aboutgitcodebugslistschat
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* passt, pasta: Namespace-based sandboxing, defer seccomp policy applicationStefano Brivio2022-02-213-15/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To reach (at least) a conceptually equivalent security level as implemented by --enable-sandbox in slirp4netns, we need to create a new mount namespace and pivot_root() into a new (empty) mountpoint, so that passt and pasta can't access any filesystem resource after initialisation. While at it, also detach IPC, PID (only for passt, to prevent vulnerabilities based on the knowledge of a target PID), and UTS namespaces. With this approach, if we apply the seccomp filters right after the configuration step, the number of allowed syscalls grows further. To prevent this, defer the application of seccomp policies after the initialisation phase, before the main loop, that's where we expect bad things to happen, potentially. This way, we get back to 22 allowed syscalls for passt and 34 for pasta, on x86_64. While at it, move #syscalls notes to specific code paths wherever it conceptually makes sense. We have to open all the file handles we'll ever need before sandboxing: - the packet capture file can only be opened once, drop instance numbers from the default path and use the (pre-sandbox) PID instead - /proc/net/tcp{,v6} and /proc/net/udp{,v6}, for automatic detection of bound ports in pasta mode, are now opened only once, before sandboxing, and their handles are stored in the execution context - the UNIX domain socket for passt is also bound only once, before sandboxing: to reject clients after the first one, instead of closing the listening socket, keep it open, accept and immediately discard new connection if we already have a valid one Clarify the (unchanged) behaviour for --netns-only in the man page. To actually make passt and pasta processes run in a separate PID namespace, we need to unshare(CLONE_NEWPID) before forking to background (if configured to do so). Introduce a small daemon() implementation, __daemon(), that additionally saves the PID file before forking. While running in foreground, the process itself can't move to a new PID namespace (a process can't change the notion of its own PID): mention that in the man page. For some reason, fork() in a detached PID namespace causes SIGTERM and SIGQUIT to be ignored, even if the handler is still reported as SIG_DFL: add a signal handler that just exits. We can now drop most of the pasta_child_handler() implementation, that took care of terminating all processes running in the same namespace, if pasta started a shell: the shell itself is now the init process in that namespace, and all children will terminate once the init process exits. Issuing 'echo $$' in a detached PID namespace won't return the actual namespace PID as seen from the init namespace: adapt demo and test setup scripts to reflect that. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/perf/passt_tcp: Drop iperf3 window size for host-to-guest testsStefano Brivio2022-02-011-10/+10
| | | | | | | | | | With a recent 5.15 kernel, passing a huge window size to iperf3 with lower MTUs makes iperf3 stop sending packets after a few seconds -- I haven't investigated this in detail, but the window size will be adjusted dynamically anyway and not passing it doesn't actually affect throughput, so simply drop the option. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/distro/ubuntu: Skip apt-get update for 16.04 on powerpcStefano Brivio2022-01-301-1/+3
| | | | | | | | Some recent change to xenial-updates broke dependencies for gcc, it can't be installed anymore. Skipping apt-get update leaves gcc dependencies in a consistent state, though. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/distro: Avoid race between display of ns_msg and netcat exitingStefano Brivio2022-01-304-0/+4
| | | | | | | | | The shell might report 'nc -6 -l -p 9999 > /tmp/ns_msg' as done even after the subsequent 'echo' is done: wait one second before reading out /tmp/ns_msg, to ensure we read that instead of the "Done" message. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test: Add basic documentation about test suite, and cool-retro-term profileStefano Brivio2022-01-281-0/+104
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test: Add distribution tests for several architectures and kernel versionsStefano Brivio2022-01-285-0/+1297
| | | | | | | | | | | | | | | The new tests check build and a simple case with pasta sending a short message in both directions (namespace to init, init to namespace). Tests cover a mix of Debian, Fedora, OpenSUSE and Ubuntu combinations on aarch64, i386, ppc64, ppc64le, s390x, x86_64. Builds tested starting from approximately glibc 2.19, gcc 4.7, and actual functionality approximately from 4.4 kernels, glibc 2.25, gcc 4.8, all the way up to current glibc/gcc/kernel versions. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/lib/test: Introduce 'def' directive for frequently used patternsStefano Brivio2022-01-281-229/+267
| | | | | | | | | For distribution tests, we'll repeat some tests frequently. Add a 'def' directive that starts a block, ended by 'endef', whose execution can then be triggered by simply giving its name as a directive itself. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/lib/term: Allow for a wider variety of prompt characters in pane_wait()Stefano Brivio2022-01-281-7/+10
| | | | | | | | We might have highlighting and slightly different prompts across different distributions, allow a more reasonable set of prompt strings to be accepted as prompts. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/lib/video: Drop -preset ultrafast from ffmpeg argumentsStefano Brivio2022-01-261-1/+1
| | | | | | | It's not really needed on a reasonably powered CPU, and makes the video contents way less readable. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/lib/setup: Don't rely on IFS to properly separate qemu argumentsStefano Brivio2022-01-261-32/+32
| | | | | | ...this gets needlessly annoying while playing with test cases. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* perf/passt_udp: Lower failure throughput thresholds with big MTUsStefano Brivio2022-01-261-4/+4
