Re: [PATCH net-next v4 2/2] selftests: net: add FOU multicast encapsulation resubmit test

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Anton Danilov wrote:
> Add a selftest to verify that FOU-encapsulated packets addressed to a
> multicast destination are correctly resubmitted to the inner protocol
> handler (GRE) via the UDP multicast delivery path.
> 
> The test creates two network namespaces connected by a veth pair with
> a FOU/GRETAP tunnel using a multicast remote address (239.0.0.1).
> Ping is sent through the tunnel and received packets are counted on
> the receiver's tunnel interface.
> 
> A static neighbor entry is configured on the sender because ARP
> replies from the receiver cannot traverse the unidirectional multicast
> tunnel back to the sender.
> 
> The early demux optimization (net.ipv4.ip_early_demux) is disabled on
> the receiver to force packets through __udp4_lib_mcast_deliver(),
> which is the code path being tested.
> 
> Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com>
> Assisted-by: Claude:claude-opus-4-6
> ---
>  tools/testing/selftests/net/Makefile          |   1 +
>  .../testing/selftests/net/fou_mcast_encap.sh  | 112 ++++++++++++++++++
>  2 files changed, 113 insertions(+)
>  create mode 100755 tools/testing/selftests/net/fou_mcast_encap.sh
> 
> diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
> index 708d960ae07d..7e9ae937cffa 100644
> --- a/tools/testing/selftests/net/Makefile
> +++ b/tools/testing/selftests/net/Makefile
> @@ -39,6 +39,7 @@ TEST_PROGS := \
>  	fib_rule_tests.sh \
>  	fib_tests.sh \
>  	fin_ack_lat.sh \
> +	fou_mcast_encap.sh \
>  	fq_band_pktlimit.sh \
>  	gre_gso.sh \
>  	gre_ipv6_lladdr.sh \
> diff --git a/tools/testing/selftests/net/fou_mcast_encap.sh b/tools/testing/selftests/net/fou_mcast_encap.sh
> new file mode 100755
> index 000000000000..8db9633f4c28
> --- /dev/null
> +++ b/tools/testing/selftests/net/fou_mcast_encap.sh
> @@ -0,0 +1,112 @@
> +#!/bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +#
> +# Test that UDP encapsulation (FOU) correctly handles packet resubmit
> +# when packets are delivered via the multicast UDP delivery path.
> +#
> +# When a FOU-encapsulated packet arrives with a multicast destination IP,
> +# __udp4_lib_mcast_deliver() must resubmit it to the inner protocol
> +# handler (e.g., GRE) rather than consuming it. This test verifies that
> +# by creating a FOU/GRETAP tunnel with a multicast remote address and
> +# sending ping through it.
> +#
> +# The early demux optimization can mask this issue by routing packets via
> +# the unicast path (udp_unicast_rcv_skb), so we disable it to force
> +# packets through __udp4_lib_mcast_deliver().
> +
> +source lib.sh
> +
> +NSENDER=""
> +NRECV=""
> +
> +cleanup() {
> +	cleanup_all_ns
> +}
> +
> +trap cleanup EXIT
> +
> +setup() {
> +	setup_ns NSENDER NRECV
> +
> +	ip link add veth_s type veth peer name veth_r
> +	ip link set veth_s netns "$NSENDER"
> +	ip link set veth_r netns "$NRECV"

Sashiko points out that names in the root namespace may collide with
other devices. Unexpected here, but it's just as easy to immediately
assign the new veth nodes to the netns. See for instance sctp_vrf.sh.

> +
> +	ip -n "$NSENDER" addr add 10.0.0.1/24 dev veth_s

More importantly, have you also tested IPv6? Can you expand the
test with IPv6.

Again, sashiko points to an important issue: ip_protocol_deliver_rcu
and ip6_protocol_deliver_rcu are not equivalent. From a quick scan it
appears that the latter does not resubmit on negative return code.