[PATCH bpf-next] selftests/bpf: fix ct status check in bpf_nf selftests

Check properly the connection tracking entry status configured running
bpf_ct_change_status kfunc.
Remove unnecessary IPS_CONFIRMED status configuration since it is
already done during entry allocation.

Fixes: 6eb7fba007a7 ("selftests/bpf: Add tests for new nf_conntrack kfuncs")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
 tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 4 ++--
 tools/testing/selftests/bpf/progs/test_bpf_nf.c | 8 +++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
index 544bf90ac2a7..903d16e3abed 100644
--- a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c

@@ -111,8 +111,8 @@ static void test_bpf_nf_ct(int mode)
 	/* allow some tolerance for test_delta_timeout value to avoid races. */
 	ASSERT_GT(skel->bss->test_delta_timeout, 8, "Test for min ct timeout update");
 	ASSERT_LE(skel->bss->test_delta_timeout, 10, "Test for max ct timeout update");
-	/* expected status is IPS_SEEN_REPLY */
-	ASSERT_EQ(skel->bss->test_status, 2, "Test for ct status update ");
+	/* expected status is IPS_CONFIRMED | IPS_SEEN_REPLY */
+	ASSERT_EQ(skel->bss->test_status, 0xa, "Test for ct status update ");
 	ASSERT_EQ(skel->data->test_exist_lookup, 0, "Test existing connection lookup");
 	ASSERT_EQ(skel->bss->test_exist_lookup_mark, 43, "Test existing connection lookup ctmark");
 end:

diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c b/tools/testing/selftests/bpf/progs/test_bpf_nf.c
index 2722441850cc..a3b9d32d1555 100644
--- a/tools/testing/selftests/bpf/progs/test_bpf_nf.c
+++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c

@@ -143,7 +143,6 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
 		struct nf_conn *ct_ins;
 
 		bpf_ct_set_timeout(ct, 10000);
-		bpf_ct_set_status(ct, IPS_CONFIRMED);
 
 		ct_ins = bpf_ct_insert_entry(ct);
 		if (ct_ins) {

@@ -156,8 +155,11 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
 				bpf_ct_change_timeout(ct_lk, 10000);
 				test_delta_timeout = ct_lk->timeout - bpf_jiffies64();
 				test_delta_timeout /= CONFIG_HZ;
-				test_status = IPS_SEEN_REPLY;
-				bpf_ct_change_status(ct_lk, IPS_SEEN_REPLY);
+
+				bpf_ct_change_status(ct_lk,
+						     IPS_CONFIRMED | IPS_SEEN_REPLY);
+				test_status = ct_lk->status;
+
 				bpf_ct_release(ct_lk);
 				test_succ_lookup = 0;
 			}

-- 
2.37.3

On Wed, Sep 7, 2022 at 3:56 AM Lorenzo Bianconi [off-list ref] wrote:

Why do we use 0xa instead of IPS_CONFIRMED | IPS_SEEN_REPLY?
To avoid dependency on the header file?

Thanks,
Song

On Wed, Sep 7, 2022 at 3:56 AM Lorenzo Bianconi [off-list ref] wrote:

quoted

Check properly the connection tracking entry status configured running
bpf_ct_change_status kfunc.
Remove unnecessary IPS_CONFIRMED status configuration since it is
already done during entry allocation.

Fixes: 6eb7fba007a7 ("selftests/bpf: Add tests for new nf_conntrack kfuncs")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
 tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 4 ++--
 tools/testing/selftests/bpf/progs/test_bpf_nf.c | 8 +++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
index 544bf90ac2a7..903d16e3abed 100644
--- a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c

@@ -111,8 +111,8 @@ static void test_bpf_nf_ct(int mode)
        /* allow some tolerance for test_delta_timeout value to avoid races. */
        ASSERT_GT(skel->bss->test_delta_timeout, 8, "Test for min ct timeout update");
        ASSERT_LE(skel->bss->test_delta_timeout, 10, "Test for max ct timeout update");
-       /* expected status is IPS_SEEN_REPLY */
-       ASSERT_EQ(skel->bss->test_status, 2, "Test for ct status update ");
+       /* expected status is IPS_CONFIRMED | IPS_SEEN_REPLY */
+       ASSERT_EQ(skel->bss->test_status, 0xa, "Test for ct status update ");

Why do we use 0xa instead of IPS_CONFIRMED | IPS_SEEN_REPLY?
To avoid dependency on the header file?

nope, thx for reporting it. I will fix it in v2.

Regards,
Lorenzo

Thanks,
Song