[PATCH net-next v5] selftests/net/openvswitch: add SCTP flow key test

[PATCH net-next v5] selftests/net/openvswitch: add SCTP flow key test

[Minxi Hou]

Add test_sctp_connect_v4() to verify OVS can match on SCTP flow keys
(sctp src/dst port).

The test sets up client and server namespaces connected through an
OVS bridge, installs port-keyed flows, and verifies:
  - sctp(dst=4443) matches client-to-server INIT
  - sctp(src=4443) matches server-to-client INIT-ACK
  - removing flows drops the connection
  - reinstalling flows restores connectivity

Signed-off-by: Minxi Hou <houminxi@gmail.com>
---
 .../selftests/net/openvswitch/openvswitch.sh  | 101 ++++++++++++++++++
 1 file changed, 101 insertions(+)

diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh
index 853dbc1b00d7..176361f9e60f 100755
--- a/tools/testing/selftests/net/openvswitch/openvswitch.sh
+++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh
@@ -34,6 +34,7 @@ tests="
 	action_set				set: SET action rewrites fields
 	trunc					trunc: output truncation
 	icmpv6					icmpv6: ICMPv6 echo type match
+	sctp_connect_v4				sctp: SCTP flow key matching
 	psample					psample: Sampling packets with psample"
 
 info() {
@@ -611,6 +612,106 @@ test_icmpv6() {
 	return 0
 }
 
+# sctp_connect_v4 test
+# - sctp(dst=4443) matches client-to-server INIT
+# - sctp(src=4443) matches server-to-client INIT-ACK
+# - remove flows and verify connection fails, reinstall and recover
+test_sctp_connect_v4() {
+	local t="test_sctp_connect_v4"
+
+	modprobe -q sctp 2>/dev/null || return "$ksft_skip"
+	socat -V 2>&1 | grep -q SCTP || return "$ksft_skip"
+
+	sbx_add "$t" || return $?
+	ovs_add_dp "$t" sctp4 || return 1
+
+	info "create namespaces"
+	for ns in client server; do
+		ovs_add_netns_and_veths "$t" "sctp4" "$ns" \
+		    "${ns:0:1}0" "${ns:0:1}1" || return 1
+	done
+
+	ip netns exec client ip addr add 172.31.110.10/24 dev c1
+	ip netns exec client ip link set c1 up
+	ip netns exec server ip addr add 172.31.110.20/24 dev s1
+	ip netns exec server ip link set s1 up
+
+	# ARP forwarding
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(1),eth(),eth_type(0x0806),arp()' \
+	    '2' || return 1
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(2),eth(),eth_type(0x0806),arp()' \
+	    '1' || return 1
+
+	# SCTP port matching: dst for request, src for reply
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(1),eth(),eth_type(0x0800),ipv4(proto=132),sctp(dst=4443)' \
+	    '2' || return 1
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(2),eth(),eth_type(0x0800),ipv4(proto=132),sctp(src=4443)' \
+	    '1' || return 1
+
+	ovs_netns_spawn_daemon "$t" "server" \
+	    socat -u SCTP4-LISTEN:4443 STDOUT
+	local server_pid="$pid"
+	ovs_wait bash -c \
+	    "ip netns exec server ss -lnH sport = :4443 | grep -q ." \
+	    || return 1
+
+	info "verify SCTP association with port-keyed flows"
+	ovs_sbx "$t" ip netns exec client \
+	    socat -u STDIN SCTP4-CONNECT:172.31.110.20:4443 </dev/null \
+	    || return 1
+
+	ovs_del_flows "$t" sctp4
+
+	info "verify connection fails without flows"
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(1),eth(),eth_type(0x0806),arp()' \
+	    '2' || return 1
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(2),eth(),eth_type(0x0806),arp()' \
+	    '1' || return 1
+
+	kill -TERM "$server_pid" 2>/dev/null
+	wait "$server_pid" 2>/dev/null
+	ovs_netns_spawn_daemon "$t" "server" \
+	    socat -u SCTP4-LISTEN:4443 STDOUT
+	server_pid="$pid"
+	ovs_wait bash -c \
+	    "ip netns exec server ss -lnH sport = :4443 | grep -q ." \
+	    || return 1
+
+	ovs_sbx "$t" ip netns exec client \
+	    socat -u STDIN SCTP4-CONNECT:172.31.110.20:4443 </dev/null \
+	    >/dev/null 2>&1 \
+	    && { info "connection should fail without flows"
+	         return 1; }
+
+	info "reinstall flows and verify recovery"
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(1),eth(),eth_type(0x0800),ipv4(proto=132),sctp(dst=4443)' \
+	    '2' || return 1
+	ovs_add_flow "$t" sctp4 \
+	    'in_port(2),eth(),eth_type(0x0800),ipv4(proto=132),sctp(src=4443)' \
+	    '1' || return 1
+
+	kill -TERM "$server_pid" 2>/dev/null
+	wait "$server_pid" 2>/dev/null
+	ovs_netns_spawn_daemon "$t" "server" \
+	    socat -u SCTP4-LISTEN:4443 STDOUT
+	ovs_wait bash -c \
+	    "ip netns exec server ss -lnH sport = :4443 | grep -q ." \
+	    || return 1
+
+	ovs_sbx "$t" ip netns exec client \
+	    socat -u STDIN SCTP4-CONNECT:172.31.110.20:4443 </dev/null \
+	    || return 1
+
+	return 0
+}
+
 # psample test
 # - use psample to observe packets
 test_psample() {
-- 
2.55.0

