| Message ID | ac92940c6d2c17c7c8d476428cfa94c4ffa6bd8b.1683626501.git.gnault@redhat.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | selftests: fcnal: Test SO_DONTROUTE socket option. | expand |
On Tue, May 09, 2023 at 02:02:37PM +0200, Guillaume Nault wrote: > diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh > index 21ca91473c09..1f8939fbb021 100755 > --- a/tools/testing/selftests/net/fcnal-test.sh > +++ b/tools/testing/selftests/net/fcnal-test.sh > @@ -1098,6 +1098,73 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0() > set_sysctl net.ipv4.tcp_l3mdev_accept="$old_tcp_l3mdev_accept" > } > > +ipv4_tcp_dontroute() > +{ > + local syncookies=$1 > + local nsa_syncookies > + local nsb_syncookies > + local a > + > + # > + # Link local connection tests (SO_DONTROUTE). > + # Connections should succeed only when the remote IP address is > + # on link (doesn't need to be routed through a gateway). > + # > + > + nsa_syncookies=$(ip netns exec "${NSA}" sysctl -n net.ipv4.tcp_syncookies) > + nsb_syncookies=$(ip netns exec "${NSB}" sysctl -n net.ipv4.tcp_syncookies) > + ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} > + ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} > + > + # Test with eth1 address (on link). > + > + a=${NSB_IP} > + log_start > + run_cmd_nsb nettest -s & > + sleep 1 rather than propagate the sleep for new tests, you try adding these tests using a single nettest instance that takes both server and client arguments and does the netns switch internally.
On Tue, May 09, 2023 at 09:32:46AM -0600, David Ahern wrote: > On Tue, May 09, 2023 at 02:02:37PM +0200, Guillaume Nault wrote: > > diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh > > index 21ca91473c09..1f8939fbb021 100755 > > --- a/tools/testing/selftests/net/fcnal-test.sh > > +++ b/tools/testing/selftests/net/fcnal-test.sh > > @@ -1098,6 +1098,73 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0() > > set_sysctl net.ipv4.tcp_l3mdev_accept="$old_tcp_l3mdev_accept" > > } > > > > +ipv4_tcp_dontroute() > > +{ > > + local syncookies=$1 > > + local nsa_syncookies > > + local nsb_syncookies > > + local a > > + > > + # > > + # Link local connection tests (SO_DONTROUTE). > > + # Connections should succeed only when the remote IP address is > > + # on link (doesn't need to be routed through a gateway). > > + # > > + > > + nsa_syncookies=$(ip netns exec "${NSA}" sysctl -n net.ipv4.tcp_syncookies) > > + nsb_syncookies=$(ip netns exec "${NSB}" sysctl -n net.ipv4.tcp_syncookies) > > + ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} > > + ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} > > + > > + # Test with eth1 address (on link). > > + > > + a=${NSB_IP} > > + log_start > > + run_cmd_nsb nettest -s & > > + sleep 1 > > rather than propagate the sleep for new tests, you try adding these > tests using a single nettest instance that takes both server and client > arguments and does the netns switch internally. Okay. That also means adding more options to nettest, to independently set SO_DONTROUTE on the server or on the client. We're getting short of one letter options, so I'll probably use long ones.
diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh index 21ca91473c09..1f8939fbb021 100755 --- a/tools/testing/selftests/net/fcnal-test.sh +++ b/tools/testing/selftests/net/fcnal-test.sh @@ -1098,6 +1098,73 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0() set_sysctl net.ipv4.tcp_l3mdev_accept="$old_tcp_l3mdev_accept" } +ipv4_tcp_dontroute() +{ + local syncookies=$1 + local nsa_syncookies + local nsb_syncookies + local a + + # + # Link local connection tests (SO_DONTROUTE). + # Connections should succeed only when the remote IP address is + # on link (doesn't need to be routed through a gateway). + # + + nsa_syncookies=$(ip netns exec "${NSA}" sysctl -n net.ipv4.tcp_syncookies) + nsb_syncookies=$(ip netns exec "${NSB}" sysctl -n net.ipv4.tcp_syncookies) + ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} + ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${syncookies} + + # Test with eth1 address (on link). + + a=${NSB_IP} + log_start + run_cmd_nsb nettest -s & + sleep 1 + run_cmd nettest -r ${a} -G + log_test_addr ${a} $? 0 "SO_DONTROUTE client, syncookies=${syncookies}" + + a=${NSB_IP} + log_start + # Ensure previous nettest server exited, so that it won't respond (we + # really want to test the -G option on the server). + wait + run_cmd_nsb nettest -s -G & + sleep 1 + run_cmd nettest -r ${a} + log_test_addr ${a} $? 0 "SO_DONTROUTE server, syncookies=${syncookies}" + + # Test with loopback address (routed). + # + # The client would use the eth1 address as source IP by default. + # Therefore, we need to use the -c option here, to force the use of the + # routed (loopback) address as source IP (so that the server will try + # to respond to a routed address and not a link local one). + + a=${NSB_LO_IP} + log_start + show_hint "Should fail 'Network is unreachable' since server is not on link" + run_cmd_nsb nettest -s & + sleep 1 + run_cmd nettest -c ${NSA_LO_IP} -r ${a} -G + log_test_addr ${a} $? 1 "SO_DONTROUTE client, syncookies=${syncookies}" + + a=${NSB_LO_IP} + log_start + show_hint "Should timeout since server cannot respond (client is not on link)" + # Ensure previous nettest server exited, so that it won't respond (we + # really want to test the -G option on the server). + wait + run_cmd_nsb nettest -s -G & + sleep 1 + run_cmd nettest -c ${NSA_LO_IP} -r ${a} + log_test_addr ${a} $? 2 "SO_DONTROUTE server, syncookies=${syncookies}" + + ip netns exec "${NSB}" sysctl -wq net.ipv4.tcp_syncookies=${nsb_syncookies} + ip netns exec "${NSA}" sysctl -wq net.ipv4.tcp_syncookies=${nsa_syncookies} +} + ipv4_tcp_novrf() { local a @@ -1217,6 +1284,9 @@ ipv4_tcp_novrf() log_test_addr ${a} $? 1 "No server, device client, local conn" ipv4_tcp_md5_novrf + + ipv4_tcp_dontroute 0 + ipv4_tcp_dontroute 2 } ipv4_tcp_vrf()
Use nettest -G to test the kernel behaviour with TCP sockets having the SO_DONTROUTE option. Sending packets to a neighbour (on link) host, should work. When the host is behind a router, sending should fail. Client and server sockets are tested independently, so that we can cover different TCP kernel paths. SO_DONTROUTE also affects the syncookies path. So ipv4_tcp_dontroute() is made to work with or without syncookies, to cover both paths. Signed-off-by: Guillaume Nault <gnault@redhat.com> --- tools/testing/selftests/net/fcnal-test.sh | 70 +++++++++++++++++++++++ 1 file changed, 70 insertions(+)