Commit cebb3522 authored by Florian Westphal's avatar Florian Westphal Committed by Jakub Kicinski
Browse files

selftests: netfilter: nft_queue.sh: shellcheck cleanups 



No functional change intended.  Disable frequent shellcheck warnings wrt.
"unreachable" code, those helpers get called indirectly from busywait helper.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240418152744.15105-3-fw@strlen.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 03a1a62f

tools/testing/selftests/net/netfilter/nft_queue.sh

+103 −108
Original line number Diff line number Diff line
@@ -3,6 +3,8 @@ 
# This tests nf_queue:

# 1. can process packets from all hooks

# 2. support running nfqueue from more than one base chain

#

# shellcheck disable=SC2162,SC2317



source lib.sh

ret=0
@@ -10,9 +12,9 @@ timeout=2 


cleanup()

{

	ip netns pids ${ns1} | xargs kill 2>/dev/null

	ip netns pids ${ns2} | xargs kill 2>/dev/null

	ip netns pids ${nsrouter} | xargs kill 2>/dev/null

	ip netns pids "$ns1" | xargs kill 2>/dev/null

	ip netns pids "$ns2" | xargs kill 2>/dev/null

	ip netns pids "$nsrouter" | xargs kill 2>/dev/null



	cleanup_all_ns
@@ -22,11 +24,7 @@ cleanup() 
	rm -f "$TMPFILE2" "$TMPFILE3"

}



nft --version > /dev/null 2>&1

if [ $? -ne 0 ];then

	echo "SKIP: Could not run test without nft tool"

	exit $ksft_skip

fi

checktool "nft --version" "test without nft tool"



trap cleanup EXIT
@@ -38,41 +36,40 @@ TMPFILE2=$(mktemp) 
TMPFILE3=$(mktemp)



TMPINPUT=$(mktemp)

dd conv=sparse status=none if=/dev/zero bs=1M count=200 of=$TMPINPUT

dd conv=sparse status=none if=/dev/zero bs=1M count=200 of="$TMPINPUT"



ip link add veth0 netns ${nsrouter} type veth peer name eth0 netns ${ns1} > /dev/null 2>&1

if [ $? -ne 0 ];then

if ! ip link add veth0 netns "$nsrouter" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1; then

    echo "SKIP: No virtual ethernet pair device support in kernel"

    exit $ksft_skip

fi

ip link add veth1 netns ${nsrouter} type veth peer name eth0 netns ${ns2}

ip link add veth1 netns "$nsrouter" type veth peer name eth0 netns "$ns2"



ip -net ${nsrouter} link set veth0 up

ip -net ${nsrouter} addr add 10.0.1.1/24 dev veth0

ip -net ${nsrouter} addr add dead:1::1/64 dev veth0 nodad

ip -net "$nsrouter" link set veth0 up

ip -net "$nsrouter" addr add 10.0.1.1/24 dev veth0

ip -net "$nsrouter" addr add dead:1::1/64 dev veth0 nodad



ip -net ${nsrouter} link set veth1 up

ip -net ${nsrouter} addr add 10.0.2.1/24 dev veth1

ip -net ${nsrouter} addr add dead:2::1/64 dev veth1 nodad

ip -net "$nsrouter" link set veth1 up

ip -net "$nsrouter" addr add 10.0.2.1/24 dev veth1

ip -net "$nsrouter" addr add dead:2::1/64 dev veth1 nodad



ip -net ${ns1} link set eth0 up

ip -net ${ns2} link set eth0 up

ip -net "$ns1" link set eth0 up

ip -net "$ns2" link set eth0 up



ip -net ${ns1} addr add 10.0.1.99/24 dev eth0

ip -net ${ns1} addr add dead:1::99/64 dev eth0 nodad

ip -net ${ns1} route add default via 10.0.1.1

ip -net ${ns1} route add default via dead:1::1

ip -net "$ns1" addr add 10.0.1.99/24 dev eth0

ip -net "$ns1" addr add dead:1::99/64 dev eth0 nodad

ip -net "$ns1" route add default via 10.0.1.1

ip -net "$ns1" route add default via dead:1::1



ip -net ${ns2} addr add 10.0.2.99/24 dev eth0

ip -net ${ns2} addr add dead:2::99/64 dev eth0 nodad

ip -net ${ns2} route add default via 10.0.2.1

ip -net ${ns2} route add default via dead:2::1

ip -net "$ns2" addr add 10.0.2.99/24 dev eth0

ip -net "$ns2" addr add dead:2::99/64 dev eth0 nodad

ip -net "$ns2" route add default via 10.0.2.1

ip -net "$ns2" route add default via dead:2::1



load_ruleset() {

	local name=$1

	local prio=$2



ip netns exec ${nsrouter} nft -f /dev/stdin <<EOF

ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF

table inet $name {

	chain nfq {

		ip protocol icmp queue bypass
@@ -108,7 +105,7 @@ EOF 
load_counter_ruleset() {

	local prio=$1



ip netns exec ${nsrouter} nft -f /dev/stdin <<EOF

ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF

table inet countrules {

	chain pre {

		type filter hook prerouting priority $prio; policy accept;
@@ -135,13 +132,11 @@ EOF 
}



