netdev - [PATCH net-next v2 00/12] testing: make netfilter selftests functional in vng environment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240418152744.15105-1-fw@strlen.de>
Date: Thu, 18 Apr 2024 17:27:28 +0200
From: Florian Westphal <fw@...len.de>
To: <netdev@...r.kernel.org>
Cc: Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	<netfilter-devel@...r.kernel.org>,
	pablo@...filter.org
Subject: [PATCH net-next v2 00/12] testing: make netfilter selftests functional in vng environment

This is the second batch of the netfilter selftest move.

Changes since v1:
- makefile and kernel config are updated to have all required features
- fix makefile with missing bits to make kselftest-install work
- test it via vng as per
   https://github.com/linux-netdev/nipa/wiki/How-to-run-netdev-selftests-CI-style
   (Thanks Jakub!)
- squash a few fixes, e.g. nft_queue.sh v1 had a race w. NFNETLINK_QUEUE=m
- add a settings file with 8m timeout, for nft_concat_range.sh sake.
  That script can be sped up a bit, I think, but its not contained in
  this batch yet.
- toss the first two bogus rebase artifacts (Matthieu Baerts)

scripts are moved to lib.sh infra. This allows to use busywait helper
and ditch various 'sleep 2' all over the place.

Tested on Fedora 39:

vng --build  --config tools/testing/selftests/net/netfilter/config
make -C tools/testing/selftests/ TARGETS=net/netfilter
vng -v --run . --user root --cpus 2 -- \
        make -C tools/testing/selftests TARGETS=net/netfilter run_tests

... all tests pass except nft_audit.sh which SKIPs due to nft version mismatch
(Fedora is on nft 1.0.7 which lacks reset keyword support).

Missing/WIP bits:
- speed up nf_concat_range.sh test
- extend flowtable selftest
- shellcheck fixups for remaining scripts

Florian Westphal (12):
  selftests: netfilter: nft_queue.sh: move to lib.sh infra
  selftests: netfilter: nft_queue.sh: shellcheck cleanups
  selftests: netfilter: nft_synproxy.sh: move to lib.sh infra
  selftests: netfilter: nft_zones_many.sh: move to lib.sh infra
  selftests: netfilter: xt_string.sh: move to lib.sh infra
  selftests: netfilter: xt_string.sh: shellcheck cleanups
  selftests: netfilter: nft_nat_zones.sh: shellcheck cleanups
  selftests: netfilter: conntrack_ipip_mtu.sh: shellcheck cleanups
  selftests: netfilter: nft_fib.sh: shellcheck cleanups
  selftests: netfilter: nft_meta.sh: small shellcheck cleanup
  selftests: netfilter: nft_audit.sh: add more skip checks
  selftests: netfilter: update makefiles and kernel config

 .../testing/selftests/net/netfilter/Makefile  |   5 +
 tools/testing/selftests/net/netfilter/config  |  52 +++-
 .../net/netfilter/conntrack_ipip_mtu.sh       |  74 ++---
 .../selftests/net/netfilter/nft_audit.sh      |  30 +-
 .../selftests/net/netfilter/nft_fib.sh        | 128 ++++-----
 .../selftests/net/netfilter/nft_meta.sh       |   4 +-
 .../selftests/net/netfilter/nft_nat_zones.sh  | 193 +++++--------
 .../selftests/net/netfilter/nft_queue.sh      | 272 ++++++++----------
 .../selftests/net/netfilter/nft_synproxy.sh   |  77 ++---
 .../selftests/net/netfilter/nft_zones_many.sh |  93 +++---
 .../testing/selftests/net/netfilter/settings  |   1 +
 .../selftests/net/netfilter/xt_string.sh      |  89 +++---
 12 files changed, 498 insertions(+), 520 deletions(-)
 create mode 100644 tools/testing/selftests/net/netfilter/settings

-- 
2.43.2