qa: build unshared nfct environment

PATCH Superseded Ken-ichirou MATSUZAWA 2 participants 6 messages Sep 30, 2014 – Oct 24, 2014 netfilter

Share & tools

Ken-ichirou MATSUZAWA

author

2014-09-30 09:02 UTC #0 lore raw

PATCH 1/1 qa: build unshared nfct environment

nssocket forks and change netns pre-establishd by ip(8), serves its socket descriptor to parent via nssocket(). Since this socket is isolated, it can be used to create regression tests for conntrack.

This also adds a conntrack event testcase as a first user. A ct_echo_event.sh script is provided to build and run this test automatically:

  # ./qa/ct_echo_event.sh
  make: Entering directory...
  ...debug output like:
      [NEW] tcp      6 2 SYN_SENT src=10.255.255.249 dst=10.255.255.250 sport...
   [UPDATE] tcp      6 2 SYN_RECV src=10.255.255.249 dst=10.255.255.250 sport...
  ...
  [DESTROY] icmp     1 src=10.255.255.249 dst=10.255.255.250 type=8 code=0...
  # echo $?
  0

Signed-off-by Ken-ichirou MATSUZAWA <[email protected]>

---
 .gitignore          |   1 +
 configure.ac        |   3 +
 qa/Makefile.am      |   8 +-
 qa/ct_echo_event.c  | 423 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 qa/ct_echo_event.sh |  78 ++++++++++
 qa/inetd.conf       |   7 +
 qa/nssocket.c       | 423 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 qa/nssocket.h       |  77 ++++++++++
 8 files changed, 1019 insertions(+), 1 deletion(-)
 create mode 100644 qa/ct_echo_event.c
 create mode 100755 qa/ct_echo_event.sh
 create mode 100644 qa/inetd.conf
 create mode 100644 qa/nssocket.c
 create mode 100644 qa/nssocket.h

.gitignore +1 -0

index f4938e9..e90dec6 100644
@@ -12,6 +12,7 @@ Makefile.in
 /config.*
 /configure
 /libtool
+/stamp-h1
 
 /doxygen.cfg
 /*.pc

configure.ac +3 -0

index 1edfd66..5050ef6 100644
@@ -3,6 +3,7 @@ dnl Process this file with autoconf to create configure.
 AC_INIT([libnetfilter_conntrack], [1.0.4])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CANONICAL_HOST
+AC_CONFIG_HEADER([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 
 AM_INIT_AUTOMAKE([-Wall foreign subdir-objects

@@ -30,6 +31,8 @@ PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 AC_CHECK_HEADERS(arpa/inet.h)
 dnl Check for inet_ntop
 AC_CHECK_FUNCS(inet_ntop)
+dnl Check for setns used in qa
+AC_CHECK_FUNCS(setns)
 dnl Again, some systems have it, but not IPv6
 if test "$ac_cv_func_inet_ntop" = "yes" ; then
 AC_MSG_CHECKING(if inet_ntop supports IPv6)

qa/Makefile.am +7 -1

index abe063f..b16ab01 100644
@@ -1,6 +1,7 @@
 include $(top_srcdir)/Make_global.am
 
-check_PROGRAMS = test_api test_filter test_connlabel ct_stress ct_events_reliable
+check_PROGRAMS = test_api test_filter test_connlabel ct_stress \
+	ct_events_reliable ct_echo_event
 
 test_api_SOURCES = test_api.c
 test_api_LDADD = ../src/libnetfilter_conntrack.la

@@ -16,3 +17,8 @@ ct_stress_LDADD = ../src/libnetfilter_conntrack.la
 
 ct_events_reliable_SOURCES = ct_events_reliable.c
 ct_events_reliable_LDADD = ../src/libnetfilter_conntrack.la
+
+AM_CFLAGS += -D_GNU_SOURCE
+ct_echo_event_SOURCES = ct_echo_event.c nssocket.c
+ct_echo_event_DEPENDENCIES = ct_echo_event.sh
+ct_echo_event_LDADD = ../src/libnetfilter_conntrack.la -lmnl

