Re: [PATCH nf-next] selftests: netfilter: add UDP flowtable offload test

[Florian Westphal <fw@strlen.de>]

jpeska <jpeska@redhat.com> wrote:
> nft_flowtable.sh offloads only TCP, so the UDP flowtable paths never
> run: the UDP tuple lookup, the UDP checksum update, IPv6 source NAT,
> and nf_ct_acct_update behind the flowtable counter flag.
> 
> Add an echo test for IPv4 and IPv6, with and without masquerade. The
> payload must come back intact, the forward chain must see only the
> handshake, and conntrack must mark the flow OFFLOAD and account every
> datagram.

In case you did not see it yet:

https://sashiko.dev/#/patchset/20261109135137.1770507-1-jpeska%40redhat.com

Wrt. the various CONFIG_* comments:

The kfselftests CAN assume that the kernel has the options defined
in selftests/net/netfilter/config , so there is no need to go above and
beyond and tolerate all kinds of stuff being absent.

exit $ksft_skip instead of exit 1 when its clearly a missing
config option is fine, but if its not easy to tell why something
is failing (e.g. nft -f foo.txt when run on kernel that lacks a
particular nftables module but that module is listed in the config
file -- exit 1, no need to start guessing.

$ksft_skip is only ok if there is no doubt whatsoever that the
failure is because of a missing option/feature.

Wrt to NETIF_F_HW_CSUM comment, I think one could start playing
with ethtool and the checksum features (ethtool -k) to check
different combinations.

Might make sense to integrate this script with nft_flowtable.sh
so that tcp can be easily covered too.  Also nft_flowtable.sh
re-runs itself with random mtu sizes, this is also helpful to spot
any MTU (defrag/refrag) problems.

But up to you.