines
4756 if (nla[NFTA_SET_ELEM_DATA] == NULL &&4758 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
4757 !(flags & NFT_SET_ELEM_INTERVAL_END))4759 !(flags & NFT_SET_ELEM_INTERVAL_END))
4758 return -EINVAL;4760 return -EINVAL;
4759 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
4760 flags & NFT_SET_ELEM_INTERVAL_END)
4761 return -EINVAL;
4762 } else {4761 } else {
4763 if (nla[NFTA_SET_ELEM_DATA] != NULL)4762 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4764 return -EINVAL;4763 return -EINVAL;
4765 }4764 }
4766 4765
4766 if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
4767 (nla[NFTA_SET_ELEM_DATA] ||
4768 nla[NFTA_SET_ELEM_OBJREF] ||
4769 nla[NFTA_SET_ELEM_TIMEOUT] ||
4770 nla[NFTA_SET_ELEM_EXPIRATION] ||
4771 nla[NFTA_SET_ELEM_USERDATA] ||
4772 nla[NFTA_SET_ELEM_EXPR]))
4773 return -EINVAL;
4774
4767 timeout = 0;4775 timeout = 0;
4768 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {4776 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4769 if (!(set->flags & NFT_SET_TIMEOUT))4777 if (!(set->flags & NFT_SET_TIMEOUT))
@@ -5476,7 +5484,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, · 706 unmodified lines
5476 if (nlh->nlmsg_flags & NLM_F_REPLACE)5484 if (nlh->nlmsg_flags & NLM_F_REPLACE)
5477 return -EOPNOTSUPP;5485 return -EOPNOTSUPP;
5478 5486
5479 type = nft_obj_type_get(net, objtype);5487 type = __nft_obj_type_get(objtype);
5480 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);5488 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5481 5489
5482 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);5490 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
net/netfilter/nf_tables_offload.c+6−0
@@ -44,6 +44,9 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, · 43 unmodified lines
44 expr = nft_expr_next(expr);44 expr = nft_expr_next(expr);
45 }45 }
46 46
47 if (num_actions == 0)
48 return ERR_PTR(-EOPNOTSUPP);
49
47 flow = nft_flow_rule_alloc(num_actions);50 flow = nft_flow_rule_alloc(num_actions);
48 if (!flow)51 if (!flow)
49 return ERR_PTR(-ENOMEM);52 return ERR_PTR(-ENOMEM);
@@ -577,6 +580,9 @@ static int nft_offload_netdev_event(struct notifier_block *this, · 527 unmodified lines
577 struct net *net = dev_net(dev);580 struct net *net = dev_net(dev);
578 struct nft_chain *chain;581 struct nft_chain *chain;
579 582
583 if (event != NETDEV_UNREGISTER)
584 return NOTIFY_DONE;
585
580 mutex_lock(&net->nft.commit_mutex);586 mutex_lock(&net->nft.commit_mutex);
581 chain = __nft_offload_get_chain(dev);587 chain = __nft_offload_get_chain(dev);
582 if (chain)588 if (chain)
net/netfilter/nft_bitwise.c+2−2
@@ -80,7 +80,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, · 79 unmodified lines
80 tb[NFTA_BITWISE_MASK]);80 tb[NFTA_BITWISE_MASK]);
81 if (err < 0)81 if (err < 0)
82 return err;82 return err;
83 if (d1.len != priv->len) {83 if (d1.type != NFT_DATA_VALUE || d1.len != priv->len) {
84 err = -EINVAL;84 err = -EINVAL;
85 goto err1;85 goto err1;
86 }86 }
@@ -89,7 +89,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, · 2 unmodified lines
89 tb[NFTA_BITWISE_XOR]);89 tb[NFTA_BITWISE_XOR]);
90 if (err < 0)90 if (err < 0)
91 goto err1;91 goto err1;
92 if (d2.len != priv->len) {92 if (d2.type != NFT_DATA_VALUE || d2.len != priv->len) {
93 err = -EINVAL;93 err = -EINVAL;
94 goto err2;94 goto err2;
95 }95 }
net/netfilter/nft_cmp.c+6−0
@@ -81,6 +81,12 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr, · 80 unmodified lines
81 if (err < 0)81 if (err < 0)
82 return err;82 return err;
83 83
84 if (desc.type != NFT_DATA_VALUE) {
85 err = -EINVAL;
86 nft_data_release(&priv->data, desc.type);
87 return err;
88 }
89
84 priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);90 priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
85 err = nft_validate_register_load(priv->sreg, desc.len);91 err = nft_validate_register_load(priv->sreg, desc.len);
86 if (err < 0)92 if (err < 0)
net/netfilter/nft_range.c+10−0
@@ -66,11 +66,21 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr · 65 unmodified lines
66 if (err < 0)66 if (err < 0)
67 return err;67 return err;
68 68
69 if (desc_from.type != NFT_DATA_VALUE) {
70 err = -EINVAL;
71 goto err1;
72 }
73
69 err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to),74 err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to),
70 &desc_to, tb[NFTA_RANGE_TO_DATA]);75 &desc_to, tb[NFTA_RANGE_TO_DATA]);
71 if (err < 0)76 if (err < 0)
72 goto err1;77 goto err1;
73 78
79 if (desc_to.type != NFT_DATA_VALUE) {
80 err = -EINVAL;
81 goto err2;
82 }
83
74 if (desc_from.len != desc_to.len) {84 if (desc_from.len != desc_to.len) {
75 err = -EINVAL;85 err = -EINVAL;
76 goto err2;86 goto err2;
net/netfilter/nft_set_rbtree.c+16−5
@@ -74,8 +74,13 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set · 73 unmodified lines
74 parent = rcu_dereference_raw(parent->rb_left);74 parent = rcu_dereference_raw(parent->rb_left);
75 continue;75 continue;
76 }76 }
77 if (nft_rbtree_interval_end(rbe))77 if (nft_rbtree_interval_end(rbe)) {
78 goto out;78 if (nft_set_is_anonymous(set))
79 return false;
80 parent = rcu_dereference_raw(parent->rb_left);
81 interval = NULL;
82 continue;
83 }
79 84
80 *ext = &rbe->ext;85 *ext = &rbe->ext;
81 return true;86 return true;
@@ -88,7 +93,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set · 6 unmodified lines
