[PATCH nf-next v4 6/6] selftests: netfilter: nft_flowtable.sh: Add SIT flowtable selftest
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: 2026-07-03 14:11:35
Also in:
linux-arm-kernel, linux-kselftest, linux-mediatek, netfilter-devel
Subsystem:
kernel selftest framework, netfilter, networking [general], the rest · Maintainers:
Shuah Khan, Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Similar to IPIP, IP6IP6 and IPv4 over IPv6, introduce specific selftest for SIT flowtable sw acceleration in nft_flowtable.sh Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> --- tools/testing/selftests/net/netfilter/config | 1 + .../selftests/net/netfilter/nft_flowtable.sh | 45 ++++++++++++++++++++++ 2 files changed, 46 insertions(+)
diff --git a/tools/testing/selftests/net/netfilter/config b/tools/testing/selftests/net/netfilter/config
index c3c121b6f300..a212b9edbcd9 100644
--- a/tools/testing/selftests/net/netfilter/config
+++ b/tools/testing/selftests/net/netfilter/config@@ -35,6 +35,7 @@ CONFIG_IP_SCTP=m CONFIG_IPV6=y CONFIG_IPV6_MULTIPLE_TABLES=y CONFIG_IPV6_TUNNEL=m +CONFIG_IPV6_SIT=m CONFIG_IP_VS=m CONFIG_IP_VS_PROTO_TCP=y CONFIG_IP_VS_RR=m
diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
index b14c80c6e372..46bd080108be 100755
--- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
+++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh@@ -597,6 +597,10 @@ ip -net "$nsr1" addr add 192.168.210.1/24 dev tun6 ip -net "$nsr1" addr add fee1:3::1/64 dev tun6 nodad ip netns exec "$nsr1" sysctl net.ipv4.conf.tun6.forwarding=1 > /dev/null +ip -net "$nsr1" link add name sit1 type sit local 192.168.10.1 remote 192.168.10.2 ttl 255 +ip -net "$nsr1" link set sit1 up +ip -net "$nsr1" addr add fe01:3::1/64 dev sit1 nodad + ip -net "$nsr2" link add name tun0 type ipip local 192.168.10.2 remote 192.168.10.1 ip -net "$nsr2" link set tun0 up ip -net "$nsr2" addr add 192.168.100.2/24 dev tun0
@@ -608,6 +612,10 @@ ip -net "$nsr2" addr add 192.168.210.2/24 dev tun6 ip -net "$nsr2" addr add fee1:3::2/64 dev tun6 nodad ip netns exec "$nsr2" sysctl net.ipv4.conf.tun6.forwarding=1 > /dev/null +ip -net "$nsr2" link add name sit1 type sit local 192.168.10.2 remote 192.168.10.1 ttl 255 +ip -net "$nsr2" link set sit1 up +ip -net "$nsr2" addr add fe01:3::2/64 dev sit1 nodad + ip -net "$nsr1" route change default via 192.168.100.2 ip -net "$nsr2" route change default via 192.168.100.1
@@ -622,6 +630,7 @@ ip -6 -net "$ns2" route add default via dead:2::1 ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun0 accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun6 accept' +ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif sit1 accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward \ 'meta oif "veth0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
@@ -648,6 +657,19 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "IP4IP6 tunnel"; then ret=1 fi +ip -6 -net "$nsr1" route delete default +ip -6 -net "$nsr1" route add default via fe01:3::2 +ip -6 -net "$nsr2" route delete default +ip -6 -net "$nsr2" route add default via fe01:3::1 + +if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then + echo "PASS: flow offload for ns1/ns2 SIT tunnel" +else + echo "FAIL: flow offload for ns1/ns2 with SIT tunnel" 1>&2 + ip netns exec "$nsr1" nft list ruleset + ret=1 +fi + # Create vlan tagged devices for IPIP traffic. ip -net "$nsr1" link add link veth1 name veth1.10 type vlan id 10 ip -net "$nsr1" link set veth1.10 up
@@ -672,6 +694,11 @@ ip -6 -net "$nsr1" route delete default ip -6 -net "$nsr1" route add default via fee1:5::2 ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun6.10 accept' +ip -net "$nsr1" link add name sit1.10 type sit local 192.168.20.1 remote 192.168.20.2 ttl 255 +ip -net "$nsr1" link set sit1.10 up +ip -net "$nsr1" addr add fe01:5::1/64 dev sit1.10 nodad +ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif sit1.10 accept' + ip -net "$nsr2" link add link veth0 name veth0.10 type vlan id 10 ip -net "$nsr2" link set veth0.10 up ip -net "$nsr2" addr add 192.168.20.2/24 dev veth0.10
@@ -689,6 +716,11 @@ ip -net "$nsr2" link set tun6.10 up ip -net "$nsr2" addr add 192.168.220.2/24 dev tun6.10 ip -net "$nsr2" addr add fee1:5::2/64 dev tun6.10 nodad ip netns exec "$nsr2" sysctl net.ipv4.conf.tun6/10.forwarding=1 > /dev/null + +ip -net "$nsr2" link add name sit1.10 type sit local 192.168.20.2 remote 192.168.20.1 ttl 255 +ip -net "$nsr2" link set sit1.10 up +ip -net "$nsr2" addr add fe01:5::2/64 dev sit1.10 nodad + ip -6 -net "$nsr2" route delete default ip -6 -net "$nsr2" route add default via fee1:5::1
@@ -715,6 +747,19 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "IP4IP6 tunnel over vlan"; then ret=1 fi +ip -6 -net "$nsr1" route delete default +ip -6 -net "$nsr1" route add default via fe01:5::2 +ip -6 -net "$nsr2" route delete default +ip -6 -net "$nsr2" route add default via fe01:5::1 + +if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then + echo "PASS: flow offload for ns1/ns2 SIT tunnel over vlan" +else + echo "FAIL: flow offload for ns1/ns2 with SIT tunnel over vlan" 1>&2 + ip netns exec "$nsr1" nft list ruleset + ret=1 +fi + # Restore the previous configuration ip -net "$nsr1" route change default via 192.168.10.2 ip -net "$nsr2" route change default via 192.168.10.1
--
2.55.0