[CRIU] [PATCH 2/2] zdtm: nft tables preservation test

[Pavel Tikhomirov]

Reviewed-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

On 11/12/19 11:27 AM, Alexander Mikhalitsyn wrote:
> Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn at virtuozzo.com>
> Signed-off-by: Alexander Mikhalitsyn <alexander at mihalicyn.com>
> ---
>   test/zdtm/static/Makefile       |  1 +
>   test/zdtm/static/netns-nft.c    | 63 +++++++++++++++++++++++++++++++++
>   test/zdtm/static/netns-nft.desc |  5 +++
>   3 files changed, 69 insertions(+)
>   create mode 100644 test/zdtm/static/netns-nft.c
>   create mode 100644 test/zdtm/static/netns-nft.desc
> 
> diff --git a/test/zdtm/static/Makefile b/test/zdtm/static/Makefile
> index a38482f4..94cecc16 100644
> --- a/test/zdtm/static/Makefile
> +++ b/test/zdtm/static/Makefile
> @@ -286,6 +286,7 @@ TST_FILE	=				\
>   		file_locks07			\
>   		file_locks08			\
>   		netns-nf			\
> +		netns-nft				\
>   		maps_file_prot			\
>   		socket_close_data01		\
>   
> diff --git a/test/zdtm/static/netns-nft.c b/test/zdtm/static/netns-nft.c
> new file mode 100644
> index 00000000..8baaace4
> --- /dev/null
> +++ b/test/zdtm/static/netns-nft.c
> @@ -0,0 +1,63 @@
> +#include <string.h>
> +#include <unistd.h>
> +#include <stdlib.h>
> +#include <stdio.h>
> +
> +#include "zdtmtst.h"
> +
> +const char *test_doc	= "Check that nft rules (some) are kept";
> +
> +char *filename;
> +TEST_OPTION(filename, string, "file name", 1);
> +
> +int main(int argc, char **argv)
> +{
> +	char cmd[128];
> +
> +	test_init(argc, argv);
> +
> +	/* create nft table */
> +	if (system("nft add table inet netns-nft-zdtm-test")) {
> +		pr_perror("Can't create nft table");
> +		return -1;
> +	}
> +
> +	/* create input chain in table */
> +	if (system("nft add chain inet netns-nft-zdtm-test input { type filter hook input priority 0 \\; }")) {
> +		pr_perror("Can't create input chain in nft table");
> +		return -1;
> +	}
> +
> +	/* block ICMPv4 traffic */
> +	if (system("nft add rule inet netns-nft-zdtm-test input meta nfproto ipv4 icmp type { echo-request } reject")) {
> +		pr_perror("Can't set input rule");
> +		return -1;
> +	}
> +
> +	/* save resulting nft table */
> +	sprintf(cmd, "nft list table inet netns-nft-zdtm-test > pre-%s", filename);
> +	if (system(cmd)) {
> +		pr_perror("Can't get nft table");
> +		return -1;
> +	}
> +
> +	test_daemon();
> +	test_waitsig();
> +
> +	/* get nft table */
> +	sprintf(cmd, "nft list table inet netns-nft-zdtm-test > post-%s", filename);
> +	if (system(cmd)) {
> +		fail("Can't get nft table");
> +		return -1;
> +	}
> +
> +	/* compare nft table before/after c/r */
> +	sprintf(cmd, "diff pre-%s post-%s", filename, filename);
> +	if (system(cmd)) {
> +		fail("nft table differ");
> +		return -1;
> +	}
> +
> +	pass();
> +	return 0;
> +}
> diff --git a/test/zdtm/static/netns-nft.desc b/test/zdtm/static/netns-nft.desc
> new file mode 100644
> index 00000000..f53890a2
> --- /dev/null
> +++ b/test/zdtm/static/netns-nft.desc
> @@ -0,0 +1,5 @@
> +{   'deps': [   '/bin/sh',
> +                '/usr/sbin/nft',
> +                '/usr/bin/diff'],
> +    'flags': 'suid',
> +    'flavor': 'ns uns'}
> 

-- 
Best regards, Tikhomirov Pavel
Software Developer, Virtuozzo.