tools/testing/selftests/net/netfilter/nft_fib.sh

Source file repositories/reference/linux-study-clean/tools/testing/selftests/net/netfilter/nft_fib.sh

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/net/netfilter/nft_fib.sh
Extension
.sh
Size
23882 bytes
Lines
851
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: tools
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

#!/bin/bash
#
# This tests the fib expression.
#
# Kselftest framework requirement - SKIP code is 4.
#
#  10.0.1.99     10.0.1.1           10.0.2.1         10.0.2.99
# dead:1::99    dead:1::1          dead:2::1        dead:2::99
# ns1 <-------> [ veth0 ] nsrouter [veth1] <-------> ns2

source lib.sh

ret=0

timeout=4

log_netns=$(sysctl -n net.netfilter.nf_log_all_netns)

cleanup()
{
	cleanup_all_ns

	[ "$log_netns" -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns=$log_netns
}

checktool "nft --version" "run test without nft"

setup_ns nsrouter ns1 ns2

trap cleanup EXIT

if dmesg | grep -q ' nft_rpfilter: ';then
	dmesg -c | grep ' nft_rpfilter: '
	echo "WARN: a previous test run has failed" 1>&2
fi

sysctl -q net.netfilter.nf_log_all_netns=1

load_ruleset() {
	local netns=$1

ip netns exec "$netns" nft -f /dev/stdin <<EOF
table inet filter {
	chain prerouting {
		type filter hook prerouting priority 0; policy accept;
	        fib saddr . iif oif missing counter log prefix "$netns nft_rpfilter: " drop
	}
}
EOF
}

load_input_ruleset() {
	local netns=$1

ip netns exec "$netns" nft -f /dev/stdin <<EOF
table inet filter {
	chain input {
		type filter hook input priority 0; policy accept;
	        fib saddr . iif oif missing counter log prefix "$netns nft_rpfilter: " drop
	}
}
EOF
}

load_pbr_ruleset() {
	local netns=$1

ip netns exec "$netns" nft -f /dev/stdin <<EOF
table inet filter {
	chain forward {

Annotation

Implementation Notes