From patchwork Mon Oct 26 15:38:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Baffo X-Patchwork-Id: 5508 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:ea99:b0:8dc:5c83:a4ec with SMTP id ov25csp2910971mab; Mon, 26 Oct 2026 08:38:51 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvByH85rxQ2xPThcxM2o3NemsrGiq7LAobNH4HDO6lueAjPBZw6Q8H9/Tx0jObPoXkQAeJvRD1YoLxoY=@openvpn.net X-Received: by 2002:a05:6820:a292:20b0:6f8:2e98:cfcb with SMTP id 006d021491bc7-70ba0eea7c2mr2488539eaf.48.1793029131555; Mon, 26 Oct 2026 08:38:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793029131; cv=none; d=google.com; s=arc-20260327; b=ayQsUMSOfPytK6vwLkQ+QCARUYNQ0N7XP25uXFs42ro8RTZQXv2Eiab6tVwx8yPcnM HB/YIwYdlBSUoZUyLS+NihKE2p56yVQMEnx/5+L5t7I0cF+6RDW+wOuT6dJWpq1FGbz9 RBcsyna6bc6TtawFYwShMAUOIu9IJnNb4sK765oXxgI5BnMrLY60QQKWWiWIqsKIKCJW fXd9AOGKForyQV7jVpVnPm9VTbtoJ6VJEic3yAN9Q/YINz6aMChHKE8ZQoe0ee+JL4Y1 kthULghU0+RBPDFcZbemwl7/1t6xCxZsL97pdA5lrzBalhSg+VrbxW6JSV4StSCy0B09 w6ww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=50EJxZCP+BGcr6dcoyLnbpEsrwKbKFqCZmSjEk818+w=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=O0RBNLbaR9D+EUsLnukIB/MAVZxMYuCWMzspHqW0Gej7BjQfX6k18H/zzjD1BFJXLS 0Dj4sxY2+Ni8z43n4FYzFRla63L4Tyus0Tcq1194t0mwZUretcF8shiXqU8b+D9U1I/q 5A0wiJfCj8r9mA+yLTIKrGhEUXvYUGvRamwKy8w22yHeEyA1MWIspmMkrefKlsuX22+x +33whp09zGhJgWQ0rY/Uds8B5vTmauxROo7oRHLfVV8DJ/bygvFJrrwWIOsJE4cZ7jJ7 m9iX68TK2Sw6mvYQhf4bBVn48oNn0kUc63w7yP0UnewwS/q8nNFGJ8g0cA8eGB2VJ0sf d81g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=fztq4qhE; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=BsSlKkWI; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="GY32lQ//"; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=saQEMAoS; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-850fb9312c2si11740558a34.39.2026.10.26.08.38.51 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Oct 2026 08:38:51 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=fztq4qhE; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=BsSlKkWI; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="GY32lQ//"; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=saQEMAoS; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=50EJxZCP+BGcr6dcoyLnbpEsrwKbKFqCZmSjEk818+w=; b=fztq4qhEtAIUwI bLedu/oKTDssXB9yw5rLGrGx01cC9eeLsiF9JaJSes3RBE8s+ceQxkb7VwwvXc8NGwRkwAlidu3pt QjjJoz2Hk0JyMV/sVMU/+b71bnCjIikegSU6mY8WGV4mZKb5+Po71hVlwK+7VQJxb6lecN007qK2a 0jk=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xLMmd-000000006aU-0iTA; Mon, 26 Oct 2026 15:38:47 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xLMma-000000006aB-2hzM for openvpn-devel@lists.sourceforge.net; Mon, 26 Oct 2026 15:38:45 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Nva0q9RzXLz8ZFj5KZrbzs1a+PEGJdbvtTSP1q/xJLo=; b=BsSlKkWIAsRDKtcekqGU02QEgs VnnXkURv5PQ7Lq0ZN1l0vwWJpGojPBYoZtNbijTJf43KctrthA/FBULbCyR2p8njj33T0d/nxWeHC in8UXXC38dnkE6w3/HHgJAKLct5+zIxxN7OWMjmdpd2CYRIClgvJVPgRtS+4Xpv1pzmk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Nva0q9RzXLz8ZFj5KZrbzs1a+PEGJdbvtTSP1q/xJLo=; b=GY32lQ//d9zMP5hhmV9Ck+ifQf