selftests: netfilter: Torture nftables netdev hooks
authorPhil Sutter <phil@nwl.cc>
Wed, 21 May 2025 20:44:34 +0000 (22:44 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 23 May 2025 11:57:14 +0000 (13:57 +0200)
commit73db1b5dab6fe17baf9fe2b0d7c8dfd1d4a5b3e5
tree98e1c3af2f46b7b8a83d1b21b25d76296ed4b0aa
parent465b9ee0ee7bc268d7f261356afd6c4262e48d82
selftests: netfilter: Torture nftables netdev hooks

Add a ruleset which binds to various interface names via netdev-family
chains and flowtables and massage the notifiers by frequently renaming
interfaces to match these names. While doing so:
- Keep an 'nft monitor' running in background to receive the notifications
- Loop over 'nft list ruleset' to exercise ruleset dump codepath
- Have iperf running so the involved chains/flowtables see traffic

If supported, also test interface wildcard support separately by
creating a flowtable with 'wild*' interface spec and quickly add/remove
matching dummy interfaces.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
tools/testing/selftests/net/netfilter/Makefile
tools/testing/selftests/net/netfilter/nft_interface_stress.sh [new file with mode: 0755]