Count the forwarded TCP packets that leave with priority 0:3 and those that leave with none, first without a priority and then with "meta priority set 0:3" ahead of "flow add". With the priority set, every packet must carry it, including those the flowtable forwards. Runs for IPv4 and IPv6.
Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Julius Bairaktaris <[email protected]> --- .../selftests/net/netfilter/nft_flowtable.sh | 110 ++++++++++++++++++ 1 file changed, 110 insertions(+) diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh index 449c518bd947..73c7b1ec2208 100755 --- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh +++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh @@ -458,6 +458,106 @@ fi check_dscp "dscp_fwd" "$pmtu" } +check_priority() +{ + local what="$1" + local pmtu="$2" + local ok=1 + + local counter + counter=$(ip netns exec "$nsr1" nft reset counter netdev priocheck prio3 | grep packets) + local pc3=${counter%*bytes*} + pc3=${pc3#*packets} + + counter=$(ip netns exec "$nsr1" nft reset counter netdev priocheck prio0 | grep packets) + local pc0=${counter%*bytes*} + pc0=${pc0#*packets} + + local failmsg="FAIL: pmtu $pmtu: $what counters do not match, expected" + + case "$what" in + "prio_none") + if [ "$pc3" -gt 0 ] || [ "$pc0" -eq 0 ]; then + echo "$failmsg prio3 == 0, prio0 > 0, but got $pc3,$pc0" 1>&2 + ret=1 + ok=0 + fi + ;; + "prio_fwd") + if [ "$pc3" -eq 0 ] || [ "$pc0" -gt 0 ]; then + echo "$failmsg prio3 > 0, prio0 == 0, but got $pc3,$pc0" 1>&2 + ret=1 + ok=0 + fi + ;; + *) + echo "FAIL: pmtu $pmtu: unknown priority check $what" 1>&2 + ret=1 + ok=0 + esac + + if [ "$ok" -eq 1 ] ;then + echo "PASS: $what: priority packet counters match" + fi +} + +test_tcp_forwarding_set_priority() +{ + local pmtu="$3" + local proto="$4" + local dstip="$5" + local dstport="$6" + local lret=0 + +ip netns exec "$nsr1" nft -f - <<EOF +table netdev priocheck { + counter prio0 { } + counter prio3 { } + + chain egress0 { + type filter hook egress device "veth0" priority 0; policy accept + meta l4proto tcp meta priority 0:3 counter name "prio3" + meta l4proto tcp meta priority none counter name "prio0" + } + + chain egress1 { + type filter hook egress device "veth1" priority 0; policy accept + meta l4proto tcp meta priority 0:3 counter name "prio3" + meta l4proto tcp meta priority none counter name "prio0" + } +} +EOF + if [ $? -ne 0 ]; then + echo "SKIP: Could not load netdev:egress for veth0 and veth1" + return 0 + fi + + if ! test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"; then + lret=1 + fi + check_priority "prio_none" "$pmtu" + + # The flow stores the priority set before it is added, so the packets + # the flowtable forwards leave with it too, in both directions. +ip netns exec "$nsr1" nft -f - <<EOF +table inet prioset { + chain forward { + type filter hook forward priority -1; policy accept + meta priority set 0:3 + } +} +EOF + if ! test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"; then + lret=1 + fi + check_priority "prio_fwd" "$pmtu" + + ip netns exec "$nsr1" nft delete table inet prioset + ip netns exec "$nsr1" nft delete table netdev priocheck + + return $lret +} + test_tcp_forwarding_nat() { local nsa="$1" @@ -516,6 +616,11 @@ else ret=1 fi +if ! test_tcp_forwarding_set_priority "$ns1" "$ns2" 0 6 "[dead:2::99]" 12345; then + echo "FAIL: IPv6 flow offload for ns1/ns2 with priority update" 1>&2 + ret=1 +fi + # delete default route, i.e. ns2 won't be able to reach ns1 and # will depend on ns1 being masqueraded in nsr1. # expect ns1 has nsr1 address. @@ -572,6 +677,11 @@ if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 1 4 10.0.2.99 12345; then exit 0 fi +if ! test_tcp_forwarding_set_priority "$ns1" "$ns2" 1 4 10.0.2.99 12345; then + echo "FAIL: flow offload for ns1/ns2 with priority update and pmtu discovery" 1>&2 + ret=1 +fi + ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 ""; then -- 2.53.0
