[PATCH nf] selftests: netfilter: disable rp_filter on router

[PATCH nf] selftests: netfilter: disable rp_filter on router

[Hangbin Liu]

Some distros may enalbe rp_filter by default. After ns1 change addr to
10.0.2.99 and set default router to 10.0.2.1, while the connected router
address is still 10.0.1.1. The router will not reply the arp request
from ns1. Fix it by setting the router's veth0 rp_filter to 0.

Before the fix:
  # ./nft_fib.sh
  PASS: fib expression did not cause unwanted packet drops
  Netns nsrouter-HQkDORO2 fib counter doesn't match expected packet count of 1 for 1.1.1.1
  table inet filter {
          chain prerouting {
                  type filter hook prerouting priority filter; policy accept;
                  ip daddr 1.1.1.1 fib saddr . iif oif missing counter packets 0 bytes 0 drop
                  ip6 daddr 1c3::c01d fib saddr . iif oif missing counter packets 0 bytes 0 drop
          }
  }

After the fix:
  # ./nft_fib.sh
  PASS: fib expression did not cause unwanted packet drops
  PASS: fib expression did drop packets for 1.1.1.1
  PASS: fib expression did drop packets for 1c3::c01d

Fixes: 82944421243e ("selftests: netfilter: add fib test case")
Signed-off-by: Yi Chen <yiche@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
 tools/testing/selftests/netfilter/nft_fib.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/testing/selftests/netfilter/nft_fib.sh b/tools/testing/selftests/netfilter/nft_fib.sh
index 6caf6ac8c285..22c7feff8d48 100755
--- a/tools/testing/selftests/netfilter/nft_fib.sh
+++ b/tools/testing/selftests/netfilter/nft_fib.sh
@@ -174,6 +174,8 @@ test_ping() {
 ip netns exec ${nsrouter} sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
 ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
 ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.rp_filter=0 > /dev/null
+ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.rp_filter=0 > /dev/null
 
 sleep 3
 
-- 
2.31.1

Re: [PATCH nf] selftests: netfilter: disable rp_filter on router

[Hangbin Liu]

Hi Pablo, Florian,
On Thu, Feb 10, 2022 at 11:32:05AM +0800, Hangbin Liu wrote:
> +ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.rp_filter=0 > /dev/null
> +ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.rp_filter=0 > /dev/null

Oh, disable rp_filter on veth0 is enough for the current testing. But for the
format and maybe a preparation for future testing. Disable veth1 rp_filter
should also be OK. If you think there is no need to do this on veth1.
I can send a v2 patch.

Thanks
Hangbin

Re: [PATCH nf] selftests: netfilter: disable rp_filter on router

[Pablo Neira Ayuso]

On Thu, Feb 10, 2022 at 11:32:05AM +0800, Hangbin Liu wrote:
> Some distros may enalbe rp_filter by default. After ns1 change addr to
> 10.0.2.99 and set default router to 10.0.2.1, while the connected router
> address is still 10.0.1.1. The router will not reply the arp request
> from ns1. Fix it by setting the router's veth0 rp_filter to 0.
> 
> Before the fix:
>   # ./nft_fib.sh
>   PASS: fib expression did not cause unwanted packet drops
>   Netns nsrouter-HQkDORO2 fib counter doesn't match expected packet count of 1 for 1.1.1.1
>   table inet filter {
>           chain prerouting {
>                   type filter hook prerouting priority filter; policy accept;
>                   ip daddr 1.1.1.1 fib saddr . iif oif missing counter packets 0 bytes 0 drop
>                   ip6 daddr 1c3::c01d fib saddr . iif oif missing counter packets 0 bytes 0 drop
>           }
>   }
> 
> After the fix:
>   # ./nft_fib.sh
>   PASS: fib expression did not cause unwanted packet drops
>   PASS: fib expression did drop packets for 1.1.1.1
>   PASS: fib expression did drop packets for 1c3::c01d

Applied

Re: [PATCH nf] selftests: netfilter: disable rp_filter on router

[Pablo Neira Ayuso]

On Thu, Feb 10, 2022 at 04:46:28PM +0800, Hangbin Liu wrote:
> Hi Pablo, Florian,
> On Thu, Feb 10, 2022 at 11:32:05AM +0800, Hangbin Liu wrote:
> > +ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.rp_filter=0 > /dev/null
> > +ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.rp_filter=0 > /dev/null
> 
> Oh, disable rp_filter on veth0 is enough for the current testing. But for the
> format and maybe a preparation for future testing. Disable veth1 rp_filter
> should also be OK. If you think there is no need to do this on veth1.
> I can send a v2 patch.

Send v2, I'll toss v1 patch.

Thanks.