[testsuite,v2] tests: make kernel iptables support optional

Commit Message

Ondrej Mosnacek Oct. 25, 2021, 2:19 p.m. UTC

The legacy iptables API is being deprecated in favor of netfilter and
some distributions are starting to disable it in their kernels (e.g.
Fedora ELN, RHEL 10+). To allow getting a clean run of the testsuite on
such kernels, detect the availability of the ip_tables kernel module and
skip the iptables tests if it's not available (either as a loadable
module or built in).

Signed-off-by: Ondrej Mosnacek <[e-mail]>
---

v2: do the same also in tests/sctp, not just tests/inet_socket

 tests/inet_socket/test | 21 ++++++++++++++++-----
 tests/sctp/test        | 21 ++++++++++++++++-----
 2 files changed, 32 insertions(+), 10 deletions(-)

Comments

Ondrej Mosnacek Oct. 27, 2021, 11:43 a.m. UTC | #1

On Mon, Oct 25, 2021 at 4:19 PM Ondrej Mosnacek <[e-mail]> wrote:
> The legacy iptables API is being deprecated in favor of netfilter and
> some distributions are starting to disable it in their kernels (e.g.
> Fedora ELN, RHEL 10+). To allow getting a clean run of the testsuite on
> such kernels, detect the availability of the ip_tables kernel module and
> skip the iptables tests if it's not available (either as a loadable
> module or built in).
>
> Signed-off-by: Ondrej Mosnacek <[e-mail]>
> ---
>
> v2: do the same also in tests/sctp, not just tests/inet_socket
>
>  tests/inet_socket/test | 21 ++++++++++++++++-----
>  tests/sctp/test        | 21 ++++++++++++++++-----
>  2 files changed, 32 insertions(+), 10 deletions(-)

Merged:
https://github.com/SELinuxProject/selinux-testsuite/commit/b2d0f3c5f946e58e3e6f8f1fff81d8435b005f92

Patch

diff --git a/tests/inet_socket/test b/tests/inet_socket/test
index 56a947b..f09b4e3 100755
--- a/tests/inet_socket/test
+++ b/tests/inet_socket/test
@@ -5,7 +5,7 @@  BEGIN {
     $basedir = $0;
     $basedir =~ s|(.*)/[^/]*|$1|;
 
-    $test_count = 38;
+    $test_count = 30;
 
     $test_ipsec = 0;
     if ( system("ip xfrm policy help 2>&1 | grep -q ctx") eq 0 ) {
@@ -27,6 +27,15 @@  BEGIN {
         $test_calipso_stream = 1;
     }
 
+    # Determine if kernel has legacy iptables support
+    $test_iptables = 0;
+
+    $rc = system("modprobe ip_tables 2>/dev/null");
+    if ( $rc == 0 ) {
+        $test_count += 8;
+        $test_iptables = 1;
+    }
+
     # Determine if nftables has secmark support
     $test_nft = 0;
 
@@ -415,10 +424,12 @@  sub test_tables {
     server_end($pid);
 }
 
-print "Testing iptables (IPv4/IPv6).\n";
-system "/bin/sh $basedir/iptables-load";
-test_tables();
-system "/bin/sh $basedir/iptables-flush";
+if ($test_iptables) {
+    print "Testing iptables (IPv4/IPv6).\n";
+    system "/bin/sh $basedir/iptables-load";
+    test_tables();
+    system "/bin/sh $basedir/iptables-flush";
+}
 
 if ($test_nft) {
     print "Testing nftables (IPv4/IPv6).\n";
diff --git a/tests/sctp/test b/tests/sctp/test
index 1170921..0f017e8 100755
--- a/tests/sctp/test
+++ b/tests/sctp/test
@@ -33,7 +33,7 @@  BEGIN {
         plan skip_all => "SCTP not supported";
     }
     else {
-        $test_count = 75;
+        $test_count = 67;
 
         # Set up a GRE tunnel over loopback to ensure we have enough addresses
         # for the ASCONF tests.
@@ -74,6 +74,15 @@  BEGIN {
             $test_calipso = 1;
         }
 
+        # Determine if kernel has legacy iptables support
+        $test_iptables = 0;
+
+        $rc = system("modprobe ip_tables 2>/dev/null");
+        if ( $rc == 0 ) {
+            $test_count += 8;
+            $test_iptables = 1;
+        }
+
         # Determine if nftables has secmark support
         $test_nft = 0;
 
@@ -903,10 +912,12 @@  sub test_tables {
     server_end($pid);
 }
 
-print "# Testing iptables (IPv4/IPv6).\n";
-system "/bin/sh $basedir/iptables-load";
-test_tables();
-system "/bin/sh $basedir/iptables-flush";
+if ($test_iptables) {
+    print "# Testing iptables (IPv4/IPv6).\n";
+    system "/bin/sh $basedir/iptables-load";
+    test_tables();
+    system "/bin/sh $basedir/iptables-flush";
+}
 
 if ($test_nft) {
     print "# Testing nftables (IPv4/IPv6).\n";