Skip to content

Commit a8a388c

Browse files
Florian Westphalummakynes
Florian Westphal
authored and
ummakynes
committed
selftests: netfilter: add packetdrill based conntrack tests
Add a new test script that uses packetdrill tool to exercise conntrack state machine. Needs ip/ip6tables and conntrack tool (to check if we have an entry in the expected state). Test cases added here cover following scenarios: 1. already-acked (retransmitted) packets are not tagged as INVALID 2. RST packet coming when conntrack is already closing (FIN/CLOSE_WAIT) transitions conntrack to CLOSE even if the RST is not an exact match 3. RST packets with out-of-window sequence numbers are marked as INVALID 4. SYN+Challenge ACK: check that challenge ack is allowed to pass 5. Old SYN/ACK: check conntrack handles the case where SYN is answered with SYN/ACK for an old, previous connection attempt 6. Check SYN reception while in ESTABLISHED state generates a challenge ack, RST response clears 'outdated' state + next SYN retransmit gets us into 'SYN_RECV' conntrack state. Tests get run twice, once with ipv4 and once with ipv6. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent 532aec7 commit a8a388c

File tree

10 files changed

+475
-0
lines changed

10 files changed

+475
-0
lines changed

‎tools/testing/selftests/net/netfilter/Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ TEST_PROGS += conntrack_tcp_unreplied.sh
1313
TEST_PROGS += conntrack_sctp_collision.sh
1414
TEST_PROGS += conntrack_vrf.sh
1515
TEST_PROGS += ipvs.sh
16+
TEST_PROGS += nf_conntrack_packetdrill.sh
1617
TEST_PROGS += nf_nat_edemux.sh
1718
TEST_PROGS += nft_audit.sh
1819
TEST_PROGS += nft_concat_range.sh
@@ -45,6 +46,7 @@ $(OUTPUT)/conntrack_dump_flush: CFLAGS += $(MNL_CFLAGS)
4546
$(OUTPUT)/conntrack_dump_flush: LDLIBS += $(MNL_LDLIBS)
4647

4748
TEST_FILES := lib.sh
49+
TEST_FILES += packetdrill
4850

4951
TEST_INCLUDES := \
5052
../lib.sh

‎tools/testing/selftests/net/netfilter/config‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,4 @@ CONFIG_VLAN_8021Q=m
8686
CONFIG_XFRM_USER=m
8787
CONFIG_XFRM_STATISTICS=y
8888
CONFIG_NET_PKTGEN=m
89+
CONFIG_TUN=m

‎tools/testing/selftests/net/netfilter/nf_conntrack_packetdrill.sh‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/bin/bash
2+
# SPDX-License-Identifier: GPL-2.0
3+
4+
source lib.sh
5+
6+
checktool "conntrack --version" "run test without conntrack"
7+
checktool "iptables --version" "run test without iptables"
8+
checktool "ip6tables --version" "run test without ip6tables"
9+
10+
modprobe -q tun
11+
modprobe -q nf_conntrack
12+
# echo 1 > /proc/sys/net/netfilter/nf_log_all_netns
13+
14+
PDRILL_TIMEOUT=10
15+
16+
files="
17+
conntrack_ack_loss_stall.pkt
18+
conntrack_inexact_rst.pkt
19+
conntrack_syn_challenge_ack.pkt
20+
conntrack_synack_old.pkt
21+
conntrack_synack_reuse.pkt
22+
conntrack_rst_invalid.pkt
23+
"
24+
25+
if ! packetdrill --dry_run --verbose "packetdrill/conntrack_ack_loss_stall.pkt";then
26+
echo "SKIP: packetdrill not installed"
27+
exit ${ksft_skip}
28+
fi
29+
30+
ret=0
31+
32+
run_packetdrill()
33+
{
34+
filename="$1"
35+
ipver="$2"
36+
local mtu=1500
37+
38+
export NFCT_IP_VERSION="$ipver"
39+
40+
if [ "$ipver" = "ipv4" ];then
41+
export xtables="iptables"
42+
elif [ "$ipver" = "ipv6" ];then
43+
export xtables="ip6tables"
44+
mtu=1520
45+
fi
46+
47+
timeout "$PDRILL_TIMEOUT" unshare -n packetdrill --ip_version="$ipver" --mtu=$mtu \
48+
--tolerance_usecs=1000000 --non_fatal packet "$filename"
49+
}
50+
51+
run_one_test_file()
52+
{
53+
filename="$1"
54+
55+
for v in ipv4 ipv6;do
56+
printf "%-50s(%s)%-20s" "$filename" "$v" ""
57+
if run_packetdrill packetdrill/"$f" "$v";then
58+
echo OK
59+
else
60+
echo FAIL
61+
ret=1
62+
fi
63+
done
64+
}
65+
66+
echo "Replaying packetdrill test cases:"
67+
for f in $files;do
68+
run_one_test_file packetdrill/"$f"
69+
done
70+
71+
exit $ret

