lkml.org 
[lkml]   [2018]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 22/89] selftests: add script to stress-test nft packet path vs. control plane
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 25d8bcedbf4329895dbaf9dd67baa6f18dad918c ]

    Start flood ping for each cpu while loading/flushing rulesets to make
    sure we do not access already-free'd rules from nf_tables evaluation loop.

    Also add this to TARGETS so 'make run_tests' in selftest dir runs it
    automatically.

    This would have caught the bug fixed in previous change
    ("netfilter: nf_tables: do not skip inactive chains during generation update")
    sooner.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    tools/testing/selftests/Makefile | 1 +
    tools/testing/selftests/netfilter/Makefile | 6 ++
    tools/testing/selftests/netfilter/config | 2 +
    .../selftests/netfilter/nft_trans_stress.sh | 78 +++++++++++++++++++
    4 files changed, 87 insertions(+)
    create mode 100644 tools/testing/selftests/netfilter/Makefile
    create mode 100644 tools/testing/selftests/netfilter/config
    create mode 100755 tools/testing/selftests/netfilter/nft_trans_stress.sh

    diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
    index ea300e7818a7..10b89f5b9af7 100644
    --- a/tools/testing/selftests/Makefile
    +++ b/tools/testing/selftests/Makefile
    @@ -20,6 +20,7 @@ TARGETS += memory-hotplug
    TARGETS += mount
    TARGETS += mqueue
    TARGETS += net
    +TARGETS += netfilter
    TARGETS += nsfs
    TARGETS += powerpc
    TARGETS += pstore
    diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
    new file mode 100644
    index 000000000000..47ed6cef93fb
    --- /dev/null
    +++ b/tools/testing/selftests/netfilter/Makefile
    @@ -0,0 +1,6 @@
    +# SPDX-License-Identifier: GPL-2.0
    +# Makefile for netfilter selftests
    +
    +TEST_PROGS := nft_trans_stress.sh
    +
    +include ../lib.mk
    diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
    new file mode 100644
    index 000000000000..1017313e41a8
    --- /dev/null
    +++ b/tools/testing/selftests/netfilter/config
    @@ -0,0 +1,2 @@
    +CONFIG_NET_NS=y
    +NF_TABLES_INET=y
    diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
    new file mode 100755
    index 000000000000..f1affd12c4b1
    --- /dev/null
    +++ b/tools/testing/selftests/netfilter/nft_trans_stress.sh
    @@ -0,0 +1,78 @@
    +#!/bin/bash
    +#
    +# This test is for stress-testing the nf_tables config plane path vs.
    +# packet path processing: Make sure we never release rules that are
    +# still visible to other cpus.
    +#
    +# set -e
    +
    +# Kselftest framework requirement - SKIP code is 4.
    +ksft_skip=4
    +
    +testns=testns1
    +tables="foo bar baz quux"
    +
    +nft --version > /dev/null 2>&1
    +if [ $? -ne 0 ];then
    + echo "SKIP: Could not run test without nft tool"
    + exit $ksft_skip
    +fi
    +
    +ip -Version > /dev/null 2>&1
    +if [ $? -ne 0 ];then
    + echo "SKIP: Could not run test without ip tool"
    + exit $ksft_skip
    +fi
    +
    +tmp=$(mktemp)
    +
    +for table in $tables; do
    + echo add table inet "$table" >> "$tmp"
    + echo flush table inet "$table" >> "$tmp"
    +
    + echo "add chain inet $table INPUT { type filter hook input priority 0; }" >> "$tmp"
    + echo "add chain inet $table OUTPUT { type filter hook output priority 0; }" >> "$tmp"
    + for c in $(seq 1 400); do
    + chain=$(printf "chain%03u" "$c")
    + echo "add chain inet $table $chain" >> "$tmp"
    + done
    +
    + for c in $(seq 1 400); do
    + chain=$(printf "chain%03u" "$c")
    + for BASE in INPUT OUTPUT; do
    + echo "add rule inet $table $BASE counter jump $chain" >> "$tmp"
    + done
    + echo "add rule inet $table $chain counter return" >> "$tmp"
    + done
    +done
    +
    +ip netns add "$testns"
    +ip -netns "$testns" link set lo up
    +
    +lscpu | grep ^CPU\(s\): | ( read cpu cpunum ;
    +cpunum=$((cpunum-1))
    +for i in $(seq 0 $cpunum);do
    + mask=$(printf 0x%x $((1<<$i)))
    + ip netns exec "$testns" taskset $mask ping -4 127.0.0.1 -fq > /dev/null &
    + ip netns exec "$testns" taskset $mask ping -6 ::1 -fq > /dev/null &
    +done)
    +
    +sleep 1
    +
    +for i in $(seq 1 10) ; do ip netns exec "$testns" nft -f "$tmp" & done
    +
    +for table in $tables;do
    + randsleep=$((RANDOM%10))
    + sleep $randsleep
    + ip netns exec "$testns" nft delete table inet $table 2>/dev/null
    +done
    +
    +randsleep=$((RANDOM%10))
    +sleep $randsleep
    +
    +pkill -9 ping
    +
    +wait
    +
    +rm -f "$tmp"
    +ip netns del "$testns"
    --
    2.19.1


    \
     
     \ /
      Last update: 2018-12-14 13:10    [W:4.111 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site