qa/ct_echo_event.c new file +423 -0

423 lines not on this page · raw message

qa/ct_echo_event.sh new file +78 -0

78 lines not on this page · raw message

qa/inetd.conf new file +7 -0

new file mode 100644
index 0000000..0216b7d
@@ -0,0 +1,7 @@
+#:INTERNAL: Internal services
+echo		stream	tcp	nowait	root	internal
+echo		dgram	udp	wait	root	internal
+#discard		stream	tcp	nowait	root	internal
+#discard		dgram	udp	wait	root	internal
+#daytime		stream	tcp	nowait	root	internal
+#time		stream	tcp	nowait	root	internal

qa/nssocket.c new file +423 -0

423 lines not on this page · raw message

qa/nssocket.h new file +77 -0

77 lines not on this page · raw message

Signature · 1 line

2.1.0

Florian Westphal

maintainer

2014-09-30 10:16 UTC #1 lore raw

Quoted 8 lines · Ken-ichirou MATSUZAWA

nssocket forks and change netns pre-establishd by ip(8), serves its socket descriptor to parent via nssocket(). Since this socket is isolated, it can be used to create regression tests for conntrack.
This also adds a conntrack event testcase as a first user. A ct_echo_event.sh script is provided to build and run this test automatically:

Quoted 9 lines

  # ./qa/ct_echo_event.sh
  make: Entering directory...
  ...debug output like:
      [NEW] tcp      6 2 SYN_SENT src=10.255.255.249 dst=10.255.255.250 sport...
   [UPDATE] tcp      6 2 SYN_RECV src=10.255.255.249 dst=10.255.255.250 sport...
  ...
  [DESTROY] icmp     1 src=10.255.255.249 dst=10.255.255.250 type=8 code=0...
  # echo $?
  0

make: Entering directory `git/netfilter.org/libnetfilter_conntrack/qa'
CC ct_echo_event.o
ct_echo_event.c:231:12: warning: 'cb_tcp_last_ack' defined but not used [-Wunused-function] ct_echo_event.c:241:12: warning: 'cb_tcp_time_wait' defined but not used [-Wunused-function] ct_echo_event.c:251:12: warning: 'cb_tcp_after_finwait' defined but not used [-Wunused-function]
CCLD ct_echo_event
make: Leaving directory `git/netfilter.org/libnetfilter_conntrack/qa'
modprobe: FATAL: Module nfnetlink_cttimeout not found.
(UNKNOWN) [10.255.255.250] 7 (echo) : Connection refused

    [NEW] tcp      6 2 SYN_SENT src=10.255.255.249 dst=10.255.255.250 sport=55576 dport=7 [UNREPLIED] src=10.255.255.250 dst=10.255.255.249 sport=7 dport=55576

[DESTROY] tcp 6 src=10.255.255.249 dst=10.255.255.250 sport=55576 dport=7 [UNREPLIED] src=10.255.255.250 dst=10.255.255.249 sport=7 dport=55576
ct_echo_event: ct_echo_event.c:95: author_update: Assertion `(nlh->nlmsg_type & 0xFF) == IPCTNL_MSG_CT_NEW' failed.
qa/ct_echo_event.sh: line 56: 2182 Aborted ${dname}/ct_echo_event $NETNS $PRE_FIFO $POST_FIFO
qa/ct_echo_event.sh: line 62: qa_post_fifo: No such file or directory
qa/ct_echo_event.sh: line 65: qa_pre_fifo: No such file or directory
qa/ct_echo_event.sh: line 67: qa_post_fifo: No such file or directory
qa/ct_echo_event.sh: line 70: qa_pre_fifo: No such file or directory
qa/ct_echo_event.sh: line 72: qa_post_fifo: No such file or directory
Killed

Seems like this depends on inetd to provide tcp/udp echo services. Thats fine, I don't have any objections.

