From nobody Thu Dec 18 07:50:51 2025 Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D98172DCBF0; Tue, 27 May 2025 03:26:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748316415; cv=none; b=sFgQCin97Xh7T+yum2Mq04vSBg1Ejac4WHk5I3Ip6Hxsilao1gF+ogzA5IoDM5SzC9HpeADmlT0Dw0+srZ6vcmCBRK4HJ5VsHqYzazaZ9LE+sqK5FopEieWnDflMyeJjVEZYsobyxoNKGEF6UIQAtvqXswXj4TUicA940aKAEhM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748316415; c=relaxed/simple; bh=2csU+79UdMjWyhK9Iv2wecuNUMlZMFfRyVTWj9zto78=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kXEcHVFQQXrIajYLwAaedgqhgs3+H33k8QagMeOKkLoSM9wB9QaTzEvM12leMU2+fDpMeKOe9mWB6xWX9SgFm5XhaHcIIH1O3cRqclIBMpi4uL/USXsJbpe0w7b9vE5gWR/VIU0+mEviHy7BkMNUuJP+pk5g8OMiRGfDL6IWU/8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NO8d4bnx; arc=none smtp.client-ip=209.85.210.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NO8d4bnx" Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-7390d21bb1cso1818110b3a.2; Mon, 26 May 2025 20:26:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1748316412; x=1748921212; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=v7d+kcHAwN3g2veRIP35/Cx+qKGOfglBxZ9UJox5e0Y=; b=NO8d4bnxAnL+F9I7p7nytSORxtmNci75CCI1a1s+tUtLZbyatiuAr15v/kkd9SeJ55 DEZKFHPNpsVrkJfQvaVkamHyhj4RoWvDZxG1oe/WQjQAeC+gDzOHYBiinolPfjE9VqU3 PcxbH3sSyVWTJenXpAYmRsLNMnhOO0/hWRB00hxsk6Sprn5Q8j5i8kOegT5RtzbNsjVR QpesjezLLIOJioVhzj36NYt3I2Z61H/dGHjfsT0E4zQEpemItDZ1QT6WBHkuVQJL717V 7apll/tJq9ybv28tqfDj4nmvZ/4kVxfAPL1iv3+aqlUirt7hN1Ww/J50zZegZ/QwJdW6 /E3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1748316412; x=1748921212; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=v7d+kcHAwN3g2veRIP35/Cx+qKGOfglBxZ9UJox5e0Y=; b=LHvYqjRcyTEXjn/yPox8f8GxYC9ZNCywY8eez2uRZXWlU/b7baWlFDl/WBQlS3vmJ1 WDh3NOaJSb/Y9eHSz5KW8Q47hmPOTDJ2D3lsd+WFs6DPHX45V+nrGeaEigRq1E7DYtPE 2dBYIARGRku1vwTKXVxFDM/MHSV4ynpXdVAdgPm3etHXnqxn6Dy4QPxphX5827qC9PFk t3vpcN+yJGkQ/N+he2ZQevckqWJfXUceFU8G5kqy4XKWe5WnJNSpBas/SVt4bPgXA50S Lzoh52NBQOR6DE7J46lY8i/XssBVR3tVx6JSMO1c3/AYsJzkA3jV7mJ8Z2/4MXtVEXcv XVqQ== X-Forwarded-Encrypted: i=1; AJvYcCVlfM858ory/6jPGKzOLcGL+WA3/iX4sRjpk73dzUQEJ/k8kExNf4ug6o6d/E+hDDqGi75+ZbheVGZ/b3c=@vger.kernel.org, AJvYcCWMKdnYsXpb/UoeVfmk+ExS1g7+S5stZf1+eEZ6DZlEmoPx7od2iBgy+axl5stCfDG28F4EM6Hpqgjqk/MND5ND@vger.kernel.org X-Gm-Message-State: AOJu0YwT/KVFI7WBiFYtRdtzCtIBM38TS+as524kiI3oCVg7jvPuyTO8 +94Qikd/51q/3s7eVGdUplUAmTRB3gMlzIEFx8BMKhA1hG0zq8BQR7hpsTD5uyqXQEpGWg== X-Gm-Gg: ASbGnctZV8JPaUCRD5/0A4sW92yFtitgcNmC5zUXRJwrLzT+ZkL3kL4Y7JQnseptVix VNzNuuo940K8Ur84V0ESkM7S3OONp6dFbB5PJxc+JZNlt5DOcuknhZ0nbEZdOUsdyRsGQsV4ZKw JQ+9vinARlnVRR/McWJTRwSpOy07nT4TxJLNGp9DT0132IPBqADiJqaT/s/wUeTGn1b9UPlzbpY ZWowe6I1InBxWI53CACeBDMrvuVJL07yI8kUKuq8CygNY0/22xd1mea3xYXu9RZkQqszGd3CeQu qMTeot2KqcBCZF5obgUANx/mYSDxumnx9pDMHPgIFGLNO6HQ3GFJGXD+oA/z8HfWRPwxGqT/qO9 4zWPqIw== X-Google-Smtp-Source: AGHT+IGm5Z446VlQptWidK7f486g8CKnUCNZzW4L3XG0SUf3L5vvYXvByrkhOdRBa0b00ccZqaQmJg== X-Received: by 2002:a05:6a00:1383:b0:742:da7c:3f27 with SMTP id d2e1a72fcca58-745fdb4c492mr16903913b3a.0.1748316412177; Mon, 26 May 2025 20:26:52 -0700 (PDT) Received: from fedora.dns.podman ([209.132.188.88]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-74622b3b481sm865926b3a.131.2025.05.26.20.26.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 May 2025 20:26:51 -0700 (PDT) From: Hangbin Liu To: netdev@vger.kernel.org Cc: "Jason A. Donenfeld" , Jakub Kicinski , Shuah Khan , "David S. Miller" , Simon Horman , Phil Sutter , Florian Westphal , Petr Mladek , Yoann Congal , wireguard@lists.zx2c4.com, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Hangbin Liu Subject: [PATCHv7 RESEND wireguard 1/2] wireguard: selftests: convert iptables to nft Date: Tue, 27 May 2025 03:26:34 +0000 Message-ID: <20250527032635.10361-2-liuhangbin@gmail.com> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20250527032635.10361-1-liuhangbin@gmail.com> References: <20250527032635.10361-1-liuhangbin@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Convert the selftest to nft as it is the replacement for iptables, which is used by default in most releases. Signed-off-by: Hangbin Liu --- tools/testing/selftests/wireguard/netns.sh | 29 ++++++++++++++-------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/sel= ftests/wireguard/netns.sh index 55500f901fbc..8b840fef90af 100755 --- a/tools/testing/selftests/wireguard/netns.sh +++ b/tools/testing/selftests/wireguard/netns.sh @@ -75,6 +75,11 @@ pp ip netns add $netns1 pp ip netns add $netns2 ip0 link set up dev lo =20 +# init nft tables +n0 nft add table ip wgtest +n1 nft add table ip wgtest +n2 nft add table ip wgtest + ip0 link add dev wg0 type wireguard ip0 link set wg0 netns $netns1 ip0 link add dev wg0 type wireguard @@ -196,13 +201,14 @@ ip1 link set wg0 mtu 1300 ip2 link set wg0 mtu 1300 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2 n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1 -n0 iptables -A INPUT -m length --length 1360 -j DROP +n0 nft add chain ip wgtest INPUT { type filter hook input priority filter = \; policy accept \; } +n0 nft add rule ip wgtest INPUT meta length 1360 drop n1 ip route add 192.168.241.2/32 dev wg0 mtu 1299 n2 ip route add 192.168.241.1/32 dev wg0 mtu 1299 n2 ping -c 1 -W 1 -s 1269 192.168.241.1 n2 ip route delete 192.168.241.1/32 dev wg0 mtu 1299 n1 ip route delete 192.168.241.2/32 dev wg0 mtu 1299 -n0 iptables -F INPUT +n0 nft flush table ip wgtest =20 ip1 link set wg0 mtu $orig_mtu ip2 link set wg0 mtu $orig_mtu @@ -335,7 +341,8 @@ n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward' [[ -e /proc/sys/net/netfilter/nf_conntrack_udp_timeout ]] || modprobe nf_c= onntrack n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout' n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_st= ream' -n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT= --to 10.0.0.1 +n0 nft add chain ip wgtest POSTROUTING { type nat hook postrouting priorit= y srcnat\; policy accept \; } +n0 nft add rule ip wgtest POSTROUTING ip saddr 192.168.1.0/24 ip daddr 10.= 0.0.0/24 snat to 10.0.0.1 =20 n1 wg set wg0 peer "$pub2" endpoint 10.0.0.100:2 persistent-keepalive 1 n1 ping -W 1 -c 1 192.168.241.2 @@ -349,10 +356,11 @@ n1 wg set wg0 peer "$pub2" persistent-keepalive 0 # Test that sk_bound_dev_if works n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # What about when the mark changes and the packet must be rerouted? -n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1 +n1 nft add chain ip wgtest OUTPUT { type route hook output priority mangle= \; policy accept \; } +n1 nft add rule ip wgtest OUTPUT meta mark set 0x1 n1 ping -c 1 -W 1 192.168.241.2 # First the boring case n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case -n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1 +n1 nft flush table ip wgtest =20 # Test that onion routing works, even when it loops n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.2= 41.2:5 @@ -386,16 +394,17 @@ n1 ping -W 1 -c 100 -f 192.168.99.7 n1 ping -W 1 -c 100 -f abab::1111 =20 # Have ns2 NAT into wg0 packets from ns0, but return an icmp error along t= he right route. -n2 iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 192.168.241.0/24 -j SN= AT --to 192.168.241.2 -n0 iptables -t filter -A INPUT \! -s 10.0.0.0/24 -i vethrs -j DROP # Manua= l rpfilter just to be explicit. +n2 nft add chain ip wgtest POSTROUTING { type nat hook postrouting priorit= y srcnat\; policy accept \; } +n2 nft add rule ip wgtest POSTROUTING ip saddr 10.0.0.0/24 ip daddr 192.16= 8.241.0/24 snat to 192.168.241.2 +n0 nft add chain ip wgtest INPUT { type filter hook input priority filter = \; policy accept \; } +n0 nft add rule ip wgtest INPUT iifname "vethrs" ip saddr !=3D 10.0.0.0/24= drop n2 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward' ip0 -4 route add 192.168.241.1 via 10.0.0.100 n2 wg set wg0 peer "$pub1" remove [[ $(! n0 ping -W 1 -c 1 192.168.241.1 || false) =3D=3D *"From 10.0.0.100 = icmp_seq=3D1 Destination Host Unreachable"* ]] =20 -n0 iptables -t nat -F -n0 iptables -t filter -F -n2 iptables -t nat -F +n0 nft flush table ip wgtest +n2 nft flush table ip wgtest ip0 link del vethrc ip0 link del vethrs ip1 link del wg0 --=20 2.46.0 From nobody Thu Dec 18 07:50:51 2025 Received: from mail-pf1-f178.google.com (mail-pf1-f178.google.com [209.85.210.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 984A61AF0AE; Tue, 27 May 2025 03:26:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748316420; cv=none; b=Zf+sqYv7lwGX9jbK/xFosjKe2jheTgbG4OuNC9+O8EpSkHg+sCrq/6sz+4Jn7zpsvs5vJB6F59UxG5bTYxOIVUFuAGUY6Eykd6XA92542RFs65XhBSfON03HFFGw0/wIcaBS47bjj8NiDsjWbgPvXS4jOWZcEDiZ7gamT2lglxc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748316420; c=relaxed/simple; bh=25kfwZWrJCdg3wZt8cA0jm1AToacY98iZoqDX4a/Ij0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a+l3Rgv15w8D4UieiS4SJAU51S2izcMzOjFtrzVODH5NPZZgOBZhn/EqXk87B4ceWt8ptmEO006SCLUxjqpKnl+AQQRiVNYvv3EA+mXi6heqlUO3OUL6woADLWJDWbKSrTNor+P8JSrQYUAsjolOBOvBH7gifxxMTGXuP1TEt8Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=CbFFa8js; arc=none smtp.client-ip=209.85.210.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="CbFFa8js" Received: by mail-pf1-f178.google.com with SMTP id d2e1a72fcca58-7399a2dc13fso3104343b3a.2; Mon, 26 May 2025 20:26:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1748316418; x=1748921218; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=0d3Ceii2JHd7DdtO/Jyc5PB50s2tl91HKnoWaWMWAkc=; b=CbFFa8js6JmcNX3afR/CdYTD2BVI+4YcjW23uCZd+YM6XwP/ImXPoKpUeuDxfUYAnF v7C4XrqVSvsMDCTBGdqJV36Mwx4rsiQmjuc3b9c2EFEGfwFUwCMev13MpDUikO83XtAM f5lH2TDcp7UnIHPeypCi7YAWLlgkLfD6j8YOB37yQ8CTxJPJlpVFemIQWU2fP6/H+jcA Vb9dj2vveKkUjJEF4hfYNA4H9EONrnCEx18GiP0uNQ6VH+0uTw+6hiygokVUdKxmdBzB CZoL3DPKOqL53/54o4v17AFXDdxts+0qFmBVBocVoo0QL+pQj614RgiVkwoCWaGW3qma MWXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1748316418; x=1748921218; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0d3Ceii2JHd7DdtO/Jyc5PB50s2tl91HKnoWaWMWAkc=; b=Pj9qusKOUne59hzwPwN2ehiQeCFbhMZXfFE2zrDF81nJA8cr2MwhVrl8LShpdKROBb fNWz7UjjZbu/n/ydEV2bDc47cHnkeu4P3PwOhQYvS+TPHoa2gRQJi89OGnh/hSJhJhXV zezRsCto3zX9Okt+G1DuihqZukzBQSs7vQgQ5UtnTJJvkPQnx1tXAoAehKuQtv6N9bcV s6nGDPLpHZ5I2ipNbpZNvAO+wEcGZZDNiWPyaU9pwvSshs2augnn+XlmhpMhCG/96hbh 3y2O4+QcOCyNL1cfDIkYZ5Zy5aapMqVlnKAKAvcoG2Ly/s7+lZlE9TPPa45eH/9N8Fte U2RQ== X-Forwarded-Encrypted: i=1; AJvYcCUv0FNoFPvEIi6XUdQj6FI+8ET8Er4XEHQy02YhuKioQbgOFmTMa6yt8qp1NbtnCGwgWNuQN+WQ3sfvLAE=@vger.kernel.org, AJvYcCXsOqSiBIH0G3tXn1nCz1/80zi0eyiFrb86TzdeAXFBY2E3toChXdGgaDG2QpySCkDpCId2M+GpgdkPmUISsbje@vger.kernel.org X-Gm-Message-State: AOJu0YxVxlUJRYvWEkEUIG4vO0D6EN9so+oHWJmKBVwywVmYGOeXhJHv eoiqfsirIYJyy6qA0eIEqaOv8CLhutwf0ti09Q+CgnEsTxg4di7vjcMCOyrhbCssT1gWtg== X-Gm-Gg: ASbGncsPvWITdJYmGgFGVh84FZWU3ubtn29m9RMQPRMCkEwUCLJf51+l8rmrAI10ppS uAoZsd+QkxDHdT2GKF/Si76Aixiqt9HrSopRTNZa5X7f28gpTmGl35CSGIinDsiQH+lfW4/AibA jsg+6smT390beZFDMEuSE/Smzj2f4eo26awBNhh6xpvN4oB36XomDDPzEHqZJzzXOHOw9+VxR9I DXwbCQo8lDMqHgQIyIAY8kBCMuVO3uFFIrD3+mroqRWnCu7wUecrAxx+zxMEtWvrUMGEljGRBRI DM+tRRF7s58L6rwZH8Cf6zyZgdXVBehXTO3YScwguLn/GFuMqmhxsbO4M3vTz4wyCdhj9QY= X-Google-Smtp-Source: AGHT+IGb+7qaXKyhT4wWXjgKeo/vySCxcdkeuTOl8hvnSfuDcHsEUB0t6+UFO7+PhMdJKjqH/VNvJQ== X-Received: by 2002:a05:6a21:3399:b0:1f5:709d:e0c6 with SMTP id adf61e73a8af0-2188c3b4987mr17871610637.42.1748316417674; Mon, 26 May 2025 20:26:57 -0700 (PDT) Received: from fedora.dns.podman ([209.132.188.88]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-74622b3b481sm865926b3a.131.2025.05.26.20.26.