[PATCH libnflog] utils: add minimal nfnlog test case

Florian Westphal <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <[email protected]>
Check that nfulnl_test receives 4 log messages each for ping/ping6 packets.

Signed-off-by: Florian Westphal <[email protected]>
---
 Seems I forgot to send it, I have carried this locally for more than
 a month :-/

 utils/nfulnl_test.c  |  1 +
 utils/nfulnl_test.sh | 58 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100755 utils/nfulnl_test.sh

diff --git a/utils/nfulnl_test.c b/utils/nfulnl_test.c
index 4f29f1757c81..840c0bea3a86 100644
--- a/utils/nfulnl_test.c
+++ b/utils/nfulnl_test.c
@@ -121,6 +121,7 @@ int main(int argc, char **argv)
 
 		/* handle messages in just-received packet */
 		nflog_handle_packet(h, buf, rv);
+		fflush(stdout);
 	}
 
 	printf("unbinding from group 100\n");
diff --git a/utils/nfulnl_test.sh b/utils/nfulnl_test.sh
new file mode 100755
index 000000000000..b23ccab04bae
--- /dev/null
+++ b/utils/nfulnl_test.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# Configuration
+NFLOG_GROUP=0
+PING_COUNT=2
+out=""
+
+cleanup() {
+	rm -f "$out"
+}
+
+die() {
+	echo "$@"
+	exit 1
+}
+
+if [ "$1" = "" ]; then
+	# Re-execute in new network namespace
+	exec unshare -n -- "$0" "run"
+fi
+
+trap cleanup EXIT
+set -e
+out=$(mktemp)
+
+timeout 5 ./nfulnl_test > "$out" &
+
+# Create ruleset to log ICMP/ICMPv6
+nft -f - <<EOF
+table inet filter {
+	chain icmp-log {
+		type filter hook prerouting priority 0; policy accept;
+
+		meta l4proto icmp counter log group $NFLOG_GROUP prefix "test icmp "
+		meta l4proto ipv6-icmp counter log group $NFLOG_GROUP prefix "test icmp6 "
+	}
+}
+EOF
+
+# Ensure the namespace has loopback and can send traffic
+ip link set lo up
+
+sleep 1
+
+# Trigger ICMP echo requests to ourselves (127.0.0.1 and ::1)
+ping -q -c "$PING_COUNT" 127.0.0.1 > /dev/null
+ping6 -q -c "$PING_COUNT" ::1 > /dev/null
+
+wait
+
+set +e
+cnt4=$(grep -c '^hw_protocol=0x0800 hook=0 hw_addrlen=6 hw_addr=00:00:00:00:00:00 mark=0 indev=1 prefix="test icmp " payload_len=84' "$out")
+cnt6=$(grep -c '^hw_protocol=0x86dd hook=0 hw_addrlen=6 hw_addr=00:00:00:00:00:00 mark=0 indev=1 prefix="test icmp6 " payload_len=104' "$out")
+
+[ "$cnt4" -ne 4 ] && die "Expected 2 counts each for ipv4 and ipv6, got $cnt4, $cnt6"
+[ "$cnt6" -ne 4 ] && die "Expected 2 counts each for ipv4 and ipv6, got $cnt4, $cnt6"
+
+echo "Completed, 4 log lines found for ipv4 and ipv6 each"
-- 
2.54.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.