[Devel] [PATCH vz10 v2 4/5] selftests: bpf: run test_sock and test_tunnel in their own netns
Eva Kurchatova
eva.kurchatova at virtuozzo.com
Tue Sep 1 02:41:51 MSK 2026
Both use the initial namespace and fail on what the machine has in it
rather than on the kernel under test.
test_sock binds 127.0.0.1:5000 and fails if anything already listens
there.
test_tunnel needs the fou module, which nothing loads, and asks for
encapsulations this kernel may not have. Run both in a namespace of
their own, load the module, and let check() probe the kernel so the
callers skip an encapsulation that is missing instead of failing.
Upstream carries neither test any more: commit eea6c14c10ce
("selftests/bpf: Retire test_sock.c") and commit a54e7006967f
("selftests/bpf: test_tunnel: Remove test_tunnel.sh") dropped them once
their cases had moved to test_progs. Both are still in this tree and
still run, so they are fixed in this tree.
https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix vz selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
---
tools/testing/selftests/bpf/test_sock.c | 17 ++++++++
tools/testing/selftests/bpf/test_tunnel.sh | 50 +++++++++++++++++-----
2 files changed, 56 insertions(+), 11 deletions(-)
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index 810c3740b2cc..0298ff2e5cf7 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -1,7 +1,10 @@
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2018 Facebook
+#define _GNU_SOURCE
+#include <sched.h>
#include <stdio.h>
+#include <stdlib.h>
#include <unistd.h>
#include <arpa/inet.h>
@@ -536,6 +539,20 @@ int main(int argc, char **argv)
int cgfd = -1;
int err = 0;
+ /* The tests bind fixed ports on the loopback address, and one of
+ * them retries on 5000, which a service on the machine may well be
+ * listening on. Take a network namespace of our own so that only
+ * the sockets of this test are in it.
+ */
+ if (unshare(CLONE_NEWNET)) {
+ log_err("unshare(CLONE_NEWNET)");
+ return -1;
+ }
+ if (system("ip link set lo up")) {
+ log_err("bringing loopback up");
+ return -1;
+ }
+
cgfd = cgroup_setup_and_join(CG_PATH);
if (cgfd < 0)
goto err;
diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
index d9661b9988ba..172aac4dae4f 100755
--- a/tools/testing/selftests/bpf/test_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tunnel.sh
@@ -45,6 +45,22 @@
# 5) Tunnel protocol handler, ex: vxlan_rcv, decap the packet
# 6) Forward the packet to the overlay tnl dev
+# The tunnels are built between this namespace and at_ns0, so a firewall
+# on the machine filters the encapsulated traffic: our nodes reject IPv6
+# with admin-prohibited, which the ip6geneve case never survives. A
+# namespace of our own has no such rules, and takes the devices with it
+# when the test ends.
+if [ -z "${BPF_TUNNEL_NETNS:-}" ]; then
+ BPF_TUNNEL_NETNS=1 export BPF_TUNNEL_NETNS
+ exec unshare -n sh -c 'ip link set lo up; exec "$0" "$@"' "$0" "$@"
+fi
+
+# The BPF object refers to the FOU kfuncs, and libbpf has to resolve them
+# against kernel or module BTF before it can load the object at all, also
+# for the tunnel types that do not use FOU. Nothing to do where FOU is
+# built in.
+modprobe fou 2>/dev/null
+
BPF_FILE="test_tunnel_kern.bpf.o"
BPF_PIN_TUNNEL_DIR="/sys/fs/bpf/tc/tunnel"
PING_ARG="-c 3 -w 10 -q"
@@ -241,7 +257,7 @@ test_gre()
DEV=gretap11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_gre_tunnel 2
attach_bpf $DEV gre_set_tunnel gre_get_tunnel
@@ -265,7 +281,7 @@ test_gre_no_tunnel_key()
DEV=gre11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_gre_tunnel
attach_bpf $DEV gre_set_tunnel_no_key gre_get_tunnel
@@ -289,7 +305,7 @@ test_ip6gre()
DEV=ip6gre11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
# reuse the ip6gretap function
add_ip6gretap_tunnel
@@ -319,7 +335,7 @@ test_ip6gretap()
DEV=ip6gretap11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6gretap_tunnel
attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel
@@ -348,7 +364,7 @@ test_erspan()
DEV=erspan11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_erspan_tunnel $1
attach_bpf $DEV erspan_set_tunnel erspan_get_tunnel
@@ -372,7 +388,7 @@ test_ip6erspan()
DEV=ip6erspan11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6erspan_tunnel $1
attach_bpf $DEV ip4ip6erspan_set_tunnel ip4ip6erspan_get_tunnel
@@ -395,7 +411,7 @@ test_geneve()
DEV=geneve11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_geneve_tunnel
attach_bpf $DEV geneve_set_tunnel geneve_get_tunnel
@@ -419,7 +435,7 @@ test_ip6geneve()
DEV=ip6geneve11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6geneve_tunnel
attach_bpf $DEV ip6geneve_set_tunnel ip6geneve_get_tunnel
@@ -443,7 +459,7 @@ test_ipip()
DEV=ipip11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ipip_tunnel
ip link set dev veth1 mtu 1500
@@ -468,7 +484,7 @@ test_ipip6()
DEV=ipip6tnl11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6tnl_tunnel
ip link set dev veth1 mtu 1500
@@ -496,7 +512,7 @@ test_ip6ip6()
DEV=ip6ip6tnl11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6tnl_tunnel
ip link set dev veth1 mtu 1500
@@ -563,6 +579,18 @@ check()
cleanup
return 1
fi
+
+ # The kernel can be built without a tunnel type, and then rtnetlink
+ # has no ops for it and says so.
+ if ip link add dev "probe_$1" type "$1" 2>&1 | \
+ grep -q "Unknown device type"; then
+ echo "SKIP $1: kernel does not support $1"
+ cleanup
+ return 1
+ fi
+ ip link del dev "probe_$1" 2>/dev/null
+
+ return 0
}
enable_debug()
--
2.55.0
More information about the Devel
mailing list