Re: [PATCH net-next v5] selftests/net/openvswitch: add SCTP flow key test

[Jakub Kicinski]

On Thu, 23 Jul 2026 04:42:03 -0400 Minxi Hou wrote:
> Add test_sctp_connect_v4() to verify OVS can match on SCTP flow keys
> (sctp src/dst port).
> 
> The test sets up client and server namespaces connected through an
> OVS bridge, installs port-keyed flows, and verifies:
>   - sctp(dst=4443) matches client-to-server INIT
>   - sctp(src=4443) matches server-to-client INIT-ACK
>   - removing flows drops the connection
>   - reinstalling flows restores connectivity

Fails in NIPA:

# Traceback (most recent call last):
#   File "/srv/vmksft/testing/wt-2/tools/testing/selftests/net/openvswitch/ovs-dpctl.py", line 3169, in <module>
#     sys.exit(main(sys.argv))
#              ~~~~^^^^^^^^^^
#   File "/srv/vmksft/testing/wt-2/tools/testing/selftests/net/openvswitch/ovs-dpctl.py", line 3150, in main
#     ovsflow.add_flow(rep["dpifindex"], flow)
#     ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
#   File "/srv/vmksft/testing/wt-2/tools/testing/selftests/net/openvswitch/ovs-dpctl.py", line 2751, in add_flow
#     raise ne
#   File "/srv/vmksft/testing/wt-2/tools/testing/selftests/net/openvswitch/ovs-dpctl.py", line 2743, in add_flow
#     reply = self.nlm_request(
#         flowmsg,
#         msg_type=self.prid,
#         msg_flags=NLM_F_REQUEST | NLM_F_ACK,
#     )
#   File "/usr/lib/python3.14/site-packages/pyroute2/netlink/nlsocket.py", line 870, in nlm_request
#     return tuple(self._genlm_request(*argv, **kwarg))
#                  ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
#   File "/usr/lib/python3.14/site-packages/pyroute2/netlink/generic/__init__.py", line 126, in nlm_request
#     return tuple(super().nlm_request(*argv, **kwarg))
#   File "/usr/lib/python3.14/site-packages/pyroute2/netlink/nlsocket.py", line 1214, in nlm_request
#     for msg in self.get(
#                ~~~~~~~~^
#         msg_seq=msg_seq,
#         ^^^^^^^^^^^^^^^^
#         terminate=terminate,
#         ^^^^^^^^^^^^^^^^^^^^
#         callback=callback,
#         ^^^^^^^^^^^^^^^^^^
#     ):
#     ^
#   File "/usr/lib/python3.14/site-packages/pyroute2/netlink/nlsocket.py", line 873, in get
#     return tuple(self._genlm_get(*argv, **kwarg))
#                  ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
#   File "/usr/lib/python3.14/site-packages/pyroute2/netlink/generic/__init__.py", line 123, in get
#     return tuple(super().get(*argv, **kwarg))
#   File "/usr/lib/python3.14/site-packages/pyroute2/netlink/nlsocket.py", line 550, in get
#     raise msg['header']['error']
# pyroute2.netlink.exceptions.NetlinkError: (22, 'Invalid argument')
# TEST: sctp: SCTP flow key matching                                  [FAIL]