Introduce test for recently added jump limit functionality. Tests
sysctl behavior with regard to netns, as well as calling user_ns.
Signed-off-by: Shaun Brady <brady.1345@xxxxxxxxx>
---
.../testing/selftests/net/netfilter/Makefile | 1 +
.../netfilter/nft_max_table_jumps_netns.sh | 227 ++++++++++++++++++
2 files changed, 228 insertions(+)
create mode 100755 tools/testing/selftests/net/netfilter/nft_max_table_jumps_netns.sh
diff --git a/tools/testing/selftests/net/netfilter/Makefile b/tools/testing/selftests/net/netfilter/Makefile
index ffe161fac8b5..bc7df8feb0f7 100644
--- a/tools/testing/selftests/net/netfilter/Makefile
+++ b/tools/testing/selftests/net/netfilter/Makefile
@@ -23,6 +23,7 @@ TEST_PROGS += nft_concat_range.sh
TEST_PROGS += nft_conntrack_helper.sh
TEST_PROGS += nft_fib.sh
TEST_PROGS += nft_flowtable.sh
+TEST_PROGS += nft_max_table_jumps_netns.sh
TEST_PROGS += nft_meta.sh
TEST_PROGS += nft_nat.sh
TEST_PROGS += nft_nat_zones.sh
diff --git a/tools/testing/selftests/net/netfilter/nft_max_table_jumps_netns.sh b/tools/testing/selftests/net/netfilter/nft_max_table_jumps_netns.sh
new file mode 100755
index 000000000000..9dedd45f4fd2
--- /dev/null
+++ b/tools/testing/selftests/net/netfilter/nft_max_table_jumps_netns.sh
@@ -0,0 +1,227 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# A test script for nf_max_table_jumps_netns limit sysctl
+#
+source lib.sh
+
+DEFAULT_SYSCTL=65536
+
+user_owned_netns="a_user_owned_netns"
+
+cleanup() {
+ ip netns del $user_owned_netns 2>/dev/null || true
+}
+
+trap cleanup EXIT
+
+init_net_value=$(sysctl -n net.netfilter.nf_max_table_jumps_netns)
+
+# Check that init ns inits to default value
+if [ "$init_net_value" -ne "$DEFAULT_SYSCTL" ];then
+ echo "Fail: Does not init default value"
+ exit 1
+fi
+
+# Set to extremely small, demonstrate CAN exceed value
+sysctl -w net.netfilter.nf_max_table_jumps_netns=32 2>&1 >/dev/null
+new_value=$(sysctl -n net.netfilter.nf_max_table_jumps_netns)
+if [ "$new_value" -ne "32" ];then
+ echo "Fail: Set value not respected"
+ exit 1
+fi
+
+nft -f - <<EOF
+table inet loop-test {
+ chain test0 {
+ type filter hook input priority filter; policy accept;
+ jump test1
+ jump test1
+ }
+
+ chain test1 {
+ jump test2
+ jump test2
+ }
+
+ chain test2 {
+ jump test3
+ tcp dport 8080 drop
+ tcp dport 8080 drop
+ }
+
+ chain test3 {
+ jump test4
+ }
+
+ chain test4 {
+ jump test5
+ }
+
+ chain test5 {
+ jump test6
+ }
+
+ chain test6 {
+ jump test7
+ }
+
+ chain test7 {
+ jump test8
+ }
+
+ chain test8 {
+ jump test9
+ }
+
+ chain test9 {
+ jump test10
+ }
+
+ chain test10 {
+ jump test11
+ }
+
+ chain test11 {
+ jump test12
+ }
+
+ chain test12 {
+ jump test13
+ }
+
+ chain test13 {
+ jump test14
+ }
+
+ chain test14 {
+ jump test15
+ jump test15
+ }
+
+ chain test15 {
+ }
+}
+EOF
+
+if [ $? -ne 0 ];then
+ echo "Fail: limit not exceeded when expected"
+ exit 1
+fi
+
+nft flush ruleset
+
+# reset to default
+sysctl -w net.netfilter.nf_max_table_jumps_netns=$DEFAULT_SYSCTL 2>&1 >/dev/null
+
+# Make init_user_ns owned netns, can change value, limit is applied
+ip netns add $user_owned_netns
+ip netns exec $user_owned_netns sysctl -qw net.netfilter.nf_max_table_jumps_netns=32 2>&1
+if [ $? -ne 0 ];then
+ echo "Fail: Can't change value in init_user_ns owned namespace"
+ exit 1
+fi
+
+ip netns exec $user_owned_netns \
+nft -f - 2>&1 <<EOF
+table inet loop-test {
+ chain test0 {
+ type filter hook input priority filter; policy accept;
+ jump test1
+ jump test1
+ }
+
+ chain test1 {
+ jump test2
+ jump test2
+ }
+
+ chain test2 {
+ jump test3
+ tcp dport 8080 drop
+ tcp dport 8080 drop
+ }
+
+ chain test3 {
+ jump test4
+ }
+
+ chain test4 {
+ jump test5
+ }
+
+ chain test5 {
+ jump test6
+ }
+
+ chain test6 {
+ jump test7
+ }
+
+ chain test7 {
+ jump test8
+ }
+
+ chain test8 {
+ jump test9
+ }
+
+ chain test9 {
+ jump test10
+ }
+
+ chain test10 {
+ jump test11
+ }
+
+ chain test11 {
+ jump test12
+ }
+
+ chain test12 {
+ jump test13
+ }
+
+ chain test13 {
+ jump test14
+ }
+
+ chain test14 {
+ jump test15
+ jump test15
+ }
+
+ chain test15 {
+ }
+}
+EOF
+
+if [ $? -eq 0 ];then
+ echo "Fail: Limited incorrectly applied"
+ exit 1
+fi
+ip netns del $user_owned_netns
+
+# Previously set value does not impact root namespace; check value from before
+new_value=$(sysctl -n net.netfilter.nf_max_table_jumps_netns)
+if [ "$new_value" -ne "$DEFAULT_SYSCTL" ];then
+ echo "Fail: Non-init namespace altered init namespace"
+ exit 1
+fi
+
+# Make non-init_user_ns owned netns, can not change value
+unshare -Un sysctl -w net.netfilter.nf_max_table_jumps_netns=1234 2>&1
+if [ $? -ne 0 ];then
+ echo "Fail: Error message incorrect when non-user-init"
+ exit 1
+fi
+
+# Double check user namespace can still see limit
+new_value=(unshare -Un sysctl -n net.netfilter.nf_max_table_jumps_netns)
+if [ "$new_value" -ne "$DEFAULT_SYSCTL" ];then
+ echo "Fail: Unexpected failure when non-user-init"
+ exit 1
+fi
+
+
+exit 0
--
2.49.0
