From patchwork Wed Oct 14 05:43:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Baffo X-Patchwork-Id: 5469 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:5249:b0:8d7:ebbe:b250 with SMTP id e9csp1478204mag; Tue, 13 Oct 2026 22:43:39 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvByvmiVMmNxRbIG/mWFsmdXLv9G155kMFliqV4GyxaP2TOGLxk2/g1dD/Temxewu1mWBKiGqq5PB8Dw=@openvpn.net X-Received: by 2002:a05:6820:809:b0:6f6:847f:9271 with SMTP id 006d021491bc7-6f6847f9b37mr6249587eaf.61.1791956619307; Tue, 13 Oct 2026 22:43:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791956619; cv=none; d=google.com; s=arc-20260327; b=YknCuOKsA0NCEFH8//Jf4VWoRFtPuQyUScy2mLw1yO5+a9BLlDzVgqgA3kurbl3JF1 dmKTXF4wglmmFEU8lP7cLXM/l5nXqBkm64R7ch5Mv8OIrXbRAEe8MyjjRHq8sND75ClP 6i2hOFQG83RK1VASoOuqGHxkNEHGcYaziPbQz8kPkulzBqqI+eBX57Nz21z2YsvdZE59 iWjrROnxa3D/Cw9aWvlBs1BA6oBqR5C3BkaaopI5mRTd08zwf/NqwPF16TK/41O8mxYm OwzfhYEvPgrvIY9cbdS9zAvUxmXbHLqZXCsppCs/nsSxhOFJ7tQSQuZ6KTAqgP4yrqBC tuRA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=FySI0BTdG81M3sUc2bKGlSwqIHjMTaz8BrO3oL/KqK8=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=NbcN1LxEDoAKNHDwt+bqZRaAlKmx0PjHWv4ff47SJ2VQjxHKV/rKyeadI3tDnGGI+/ J+mXbAud1Xtr80eGWdflJZ80z6wL4d5rTlAvWC/UalQVjN1uX3hL6P/8dRmbwYvgSCZ+ xLFqvvAt5EtK3Imj6+QfWQyObqaayhs2jZNe6cNVkCRA72Fl/5qhdrKobRmuou52FrAZ R0bZEWIwgygWzwBdLcejuiVFTBK8TiXo1sNWdFbAxyD8J86YaPq2bPzjayaPCLHDG9SI aIh+A1BUmNM6/FlWikr5zzWLv3XU0Qpi8HZ461WidUw9tUZ4N4ucFasfnM17L7XIzqRP Y+Pw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Pr7V9CMh; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=V4Y1EODw; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=RBw07dkT; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b="I37iby/X"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 006d021491bc7-6f565d0da5dsi10923194eaf.5.2026.10.13.22.43.38 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Oct 2026 22:43:39 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Pr7V9CMh; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=V4Y1EODw; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=RBw07dkT; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b="I37iby/X"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=FySI0BTdG81M3sUc2bKGlSwqIHjMTaz8BrO3oL/KqK8=; b=Pr7V9CMhiB4vrsKsFvd2Nc+6CS gn9Na71OV3efeE+g1wBwx8kEME0sTNM2Z1z41YuJqsm1Sv+DTHthO0u/7HYALADF28JFwePh1iMz8 QLvF7b1KDezqD7n7+JBs5rdbJoKyb4eOndVsCbwgpEOPYY9eb50F8bF6/FdBRW7XJJHo=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1xGrly-0007x4-AL; Wed, 14 Oct 2026 05:43:30 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1xGrlw-0007wv-2s for openvpn-devel@lists.sourceforge.net; Wed, 14 Oct 2026 05:43:28 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=yllz3wSfJ88c9dRyDVXP8ClZXjNFqeN3nV5Pkpjh57A=; b=V4Y1EODwCC+CfhhYmoQ2E07qD8 jZ0KxFl0sm0DFHnKeoNq6hJzqoAXDJgOMyFrZASvTS0u1TDb2PcWteQq8QhA0w8hJC3vkUrqJKiWP IeqhV8ftn4sn22oZtUs93Jjev7CsAPAdHZ21a65LNQlb77C5Y0v7epTW9SmxXkr10ZzA=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=yllz3wSfJ88c9dRyDVXP8ClZXjNFqeN3nV5Pkpjh57A=; b=RBw07dkTTVKu9rmSBZOHeqDtM3 