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 May 2025 20:26:57 -0700 (PDT) From: Hangbin Liu To: netdev@vger.kernel.org Cc: "Jason A. Donenfeld" , Jakub Kicinski , Shuah Khan , "David S. Miller" , Simon Horman , Phil Sutter , Florian Westphal , Petr Mladek , Yoann Congal , wireguard@lists.zx2c4.com, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Hangbin Liu Subject: [PATCHv7 RESEND wireguard 2/2] wireguard: selftests: update to using nft for qemu test Date: Tue, 27 May 2025 03:26:35 +0000 Message-ID: <20250527032635.10361-3-liuhangbin@gmail.com> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20250527032635.10361-1-liuhangbin@gmail.com> References: <20250527032635.10361-1-liuhangbin@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Since we will replace iptables with nft for wireguard netns testing, let's also convert the qemu test to use nft at the same time. Co-developed-by: Phil Sutter Signed-off-by: Phil Sutter Signed-off-by: Hangbin Liu --- .../testing/selftests/wireguard/qemu/Makefile | 36 ++++++++++++++----- .../selftests/wireguard/qemu/kernel.config | 7 ++-- 2 files changed, 30 insertions(+), 13 deletions(-) diff --git a/tools/testing/selftests/wireguard/qemu/Makefile b/tools/testin= g/selftests/wireguard/qemu/Makefile index 35856b11c143..2442ae99f007 100644 --- a/tools/testing/selftests/wireguard/qemu/Makefile +++ b/tools/testing/selftests/wireguard/qemu/Makefile @@ -40,7 +40,9 @@ endef $(eval $(call tar_download,IPERF,iperf,3.11,.tar.gz,https://downloads.es.n= et/pub/iperf/,de8cb409fad61a0574f4cb07eb19ce1159707403ac2dc01b5d175e91240b7= e5f)) $(eval $(call tar_download,BASH,bash,5.1.16,.tar.gz,https://ftp.gnu.org/gn= u/bash/,5bac17218d3911834520dad13cd1f85ab944e1c09ae1aba55906be1f8192f558)) $(eval $(call tar_download,IPROUTE2,iproute2,5.17.0,.tar.gz,https://www.ke= rnel.org/pub/linux/utils/net/iproute2/,bda331d5c4606138892f23a565d78fca1891= 9b4d508a0b7ca8391c2da2db68b9)) -$(eval $(call tar_download,IPTABLES,iptables,1.8.7,.tar.bz2,https://www.ne= tfilter.org/projects/iptables/files/,c109c96bb04998cd44156622d36f8e04b14070= 1ec60531a10668cfdff5e8d8f0)) +$(eval $(call tar_download,LIBMNL,libmnl,1.0.5,.tar.bz2,https://www.netfil= ter.org/projects/libmnl/files/,274b9b919ef3152bfb3da3a13c950dd60d6e2bcd5423= 0ffeca298d03b40d0525)) +$(eval $(call tar_download,LIBNFTNL,libnftnl,1.2.8,.tar.xz,https://www.net= filter.org/projects/libnftnl/files/,37fea5d6b5c9b08de7920d298de3cdc942e7ae6= 4b1a3e8b880b2d390ae67ad95)) +$(eval $(call tar_download,NFTABLES,nftables,1.1.1,.tar.xz,https://www.net= filter.org/projects/nftables/files/,6358830f3a64f31e39b0ad421d7dadcd240b723= 43ded48d8ef13b8faf204865a)) $(eval $(call tar_download,NMAP,nmap,7.92,.tgz,https://nmap.org/dist/,0641= 83ea642dc4c12b1ab3b5358ce1cef7d2e7e11ffa2849f16d339f5b717117)) $(eval $(call tar_download,IPUTILS,iputils,s20190709,.tar.gz,https://githu= b.com/iputils/iputils/archive/s20190709.tar.gz/#,a15720dd741d7538dd2645f9f5= 16d193636ae4300ff7dbc8bfca757bf166490a)) $(eval $(call tar_download,WIREGUARD_TOOLS,wireguard-tools,1.0.20210914,.t= ar.xz,https://git.zx2c4.com/wireguard-tools/snapshot/,97ff31489217bb265b7ae= 850d3d0f335ab07d2652ba1feec88b734bc96bd05ac)) @@ -322,8 +324,7 @@ $(BUILD_PATH)/init-cpio-spec.txt: $(TOOLCHAIN_PATH)/.in= stalled $(BUILD_PATH)/ini echo "file /bin/ss $(IPROUTE2_PATH)/misc/ss 755 0 0" >> $@ echo "file /bin/ping $(IPUTILS_PATH)/ping 755 0 0" >> $@ echo "file /bin/ncat $(NMAP_PATH)/ncat/ncat 755 0 0" >> $@ - echo "file /bin/xtables-legacy-multi $(IPTABLES_PATH)/iptables/xtables-le= gacy-multi 755 0 0" >> $@ - echo "slink /bin/iptables xtables-legacy-multi 777 0 0" >> $@ + echo "file /bin/nft $(NFTABLES_PATH)/src/nft 755 0 0" >> $@ echo "slink /bin/ping6 ping 777 0 0" >> $@ echo "dir /lib 755 0 0" >> $@ echo "file /lib/libc.so $(TOOLCHAIN_PATH)/$(CHOST)/lib/libc.so 755 0 0" >= > $@ @@ -338,7 +339,7 @@ $(KERNEL_BUILD_PATH)/.config: $(TOOLCHAIN_PATH)/.instal= led kernel.config arch/$( cd $(KERNEL_BUILD_PATH) && ARCH=3D$(KERNEL_ARCH) $(KERNEL_PATH)/scripts/k= config/merge_config.sh -n $(KERNEL_BUILD_PATH)/.config $(KERNEL_BUILD_PATH)= /minimal.config $(if $(findstring yes,$(DEBUG_KERNEL)),cp debug.config $(KERNEL_BUILD_PAT= H) && cd $(KERNEL_BUILD_PATH) && ARCH=3D$(KERNEL_ARCH) $(KERNEL_PATH)/scrip= ts/kconfig/merge_config.sh -n $(KERNEL_BUILD_PATH)/.config debug.config,) =20 -$(KERNEL_BZIMAGE): $(TOOLCHAIN_PATH)/.installed $(KERNEL_BUILD_PATH)/.conf= ig $(BUILD_PATH)/init-cpio-spec.txt $(IPERF_PATH)/src/iperf3 $(IPUTILS_PATH= )/ping $(BASH_PATH)/bash $(IPROUTE2_PATH)/misc/ss $(IPROUTE2_PATH)/ip/ip $(= IPTABLES_PATH)/iptables/xtables-legacy-multi $(NMAP_PATH)/ncat/ncat $(WIREG= UARD_TOOLS_PATH)/src/wg $(BUILD_PATH)/init +$(KERNEL_BZIMAGE): $(TOOLCHAIN_PATH)/.installed $(KERNEL_BUILD_PATH)/.conf= ig $(BUILD_PATH)/init-cpio-spec.txt $(IPERF_PATH)/src/iperf3 $(IPUTILS_PATH= )/ping $(BASH_PATH)/bash $(IPROUTE2_PATH)/misc/ss $(IPROUTE2_PATH)/ip/ip $(= LIBMNL_PATH)/libmnl $(LIBNFTNL_PATH)/libnftnl $(NFTABLES_PATH)/src/nft $(NM= AP_PATH)/ncat/ncat $(WIREGUARD_TOOLS_PATH)/src/wg $(BUILD_PATH)/init $(MAKE) -C $(KERNEL_PATH) O=3D$(KERNEL_BUILD_PATH) ARCH=3D$(KERNEL_ARCH) = CROSS_COMPILE=3D$(CROSS_COMPILE) .PHONY: $(KERNEL_BZIMAGE) =20 @@ -421,15 +422,32 @@ $(IPROUTE2_PATH)/misc/ss: | $(IPROUTE2_PATH)/.install= ed $(USERSPACE_DEPS) $(MAKE) -C $(IPROUTE2_PATH) PREFIX=3D/ misc/ss $(STRIP) -s $@ =20 -$(IPTABLES_PATH)/.installed: $(IPTABLES_TAR) +$(LIBMNL_PATH)/.installed: $(LIBMNL_TAR) mkdir -p $(BUILD_PATH) flock -s $<.lock tar -C $(BUILD_PATH) -xf $< - sed -i -e "/nfnetlink=3D[01]/s:=3D[01]:=3D0:" -e "/nfconntrack=3D[01]/s:= =3D[01]:=3D0:" $(IPTABLES_PATH)/configure touch $@ =20 -$(IPTABLES_PATH)/iptables/xtables-legacy-multi: | $(IPTABLES_PATH)/.instal= led $(USERSPACE_DEPS) - cd $(IPTABLES_PATH) && ./configure --prefix=3D/ $(CROSS_COMPILE_FLAG) --e= nable-static --disable-shared --disable-nftables --disable-bpf-compiler --d= isable-nfsynproxy --disable-libipq --disable-connlabel --with-kernel=3D$(BU= ILD_PATH)/include - $(MAKE) -C $(IPTABLES_PATH) +$(LIBMNL_PATH)/libmnl: | $(LIBMNL_PATH)/.installed $(USERSPACE_DEPS) + cd $(LIBMNL_PATH) && ./configure --prefix=3D$(TOOLCHAIN_PATH) $(CROSS_COM= PILE_FLAG) --enable-static --disable-shared + $(MAKE) -C $(LIBMNL_PATH) install + +$(LIBNFTNL_PATH)/.installed: $(LIBNFTNL_TAR) + mkdir -p $(BUILD_PATH) + flock -s $<.lock tar -C $(BUILD_PATH) -xf $< + touch $@ + +$(LIBNFTNL_PATH)/libnftnl: | $(LIBNFTNL_PATH)/.installed $(USERSPACE_DEPS) + cd $(LIBNFTNL_PATH) && PKG_CONFIG_PATH=3D"$(TOOLCHAIN_PATH)/lib/pkgconfig= " ./configure --prefix=3D$(TOOLCHAIN_PATH) $(CROSS_COMPILE_FLAG) --enable-s= tatic --disable-shared + $(MAKE) -C $(LIBNFTNL_PATH) install + +$(NFTABLES_PATH)/.installed: $(NFTABLES_TAR) + mkdir -p $(BUILD_PATH) + flock -s $<.lock tar -C $(BUILD_PATH) -xf $< + touch $@ + +$(NFTABLES_PATH)/src/nft: | $(NFTABLES_PATH)/.installed $(USERSPACE_DEPS) + cd $(NFTABLES_PATH) && PKG_CONFIG_PATH=3D"$(TOOLCHAIN_PATH)/lib/pkgconfig= " ./configure --prefix=3D/ $(CROSS_COMPILE_FLAG) --enable-static --disable-= shared --disable-debug --disable-man-doc --with-mini-gmp --without-cli + $(MAKE) -C $(NFTABLES_PATH) PREFIX=3D/ $(STRIP) -s $@ =20 $(NMAP_PATH)/.installed: $(NMAP_TAR) diff --git a/tools/testing/selftests/wireguard/qemu/kernel.config b/tools/t= esting/selftests/wireguard/qemu/kernel.config index f314d3789f17..9930116ecd81 100644 --- a/tools/testing/selftests/wireguard/qemu/kernel.config +++ b/tools/testing/selftests/wireguard/qemu/kernel.config @@ -19,10 +19,9 @@ CONFIG_NETFILTER_XTABLES=3Dy CONFIG_NETFILTER_XT_NAT=3Dy CONFIG_NETFILTER_XT_MATCH_LENGTH=3Dy CONFIG_NETFILTER_XT_MARK=3Dy -CONFIG_IP_NF_IPTABLES=3Dy -CONFIG_IP_NF_FILTER=3Dy -CONFIG_IP_NF_MANGLE=3Dy -CONFIG_IP_NF_NAT=3Dy +CONFIG_NF_TABLES=3Dm +CONFIG_NF_TABLES_INET=3Dy +CONFIG_NFT_NAT=3Dy CONFIG_IP_ADVANCED_ROUTER=3Dy CONFIG_IP_MULTIPLE_TABLES=3Dy CONFIG_IPV6_MULTIPLE_TABLES=3Dy --=20 2.46.0