The ICMP test passes when I remove tcp/udp test.

Could you please either remove the unused functions or provide some comment in the commit message why these helpers are there, but currently unused? (I see you commented out the calls).

[ the modprobe error is because I don't have cttimeout but it does appear to have no immediate
ill effect ]

Thanks!

Ken-ichirou MATSUZAWA

author

2014-10-04 14:13 UTC #2 lore raw

PATCH v2 1/1 qa: build unshared nfct environment

This also adds a conntrack event testcase as a first user. A ct_echo_event.sh script is provided to build and run this test automatically:

  # ./qa/ct_echo_event.sh
  make: Entering directory...
  ...debug output like:
      [NEW] tcp      6 2 SYN_SENT src=10.255.255.249 dst=10.255.255.250 sport...
   [UPDATE] tcp      6 2 SYN_RECV src=10.255.255.249 dst=10.255.255.250 sport...
  ...
  [DESTROY] icmp     1 src=10.255.255.249 dst=10.255.255.250 type=8 code=0...
  # echo $?
  0

Signed-off-by Ken-ichirou MATSUZAWA <[email protected]>

---
 .gitignore          |   1 +
 configure.ac        |   3 +
 qa/Makefile.am      |   8 +-
 qa/ct_echo_event.c  | 383 +++++++++++++++++++++++++++++++++++++++++++++++
 qa/ct_echo_event.sh |  81 ++++++++++
 qa/inetd.conf       |   7 +
 qa/nssocket.c       | 423 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 qa/nssocket.h       |  66 ++++++++
 8 files changed, 971 insertions(+), 1 deletion(-)
 create mode 100644 qa/ct_echo_event.c
 create mode 100755 qa/ct_echo_event.sh
 create mode 100644 qa/inetd.conf
 create mode 100644 qa/nssocket.c
 create mode 100644 qa/nssocket.h

.gitignore +1 -0

index f4938e9..e90dec6 100644
@@ -12,6 +12,7 @@ Makefile.in
 /config.*
 /configure
 /libtool
+/stamp-h1
 
 /doxygen.cfg
 /*.pc

configure.ac +3 -0

index 1edfd66..5050ef6 100644
@@ -3,6 +3,7 @@ dnl Process this file with autoconf to create configure.
 AC_INIT([libnetfilter_conntrack], [1.0.4])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CANONICAL_HOST
+AC_CONFIG_HEADER([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 
 AM_INIT_AUTOMAKE([-Wall foreign subdir-objects

@@ -30,6 +31,8 @@ PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 AC_CHECK_HEADERS(arpa/inet.h)
 dnl Check for inet_ntop
 AC_CHECK_FUNCS(inet_ntop)
+dnl Check for setns used in qa
+AC_CHECK_FUNCS(setns)
 dnl Again, some systems have it, but not IPv6
 if test "$ac_cv_func_inet_ntop" = "yes" ; then
 AC_MSG_CHECKING(if inet_ntop supports IPv6)

qa/Makefile.am +7 -1

index abe063f..b16ab01 100644
@@ -1,6 +1,7 @@
 include $(top_srcdir)/Make_global.am
 
-check_PROGRAMS = test_api test_filter test_connlabel ct_stress ct_events_reliable
+check_PROGRAMS = test_api test_filter test_connlabel ct_stress \
+	ct_events_reliable ct_echo_event
 
 test_api_SOURCES = test_api.c
 test_api_LDADD = ../src/libnetfilter_conntrack.la

@@ -16,3 +17,8 @@ ct_stress_LDADD = ../src/libnetfilter_conntrack.la
 
 ct_events_reliable_SOURCES = ct_events_reliable.c
 ct_events_reliable_LDADD = ../src/libnetfilter_conntrack.la
+
+AM_CFLAGS += -D_GNU_SOURCE
+ct_echo_event_SOURCES = ct_echo_event.c nssocket.c
+ct_echo_event_DEPENDENCIES = ct_echo_event.sh
+ct_echo_event_LDADD = ../src/libnetfilter_conntrack.la -lmnl

