[Devel] [PATCH vz10 v2 3/5] selftests: netfilter: add the veth pair from inside the namespace

[Eva Kurchatova]

Both tests add a veth by name while running in the initial namespace.
The name of the new device is taken there, not in the namespace passed to
netns, so a device of that name left behind by another test makes the add
fail and the test then runs with no connectivity at all:

  # RTNETLINK answers: File exists
  # Cannot find device "veth1"
  # FAIL: socat cannot connect via NAT'd address

Add the pair from inside one of the namespaces instead. Those are made
by setup_ns and are empty, and the peer is created directly in its own
namespace, so no name from the initial namespace is in the way.

br_netfilter.sh checked only the first of its four adds, so a failure of
any of the others was silent and turned up 90 lines later as a ping to a
namespace that had no interface. Check all four.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
---
 .../selftests/net/netfilter/br_netfilter.sh   | 21 ++++++++++++-------
 .../selftests/net/netfilter/nf_nat_edemux.sh  | 12 +++++++----
 2 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/tools/testing/selftests/net/netfilter/br_netfilter.sh b/tools/testing/selftests/net/netfilter/br_netfilter.sh
index 011de8763094..e4480c9db86e 100755
--- a/tools/testing/selftests/net/netfilter/br_netfilter.sh
+++ b/tools/testing/selftests/net/netfilter/br_netfilter.sh
@@ -60,14 +60,19 @@ bcast_ping()
 	done
 }
 
-if ! ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns1"; then
-	echo "SKIP: Can't create veth device"
-	exit $ksft_skip
-fi
-
-ip link add veth2 netns "$ns0" type veth peer name eth0 netns "$ns2"
-ip link add veth3 netns "$ns0" type veth peer name eth0 netns "$ns3"
-ip link add veth4 netns "$ns0" type veth peer name eth0 netns "$ns4"
+# Add the pairs from inside ns0: the name of the new device is taken in the
+# namespace the command runs in, so adding them here would fail if a device
+# of that name was left behind in the initial namespace.  Only veth1 used to
+# be checked, and a silent failure for one of the others left a namespace
+# with no interface at all, which showed up as a ping failure much later.
+for i in $(seq 1 4); do
+	nsvar="ns$i"
+	if ! ip -net "$ns0" link add "veth$i" type veth \
+		peer name eth0 netns "${!nsvar}"; then
+		echo "SKIP: Can't create veth device"
+		exit $ksft_skip
+	fi
+done
 
 for i in $(seq 1 4); do
   ip -net "$ns0" link set "veth$i" up
diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
index 1014551dd769..9d655d525104 100755
--- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
+++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
@@ -22,10 +22,14 @@ trap cleanup EXIT
 
 setup_ns ns1 ns2
 
-# Connect the namespaces using a veth pair
-ip link add name veth2 type veth peer name veth1
-ip link set netns "$ns1" dev veth1
-ip link set netns "$ns2" dev veth2
+# Connect the namespaces using a veth pair.  Add it from inside ns1: the
+# name of the new device is taken in the namespace the command runs in, so
+# adding it here would fail if a device of that name was left behind in the
+# initial namespace, and the test would then run without connectivity.
+if ! ip -net "$ns1" link add name veth1 type veth peer name veth2 netns "$ns2"; then
+	echo "SKIP: Can't create veth device"
+	exit $ksft_skip
+fi
 
 ip netns exec "$ns1" ip link set up dev lo
 ip netns exec "$ns1" ip link set up dev veth1
-- 
2.55.0