From patchwork Mon Oct 26 14:05:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Baffo X-Patchwork-Id: 5505 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:ea99:b0:8dc:5c83:a4ec with SMTP id ov25csp2777186mab; Mon, 26 Oct 2026 07:05:24 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBxv+Z7XlpZwNoGPhU+LghuEKSo3aovfmAf+Vd2+kcJx7moQiXwWDacHWGoHNiALXneR8wvXD238Udo=@openvpn.net X-Received: by 2002:a05:6808:168c:b0:4cb:ae51:5971 with SMTP id 5614622812f47-55c003216bdmr3928176b6e.32.1793023524586; Mon, 26 Oct 2026 07:05:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793023524; cv=none; d=google.com; s=arc-20260327; b=ZHGkW+ogLqH7hAI3i89wcOeIUqvpevRXRYK27gCBbpsG8ClvBd7fwPgDAOPJogZRDy UI3WH/eXW/wlEOh+mCPkhDaNYAkTNuoMaQucyVvLPbfr8fkX59VLR/BuQZlfJ1VJFL3m McZVooojpLnLyTxsS+5l2DkdZuv3ncGiGm6YV5RDsY2bFWD+tUlbZxwJJpGUuNxbp7e0 lqnrdMaLOjcD0YFYHWLYqNVa0VkJ3cdAl3ohvY6zv074kl2cvvXeJPlR3fDe0Zr4r+9v y2h3FS49ZAdov20FlM0YaFbQNo0dBE5E+3qqutHRPfcoaa9aDO93jWBwvXqeY+n48xcO i19A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=WriUvSZNeov06fERfXxBHGPJyIaUWKmdRDsjkfxuyIE=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=i8WV2jWfktvSBSa7pNIeZr1OciwdwMNOy6hwfZFTZz2t/Awsw6P/Wm00CsoJuP/7e6 XdGaYkqkX9JA4+E66YhbK9MYAPcpUPjoocEmKzo4Uh3PwiqTyAufI6l9mYuaZT/FondY 5pY3ihI6B8X/WJ3LlkvVoOVehl6ghTaKC0wLYx2gUVIxXodK6OqZv5gEIj7/XFcIR19j F2wxCF20woYImcT1+bCKBqP9G314lQv1qHTdIwYT1pQqe/AT8lyPnniYBdMM3ANKa57X V890M2b2uYsriF812joUKeXD9gfD2fQbIM92TT1Q+J8Xku3lhLIfGTbnqStNDk5mybne Guzg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ct0FEW70; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Z43qioz8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=FLlGBadL; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=V9qPy2mj; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5614622812f47-55c04435d61si9249585b6e.101.2026.10.26.07.05.23 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Oct 2026 07:05:24 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ct0FEW70; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=Z43qioz8; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=FLlGBadL; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=V9qPy2mj; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=WriUvSZNeov06fERfXxBHGPJyIaUWKmdRDsjkfxuyIE=; b=Ct0FEW70DDrz8B gEAoNdJstVu78ifgfClJp32SnYReEzHw0JSbLlaPzAYr0hY9cqNmgL45BXORL7qXMA9l++gHmlZUv CJrYSoAKUzDki/hHH+e4DLtT9pms6xwvDfz+UV6o53iXAbMuQkl9ECSxSqOYeUBB8akD8pReoKAyD 8Uw=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xLLKC-000000000w8-2XQq; Mon, 26 Oct 2026 14:05:20 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xLLKB-000000000w0-1gGi for openvpn-devel@lists.sourceforge.net; Mon, 26 Oct 2026 14:05:19 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Qrtk7Lyu9zhVotS1t8CVhf0tjSBrVaB7BEUgPsTLcMQ=; b=Z43qioz8gwS7jCNNit9Zo6W0sP J1Na462kSuyvM3RoNPj9vWtu6vRPEhWUTEGS391wWBLCM/5K3r+56wce/uBdjLxLK2rfuDp7cvTAv edzgqQdwba+n6k3NGlEn+vq4V+LK/zxos34VcR9D7aO5E2REkIl3unNIi02VR0mPzGAs=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Qrtk7Lyu9zhVotS1t8CVhf0tjSBrVaB7BEUgPsTLcMQ=; b=FLlGBadLRMUBm26kaEpuqs5VNe