Anton Danilov wrote:
> Add a selftest to verify that FOU-encapsulated packets addressed to a
> multicast destination are correctly resubmitted to the inner protocol
> handler (GRE) via the UDP multicast delivery path. Both IPv4 and IPv6
> paths are tested.
>
> The test creates two network namespaces connected by a veth pair with
> a FOU/GRETAP (IPv4) and FOU/ip6gretap (IPv6) tunnel using multicast
> remote addresses (239.0.0.1 and ff0e::1). Ping is sent through each
> tunnel and received packets are counted on the receiver's tunnel
> interface.
>
> The veth pair is created directly inside the namespaces to avoid
> possible name collisions with devices in the root namespace.
>
> Static neighbor entries are configured on the sender because ARP/ND
> replies from the receiver cannot traverse the unidirectional multicast
> tunnel back to the sender.
>
> The early demux optimization (net.ipv4.ip_early_demux, which controls
> both IPv4 and IPv6) is disabled on the receiver to force packets
> through __udp4_lib_mcast_deliver() / __udp6_lib_mcast_deliver(), which
> is the code path being tested.
>
> Signed-off-by: Anton Danilov <[email protected]>
> Assisted-by: Claude:claude-opus-4-6
> ---
> tools/testing/selftests/net/Makefile | 1 +
> .../testing/selftests/net/fou_mcast_encap.sh | 177 ++++++++++++++++++
> 2 files changed, 178 insertions(+)
> create mode 100755 tools/testing/selftests/net/fou_mcast_encap.sh
>
> diff --git a/tools/testing/selftests/net/Makefile
> b/tools/testing/selftests/net/Makefile
> index 708d960ae07d..7e9ae937cffa 100644
> --- a/tools/testing/selftests/net/Makefile
> +++ b/tools/testing/selftests/net/Makefile
> @@ -39,6 +39,7 @@ TEST_PROGS := \
> fib_rule_tests.sh \
> fib_tests.sh \
> fin_ack_lat.sh \
> + fou_mcast_encap.sh \
> fq_band_pktlimit.sh \
> gre_gso.sh \
> gre_ipv6_lladdr.sh \
> diff --git a/tools/testing/selftests/net/fou_mcast_encap.sh
> b/tools/testing/selftests/net/fou_mcast_encap.sh
> new file mode 100755
> index 000000000000..728513d55db4
> --- /dev/null
> +++ b/tools/testing/selftests/net/fou_mcast_encap.sh
> @@ -0,0 +1,177 @@
> +#!/bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +#
> +# Test that UDP encapsulation (FOU) correctly handles packet resubmit
> +# when packets are delivered via the multicast UDP delivery path.
> +#
> +# When a FOU-encapsulated packet arrives with a multicast destination IP,
> +# __udp4_lib_mcast_deliver() / __udp6_lib_mcast_deliver() must resubmit
> +# it to the inner protocol handler (e.g., GRE) rather than consuming it.
> +# This test verifies both IPv4 and IPv6 paths by creating a FOU/GRETAP
> +# tunnel with a multicast remote address and sending ping through it.
> +#
> +# The early demux optimization can mask this issue by routing packets via
> +# the unicast path (udp[6]_unicast_rcv_skb), so we disable it to force
> +# packets through the multicast delivery function.
> +
> +source lib.sh
> +
> +NSENDER=""
> +NRECV=""
> +
> +FOU_PORT4=4797
> +FOU_PORT6=4798
> +MCAST4=239.0.0.1
> +MCAST6=ff0e::1
> +
> +TUN4_S=192.168.99.1
> +TUN4_R=192.168.99.2
> +TUN6_S=2001:db8:99::1
> +TUN6_R=2001:db8:99::2
> +
> +cleanup() {
> + cleanup_all_ns
> +}
> +
> +trap cleanup EXIT
> +
> +setup_common() {
> + setup_ns NSENDER NRECV
> +
> + # Create veth pair directly inside namespaces to avoid name
> + # collisions with devices in the root namespace.
> + ip link add veth_s netns "$NSENDER" type veth \
> + peer name veth_r netns "$NRECV"
> +
> + ip -n "$NSENDER" link set veth_s up
> + ip -n "$NRECV" link set veth_r up
> +
> + # Same sysctl controls early demux for both IPv4 and IPv6.
> + ip netns exec "$NRECV" sysctl -wq net.ipv4.ip_early_demux=0
> +}
> +
> +setup_ipv4() {
> + ip -n "$NSENDER" addr add 10.0.0.1/24 dev veth_s
> + ip -n "$NRECV" addr add 10.0.0.2/24 dev veth_r
> +
> + # Join multicast group on receiver
> + ip -n "$NRECV" addr add "$MCAST4/32" dev veth_r autojoin
> +
> + ip -n "$NSENDER" route add 239.0.0.0/8 dev veth_s
> + ip -n "$NRECV" route add 239.0.0.0/8 dev veth_r
> +
> + # Sender: GRETAP with FOU encap (no FOU listener needed on TX side)
> + ip -n "$NSENDER" link add eoudp4 type gretap \
> + remote "$MCAST4" local 10.0.0.1 \
> + encap fou encap-sport "$FOU_PORT4" encap-dport "$FOU_PORT4" \
> + key "$MCAST4"
> + ip -n "$NSENDER" link set eoudp4 up
> + ip -n "$NSENDER" addr add "$TUN4_S/24" dev eoudp4
> +
> + # Receiver: FOU listener + GRETAP
> + ip netns exec "$NRECV" ip fou add port "$FOU_PORT4" ipproto 47
> + ip -n "$NRECV" link add eoudp4 type gretap \
> + remote "$MCAST4" local 10.0.0.2 \
> + encap fou encap-sport "$FOU_PORT4" encap-dport "$FOU_PORT4" \
> + key "$MCAST4"
> + ip -n "$NRECV" link set eoudp4 up
> + ip -n "$NRECV" addr add "$TUN4_R/24" dev eoudp4
> +
> + # Static neigh on sender: ARP replies cannot traverse the
> + # unidirectional multicast tunnel.