qa/ct_echo_event.c new file +383 -0

383 lines not on this page · raw message

qa/ct_echo_event.sh new file +81 -0

81 lines not on this page · raw message

qa/inetd.conf new file +7 -0

new file mode 100644
index 0000000..0216b7d
@@ -0,0 +1,7 @@
+#:INTERNAL: Internal services
+echo		stream	tcp	nowait	root	internal
+echo		dgram	udp	wait	root	internal
+#discard		stream	tcp	nowait	root	internal
+#discard		dgram	udp	wait	root	internal
+#daytime		stream	tcp	nowait	root	internal
+#time		stream	tcp	nowait	root	internal

qa/nssocket.c new file +423 -0

423 lines not on this page · raw message

qa/nssocket.h new file +66 -0

66 lines not on this page · raw message

Signature · 1 line

2.1.1

Ken-ichirou MATSUZAWA

author

2014-10-07 04:38 UTC #3 lore raw

v3 cover qa: build unshared nfct environment

In reply to Florian Westphal

Quoted 2 lines · Florian Westphal

Seems like this depends on inetd to provide tcp/udp echo services. Thats fine, I don't have any objections.

You said so but I added tools existance check.

Quoted 1 line

Could you please either remove the unused functions or provide some

I removed the unused function and the macro.

And move functions which may be common from ct_echo_event.c to nssocket.c and from ct_echo_event.sh to nssocket_env.sh for patches I will post later. Would you review again?

Thanks,

Ken-ichirou MATSUZAWA

author

2014-10-07 04:40 UTC #4 lore raw

PATCH v3 1/1 qa: build unshared nfct environment

This also adds a conntrack event testcase as a first user. A ct_echo_event.sh script is provided to build and run this test automatically:

  # ./qa/ct_echo_event.sh
  make: Entering directory...
  ...debug output like:
      [NEW] tcp      6 2 SYN_SENT src=10.255.255.249 dst=10.255.255.250 sport...
   [UPDATE] tcp      6 2 SYN_RECV src=10.255.255.249 dst=10.255.255.250 sport...
  ...
  [DESTROY] icmp     1 src=10.255.255.249 dst=10.255.255.250 type=8 code=0...
  # echo $?
  0

Signed-off-by Ken-ichirou MATSUZAWA <[email protected]>

---
 .gitignore          |   1 +
 configure.ac        |   3 +
 qa/Makefile.am      |   8 +-
 qa/ct_echo_event.c  |  62 +++++
 qa/ct_echo_event.sh |  20 ++
 qa/inetd.conf       |   7 +
 qa/nssocket.c       | 739 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 qa/nssocket.h       | 102 ++++++++
 qa/nssocket_env.sh  |  87 +++++++
 9 files changed, 1028 insertions(+), 1 deletion(-)
 create mode 100644 qa/ct_echo_event.c
 create mode 100755 qa/ct_echo_event.sh
 create mode 100644 qa/inetd.conf
 create mode 100644 qa/nssocket.c
 create mode 100644 qa/nssocket.h
 create mode 100644 qa/nssocket_env.sh

.gitignore +1 -0

index f4938e9..e90dec6 100644
@@ -12,6 +12,7 @@ Makefile.in
 /config.*
 /configure
 /libtool
+/stamp-h1
 
 /doxygen.cfg
 /*.pc

configure.ac +3 -0

index 1edfd66..5050ef6 100644
@@ -3,6 +3,7 @@ dnl Process this file with autoconf to create configure.
 AC_INIT([libnetfilter_conntrack], [1.0.4])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CANONICAL_HOST
+AC_CONFIG_HEADER([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 
 AM_INIT_AUTOMAKE([-Wall foreign subdir-objects

