linux-stable.git/tools/testing/selftests/netfilter, branch v5.16.2

selftests: netfilter: switch zone stress to socat

2021-12-08T00:29:15+00:00

centos9 has nmap-ncat which doesn't like the '-q' option, use socat.
While at it, mark test skipped if needed tools are missing.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

selftests: netfilter: Add correctness test for mac,net set type

2021-12-08T00:05:55+00:00

The existing net,mac test didn't cover the issue recently reported
by Nikita Yushchenko, where MAC addresses wouldn't match if given
as first field of a concatenated set with AVX2 and 8-bit groups,
because there's a different code path covering the lookup of six
8-bit groups (MAC addresses) if that's the first field.

Add a similar mac,net test, with MAC address and IPv4 address
swapped in the set specification.

Signed-off-by: Stefano Brivio 
Signed-off-by: Pablo Neira Ayuso

vrf: don't run conntrack on vrf with !dflt qdisc

2021-12-08T00:05:55+00:00

After the below patch, the conntrack attached to skb is set to "notrack" in
the context of vrf device, for locally generated packets.
But this is true only when the default qdisc is set to the vrf device. When
changing the qdisc, notrack is not set anymore.
In fact, there is a shortcut in the vrf driver, when the default qdisc is
set, see commit dcdd43c41e60 ("net: vrf: performance improvements for
IPv4") for more details.

This patch ensures that the behavior is always the same, whatever the qdisc
is.

To demonstrate the difference, a new test is added in conntrack_vrf.sh.

Fixes: 8c9c296adfae ("vrf: run conntrack only in context of lower/physdev for locally generated packets")
Signed-off-by: Nicolas Dichtel 
Acked-by: Florian Westphal 
Reviewed-by: David Ahern 
Signed-off-by: Pablo Neira Ayuso

selftests: nft_nat: switch port shadow test cases to socat

2021-11-15T11:02:11+00:00

There are now at least three distinct flavours of netcat/nc tool:
'original' version, one version ported from openbsd and nmap-ncat.

The script only works with original because it sets SOREUSEPORT option.

Other nc versions return 'port already in use' error and port shadow test fails:

PASS: inet IPv6 redirection for ns2-hMHcaRvx
nc: bind failed: Address already in use
ERROR: portshadow test default: got reply from "ROUTER", not CLIENT as intended

Switch to socat instead.

Reported-by: kernel test robot 
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

selftests: nft_nat: Simplify port shadow notrack test

2021-11-08T10:26:57+00:00

The second rule in prerouting chain was probably a leftover: The router
listens on veth0, so not tracking connections via that interface is
sufficient. Likewise, the rule in output chain can be limited to that
interface as well.

Signed-off-by: Phil Sutter 
Signed-off-by: Pablo Neira Ayuso

selftests: nft_nat: Improve port shadow test stability

2021-11-08T10:26:57+00:00

Setup phase in test_port_shadow() relied upon a race-condition:
Listening nc on port 1405 was started in background before attempting to
create the fake conntrack entry using the same source port. If listening
nc won, fake conntrack entry could not be created causing wrong
behaviour. Reorder nc calls to fix this and introduce a short delay
before testing the setup to wait for listening nc process startup.

Fixes: 465f15a6d1a8f ("selftests: nft_nat: add udp hole punch test case")
Signed-off-by: Phil Sutter 
Signed-off-by: Pablo Neira Ayuso

selftests: netfilter: extend nfqueue tests to cover vrf device

2021-11-08T10:24:01+00:00

VRF device calls the output/postrouting hooks so packet should be seeon
with oifname tvrf and once with eth0.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

selftests: netfilter: add a vrf+conntrack testcase

2021-11-08T10:24:01+00:00

Rework the reproducer for the vrf+conntrack regression reported
by Eugene into a selftest and also add a test for ip masquerading
that Lahav fixed recently.

With net or net-next tree, the first test fails and the latter
two pass.

With 09e856d54bda5f28 ("vrf: Reset skb conntrack connection on VRF rcv")
reverted first test passes but the last two fail.

A proper fix needs more work, for time being a revert seems to be
the best choice, snat/masquerade did not work before the fix.

Link: https://lore.kernel.org/netdev/378ca299-4474-7e9a-3d36-2350c8c98995@gmail.com/T/#m95358a31810df7392f541f99d187227bc75c9963
Reported-by: Eugene Crosser 
Cc: Lahav Schlesinger 
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

selftests: netfilter: remove stray bash debug line

2021-10-14T21:08:35+00:00

This should not be there.

Fixes: 2de03b45236f ("selftests: netfilter: add flowtable test script")
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

selftests: nft_nat: add udp hole punch test case

2021-10-11T23:42:39+00:00

Add a test case that demonstrates port shadowing via UDP.

ns2 sends packet to ns1, from source port used by a udp service on the
router, ns0.  Then, ns1 sends packet to ns0:service, but that ends up getting
forwarded to ns2.

Also add three test cases that demonstrate mitigations:
1. disable use of $port as source from 'unstrusted' origin
2. make the service untracked.  This prevents masquerade entries
   from having any effects.
3. add forced PAT via 'random' mode to translate the "wrong" sport
   into an acceptable range.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso