selftests: netfilter: Torture nftables netdev hooks

Browse source

Add a ruleset which binds to various interface names via netdev-family
chains and flowtables and massage the notifiers by frequently renaming
interfaces to match these names. While doing so:
- Keep an 'nft monitor' running in background to receive the notifications
- Loop over 'nft list ruleset' to exercise ruleset dump codepath
- Have iperf running so the involved chains/flowtables see traffic

If supported, also test interface wildcard support separately by
creating a flowtable with 'wild*' interface spec and quickly add/remove
matching dummy interfaces.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Phil Sutter 2025-05-21 22:44:34 +02:00 • committed by Pablo Neira Ayuso

parent 465b9ee0ee

commit 73db1b5dab

2 changed files with 152 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

tools/testing/selftests/net/netfilter/Makefile

View file

151

tools/testing/selftests/net/netfilter/nft_interface_stress.sh Executable file

View file