xHEQmifr7kjzsrUbWD31OxM8SCQwv26JnP9AwPPR+cQ+HvXfIlKWpgkRwn6k6BAG/wW1/r1xwWmUq VPOk4/BzoGAv7bO1wB6TV4+7flvNr4Q4LKZF8JynIgje+nHrbKERtNamwZrNZN7099QI=; Received: from mout-b-210.mailbox.org ([195.10.208.40]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xLMmY-0000000045t-22XM for openvpn-devel@lists.sourceforge.net; Mon, 26 Oct 2026 15:38:44 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-210.mailbox.org (Postfix) with ESMTPS id 4jCyT63qxgzFpl3; Mon, 26 Oct 2026 16:38:34 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1793029114; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Nva0q9RzXLz8ZFj5KZrbzs1a+PEGJdbvtTSP1q/xJLo=; b=saQEMAoSoxcPBlS2KyARf0C+DOCaFpKEemgZX0cBruy+0v+quiju3eh/heky4jpeYO87Cq bO8K0iDaoAl07EY93XZucBX6ziEqYMRmmxb6bnfWjmX8y/Q78nOcJEhUmNjHLHDpK/bEmm gQ5cLVaKSJ/rInWdediCILnDP9WC0Ye8kOz9qHo1KM8FCZ+LWYSaJKSH6YQz23NiMH7Gxy b7eUNdehiJpSg0dggaN8CeCLwb+r7rZg+Ly4hkwOlY74PFe6ZQsQpStmtjkiblj36G3tJT oe/o7tU4vb/lzBF5vIcc+HLAgzCl87JCqk8JDCH3iqk3ExeynZ88eY7C9s0C0g== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of marco@mandelbit.com designates 2001:67c:2050:b231:465::2 as permitted sender) smtp.mailfrom=marco@mandelbit.com From: Marco Baffo To: openvpn-devel@lists.sourceforge.net Date: Mon, 26 Oct 2026 16:38:29 +0100 Message-ID: <20261026153829.1821226-2-marco@mandelbit.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261026153829.1821226-1-marco@mandelbit.com> References: <20261026153829.1821226-1-marco@mandelbit.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 4jCyT63qxgzFpl3 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Add a test stage that verifies the ovpn module forwards broadcast (IPv4) and multicast (IPv4/v6) packets to all active peers. For each mode we start tcpdump on every client peer, send a single ping from peer0 to the broadcast/multicast address, and verify all peers captured the packet. Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [195.10.208.40 listed in list.dnswl.org] -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1xLMmY-0000000045t-22XM Subject: [Openvpn-devel] [PATCH ovpn net-next v3 2/2] ovpn: add broadcast and multicast selftests X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880127314754909069 X-GMAIL-MSGID: 1880127314754909069 Add a test stage that verifies the ovpn module forwards broadcast (IPv4) and multicast (IPv4/v6) packets to all active peers. For each mode we start tcpdump on every client peer, send a single ping from peer0 to the broadcast/multicast address, and verify all peers captured the packet. Assign link-local addresses explicitly for the IPv6 multicast test so that ping to ff02::1 has a valid source address. Signed-off-by: Marco Baffo --- No change in v3. Changes in v2: - Shortened lines longer than 80 chars - Changed ping -w 3 with -W 1 in ovpn_run_mbcast_test() to save time tools/testing/selftests/net/ovpn/test.sh | 92 +++++++++++++++++++++++- 1 file changed, 90 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/ovpn/test.sh b/tools/testing/selftests/net/ovpn/test.sh index 9b5610837032f..ca222ff69b2c2 100755 --- a/tools/testing/selftests/net/ovpn/test.sh +++ b/tools/testing/selftests/net/ovpn/test.sh @@ -56,6 +56,93 @@ ovpn_prepare_network() { done } +ovpn_run_mbcast_test() ( + local label="$1" + local destination="$2" + local filter="$3" + local capture_dir + local deadline + local p + local ret=0 + local -a pids=() + + shift 3 + capture_dir=$(mktemp -d) || return 1 + trap 'kill "${pids[@]}" 2>/dev/null || true + wait "${pids[@]}" 2>/dev/null || true + rm -rf "${capture_dir}"' EXIT + trap 'exit 1' INT TERM + + ovpn_log "Testing ${label}:" + # allow 5 seconds for startup, plus time to send and capture the ping. + deadline=$((SECONDS + 5)) + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + : >"${capture_dir}/${p}" || return 1 + LC_ALL=C timeout 10 ip netns exec "ovpn_peer${p}" \ + tcpdump --immediate-mode -p -Q in -ni "tun${p}" -c 1 \ + "${filter}" >/dev/null 2>"${capture_dir}/${p}" & + pids[p]=$! + done + + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + while ! grep -q "listening on tun${p}," \ + "${capture_dir}/${p}"; do + if ! kill -0 "${pids[p]}" 2>/dev/null || + ((SECONDS >= deadline)); then + printf '# %s: capture not ready on peer%s\n' \ + "${label}" "${p}" + cat "${capture_dir}/${p}" + return 1 + fi + sleep 0.1 + done + done + + ovpn_cmd_mayfail "send ${label} ping from peer0" \ + ip netns exec ovpn_peer0 ping "$@" -qc 1 -W 1 -I tun0 \ + "${destination}" + for p in $(seq 1 "${OVPN_NUM_PEERS}"); do + if ! wait "${pids[p]}"; then + printf '# %s: capture failed on peer%s\n' "${label}" \ + "${p}" + cat "${capture_dir}/${p}" + ret=1 + fi + unset 'pids[p]' + done + + return "${ret}" +) + +ovpn_run_mbcast_tests() { + local filter4='icmp and src host 5.5.5.1 and + icmp[icmptype] == icmp-echo' + local p + local ret=0 + + ovpn_run_mbcast_test "broadcast" 5.5.5.255 \ + "${filter4} and dst host 5.5.5.255" -b || return 1 + ovpn_run_mbcast_test "IPv4 multicast" 224.0.0.1 \ + "${filter4} and dst host 224.0.0.1" || return 1 + + for p in $(seq 0 "${OVPN_NUM_PEERS}"); do + ovpn_cmd_ok "configure IPv6 address on peer${p}" \ + ip -n "ovpn_peer${p}" addr add fe80::$((p + 1))/64 \ + dev tun${p} scope link nodad + done + # ping sends echo requests without IPv6 extension headers. + ovpn_run_mbcast_test "IPv6 multicast" ff02::1 \ + 'icmp6 and src host fe80::1 and dst host ff02::1 and + ip6[40] == 128' -6 || ret=1 + for p in $(seq 0 "${OVPN_NUM_PEERS}"); do + ovpn_cmd_ok "remove IPv6 address on peer${p}" \ + ip -n "ovpn_peer${p}" addr del fe80::$((p + 1))/64 \ + dev tun${p} + done + + return "${ret}" +} + ovpn_run_basic_traffic() { local p local header1 @@ -293,9 +380,9 @@ trap ovpn_stage_err ERR ktap_print_header if [ "${OVPN_FLOAT}" == "1" ]; then - ktap_set_plan 13 + ktap_set_plan 14 else - ktap_set_plan 12 + ktap_set_plan 13 fi ovpn_cleanup @@ -303,6 +390,7 @@ modprobe -q ovpn || true ovpn_run_stage "setup network topology" ovpn_prepare_network ovpn_run_stage "run baseline data traffic" ovpn_run_basic_traffic +ovpn_run_stage "run multi/broadcast traffic" ovpn_run_mbcast_tests ovpn_run_stage "run LAN traffic behind peer1" ovpn_run_lan_traffic [ "${OVPN_FLOAT}" == "1" ] && ovpn_run_stage "run floating peer checks" \ ovpn_run_float_mode