* [iptables PATCH] tests: iptables-test: Support variant deviation
@ 2022-02-04 17:55 Phil Sutter
2022-02-09 14:11 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Phil Sutter @ 2022-02-04 17:55 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
Some test results are not consistent between variants:
* CLUSTERIP is not supported with nft_compat, so all related tests fail
with iptables-nft.
* iptables-legacy mandates TCPMSS be combined with SYN flag match,
iptables-nft does not care. (Or precisely, xt_TCPMSS.ko can't validate
match presence.)
Avoid the expected failures by allowing "NFT" and "LGC" outcomes in
addition to "OK" and "FAIL". They specify the variant with which given
test should pass.
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
extensions/libipt_CLUSTERIP.t | 4 ++--
extensions/libxt_TCPMSS.t | 2 +-
iptables-test.py | 7 +++++--
3 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/extensions/libipt_CLUSTERIP.t b/extensions/libipt_CLUSTERIP.t
index 5af555e005c1d..d3a2d6cbb1b2e 100644
--- a/extensions/libipt_CLUSTERIP.t
+++ b/extensions/libipt_CLUSTERIP.t
@@ -1,4 +1,4 @@
:INPUT
-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 0 --hash-init 1;=;FAIL
--d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK
--d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;OK
+-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;LGC
+-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;LGC
diff --git a/extensions/libxt_TCPMSS.t b/extensions/libxt_TCPMSS.t
index 553a3452e4876..c3ee2de880826 100644
--- a/extensions/libxt_TCPMSS.t
+++ b/extensions/libxt_TCPMSS.t
@@ -1,6 +1,6 @@
:FORWARD,OUTPUT,POSTROUTING
*mangle
-j TCPMSS;;FAIL
--p tcp -j TCPMSS --set-mss 42;;FAIL
+-p tcp -j TCPMSS --set-mss 42;;NFT
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 42;=;OK
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --clamp-mss-to-pmtu;=;OK
diff --git a/iptables-test.py b/iptables-test.py
index 95fa11b1475ca..be1b1a94decf4 100755
--- a/iptables-test.py
+++ b/iptables-test.py
@@ -91,8 +91,11 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
#
# report failed test
#
+ should_pass = (res == "OK") or \
+ (res == "NFT" and EXECUTABLE == "xtables-nft-multi") or \
+ (res == "LGC" and EXECUTABLE == "xtables-legacy-multi")
if ret:
- if res == "OK":
+ if should_pass:
reason = "cannot load: " + cmd
print_error(reason, filename, lineno)
return -1
@@ -100,7 +103,7 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
# do not report this error
return 0
else:
- if res == "FAIL":
+ if not should_pass:
reason = "should fail: " + cmd
print_error(reason, filename, lineno)
delete_rule(iptables, rule, filename, lineno)
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [iptables PATCH] tests: iptables-test: Support variant deviation
2022-02-04 17:55 [iptables PATCH] tests: iptables-test: Support variant deviation Phil Sutter
@ 2022-02-09 14:11 ` Pablo Neira Ayuso
2022-02-09 14:22 ` Phil Sutter
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-02-09 14:11 UTC (permalink / raw)
To: Phil Sutter; +Cc: netfilter-devel
On Fri, Feb 04, 2022 at 06:55:20PM +0100, Phil Sutter wrote:
> Some test results are not consistent between variants:
>
> * CLUSTERIP is not supported with nft_compat, so all related tests fail
> with iptables-nft.
> * iptables-legacy mandates TCPMSS be combined with SYN flag match,
> iptables-nft does not care. (Or precisely, xt_TCPMSS.ko can't validate
> match presence.)
>
> Avoid the expected failures by allowing "NFT" and "LGC" outcomes in
> addition to "OK" and "FAIL". They specify the variant with which given
> test should pass.
>
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
> extensions/libipt_CLUSTERIP.t | 4 ++--
> extensions/libxt_TCPMSS.t | 2 +-
> iptables-test.py | 7 +++++--
> 3 files changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/extensions/libipt_CLUSTERIP.t b/extensions/libipt_CLUSTERIP.t
> index 5af555e005c1d..d3a2d6cbb1b2e 100644
> --- a/extensions/libipt_CLUSTERIP.t
> +++ b/extensions/libipt_CLUSTERIP.t
> @@ -1,4 +1,4 @@
> :INPUT
> -d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 0 --hash-init 1;=;FAIL
> --d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK
Could you add a new semicolon to the test line instead?
--d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK;LEGACY
> --d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;OK
> +-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;LGC
> +-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;LGC
Thanks
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [iptables PATCH] tests: iptables-test: Support variant deviation
2022-02-09 14:11 ` Pablo Neira Ayuso
@ 2022-02-09 14:22 ` Phil Sutter
0 siblings, 0 replies; 3+ messages in thread
From: Phil Sutter @ 2022-02-09 14:22 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On Wed, Feb 09, 2022 at 03:11:42PM +0100, Pablo Neira Ayuso wrote:
> On Fri, Feb 04, 2022 at 06:55:20PM +0100, Phil Sutter wrote:
> > Some test results are not consistent between variants:
> >
> > * CLUSTERIP is not supported with nft_compat, so all related tests fail
> > with iptables-nft.
> > * iptables-legacy mandates TCPMSS be combined with SYN flag match,
> > iptables-nft does not care. (Or precisely, xt_TCPMSS.ko can't validate
> > match presence.)
> >
> > Avoid the expected failures by allowing "NFT" and "LGC" outcomes in
> > addition to "OK" and "FAIL". They specify the variant with which given
> > test should pass.
> >
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> > extensions/libipt_CLUSTERIP.t | 4 ++--
> > extensions/libxt_TCPMSS.t | 2 +-
> > iptables-test.py | 7 +++++--
> > 3 files changed, 8 insertions(+), 5 deletions(-)
> >
> > diff --git a/extensions/libipt_CLUSTERIP.t b/extensions/libipt_CLUSTERIP.t
> > index 5af555e005c1d..d3a2d6cbb1b2e 100644
> > --- a/extensions/libipt_CLUSTERIP.t
> > +++ b/extensions/libipt_CLUSTERIP.t
> > @@ -1,4 +1,4 @@
> > :INPUT
> > -d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 0 --hash-init 1;=;FAIL
> > --d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK
>
> Could you add a new semicolon to the test line instead?
>
> --d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK;LEGACY
Sure, will do. It means we'll have semantical aliases:
- ...;OK;LEGAY == ...;FAIL;NFT
- ...;OK:NFT == ...;FAIL;LEGACY
Not a real issue, though.
Thanks, Phil
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-02-09 14:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-04 17:55 [iptables PATCH] tests: iptables-test: Support variant deviation Phil Sutter
2022-02-09 14:11 ` Pablo Neira Ayuso
2022-02-09 14:22 ` Phil Sutter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.