‎tools/testing/selftests/net/netfilter/packetdrill/common.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
# SPDX-License-Identifier: GPL-2.0
3+
4+
# for debugging set net.netfilter.nf_log_all_netns=1 in init_net
5+
# or do not use net namespaces.
6+
modprobe -q nf_conntrack
7+
sysctl -q net.netfilter.nf_conntrack_log_invalid=6
8+
9+
# Flush old cached data (fastopen cookies).
10+
ip tcp_metrics flush all > /dev/null 2>&1
11+
12+
# TCP min, default, and max receive and send buffer sizes.
13+
sysctl -q net.ipv4.tcp_rmem="4096 540000 $((15*1024*1024))"
14+
sysctl -q net.ipv4.tcp_wmem="4096 $((256*1024)) 4194304"
15+
16+
# TCP congestion control.
17+
sysctl -q net.ipv4.tcp_congestion_control=cubic
18+
19+
# TCP slow start after idle.
20+
sysctl -q net.ipv4.tcp_slow_start_after_idle=0
21+
22+
# TCP Explicit Congestion Notification (ECN)
23+
sysctl -q net.ipv4.tcp_ecn=0
24+
25+
sysctl -q net.ipv4.tcp_notsent_lowat=4294967295 > /dev/null 2>&1
26+
27+
# Override the default qdisc on the tun device.
28+
# Many tests fail with timing errors if the default
29+
# is FQ and that paces their flows.
30+
tc qdisc add dev tun0 root pfifo
31+
32+
# Enable conntrack
33+
$xtables -A INPUT -m conntrack --ctstate NEW -p tcp --syn

