From: Florian Westphal <fw@strlen.de>
To: <netdev@vger.kernel.org>
Cc: jhs@mojatatu.com, jiri@resnulli.us, victor@mojatatu.com,
Florian Westphal <fw@strlen.de>
Subject: [PATCH net 3/4] selftests: tc-testing: add act_ct test for ct reset handling
Date: Wed, 19 Aug 2026 22:42:09 +0200 [thread overview]
Message-ID: <20260819204210.23722-4-fw@strlen.de> (raw)
In-Reply-To: <20260819204210.23722-1-fw@strlen.de>
Check that skb->nfct is re-set when pedit munges network or transport
header data, else we feed packets to stack where skb might carry
different or invalid headers compared to what conntrack input has
validated earlier.
Also check MAC modifications keep the ct entry as-is.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Florian Westphal <fw@strlen.de>
---
.../tc-testing/tc-tests/actions/ct.json | 168 ++++++++++++++++++
1 file changed, 168 insertions(+)
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json
index 8ab48def89b6..18a773748358 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json
@@ -742,5 +742,173 @@
"teardown": [
"$TC qdisc del dev $DEV1 clsact"
]
+ },
+ {
+ "id": "c2a9",
+ "name": "Verify conntrack reset after pedit modifies IP protocol",
+ "category": [
+ "actions",
+ "ct",
+ "pedit",
+ "scapy"
+ ],
+ "plugins": {
+ "requires": [
+ "nsPlugin",
+ "scapyPlugin"
+ ]
+ },
+ "setup": [
+ [
+ "$TC qdisc del dev $DEV1 ingress",
+ 0,
+ 1,
+ 2,
+ 255
+ ],
+ "iptables -t raw -F",
+ "iptables -t raw -A PREROUTING -i $DEV1 -p icmp -m conntrack --ctstate INVALID -j DROP",
+ "$TC qdisc add dev $DEV1 ingress"
+ ],
+ "cmdUnderTest": "$TC filter add dev $DEV1 ingress protocol ip prio 1 flower action ct commit pipe action pedit ex munge ip protocol set 1 pipe action csum ip4h continue",
+ "scapy": {
+ "iface": "$DEV0",
+ "count": 1,
+ "packet": "Ether(type=0x800)/IP(src='10.0.0.10',dst='10.0.0.20',proto=6)/TCP(sport=1234,dport=80,flags='S')"
+ },
+ "expExitCode": "0",
+ "verifyCmd": "iptables-save -c -t raw | grep 'ctstate INVALID'",
+ "matchPattern": "^\\[1:40\\]",
+ "matchCount": "1",
+ "teardown": [
+ "$TC qdisc del dev $DEV1 ingress",
+ "iptables -t raw -F"
+ ]
+ },
+ {
+ "id": "d3b8",
+ "name": "Verify conntrack reset after TCP port modification",
+ "category": [
+ "actions",
+ "ct",
+ "pedit",
+ "scapy"
+ ],
+ "plugins": {
+ "requires": [
+ "nsPlugin",
+ "scapyPlugin"
+ ]
+ },
+ "setup": [
+ [
+ "$TC qdisc del dev $DEV1 ingress",
+ 0,
+ 1,
+ 2,
+ 255
+ ],
+ "iptables -t raw -F",
+ "iptables -t raw -A PREROUTING -i $DEV1 -p tcp -m conntrack --ctstate INVALID -j DROP",
+ "$TC qdisc add dev $DEV1 ingress"
+ ],
+ "cmdUnderTest": "$TC filter add dev $DEV1 ingress protocol ip prio 1 flower ip_proto tcp action ct commit pipe action pedit ex munge tcp sport set 9999 pipe",
+ "scapy": {
+ "iface": "$DEV0",
+ "count": 1,
+ "packet": "Ether(type=0x800)/IP(src='10.0.0.10',dst='10.0.0.20')/TCP(sport=1234,dport=80,flags='S')"
+ },
+ "expExitCode": "0",
+ "verifyCmd": "iptables-save -c -t raw | grep 'ctstate INVALID'",
