mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 02:44:41 +01:00
selftests: netfilter: nft_queue.sh: add udp fraglist gro test case
Without the preceding patch, this fails with: FAIL: test_udp_gro_ct: Expected udp conntrack entry FAIL: test_udp_gro_ct: Expected software segmentation to occur, had 10 and 0 Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Florian Westphal
parent
207b3ebacb
commit
59ecffa399
1 changed files with 136 additions and 6 deletions
|
|
@ -510,7 +510,7 @@ EOF
|
|||
|
||||
udp_listener_ready()
|
||||
{
|
||||
ss -S -N "$1" -uln -o "sport = :12345" | grep -q 12345
|
||||
ss -S -N "$1" -uln -o "sport = :$2" | grep -q "$2"
|
||||
}
|
||||
|
||||
output_files_written()
|
||||
|
|
@ -518,7 +518,7 @@ output_files_written()
|
|||
test -s "$1" && test -s "$2"
|
||||
}
|
||||
|
||||
test_udp_ct_race()
|
||||
test_udp_nat_race()
|
||||
{
|
||||
ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF
|
||||
flush ruleset
|
||||
|
|
@ -545,8 +545,8 @@ EOF
|
|||
ip netns exec "$nsrouter" ./nf_queue -q 12 -d 1000 &
|
||||
local nfqpid=$!
|
||||
|
||||
busywait "$BUSYWAIT_TIMEOUT" udp_listener_ready "$ns2"
|
||||
busywait "$BUSYWAIT_TIMEOUT" udp_listener_ready "$ns3"
|
||||
busywait "$BUSYWAIT_TIMEOUT" udp_listener_ready "$ns2" 12345
|
||||
busywait "$BUSYWAIT_TIMEOUT" udp_listener_ready "$ns3" 12345
|
||||
busywait "$BUSYWAIT_TIMEOUT" nf_queue_wait "$nsrouter" 12
|
||||
|
||||
# Send two packets, one should end up in ns1, other in ns2.
|
||||
|
|
@ -557,7 +557,7 @@ EOF
|
|||
|
||||
busywait 10000 output_files_written "$TMPFILE1" "$TMPFILE2"
|
||||
|
||||
kill "$nfqpid"
|
||||
kill "$nfqpid" "$rpid1" "$rpid2"
|
||||
|
||||
if ! ip netns exec "$nsrouter" bash -c 'conntrack -L -p udp --dport 12345 2>/dev/null | wc -l | grep -q "^1"'; then
|
||||
echo "FAIL: Expected One udp conntrack entry"
|
||||
|
|
@ -585,6 +585,135 @@ EOF
|
|||
echo "PASS: both udp receivers got one packet each"
|
||||
}
|
||||
|
||||
# Make sure UDPGRO aggregated packets don't lose
|
||||
# their skb->nfct entry when nfqueue passes the
|
||||
# skb to userspace with software gso segmentation on.
|
||||
test_udp_gro_ct()
|
||||
{
|
||||
local errprefix="FAIL: test_udp_gro_ct:"
|
||||
|
||||
ip netns exec "$nsrouter" conntrack -F 2>/dev/null
|
||||
|
||||
ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF
|
||||
flush ruleset
|
||||
table inet udpq {
|
||||
# Number of packets/bytes queued to userspace
|
||||
counter toqueue { }
|
||||
# Number of packets/bytes reinjected from userspace with 'ct new' intact
|
||||
counter fromqueue { }
|
||||
# These two counters should be identical and not 0.
|
||||
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority -300; policy accept;
|
||||
|
||||
# userspace sends small packets, if < 1000, UDPGRO did
|
||||
# not kick in, but test needs a 'new' conntrack with udpgro skb.
|
||||
meta iifname veth0 meta l4proto udp meta length > 1000 accept
|
||||
|
||||
# don't pick up non-gso packets and don't queue them to
|
||||
# userspace.
|
||||
notrack
|
||||
}
|
||||
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority 0; policy accept;
|
||||
|
||||
# Only queue unconfirmed fraglist gro skbs to userspace.
|
||||
udp dport 12346 ct status ! confirmed counter name "toqueue" mark set 1 queue num 1
|
||||
}
|
||||
|
||||
chain validate {
|
||||
type filter hook postrouting priority 1; policy accept;
|
||||
# ... and only count those that were reinjected with the
|
||||
# skb->nfct intact.
|
||||
mark 1 counter name "fromqueue"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
timeout 10 ip netns exec "$ns2" socat UDP-LISTEN:12346,fork,pf=ipv4 OPEN:"$TMPFILE1",trunc &
|
||||
local rpid=$!
