[PATCH nf-next] selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic

[PATCH nf-next] selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic

[Lorenzo Bianconi]

Introduce the capability to send TCP traffic over IPv6 to
nft_flowtable netfilter selftest.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
 .../selftests/net/netfilter/nft_flowtable.sh       | 47 +++++++++++++++-------
 1 file changed, 33 insertions(+), 14 deletions(-)

diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
index 1fbfc8ad8dcdc5db2ab1a1ea9310f655d09eee83..24b4e60b91451e7ea7f6a041b0335233047c6242 100755
--- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
+++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
@@ -127,6 +127,8 @@ ip -net "$nsr1" addr add fee1:2::1/64 dev veth1 nodad
 ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0
 ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad
 
+ip netns exec "$nsr1" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+ip netns exec "$nsr2" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
 for i in 0 1; do
   ip netns exec "$nsr1" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
   ip netns exec "$nsr2" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
@@ -153,7 +155,9 @@ ip -net "$ns1" route add default via dead:1::1
 ip -net "$ns2" route add default via dead:2::1
 
 ip -net "$nsr1" route add default via 192.168.10.2
+ip -6 -net "$nsr1" route add default via fee1:2::2
 ip -net "$nsr2" route add default via 192.168.10.1
+ip -6 -net "$nsr2" route add default via fee1:2::1
 
 ip netns exec "$nsr1" nft -f - <<EOF
 table inet filter {
@@ -352,8 +356,9 @@ test_tcp_forwarding_ip()
 	local nsa=$1
 	local nsb=$2
 	local pmtu=$3
-	local dstip=$4
-	local dstport=$5
+	local proto=$4
+	local dstip=$5
+	local dstport=$6
 	local lret=0
 	local socatc
 	local socatl
@@ -363,12 +368,12 @@ test_tcp_forwarding_ip()
 		infile="$nsin_small"
 	fi
 
-	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
+	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -${proto} TCP${proto}-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
 	lpid=$!
 
 	busywait 1000 listener_ready
 
-	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
+	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -${proto} TCP${proto}:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
 	socatc=$?
 
 	wait $lpid
@@ -394,8 +399,11 @@ test_tcp_forwarding_ip()
 test_tcp_forwarding()
 {
 	local pmtu="$3"
+	local proto="$4"
+	local dstip="$5"
+	local dstport="$6"
 
-	test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.0.2.99 12345
+	test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
 
 	return $?
 }
@@ -403,6 +411,9 @@ test_tcp_forwarding()
 test_tcp_forwarding_set_dscp()
 {
 	local pmtu="$3"
+	local proto="$4"
+	local dstip="$5"
+	local dstport="$6"
 
 ip netns exec "$nsr1" nft -f - <<EOF
 table netdev dscpmangle {
@@ -413,7 +424,7 @@ table netdev dscpmangle {
 }
 EOF
 if [ $? -eq 0 ]; then
-	test_tcp_forwarding_ip "$1" "$2" "$3" 10.0.2.99 12345
+	test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
 	check_dscp "dscp_ingress" "$pmtu"
 
 	ip netns exec "$nsr1" nft delete table netdev dscpmangle
@@ -430,7 +441,7 @@ table netdev dscpmangle {
 }
 EOF
 if [ $? -eq 0 ]; then
-	test_tcp_forwarding_ip "$1" "$2" "$pmtu"  10.0.2.99 12345
+	test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
 	check_dscp "dscp_egress" "$pmtu"
 
 	ip netns exec "$nsr1" nft delete table netdev dscpmangle
@@ -441,7 +452,7 @@ fi
 	# partial.  If flowtable really works, then both dscp-is-0 and dscp-is-cs3
 	# counters should have seen packets (before and after ft offload kicks in).
 	ip netns exec "$nsr1" nft -a insert rule inet filter forward ip dscp set cs3
-	test_tcp_forwarding_ip "$1" "$2" "$pmtu"  10.0.2.99 12345
+	test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"
 	check_dscp "dscp_fwd" "$pmtu"
 }
 
