diff options
| author | Florian Westphal <fw@strlen.de> | 2026-10-07 01:04:59 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-10-18 02:35:05 +0200 |
| commit | a20a01ae89813ef493dc416d69f2b2ad17afb54c (patch) | |
| tree | 5e0500ddcb7cbfeafb39e446eb80a04f398414d3 /tools/testing | |
| parent | d7c4b903f349c1e910e377c9e306b1a789ba03a8 (diff) | |
selftests: netfilter: fix return value in zone subtest
zone subtest prints FAIL, but did not set 'ret=1', so kselftest
framework reports success.
While at it, also fail when "nft -f" returns an error.
Noticed thanks to a (broken) local patch that should have caused this
selftest (resp. the kselftest framework) to report a failure.
Fixes: 33b8aad21ac1 ("selftests: netfilter: add a vrf+conntrack testcase")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/testing')
| -rwxr-xr-x | tools/testing/selftests/net/netfilter/conntrack_vrf.sh | 25 |
1 files changed, 22 insertions, 3 deletions
diff --git a/tools/testing/selftests/net/netfilter/conntrack_vrf.sh b/tools/testing/selftests/net/netfilter/conntrack_vrf.sh index 207b79932d91..2dbfabaadf4b 100755 --- a/tools/testing/selftests/net/netfilter/conntrack_vrf.sh +++ b/tools/testing/selftests/net/netfilter/conntrack_vrf.sh @@ -84,7 +84,7 @@ busywait $BUSYWAIT_TIMEOUT listener_ready "$ns1" # as decided by the first iteration of the ruleset. test_ct_zone_in() { -ip netns exec "$ns0" nft -f - <<EOF +if ! ip netns exec "$ns0" nft -f - <<EOF table testct { chain rawpre { type filter hook prerouting priority raw; @@ -105,6 +105,12 @@ table testct { } } EOF + then + echo "FAIL: cannot load testct nft ruleset" + ret=1 + return + fi + ip netns exec "$ns1" ping -W 1 -c 1 -I veth0 "$IP0" > /dev/null # should be in zone 1, not zone 2 @@ -113,6 +119,7 @@ EOF echo "PASS: entry found in conntrack zone 1" else echo "FAIL: entry not found in conntrack zone 1" + ret=1 count=$(ip netns exec "$ns0" conntrack -L -s $IP1 -d $IP0 -p icmp --zone 2 2> /dev/null | wc -l) if [ "$count" -eq 1 ]; then echo "FAIL: entry found in zone 2 instead" @@ -137,7 +144,7 @@ test_masquerade_vrf() ip netns exec "$ns0" conntrack -F 2>/dev/null -ip netns exec "$ns0" nft -f - <<EOF +if ! ip netns exec "$ns0" nft -f - <<EOF flush ruleset table ip nat { chain rawout { @@ -158,6 +165,12 @@ table ip nat { } } EOF + then + echo "FAIL: cannot load ip nat nft ruleset" + ret=1 + return + fi + if ! ip netns exec "$ns0" ip vrf exec tvrf socat -u -4 STDIN TCP:"$IP1":55555 < /dev/null > /dev/null;then echo "FAIL: connect failure with masquerade + sport rewrite on vrf device" ret=1 @@ -184,7 +197,7 @@ EOF test_masquerade_veth() { ip netns exec "$ns0" conntrack -F 2>/dev/null -ip netns exec "$ns0" nft -f - <<EOF +if ! ip netns exec "$ns0" nft -f - <<EOF flush ruleset table ip nat { chain postrouting { @@ -193,6 +206,12 @@ table ip nat { } } EOF + then + echo "FAIL: cannot load ip nat postrouting ruleset" + ret=1 + return + fi + if ! ip netns exec "$ns0" ip vrf exec tvrf socat -u -4 STDIN TCP:"$IP1":55555 < /dev/null > /dev/null;then echo "FAIL: connect failure with masquerade + sport rewrite on veth device" ret=1 |