|
||||
|
||||
ip netns exec "$nsrouter" ./nf_queue -G -c -q 1 -t 2 > "$TMPFILE2" &
|
||||
local nfqpid=$!
|
||||
|
||||
ip netns exec "$nsrouter" ethtool -K "veth0" rx-udp-gro-forwarding on rx-gro-list on generic-receive-offload on
|
||||
|
||||
busywait "$BUSYWAIT_TIMEOUT" udp_listener_ready "$ns2" 12346
|
||||
busywait "$BUSYWAIT_TIMEOUT" nf_queue_wait "$nsrouter" 1
|
||||
|
||||
local bs=512
|
||||
local count=$(((32 * 1024 * 1024) / bs))
|
||||
dd if=/dev/zero bs="$bs" count="$count" 2>/dev/null | for i in $(seq 1 16); do
|
||||
timeout 5 ip netns exec "$ns1" \
|
||||
socat -u -b 512 STDIN UDP-DATAGRAM:10.0.2.99:12346,reuseport,bind=0.0.0.0:55221 &
|
||||
done
|
||||
|
||||
busywait 10000 test -s "$TMPFILE1"
|
||||
|
||||
kill "$rpid"
|
||||
|
||||
wait
|
||||
|
||||
local p
|
||||
local b
|
||||
local pqueued
|
||||
local bqueued
|
||||
|
||||
c=$(ip netns exec "$nsrouter" nft list counter inet udpq "toqueue" | grep packets)
|
||||
read p pqueued b bqueued <<EOF
|
||||
$c
|
||||
EOF
|
||||
local preinject
|
||||
local breinject
|
||||
c=$(ip netns exec "$nsrouter" nft list counter inet udpq "fromqueue" | grep packets)
|
||||
read p preinject b breinject <<EOF
|
||||
$c
|
||||
EOF
|
||||
ip netns exec "$nsrouter" ethtool -K "veth0" rx-udp-gro-forwarding off
|
||||
ip netns exec "$nsrouter" ethtool -K "veth1" rx-udp-gro-forwarding off
|
||||
|
||||
if [ "$pqueued" -eq 0 ];then
|
||||
# happens when gro did not build at least on aggregate
|
||||
echo "SKIP: No packets were queued"
|
||||
return
|
||||
fi
|
||||
|
||||
local saw_ct_entry=0
|
||||
if ip netns exec "$nsrouter" bash -c 'conntrack -L -p udp --dport 12346 2>/dev/null | wc -l | grep -q "^1"'; then
|
||||
saw_ct_entry=1
|
||||
else
|
||||
echo "$errprefix Expected udp conntrack entry"
|
||||
ip netns exec "$nsrouter" conntrack -L
|
||||
ret=1
|
||||
fi
|
||||
|
||||
if [ "$pqueued" -ge "$preinject" ] ;then
|
||||
echo "$errprefix Expected software segmentation to occur, had $pqueued and $preinject"
|
||||
ret=1
|
||||
return
|
||||
fi
|
||||
|
||||
# sw segmentation adds extra udp and ip headers.
|
||||
local breinject_expect=$((preinject * (512 + 20 + 8)))
|
||||
|
||||
if [ "$breinject" -eq "$breinject_expect" ]; then
|
||||
if [ "$saw_ct_entry" -eq 1 ];then
|
||||
echo "PASS: fraglist gro skb passed with conntrack entry"
|
||||
else
|
||||
echo "$errprefix fraglist gro skb passed without conntrack entry"
|
||||
ret=1
|
||||
fi
|
||||
else
|
||||
echo "$errprefix Counter mismatch, conntrack entry dropped by nfqueue? Queued: $pqueued, $bqueued. Post-queue: $preinject, $breinject. Expected $breinject_expect"
|
||||
ret=1
|
||||
fi
|
||||
|
||||
if ! ip netns exec "$nsrouter" nft delete table inet udpq; then
|
||||
echo "$errprefix: Could not delete udpq table"
|
||||
ret=1
|
||||
fi
|
||||
}
|
||||
|
||||
test_queue_removal()
|
||||
{
|
||||
read tainted_then < /proc/sys/kernel/tainted
|
||||
|
|
@ -663,7 +792,8 @@ test_tcp_localhost_connectclose
|
|||
test_tcp_localhost_requeue
|
||||
test_sctp_forward
|
||||
test_sctp_output
|
||||
test_udp_ct_race
|
||||
test_udp_nat_race
|
||||
test_udp_gro_ct
|
||||
|
||||
# should be last, adds vrf device in ns1 and changes routes
|
||||
test_icmp_vrf
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue