[PATCH libnflog] utils: add minimal nfnlog test case
Florian Westphal <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
Check that nfulnl_test receives 4 log messages each for ping/ping6 packets. Signed-off-by: Florian Westphal <[email protected]> --- Seems I forgot to send it, I have carried this locally for more than a month :-/ utils/nfulnl_test.c | 1 + utils/nfulnl_test.sh | 58 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100755 utils/nfulnl_test.sh diff --git a/utils/nfulnl_test.c b/utils/nfulnl_test.c index 4f29f1757c81..840c0bea3a86 100644 --- a/utils/nfulnl_test.c +++ b/utils/nfulnl_test.c @@ -121,6 +121,7 @@ int main(int argc, char **argv) /* handle messages in just-received packet */ nflog_handle_packet(h, buf, rv); + fflush(stdout); } printf("unbinding from group 100\n"); diff --git a/utils/nfulnl_test.sh b/utils/nfulnl_test.sh new file mode 100755 index 000000000000..b23ccab04bae --- /dev/null +++ b/utils/nfulnl_test.sh @@ -0,0 +1,58 @@ +#!/bin/bash + +# Configuration +NFLOG_GROUP=0 +PING_COUNT=2 +out="" + +cleanup() { + rm -f "$out" +} + +die() { + echo "$@" + exit 1 +} + +if [ "$1" = "" ]; then + # Re-execute in new network namespace + exec unshare -n -- "$0" "run" +fi + +trap cleanup EXIT +set -e +out=$(mktemp) + +timeout 5 ./nfulnl_test > "$out" & + +# Create ruleset to log ICMP/ICMPv6 +nft -f - <<EOF +table inet filter { + chain icmp-log { + type filter hook prerouting priority 0; policy accept; + + meta l4proto icmp counter log group $NFLOG_GROUP prefix "test icmp " + meta l4proto ipv6-icmp counter log group $NFLOG_GROUP prefix "test icmp6 " + } +} +EOF + +# Ensure the namespace has loopback and can send traffic +ip link set lo up + +sleep 1 + +# Trigger ICMP echo requests to ourselves (127.0.0.1 and ::1) +ping -q -c "$PING_COUNT" 127.0.0.1 > /dev/null +ping6 -q -c "$PING_COUNT" ::1 > /dev/null + +wait + +set +e +cnt4=$(grep -c '^hw_protocol=0x0800 hook=0 hw_addrlen=6 hw_addr=00:00:00:00:00:00 mark=0 indev=1 prefix="test icmp " payload_len=84' "$out") +cnt6=$(grep -c '^hw_protocol=0x86dd hook=0 hw_addrlen=6 hw_addr=00:00:00:00:00:00 mark=0 indev=1 prefix="test icmp6 " payload_len=104' "$out") + +[ "$cnt4" -ne 4 ] && die "Expected 2 counts each for ipv4 and ipv6, got $cnt4, $cnt6" +[ "$cnt6" -ne 4 ] && die "Expected 2 counts each for ipv4 and ipv6, got $cnt4, $cnt6" + +echo "Completed, 4 log lines found for ipv4 and ipv6 each" -- 2.54.0