selftests: netfilter: skip tests on early errors

br_netfilter: If we can't add the needed initial nftables ruleset skip the
test, kernel doesn't support a required feature.

rpath: run a subset of the tests if possible, but make sure we return
the skip return value so they are marked appropriately by the kselftest
framework.

nft_audit.sh: provide version information when skipping, this should
help catching kernel problem (feature not available in kernel) vs.
userspace issue (parser doesn't support keyword).

Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240423130604.7013-7-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/tools/testing/selftests/net/netfilter/br_netfilter.sh b/tools/testing/selftests/net/netfilter/br_netfilter.sh
index 1084faf88f0b51f99095849ccf034584db59df4c..d7806753f5de2d13d82fb4b5a0fa76d52fd3bf07 100755 (executable)
--- a/tools/testing/selftests/net/netfilter/br_netfilter.sh
+++ b/tools/testing/selftests/net/netfilter/br_netfilter.sh
@@ -124,6 +124,10 @@ table bridge filter {
        }
 }
 EOF
+if [ "$?" -ne 0 ];then
+       echo "SKIP: could not add nftables ruleset"
+       exit $ksft_skip
+fi
 
 # place 1, 2 & 3 in same subnet, connected via ns0:br0.
 # ns4 is placed in same subnet as well, but its not

diff --git a/tools/testing/selftests/net/netfilter/nft_audit.sh b/tools/testing/selftests/net/netfilter/nft_audit.sh
index b390437696baae7a2999fe9dfaba657211eed1cd..902f8114bc80fc2727cc2c6778d22ef066013227 100755 (executable)
--- a/tools/testing/selftests/net/netfilter/nft_audit.sh
+++ b/tools/testing/selftests/net/netfilter/nft_audit.sh
@@ -29,7 +29,8 @@ reset rules t c
 EOF
 
 if [ "$?" -ne 0 ];then
-       echo "SKIP: nft reset feature test failed"
+       echo -n "SKIP: nft reset feature test failed: "
+       nft --version
        exit $SKIP_RC
 fi
 

diff --git a/tools/testing/selftests/net/netfilter/rpath.sh b/tools/testing/selftests/net/netfilter/rpath.sh
index 5289c8447a419b611befb82ddba6441ebee390ac..4485fd7675ed7e1101cb301cf01aae7d5c1bf39d 100755 (executable)
--- a/tools/testing/selftests/net/netfilter/rpath.sh
+++ b/tools/testing/selftests/net/netfilter/rpath.sh
@@ -64,12 +64,18 @@ ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad
 # firewall matches to test
 [ -n "$iptables" ] && {
        common='-t raw -A PREROUTING -s 192.168.0.0/16'
-       ip netns exec "$ns2" "$iptables" $common -m rpfilter
+       if ! ip netns exec "$ns2" "$iptables" $common -m rpfilter;then
+               echo "Cannot add rpfilter rule"
+               exit $ksft_skip
+       fi
        ip netns exec "$ns2" "$iptables" $common -m rpfilter --invert
 }
 [ -n "$ip6tables" ] && {
        common='-t raw -A PREROUTING -s fec0::/16'
-       ip netns exec "$ns2" "$ip6tables" $common -m rpfilter
+       if ! ip netns exec "$ns2" "$ip6tables" $common -m rpfilter;then
+               echo "Cannot add rpfilter rule"
+               exit $ksft_skip
+       fi
        ip netns exec "$ns2" "$ip6tables" $common -m rpfilter --invert
 }
 [ -n "$nft" ] && ip netns exec "$ns2" $nft -f - <<EOF