github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests: netfilter: add bridge tunnel flowtable regression

Browse Source 
Add a nft_flowtable.sh regression test for the bridge direct-xmit plus
IPIP/IP6IP6 underlay configuration that reproduces the reachable
DIRECT+tunnel tuple combination exercised by the flowtable fix.

The test reuses the existing bridge and tunnel topology, installs flow
rules for the tunnel egress and bridge reply path, verifies IPv4 and
IPv6 forwarding, and checks the flowtable counters after the transfer.

Signed-off-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Zhengyang Chen 2026-06-22 18:10:27 +08:00 committed by Florian Westphal
parent f62c41b491
commit bd0bdfae1c
1 changed files with 55 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
tools/testing/selftests/net/netfilter/nft_flowtable.sh
View File

@ -736,6 +736,61 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "on bridge"; then
ret=1
fi
if ip -net "$nsr1" link show tun0 > /dev/null 2>&1 &&
ip -net "$nsr2" link show tun0 > /dev/null 2>&1; then
ip -net "$nsr1" route change default via 192.168.100.2
ip -net "$nsr2" route change default via 192.168.100.1
ip -6 -net "$nsr1" route delete default
ip -6 -net "$nsr1" route add default via fee1:3::2
ip -6 -net "$nsr2" route delete default
ip -6 -net "$nsr2" route add default via fee1:3::1
ip -net "$ns2" route add default via 10.0.2.1
ip -6 -net "$ns2" route add default via dead:2::1
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun0" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun6" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "veth0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "br0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun0" accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun6" accept'
ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
if test_tcp_forwarding "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
check_counters "bridge + IPIP tunnel"
else
echo "FAIL: flow offload for ns1/ns2 with bridge + IPIP tunnel" 1>&2
ip netns exec "$nsr1" nft list ruleset
ret=1
fi
if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then
check_counters "bridge + IP6IP6 tunnel"
else
echo "FAIL: flow offload for ns1/ns2 with bridge + IP6IP6 tunnel" 1>&2
ip netns exec "$nsr1" nft list ruleset
ret=1
fi
ip -net "$nsr1" route change default via 192.168.10.2
ip -net "$nsr2" route change default via 192.168.10.1
ip -net "$ns2" route del default via 10.0.2.1
ip -6 -net "$nsr1" route delete default
ip -6 -net "$nsr1" route add default via fee1:2::2
ip -6 -net "$nsr2" route delete default
ip -6 -net "$nsr2" route add default via fee1:2::1
ip -6 -net "$ns2" route del default via dead:2::1
else
echo "SKIP: bridge + tunnel flowtable regression (tun0 missing)"
[ "$ret" -eq 0 ] && ret=$ksft_skip
fi
# Another test:
# Add bridge interface br0 to Router1, with NAT and VLAN.