[PATCH testsuite] tests/inet_socket: make kernel iptables support optional

[PATCH testsuite] tests/inet_socket: make kernel iptables support optional

[Ondrej Mosnacek]

The legacy iptables API is being deprecated in favor of netfilter and
some distributions are starting to disable it in their kernels (e.g.
Fedora ELN, RHEL 10+). To allow getting a clean run of the testsuite on
such kernels, detect the availability of the ip_tables kernel module and
skip the iptables tests if it's not available (either as a loadable
module or built in).

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
 tests/inet_socket/test | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/tests/inet_socket/test b/tests/inet_socket/test
index 56a947b..f09b4e3 100755
--- a/tests/inet_socket/test
+++ b/tests/inet_socket/test
@@ -5,7 +5,7 @@ BEGIN {
     $basedir = $0;
     $basedir =~ s|(.*)/[^/]*|$1|;
 
-    $test_count = 38;
+    $test_count = 30;
 
     $test_ipsec = 0;
     if ( system("ip xfrm policy help 2>&1 | grep -q ctx") eq 0 ) {
@@ -27,6 +27,15 @@ BEGIN {
         $test_calipso_stream = 1;
     }
 
+    # Determine if kernel has legacy iptables support
+    $test_iptables = 0;
+
+    $rc = system("modprobe ip_tables 2>/dev/null");
+    if ( $rc == 0 ) {
+        $test_count += 8;
+        $test_iptables = 1;
+    }
+
     # Determine if nftables has secmark support
     $test_nft = 0;
 
@@ -415,10 +424,12 @@ sub test_tables {
     server_end($pid);
 }
 
-print "Testing iptables (IPv4/IPv6).\n";
-system "/bin/sh $basedir/iptables-load";
-test_tables();
-system "/bin/sh $basedir/iptables-flush";
+if ($test_iptables) {
+    print "Testing iptables (IPv4/IPv6).\n";
+    system "/bin/sh $basedir/iptables-load";
+    test_tables();
+    system "/bin/sh $basedir/iptables-flush";
+}
 
 if ($test_nft) {
     print "Testing nftables (IPv4/IPv6).\n";
-- 
2.31.1

Re: [PATCH testsuite] tests/inet_socket: make kernel iptables support optional

[Ondrej Mosnacek]

On Mon, Oct 25, 2021 at 2:48 PM Ondrej Mosnacek <omosnace@redhat.com> wrote:
> The legacy iptables API is being deprecated in favor of netfilter and
> some distributions are starting to disable it in their kernels (e.g.
> Fedora ELN, RHEL 10+). To allow getting a clean run of the testsuite on
> such kernels, detect the availability of the ip_tables kernel module and
> skip the iptables tests if it's not available (either as a loadable
> module or built in).
>
> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
> ---
>  tests/inet_socket/test | 21 ++++++++++++++++-----
>  1 file changed, 16 insertions(+), 5 deletions(-)

Actually, I missed there are similar iptables/nftables tests under
tests/sctp as well... I'll need to respin this.

-- 
Ondrej Mosnacek
Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.