Re: [BUG] selftests/net: icmp_redirect.sh: 12 out of 40 test result with [FAIL]

[Mirsad Todorovac]

On 3/18/24 15:42, David Ahern wrote:
> On 3/17/24 8:38 PM, Hangbin Liu wrote:
> > Wild guess, the last change of icmp_redirect is my netns update. Maybe
> > there are something default sysctl settings in netns cause the error?
>
> It is most likely sysctl settings. It would be good to chase those down
> and make sure we have the script setting them.
>
> Mirsad: What OS are you testing with? That script has a verbose option
> (-v) to get more output like the commands run and pause-on-fail (-p) to
> manually debug at that point.

Hi, David,

I am running an Ubuntu 22.04 LTS box, with the iptools upgraded to iproute2-next
tree of March 15th, on the torvalds tree.

Right now I have tried it against the net-next tree, and I get the same result:

# timeout set to 3600
# selftests: net: icmp_redirect.sh
#
# ###########################################################################
# Legacy routing
# ###########################################################################
#
# TEST: IPv4: redirect exception                                      [FAIL]
# TEST: IPv6: redirect exception                                      [ OK ]
# TEST: IPv4: redirect exception plus mtu                             [FAIL]
# TEST: IPv6: redirect exception plus mtu                             [ OK ]
# TEST: IPv4: routing reset                                           [ OK ]
# TEST: IPv6: routing reset                                           [ OK ]
# TEST: IPv4: mtu exception                                           [ OK ]
# TEST: IPv6: mtu exception                                           [ OK ]
# TEST: IPv4: mtu exception plus redirect                             [FAIL]
# TEST: IPv6: mtu exception plus redirect                             [ OK ]
#
# ###########################################################################
# Legacy routing with VRF
# ###########################################################################
#
# TEST: IPv4: redirect exception                                      [FAIL]
# TEST: IPv6: redirect exception                                      [ OK ]
# TEST: IPv4: redirect exception plus mtu                             [FAIL]
# TEST: IPv6: redirect exception plus mtu                             [ OK ]
# TEST: IPv4: routing reset                                           [ OK ]
# TEST: IPv6: routing reset                                           [ OK ]
# TEST: IPv4: mtu exception                                           [ OK ]
# TEST: IPv6: mtu exception                                           [ OK ]
# TEST: IPv4: mtu exception plus redirect                             [FAIL]
# TEST: IPv6: mtu exception plus redirect                             [ OK ]
#
# ###########################################################################
# Routing with nexthop objects
# ###########################################################################
#
# TEST: IPv4: redirect exception                                      [FAIL]
# TEST: IPv6: redirect exception                                      [ OK ]
# TEST: IPv4: redirect exception plus mtu                             [FAIL]
# TEST: IPv6: redirect exception plus mtu                             [ OK ]
# TEST: IPv4: routing reset                                           [ OK ]
# TEST: IPv6: routing reset                                           [ OK ]
# TEST: IPv4: mtu exception                                           [ OK ]
# TEST: IPv6: mtu exception                                           [ OK ]
# TEST: IPv4: mtu exception plus redirect                             [FAIL]
# TEST: IPv6: mtu exception plus redirect                             [ OK ]
#
# ###########################################################################
# Routing with nexthop objects and VRF
# ###########################################################################
#
# TEST: IPv4: redirect exception                                      [FAIL]
# TEST: IPv6: redirect exception                                      [ OK ]
# TEST: IPv4: redirect exception plus mtu                             [FAIL]
# TEST: IPv6: redirect exception plus mtu                             [ OK ]
# TEST: IPv4: routing reset                                           [ OK ]
# TEST: IPv6: routing reset                                           [ OK ]
# TEST: IPv4: mtu exception                                           [ OK ]
# TEST: IPv6: mtu exception                                           [ OK ]
# TEST: IPv4: mtu exception plus redirect                             [FAIL]
# TEST: IPv6: mtu exception plus redirect                             [ OK ]
#
# Tests passed:  28
# Tests failed:  12
# Tests xfailed:   0
not ok 45 selftests: net: icmp_redirect.sh # exit=1

So, it is probably the sysctl you said, but I cannot tell which one.

My /etc/sysctl.conf looks like this (I think something like Libreswan VPN required these
to be redirects turned off):

#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3

###################################################################
# Functions previously found in netbase
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
#net.ipv6.conf.all.forwarding=1

net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.rp_filter = 0


###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
#
# Do not accept IP source route packets (we are not a router)
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
#

###################################################################
# Magic system request Key
# 0=disable, 1=enable all, >1 bitmask of sysrq functions
# See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
# for what other values do
#kernel.sysrq=438

Thank you.

Best regards,
Mirsad

Attachment: sysctl-all.conf.xz
Description: application/xz