88 *ext = &interval->ext;93 *ext = &interval->ext;
89 return true;94 return true;
90 }95 }
91out:96
92 return false;97 return false;
93}98}
94 99
@@ -139,8 +144,10 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, · 44 unmodified lines
139 if (flags & NFT_SET_ELEM_INTERVAL_END)144 if (flags & NFT_SET_ELEM_INTERVAL_END)
140 interval = rbe;145 interval = rbe;
141 } else {146 } else {
142 if (!nft_set_elem_active(&rbe->ext, genmask))147 if (!nft_set_elem_active(&rbe->ext, genmask)) {
143 parent = rcu_dereference_raw(parent->rb_left);148 parent = rcu_dereference_raw(parent->rb_left);
149 continue;
150 }
144 151
145 if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) ||152 if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) ||
146 (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==153 (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==
@@ -148,7 +155,11 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, · 1 unmodified line
148 *elem = rbe;155 *elem = rbe;
149 return true;156 return true;
150 }157 }
151 return false;158
159 if (nft_rbtree_interval_end(rbe))
160 interval = NULL;
161
162 parent = rcu_dereference_raw(parent->rb_left);
152 }163 }
153 }164 }
154 165
tools/testing/selftests/netfilter/nft_nat.sh+176−156
@@ -8,9 +8,14 @@ ksft_skip=4 · 7 unmodified lines
8ret=08ret=0
9test_inet_nat=true9test_inet_nat=true
10 10
11sfx=$(mktemp -u "XXXXXXXX")
12ns0="ns0-$sfx"
13ns1="ns1-$sfx"
14ns2="ns2-$sfx"
15
11cleanup()16cleanup()
12{17{
13 for i in 0 1 2; do ip netns del ns$i;done18 for i in 0 1 2; do ip netns del ns$i-"$sfx";done
14}19}
15 20
16nft --version > /dev/null 2>&121nft --version > /dev/null 2>&1
@@ -25,40 +30,49 @@ if [ $? -ne 0 ];then · 8 unmodified lines
25 exit $ksft_skip30 exit $ksft_skip
26fi31fi
27 32
28ip netns add ns033ip netns add "$ns0"
29if [ $? -ne 0 ];then34if [ $? -ne 0 ];then
30 echo "SKIP: Could not create net namespace"35 echo "SKIP: Could not create net namespace $ns0"
31 exit $ksft_skip36 exit $ksft_skip
32fi37fi
33 38
34trap cleanup EXIT39trap cleanup EXIT
35 40
36ip netns add ns141ip netns add "$ns1"
37ip netns add ns242if [ $? -ne 0 ];then
43 echo "SKIP: Could not create net namespace $ns1"
44 exit $ksft_skip
45fi
46
47ip netns add "$ns2"
48if [ $? -ne 0 ];then
49 echo "SKIP: Could not create net namespace $ns2"
50 exit $ksft_skip
51fi
38 52
39ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 > /dev/null 2>&153ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1
40if [ $? -ne 0 ];then54if [ $? -ne 0 ];then
41 echo "SKIP: No virtual ethernet pair device support in kernel"55 echo "SKIP: No virtual ethernet pair device support in kernel"
42 exit $ksft_skip56 exit $ksft_skip
43fi57fi
44ip link add veth1 netns ns0 type veth peer name eth0 netns ns258ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2"
45 59
46ip -net ns0 link set lo up60ip -net "$ns0" link set lo up
47ip -net ns0 link set veth0 up61ip -net "$ns0" link set veth0 up
48ip -net ns0 addr add 10.0.1.1/24 dev veth062ip -net "$ns0" addr add 10.0.1.1/24 dev veth0
49ip -net ns0 addr add dead:1::1/64 dev veth063ip -net "$ns0" addr add dead:1::1/64 dev veth0
50 64
51ip -net ns0 link set veth1 up65ip -net "$ns0" link set veth1 up
52ip -net ns0 addr add 10.0.2.1/24 dev veth166ip -net "$ns0" addr add 10.0.2.1/24 dev veth1
53ip -net ns0 addr add dead:2::1/64 dev veth167ip -net "$ns0" addr add dead:2::1/64 dev veth1
54 68
55for i in 1 2; do69for i in 1 2; do
56 ip -net ns$i link set lo up70 ip -net ns$i-$sfx link set lo up
57 ip -net ns$i link set eth0 up71 ip -net ns$i-$sfx link set eth0 up
58 ip -net ns$i addr add 10.0.$i.99/24 dev eth072 ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0
59 ip -net ns$i route add default via 10.0.$i.173 ip -net ns$i-$sfx route add default via 10.0.$i.1
60 ip -net ns$i addr add dead:$i::99/64 dev eth074 ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0
61 ip -net ns$i route add default via dead:$i::175 ip -net ns$i-$sfx route add default via dead:$i::1
62done76done
63 77
64bad_counter()78bad_counter()
@@ -66,8 +80,9 @@ bad_counter() · 1 unmodified line
66 local ns=$180 local ns=$1
67 local counter=$281 local counter=$2
68 local expect=$382 local expect=$3
83 local tag=$4
69 84
70 echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&285 echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2
71 ip netns exec $ns nft list counter inet filter $counter 1>&286 ip netns exec $ns nft list counter inet filter $counter 1>&2
72}87}
73 88
@@ -78,24 +93,24 @@ check_counters() · 4 unmodified lines
78 93
79 cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")94 cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
80 if [ $? -ne 0 ]; then95 if [ $? -ne 0 ]; then
81 bad_counter $ns ns0in "packets 1 bytes 84"96 bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1"
82 lret=197 lret=1
83 fi98 fi
84 cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")99 cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
85 if [ $? -ne 0 ]; then100 if [ $? -ne 0 ]; then
86 bad_counter $ns ns0out "packets 1 bytes 84"101 bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2"
87 lret=1102 lret=1
88 fi103 fi
89 104
90 expect="packets 1 bytes 104"105 expect="packets 1 bytes 104"
91 cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")106 cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
