blob: 34c3b324b04b808e898276a1838e03d34e355d45 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
|
#!/bin/bash
msg_error() {
echo "E: $1 ..." >&2
exit 1
}
msg_warn() {
echo "W: $1" >&2
}
msg_info() {
echo "I: $1"
}
usage() {
echo " $0 [OPTIONS] [TESTS...]"
echo
echo "OPTIONS:"
echo " -h|--help : Print usage."
echo " -L|--list-tests : List test names and quit."
echo " -v : Sets VERBOSE=y. Specifying tests without \"--\" enables verbose mode."
echo " -g : Sets DUMPGEN=y."
echo " -V : Sets VALGRIND=y."
echo " -K : Sets KMEMLEAK=y."
echo " -- : Separate options from tests."
echo " [TESTS...] : Other options are treated as test names,"
echo " that is, executables that are run by the runner."
echo
echo "ENVIRONMENT VARIABLES:"
echo " NFT=<CMD> : Path to nft executable. Will be called as \`\$NFT [...]\` so"
echo " it can be a command with parameters. Note that in this mode quoting"
echo " does not work, so the usage is limited and the command cannot contain"
echo " spaces."
echo " VERBOSE=*|y : Enable verbose output."
echo " DUMPGEN=*|y : Regenerate dump files."
echo " VALGRIND=*|y : Run \$NFT in valgrind."
echo " KMEMLEAK=*|y : Check for kernel memleaks."
}
# Configuration
BASEDIR="$(dirname "$0")"
SRC_NFT="$BASEDIR/../../src/nft"
DIFF=$(which diff)
if [ "$(id -u)" != "0" ] ; then
msg_error "this requires root!"
fi
if [ "${1}" != "run" ]; then
if unshare -f -n true; then
unshare -n "${0}" run $@
exit $?
fi
msg_warn "cannot run in own namespace, connectivity might break"
fi
shift
VERBOSE="$VERBOSE"
DUMPGEN="$DUMPGEN"
VALGRIND="$VALGRIND"
KMEMLEAK="$KMEMLEAK"
DO_LIST_TESTS=
TESTS=()
while [ $# -gt 0 ] ; do
A="$1"
shift
case "$A" in
-v)
VERBOSE=y
;;
-g)
DUMPGEN=y
;;
-V)
VALGRIND=y
;;
-K)
KMEMLEAK=y
;;
-h|--help)
usage
exit 0
;;
-L|--list-tests)
DO_LIST_TESTS=y
;;
--)
TESTS+=( "$@" )
shift $#
;;
*)
# Any unrecognized option is treated as a test name, and also
# enable verbose tests.
TESTS+=( "$A" )
VERBOSE=y
;;
esac
done
find_tests() {
find "$1" -type f -executable | sort
}
if [ "${#TESTS[@]}" -eq 0 ] ; then
TESTS=( $(find_tests "$BASEDIR/testcases/") )
test "${#TESTS[@]}" -gt 0 || msg_error "Could not find tests"
fi
TESTSOLD=( "${TESTS[@]}" )
TESTS=()
for t in "${TESTSOLD[@]}" ; do
if [ -f "$t" -a -x "$t" ] ; then
TESTS+=( "$t" )
elif [ -d "$t" ] ; then
TESTS+=( $(find_tests "$t") )
else
msg_error "Unknown test \"$t\""
fi
done
if [ "$DO_LIST_TESTS" = y ] ; then
printf '%s\n' "${TESTS[@]}"
exit 0
fi
[ -z "$NFT" ] && NFT=$SRC_NFT
${NFT} > /dev/null 2>&1
ret=$?
if [ ${ret} -eq 126 ] || [ ${ret} -eq 127 ]; then
msg_error "cannot execute nft command: ${NFT}"
else
msg_info "using nft command: ${NFT}"
fi
MODPROBE="$(which modprobe)"
if [ ! -x "$MODPROBE" ] ; then
msg_error "no modprobe binary found"
fi
DIFF="$(which diff)"
if [ ! -x "$DIFF" ] ; then
DIFF=true
fi
kernel_cleanup() {
$NFT flush ruleset
$MODPROBE -raq \
nft_reject_ipv4 nft_reject_bridge nft_reject_ipv6 nft_reject \
nft_redir_ipv4 nft_redir_ipv6 nft_redir \
nft_dup_ipv4 nft_dup_ipv6 nft_dup nft_nat \
nft_masq_ipv4 nft_masq_ipv6 nft_masq \
nft_exthdr nft_payload nft_cmp nft_range \
nft_quota nft_queue nft_numgen nft_osf nft_socket nft_tproxy \
nft_meta nft_meta_bridge nft_counter nft_log nft_limit \
nft_fib nft_fib_ipv4 nft_fib_ipv6 nft_fib_inet \
nft_hash nft_ct nft_compat nft_rt nft_objref \
nft_set_hash nft_set_rbtree nft_set_bitmap \
nft_synproxy nft_connlimit \
nft_chain_nat \
nft_chain_route_ipv4 nft_chain_route_ipv6 \
nft_dup_netdev nft_fwd_netdev \
nft_reject nft_reject_inet nft_reject_netdev \
nf_tables_set nf_tables \
nf_flow_table nf_flow_table_ipv4 nf_flow_tables_ipv6 \
nf_flow_table_inet nft_flow_offload \
nft_xfrm
}
printscript() { # (cmd, tmpd)
cat <<EOF
#!/bin/bash
CMD="$1"