MskwS72ZvbLnKB6njjjwcL6P7F+A6cwm9Tm5nUy76FEDPO5vkRmX1129/36eBTo0nw1rrlw2AdNJW hrgpUaHKPHr14FMf+2lA6VC0B8sZ85PPpTuKHNP/2LHc6BqIXFcw8pAeLe70cKdDvND0=; Received: from mout-b-201.mailbox.org ([195.10.208.61]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1xGrlr-0000tS-Sg for openvpn-devel@lists.sourceforge.net; Wed, 14 Oct 2026 05:43:28 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-201.mailbox.org (Postfix) with ESMTPS id 4j4Kql5M9kzLmHV; Wed, 14 Oct 2026 07:43:15 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1791956595; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yllz3wSfJ88c9dRyDVXP8ClZXjNFqeN3nV5Pkpjh57A=; b=I37iby/XPgc+hYxtzZr0exte5dFzf9jMqSpcYB2HPo0Iow804rJgoKO2LfuWXLTsaGZrjJ K7JDEKo8s54ZY+eqBQ1oFZk2rLY1Dknjhjeahk9H8JzUbBgOvYGonG5hiQBy7JYNheJf+d 4A7FRGoR7nlbsKq5FR59g4T4aAPTuFlWdxMquuEEC4UtBcEYJgC3aKGiGCpJSDjDlpA7+5 3bp+OtJ3N9oRJT2EjWb6TXPqEL+3LbmCk24qr6CRQZKwy7u5QUqS7dAtskKZT+2/fqucYn KFoV7+eXJqJTdHaAXb20C5NAYA22dn1qTKTrV/t9EUSUPS/mvbb0lRRyvVoumw== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of marco@mandelbit.com designates 2001:67c:2050:b231:465::2 as permitted sender) smtp.mailfrom=marco@mandelbit.com From: Marco Baffo To: openvpn-devel@lists.sourceforge.net Date: Wed, 14 Oct 2026 07:43:11 +0200 Message-ID: <20261014054311.352210-2-marco@mandelbit.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261014054311.352210-1-marco@mandelbit.com> References: <20261014054311.352210-1-marco@mandelbit.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 4j4Kql5M9kzLmHV X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Add a test stage that verifies the ovpn module forwards broadcast (IPv4) and multicast (IPv4/v6) packets to all active peers. For each mode we start tcpdump on every client peer, send a single ping from peer0 to the broadcast/multicast address, and verify all peers captured the packet. Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URI: mandelbit.com] [URI: test.sh] -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1xGrlr-0000tS-Sg Subject: [Openvpn-devel] [PATCH ovpn net-next 2/2] ovpn: add broadcast and multicast selftests X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1879002704423073196 X-GMAIL-MSGID: 1879002704423073196 Add a test stage that verifies the ovpn module forwards broadcast (IPv4) and multicast (IPv4/v6) packets to all active peers. For each mode we start tcpdump on every client peer, send a single ping from peer0 to the broadcast/multicast address, and verify all peers captured the packet. Assign link-local addresses explicitly for the IPv6 multicast test so that ping to ff02::1 has a valid source address. Signed-off-by: Marco Baffo --- tools/testing/selftests/net/ovpn/test.sh | 88 +++++++++++++++++++++++- 1 file changed, 86 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/ovpn/test.sh b/tools/testing/selftests/net/ovpn/test.sh index 9b5610837032f..8614a12a5f4a0 100755 --- a/tools/testing/selftests/net/ovpn/test.sh +++ b/tools/testing/selftests/net/ovpn/test.sh @@ -56,6 +56,89 @@ ovpn_prepare_network() { done } +ovpn_run_mbcast_test() ( + local label="$1" + local destination="$2" + local filter="$3" + local capture_dir + local deadline + local p + local ret=0 + local -a pids=() + + shift 3 + capture_dir=$(mktemp -d) || return 1 + trap 'kill "${pids[@]}" 2>/dev/null || true + wait "${pids[@]}" 2>/dev/null || true + rm -rf "${capture_dir}"' EXIT + trap 'exit 1' INT TERM + + ovpn_log "Testing ${label}:" + # Allow five seconds for startup, plus time to send and capture the ping. + deadline=$((SECONDS + 5)) + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + : >"${capture_dir}/${p}" || return 1 + LC_ALL=C timeout 10 ip netns exec "ovpn_peer${p}" \ + tcpdump --immediate-mode -p -Q in -ni "tun${p}" -c 1 \ + "${filter}" >/dev/null 2>"${capture_dir}/${p}" & + pids[p]=$! + done + + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + while ! grep -q "listening on tun${p}," "${capture_dir}/${p}"; do + if ! kill -0 "${pids[p]}" 2>/dev/null || + ((SECONDS >= deadline)); then + printf '# %s: capture not ready on peer%s\n' \ + "${label}" "${p}" + cat "${capture_dir}/${p}" + return 1 + fi + sleep 0.1 + done + done + + ovpn_cmd_mayfail "send ${label} ping from peer0" \ + ip netns exec ovpn_peer0 ping "$@" -qc 1 -w 3 -I tun0 \ + "${destination}" + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + if ! wait "${pids[p]}"; then + printf '# %s: capture failed on peer%s\n' "${label}" "${p}" + cat "${capture_dir}/${p}" + ret=1 + fi + unset 'pids[p]' + done + + return "${ret}" +) + +ovpn_run_mbcast_tests() { + local filter4='icmp and src host 5.5.5.1 and icmp[icmptype] == icmp-echo' + local p + local ret=0 + + ovpn_run_mbcast_test "broadcast" 5.5.5.255 \ + "${filter4} and dst host 5.5.5.255" -b || return 1 + ovpn_run_mbcast_test "IPv4 multicast" 224.0.0.1 \ + "${filter4} and dst host 224.0.0.1" || return 1 + + for p in $(seq 0 "${OVPN_NUM_PEERS}"); do + ovpn_cmd_ok "configure IPv6 address on peer${p}" \ + ip -n "ovpn_peer${p}" addr add fe80::$((p + 1))/64 \ + dev tun${p} scope link nodad + done + # ping sends echo requests without IPv6 extension headers. + ovpn_run_mbcast_test "IPv6 multicast" ff02::1 \ + 'icmp6 and src host fe80::1 and dst host ff02::1 and ip6[40] == 128' -6 || ret=1 + for p in $(seq 0 "${OVPN_NUM_PEERS}"); do + ovpn_cmd_ok "remove IPv6 address on peer${p}" \ + ip -n "ovpn_peer${p}" addr del fe80::$((p + 1))/64 \ + dev tun${p} + done + + return "${ret}" +} + ovpn_run_basic_traffic() { local p local header1 @@ -293,9 +376,9 @@ trap ovpn_stage_err ERR ktap_print_header if [ "${OVPN_FLOAT}" == "1" ]; then - ktap_set_plan 13 + ktap_set_plan 14 else - ktap_set_plan 12 + ktap_set_plan 13 fi ovpn_cleanup @@ -303,6 +386,7 @@ modprobe -q ovpn || true ovpn_run_stage "setup network topology" ovpn_prepare_network ovpn_run_stage "run baseline data traffic" ovpn_run_basic_traffic +ovpn_run_stage "run multi/broadcast traffic" ovpn_run_mbcast_tests ovpn_run_stage "run LAN traffic behind peer1" ovpn_run_lan_traffic [ "${OVPN_FLOAT}" == "1" ] && ovpn_run_stage "run floating peer checks" \ ovpn_run_float_mode