92 if [ $? -ne 0 ]; then107 if [ $? -ne 0 ]; then
93 bad_counter $ns ns0in6 "$expect"108 bad_counter $ns ns0in6 "$expect" "check_counters 3"
94 lret=1109 lret=1
95 fi110 fi
96 cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")111 cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
97 if [ $? -ne 0 ]; then112 if [ $? -ne 0 ]; then
98 bad_counter $ns ns0out6 "$expect"113 bad_counter $ns ns0out6 "$expect" "check_counters 4"
99 lret=1114 lret=1
100 fi115 fi
101 116
@@ -107,41 +122,41 @@ check_ns0_counters() · 5 unmodified lines
107 local ns=$1122 local ns=$1
108 local lret=0123 local lret=0
109 124
110 cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")125 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
111 if [ $? -ne 0 ]; then126 if [ $? -ne 0 ]; then
112 bad_counter ns0 ns0in "packets 0 bytes 0"127 bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1"
113 lret=1128 lret=1
114 fi129 fi
115 130
116 cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")131 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
117 if [ $? -ne 0 ]; then132 if [ $? -ne 0 ]; then
118 bad_counter ns0 ns0in6 "packets 0 bytes 0"133 bad_counter "$ns0" ns0in6 "packets 0 bytes 0"
119 lret=1134 lret=1
120 fi135 fi
121 136
122 cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")137 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
123 if [ $? -ne 0 ]; then138 if [ $? -ne 0 ]; then
124 bad_counter ns0 ns0out "packets 0 bytes 0"139 bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2"
125 lret=1140 lret=1
126 fi141 fi
127 cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")142 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
128 if [ $? -ne 0 ]; then143 if [ $? -ne 0 ]; then
129 bad_counter ns0 ns0out6 "packets 0 bytes 0"144 bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 "
130 lret=1145 lret=1
131 fi146 fi
132 147
133 for dir in "in" "out" ; do148 for dir in "in" "out" ; do
134 expect="packets 1 bytes 84"149 expect="packets 1 bytes 84"
135 cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect")150 cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} | grep -q "$expect")
136 if [ $? -ne 0 ]; then151 if [ $? -ne 0 ]; then
137 bad_counter ns0 $ns$dir "$expect"152 bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4"
138 lret=1153 lret=1
139 fi154 fi
140 155
141 expect="packets 1 bytes 104"156 expect="packets 1 bytes 104"
142 cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")157 cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
143 if [ $? -ne 0 ]; then158 if [ $? -ne 0 ]; then
144 bad_counter ns0 $ns$dir6 "$expect"159 bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5"
145 lret=1160 lret=1
146 fi161 fi
147 done162 done
@@ -152,7 +167,7 @@ check_ns0_counters() · 4 unmodified lines
152reset_counters()167reset_counters()
153{168{
154 for i in 0 1 2;do169 for i in 0 1 2;do
155 ip netns exec ns$i nft reset counters inet > /dev/null170 ip netns exec ns$i-$sfx nft reset counters inet > /dev/null
156 done171 done
157}172}
158 173
@@ -166,7 +181,7 @@ test_local_dnat6() · 7 unmodified lines
166 IPF="ip6"181 IPF="ip6"
167 fi182 fi
168 183
169ip netns exec ns0 nft -f - <<EOF184ip netns exec "$ns0" nft -f /dev/stdin <<EOF
170table $family nat {185table $family nat {
171 chain output {186 chain output {
172 type nat hook output priority 0; policy accept;187 type nat hook output priority 0; policy accept;
@@ -180,7 +195,7 @@ EOF · 7 unmodified lines
180 fi195 fi
181 196
182 # ping netns1, expect rewrite to netns2197 # ping netns1, expect rewrite to netns2
183 ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null198 ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null
184 if [ $? -ne 0 ]; then199 if [ $? -ne 0 ]; then
185 lret=1200 lret=1
186 echo "ERROR: ping6 failed"201 echo "ERROR: ping6 failed"
@@ -189,18 +204,18 @@ EOF · 2 unmodified lines
189 204
190 expect="packets 0 bytes 0"205 expect="packets 0 bytes 0"
191 for dir in "in6" "out6" ; do206 for dir in "in6" "out6" ; do
192 cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")207 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
193 if [ $? -ne 0 ]; then208 if [ $? -ne 0 ]; then
194 bad_counter ns0 ns1$dir "$expect"209 bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1"
195 lret=1210 lret=1
196 fi211 fi
197 done212 done
198 213
199 expect="packets 1 bytes 104"214 expect="packets 1 bytes 104"
200 for dir in "in6" "out6" ; do215 for dir in "in6" "out6" ; do
201 cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")216 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
202 if [ $? -ne 0 ]; then217 if [ $? -ne 0 ]; then
203 bad_counter ns0 ns2$dir "$expect"218 bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2"
204 lret=1219 lret=1
205 fi220 fi
206 done221 done
@@ -208,9 +223,9 @@ EOF · 1 unmodified line
208 # expect 0 count in ns1223 # expect 0 count in ns1
209 expect="packets 0 bytes 0"224 expect="packets 0 bytes 0"
210 for dir in "in6" "out6" ; do225 for dir in "in6" "out6" ; do
211 cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")226 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
212 if [ $? -ne 0 ]; then227 if [ $? -ne 0 ]; then
213 bad_counter ns1 ns0$dir "$expect"228 bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3"