test_ping() {

  ip netns exec ${ns1} ping -c 1 -q 10.0.2.99 > /dev/null

  if [ $? -ne 0 ];then

  if ! ip netns exec "$ns1" ping -c 1 -q 10.0.2.99 > /dev/null; then

	return 1

  fi



  ip netns exec ${ns1} ping -c 1 -q dead:2::99 > /dev/null

  if [ $? -ne 0 ];then

  if ! ip netns exec "$ns1" ping -c 1 -q dead:2::99 > /dev/null; then

	return 2

  fi
@@ -149,13 +144,11 @@ test_ping() { 
}



test_ping_router() {

  ip netns exec ${ns1} ping -c 1 -q 10.0.2.1 > /dev/null

  if [ $? -ne 0 ];then

  if ! ip netns exec "$ns1" ping -c 1 -q 10.0.2.1 > /dev/null; then

	return 3

  fi



  ip netns exec ${ns1} ping -c 1 -q dead:2::1 > /dev/null

  if [ $? -ne 0 ];then

  if ! ip netns exec "$ns1" ping -c 1 -q dead:2::1 > /dev/null; then

	return 4

  fi
@@ -165,7 +158,7 @@ test_ping_router() { 
test_queue_blackhole() {

	local proto=$1



ip netns exec ${nsrouter} nft -f /dev/stdin <<EOF

ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF

table $proto blackh {

	chain forward {

	type filter hook forward priority 0; policy accept;
@@ -173,24 +166,23 @@ table $proto blackh { 
	}

}

EOF

	if [ $proto = "ip" ] ;then

		ip netns exec ${ns1} ping -W 2 -c 1 -q 10.0.2.99 > /dev/null

	if [ "$proto" = "ip" ] ;then

		ip netns exec "$ns1" ping -W 2 -c 1 -q 10.0.2.99 > /dev/null

		lret=$?

	elif [ $proto = "ip6" ]; then

		ip netns exec ${ns1} ping -W 2 -c 1 -q dead:2::99 > /dev/null

	elif [ "$proto" = "ip6" ]; then

		ip netns exec "$ns1" ping -W 2 -c 1 -q dead:2::99 > /dev/null

		lret=$?

	else

		lret=111

	fi



	# queue without bypass keyword should drop traffic if no listener exists.

	if [ $lret -eq 0 ];then

	if [ "$lret" -eq 0 ];then

		echo "FAIL: $proto expected failure, got $lret" 1>&2

		exit 1

	fi



	ip netns exec ${nsrouter} nft delete table $proto blackh

	if [ $? -ne 0 ] ;then

	if ! ip netns exec "$nsrouter" nft delete table "$proto" blackh; then

	        echo "FAIL: $proto: Could not delete blackh table"

	        exit 1

	fi
@@ -198,26 +190,41 @@ EOF 
        echo "PASS: $proto: statement with no listener results in packet drop"

}



nf_queue_wait()

{

	local procfile="/proc/self/net/netfilter/nfnetlink_queue"

	local netns id



	netns="$1"

	id="$2"



	# if this file doesn't exist, nfnetlink_module isn't loaded.

	# rather than loading it ourselves, wait for kernel module autoload

	# completion, nfnetlink should do so automatically because nf_queue

	# helper program, spawned in the background, asked for this functionality.

	test -f "$procfile" &&

		ip netns exec "$netns" cat "$procfile" | grep -q "^ *$id "

}



test_queue()

{

	local expected=$1

	local expected="$1"

	local last=""



	# spawn nf_queue listeners

	ip netns exec ${nsrouter} ./nf_queue -c -q 0 -t $timeout > "$TMPFILE0" &

	ip netns exec ${nsrouter} ./nf_queue -c -q 1 -t $timeout > "$TMPFILE1" &

	sleep 1

	test_ping

	ret=$?

