linux.git/tools/testing/selftests/netfilter, branch v6.6.131

selftests: netfilter: Fix nft_audit.sh for newer nft binaries

2024-10-10T09:57:15+00:00

[ Upstream commit 8a89015644513ef69193a037eb966f2d55fe385a ]

As a side-effect of nftables' commit dbff26bfba833 ("cache: consolidate
reset command"), audit logs changed when more objects were reset than
fit into a single netlink message.

Since the objects' distribution in netlink messages is not relevant,
implement a summarizing function which combines repeated audit logs into
a single one with summed up 'entries=' value.

Fixes: 203bb9d39866 ("selftests: netfilter: Extend nft_audit.sh")
Signed-off-by: Phil Sutter 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin

net: skb_find_text: Ignore patterns extending past 'to'

2023-11-20T10:59:01+00:00

[ Upstream commit c4eee56e14fe001e1cff54f0b438a5e2d0dd7454 ]

Assume that caller's 'to' offset really represents an upper boundary for
the pattern search, so patterns extending past this offset are to be
rejected.

The old behaviour also was kind of inconsistent when it comes to
fragmentation (or otherwise non-linear skbs): If the pattern started in
between 'to' and 'from' offsets but extended to the next fragment, it
was not found if 'to' offset was still within the current fragment.

Test the new behaviour in a kselftest using iptables' string match.

Suggested-by: Pablo Neira Ayuso 
Fixes: f72b948dcbb8 ("[NET]: skb_find_text ignores to argument")
Signed-off-by: Phil Sutter 
Reviewed-by: Florian Westphal 
Reviewed-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

selftests: netfilter: Run nft_audit.sh in its own netns

2023-10-18T11:47:08+00:00

Don't mess with the host's firewall ruleset. Since audit logging is not
per-netns, add an initial delay of a second so other selftests' netns
cleanups have a chance to finish.

Fixes: e8dbde59ca3f ("selftests: netfilter: Test nf_tables audit logging")
Signed-off-by: Phil Sutter 
Signed-off-by: Florian Westphal

netfilter: nf_tables: audit log object reset once per table

2023-10-18T11:43:40+00:00

When resetting multiple objects at once (via dump request), emit a log
message per table (or filled skb) and resurrect the 'entries' parameter
to contain the number of objects being logged for.

To test the skb exhaustion path, perform some bulk counter and quota
adds in the kselftest.

Signed-off-by: Phil Sutter 
Reviewed-by: Richard Guy Briggs 
Acked-by: Paul Moore  (Audit)
Signed-off-by: Florian Westphal

netfilter: nf_tables: Deduplicate nft_register_obj audit logs

2023-10-04T13:57:06+00:00

When adding/updating an object, the transaction handler emits suitable
audit log entries already, the one in nft_obj_notify() is redundant. To
fix that (and retain the audit logging from objects' 'update' callback),
Introduce an "audit log free" variant for internal use.

Fixes: c520292f29b8 ("audit: log nftables configuration change events once per table")
Signed-off-by: Phil Sutter 
Reviewed-by: Richard Guy Briggs 
Acked-by: Paul Moore  (Audit)
Signed-off-by: Florian Westphal

selftests: netfilter: Extend nft_audit.sh

2023-10-04T12:12:01+00:00

Add tests for sets and elements and deletion of all kinds. Also
reorder rule reset tests: By moving the bulk rule add command up, the
two 'reset rules' tests become identical.

While at it, fix for a failing bulk rule add test's error status getting
lost due to its use in a pipe. Avoid this by using a temporary file.

Headings in diff output for failing tests contain no useful data, strip
them.

Signed-off-by: Phil Sutter 
Signed-off-by: Florian Westphal

selftests: netfilter: test for sctp collision processing in nf_conntrack

2023-10-04T12:12:01+00:00

This patch adds a test case to reproduce the SCTP DATA chunk retransmission
timeout issue caused by the improper SCTP collision processing in netfilter
nf_conntrack_proto_sctp.

In this test, client sends a INIT chunk, but the INIT_ACK replied from
server is delayed until the server sends a INIT chunk to start a new
connection from its side. After the connection is complete from server
side, the delayed INIT_ACK arrives in nf_conntrack_proto_sctp.

The delayed INIT_ACK should be dropped in nf_conntrack_proto_sctp instead
of updating the vtag with the out-of-date init_tag, otherwise, the vtag
in DATA chunks later sent by client don't match the vtag in the conntrack
entry and the DATA chunks get dropped.

Signed-off-by: Xin Long 
Signed-off-by: Florian Westphal

selftests: netfilter: Test nf_tables audit logging

2023-09-13T19:57:50+00:00

Compare NETFILTER_CFG type audit logs emitted from kernel upon ruleset
modifications against expected output.

Signed-off-by: Phil Sutter 
Signed-off-by: Pablo Neira Ayuso

selftests: nft_flowtable.sh: check ingress/egress chain too

2023-05-10T07:31:07+00:00

Make sure flowtable interacts correctly with ingress and egress
chains, i.e. those get handled before and after flow table respectively.

Adds three more tests:
1. repeat flowtable test, but with 'ip dscp set cs3' done in
   inet forward chain.

Expect that some packets have been mangled (before flowtable offload
became effective) while some pass without mangling (after offload
succeeds).

2. repeat flowtable test, but with 'ip dscp set cs3' done in
   veth0:ingress.

Expect that all packets pass with cs3 dscp field.

3. same as 2, but use veth1:egress.  Expect the same outcome.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

selftests: nft_flowtable.sh: monitor result file sizes

2023-05-10T07:31:07+00:00

When running nft_flowtable.sh in VM on a busy server we've found that
the time of the netcat file transfers vary wildly.

Therefore replace hardcoded 3 second sleep with the loop checking for
a change in the file sizes. Once no change in detected we test the results.

Nice side effect is that we shave 1 second sleep in the fast case
(hard-coded 3 second sleep vs two 1 second sleeps).

Acked-by: Florian Westphal 
Signed-off-by: Boris Sukholitko 
Signed-off-by: Pablo Neira Ayuso