214 lret=1229 lret=1
215 fi230 fi
216 done231 done
@@ -218,15 +233,15 @@ EOF · 1 unmodified line
218 # expect 1 packet in ns2233 # expect 1 packet in ns2
219 expect="packets 1 bytes 104"234 expect="packets 1 bytes 104"
220 for dir in "in6" "out6" ; do235 for dir in "in6" "out6" ; do
221 cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")236 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
222 if [ $? -ne 0 ]; then237 if [ $? -ne 0 ]; then
223 bad_counter ns2 ns0$dir "$expect"238 bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4"
224 lret=1239 lret=1
225 fi240 fi
226 done241 done
227 242
228 test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was $family NATted to ns2"243 test $lret -eq 0 && echo "PASS: ipv6 ping to $ns1 was $family NATted to $ns2"
229 ip netns exec ns0 nft flush chain ip6 nat output244 ip netns exec "$ns0" nft flush chain ip6 nat output
230 245
231 return $lret246 return $lret
232}247}
@@ -241,7 +256,7 @@ test_local_dnat() · 8 unmodified lines
241 IPF="ip"256 IPF="ip"
242 fi257 fi
243 258
244ip netns exec ns0 nft -f - <<EOF 2>/dev/null259ip netns exec "$ns0" nft -f /dev/stdin <<EOF 2>/dev/null
245table $family nat {260table $family nat {
246 chain output {261 chain output {
247 type nat hook output priority 0; policy accept;262 type nat hook output priority 0; policy accept;
@@ -260,7 +275,7 @@ EOF · 12 unmodified lines
260 fi275 fi
261 276
262 # ping netns1, expect rewrite to netns2277 # ping netns1, expect rewrite to netns2
263 ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null278 ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
264 if [ $? -ne 0 ]; then279 if [ $? -ne 0 ]; then
265 lret=1280 lret=1
266 echo "ERROR: ping failed"281 echo "ERROR: ping failed"
@@ -269,18 +284,18 @@ EOF · 2 unmodified lines
269 284
270 expect="packets 0 bytes 0"285 expect="packets 0 bytes 0"
271 for dir in "in" "out" ; do286 for dir in "in" "out" ; do
272 cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")287 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
273 if [ $? -ne 0 ]; then288 if [ $? -ne 0 ]; then
274 bad_counter ns0 ns1$dir "$expect"289 bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1"
275 lret=1290 lret=1
276 fi291 fi
277 done292 done
278 293
279 expect="packets 1 bytes 84"294 expect="packets 1 bytes 84"
280 for dir in "in" "out" ; do295 for dir in "in" "out" ; do
281 cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")296 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
282 if [ $? -ne 0 ]; then297 if [ $? -ne 0 ]; then
283 bad_counter ns0 ns2$dir "$expect"298 bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2"
284 lret=1299 lret=1
285 fi300 fi
286 done301 done
@@ -288,9 +303,9 @@ EOF · 1 unmodified line
288 # expect 0 count in ns1303 # expect 0 count in ns1
289 expect="packets 0 bytes 0"304 expect="packets 0 bytes 0"
290 for dir in "in" "out" ; do305 for dir in "in" "out" ; do
291 cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")306 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
292 if [ $? -ne 0 ]; then307 if [ $? -ne 0 ]; then
293 bad_counter ns1 ns0$dir "$expect"308 bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3"
294 lret=1309 lret=1
295 fi310 fi
296 done311 done
@@ -298,19 +313,19 @@ EOF · 1 unmodified line
298 # expect 1 packet in ns2313 # expect 1 packet in ns2
299 expect="packets 1 bytes 84"314 expect="packets 1 bytes 84"
300 for dir in "in" "out" ; do315 for dir in "in" "out" ; do
301 cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")316 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
302 if [ $? -ne 0 ]; then317 if [ $? -ne 0 ]; then
303 bad_counter ns2 ns0$dir "$expect"318 bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4"
304 lret=1319 lret=1
305 fi320 fi
306 done321 done
307 322
308 test $lret -eq 0 && echo "PASS: ping to ns1 was $family NATted to ns2"323 test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2"
309 324
310 ip netns exec ns0 nft flush chain $family nat output325 ip netns exec "$ns0" nft flush chain $family nat output
311 326
312 reset_counters327 reset_counters
313 ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null328 ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
314 if [ $? -ne 0 ]; then329 if [ $? -ne 0 ]; then
315 lret=1330 lret=1
316 echo "ERROR: ping failed"331 echo "ERROR: ping failed"
@@ -319,17 +334,17 @@ EOF · 2 unmodified lines
319 334
320 expect="packets 1 bytes 84"335 expect="packets 1 bytes 84"
321 for dir in "in" "out" ; do336 for dir in "in" "out" ; do
322 cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")337 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
323 if [ $? -ne 0 ]; then338 if [ $? -ne 0 ]; then
324 bad_counter ns1 ns1$dir "$expect"339 bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5"
325 lret=1340 lret=1
326 fi341 fi
327 done342 done
328 expect="packets 0 bytes 0"343 expect="packets 0 bytes 0"
329 for dir in "in" "out" ; do344 for dir in "in" "out" ; do
330 cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")345 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
331 if [ $? -ne 0 ]; then346 if [ $? -ne 0 ]; then
332 bad_counter ns0 ns2$dir "$expect"347 bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6"
333 lret=1348 lret=1
334 fi349 fi
335 done350 done
