diff options
Diffstat (limited to 'target/linux/generic/pending-5.10/640-08-selftests-netfilter-flowtable-bridge-and-VLAN-suppor.patch')
| -rw-r--r-- | target/linux/generic/pending-5.10/640-08-selftests-netfilter-flowtable-bridge-and-VLAN-suppor.patch | 107 |
1 files changed, 107 insertions, 0 deletions
diff --git a/target/linux/generic/pending-5.10/640-08-selftests-netfilter-flowtable-bridge-and-VLAN-suppor.patch b/target/linux/generic/pending-5.10/640-08-selftests-netfilter-flowtable-bridge-and-VLAN-suppor.patch new file mode 100644 index 0000000000..1ee015c6aa --- /dev/null +++ b/target/linux/generic/pending-5.10/640-08-selftests-netfilter-flowtable-bridge-and-VLAN-suppor.patch @@ -0,0 +1,107 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Fri, 20 Nov 2020 13:49:21 +0100 +Subject: [PATCH] selftests: netfilter: flowtable bridge and VLAN support + +This patch adds two new tests to cover bridge and VLAN support: + +- Add a bridge device to the Router1 (nsr1) container and attach the + veth0 device to the bridge. Set the IP address to the bridge device + to exercise the bridge forwarding path. + +- Add VLAN encapsulation between to the bridge device in the Router1 and + one of the sender containers (ns1). + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/tools/testing/selftests/netfilter/nft_flowtable.sh ++++ b/tools/testing/selftests/netfilter/nft_flowtable.sh +@@ -371,6 +371,88 @@ else + ip netns exec nsr1 nft list ruleset + fi + ++# Another test: ++# Add bridge interface br0 to Router1, with NAT enabled. ++ip -net nsr1 link add name br0 type bridge ++ip -net nsr1 addr flush dev veth0 ++ip -net nsr1 link set up dev veth0 ++ip -net nsr1 link set veth0 master br0 ++ip -net nsr1 addr add 10.0.1.1/24 dev br0 ++ip -net nsr1 addr add dead:1::1/64 dev br0 ++ip -net nsr1 link set up dev br0 ++ ++ip netns exec nsr1 sysctl net.ipv4.conf.br0.forwarding=1 > /dev/null ++ ++# br0 with NAT enabled. ++ip netns exec nsr1 nft -f - <<EOF ++flush table ip nat ++table ip nat { ++ chain prerouting { ++ type nat hook prerouting priority 0; policy accept; ++ meta iif "br0" ip daddr 10.6.6.6 tcp dport 1666 counter dnat ip to 10.0.2.99:12345 ++ } ++ ++ chain postrouting { ++ type nat hook postrouting priority 0; policy accept; ++ meta oifname "veth1" counter masquerade ++ } ++} ++EOF ++ ++if test_tcp_forwarding_nat ns1 ns2; then ++ echo "PASS: flow offloaded for ns1/ns2 with bridge NAT" ++else ++ echo "FAIL: flow offload for ns1/ns2 with bridge NAT" 1>&2 ++ ip netns exec nsr1 nft list ruleset ++ ret=1 ++fi ++ ++# Another test: ++# Add bridge interface br0 to Router1, with NAT and VLAN. ++ip -net nsr1 link set veth0 nomaster ++ip -net nsr1 link set down dev veth0 ++ip -net nsr1 link add link veth0 name veth0.10 type vlan id 10 ++ip -net nsr1 link set up dev veth0 ++ip -net nsr1 link set up dev veth0.10 ++ip -net nsr1 link set veth0.10 master br0 ++ ++ip -net ns1 addr flush dev eth0 ++ip -net ns1 link add link eth0 name eth0.10 type vlan id 10 ++ip -net ns1 link set eth0 up ++ip -net ns1 link set eth0.10 up ++ip -net ns1 addr add 10.0.1.99/24 dev eth0.10 ++ip -net ns1 route add default via 10.0.1.1 ++ip -net ns1 addr add dead:1::99/64 dev eth0.10 ++ ++if test_tcp_forwarding_nat ns1 ns2; then ++ echo "PASS: flow offloaded for ns1/ns2 with bridge NAT and VLAN" ++else ++ echo "FAIL: flow offload for ns1/ns2 with bridge NAT and VLAN" 1>&2 ++ ip netns exec nsr1 nft list ruleset ++ ret=1 ++fi ++ ++# restore test topology (remove bridge and VLAN) ++ip -net nsr1 link set veth0 nomaster ++ip -net nsr1 link set veth0 down ++ip -net nsr1 link set veth0.10 down ++ip -net nsr1 link delete veth0.10 type vlan ++ip -net nsr1 link delete br0 type bridge ++ip -net ns1 addr flush dev eth0.10 ++ip -net ns1 link set eth0.10 down ++ip -net ns1 link set eth0 down ++ip -net ns1 link delete eth0.10 type vlan ++ ++# restore address in ns1 and nsr1 ++ip -net ns1 link set eth0 up ++ip -net ns1 addr add 10.0.1.99/24 dev eth0 ++ip -net ns1 route add default via 10.0.1.1 ++ip -net ns1 addr add dead:1::99/64 dev eth0 ++ip -net ns1 route add default via dead:1::1 ++ip -net nsr1 addr add 10.0.1.1/24 dev veth0 ++ip -net nsr1 addr add dead:1::1/64 dev veth0 ++ip -net nsr1 link set up dev veth0 ++ + KEY_SHA="0x"$(ps -xaf | sha1sum | cut -d " " -f 1) + KEY_AES="0x"$(ps -xaf | md5sum | cut -d " " -f 1) + SPI1=$RANDOM |