[PATCH v3] selftests/net: add test for IP-in-IPv6 tunneling

[PATCH v3] selftests/net: add test for IP-in-IPv6 tunneling

[Linus Heckemann]

commit 81c734dae203 ("ip6_tunnel: use skb_vlan_inet_prepare() in
__ip6_tnl_rcv()") was fine in and of itself, but its backport to 6.12
(and 6.6) broke IPv4-in-IPv6 tunneling, see [1]. This adds a self-test
for basic IPv4-in-IPv6 and IPv6-in-IPv6 functionality.

[1]: https://lore.kernel.org/all/CAA2RiuSnH_2xc+-W6EnFEG00XjS-dszMq61JEvRjcGS31CBw=g@mail.gmail.com/

Signed-off-by: Linus Heckemann <git@sphalerite.org>
--
Compared to previous version:
* Added DCO as requested by Jakub
* Suppressed output of ping and the expected-to-fail `ip link delete` cleanup invocation as suggested by Jakub
* Added `set -e` as suggested by Hangbin

Not sure about the etiquette regarding the Tested-by line: Ricardo
tested v1 of the patch, I guess I shouldn't add it to a respin?
---
 tools/testing/selftests/net/Makefile      |  1 +
 tools/testing/selftests/net/ip6_tunnel.sh | 44 +++++++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 tools/testing/selftests/net/ip6_tunnel.sh

diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 45c4ea381bc36..5037a344ad826 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -43,6 +43,7 @@ TEST_PROGS := \
 	io_uring_zerocopy_tx.sh \
 	ioam6.sh \
 	ip6_gre_headroom.sh \
+	ip6_tunnel.sh \
 	ip_defrag.sh \
 	ip_local_port_range.sh \
 	ipv6_flowlabel.sh \
diff --git a/tools/testing/selftests/net/ip6_tunnel.sh b/tools/testing/selftests/net/ip6_tunnel.sh
new file mode 100644
index 0000000000000..fe081a5218199
--- /dev/null
+++ b/tools/testing/selftests/net/ip6_tunnel.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# Test that IPv4-over-IPv6 tunneling works.
+
+source lib.sh
+set -e
+
+setup_prepare() {
+  ip link add transport1 type veth peer name transport2
+
+  setup_ns ns1
+  ip link set transport1 netns $ns1
+  ip -n $ns1 address add 2001:db8::1/64 dev transport1 nodad
+  ip -n $ns1 address add 2001:db8::3/64 dev transport1 nodad
+  ip -n $ns1 link set transport1 up
+  ip -n $ns1 link add link transport1 name tunnel4 type ip6tnl mode ipip6 local 2001:db8::1 remote 2001:db8::2
+  ip -n $ns1 address add 172.0.0.1/32 peer 172.0.0.2/32 dev tunnel4
+  ip -n $ns1 link set tunnel4 up
+  ip -n $ns1 link add link transport1 name tunnel6 type ip6tnl mode ip6ip6 local 2001:db8::3 remote 2001:db8::4
+  ip -n $ns1 address add 2001:db8:6::1/64 dev tunnel6
+  ip -n $ns1 link set tunnel6 up
+
+  setup_ns ns2
+  ip link set transport2 netns $ns2
+  ip -n $ns2 address add 2001:db8::2/64 dev transport2 nodad
+  ip -n $ns2 address add 2001:db8::4/64 dev transport2 nodad
+  ip -n $ns2 link set transport2 up
+  ip -n $ns2 link add link transport2 name tunnel4 type ip6tnl mode ipip6 local 2001:db8::2 remote 2001:db8::1
+  ip -n $ns2 address add 172.0.0.2/32 peer 172.0.0.1/32 dev tunnel4
+  ip -n $ns2 link set tunnel4 up
+  ip -n $ns2 link add link transport2 name tunnel6 type ip6tnl mode ip6ip6 local 2001:db8::4 remote 2001:db8::3
+  ip -n $ns2 address add 2001:db8:6::2/64 dev tunnel6
+  ip -n $ns2 link set tunnel6 up
+}
+
+cleanup() {
+  cleanup_all_ns
+  # in case the namespaces haven't been set up yet
+  ip link delete transport1 &>/dev/null || true
+}
+
+trap cleanup EXIT
+setup_prepare
+ip netns exec $ns1 ping -q -W1 -c1 172.0.0.2 >/dev/null
+ip netns exec $ns1 ping -q -W1 -c1 2001:db8:6::2 >/dev/null
-- 
2.52.0

Re: [PATCH v3] selftests/net: add test for IP-in-IPv6 tunneling

[Hangbin Liu]