# note: valgrind man page warns about --log-file with --trace-children, the
# last child executed overwrites previous reports unless %p or %q is used.
# Since libtool wrapper calls exec but none of the iptables tools do, this is
# perfect for us as it effectively hides bash-related errors
valgrind --log-file=$2/valgrind.log --trace-children=yes \
--leak-check=full --show-leak-kinds=all \$CMD "\$@"
RC=\$?
# don't keep uninteresting logs
if grep -q 'no leaks are possible' $2/valgrind.log; then
rm $2/valgrind.log
else
mv $2/valgrind.log $2/valgrind_\$\$.log
fi
# drop logs for failing commands for now
[ \$RC -eq 0 ] || rm $2/valgrind_\$\$.log
exit \$RC
EOF
}
if [ "$VALGRIND" == "y" ]; then
tmpd=$(mktemp -d)
chmod 755 $tmpd
msg_info "writing valgrind logs to $tmpd"
printscript "$NFT" "$tmpd" >${tmpd}/nft
trap "rm ${tmpd}/nft" EXIT
chmod a+x ${tmpd}/nft
NFT="${tmpd}/nft"
fi
echo ""
ok=0
failed=0
taint=0
check_taint()
{
read taint_now < /proc/sys/kernel/tainted
if [ $taint -ne $taint_now ] ; then
msg_warn "[FAILED] kernel is tainted: $taint -> $taint_now"
fi
}
kmem_runs=0
kmemleak_found=0
check_kmemleak_force()
{
test -f /sys/kernel/debug/kmemleak || return 0
echo scan > /sys/kernel/debug/kmemleak
lines=$(grep "unreferenced object" /sys/kernel/debug/kmemleak | wc -l)
if [ $lines -ne $kmemleak_found ];then
msg_warn "[FAILED] kmemleak detected $lines memory leaks"
kmemleak_found=$lines
fi
if [ $lines -ne 0 ];then
return 1
fi
return 0
}
check_kmemleak()
{
test -f /sys/kernel/debug/kmemleak || return
if [ "$KMEMLEAK" == "y" ] ; then
check_kmemleak_force
return
fi
kmem_runs=$((kmem_runs + 1))
if [ $((kmem_runs % 30)) -eq 0 ]; then
# scan slows tests down quite a bit, hence
# do this only for every 30th test file by
# default.
check_kmemleak_force
fi
}
check_taint
for testfile in "${TESTS[@]}" ; do
read taint < /proc/sys/kernel/tainted
kernel_cleanup
msg_info "[EXECUTING] $testfile"
test_output=$(NFT="$NFT" DIFF=$DIFF ${testfile} 2>&1)
rc_got=$?
echo -en "\033[1A\033[K" # clean the [EXECUTING] foobar line
if [ "$rc_got" -eq 0 ] ; then
# check nft dump only for positive tests
dumppath="$(dirname ${testfile})/dumps"
dumpfile="${dumppath}/$(basename ${testfile}).nft"
rc_spec=0
if [ "$rc_got" -eq 0 ] && [ -f ${dumpfile} ]; then
test_output=$(${DIFF} -u ${dumpfile} <($NFT list ruleset) 2>&1)
rc_spec=$?
fi
if [ "$rc_spec" -eq 0 ]; then
msg_info "[OK] $testfile"
[ "$VERBOSE" == "y" ] && [ ! -z "$test_output" ] && echo "$test_output"
((ok++))
if [ "$DUMPGEN" == "y" ] && [ "$rc_got" == 0 ] && [ ! -f "${dumpfile}" ]; then
mkdir -p "${dumppath}"
$NFT list ruleset > "${dumpfile}"
fi
else
((failed++))
if [ "$VERBOSE" == "y" ] ; then
msg_warn "[DUMP FAIL] $testfile: dump diff detected"
[ ! -z "$test_output" ] && echo "$test_output"
else
msg_warn "[DUMP FAIL] $testfile"
fi
fi
else
((failed++))
if [ "$VERBOSE" == "y" ] ; then
msg_warn "[FAILED] $testfile: got $rc_got"
[ ! -z "$test_output" ] && echo "$test_output"
else
msg_warn "[FAILED] $testfile"
fi
fi
check_taint
check_kmemleak
done
echo ""
# kmemleak may report suspected leaks
# that get free'd after all, so always do
# a check after all test cases
# have completed and reset the counter
# so another warning gets emitted.
kmemleak_found=0
check_kmemleak_force
msg_info "results: [OK] $ok [FAILED] $failed [TOTAL] $((ok+failed))"
kernel_cleanup
[ "$failed" -eq 0 ]
|