netdev - Re: [PATCH net-next] selftests: wireguards: use nft by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Zyx46O0qLtXAs80X@orbyte.nwl.cc>
Date: Thu, 7 Nov 2024 09:23:04 +0100
From: Phil Sutter <phil@....cc>
To: Hangbin Liu <liuhangbin@...il.com>
Cc: netdev@...r.kernel.org, "Jason A. Donenfeld" <Jason@...c4.com>,
	Shuah Khan <shuah@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Florian Westphal <fw@...len.de>, wireguard@...ts.zx2c4.com,
	linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next] selftests: wireguards: use nft by default

Hi Liu Hangbin,

On Thu, Nov 07, 2024 at 02:54:38AM +0000, Hangbin Liu wrote:
> Use nft by default if it's supported, as nft is the replacement for iptables,
> which is used by default in some releases. Additionally, iptables is dropped
> in some releases.
> 
> Signed-off-by: Hangbin Liu <liuhangbin@...il.com>
> ---
> CC nft developers to see if there are any easier configurations,
> as I'm not very familiar with nft commands.

Basically looks good, just a few minor remarks:

> ---
>  tools/testing/selftests/wireguard/netns.sh | 63 ++++++++++++++++++----
>  1 file changed, 53 insertions(+), 10 deletions(-)
> 
> diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh
> index 405ff262ca93..4e29c1a7003c 100755
> --- a/tools/testing/selftests/wireguard/netns.sh
> +++ b/tools/testing/selftests/wireguard/netns.sh
> @@ -44,6 +44,7 @@ sleep() { read -t "$1" -N 1 || true; }
>  waitiperf() { pretty "${1//*-}" "wait for iperf:${3:-5201} pid $2"; while [[ $(ss -N "$1" -tlpH "sport = ${3:-5201}") != *\"iperf3\",pid=$2,fd=* ]]; do sleep 0.1; done; }
>  waitncatudp() { pretty "${1//*-}" "wait for udp:1111 pid $2"; while [[ $(ss -N "$1" -ulpH 'sport = 1111') != *\"ncat\",pid=$2,fd=* ]]; do sleep 0.1; done; }
>  waitiface() { pretty "${1//*-}" "wait for $2 to come up"; ip netns exec "$1" bash -c "while [[ \$(< \"/sys/class/net/$2/operstate\") != up ]]; do read -t .1 -N 0 || true; done;"; }
> +use_nft() { nft --version &> /dev/null; }
>  
>  cleanup() {
>  	set +e
> @@ -196,13 +197,23 @@ ip1 link set wg0 mtu 1300
>  ip2 link set wg0 mtu 1300
>  n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
>  n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1
> -n0 iptables -A INPUT -m length --length 1360 -j DROP
> +if use_nft; then
> +	n0 nft add table inet filter

Using inet family captures IPv6 traffic, too. You don't seem to
explicitly configure it, but the usual auto-config traffic may offset
rule counters. If you care about such side-effects, you may want to use
ip family instead.

Tables are family-specific, but generic otherwise. So you could add a
table for testing in each netns up front:

| if use_nft; then
| 	n0 nft add table ip wgtest
| 	n1 nft add table ip wgtest
| 	n2 nft add table ip wgtest
| fi

> +	n0 nft add chain inet filter INPUT { type filter hook input priority filter \; policy accept \; }
> +	n0 nft add rule inet filter INPUT meta length 1360 counter drop
> +else
> +	n0 iptables -A INPUT -m length --length 1360 -j DROP
> +fi
>  n1 ip route add 192.168.241.2/32 dev wg0 mtu 1299
>  n2 ip route add 192.168.241.1/32 dev wg0 mtu 1299
>  n2 ping -c 1 -W 1 -s 1269 192.168.241.1
>  n2 ip route delete 192.168.241.1/32 dev wg0 mtu 1299
>  n1 ip route delete 192.168.241.2/32 dev wg0 mtu 1299
> -n0 iptables -F INPUT
> +if use_nft; then
> +	n0 nft delete table inet filter

Here just flush the table (drops only the rules):

| n0 nft flush table ip wgtest

Cheers, Phil