@@ -30,6 +31,8 @@ PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 AC_CHECK_HEADERS(arpa/inet.h)
 dnl Check for inet_ntop
 AC_CHECK_FUNCS(inet_ntop)
+dnl Check for setns used in qa
+AC_CHECK_FUNCS(setns)
 dnl Again, some systems have it, but not IPv6
 if test "$ac_cv_func_inet_ntop" = "yes" ; then
 AC_MSG_CHECKING(if inet_ntop supports IPv6)

qa/Makefile.am +7 -1

index abe063f..b16ab01 100644
@@ -1,6 +1,7 @@
 include $(top_srcdir)/Make_global.am
 
-check_PROGRAMS = test_api test_filter test_connlabel ct_stress ct_events_reliable
+check_PROGRAMS = test_api test_filter test_connlabel ct_stress \
+	ct_events_reliable ct_echo_event
 
 test_api_SOURCES = test_api.c
 test_api_LDADD = ../src/libnetfilter_conntrack.la

@@ -16,3 +17,8 @@ ct_stress_LDADD = ../src/libnetfilter_conntrack.la
 
 ct_events_reliable_SOURCES = ct_events_reliable.c
 ct_events_reliable_LDADD = ../src/libnetfilter_conntrack.la
+
+AM_CFLAGS += -D_GNU_SOURCE
+ct_echo_event_SOURCES = ct_echo_event.c nssocket.c
+ct_echo_event_DEPENDENCIES = ct_echo_event.sh
+ct_echo_event_LDADD = ../src/libnetfilter_conntrack.la -lmnl

qa/ct_echo_event.c new file +62 -0

62 lines not on this page · raw message

qa/ct_echo_event.sh new file +20 -0

new file mode 100755
index 0000000..b4d7409
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+. `dirname $0`/nssocket_env.sh
+
+echo "---- TCP echo"
+pre_sync
+echo | nc -q 0 $VETH_CHILD_ADDR $DSTPORT
+post_sync
+
+echo "---- UDP echo"
+pre_sync
+echo | nc -q 0 -u $VETH_CHILD_ADDR $DSTPORT
+post_sync
+
+echo "---- ICMP echo"
+pre_sync
+ping -c 1 $VETH_CHILD_ADDR > /dev/null 2>&1
+post_sync
+
+fin

qa/inetd.conf new file +7 -0

new file mode 100644
index 0000000..0216b7d
@@ -0,0 +1,7 @@
+#:INTERNAL: Internal services
+echo		stream	tcp	nowait	root	internal
+echo		dgram	udp	wait	root	internal
+#discard		stream	tcp	nowait	root	internal
+#discard		dgram	udp	wait	root	internal
+#daytime		stream	tcp	nowait	root	internal
+#time		stream	tcp	nowait	root	internal

qa/nssocket.c new file +739 -0

739 lines not on this page · raw message

qa/nssocket.h new file +102 -0

102 lines not on this page · raw message

qa/nssocket_env.sh new file +87 -0

87 lines not on this page · raw message

Signature · 1 line

2.1.1

Florian Westphal

maintainer Applied

2014-10-24 09:24 UTC #5 lore raw

Quoted 8 lines · Ken-ichirou MATSUZAWA

nssocket forks and change netns pre-establishd by ip(8), serves its socket descriptor to parent via nssocket(). Since this socket is isolated, it can be used to create regression tests for conntrack.
This also adds a conntrack event testcase as a first user. A ct_echo_event.sh script is provided to build and run this test automatically:

Quoted 9 lines

  # ./qa/ct_echo_event.sh
  make: Entering directory...
  ...debug output like:
      [NEW] tcp      6 2 SYN_SENT src=10.255.255.249 dst=10.255.255.250 sport...
   [UPDATE] tcp      6 2 SYN_RECV src=10.255.255.249 dst=10.255.255.250 sport...
  ...
  [DESTROY] icmp     1 src=10.255.255.249 dst=10.255.255.250 type=8 code=0...
  # echo $?
  0

Applied, thanks for your patience.