‎tools/testing/selftests/net/netfilter/packetdrill/conntrack_ack_loss_stall.pkt‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
// check that already-acked (retransmitted) packet is let through rather
2+
// than tagged as INVALID.
3+
4+
`packetdrill/common.sh`
5+
6+
// should set -P DROP but it disconnects VM w.o. extra netns
7+
+0 `$xtables -A INPUT -m conntrack --ctstate INVALID -j DROP`
8+
9+
+0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
10+
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
11+
+0 bind(3, ..., ...) = 0
12+
+0 listen(3, 10) = 0
13+
14+
+0 < S 0:0(0) win 32792 <mss 1000>
15+
+0 > S. 0:0(0) ack 1 <mss 1460>
16+
+.01 < . 1:1(0) ack 1 win 65535
17+
+0 accept(3, ..., ...) = 4
18+
19+
+0.0001 < P. 1:1461(1460) ack 1 win 257
20+
+.0 > . 1:1(0) ack 1461 win 65535
21+
+0.0001 < P. 1461:2921(1460) ack 1 win 257
22+
+.0 > . 1:1(0) ack 2921 win 65535
23+
+0.0001 < P. 2921:4381(1460) ack 1 win 257
24+
+.0 > . 1:1(0) ack 4381 win 65535
25+
+0.0001 < P. 4381:5841(1460) ack 1 win 257
26+
+.0 > . 1:1(0) ack 5841 win 65535
27+
+0.0001 < P. 5841:7301(1460) ack 1 win 257
28+
+.0 > . 1:1(0) ack 7301 win 65535
29+
+0.0001 < P. 7301:8761(1460) ack 1 win 257
30+
+.0 > . 1:1(0) ack 8761 win 65535
31+
+0.0001 < P. 8761:10221(1460) ack 1 win 257
32+
+.0 > . 1:1(0) ack 10221 win 65535
33+
+0.0001 < P. 10221:11681(1460) ack 1 win 257
34+
+.0 > . 1:1(0) ack 11681 win 65535
35+
+0.0001 < P. 11681:13141(1460) ack 1 win 257
36+
+.0 > . 1:1(0) ack 13141 win 65535
37+
+0.0001 < P. 13141:14601(1460) ack 1 win 257
38+
+.0 > . 1:1(0) ack 14601 win 65535
39+
+0.0001 < P. 14601:16061(1460) ack 1 win 257
40+
+.0 > . 1:1(0) ack 16061 win 65535
41+
+0.0001 < P. 16061:17521(1460) ack 1 win 257
42+
+.0 > . 1:1(0) ack 17521 win 65535
43+
+0.0001 < P. 17521:18981(1460) ack 1 win 257
44+
+.0 > . 1:1(0) ack 18981 win 65535
45+
+0.0001 < P. 18981:20441(1460) ack 1 win 257
46+
+.0 > . 1:1(0) ack 20441 win 65535
47+
+0.0001 < P. 20441:21901(1460) ack 1 win 257
48+
+.0 > . 1:1(0) ack 21901 win 65535
49+
+0.0001 < P. 21901:23361(1460) ack 1 win 257
50+
+.0 > . 1:1(0) ack 23361 win 65535
51+
+0.0001 < P. 23361:24821(1460) ack 1 win 257
52+
0.055 > . 1:1(0) ack 24821 win 65535
53+
+0.0001 < P. 24821:26281(1460) ack 1 win 257
54+
+.0 > . 1:1(0) ack 26281 win 65535
55+
+0.0001 < P. 26281:27741(1460) ack 1 win 257
56+
+.0 > . 1:1(0) ack 27741 win 65535
57+
+0.0001 < P. 27741:29201(1460) ack 1 win 257
58+
+.0 > . 1:1(0) ack 29201 win 65535
59+
+0.0001 < P. 29201:30661(1460) ack 1 win 257
60+
+.0 > . 1:1(0) ack 30661 win 65535
61+
+0.0001 < P. 30661:32121(1460) ack 1 win 257
62+
+.0 > . 1:1(0) ack 32121 win 65535
63+
+0.0001 < P. 32121:33581(1460) ack 1 win 257
64+
+.0 > . 1:1(0) ack 33581 win 65535
65+
+0.0001 < P. 33581:35041(1460) ack 1 win 257
66+
+.0 > . 1:1(0) ack 35041 win 65535
67+
+0.0001 < P. 35041:36501(1460) ack 1 win 257
68+
+.0 > . 1:1(0) ack 36501 win 65535
69+
+0.0001 < P. 36501:37961(1460) ack 1 win 257
70+
+.0 > . 1:1(0) ack 37961 win 65535
71+
+0.0001 < P. 37961:39421(1460) ack 1 win 257
72+
+.0 > . 1:1(0) ack 39421 win 65535
73+
+0.0001 < P. 39421:40881(1460) ack 1 win 257
74+
+.0 > . 1:1(0) ack 40881 win 65535
75+
+0.0001 < P. 40881:42341(1460) ack 1 win 257
76+
+.0 > . 1:1(0) ack 42341 win 65535
77+
+0.0001 < P. 42341:43801(1460) ack 1 win 257
78+
+.0 > . 1:1(0) ack 43801 win 65535
79+
+0.0001 < P. 43801:45261(1460) ack 1 win 257
80+
+.0 > . 1:1(0) ack 45261 win 65535
81+
+0.0001 < P. 45261:46721(1460) ack 1 win 257
82+
+.0 > . 1:1(0) ack 46721 win 65535
83+
+0.0001 < P. 46721:48181(1460) ack 1 win 257
84+
+.0 > . 1:1(0) ack 48181 win 65535
85+
+0.0001 < P. 48181:49641(1460) ack 1 win 257
86+
+.0 > . 1:1(0) ack 49641 win 65535
87+
+0.0001 < P. 49641:51101(1460) ack 1 win 257
88+
+.0 > . 1:1(0) ack 51101 win 65535
89+
+0.0001 < P. 51101:52561(1460) ack 1 win 257
90+
+.0 > . 1:1(0) ack 52561 win 65535
91+
+0.0001 < P. 52561:54021(1460) ack 1 win 257
92+
+.0 > . 1:1(0) ack 54021 win 65535
93+
+0.0001 < P. 54021:55481(1460) ack 1 win 257
94+
+.0 > . 1:1(0) ack 55481 win 65535
95+
+0.0001 < P. 55481:56941(1460) ack 1 win 257
96+
+.0 > . 1:1(0) ack 56941 win 65535
97+
+0.0001 < P. 56941:58401(1460) ack 1 win 257
98+
+.0 > . 1:1(0) ack 58401 win 65535
99+
+0.0001 < P. 58401:59861(1460) ack 1 win 257
100+
+.0 > . 1:1(0) ack 59861 win 65535
101+
+0.0001 < P. 59861:61321(1460) ack 1 win 257
102+
+.0 > . 1:1(0) ack 61321 win 65535
103+
+0.0001 < P. 61321:62781(1460) ack 1 win 257
104+
+.0 > . 1:1(0) ack 62781 win 65535
105+
+0.0001 < P. 62781:64241(1460) ack 1 win 257
106+
+.0 > . 1:1(0) ack 64241 win 65535
107+
+0.0001 < P. 64241:65701(1460) ack 1 win 257
108+
+.0 > . 1:1(0) ack 65701 win 65535
109+
+0.0001 < P. 65701:67161(1460) ack 1 win 257
110+
+.0 > . 1:1(0) ack 67161 win 65535
111+
112+
// nf_ct_proto_6: SEQ is under the lower bound (already ACKed data retransmitted) IN=tun0 OUT= MAC= SRC=192.0.2.1 DST=192.168.24.72 LEN=1500 TOS=0x00 PREC=0x00 TTL=255 ID=0 PROTO=TCP SPT=34375 DPT=8080 SEQ=1 ACK=4162510439 WINDOW=257 RES=0x00 ACK PSH URGP=0
113+
+0.0001 < P. 1:1461(1460) ack 1 win 257
114+
115+
// only sent if above packet isn't flagged as invalid
116+
+.0 > . 1:1(0) ack 67161 win 65535
117+
118+
+0 `$xtables -D INPUT -m conntrack --ctstate INVALID -j DROP`