+ "matchCount": "1",
+ "matchPattern": "^\\[1:40\\]",
+ "teardown": [
+ "$TC qdisc del dev $DEV1 ingress",
+ "iptables -t raw -F"
+ ]
+ },
+ {
+ "id": "a1b2",
+ "name": "Verify conntrack NOT reset when pedit modifies only MAC",
+ "category": [
+ "actions",
+ "ct",
+ "pedit",
+ "scapy"
+ ],
+ "plugins": {
+ "requires": [
+ "nsPlugin",
+ "scapyPlugin"
+ ]
+ },
+ "setup": [
+ [
+ "$TC qdisc del dev $DEV1 ingress",
+ 0,
+ 1,
+ 2,
+ 255
+ ],
+ "iptables -t raw -F",
+ "iptables -t raw -A PREROUTING -i $DEV1 -p icmp -m conntrack --ctstate NEW -j DROP",
+ "$TC qdisc add dev $DEV1 ingress"
+ ],
+ "cmdUnderTest": "$TC filter add dev $DEV1 ingress protocol ip prio 1 flower action ct commit pipe action pedit ex munge eth src set 11:22:33:44:55:66 pipe",
+ "scapy": {
+ "iface": "$DEV0",
+ "count": 1,
+ "packet": "Ether(src='aa:bb:cc:dd:ee:ff',type=0x800)/IP(src='10.0.0.11',dst='10.0.0.21')/ICMP()"
+ },
+ "expExitCode": "0",
+ "verifyCmd": "iptables-save -c -t raw | grep 'ctstate NEW'",
+ "matchPattern": "^\\[1:28\\]",
+ "matchCount": "1",
+ "teardown": [
+ "$TC qdisc del dev $DEV1 ingress",
+ "iptables -t raw -F"
+ ]
+ },
+ {
+ "id": "b7f4",
+ "name": "Verify conntrack reset when ETH write extends into IP layer",
+ "category": [
+ "actions",
+ "ct",
+ "pedit",
+ "scapy"
+ ],
+ "plugins": {
+ "requires": [
+ "nsPlugin",
+ "scapyPlugin"
+ ]
+ },
+ "setup": [
+ [
+ "$TC qdisc del dev $DEV1 ingress",
+ 0,
+ 1,
+ 2,
+ 255
+ ],
+ "iptables -t raw -F",
+ "iptables -t raw -A PREROUTING -i $DEV1 -m conntrack --ctstate INVALID -j DROP",
+ "$TC qdisc add dev $DEV1 ingress"
+ ],
+ "cmdUnderTest": "$TC filter add dev $DEV1 ingress protocol ip prio 1 flower action ct commit pipe action pedit ex munge offset 12 u32 set 0x08004500 pipe csum ip4h continue",
+ "scapy": {
+ "iface": "$DEV0",
+ "count": 1,
+ "packet": "Ether(type=0x800)/IP(src='10.0.0.13',dst='10.0.0.23')/ICMP()"
+ },
+ "expExitCode": "0",
+ "verifyCmd": "iptables-save -t raw -c | grep 'ctstate INVALID'",
+ "matchPattern": "^\\[1:28\\]",
+ "matchCount": "1",
+ "teardown": [
+ "$TC qdisc del dev $DEV1 ingress",
+ "iptables -t raw -F"
+ ]
}
]
--
2.54.0
next prev parent reply other threads:[~2026-08-19 20:42 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-19 20:42 [PATCH net 0/4] net/sched: reset conntrack after packet munging Florian Westphal
2026-08-19 20:42 ` [PATCH net 1/4] selftests/tc-testing: pass mp_pm via initialiser Florian Westphal
2026-08-19 20:42 ` [PATCH net 2/4] net/sched: act_pedit: drop conntrack on network/transport header changes Florian Westphal
2026-08-19 20:42 ` Florian Westphal [this message]
2026-08-19 20:42 ` [PATCH net 4/4] net/sched: act_nat: discard any conntrack entry post modification Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260819204210.23722-4-fw@strlen.de \
--to=fw@strlen.de \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=netdev@vger.kernel.org \
--cc=victor@mojatatu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.