@@ -337,9 +352,9 @@ EOF · 1 unmodified line
337 # expect 1 count in ns1352 # expect 1 count in ns1
338 expect="packets 1 bytes 84"353 expect="packets 1 bytes 84"
339 for dir in "in" "out" ; do354 for dir in "in" "out" ; do
340 cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")355 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
341 if [ $? -ne 0 ]; then356 if [ $? -ne 0 ]; then
342 bad_counter ns0 ns0$dir "$expect"357 bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7"
343 lret=1358 lret=1
344 fi359 fi
345 done360 done
@@ -347,14 +362,14 @@ EOF · 1 unmodified line
347 # expect 0 packet in ns2362 # expect 0 packet in ns2
348 expect="packets 0 bytes 0"363 expect="packets 0 bytes 0"
349 for dir in "in" "out" ; do364 for dir in "in" "out" ; do
350 cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")365 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
351 if [ $? -ne 0 ]; then366 if [ $? -ne 0 ]; then
352 bad_counter ns2 ns2$dir "$expect"367 bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8"
353 lret=1368 lret=1
354 fi369 fi
355 done370 done
356 371
357 test $lret -eq 0 && echo "PASS: ping to ns1 OK after $family nat output chain flush"372 test $lret -eq 0 && echo "PASS: ping to $ns1 OK after $family nat output chain flush"
358 373
359 return $lret374 return $lret
360}375}
@@ -366,26 +381,26 @@ test_masquerade6() · 5 unmodified lines
366 local natflags=$2381 local natflags=$2
367 local lret=0382 local lret=0
368 383
369 ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null384 ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
370 385
371 ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1386 ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
372 if [ $? -ne 0 ] ; then387 if [ $? -ne 0 ] ; then
373 echo "ERROR: cannot ping ns1 from ns2 via ipv6"388 echo "ERROR: cannot ping $ns1 from $ns2 via ipv6"
374 return 1389 return 1
375 lret=1390 lret=1
376 fi391 fi
377 392
378 expect="packets 1 bytes 104"393 expect="packets 1 bytes 104"
379 for dir in "in6" "out6" ; do394 for dir in "in6" "out6" ; do
380 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")395 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
381 if [ $? -ne 0 ]; then396 if [ $? -ne 0 ]; then
382 bad_counter ns1 ns2$dir "$expect"397 bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1"
383 lret=1398 lret=1
384 fi399 fi
385 400
386 cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")401 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
387 if [ $? -ne 0 ]; then402 if [ $? -ne 0 ]; then
388 bad_counter ns2 ns1$dir "$expect"403 bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2"
389 lret=1404 lret=1
390 fi405 fi
391 done406 done
@@ -393,7 +408,7 @@ test_masquerade6() · 1 unmodified line
393 reset_counters408 reset_counters
394 409
395# add masquerading rule410# add masquerading rule
396ip netns exec ns0 nft -f - <<EOF411ip netns exec "$ns0" nft -f /dev/stdin <<EOF
397table $family nat {412table $family nat {
398 chain postrouting {413 chain postrouting {
399 type nat hook postrouting priority 0; policy accept;414 type nat hook postrouting priority 0; policy accept;
@@ -406,24 +421,24 @@ EOF · 6 unmodified lines
406 return $ksft_skip421 return $ksft_skip
407 fi422 fi
408 423
409 ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1424 ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
410 if [ $? -ne 0 ] ; then425 if [ $? -ne 0 ] ; then
411 echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags"426 echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
412 lret=1427 lret=1
413 fi428 fi
414 429
415 # ns1 should have seen packets from ns0, due to masquerade430 # ns1 should have seen packets from ns0, due to masquerade
416 expect="packets 1 bytes 104"431 expect="packets 1 bytes 104"
417 for dir in "in6" "out6" ; do432 for dir in "in6" "out6" ; do
418 cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")433 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
419 if [ $? -ne 0 ]; then434 if [ $? -ne 0 ]; then
420 bad_counter ns1 ns0$dir "$expect"435 bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3"
421 lret=1436 lret=1
422 fi437 fi
423 438
424 cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")439 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
425 if [ $? -ne 0 ]; then440 if [ $? -ne 0 ]; then
426 bad_counter ns2 ns1$dir "$expect"441 bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4"
427 lret=1442 lret=1
428 fi443 fi
429 done444 done
@@ -431,32 +446,32 @@ EOF · 1 unmodified line
431 # ns1 should not have seen packets from ns2, due to masquerade446 # ns1 should not have seen packets from ns2, due to masquerade
432 expect="packets 0 bytes 0"447 expect="packets 0 bytes 0"
433 for dir in "in6" "out6" ; do448 for dir in "in6" "out6" ; do
434 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")449 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
435 if [ $? -ne 0 ]; then450 if [ $? -ne 0 ]; then
436 bad_counter ns1 ns0$dir "$expect"451 bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5"
437 lret=1452 lret=1
438 fi453 fi
439 454
440 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")455 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
441 if [ $? -ne 0 ]; then456 if [ $? -ne 0 ]; then
442 bad_counter ns2 ns1$dir "$expect"457 bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6"