‎tools/testing/selftests/net/netfilter/packetdrill/conntrack_inexact_rst.pkt‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// check RST packet that doesn't exactly match expected next sequence
2+
// number still transitions conntrack state to CLOSE iff its already in
3+
// FIN/CLOSE_WAIT.
4+
5+
`packetdrill/common.sh`
6+
7+
// 5.771921 server_ip > client_ip TLSv1.2 337 [Packet size limited during capture]
8+
// 5.771994 server_ip > client_ip TLSv1.2 337 [Packet size limited during capture]
9+
// 5.772212 client_ip > server_ip TCP 66 45020 > 443 [ACK] Seq=1905874048 Ack=781810658 Win=36352 Len=0 TSval=3317842872 TSecr=675936334
10+
// 5.787924 server_ip > client_ip TLSv1.2 1300 [Packet size limited during capture]
11+
// 5.788126 server_ip > client_ip TLSv1.2 90 Application Data
12+
// 5.788207 server_ip > client_ip TCP 66 443 > 45020 [FIN, ACK] Seq=781811916 Ack=1905874048 Win=31104 Len=0 TSval=675936350 TSecr=3317842872
13+
// 5.788447 client_ip > server_ip TLSv1.2 90 Application Data
14+
// 5.788479 client_ip > server_ip TCP 66 45020 > 443 [RST, ACK] Seq=1905874072 Ack=781811917 Win=39040 Len=0 TSval=3317842889 TSecr=675936350
15+
// 5.788581 server_ip > client_ip TCP 54 8443 > 45020 [RST] Seq=781811892 Win=0 Len=0
16+
17+
+0 `iptables -A INPUT -p tcp -m conntrack --ctstate INVALID -j DROP`
18+
+0 `iptables -A OUTPUT -p tcp -m conntrack --ctstate INVALID -j DROP`
19+
20+
+0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
21+
+0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
22+
23+
0.1 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress)
24+
25+
0.1 > S 0:0(0) win 65535 <mss 1460,sackOK,TS val 1 ecr 0,nop,wscale 8>
26+
27+
+0.1 < S. 1:1(0) ack 1 win 65535 <mss 1460>
28+
29+
+0 > . 1:1(0) ack 1 win 65535
30+
+0 < . 1:1001(1000) ack 1 win 65535
31+
+0 < . 1001:2001(1000) ack 1 win 65535
32+
+0 < . 2001:3001(1000) ack 1 win 65535
33+
34+
+0 > . 1:1(0) ack 1001 win 65535
35+
+0 > . 1:1(0) ack 2001 win 65535
36+
+0 > . 1:1(0) ack 3001 win 65535
37+
38+
+0 write(3, ..., 1000) = 1000
39+
40+
+0.0 > P. 1:1001(1000) ack 3001 win 65535
41+
42+
+0.1 read(3, ..., 1000) = 1000
43+
44+
// Conntrack should move to FIN_WAIT, then CLOSE_WAIT.
45+
+0 < F. 3001:3001(0) ack 1001 win 65535
46+
+0 > . 1001:1001(0) ack 3002 win 65535
47+
48+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q CLOSE_WAIT`
49+
50+
+1 close(3) = 0
51+
// RST: unread data. FIN was seen, hence ack + 1
52+
+0 > R. 1001:1001(0) ack 3002 win 65535
53+
// ... and then, CLOSE.
54+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q CLOSE\ `
55+
56+
// Spurious RST from peer -- no sk state. Should NOT get
57+
// marked INVALID, because conntrack is already closing.
58+
+0.1 < R 2001:2001(0) win 0
59+
60+
// No packets should have been marked INVALID
61+
+0 `iptables -v -S INPUT | grep INVALID | grep -q -- "-c 0 0"`
62+
+0 `iptables -v -S OUTPUT | grep INVALID | grep -q -- "-c 0 0"`