On Sat, Feb 14, 2026 at 09:05:54AM +0100, Linus Heckemann wrote:
> commit 81c734dae203 ("ip6_tunnel: use skb_vlan_inet_prepare() in
> __ip6_tnl_rcv()") was fine in and of itself, but its backport to 6.12
> (and 6.6) broke IPv4-in-IPv6 tunneling, see [1]. This adds a self-test
> for basic IPv4-in-IPv6 and IPv6-in-IPv6 functionality.
> 
> [1]: https://lore.kernel.org/all/CAA2RiuSnH_2xc+-W6EnFEG00XjS-dszMq61JEvRjcGS31CBw=g@mail.gmail.com/
> 
> Signed-off-by: Linus Heckemann <git@sphalerite.org>
> --
> Compared to previous version:
> * Added DCO as requested by Jakub
> * Suppressed output of ping and the expected-to-fail `ip link delete` cleanup invocation as suggested by Jakub
> * Added `set -e` as suggested by Hangbin
> 
> Not sure about the etiquette regarding the Tested-by line: Ricardo
> tested v1 of the patch, I guess I shouldn't add it to a respin?
> ---
>  tools/testing/selftests/net/Makefile      |  1 +
>  tools/testing/selftests/net/ip6_tunnel.sh | 44 +++++++++++++++++++++++
>  2 files changed, 45 insertions(+)
>  create mode 100644 tools/testing/selftests/net/ip6_tunnel.sh
> 
> diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
> index 45c4ea381bc36..5037a344ad826 100644
> --- a/tools/testing/selftests/net/Makefile
> +++ b/tools/testing/selftests/net/Makefile
> @@ -43,6 +43,7 @@ TEST_PROGS := \
>  	io_uring_zerocopy_tx.sh \
>  	ioam6.sh \
>  	ip6_gre_headroom.sh \
> +	ip6_tunnel.sh \
>  	ip_defrag.sh \
>  	ip_local_port_range.sh \
>  	ipv6_flowlabel.sh \
> diff --git a/tools/testing/selftests/net/ip6_tunnel.sh b/tools/testing/selftests/net/ip6_tunnel.sh
> new file mode 100644
> index 0000000000000..fe081a5218199
> --- /dev/null
> +++ b/tools/testing/selftests/net/ip6_tunnel.sh
> @@ -0,0 +1,44 @@
> +#!/bin/bash
> +# Test that IPv4-over-IPv6 tunneling works.
> +
> +source lib.sh
> +set -e
> +
> +setup_prepare() {
> +  ip link add transport1 type veth peer name transport2
> +
> +  setup_ns ns1
> +  ip link set transport1 netns $ns1
> +  ip -n $ns1 address add 2001:db8::1/64 dev transport1 nodad
> +  ip -n $ns1 address add 2001:db8::3/64 dev transport1 nodad
> +  ip -n $ns1 link set transport1 up
> +  ip -n $ns1 link add link transport1 name tunnel4 type ip6tnl mode ipip6 local 2001:db8::1 remote 2001:db8::2
> +  ip -n $ns1 address add 172.0.0.1/32 peer 172.0.0.2/32 dev tunnel4
> +  ip -n $ns1 link set tunnel4 up
> +  ip -n $ns1 link add link transport1 name tunnel6 type ip6tnl mode ip6ip6 local 2001:db8::3 remote 2001:db8::4
> +  ip -n $ns1 address add 2001:db8:6::1/64 dev tunnel6
> +  ip -n $ns1 link set tunnel6 up
> +
> +  setup_ns ns2
> +  ip link set transport2 netns $ns2
> +  ip -n $ns2 address add 2001:db8::2/64 dev transport2 nodad
> +  ip -n $ns2 address add 2001:db8::4/64 dev transport2 nodad
> +  ip -n $ns2 link set transport2 up
> +  ip -n $ns2 link add link transport2 name tunnel4 type ip6tnl mode ipip6 local 2001:db8::2 remote 2001:db8::1
> +  ip -n $ns2 address add 172.0.0.2/32 peer 172.0.0.1/32 dev tunnel4
> +  ip -n $ns2 link set tunnel4 up
> +  ip -n $ns2 link add link transport2 name tunnel6 type ip6tnl mode ip6ip6 local 2001:db8::4 remote 2001:db8::3
> +  ip -n $ns2 address add 2001:db8:6::2/64 dev tunnel6
> +  ip -n $ns2 link set tunnel6 up
> +}
> +
> +cleanup() {
> +  cleanup_all_ns
> +  # in case the namespaces haven't been set up yet
> +  ip link delete transport1 &>/dev/null || true
> +}
> +
> +trap cleanup EXIT
> +setup_prepare
> +ip netns exec $ns1 ping -q -W1 -c1 172.0.0.2 >/dev/null
> +ip netns exec $ns1 ping -q -W1 -c1 2001:db8:6::2 >/dev/null
> -- 
> 2.52.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>

Re: [PATCH v3] selftests/net: add test for IP-in-IPv6 tunneling

[Ricardo B. Marlière]

On Sat Feb 14, 2026 at 5:05 AM -03, Linus Heckemann wrote:
> commit 81c734dae203 ("ip6_tunnel: use skb_vlan_inet_prepare() in
> __ip6_tnl_rcv()") was fine in and of itself, but its backport to 6.12
> (and 6.6) broke IPv4-in-IPv6 tunneling, see [1]. This adds a self-test
> for basic IPv4-in-IPv6 and IPv6-in-IPv6 functionality.
>
> [1]: https://lore.kernel.org/all/CAA2RiuSnH_2xc+-W6EnFEG00XjS-dszMq61JEvRjcGS31CBw=g@mail.gmail.com/
>
> Signed-off-by: Linus Heckemann <git@sphalerite.org>
> --

^ need to be "---" if you don't want it to leak into the commit log.