443 lret=1458 lret=1
444 fi459 fi
445 done460 done
446 461
447 ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1462 ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
448 if [ $? -ne 0 ] ; then463 if [ $? -ne 0 ] ; then
449 echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)"464 echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)"
450 lret=1465 lret=1
451 fi466 fi
452 467
453 ip netns exec ns0 nft flush chain $family nat postrouting468 ip netns exec "$ns0" nft flush chain $family nat postrouting
454 if [ $? -ne 0 ]; then469 if [ $? -ne 0 ]; then
455 echo "ERROR: Could not flush $family nat postrouting" 1>&2470 echo "ERROR: Could not flush $family nat postrouting" 1>&2
456 lret=1471 lret=1
457 fi472 fi
458 473
459 test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for ns2"474 test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for $ns2"
460 475
461 return $lret476 return $lret
462}477}
@@ -467,26 +482,26 @@ test_masquerade() · 4 unmodified lines
467 local natflags=$2482 local natflags=$2
468 local lret=0483 local lret=0
469 484
470 ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null485 ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
471 ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null486 ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
472 487
473 ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1488 ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
474 if [ $? -ne 0 ] ; then489 if [ $? -ne 0 ] ; then
475 echo "ERROR: cannot ping ns1 from ns2 $natflags"490 echo "ERROR: cannot ping $ns1 from "$ns2" $natflags"
476 lret=1491 lret=1
477 fi492 fi
478 493
479 expect="packets 1 bytes 84"494 expect="packets 1 bytes 84"
480 for dir in "in" "out" ; do495 for dir in "in" "out" ; do
481 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")496 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
482 if [ $? -ne 0 ]; then497 if [ $? -ne 0 ]; then
483 bad_counter ns1 ns2$dir "$expect"498 bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
484 lret=1499 lret=1
485 fi500 fi
486 501
487 cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")502 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
488 if [ $? -ne 0 ]; then503 if [ $? -ne 0 ]; then
489 bad_counter ns2 ns1$dir "$expect"504 bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2"
490 lret=1505 lret=1
491 fi506 fi
492 done507 done
@@ -494,7 +509,7 @@ test_masquerade() · 1 unmodified line
494 reset_counters509 reset_counters
495 510
496# add masquerading rule511# add masquerading rule
497ip netns exec ns0 nft -f - <<EOF512ip netns exec "$ns0" nft -f /dev/stdin <<EOF
498table $family nat {513table $family nat {
499 chain postrouting {514 chain postrouting {
500 type nat hook postrouting priority 0; policy accept;515 type nat hook postrouting priority 0; policy accept;
@@ -507,24 +522,24 @@ EOF · 6 unmodified lines
507 return $ksft_skip522 return $ksft_skip
508 fi523 fi
509 524
510 ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1525 ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
511 if [ $? -ne 0 ] ; then526 if [ $? -ne 0 ] ; then
512 echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags"527 echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
513 lret=1528 lret=1
514 fi529 fi
515 530
516 # ns1 should have seen packets from ns0, due to masquerade531 # ns1 should have seen packets from ns0, due to masquerade
517 expect="packets 1 bytes 84"532 expect="packets 1 bytes 84"
518 for dir in "in" "out" ; do533 for dir in "in" "out" ; do
519 cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")534 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
520 if [ $? -ne 0 ]; then535 if [ $? -ne 0 ]; then
521 bad_counter ns1 ns0$dir "$expect"536 bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3"
522 lret=1537 lret=1
523 fi538 fi
524 539
525 cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")540 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
526 if [ $? -ne 0 ]; then541 if [ $? -ne 0 ]; then
527 bad_counter ns2 ns1$dir "$expect"542 bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4"
528 lret=1543 lret=1
529 fi544 fi
530 done545 done
@@ -532,32 +547,32 @@ EOF · 1 unmodified line
532 # ns1 should not have seen packets from ns2, due to masquerade547 # ns1 should not have seen packets from ns2, due to masquerade
533 expect="packets 0 bytes 0"548 expect="packets 0 bytes 0"
534 for dir in "in" "out" ; do549 for dir in "in" "out" ; do
535 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")550 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
536 if [ $? -ne 0 ]; then551 if [ $? -ne 0 ]; then
537 bad_counter ns1 ns0$dir "$expect"552 bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5"
538 lret=1553 lret=1
539 fi554 fi
540 555
541 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")556 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
542 if [ $? -ne 0 ]; then557 if [ $? -ne 0 ]; then
543 bad_counter ns2 ns1$dir "$expect"558 bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6"
544 lret=1559 lret=1
545 fi560 fi
546 done561 done
547 562
548 ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1563 ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
549 if [ $? -ne 0 ] ; then564 if [ $? -ne 0 ] ; then