‎tools/testing/selftests/net/netfilter/packetdrill/conntrack_rst_invalid.pkt‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
// check that out of window resets are marked as INVALID and conntrack remains
2+
// in ESTABLISHED state.
3+
4+
`packetdrill/common.sh`
5+
6+
+0 `$xtables -A INPUT -p tcp -m conntrack --ctstate INVALID -j DROP`
7+
+0 `$xtables -A OUTPUT -p tcp -m conntrack --ctstate INVALID -j DROP`
8+
9+
+0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
10+
+0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
11+
12+
0.1 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress)
13+
14+
0.1 > S 0:0(0) win 65535 <mss 1460,sackOK,TS val 1 ecr 0,nop,wscale 8>
15+
16+
+0.1 < S. 1:1(0) ack 1 win 65535 <mss 1460>
17+
18+
+0 > . 1:1(0) ack 1 win 65535
19+
+0 < . 1:1001(1000) ack 1 win 65535
20+
+0 < . 1001:2001(1000) ack 1 win 65535
21+
+0 < . 2001:3001(1000) ack 1 win 65535
22+
23+
+0 > . 1:1(0) ack 1001 win 65535
24+
+0 > . 1:1(0) ack 2001 win 65535
25+
+0 > . 1:1(0) ack 3001 win 65535
26+
27+
+0 write(3, ..., 1000) = 1000
28+
29+
// out of window
30+
+0.0 < R 0:0(0) win 0
31+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q ESTABLISHED`
32+
33+
// out of window
34+
+0.0 < R 1000000:1000000(0) win 0
35+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q ESTABLISHED`
36+
37+
// in-window but not exact match
38+
+0.0 < R 42:42(0) win 0
39+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q ESTABLISHED`
40+
41+
+0.0 > P. 1:1001(1000) ack 3001 win 65535
42+
43+
+0.1 read(3, ..., 1000) = 1000
44+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q ESTABLISHED`
45+
46+
+0 < . 3001:3001(0) ack 1001 win 65535
47+
48+
+0.0 < R. 3000:3000(0) ack 1001 win 0
49+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q ESTABLISHED`
50+
51+
// exact next sequence
52+
+0.0 < R. 3001:3001(0) ack 1001 win 0
53+
// Conntrack should move to CLOSE
54+
55+
// Expect four invalid RSTs
56+
+0 `$xtables -v -S INPUT | grep INVALID | grep -q -- "-c 4 "`
57+
+0 `$xtables -v -S OUTPUT | grep INVALID | grep -q -- "-c 0 0"`
58+
59+
+0 `conntrack -f $NFCT_IP_VERSION -L -p tcp --dport 8080 2>/dev/null |grep -q CLOSE\ `

0 commit comments

Comments
 (0)