netdev - Re: [PATCH net-next 00/15] net: Add functional tests for L3 and L4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 1 Aug 2019 22:04:29 -0600
From:   David Ahern <dsahern@...il.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        David Ahern <dsahern@...nel.org>
Cc:     davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH net-next 00/15] net: Add functional tests for L3 and L4

On 8/1/19 6:19 PM, Alexei Starovoitov wrote:
> On Thu, Aug 01, 2019 at 11:56:33AM -0700, David Ahern wrote:
>> From: David Ahern <dsahern@...il.com>
>>
>> This is a port the functional test cases created during the development
>> of the VRF feature. It covers various permutations of icmp, tcp and udp
>> for IPv4 and IPv6 including negative tests.
> 
> Thanks a lot for doing this!
> 
> Is there expected output ?

My tests are quiet by default with a verbose option and pause on fail.

$ fcnal-test.sh -h
usage: fcnal-test.sh OPTS

	-4          IPv4 tests only
	-6          IPv6 tests only
	-t <test>   Test name/set to run
	-p          Pause on fail
	-P          Pause after each test
	-v          Be verbose

> All tests suppose to pass on the latest net-next?

they do for me. Buster image. 5.3-rc1 kernel.

> 
> I'm seeing:
> ./fcnal-test.sh
> ...
> SYSCTL: net.ipv4.raw_l3mdev_accept=0
> TEST: ping out - ns-B IP                                                      [ OK ]
> TEST: ping out, device bind - ns-B IP                                         [ OK ]
> TEST: ping out, address bind - ns-B IP                                        [FAIL]
> TEST: ping out - ns-B loopback IP                                             [ OK ]
> TEST: ping out, device bind - ns-B loopback IP                                [ OK ]
> TEST: ping out, address bind - ns-B loopback IP                               [FAIL]
> TEST: ping in - ns-A IP                                                       [ OK ]
> TEST: ping in - ns-A loopback IP                                              [ OK ]
> TEST: ping local - ns-A IP                                                    [ OK ]
> TEST: ping local - ns-A loopback IP                                           [ OK ]
> TEST: ping local - loopback                                                   [ OK ]
> TEST: ping local, device bind - ns-A IP                                       [ OK ]
> TEST: ping local, device bind - ns-A loopback IP                              [FAIL]
> TEST: ping local, device bind - loopback                                      [FAIL]

...
TEST: ping out - ns-B IP                                          [ OK ]
TEST: ping out, device bind - ns-B IP                             [ OK ]
TEST: ping out, address bind - ns-B IP                            [ OK ]
TEST: ping out - ns-B loopback IP                                 [ OK ]
TEST: ping out, device bind - ns-B loopback IP                    [ OK ]
TEST: ping out, address bind - ns-B loopback IP                   [ OK ]
TEST: ping in - ns-A IP                                           [ OK ]
TEST: ping in - ns-A loopback IP                                  [ OK ]
TEST: ping local - ns-A IP                                        [ OK ]
TEST: ping local - ns-A loopback IP                               [ OK ]
TEST: ping local - loopback                                       [ OK ]
TEST: ping local, device bind - ns-A IP                           [ OK ]
TEST: ping local, device bind - ns-A loopback IP                  [ OK ]
TEST: ping local, device bind - loopback                          [ OK ]
TEST: ping out, blocked by rule - ns-B loopback IP                [ OK ]
TEST: ping in, blocked by rule - ns-A loopback IP                 [ OK ]
TEST: ping out, blocked by route - ns-B loopback IP               [ OK ]
TEST: ping in, blocked by route - ns-A loopback IP                [ OK ]
TEST: ping out, unreachable default route - ns-B loopback IP      [ OK ]
...

> 
> with -v I see:
> COMMAND: ip netns exec ns-A ping -c1 -w1 -I 172.16.2.1 172.16.1.2
> ping: unknown iface 172.16.2.1
> TEST: ping out, address bind - ns-B IP                                        [FAIL]

With ping from iputils-ping -I can be an address or a device.

$ man ping

       -I interface
           interface is either an address, or an interface name. If
interface is an address, it
           sets source address to specified interface address. If
interface in an interface name,
           it sets source interface to specified interface. NOTE: For
IPv6, when doing ping to a
           link-local scope address, link specification (by the
'%'-notation in destination, or
           by this option) can be used but it is no longer required.