[CRIU] [PATCHv2 2/2] zdtm: nft tables preservation test

[Alexander Mikhalitsyn]

Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn at virtuozzo.com>
Signed-off-by: Alexander Mikhalitsyn <alexander at mihalicyn.com>
---
 scripts/build/Dockerfile.alpine      |  1 +
 scripts/build/Dockerfile.centos      |  1 +
 scripts/build/Dockerfile.fedora.tmpl |  1 +
 scripts/travis/travis-tests          |  2 +-
 test/zdtm/static/Makefile            |  1 +
 test/zdtm/static/netns-nft.c         | 63 ++++++++++++++++++++++++++++
 test/zdtm/static/netns-nft.checkskip |  3 ++
 test/zdtm/static/netns-nft.desc      |  5 +++
 8 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 test/zdtm/static/netns-nft.c
 create mode 100755 test/zdtm/static/netns-nft.checkskip
 create mode 100644 test/zdtm/static/netns-nft.desc

diff --git a/scripts/build/Dockerfile.alpine b/scripts/build/Dockerfile.alpine
index 70fdf480..125b684e 100644
--- a/scripts/build/Dockerfile.alpine
+++ b/scripts/build/Dockerfile.alpine
@@ -32,6 +32,7 @@ RUN apk add \
 	py2-future \
 	ip6tables \
 	iptables \
+	nftables \
 	iproute2 \
 	tar \
 	bash \
diff --git a/scripts/build/Dockerfile.centos b/scripts/build/Dockerfile.centos
index 213be694..baa9e019 100644
--- a/scripts/build/Dockerfile.centos
+++ b/scripts/build/Dockerfile.centos
@@ -12,6 +12,7 @@ RUN yum install -y \
 	gnutls-devel \
 	iproute \
 	iptables \
+	nftables \
 	libaio-devel \
 	libasan \
 	libcap-devel \
diff --git a/scripts/build/Dockerfile.fedora.tmpl b/scripts/build/Dockerfile.fedora.tmpl
index 0500a8fc..9d442724 100644
--- a/scripts/build/Dockerfile.fedora.tmpl
+++ b/scripts/build/Dockerfile.fedora.tmpl
@@ -10,6 +10,7 @@ RUN dnf install -y \
 	gnutls-devel \
 	iproute \
 	iptables \
+	nftables \
 	libaio-devel \
 	libasan \
 	libcap-devel \
diff --git a/scripts/travis/travis-tests b/scripts/travis/travis-tests
index 1f6b1913..dd772e40 100755
--- a/scripts/travis/travis-tests
+++ b/scripts/travis/travis-tests
@@ -6,7 +6,7 @@ TRAVIS_PKGS="protobuf-c-compiler libprotobuf-c-dev libaio-dev python-future
 		libcap-dev libnl-3-dev gdb bash python-protobuf python-yaml
 		libnet-dev util-linux asciidoctor libnl-route-3-dev
 		python-junit.xml python-ipaddress time ccache flake8
-		libbsd-dev"
+		libbsd-dev nftables"
 
 X86_64_PKGS="gcc-multilib"
 
diff --git a/test/zdtm/static/Makefile b/test/zdtm/static/Makefile
index a38482f4..94cecc16 100644
--- a/test/zdtm/static/Makefile
+++ b/test/zdtm/static/Makefile
@@ -286,6 +286,7 @@ TST_FILE	=				\
 		file_locks07			\
 		file_locks08			\
 		netns-nf			\
+		netns-nft				\
 		maps_file_prot			\
 		socket_close_data01		\
 
diff --git a/test/zdtm/static/netns-nft.c b/test/zdtm/static/netns-nft.c
new file mode 100644
index 00000000..8baaace4
--- /dev/null
+++ b/test/zdtm/static/netns-nft.c
@@ -0,0 +1,63 @@
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "zdtmtst.h"
+
+const char *test_doc	= "Check that nft rules (some) are kept";
+
+char *filename;
+TEST_OPTION(filename, string, "file name", 1);
+
+int main(int argc, char **argv)
+{
+	char cmd[128];
+
+	test_init(argc, argv);
+
+	/* create nft table */
+	if (system("nft add table inet netns-nft-zdtm-test")) {
+		pr_perror("Can't create nft table");
+		return -1;
+	}
+
+	/* create input chain in table */
+	if (system("nft add chain inet netns-nft-zdtm-test input { type filter hook input priority 0 \\; }")) {
+		pr_perror("Can't create input chain in nft table");
+		return -1;
+	}
+
+	/* block ICMPv4 traffic */
+	if (system("nft add rule inet netns-nft-zdtm-test input meta nfproto ipv4 icmp type { echo-request } reject")) {
+		pr_perror("Can't set input rule");
+		return -1;
+	}
+
+	/* save resulting nft table */
+	sprintf(cmd, "nft list table inet netns-nft-zdtm-test > pre-%s", filename);
+	if (system(cmd)) {
+		pr_perror("Can't get nft table");
+		return -1;
+	}
+
+	test_daemon();
+	test_waitsig();
+
+	/* get nft table */
+	sprintf(cmd, "nft list table inet netns-nft-zdtm-test > post-%s", filename);
+	if (system(cmd)) {
+		fail("Can't get nft table");
+		return -1;
+	}
+
+	/* compare nft table before/after c/r */
+	sprintf(cmd, "diff pre-%s post-%s", filename, filename);
+	if (system(cmd)) {
+		fail("nft table differ");
+		return -1;
+	}
+
+	pass();
+	return 0;
+}
diff --git a/test/zdtm/static/netns-nft.checkskip b/test/zdtm/static/netns-nft.checkskip
new file mode 100755
index 00000000..270cafeb
--- /dev/null
+++ b/test/zdtm/static/netns-nft.checkskip
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+test -f /usr/sbin/nft || exit 1
diff --git a/test/zdtm/static/netns-nft.desc b/test/zdtm/static/netns-nft.desc
new file mode 100644
index 00000000..f53890a2
--- /dev/null
+++ b/test/zdtm/static/netns-nft.desc
@@ -0,0 +1,5 @@
+{   'deps': [   '/bin/sh',
+                '/usr/sbin/nft',
+                '/usr/bin/diff'],
+    'flags': 'suid',
+    'flavor': 'ns uns'}
-- 
2.17.1