linux/tools
Peilin Ye f6071e5e39 selftests/fib_tests: Rework fib_rp_filter_test()
Currently rp_filter tests in fib_tests.sh:fib_rp_filter_test() are
failing.  ping sockets are bound to dummy1 using the "-I" option
(SO_BINDTODEVICE), but socket lookup is failing when receiving ping
replies, since the routing table thinks they belong to dummy0.

For example, suppose ping is using a SOCK_RAW socket for ICMP messages.
When receiving ping replies, in __raw_v4_lookup(), sk->sk_bound_dev_if
is 3 (dummy1), but dif (skb_rtable(skb)->rt_iif) says 2 (dummy0), so the
raw_sk_bound_dev_eq() check fails.  Similar things happen in
ping_lookup() for SOCK_DGRAM sockets.

These tests used to pass due to a bug [1] in iputils, where "ping -I"
actually did not bind ICMP message sockets to device.  The bug has been
fixed by iputils commit f455fee41c07 ("ping: also bind the ICMP socket
to the specific device") in 2016, which is why our rp_filter tests
started to fail.  See [2] .

Fixing the tests while keeping everything in one netns turns out to be
nontrivial.  Rework the tests and build the following topology:

 ┌─────────────────────────────┐    ┌─────────────────────────────┐
 │  network namespace 1 (ns1)  │    │  network namespace 2 (ns2)  │
 │                             │    │                             │
 │  ┌────┐     ┌─────┐         │    │  ┌─────┐            ┌────┐  │
 │  │ lo │<───>│veth1│<────────┼────┼─>│veth2│<──────────>│ lo │  │
 │  └────┘     ├─────┴──────┐  │    │  ├─────┴──────┐     └────┘  │
 │             │192.0.2.1/24│  │    │  │192.0.2.1/24│             │
 │             └────────────┘  │    │  └────────────┘             │
 └─────────────────────────────┘    └─────────────────────────────┘

Consider sending an ICMP_ECHO packet A in ns2.  Both source and
destination IP addresses are 192.0.2.1, and we use strict mode rp_filter
in both ns1 and ns2:

  1. A is routed to lo since its destination IP address is one of ns2's
     local addresses (veth2);
  2. A is redirected from lo's egress to veth2's egress using mirred;
  3. A arrives at veth1's ingress in ns1;
  4. A is redirected from veth1's ingress to lo's ingress, again, using
     mirred;
  5. In __fib_validate_source(), fib_info_nh_uses_dev() returns false,
     since A was received on lo, but reverse path lookup says veth1;
  6. However A is not dropped since we have relaxed this check for lo in
     commit 66f8209547 ("fib: relax source validation check for loopback
     packets");

Making sure A is not dropped here in this corner case is the whole point
of having this test.

  7. As A reaches the ICMP layer, an ICMP_ECHOREPLY packet, B, is
     generated;
  8. Similarly, B is redirected from lo's egress to veth1's egress (in
     ns1), then redirected once again from veth2's ingress to lo's
     ingress (in ns2), using mirred.

Also test "ping 127.0.0.1" from ns2.  It does not trigger the relaxed
check in __fib_validate_source(), but just to make sure the topology
works with loopback addresses.

Tested with ping from iputils 20210722-41-gf9fb573:

$ ./fib_tests.sh -t rp_filter

IPv4 rp_filter tests
    TEST: rp_filter passes local packets		[ OK ]
    TEST: rp_filter passes loopback packets		[ OK ]

[1] https://github.com/iputils/iputils/issues/55
[2] f455fee41c

Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Fixes: adb701d6cf ("selftests: add a test case for rp_filter")
Reviewed-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
Acked-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20211201004720.6357-1-yepeilin.cs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-12-02 17:59:34 -08:00
..
accounting
arch tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources 2021-11-18 10:08:07 -03:00
bootconfig bootconfig: Cleanup dummy headers in tools/bootconfig 2021-10-10 22:16:02 -04:00
bpf tools/runqslower: Fix cross-build 2021-11-12 17:23:16 -08:00
build tools build: Fix removal of feature-sync-compare-and-swap feature detection 2021-11-18 10:08:07 -03:00
cgroup
counter tools/counter: Create Counter tools 2021-10-17 10:54:16 +01:00
debugging
edid
firewire
firmware
gpio
hv
iio
include tools: Fix math.h breakage 2021-11-30 09:14:42 -08:00
io_uring tools/io_uring/io_uring-cp: sync with liburing example 2021-08-13 08:58:11 -06:00
kvm/kvm_stat KVM: kvm_stat: do not show halt_wait_ns 2021-10-18 14:07:18 -04:00
laptop
leds
lib Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2021-11-16 16:53:48 -08:00
memory-model tools/memory-model: Document data_race(READ_ONCE()) 2021-07-27 11:48:55 -07:00
objtool static_call,x86: Robustify trampoline patching 2021-11-11 13:09:31 +01:00
pci tools: PCI: Zero-initialize param 2021-08-05 11:01:30 +01:00
pcmcia
perf perf evsel: Fix memory leaks relating to unit 2021-11-18 10:19:14 -03:00
power
rcu tools/rcu: Add an extract-stall script 2021-09-16 10:31:26 -07:00
scripts tools, build: Add RISC-V to HOSTARCH parsing 2021-11-01 17:08:21 +01:00
spi
testing selftests/fib_tests: Rework fib_rp_filter_test() 2021-12-02 17:59:34 -08:00
thermal/tmon tools/thermal/tmon: Add cross compiling support 2021-08-14 15:33:19 +02:00
time
tracing tools/latency-collector: Use correct size when writing queue_full_warning 2021-10-25 22:27:19 -04:00
usb usb: testusb: Fix for showing the connection speed 2021-09-14 10:31:41 +02:00
virtio tools/virtio: fix build 2021-08-11 06:44:24 -04:00
vm tools/vm/page-types.c: print file offset in hexadecimal 2021-11-06 13:30:40 -07:00
wmi
Makefile tools/lib/lockdep: drop liblockdep 2021-11-12 11:07:17 -08:00