netns test: improve ping test

- Use fping for pinging multiple hosts in parallel.
  Significantly improves test runtime:
  >13 s -> ~200 ms for the negative ping tests.
- Only test network namespaces that are enabled.
  This allows running the netns test with a reduced service set for debugging.
- Remove deprecated services, instead add btcpayserver, spark-wallet

test/tests.nix

@@ -115,6 +115,7 @@ let testEnv = rec {
       nix-bitcoin.netns-isolation.enable = true;
       test.data.netns = config.nix-bitcoin.netns-isolation.netns;
       tests.netns-isolation = true;
+      environment.systemPackages = [ pkgs.fping ];
 
       # This test is rather slow and unaffected by netns settings
       tests.backups = mkForce false;

test/tests.py

@@ -237,40 +237,28 @@ def _():
 # (and their corresponding network namespaces).
 @test("netns-isolation")
 def _():
-    ping_bitcoind = "ip netns exec nb-bitcoind ping -c 1 -w 1"
+    def get_ips(services):
-    ping_nanopos = "ip netns exec nb-nanopos ping -c 1 -w 1"
+        enabled = enabled_tests.intersection(services)
-    ping_nbxplorer = "ip netns exec nb-nbxplorer ping -c 1 -w 1"
+        return " ".join(ip(service) for service in enabled)
 
-    # Positive ping tests (non-exhaustive)
+    def assert_reachable(src, dests):
-    machine.succeed(
+        dest_ips = get_ips(dests)
-        "%s %s &&" % (ping_bitcoind, ip("bitcoind"))
+        if src in enabled_tests and dest_ips:
-        + "%s %s &&" % (ping_bitcoind, ip("clightning"))
+            machine.succeed(f"ip netns exec nb-{src} fping -c1 -t100 {dest_ips}")
-        + "%s %s &&" % (ping_bitcoind, ip("lnd"))
-        + "%s %s &&" % (ping_bitcoind, ip("liquidd"))
-        + "%s %s &&" % (ping_bitcoind, ip("nbxplorer"))
-        + "%s %s &&" % (ping_nbxplorer, ip("btcpayserver"))
-        + "%s %s &&" % (ping_nanopos, ip("lightning-charge"))
-        + "%s %s &&" % (ping_nanopos, ip("nanopos"))
-        + "%s %s" % (ping_nanopos, ip("nginx"))
-    )
 
-    # Negative ping tests (non-exhaustive)
+    def assert_unreachable(src, dests):
+        dest_ips = get_ips(dests)
+        if src in enabled_tests and dest_ips:
             machine.fail(
-        "%s %s ||" % (ping_bitcoind, ip("spark-wallet"))
+                # This fails when no host is reachable within 100 ms
-        + "%s %s ||" % (ping_bitcoind, ip("lightning-loop"))
+                f"ip netns exec nb-{src} fping -c1 -t100 --reachable=1 {dest_ips}"
-        + "%s %s ||" % (ping_bitcoind, ip("lightning-charge"))
-        + "%s %s ||" % (ping_bitcoind, ip("nanopos"))
-        + "%s %s ||" % (ping_bitcoind, ip("nginx"))
-        + "%s %s ||" % (ping_nanopos, ip("bitcoind"))
-        + "%s %s ||" % (ping_nanopos, ip("clightning"))
-        + "%s %s ||" % (ping_nanopos, ip("lnd"))
-        + "%s %s ||" % (ping_nanopos, ip("lightning-loop"))
-        + "%s %s ||" % (ping_nanopos, ip("liquidd"))
-        + "%s %s ||" % (ping_nanopos, ip("electrs"))
-        + "%s %s ||" % (ping_nanopos, ip("spark-wallet"))
-        + "%s %s" % (ping_nanopos, ip("btcpayserver"))
             )
 
+    # These reachability tests are non-exhaustive
+    assert_reachable("bitcoind", ["clightning", "lnd", "liquidd"])
+    assert_unreachable("bitcoind", ["btcpayserver", "spark-wallet", "lightning-loop"])
+    assert_unreachable("btcpayserver", ["bitcoind", "lightning-loop", "liquidd"])
+
     # test that netns-exec can't be run for unauthorized namespace
     machine.fail("netns-exec nb-electrs ip a")