Commit d92906fd authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

selftests: netfilter: Stabilize rpath.sh 



On some systems, neighbor discoveries from ns1 for fec0:42::1 (i.e., the
martian trap address) would happen at the wrong time and cause
false-negative test result.

Problem analysis also discovered that IPv6 martian ping test was broken
in that sent neighbor discoveries, not echo requests were inadvertently
trapped

Avoid the race condition by introducing the neighbors to each other
upfront. Also pin down the firewall rules to matching on echo requests
only.

Fixes: efb056e5 ("netfilter: ip6t_rpfilter: Fix regression with VRF interfaces")
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 31f1b55d

tools/testing/selftests/net/netfilter/rpath.sh

+16 −2
Original line number Diff line number Diff line
@@ -61,9 +61,20 @@ ip -net "$ns2" a a 192.168.42.1/24 dev d0 
ip -net "$ns1" a a fec0:42::2/64 dev v0 nodad

ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad



# avoid neighbor lookups and enable martian IPv6 pings

ns2_hwaddr=$(ip -net "$ns2" link show dev v0 | \

	     sed -n 's, *link/ether \([^ ]*\) .*,\1,p')

ns1_hwaddr=$(ip -net "$ns1" link show dev v0 | \

	     sed -n 's, *link/ether \([^ ]*\) .*,\1,p')

ip -net "$ns1" neigh add fec0:42::1 lladdr "$ns2_hwaddr" nud permanent dev v0

ip -net "$ns1" neigh add fec0:23::1 lladdr "$ns2_hwaddr" nud permanent dev v0

ip -net "$ns2" neigh add fec0:42::2 lladdr "$ns1_hwaddr" nud permanent dev d0

ip -net "$ns2" neigh add fec0:23::2 lladdr "$ns1_hwaddr" nud permanent dev v0



# firewall matches to test

[ -n "$iptables" ] && {

	common='-t raw -A PREROUTING -s 192.168.0.0/16'

	common+=' -p icmp --icmp-type echo-request'

	if ! ip netns exec "$ns2" "$iptables" $common -m rpfilter;then

		echo "Cannot add rpfilter rule"

		exit $ksft_skip
@@ -72,6 +83,7 @@ ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad 
}

[ -n "$ip6tables" ] && {

	common='-t raw -A PREROUTING -s fec0::/16'

	common+=' -p icmpv6 --icmpv6-type echo-request'

	if ! ip netns exec "$ns2" "$ip6tables" $common -m rpfilter;then

		echo "Cannot add rpfilter rule"

		exit $ksft_skip
@@ -82,8 +94,10 @@ ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad 
table inet t {

	chain c {

		type filter hook prerouting priority raw;

		ip saddr 192.168.0.0/16 fib saddr . iif oif exists counter

		ip6 saddr fec0::/16 fib saddr . iif oif exists counter

		ip saddr 192.168.0.0/16 icmp type echo-request \

			fib saddr . iif oif exists counter

		ip6 saddr fec0::/16 icmpv6 type echo-request \

			fib saddr . iif oif exists counter

	}

}

EOF