diff mbox series

[nft] tests: shell: add cgroupv2 socket match test case

Message ID 20250102170833.18692-1-fw@strlen.de
State Accepted, archived
Headers show
Series [nft] tests: shell: add cgroupv2 socket match test case | expand

Commit Message

Florian Westphal Jan. 2, 2025, 5:08 p.m. UTC 
This is a test case for nft_socket cgroupv2 matching, including
support for matching inside a cgroupv2 mount space added in kernel
commit 7f3287db6543 ("netfilter: nft_socket: make cgroupsv2 matching work with namespaces").

Test is thus run twice, once in the initial namespace and once with
a changed cgroupv2 root.

In case we can't create a cgroup or the 2nd half (unshared re-run)
fails, indicate SKIP.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 tests/shell/testcases/packetpath/cgroupv2     | 143 ++++++++++++++++++
 .../packetpath/dumps/cgroupv2.nodump          |   0
 2 files changed, 143 insertions(+)
 create mode 100755 tests/shell/testcases/packetpath/cgroupv2
 create mode 100644 tests/shell/testcases/packetpath/dumps/cgroupv2.nodump
diff mbox series

Patch

diff --git a/tests/shell/testcases/packetpath/cgroupv2 b/tests/shell/testcases/packetpath/cgroupv2
new file mode 100755
index 000000000000..20bd18ae3b4f
--- /dev/null
+++ b/tests/shell/testcases/packetpath/cgroupv2
@@ -0,0 +1,143 @@ 
+#!/bin/bash
+
+doit="$1"
+rc=0
+
+# Create hierarchy:
+# / -> nft-test1a/nft-test2a
+# |              `nft-test2b
+# `--> nft-test1b/nft-test2a
+# test1b/nft-test2a will remain empty and
+# should never match, it only exists so we
+# can create cgroupv2 match rules.
+
+if ! socat -h > /dev/null ; then
+	echo "socat tool is missing"
+	exit 77
+fi
+
+if [ ! -r /sys/fs/cgroup/cgroup.procs ] ;then
+	echo "cgroup filesystem not available"
+	exit 77
+fi
+
+cleanup()
+{
+	echo $$ > "/sys/fs/cgroup/cgroup.procs"
+
+	rmdir "/sys/fs/cgroup/nft-test1a/nft-test2a"
+	rmdir "/sys/fs/cgroup/nft-test1a/nft-test2b"
+	rmdir "/sys/fs/cgroup/nft-test1b/nft-test2a"
+	rmdir "/sys/fs/cgroup/nft-test1a"
+	rmdir "/sys/fs/cgroup/nft-test1b"
+
+	# nft list is broken after cgroupv2 removal, as nft
+	# can't find the human-readable names anymore.
+	$NFT delete table inet testcgrpv2
+}
+
+do_initial_setup()
+{
+	trap cleanup EXIT
+	ip link set lo up
+
+	mkdir -p "/sys/fs/cgroup/nft-test1a/nft-test2a" || exit 1
+	mkdir -p "/sys/fs/cgroup/nft-test1b/nft-test2a" || exit 1
+
+	mkdir "/sys/fs/cgroup/nft-test1a/nft-test2b" || exit 1
+
+	# After this, we can create cgroupv2 rules for the these cgroups.
+	# test1a and test2a should match while test1b/test2b should not:
+$NFT -f - <<EOF
+table inet testcgrpv2 {
+       counter nft-test1a {}
+       counter nft-test1a2a {}
+       counter nft-test1a2b {}
+       counter nft-test1b {}
+       counter nft-test1b2a {}
+
+       chain output {
+               type filter hook output priority 0;
+
+		socket cgroupv2 level 1 "nft-test1a" counter name "nft-test1a"
+		socket cgroupv2 level 2 "nft-test1a/nft-test2a" counter name "nft-test1a2a"
+
+		# Next must never match
+		socket cgroupv2 level 2 "nft-test1a/nft-test2b" counter name "nft-test1a2b"
+
+		# Must never match
+		socket cgroupv2 level 1 "nft-test1b" counter name "nft-test1b"
+		# Same, must not match.
+		socket cgroupv2 level 2 "nft-test1b/nft-test2a" counter name "nft-test1b2a"
+       }
+}
+EOF
+}
+
+test_counters()
+{
+	local subtest="$1"
+
+	local t1a="$2"
+	local t1a2a="$3"
+
+	$NFT list ruleset
+
+	$NFT reset counter inet testcgrpv2 nft-test1a | grep -q "packets $t1a" || rc=1
+	$NFT reset counter inet testcgrpv2 nft-test1a2a | grep -q "packets $t1a2a" || rc=2
+
+	# dummy cgroup counters, must not match.
+	$NFT reset counter inet testcgrpv2 nft-test1a2b | grep -q 'packets 0' || rc=3
+	$NFT reset counter inet testcgrpv2 nft-test1b   | grep -q 'packets 0' || rc=4
+	$NFT reset counter inet testcgrpv2 nft-test1b2a | grep -q 'packets 0' || rc=5
+
+	if [ $rc -ne 0 ]; then
+		echo "Counters did not match expected values fur subtest $subtest, return $rc"
+		exit $rc
+	fi
+}
+
+run_test()
+{
+	echo $$ > "/sys/fs/cgroup/nft-test1a/nft-test2a/cgroup.procs" || exit 2
+	socat -u STDIN TCP:127.0.0.1:8880,connect-timeout=4 < /dev/null > /dev/null
+
+	test_counters "a1,a2" 1 1
+
+	echo $$ > "/sys/fs/cgroup/nft-test1a/cgroup.procs" || exit 2
+	socat -u STDIN TCP:127.0.0.1:8880,connect-timeout=4 < /dev/null > /dev/null
+	test_counters "a1 only" 1 0
+}
+
+
+if [ "$doit" != "setup-done" ];then
+	mkdir -p "/sys/fs/cgroup/nft-test1a" || exit 77
+
+	do_initial_setup
+	run_test
+
+	if [ $rc -ne 0 ]; then
+		exit $rc
+	fi
+
+	echo "Re-running test with changed cgroup root"
+	echo $$ > "/sys/fs/cgroup/nft-test1a/cgroup.procs" || exit 2
+	unshare --fork --pid --mount -n -C $0 "setup-done"
+	rc=$?
+else
+	want_inode=$(stat --printf=%i "/sys/fs/cgroup/nft-test1a/")
+	mount -t cgroup2 cgroup2 /sys/fs/cgroup
+
+	# /sys/fs/cgroup/  should now match "/sys/fs/cgroup/nft-test1a/cgroup.procs"
+	rootinode=$(stat --printf=%i "/sys/fs/cgroup/")
+
+	if [ $want_inode -ne $rootinode ] ;then
+		echo "Failed to remount cgroupv2 fs, wanted inode $want_inode as root node, but got $rootinode"
+		exit 77
+	fi
+
+	do_initial_setup
+	run_test
+fi
+
+exit $rc
diff --git a/tests/shell/testcases/packetpath/dumps/cgroupv2.nodump b/tests/shell/testcases/packetpath/dumps/cgroupv2.nodump
new file mode 100644
index 000000000000..e69de29bb2d1