[PATCH net-next v2 2/2] selftests/bpf: verify syncookie statistics in tcp_custom_syncookie

Jiayuan Chen
2026-04-11T01:32:51Z

Add read_tcpext_snmp() helper to network_helpers which reads a
TcpExt SNMP counter via nstat, and use it in the tcp_custom_syncookie
test to verify that LINUX_MIB_SYNCOOKIESRECV is incremented and
LINUX_MIB_SYNCOOKIESFAILED stays unchanged across a successful
BPF custom syncookie validation.

The delta is captured between start_server() and accept(), which
covers the full SYN/ACK/cookie-check path for one connection.

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
tools/testing/selftests/bpf/network_helpers.c | 22 +++++++++++++++++++
tools/testing/selftests/bpf/network_helpers.h | 1 +
.../bpf/prog_tests/tcp_custom_syncookie.c | 20 +++++++++++++++++
3 files changed, 43 insertions(+)

diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c
index b82f572641b7..3388dd5112b6 100644
--- a/tools/testing/selftests/bpf/network_helpers.c
+++ b/tools/testing/selftests/bpf/network_helpers.c
@@ -621,6 +621,28 @@ int get_socket_local_port(int sock_fd)
return -1;
}

+int read_tcpext_snmp(const char *name, unsigned long *val)
+{
+ char cmd[128], buf[128];
+ int ret = 0;
+ FILE *f;
+
+ snprintf(cmd, sizeof(cmd),
+ "nstat -az TcpExt%s | awk '/TcpExt/ {print $2}'", name);
+ f = popen(cmd, "r");
+ if (!f)
+ return -errno;
+
+ if (!fgets(buf, sizeof(buf), f)) {
+ ret = ferror(f) ? -errno : -ENODATA;
+ goto out;
+ }
+ *val = strtoul(buf, NULL, 10);
+out:
+ pclose(f);
+ return ret;
+}
+
int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param)
{
struct ifreq ifr = {0};
diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/selftests/bpf/network_helpers.h
index 79a010c88e11..c53cd781df6e 100644
--- a/tools/testing/selftests/bpf/network_helpers.h
+++ b/tools/testing/selftests/bpf/network_helpers.h
@@ -84,6 +84,7 @@ int make_sockaddr(int family, const char *addr_str, __u16 port,
struct sockaddr_storage *addr, socklen_t *len);
char *ping_command(int family);
int get_socket_local_port(int sock_fd);
+int read_tcpext_snmp(const char *name, unsigned long *val);
int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param);
int set_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param);

diff --git a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c
index eaf441dc7e79..6adfb4b892f8 100644
--- a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c
+++ b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c
@@ -91,12 +91,21 @@ static void transfer_message(int sender, int receiver)

static void create_connection(struct test_tcp_custom_syncookie_case *test_case)
{
+ unsigned long recv_before, recv_after;
+ unsigned long failed_before, failed_after;
int server, client, child;

server = start_server(test_case->family, test_case->type, test_case->addr, 0, 0);
if (!ASSERT_NEQ(server, -1, "start_server"))
return;

+ if (!ASSERT_OK(read_tcpext_snmp("SyncookiesRecv", &recv_before),
+ "read SyncookiesRecv before"))
+ goto close_server;
+ if (!ASSERT_OK(read_tcpext_snmp("SyncookiesFailed", &failed_before),
+ "read SyncookiesFailed before"))
+ goto close_server;
+
client = connect_to_fd(server, 0);
if (!ASSERT_NEQ(client, -1, "connect_to_fd"))
goto close_server;
@@ -105,9 +114,20 @@ static void create_connection(struct test_tcp_custom_syncookie_case *test_case)
if (!ASSERT_NEQ(child, -1, "accept"))
goto close_client;

+ if (!ASSERT_OK(read_tcpext_snmp("SyncookiesRecv", &recv_after),
+ "read SyncookiesRecv after"))
+ goto close_child;
+ if (!ASSERT_OK(read_tcpext_snmp("SyncookiesFailed", &failed_after),
+ "read SyncookiesFailed after"))
+ goto close_child;
+
+ ASSERT_EQ(recv_after - recv_before, 1, "SyncookiesRecv delta");
+ ASSERT_EQ(failed_after - failed_before, 0, "SyncookiesFailed delta");
+
transfer_message(client, child);
transfer_message(child, client);

+close_child:
close(child);
close_client:
close(client);
--
2.43.0