tools/testing/selftests/net/netfilter/nft_nat_zones.sh

Source file repositories/reference/linux-study-clean/tools/testing/selftests/net/netfilter/nft_nat_zones.sh

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/net/netfilter/nft_nat_zones.sh
Extension
.sh
Size
8590 bytes
Lines
266
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: tools
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

#!/bin/bash
#
# Test connection tracking zone and NAT source port reallocation support.
#

source lib.sh

# Don't increase too much, 2000 clients should work
# just fine but script can then take several minutes with
# KASAN/debug builds.
maxclients=100

have_socat=0
ret=0

[ "$KSFT_MACHINE_SLOW" = yes ] && maxclients=40
# client1---.
#            veth1-.
#                  |
#               NAT Gateway --veth0--> Server
#                  | |
#            veth2-' |
# client2---'        |
#  ....              |
# clientX----vethX---'

# All clients share identical IP address.
# NAT Gateway uses policy routing and conntrack zones to isolate client
# namespaces.  Each client connects to Server, each with colliding tuples:
#   clientsaddr:10000 -> serveraddr:dport
#   NAT Gateway is supposed to do port reallocation for each of the
#   connections.

v4gc1=$(sysctl -n net.ipv4.neigh.default.gc_thresh1 2>/dev/null)
v4gc2=$(sysctl -n net.ipv4.neigh.default.gc_thresh2 2>/dev/null)
v4gc3=$(sysctl -n net.ipv4.neigh.default.gc_thresh3 2>/dev/null)
v6gc1=$(sysctl -n net.ipv6.neigh.default.gc_thresh1 2>/dev/null)
v6gc2=$(sysctl -n net.ipv6.neigh.default.gc_thresh2 2>/dev/null)
v6gc3=$(sysctl -n net.ipv6.neigh.default.gc_thresh3 2>/dev/null)

cleanup()
{
	cleanup_all_ns

	sysctl -q net.ipv4.neigh.default.gc_thresh1="$v4gc1" 2>/dev/null
	sysctl -q net.ipv4.neigh.default.gc_thresh2="$v4gc2" 2>/dev/null
	sysctl -q net.ipv4.neigh.default.gc_thresh3="$v4gc3" 2>/dev/null
	sysctl -q net.ipv6.neigh.default.gc_thresh1="$v6gc1" 2>/dev/null
	sysctl -q net.ipv6.neigh.default.gc_thresh2="$v6gc2" 2>/dev/null
	sysctl -q net.ipv6.neigh.default.gc_thresh3="$v6gc3" 2>/dev/null
}

checktool "nft --version" echo "run test without nft tool"
checktool "conntrack -V" "run test without conntrack tool"

if socat -h >/dev/null 2>&1; then
	have_socat=1
fi

setup_ns gw srv

trap cleanup EXIT

ip link add veth0 netns "$gw" type veth peer name eth0 netns "$srv"
ip -net "$gw" link set veth0 up
ip -net "$srv" link set eth0 up

sysctl -q net.ipv6.neigh.default.gc_thresh1=512  2>/dev/null
sysctl -q net.ipv6.neigh.default.gc_thresh2=1024 2>/dev/null
sysctl -q net.ipv6.neigh.default.gc_thresh3=4096 2>/dev/null

Annotation

Implementation Notes