> + local recv_mac
> + recv_mac=$(ip -n "$NRECV" link show eoudp4 | awk '/ether/{print $2}')
> + ip -n "$NSENDER" neigh add "$TUN4_R" lladdr "$recv_mac" dev eoudp4
> +}
> +
> +setup_ipv6() {
> + # Skip cleanly if IPv6 is not available in the running kernel.
> + [ -e /proc/sys/net/ipv6 ] || return "$ksft_skip"
> + modprobe -q fou6 || return "$ksft_skip"
Is the equivalent not needed for fou?
More importantly, this means we need to add CONFIG_IPV6_FOU to
tools/testing/selftests/net/config
> +
> + ip -n "$NSENDER" addr add 2001:db8::1/64 dev veth_s nodad
> + ip -n "$NRECV" addr add 2001:db8::2/64 dev veth_r nodad
> +
> + # Join multicast group on receiver
> + ip -n "$NRECV" addr add "$MCAST6/128" dev veth_r autojoin
> +
> + ip -n "$NSENDER" -6 route add ff00::/8 dev veth_s
> + ip -n "$NRECV" -6 route add ff00::/8 dev veth_r
> +
> + # Sender: ip6gretap with FOU encap
> + ip -n "$NSENDER" link add eoudp6 type ip6gretap \
> + remote "$MCAST6" local 2001:db8::1 \
> + encap fou encap-sport "$FOU_PORT6" encap-dport "$FOU_PORT6" \
> + key 42
> + ip -n "$NSENDER" link set eoudp6 up
> + ip -n "$NSENDER" addr add "$TUN6_S/64" dev eoudp6 nodad
> +
> + # Receiver: FOU listener (IPv6) + ip6gretap
> + ip netns exec "$NRECV" ip fou add port "$FOU_PORT6" ipproto 47 -6
> + ip -n "$NRECV" link add eoudp6 type ip6gretap \
> + remote "$MCAST6" local 2001:db8::2 \
> + encap fou encap-sport "$FOU_PORT6" encap-dport "$FOU_PORT6" \
> + key 42
> + ip -n "$NRECV" link set eoudp6 up
> + ip -n "$NRECV" addr add "$TUN6_R/64" dev eoudp6 nodad
> +
> + # Static neigh on sender: neighbor discovery cannot traverse the
> + # unidirectional multicast tunnel.
> + local recv_mac
> + recv_mac=$(ip -n "$NRECV" link show eoudp6 | awk '/ether/{print $2}')
> + ip -n "$NSENDER" neigh add "$TUN6_R" lladdr "$recv_mac" dev eoudp6
I think these two functions can probably be deduplicated easily. But I
may be wrong, e.g., if there are too many nodad, autojoin, etc special
cases to have to take care of.. Fine to leave as is too.
> +}
> +
> +get_rx_packets() {
> + local dev="$1"
> +
> + ip -n "$NRECV" -s link show "$dev" | awk '/RX:/{getline; print $2}'
> +}
> +
> +run_ping_test() {
> + local family="$1"
> + local dev="$2"
> + local dst="$3"
> + local count=100
> + local rx_before rx_after rx_delta
> +
> + # Warmup: let any initial broadcast/ND traffic settle
> + ip netns exec "$NSENDER" ping "$family" -c 1 -W 1 "$dst" \
> + >/dev/null 2>&1
> + sleep 1
> +
> + rx_before=$(get_rx_packets "$dev")
> + ip netns exec "$NSENDER" ping "$family" -c $count -W 1 "$dst" \
> + >/dev/null 2>&1
Pass -i 0.01 to speed this up?
> + sleep 1
> + rx_after=$(get_rx_packets "$dev")
> +
> + rx_delta=$((rx_after - rx_before))
> +
> + if [ "$rx_delta" -ge "$count" ]; then
> + echo "PASS: received $rx_delta/$count packets"
> + return "$ksft_pass"
> + elif [ "$rx_delta" -gt 0 ]; then
> + echo "FAIL: only $rx_delta/$count packets received"
> + return "$ksft_fail"
> + else
> + echo "FAIL: 0/$count packets received"
> + return "$ksft_fail"
> + fi
> +}
> +
> +ret=0
> +
> +echo "TEST: FOU/GRETAP IPv4 multicast encapsulation resubmit"
> +setup_common
> +setup_ipv4
> +run_ping_test -4 eoudp4 "$TUN4_R" || ret=$?
> +
> +echo "TEST: FOU/GRETAP IPv6 multicast encapsulation resubmit"
> +if setup_ipv6; then
> + run_ping_test -6 eoudp6 "$TUN6_R" || ret=$?
> +else
> + echo "SKIP: IPv6 unavailable"
Use KSFT_SKIP for such cases.
> +fi
> +
> +exit $ret
> --
> 2.47.3
>