	if [ $ret -ne 0 ];then

		echo "FAIL: netns routing/connectivity with active listener on queue $queue: $ret" 1>&2

	ip netns exec "$nsrouter" ./nf_queue -c -q 0 -t $timeout > "$TMPFILE0" &

	ip netns exec "$nsrouter" ./nf_queue -c -q 1 -t $timeout > "$TMPFILE1" &



	busywait "$BUSYWAIT_TIMEOUT" nf_queue_wait "$nsrouter" 0

	busywait "$BUSYWAIT_TIMEOUT" nf_queue_wait "$nsrouter" 1



	if ! test_ping;then

		echo "FAIL: netns routing/connectivity with active listener on queues 0 and 1: $ret" 1>&2

		exit $ret

	fi



	test_ping_router

	ret=$?

	if [ $ret -ne 0 ];then

		echo "FAIL: netns router unreachable listener on queue $queue: $ret" 1>&2

	if ! test_ping_router;then

		echo "FAIL: netns router unreachable listener on queue 0 and 1: $ret" 1>&2

		exit $ret

	fi
@@ -228,9 +235,7 @@ test_queue() 
		last=$(tail -n1 "$file")

		if [ x"$last" != x"$expected packets total" ]; then

			echo "FAIL: Expected $expected packets total, but got $last" 1>&2

			cat "$file" 1>&2



			ip netns exec ${nsrouter} nft list ruleset

			ip netns exec "$nsrouter" nft list ruleset

			exit 1

		fi

	done
@@ -245,56 +250,50 @@ listener_ready() 


test_tcp_forward()

{

	ip netns exec ${nsrouter} ./nf_queue -q 2 -t $timeout &

	ip netns exec "$nsrouter" ./nf_queue -q 2 -t "$timeout" &

	local nfqpid=$!



	timeout 5 ip netns exec ${ns2} socat -u TCP-LISTEN:12345 STDOUT >/dev/null &

	timeout 5 ip netns exec "$ns2" socat -u TCP-LISTEN:12345 STDOUT >/dev/null &

	local rpid=$!



	busywait $BUSYWAIT_TIMEOUT listener_ready ${ns2}



	ip netns exec ${ns1} socat -u STDIN TCP:10.0.2.99:12345 <"$TMPINPUT" >/dev/null

	busywait "$BUSYWAIT_TIMEOUT" listener_ready "$ns2"



	wait $rpid

	ip netns exec "$ns1" socat -u STDIN TCP:10.0.2.99:12345 <"$TMPINPUT" >/dev/null



	[ $? -eq 0 ] && echo "PASS: tcp and nfqueue in forward chain"

	wait "$rpid" && echo "PASS: tcp and nfqueue in forward chain"

}



test_tcp_localhost()

{

	dd conv=sparse status=none if=/dev/zero bs=1M count=200 of=$TMPINPUT

	timeout 5 ip netns exec ${nsrouter} socat -u TCP-LISTEN:12345 STDOUT >/dev/null &

	dd conv=sparse status=none if=/dev/zero bs=1M count=200 of="$TMPINPUT"

	timeout 5 ip netns exec "$nsrouter" socat -u TCP-LISTEN:12345 STDOUT >/dev/null &

	local rpid=$!



	ip netns exec ${nsrouter} ./nf_queue -q 3 -t $timeout &

	ip netns exec "$nsrouter" ./nf_queue -q 3 -t "$timeout" &

	local nfqpid=$!



	busywait $BUSYWAIT_TIMEOUT listener_ready ${nsrouter}

	busywait "$BUSYWAIT_TIMEOUT" listener_ready "$nsrouter"



	ip netns exec ${nsrouter} socat -u STDIN TCP:127.0.0.1:12345 <"$TMPINPUT" >/dev/null

	ip netns exec "$nsrouter" socat -u STDIN TCP:127.0.0.1:12345 <"$TMPINPUT" >/dev/null



	wait $rpid

	[ $? -eq 0 ] && echo "PASS: tcp via loopback"

	wait "$rpid" && echo "PASS: tcp via loopback"

	wait 2>/dev/null

}



test_tcp_localhost_connectclose()

{

	ip netns exec ${nsrouter} ./connect_close -p 23456 -t $timeout &

	ip netns exec "$nsrouter" ./connect_close -p 23456 -t "$timeout" &

	ip netns exec "$nsrouter" ./nf_queue -q 3 -t "$timeout" &



	ip netns exec ${nsrouter} ./nf_queue -q 3 -t $timeout &

	local nfqpid=$!



	sleep 1

	busywait "$BUSYWAIT_TIMEOUT" nf_queue_wait "$nsrouter" 3



	wait $rpid

	[ $? -eq 0 ] && echo "PASS: tcp via loopback with connect/close"

	wait && echo "PASS: tcp via loopback with connect/close"

	wait 2>/dev/null

}



test_tcp_localhost_requeue()