> Compared to previous version:
> * Added DCO as requested by Jakub
> * Suppressed output of ping and the expected-to-fail `ip link delete` cleanup invocation as suggested by Jakub
> * Added `set -e` as suggested by Hangbin
>
> Not sure about the etiquette regarding the Tested-by line: Ricardo
> tested v1 of the patch, I guess I shouldn't add it to a respin?
> ---
>  tools/testing/selftests/net/Makefile      |  1 +
>  tools/testing/selftests/net/ip6_tunnel.sh | 44 +++++++++++++++++++++++

It's missing `chmod +x tools/testing/selftests/net/ip6_tunnel.sh`.

Reviewed-by: Ricardo B. Marlière <rbm@suse.com>
Tested-by: Ricardo B. Marlière <rbm@suse.com>

Tested with v6.19 with commit 9990ddf47d41 ("net: tunnel: make
skb_vlan_inet_prepare() return drop reasons") reverted. Test correctly
exits with 1.

>  2 files changed, 45 insertions(+)
>  create mode 100644 tools/testing/selftests/net/ip6_tunnel.sh
>
> diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
> index 45c4ea381bc36..5037a344ad826 100644
> --- a/tools/testing/selftests/net/Makefile
> +++ b/tools/testing/selftests/net/Makefile
> @@ -43,6 +43,7 @@ TEST_PROGS := \
>  	io_uring_zerocopy_tx.sh \
>  	ioam6.sh \
>  	ip6_gre_headroom.sh \
> +	ip6_tunnel.sh \
>  	ip_defrag.sh \
>  	ip_local_port_range.sh \
>  	ipv6_flowlabel.sh \
> diff --git a/tools/testing/selftests/net/ip6_tunnel.sh b/tools/testing/selftests/net/ip6_tunnel.sh
> new file mode 100644
> index 0000000000000..fe081a5218199
> --- /dev/null
> +++ b/tools/testing/selftests/net/ip6_tunnel.sh
> @@ -0,0 +1,44 @@
> +#!/bin/bash
> +# Test that IPv4-over-IPv6 tunneling works.
> +
> +source lib.sh
> +set -e
> +
> +setup_prepare() {
> +  ip link add transport1 type veth peer name transport2
> +
> +  setup_ns ns1
> +  ip link set transport1 netns $ns1
> +  ip -n $ns1 address add 2001:db8::1/64 dev transport1 nodad
> +  ip -n $ns1 address add 2001:db8::3/64 dev transport1 nodad
> +  ip -n $ns1 link set transport1 up
> +  ip -n $ns1 link add link transport1 name tunnel4 type ip6tnl mode ipip6 local 2001:db8::1 remote 2001:db8::2
> +  ip -n $ns1 address add 172.0.0.1/32 peer 172.0.0.2/32 dev tunnel4
> +  ip -n $ns1 link set tunnel4 up
> +  ip -n $ns1 link add link transport1 name tunnel6 type ip6tnl mode ip6ip6 local 2001:db8::3 remote 2001:db8::4
> +  ip -n $ns1 address add 2001:db8:6::1/64 dev tunnel6
> +  ip -n $ns1 link set tunnel6 up
> +
> +  setup_ns ns2
> +  ip link set transport2 netns $ns2
> +  ip -n $ns2 address add 2001:db8::2/64 dev transport2 nodad
> +  ip -n $ns2 address add 2001:db8::4/64 dev transport2 nodad
> +  ip -n $ns2 link set transport2 up
> +  ip -n $ns2 link add link transport2 name tunnel4 type ip6tnl mode ipip6 local 2001:db8::2 remote 2001:db8::1
> +  ip -n $ns2 address add 172.0.0.2/32 peer 172.0.0.1/32 dev tunnel4
> +  ip -n $ns2 link set tunnel4 up
> +  ip -n $ns2 link add link transport2 name tunnel6 type ip6tnl mode ip6ip6 local 2001:db8::4 remote 2001:db8::3
> +  ip -n $ns2 address add 2001:db8:6::2/64 dev tunnel6
> +  ip -n $ns2 link set tunnel6 up
> +}
> +
> +cleanup() {
> +  cleanup_all_ns
> +  # in case the namespaces haven't been set up yet
> +  ip link delete transport1 &>/dev/null || true
> +}
> +
> +trap cleanup EXIT
> +setup_prepare
> +ip netns exec $ns1 ping -q -W1 -c1 172.0.0.2 >/dev/null
> +ip netns exec $ns1 ping -q -W1 -c1 2001:db8:6::2 >/dev/null