@@ -455,7 +466,7 @@ test_tcp_forwarding_nat()
 
 	[ "$pmtu" -eq 0 ] && what="$what (pmtu disabled)"
 
-	test_tcp_forwarding_ip "$nsa" "$nsb" "$pmtu" 10.0.2.99 12345
+	test_tcp_forwarding_ip "$nsa" "$nsb" "$pmtu" 4 10.0.2.99 12345
 	lret=$?
 
 	if [ "$lret" -eq 0 ] ; then
@@ -465,7 +476,7 @@ test_tcp_forwarding_nat()
 			echo "PASS: flow offload for ns1/ns2 with masquerade $what"
 		fi
 
-		test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.6.6.6 1666
+		test_tcp_forwarding_ip "$1" "$2" "$pmtu" 4 10.6.6.6 1666
 		lret=$?
 		if [ "$pmtu" -eq 1 ] ;then
 			check_counters "flow offload for ns1/ns2 with dnat $what"
@@ -487,7 +498,7 @@ make_file "$nsin_small" "$filesize_small"
 # Due to MTU mismatch in both directions, all packets (except small packets like pure
 # acks) have to be handled by normal forwarding path.  Therefore, packet counters
 # are not checked.
-if test_tcp_forwarding "$ns1" "$ns2" 0; then
+if test_tcp_forwarding "$ns1" "$ns2" 0 4 10.0.2.99 12345; then
 	echo "PASS: flow offloaded for ns1/ns2"
 else
 	echo "FAIL: flow offload for ns1/ns2:" 1>&2
@@ -495,6 +506,14 @@ else
 	ret=1
 fi
 
+if test_tcp_forwarding "$ns1" "$ns2" 0 6 "[dead:2::99]" 12345; then
+	echo "PASS: IPv6 flow offloaded for ns1/ns2"
+else
+	echo "FAIL: IPv6 flow offload for ns1/ns2:" 1>&2
+	ip netns exec "$nsr1" nft list ruleset
+	ret=1
+fi
+
 # delete default route, i.e. ns2 won't be able to reach ns1 and
 # will depend on ns1 being masqueraded in nsr1.
 # expect ns1 has nsr1 address.
@@ -520,7 +539,7 @@ table ip nat {
 EOF
 
 check_dscp "dscp_none" "0"
-if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 0 ""; then
+if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 0 4 10.0.2.99 12345; then
 	echo "FAIL: flow offload for ns1/ns2 with dscp update and no pmtu discovery" 1>&2
 	exit 0
 fi
@@ -546,7 +565,7 @@ ip netns exec "$ns2" sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
 ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
 ip netns exec "$ns2"  nft reset counters table inet filter >/dev/null
 
-if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 1 ""; then
+if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
 	echo "FAIL: flow offload for ns1/ns2 with dscp update and pmtu discovery" 1>&2
 	exit 0
 fi
@@ -752,7 +771,7 @@ ip -net "$ns2" route del 192.168.10.1 via 10.0.2.1
 ip -net "$ns2" route add default via 10.0.2.1
 ip -net "$ns2" route add default via dead:2::1
 
-if test_tcp_forwarding "$ns1" "$ns2" 1; then
+if test_tcp_forwarding "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
 	check_counters "ipsec tunnel mode for ns1/ns2"
 else
 	echo "FAIL: ipsec tunnel mode for ns1/ns2"

---
base-commit: aa7ece8adbea8cca27594a0f80c68f6cb708326d
change-id: 20251122-nft_flowtable-sh-ipv6-tcp-76f3d28169d1

Best regards,
-- 
Lorenzo Bianconi <lorenzo@kernel.org>

Re: [PATCH nf-next] selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic

[Simon Horman]

