tools/testing/selftests/net/netfilter/nft_flowtable.sh

Source file repositories/reference/linux-study-clean/tools/testing/selftests/net/netfilter/nft_flowtable.sh

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/net/netfilter/nft_flowtable.sh
Extension
.sh
Size
25064 bytes
Lines
863
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: tools
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# This tests basic flowtable functionality.
# Creates following default topology:
#
# Originator (MTU 9000) <-Router1-> MTU 1500 <-Router2-> Responder (MTU 2000)
# Router1 is the one doing flow offloading, Router2 has no special
# purpose other than having a link that is smaller than either Originator
# and responder, i.e. TCPMSS announced values are too large and will still
# result in fragmentation and/or PMTU discovery.
#
# You can check with different Orgininator/Link/Responder MTU eg:
# nft_flowtable.sh -o8000 -l1500 -r2000
#

source lib.sh

ret=0
SOCAT_TIMEOUT=60

nsin=""
nsin_small=""
ns1out=""
ns2out=""

log_netns=$(sysctl -n net.netfilter.nf_log_all_netns)

checktool "nft --version" "run test without nft tool"
checktool "socat -h" "run test without socat"

setup_ns ns1 ns2 nsr1 nsr2

cleanup() {
	ip netns pids "$ns1" | xargs kill 2>/dev/null
	ip netns pids "$ns2" | xargs kill 2>/dev/null

	cleanup_all_ns

	rm -f "$nsin" "$nsin_small" "$ns1out" "$ns2out"

	[ "$log_netns" -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns="$log_netns"
}

trap cleanup EXIT

sysctl -q net.netfilter.nf_log_all_netns=1

ip link add veth0 netns "$nsr1" type veth peer name eth0 netns "$ns1"
ip link add veth1 netns "$nsr1" type veth peer name veth0 netns "$nsr2"

ip link add veth1 netns "$nsr2" type veth peer name eth0 netns "$ns2"

for dev in veth0 veth1; do
    ip -net "$nsr1" link set "$dev" up
    ip -net "$nsr2" link set "$dev" up
done

ip -net "$nsr1" addr add 10.0.1.1/24 dev veth0
ip -net "$nsr1" addr add dead:1::1/64 dev veth0 nodad

ip -net "$nsr2" addr add 10.0.2.1/24 dev veth1
ip -net "$nsr2" addr add dead:2::1/64 dev veth1 nodad

# set different MTUs so we need to push packets coming from ns1 (large MTU)
# to ns2 (smaller MTU) to stack either to perform fragmentation (ip_no_pmtu_disc=1),
# or to do PTMU discovery (send ICMP error back to originator).
# ns2 is going via nsr2 with a smaller mtu, so that TCPMSS announced by both peers
# is NOT the lowest link mtu.

Annotation

Implementation Notes