[Devel] [PATCH vz10 v2 2/5] selftests: bpf: run test_xdp_features in its own netns

[Konstantin Khorenko]

Committed to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.3.vz10

2b7d45077716



selftests: bpf: run test_xdp_features in its own netns
The device under test listens on the veth address of the namespace the
script runs in and the tester connects to it, so a firewall on the
machine refuses the control connection:
  Failed connecting to the Device Under Test control socket
That side of the pair is also always called v1, and cleanup is trapped
for signals only, not for a normal exit, so a failed run leaves the
device behind and every later run stops in setup with nothing printed
at all.
Run the test in a namespace of its own, the way nft_audit.sh and
nft_concat_range.sh already do: no rule of the machine applies, and
what the test leaves behind goes away with the namespace.
https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
Link: http://lore.virtuozzo.com/20260831234217.1649428-2-eva.kurchatova@virtuozzo.com






--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 9/1/26 01:41, Eva Kurchatova wrote:
> The device under test listens on the veth address of the namespace the
> script runs in and the tester connects to it, so a firewall on the
> machine refuses the control connection:
> 
>   Failed connecting to the Device Under Test control socket
> 
> That side of the pair is also always called v1, and cleanup is trapped
> for signals only, not for a normal exit, so a failed run leaves the
> device behind and every later run stops in setup with nothing printed
> at all.
> 
> Run the test in a namespace of its own, the way nft_audit.sh and
> nft_concat_range.sh already do: no rule of the machine applies, and
> what the test leaves behind goes away with the namespace.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-139677
> Feature: fix selftests
> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
> ---
>  tools/testing/selftests/bpf/test_xdp_features.sh | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/test_xdp_features.sh b/tools/testing/selftests/bpf/test_xdp_features.sh
> index 0aa71c4455c0..75acacee701d 100755
> --- a/tools/testing/selftests/bpf/test_xdp_features.sh
> +++ b/tools/testing/selftests/bpf/test_xdp_features.sh
> @@ -1,6 +1,14 @@
>  #!/bin/bash
>  # SPDX-License-Identifier: GPL-2.0
>  
> +# The device under test listens on the veth address of the namespace
> +# this script runs in, so a firewall on the machine can refuse the
> +# control connection, and cleanup is trapped for signals only, so a
> +# failed run leaves the device behind and stops every later one.  Run
> +# in a fresh network namespace, like the netfilter tests do.
> +[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
> +ip link set lo up
> +
>  readonly NS="ns1-$(mktemp -u XXXXXX)"
>  readonly V0_IP4=10.10.0.11
>  readonly V1_IP4=10.10.0.1