550 echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)"565 echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)"
551 lret=1566 lret=1
552 fi567 fi
553 568
554 ip netns exec ns0 nft flush chain $family nat postrouting569 ip netns exec "$ns0" nft flush chain $family nat postrouting
555 if [ $? -ne 0 ]; then570 if [ $? -ne 0 ]; then
556 echo "ERROR: Could not flush $family nat postrouting" 1>&2571 echo "ERROR: Could not flush $family nat postrouting" 1>&2
557 lret=1572 lret=1
558 fi573 fi
559 574
560 test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for ns2"575 test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for $ns2"
561 576
562 return $lret577 return $lret
563}578}
@@ -567,25 +582,25 @@ test_redirect6() · 3 unmodified lines
567 local family=$1582 local family=$1
568 local lret=0583 local lret=0
569 584
570 ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null585 ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
571 586
572 ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1587 ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
573 if [ $? -ne 0 ] ; then588 if [ $? -ne 0 ] ; then
574 echo "ERROR: cannnot ping ns1 from ns2 via ipv6"589 echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6"
575 lret=1590 lret=1
576 fi591 fi
577 592
578 expect="packets 1 bytes 104"593 expect="packets 1 bytes 104"
579 for dir in "in6" "out6" ; do594 for dir in "in6" "out6" ; do
580 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")595 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
581 if [ $? -ne 0 ]; then596 if [ $? -ne 0 ]; then
582 bad_counter ns1 ns2$dir "$expect"597 bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1"
583 lret=1598 lret=1
584 fi599 fi
585 600
586 cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")601 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
587 if [ $? -ne 0 ]; then602 if [ $? -ne 0 ]; then
588 bad_counter ns2 ns1$dir "$expect"603 bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2"
589 lret=1604 lret=1
590 fi605 fi
591 done606 done
@@ -593,7 +608,7 @@ test_redirect6() · 1 unmodified line
593 reset_counters608 reset_counters
594 609
595# add redirect rule610# add redirect rule
596ip netns exec ns0 nft -f - <<EOF611ip netns exec "$ns0" nft -f /dev/stdin <<EOF
597table $family nat {612table $family nat {
598 chain prerouting {613 chain prerouting {
599 type nat hook prerouting priority 0; policy accept;614 type nat hook prerouting priority 0; policy accept;
@@ -606,18 +621,18 @@ EOF · 6 unmodified lines
606 return $ksft_skip621 return $ksft_skip
607 fi622 fi
608 623
609 ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1624 ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
610 if [ $? -ne 0 ] ; then625 if [ $? -ne 0 ] ; then
611 echo "ERROR: cannot ping ns1 from ns2 via ipv6 with active $family redirect"626 echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect"
612 lret=1627 lret=1
613 fi628 fi
614 629
615 # ns1 should have seen no packets from ns2, due to redirection630 # ns1 should have seen no packets from ns2, due to redirection
616 expect="packets 0 bytes 0"631 expect="packets 0 bytes 0"
617 for dir in "in6" "out6" ; do632 for dir in "in6" "out6" ; do
618 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")633 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
619 if [ $? -ne 0 ]; then634 if [ $? -ne 0 ]; then
620 bad_counter ns1 ns0$dir "$expect"635 bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3"
621 lret=1636 lret=1
622 fi637 fi
623 done638 done
@@ -625,20 +640,20 @@ EOF · 1 unmodified line
625 # ns0 should have seen packets from ns2, due to masquerade640 # ns0 should have seen packets from ns2, due to masquerade
626 expect="packets 1 bytes 104"641 expect="packets 1 bytes 104"
627 for dir in "in6" "out6" ; do642 for dir in "in6" "out6" ; do
628 cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")643 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
629 if [ $? -ne 0 ]; then644 if [ $? -ne 0 ]; then
630 bad_counter ns1 ns0$dir "$expect"645 bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4"
631 lret=1646 lret=1
632 fi647 fi
633 done648 done
634 649
635 ip netns exec ns0 nft delete table $family nat650 ip netns exec "$ns0" nft delete table $family nat
636 if [ $? -ne 0 ]; then651 if [ $? -ne 0 ]; then
637 echo "ERROR: Could not delete $family nat table" 1>&2652 echo "ERROR: Could not delete $family nat table" 1>&2
638 lret=1653 lret=1
639 fi654 fi
640 655
641 test $lret -eq 0 && echo "PASS: $family IPv6 redirection for ns2"656 test $lret -eq 0 && echo "PASS: $family IPv6 redirection for $ns2"
642 657
643 return $lret658 return $lret
644}659}
@@ -648,26 +663,26 @@ test_redirect() · 3 unmodified lines
648 local family=$1663 local family=$1
649 local lret=0664 local lret=0
650 665
651 ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null666 ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
652 ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null667 ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
653 668
654 ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1669 ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
655 if [ $? -ne 0 ] ; then670 if [ $? -ne 0 ] ; then
656 echo "ERROR: cannot ping ns1 from ns2"671 echo "ERROR: cannot ping $ns1 from $ns2"
657 lret=1672 lret=1
