netdev - Re: [PATCH nf-next] selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aSg1MWLUx0GyCWij@lore-desk>
Date: Thu, 27 Nov 2025 12:25:37 +0100
From: Lorenzo Bianconi <lorenzo@...nel.org>
To: Simon Horman <horms@...nel.org>
Cc: Pablo Neira Ayuso <pablo@...filter.org>,
	Jozsef Kadlecsik <kadlec@...filter.org>,
	Florian Westphal <fw@...len.de>, Phil Sutter <phil@....cc>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Shuah Khan <shuah@...nel.org>, netfilter-devel@...r.kernel.org,
	coreteam@...filter.org, netdev@...r.kernel.org,
	linux-kselftest@...r.kernel.org
Subject: Re: [PATCH nf-next] selftests: netfilter: nft_flowtable.sh: Add the
 capability to send IPv6 TCP traffic

> On Sat, Nov 22, 2025 at 07:41:38PM +0100, Lorenzo Bianconi wrote:
> > Introduce the capability to send TCP traffic over IPv6 to
> > nft_flowtable netfilter selftest.
> > 
> > Signed-off-by: Lorenzo Bianconi <lorenzo@...nel.org>
> > ---
> >  .../selftests/net/netfilter/nft_flowtable.sh       | 47 +++++++++++++++-------
> >  1 file changed, 33 insertions(+), 14 deletions(-)
> > 
> > diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > index 1fbfc8ad8dcdc5db2ab1a1ea9310f655d09eee83..24b4e60b91451e7ea7f6a041b0335233047c6242 100755
> > --- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > +++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > @@ -127,6 +127,8 @@ ip -net "$nsr1" addr add fee1:2::1/64 dev veth1 nodad
> >  ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0
> >  ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad
> >  
> > +ip netns exec "$nsr1" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
> > +ip netns exec "$nsr2" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
> >  for i in 0 1; do
> >    ip netns exec "$nsr1" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
> >    ip netns exec "$nsr2" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
> > @@ -153,7 +155,9 @@ ip -net "$ns1" route add default via dead:1::1
> >  ip -net "$ns2" route add default via dead:2::1
> >  
> >  ip -net "$nsr1" route add default via 192.168.10.2
> > +ip -6 -net "$nsr1" route add default via fee1:2::2
> >  ip -net "$nsr2" route add default via 192.168.10.1
> > +ip -6 -net "$nsr2" route add default via fee1:2::1
> >  
> >  ip netns exec "$nsr1" nft -f - <<EOF
> >  table inet filter {
> > @@ -352,8 +356,9 @@ test_tcp_forwarding_ip()
> >  	local nsa=$1
> >  	local nsb=$2
> >  	local pmtu=$3
> > -	local dstip=$4
> > -	local dstport=$5
> > +	local proto=$4
> > +	local dstip=$5
> > +	local dstport=$6
> >  	local lret=0
> >  	local socatc
> >  	local socatl
> > @@ -363,12 +368,12 @@ test_tcp_forwarding_ip()
> >  		infile="$nsin_small"
> >  	fi
> >  
> > -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
> > +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -${proto} TCP${proto}-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
> 
> Hi Lorenzo,
> 
> Some minor nits:
> 
> 1. This line is (and was) excessively long.
>    Maybe it can be addressed as the line is being modified anyway.
> 
>    Flagged by checkpatch
> 
> 2. Prior to this patch, variables on this line were enclosed in "" to
>    guard against word splitting when expansion occurs.
>    This is no longer the case.
> 
>    Flagged by shellcheck
> 
> >  	lpid=$!
> >  
> >  	busywait 1000 listener_ready
> >  
> > -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
> > +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -${proto} TCP${proto}:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
> >  	socatc=$?
> 
> Likewise here.
> 
> >  
> >  	wait $lpid
> 
> Otherwise this LGTM.

Hi Simon,

ack, fine. Is it ok to address them in subsequent patch or do you prefer to
address them here?
@Pablo: what do you prefer?

Regards,
Lorenzo

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)