[PATCH bpf-next] selftests/bpf: s/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test

[PATCH bpf-next] selftests/bpf: s/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test

[Martin KaFai Lau]

From: Martin KaFai Lau <martin.lau@kernel.org>

The recent vm image in CI has reported error in selftests that use
the iptables command.  Manu Bretelle has pointed out the difference
in the recent vm image that the iptables is sym-linked to the iptables-nft.
With this knowledge,  I can also reproduce the CI error by manually running
with the 'iptables-nft'.

This patch is to replace the iptables command with iptables-legacy
to unblock the CI tests.

Cc: Manu Bretelle <chantra@meta.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
---
 tools/testing/selftests/bpf/prog_tests/bpf_nf.c       | 6 +++---
 tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
index 8a838ea8bdf3..c8ba4009e4ab 100644
--- a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
@@ -49,14 +49,14 @@ static int connect_to_server(int srv_fd)
 
 static void test_bpf_nf_ct(int mode)
 {
-	const char *iptables = "iptables -t raw %s PREROUTING -j CONNMARK --set-mark 42/0";
+	const char *iptables = "iptables-legacy -t raw %s PREROUTING -j CONNMARK --set-mark 42/0";
 	int srv_fd = -1, client_fd = -1, srv_client_fd = -1;
 	struct sockaddr_in peer_addr = {};
 	struct test_bpf_nf *skel;
 	int prog_fd, err;
 	socklen_t len;
 	u16 srv_port;
-	char cmd[64];
+	char cmd[128];
 	LIBBPF_OPTS(bpf_test_run_opts, topts,
 		.data_in = &pkt_v4,
 		.data_size_in = sizeof(pkt_v4),
@@ -69,7 +69,7 @@ static void test_bpf_nf_ct(int mode)
 
 	/* Enable connection tracking */
 	snprintf(cmd, sizeof(cmd), iptables, "-A");
-	if (!ASSERT_OK(system(cmd), "iptables"))
+	if (!ASSERT_OK(system(cmd), cmd))
 		goto end;
 
 	srv_port = (mode == TEST_XDP) ? 5005 : 5006;
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c b/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
index 75550a40e029..c72083885b6d 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
@@ -94,12 +94,12 @@ static void test_synproxy(bool xdp)
 	SYS("sysctl -w net.ipv4.tcp_syncookies=2");
 	SYS("sysctl -w net.ipv4.tcp_timestamps=1");
 	SYS("sysctl -w net.netfilter.nf_conntrack_tcp_loose=0");
-	SYS("iptables -t raw -I PREROUTING \
+	SYS("iptables-legacy -t raw -I PREROUTING \
 	    -i tmp1 -p tcp -m tcp --syn --dport 8080 -j CT --notrack");
-	SYS("iptables -t filter -A INPUT \
+	SYS("iptables-legacy -t filter -A INPUT \
 	    -i tmp1 -p tcp -m tcp --dport 8080 -m state --state INVALID,UNTRACKED \
 	    -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460");
-	SYS("iptables -t filter -A INPUT \
+	SYS("iptables-legacy -t filter -A INPUT \
 	    -i tmp1 -m state --state INVALID -j DROP");
 
 	ctrl_file = SYS_OUT("./xdp_synproxy --iface tmp1 --ports 8080 \
-- 
2.30.2

Re: [PATCH bpf-next] selftests/bpf: s/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test

[David Vernet]

On Wed, Oct 12, 2022 at 03:12:35PM -0700, Martin KaFai Lau wrote:
> From: Martin KaFai Lau <martin.lau@kernel.org>
> 
> The recent vm image in CI has reported error in selftests that use
> the iptables command.  Manu Bretelle has pointed out the difference
> in the recent vm image that the iptables is sym-linked to the iptables-nft.
> With this knowledge,  I can also reproduce the CI error by manually running
> with the 'iptables-nft'.
> 
> This patch is to replace the iptables command with iptables-legacy
> to unblock the CI tests.
> 
> Cc: Manu Bretelle <chantra@meta.com>
> Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

LGTM, thanks for fixing this.

Acked-by: David Vernet <void@manifault.com>

Re: [PATCH bpf-next] selftests/bpf: s/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Wed, 12 Oct 2022 15:12:35 -0700 you wrote:
> From: Martin KaFai Lau <martin.lau@kernel.org>
> 
> The recent vm image in CI has reported error in selftests that use
> the iptables command.  Manu Bretelle has pointed out the difference
> in the recent vm image that the iptables is sym-linked to the iptables-nft.
> With this knowledge,  I can also reproduce the CI error by manually running
> with the 'iptables-nft'.
> 
> [...]

Here is the summary with links:
  - [bpf-next] selftests/bpf: s/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test
    https://git.kernel.org/bpf/bpf-next/c/de9c8d848d90

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html