658 fi673 fi
659 674
660 expect="packets 1 bytes 84"675 expect="packets 1 bytes 84"
661 for dir in "in" "out" ; do676 for dir in "in" "out" ; do
662 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")677 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
663 if [ $? -ne 0 ]; then678 if [ $? -ne 0 ]; then
664 bad_counter ns1 ns2$dir "$expect"679 bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1"
665 lret=1680 lret=1
666 fi681 fi
667 682
668 cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")683 cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
669 if [ $? -ne 0 ]; then684 if [ $? -ne 0 ]; then
670 bad_counter ns2 ns1$dir "$expect"685 bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2"
671 lret=1686 lret=1
672 fi687 fi
673 done688 done
@@ -675,7 +690,7 @@ test_redirect() · 1 unmodified line
675 reset_counters690 reset_counters
676 691
677# add redirect rule692# add redirect rule
678ip netns exec ns0 nft -f - <<EOF693ip netns exec "$ns0" nft -f /dev/stdin <<EOF
679table $family nat {694table $family nat {
680 chain prerouting {695 chain prerouting {
681 type nat hook prerouting priority 0; policy accept;696 type nat hook prerouting priority 0; policy accept;
@@ -688,9 +703,9 @@ EOF · 6 unmodified lines
688 return $ksft_skip703 return $ksft_skip
689 fi704 fi
690 705
691 ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1706 ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
692 if [ $? -ne 0 ] ; then707 if [ $? -ne 0 ] ; then
693 echo "ERROR: cannot ping ns1 from ns2 with active $family ip redirect"708 echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect"
694 lret=1709 lret=1
695 fi710 fi
696 711
@@ -698,9 +713,9 @@ EOF · 1 unmodified line
698 expect="packets 0 bytes 0"713 expect="packets 0 bytes 0"
699 for dir in "in" "out" ; do714 for dir in "in" "out" ; do
700 715
701 cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")716 cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
702 if [ $? -ne 0 ]; then717 if [ $? -ne 0 ]; then
703 bad_counter ns1 ns0$dir "$expect"718 bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3"
704 lret=1719 lret=1
705 fi720 fi
706 done721 done
@@ -708,28 +723,28 @@ EOF · 1 unmodified line
708 # ns0 should have seen packets from ns2, due to masquerade723 # ns0 should have seen packets from ns2, due to masquerade
709 expect="packets 1 bytes 84"724 expect="packets 1 bytes 84"
710 for dir in "in" "out" ; do725 for dir in "in" "out" ; do
711 cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")726 cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
712 if [ $? -ne 0 ]; then727 if [ $? -ne 0 ]; then
713 bad_counter ns1 ns0$dir "$expect"728 bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4"
714 lret=1729 lret=1
715 fi730 fi
716 done731 done
717 732
718 ip netns exec ns0 nft delete table $family nat733 ip netns exec "$ns0" nft delete table $family nat
719 if [ $? -ne 0 ]; then734 if [ $? -ne 0 ]; then
720 echo "ERROR: Could not delete $family nat table" 1>&2735 echo "ERROR: Could not delete $family nat table" 1>&2
721 lret=1736 lret=1
722 fi737 fi
723 738
724 test $lret -eq 0 && echo "PASS: $family IP redirection for ns2"739 test $lret -eq 0 && echo "PASS: $family IP redirection for $ns2"
725 740
726 return $lret741 return $lret
727}742}
728 743
729 744
730# ip netns exec ns0 ping -c 1 -q 10.0.$i.99745# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99
731for i in 0 1 2; do746for i in 0 1 2; do
732ip netns exec ns$i nft -f - <<EOF747ip netns exec ns$i-$sfx nft -f /dev/stdin <<EOF
733table inet filter {748table inet filter {
734 counter ns0in {}749 counter ns0in {}
735 counter ns1in {}750 counter ns1in {}
@@ -796,18 +811,18 @@ done · 60 unmodified lines
796sleep 3811sleep 3
797# test basic connectivity812# test basic connectivity
798for i in 1 2; do813for i in 1 2; do
799 ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null814 ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null
800 if [ $? -ne 0 ];then815 if [ $? -ne 0 ];then
801 echo "ERROR: Could not reach other namespace(s)" 1>&2816 echo "ERROR: Could not reach other namespace(s)" 1>&2
802 ret=1817 ret=1
803 fi818 fi
804 819
805 ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null820 ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null
806 if [ $? -ne 0 ];then821 if [ $? -ne 0 ];then
807 echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2822 echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
808 ret=1823 ret=1
809 fi824 fi
810 check_counters ns$i825 check_counters ns$i-$sfx
811 if [ $? -ne 0 ]; then826 if [ $? -ne 0 ]; then
812 ret=1827 ret=1
813 fi828 fi
@@ -820,7 +835,7 @@ for i in 1 2; do · 6 unmodified lines
820done835done
821 836
822if [ $ret -eq 0 ];then837if [ $ret -eq 0 ];then
823 echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2"838 echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2"
824fi839fi
825 840
826reset_counters841reset_counters
@@ -846,4 +861,9 @@ reset_counters · 19 unmodified lines
846$test_inet_nat && test_redirect inet861$test_inet_nat && test_redirect inet
847$test_inet_nat && test_redirect6 inet862$test_inet_nat && test_redirect6 inet
848 863
864if [ $ret -ne 0 ];then
865 echo -n "FAIL: "
866 nft --version
867fi
868
849exit $ret869exit $ret

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t