| | | | | | | The throughput results in this test look quite variable, slightly lower figures look reasonable anyway. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/two_guests: Drop stray spaces after sleep directivesStefano Brivio2022-01-261-4/+4
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo/pasta: Don't wait for pasta to return to a promptStefano Brivio2022-01-261-1/+1
| | | | | | | Debug information might be printed after a prompt is seen, just wait those 3 seconds and be done with it. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* README, perf_report: Markdown and CSS fixesStefano Brivio2021-10-221-7/+8
| | | | | | Updating md2html on the server needs a few adjustments. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/two_guests: Fix sleep command for DADStefano Brivio2021-10-211-1/+2
| | | | | | | | | An inline comment prefixed by a space doesn't mean the space is dropped, and sleep(1) will get a blank in its argument. Move the comment on its own line. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/two_guests: Let the guests end DAD before starting the DHCPv6 clientStefano Brivio2021-10-211-0/+1
| | | | | | | They'll start DAD as we bring up the interface, and the DHCPv6 client might be unreasonably delayed if we start it too early. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Add cppcheck target, test, and address resulting warningsStefano Brivio2021-10-211-1/+5
| | | | | | | ...mostly false positives, but a number of very relevant ones too, in tcp_get_sndbuf(), tcp_conn_from_tap(), and siphash PREAMBLE(). Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/perf: Actually load passt enough to test UDP performanceStefano Brivio2021-10-213-31/+34
| | | | | | | | | With recent improvements, we're not CPU-bound at all while testing UDP performance. Give the VM more memory and CPUs, forward two additional ports, start up to four threads in parallel, and give single iperf3 threads higher bandwidth targets. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/lib/test: Wait a bit longer before terminating iperf3 processesStefano Brivio2021-10-211-3/+3
| | | | | | | Sometimes tests run a few seconds longer than expected, wait a few more seconds. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/perf: Try sourcing maximum scaling frequency from cpufreqStefano Brivio2021-10-214-4/+14
| | | | | | | On most recent CPUs, that's a better indication of all-core turbo frequency, or non-turbo frequency, than /proc/cpuinfo. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Add clang-tidy Makefile target and test, take care of warningsStefano Brivio2021-10-201-0/+18
| | | | | | | Most are just about style and form, but a few were actually serious mistakes (NDP-related). Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/demo: Don't wait for # after pasta is started by perf reportStefano Brivio2021-10-202-2/+2
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* LICENSES: Add license text files, add missing notices, fix SPDX tagsStefano Brivio2021-10-201-0/+3
| | | | | | | | | | SPDX tags don't replace license files. Some notices were missing and some tags were not according to the SPDX specification, too. Now reuse --lint from the REUSE tool (https://reuse.software/) passes. Reported-by: Martin Hauke <mardnh@gmx.de> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* Makefile: Install man pages to /usr/share/man instead of /usr/manStefano Brivio2021-10-201-6/+6
| | | | | Reported-by: Martin Hauke <mardnh@gmx.de> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* perf/passt_udp: Don't overshoot UDP bandwidth excessively on larger MTUsStefano Brivio2021-10-191-2/+2
| | | | | | | ...performance with 64KiB MTUs might look worse than with 9000bytes on some configurations. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* perf/passt_tcp: Don't exceed typical L3 cache sizes with buffersStefano Brivio2021-10-191-8/+8
| | | | | | ...we might see misleading rate drops with larger MTUs otherwise. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/perf: Use CPU frequency from /proc/cpuinfo instead of cpupower(1)Stefano Brivio2021-10-194-8/+8
| | | | | | Get it to work also in nested virtualisation environments. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo/pasta: Swap init>ns and ns>init flowsStefano Brivio2021-10-151-24/+24
| | | | | | ...make those short performance tests actually match table headers. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test: Drop debugging left-overs in lib/utilStefano Brivio2021-10-141-4/+0
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* pasta: Allow specifying paths and names of namespacesGiuseppe Scrivano2021-10-071-1/+1
| | | | | | | | | | | | | | | | | | Based on a patch from Giuseppe Scrivano, this adds the ability to: - specify paths and names of target namespaces to join, instead of a PID, also for user namespaces, with --userns - request to join or create a network namespace only, without entering or creating a user namespace, with --netns-only - specify the base directory for netns mountpoints, with --nsrun-dir Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> [sbrivio: reworked logic to actually join the given namespaces when they're not created, implemented --netns-only and --nsrun-dir, updated pasta demo script and man page] Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/lib/term: Export PCAP and DEBUG variables for tmux sessions globallyStefano Brivio2021-10-051-0/+1
| | | | | | Otherwise, this would depend on the local tmux configuration. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test/lib/setup: Increase --max-stackframe in commented-out valgrind commandStefano Brivio2021-10-051-1/+1
| | | | | | ...so that I don't keep fighting with this for pasta clone() calls. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo/pasta: Enter the right directory before issuing perf report -gStefano Brivio2021-10-041-1/+1
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test: Record CI and demo videos in Xvfb by default, fix demo setup sequenceStefano Brivio2021-09-296-8/+54
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test: Add CI/demo scriptsStefano Brivio2021-09-2731-0/+4816
Not really quick, definitely dirty. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 01:31:49 +0000