netdev - Re: [RFC net-next 11/13] selftests: ovpn: add test for bound device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b7c7ee0c95241155dfa5f461d58b1bfd072a901b.camel@mandelbit.com>
Date: Tue, 02 Dec 2025 17:28:45 +0100
From: Ralf Lici <ralf@...delbit.com>
To: Sabrina Dubroca <sd@...asysnail.net>, Antonio Quartulli
	 <antonio@...nvpn.net>
Cc: netdev@...r.kernel.org, Jakub Kicinski <kuba@...nel.org>, 
	linux-kselftest@...r.kernel.org, Shuah Khan <shuah@...nel.org>
Subject: Re: [RFC net-next 11/13] selftests: ovpn: add test for bound device

On Thu, 2025-11-27 at 12:29 +0100, Sabrina Dubroca wrote:
> 2025-11-21, 01:20:42 +0100, Antonio Quartulli wrote:
> > From: Ralf Lici <ralf@...delbit.com>
> > 
> > Add a selftest to verify that when a socket is bound to a device,
> > UDP
> > traffic from ovpn is correctly routed through the specified
> > interface.
> > 
> > The test sets up a P2P session between two peers in separate network
> > namespaces, connected via two veth pairs. It binds to both veth
> > interfaces and uses tcpdump to confirm that traffic flows through
> > the
> > expected paths.
> 
> The current setup doesn't really test that, since it would also work
> without SO_BINDTODEVICE (traffic still flows through the expected veth
> if I pass "any" instead of veth1/veth2 to the new_peer commands).

Thanks for catching this. I see the issue and will try a different
approach in the next version of the patch.

> [...]
> > diff --git a/tools/testing/selftests/net/ovpn/common.sh
> > b/tools/testing/selftests/net/ovpn/common.sh
> > index d926413c9f16..c802e4e50054 100644
> > --- a/tools/testing/selftests/net/ovpn/common.sh
> > +++ b/tools/testing/selftests/net/ovpn/common.sh
> > @@ -66,9 +66,11 @@ setup_listener() {
> >  }
> >  
> >  add_peer() {
> > +	dev=${2:-"any"}
> 
> nit: no user of add_peer is patched to pass this extra argument

Yes, I initially considered using this function for test-bind.sh but
later abandoned the idea. I'll remove the argument since it's not
needed.

> > diff --git a/tools/testing/selftests/net/ovpn/test-bind.sh
> > b/tools/testing/selftests/net/ovpn/test-bind.sh
> > new file mode 100755
> > index 000000000000..fd7c3c8fdf63
> > --- /dev/null
> > +++ b/tools/testing/selftests/net/ovpn/test-bind.sh
> > @@ -0,0 +1,103 @@
> [...]
> > +run_bind_test() {
> > +	dev1=${1}
> > +	dev2=${2}
> > +	raddr4_peer1=${3}
> > +	raddr4_peer2=${4}
> > +
> > +	touch /tmp/ovpn-bind1.log
> > +	touch /tmp/ovpn-bind2.log
> > +
> > +	ip netns exec peer1 ${OVPN_CLI} del_peer tun1 1 2>/dev/null
> > || true
> > +	ip netns exec peer2 ${OVPN_CLI} del_peer tun2 10
> > 2>/dev/null || true
> > +
> > +	# close any active socket
> > +	killall $(basename ${OVPN_CLI}) 2>/dev/null || true
> > +
> > +	ip netns exec peer1 ${OVPN_CLI} new_peer tun1 ${dev1} 1 10
> > 1 ${raddr4_peer1} 1
> > +	ip netns exec peer1 ${OVPN_CLI} new_key tun1 1 1 0 ${ALG} 0
> > data64.key
> > +	ip netns exec peer2 ${OVPN_CLI} new_peer tun2 ${dev2} 10 1
> > 1 ${raddr4_peer2} 1
> > +	ip netns exec peer2 ${OVPN_CLI} new_key tun2 10 1 0 ${ALG}
> > 1 data64.key
> > +
> > +	ip netns exec peer1 ${OVPN_CLI} set_peer tun1 1 60 120
> > +	ip netns exec peer2 ${OVPN_CLI} set_peer tun2 10 60 120
> > +
> > +	timeout 2 ip netns exec peer1 tcpdump -i veth1 "${PROTO,,}"
> > port 1 -n -q > /tmp/ovpn-bind1.log &
> 
> Maybe add
> 2> /dev/null
> to clean up a bit the script output?

ACK.

> > +	tcpdump1_pid=$!
> > +	timeout 2 ip netns exec peer1 tcpdump -i veth2 "${PROTO,,}"
> > port 1 -n -q > /tmp/ovpn-bind2.log &
> > +	tcpdump2_pid=$!
> > +	sleep 0.5
> > +
> > +	ip netns exec peer1 ping -qfc 50 -w 1 5.5.5.2
> > +
> > +	wait ${tcpdump1_pid} || true
> > +	wait ${tcpdump2_pid} || true
> > +}
> > +
> > +run_bind_test veth1 any 10.10.10.2 10.10.10.1
> > +[ "$(grep -c -i udp /tmp/ovpn-bind1.log)" -ge 100 ]
> > +[ "$(grep -c -i udp /tmp/ovpn-bind2.log)" -eq 0 ]
> > +
> > +run_bind_test veth2 any 20.20.20.2 20.20.20.1
> > +[ "$(grep -c -i udp /tmp/ovpn-bind2.log)" -ge 100 ]
> > +[ "$(grep -c -i udp /tmp/ovpn-bind1.log)" -eq 0 ]
> > +
> > +run_bind_test any veth1 10.10.10.2 10.10.10.1
> > +[ "$(grep -c -i udp /tmp/ovpn-bind1.log)" -ge 100 ]
> > +[ "$(grep -c -i udp /tmp/ovpn-bind2.log)" -eq 0 ]
> > +
> > +run_bind_test any veth2 20.20.20.2 20.20.20.1
> > +[ "$(grep -c -i udp /tmp/ovpn-bind2.log)" -ge 100 ]
> > +[ "$(grep -c -i udp /tmp/ovpn-bind1.log)" -eq 0 ]
> > +
> > +cleanup
> 
> And also clean up the log files? (maybe via "trap <function> EXIT" so
> that they get removed as well if the test fails)

ACK.

-- 
Ralf Lici
Mandelbit Srl