GhSi5ZzJgHpeEuJhWON+AseUA69J1Zt6I7Uxs1Qh7H8VQTiXAi6E2zP8zsVUyNf1uYgVZvP9pgGsU ZgR7kRj9zsua7okM6LGJdKIpkIEJmdQJ/kiFx8Ioz6/gzVcNY4EhKD87v3XcTf+uWHvU=; Received: from mout-b-107.mailbox.org ([195.10.208.47]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xLLK9-000000002zX-0J6G for openvpn-devel@lists.sourceforge.net; Mon, 26 Oct 2026 14:05:19 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-107.mailbox.org (Postfix) with ESMTPS id 4jCwPK3cfpz3y38; Mon, 26 Oct 2026 15:05:09 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1793023509; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Qrtk7Lyu9zhVotS1t8CVhf0tjSBrVaB7BEUgPsTLcMQ=; b=V9qPy2mj6/3aU/19SHNqonaXcLhKDVAibuEHmsPVnd4fXcJZX1n6JWXNkP01PWeJqE2ILy T608KN3QfBBcT1bZK3j6fd9miqfWfVt1f8eGZ7aDGDWp0aBCKuuKiU70/FvFyPhXz+Sp2L Cu0h8ZfBiMZY71fj0CSwqUu+Ja3Eb0QNSgnsy1oGjys+WFFBiuOtthQQnCP1gzMpDMOhOa BX51gKqC/xAod+rQCrNyzL0uMoo6kM+4QhcUueVkHE1Q6QOH/BkLEBVWWmbKTyA+GMBPfs GPSuBAZdPlYDObyYRXjkntuM9mH6MPvlTdHlO003skhu5X0VBiogKmsF4qZr4w== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of marco@mandelbit.com designates 2001:67c:2050:b231:465::1 as permitted sender) smtp.mailfrom=marco@mandelbit.com From: Marco Baffo To: openvpn-devel@lists.sourceforge.net Date: Mon, 26 Oct 2026 15:05:04 +0100 Message-ID: <20261026140504.1786019-2-marco@mandelbit.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261026140504.1786019-1-marco@mandelbit.com> References: <20261026140504.1786019-1-marco@mandelbit.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 4jCwPK3cfpz3y38 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Add a test stage that verifies the ovpn module forwards broadcast (IPv4) and multicast (IPv4/v6) packets to all active peers. For each mode we start tcpdump on every client peer, send a single ping from peer0 to the broadcast/multicast address, and verify all peers captured the packet. Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1xLLK9-000000002zX-0J6G Subject: [Openvpn-devel] [PATCH ovpn net-next v2 2/2] ovpn: add broadcast and multicast selftests X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880121435475705896 X-GMAIL-MSGID: 1880121435475705896 Add a test stage that verifies the ovpn module forwards broadcast (IPv4) and multicast (IPv4/v6) packets to all active peers. For each mode we start tcpdump on every client peer, send a single ping from peer0 to the broadcast/multicast address, and verify all peers captured the packet. Assign link-local addresses explicitly for the IPv6 multicast test so that ping to ff02::1 has a valid source address. Signed-off-by: Marco Baffo --- Changes in v2: - Shortened lines longer than 80 chars - Changed ping -w 3 with -W 1 in ovpn_run_mbcast_test() to save time tools/testing/selftests/net/ovpn/test.sh | 92 +++++++++++++++++++++++- 1 file changed, 90 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/ovpn/test.sh b/tools/testing/selftests/net/ovpn/test.sh index 9b5610837032f..ca222ff69b2c2 100755 --- a/tools/testing/selftests/net/ovpn/test.sh +++ b/tools/testing/selftests/net/ovpn/test.sh @@ -56,6 +56,93 @@ ovpn_prepare_network() { done } +ovpn_run_mbcast_test() ( + local label="$1" + local destination="$2" + local filter="$3" + local capture_dir + local deadline + local p + local ret=0 + local -a pids=() + + shift 3 + capture_dir=$(mktemp -d) || return 1 + trap 'kill "${pids[@]}" 2>/dev/null || true + wait "${pids[@]}" 2>/dev/null || true + rm -rf "${capture_dir}"' EXIT + trap 'exit 1' INT TERM + + ovpn_log "Testing ${label}:" + # allow 5 seconds for startup, plus time to send and capture the ping. + deadline=$((SECONDS + 5)) + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + : >"${capture_dir}/${p}" || return 1 + LC_ALL=C timeout 10 ip netns exec "ovpn_peer${p}" \ + tcpdump --immediate-mode -p -Q in -ni "tun${p}" -c 1 \ + "${filter}" >/dev/null 2>"${capture_dir}/${p}" & + pids[p]=$! + done + + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + while ! grep -q "listening on tun${p}," \ + "${capture_dir}/${p}"; do + if ! kill -0 "${pids[p]}" 2>/dev/null || + ((SECONDS >= deadline)); then + printf '# %s: capture not ready on peer%s\n' \ + "${label}" "${p}" + cat "${capture_dir}/${p}" + return 1 + fi + sleep 0.1 + done + done + + ovpn_cmd_mayfail "send ${label} ping from peer0" \ + ip netns exec ovpn_peer0 ping "$@" -qc 1 -W 1 -I tun0 \ + "${destination}" + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + if ! wait "${pids[p]}"; then + printf '# %s: capture failed on peer%s\n' "${label}" \ + "${p}" + cat "${capture_dir}/${p}" + ret=1 + fi + unset 'pids[p]' + done + + return "${ret}" +) + +ovpn_run_mbcast_tests() { + local filter4='icmp and src host 5.5.5.1 and + icmp[icmptype] == icmp-echo' + local p + local ret=0 + + ovpn_run_mbcast_test "broadcast" 5.5.5.255 \ + "${filter4} and dst host 5.5.5.255" -b || return 1 + ovpn_run_mbcast_test "IPv4 multicast" 224.0.0.1 \ + "${filter4} and dst host 224.0.0.1" || return 1 + + for p in $(seq 0 "${OVPN_NUM_PEERS}"); do + ovpn_cmd_ok "configure IPv6 address on peer${p}" \ + ip -n "ovpn_peer${p}" addr add fe80::$((p + 1))/64 \ + dev tun${p} scope link nodad + done + # ping sends echo requests without IPv6 extension headers. + ovpn_run_mbcast_test "IPv6 multicast" ff02::1 \ + 'icmp6 and src host fe80::1 and dst host ff02::1 and + ip6[40] == 128' -6 || ret=1 + for p in $(seq 0 "${OVPN_NUM_PEERS}"); do + ovpn_cmd_ok "remove IPv6 address on peer${p}" \ + ip -n "ovpn_peer${p}" addr del fe80::$((p + 1))/64 \ + dev tun${p} + done + + return "${ret}" +} + ovpn_run_basic_traffic() { local p local header1 @@ -293,9 +380,9 @@ trap ovpn_stage_err ERR ktap_print_header if [ "${OVPN_FLOAT}" == "1" ]; then - ktap_set_plan 13 + ktap_set_plan 14 else - ktap_set_plan 12 + ktap_set_plan 13 fi ovpn_cleanup @@ -303,6 +390,7 @@ modprobe -q ovpn || true ovpn_run_stage "setup network topology" ovpn_prepare_network ovpn_run_stage "run baseline data traffic" ovpn_run_basic_traffic +ovpn_run_stage "run multi/broadcast traffic" ovpn_run_mbcast_tests ovpn_run_stage "run LAN traffic behind peer1" ovpn_run_lan_traffic [ "${OVPN_FLOAT}" == "1" ] && ovpn_run_stage "run floating peer checks" \ ovpn_run_float_mode