| Message ID | 20221012151802.11339-1-phil@nwl.cc |
|---|---|
| Headers | show |
| Series | Speed up iptables-test.py | expand |
On Wed, Oct 12, 2022 at 05:17:50PM +0200, Phil Sutter wrote: [...] > I had this in mind for a while now and finally got around to do it: When > testing an extensions/*.t file with iptables-tests.py, act in a "batch" > mode applying all rules at once and checking the expected output in one > go, thereby reducing the overhead per test file to a single > iptables-restore and iptables-save call each. This was a bit optimistic, > but the result is still significant - on my rather slow testing VM, a > full iptables-tests.py run completes in ~7min instead of ~30min (yes, > it's slow). FTR: I tested this once more on a not entirely broken machine which managed to complete a full testrun in 3min (i.e. a tenth of my VM). With this patch applied, the same run took merely 40s - so still significant. Series applied meanwhile. Cheers, Phil
Changes since v1: - Add fallout NFQUEUE patch 1 - Adjust iptables-test.py enhancement as suggested by Jan, details in patch 2 - Avoid changing what extensions print, this is a separate discussion - instead update expected output accordingly Original cover letter text: I had this in mind for a while now and finally got around to do it: When testing an extensions/*.t file with iptables-tests.py, act in a "batch" mode applying all rules at once and checking the expected output in one go, thereby reducing the overhead per test file to a single iptables-restore and iptables-save call each. This was a bit optimistic, but the result is still significant - on my rather slow testing VM, a full iptables-tests.py run completes in ~7min instead of ~30min (yes, it's slow). See patch 1 for the implementation details. As a side-effect, rule existence checking became much stricter, so the remaining patches in this series deal with eliminating those differences: * Patch 2 avoids having to add '-j CONTINUE' to almost all ebtables rules. * Patches 3-10 adjust expected output to reality, mostly adding content the script didn't care about since the old 'output.find(<rule>)' worked fine as long as the output *started* like '<rule>'. * Patch 11 Changes output by omitting an obvious default value, so a real functional change. * Patch 12 drops another default value (from NFQUEUE target) I'm not sure we should keep. So patches are roughly sorted by my confidence in correctness. Please have (at least) a close look at the last two, I don't want to break iptables for anyone just to keep test files small. Phil Sutter (12): extensions: NFQUEUE: Document queue-balance limitation tests: iptables-test: Implement fast test mode tests: iptables-test: Cover for obligatory -j CONTINUE in ebtables tests: *.t: Fix expected output for simple calls tests: *.t: Fix for hexadecimal output tests: libebt_redirect.t: Plain redirect prints with trailing whitespace tests: libxt_length.t: Fix odd use-case output tests: libxt_recent.t: Add missing default values tests: libxt_tos.t, libxt_TOS.t: Add missing masks in output tests: libebt_vlan.t: Drop trailing whitespace from rules tests: libxt_connlimit.t: Add missing default values tests: *.t: Add missing all-one's netmasks to expected output extensions/libebt_log.t | 2 +- extensions/libebt_nflog.t | 2 +- extensions/libebt_redirect.t | 2 +- extensions/libebt_vlan.t | 4 +- extensions/libip6t_NETMAP.t | 2 +- extensions/libip6t_REJECT.t | 2 +- extensions/libipt_NETMAP.t | 2 +- extensions/libipt_REJECT.t | 2 +- extensions/libxt_CONNMARK.t | 8 +- extensions/libxt_DSCP.t | 2 +- extensions/libxt_MARK.t | 4 +- extensions/libxt_NFQUEUE.c | 2 +- extensions/libxt_NFQUEUE.man | 2 + extensions/libxt_NFQUEUE.t | 7 +- extensions/libxt_TOS.t | 12 +-- extensions/libxt_connlimit.t | 12 +-- extensions/libxt_connmark.t | 4 +- extensions/libxt_dscp.t | 2 +- extensions/libxt_length.t | 2 +- extensions/libxt_mark.t | 2 +- extensions/libxt_recent.t | 4 +- extensions/libxt_tos.t | 8 +- iptables-test.py | 163 ++++++++++++++++++++++++++++++++++- 23 files changed, 207 insertions(+), 45 deletions(-)