Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-07-18 00:58:31 +00:00
Code Issues Projects Releases Wiki Activity

zdtm: add combined nftables/iptables netns-nft-ipt test

Browse source 
Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
This commit is contained in:
Alexander Mikhalitsyn 2021-04-20 17:26:08 +03:00 • committed by Andrei Vagin
parent 4696e61edb
commit ddefbbff16
3 changed files with 91 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
test/zdtm/static/Makefile
View file

@ -314,7 +314,8 @@ TST_FILE = \
file_locks07 \
file_locks08 \
netns-nf \
netns-nft \
netns-nft \
netns-nft-ipt \
maps_file_prot \
socket_close_data01 \
fifo_upon_unix_socket00 \

81
test/zdtm/static/netns-nft-ipt.c Normal file
View file

@ -0,0 +1,81 @@
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include "zdtmtst.h"
const char *test_doc = "Check that both nftables & iptables rules (some) are C/R properly";
const char *test_author = "Alexander Mikhalitsyn <alexander@mihalicyn.com>";
char *filename;
TEST_OPTION(filename, string, "file name", 1);
int main(int argc, char **argv)
{
char cmd[128];
test_init(argc, argv);
/* create nft table */
if (system("nft add table inet netns-nft-zdtm-test")) {
pr_perror("Can't create nft table");
return -1;
}
/* create input chain in table */
if (system("nft add chain inet netns-nft-zdtm-test input { type filter hook input priority 0 \\; }")) {
pr_perror("Can't create input chain in nft table");
return -1;
}
/* block ICMPv4 traffic */
if (system("nft add rule inet netns-nft-zdtm-test input meta nfproto ipv4 icmp type { echo-request } reject")) {
pr_perror("Can't set input rule");
return -1;
}
/* save resulting nft table */
sprintf(cmd, "nft list table inet netns-nft-zdtm-test > pre-%s", filename);
if (system(cmd)) {
pr_perror("Can't get nft table");
return -1;
}
if (system("iptables -A INPUT -t filter --protocol icmp -j DROP")) {
pr_perror("Can't set input rule");
return -1;
}
sprintf(cmd, "iptables -L >> pre-%s", filename);
if (system(cmd)) {
pr_perror("Can't save iptables");
return -1;
}
test_daemon();
test_waitsig();
/* get nft table */
sprintf(cmd, "nft list table inet netns-nft-zdtm-test > post-%s", filename);
if (system(cmd)) {
fail("Can't get nft table");
return -1;
}
sprintf(cmd, "iptables -L >> post-%s", filename);
if (system(cmd)) {
fail("Can't get iptables");
return -1;
}
/* compare nft table before/after c/r */
sprintf(cmd, "diff pre-%s post-%s", filename, filename);
if (system(cmd)) {
fail("nft table differ");
return -1;
}
pass();
return 0;
}

8
test/zdtm/static/netns-nft-ipt.desc Normal file
View file

@ -0,0 +1,8 @@
{ 'feature': 'nftables has_ipt_legacy',
'deps': [ '/bin/sh',
'/usr/sbin/nft',
'/sbin/iptables|/usr/sbin/iptables',
'/usr/lib64/xtables/libxt_standard.so|/usr/lib/iptables/libxt_standard.so|/lib/xtables/libxt_standard.so|/usr/lib/powerpc64le-linux-gnu/xtables/libxt_standard.so|/usr/lib/x86_64-linux-gnu/xtables/libxt_standard.so|/usr/lib/s390x-linux-gnu/xtables/libxt_standard.so|/usr/lib/xtables/libxt_standard.so|/usr/lib/aarch64-linux-gnu/xtables/libxt_standard.so',
'/usr/bin/diff'],
'flags': 'suid',
'flavor': 'ns uns'}