{

ip netns exec ${nsrouter} nft -f /dev/stdin <<EOF

ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF

flush ruleset

table inet filter {

	chain output {
@@ -307,17 +306,17 @@ table inet filter { 
	}

}

EOF

	timeout 5 ip netns exec ${nsrouter} socat -u TCP-LISTEN:12345 STDOUT >/dev/null &

	timeout 5 ip netns exec "$nsrouter" socat -u TCP-LISTEN:12345 STDOUT >/dev/null &

	local rpid=$!



	ip netns exec ${nsrouter} ./nf_queue -c -q 1 -t $timeout > "$TMPFILE2" &

	ip netns exec "$nsrouter" ./nf_queue -c -q 1 -t "$timeout" > "$TMPFILE2" &



	# nfqueue 1 will be called via output hook.  But this time,

        # re-queue the packet to nfqueue program on queue 2.

	ip netns exec ${nsrouter} ./nf_queue -G -d 150 -c -q 0 -Q 1 -t $timeout > "$TMPFILE3" &

	ip netns exec "$nsrouter" ./nf_queue -G -d 150 -c -q 0 -Q 1 -t "$timeout" > "$TMPFILE3" &



	busywait $BUSYWAIT_TIMEOUT listener_ready ${nsrouter}

	ip netns exec ${nsrouter} socat -u STDIN TCP:127.0.0.1:12345 <"$TMPINPUT" > /dev/null

	busywait "$BUSYWAIT_TIMEOUT" listener_ready "$nsrouter"

	ip netns exec "$nsrouter" socat -u STDIN TCP:127.0.0.1:12345 <"$TMPINPUT" > /dev/null



	wait
@@ -330,17 +329,16 @@ EOF 
}



test_icmp_vrf() {

	ip -net $ns1 link add tvrf type vrf table 9876

	if [ $? -ne 0 ];then

	if ! ip -net "$ns1" link add tvrf type vrf table 9876;then

		echo "SKIP: Could not add vrf device"

		return

	fi



	ip -net $ns1 li set eth0 master tvrf

	ip -net $ns1 li set tvrf up

	ip -net "$ns1" li set eth0 master tvrf

	ip -net "$ns1" li set tvrf up



	ip -net $ns1 route add 10.0.2.0/24 via 10.0.1.1 dev eth0 table 9876

ip netns exec ${ns1} nft -f /dev/stdin <<EOF

	ip -net "$ns1" route add 10.0.2.0/24 via 10.0.1.1 dev eth0 table 9876

ip netns exec "$ns1" nft -f /dev/stdin <<EOF

flush ruleset

table inet filter {

	chain output {
@@ -355,38 +353,35 @@ table inet filter { 
	}

}

EOF

	ip netns exec ${ns1} ./nf_queue -q 1 -t $timeout &

	ip netns exec "$ns1" ./nf_queue -q 1 -t "$timeout" &

	local nfqpid=$!



	sleep 1

	ip netns exec ${ns1} ip vrf exec tvrf ping -c 1 10.0.2.99 > /dev/null

	busywait "$BUSYWAIT_TIMEOUT" nf_queue_wait "$ns1" 1



	ip netns exec "$ns1" ip vrf exec tvrf ping -c 1 10.0.2.99 > /dev/null



	for n in output post; do

		for d in tvrf eth0; do

			ip netns exec ${ns1} nft list chain inet filter $n | grep -q "oifname \"$d\" icmp type echo-request counter packets 1"

			if [ $? -ne 0 ] ; then

			if ! ip netns exec "$ns1" nft list chain inet filter "$n" | grep -q "oifname \"$d\" icmp type echo-request counter packets 1"; then

				echo "FAIL: chain $n: icmp packet counter mismatch for device $d" 1>&2

				ip netns exec ${ns1} nft list ruleset

				ip netns exec "$ns1" nft list ruleset

				ret=1

				return

			fi

		done

	done



	wait $nfqpid

	[ $? -eq 0 ] && echo "PASS: icmp+nfqueue via vrf"

	wait "$nfqpid" && echo "PASS: icmp+nfqueue via vrf"

	wait 2>/dev/null

}



ip netns exec ${nsrouter} sysctl net.ipv6.conf.all.forwarding=1 > /dev/null

ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null

ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null

ip netns exec "$nsrouter" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null

ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null

ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null



load_ruleset "filter" 0



test_ping

ret=$?

if [ $ret -eq 0 ];then

if test_ping; then

	# queue bypass works (rules were skipped, no listener)

	echo "PASS: ${ns1} can reach ${ns2}"

else