On Sat, Nov 22, 2025 at 07:41:38PM +0100, Lorenzo Bianconi wrote:
> Introduce the capability to send TCP traffic over IPv6 to
> nft_flowtable netfilter selftest.
> 
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
>  .../selftests/net/netfilter/nft_flowtable.sh       | 47 +++++++++++++++-------
>  1 file changed, 33 insertions(+), 14 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> index 1fbfc8ad8dcdc5db2ab1a1ea9310f655d09eee83..24b4e60b91451e7ea7f6a041b0335233047c6242 100755
> --- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> +++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> @@ -127,6 +127,8 @@ ip -net "$nsr1" addr add fee1:2::1/64 dev veth1 nodad
>  ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0
>  ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad
>  
> +ip netns exec "$nsr1" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
> +ip netns exec "$nsr2" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
>  for i in 0 1; do
>    ip netns exec "$nsr1" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
>    ip netns exec "$nsr2" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
> @@ -153,7 +155,9 @@ ip -net "$ns1" route add default via dead:1::1
>  ip -net "$ns2" route add default via dead:2::1
>  
>  ip -net "$nsr1" route add default via 192.168.10.2
> +ip -6 -net "$nsr1" route add default via fee1:2::2
>  ip -net "$nsr2" route add default via 192.168.10.1
> +ip -6 -net "$nsr2" route add default via fee1:2::1
>  
>  ip netns exec "$nsr1" nft -f - <<EOF
>  table inet filter {
> @@ -352,8 +356,9 @@ test_tcp_forwarding_ip()
>  	local nsa=$1
>  	local nsb=$2
>  	local pmtu=$3
> -	local dstip=$4
> -	local dstport=$5
> +	local proto=$4
> +	local dstip=$5
> +	local dstport=$6
>  	local lret=0
>  	local socatc
>  	local socatl
> @@ -363,12 +368,12 @@ test_tcp_forwarding_ip()
>  		infile="$nsin_small"
>  	fi
>  
> -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
> +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -${proto} TCP${proto}-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &

Hi Lorenzo,

Some minor nits:

1. This line is (and was) excessively long.
   Maybe it can be addressed as the line is being modified anyway.

   Flagged by checkpatch

2. Prior to this patch, variables on this line were enclosed in "" to
   guard against word splitting when expansion occurs.
   This is no longer the case.

   Flagged by shellcheck

>  	lpid=$!
>  
>  	busywait 1000 listener_ready
>  
> -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
> +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -${proto} TCP${proto}:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
>  	socatc=$?

Likewise here.

>  
>  	wait $lpid

Otherwise this LGTM.

Re: [PATCH nf-next] selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic

[Lorenzo Bianconi]

[-- Attachment #1: Type: text/plain, Size: 3349 bytes --]

> On Sat, Nov 22, 2025 at 07:41:38PM +0100, Lorenzo Bianconi wrote:
> > Introduce the capability to send TCP traffic over IPv6 to
> > nft_flowtable netfilter selftest.
> > 
> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> > ---
> >  .../selftests/net/netfilter/nft_flowtable.sh       | 47 +++++++++++++++-------
> >  1 file changed, 33 insertions(+), 14 deletions(-)
> > 
> > diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > index 1fbfc8ad8dcdc5db2ab1a1ea9310f655d09eee83..24b4e60b91451e7ea7f6a041b0335233047c6242 100755
> > --- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > +++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > @@ -127,6 +127,8 @@ ip -net "$nsr1" addr add fee1:2::1/64 dev veth1 nodad
> >  ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0
> >  ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad
> >  
> > +ip netns exec "$nsr1" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
> > +ip netns exec "$nsr2" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
> >  for i in 0 1; do
> >    ip netns exec "$nsr1" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
> >    ip netns exec "$nsr2" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
> > @@ -153,7 +155,9 @@ ip -net "$ns1" route add default via dead:1::1
> >  ip -net "$ns2" route add default via dead:2::1
> >  
> >  ip -net "$nsr1" route add default via 192.168.10.2
> > +ip -6 -net "$nsr1" route add default via fee1:2::2
> >  ip -net "$nsr2" route add default via 192.168.10.1
> > +ip -6 -net "$nsr2" route add default via fee1:2::1
> >  
> >  ip netns exec "$nsr1" nft -f - <<EOF
> >  table inet filter {
> > @@ -352,8 +356,9 @@ test_tcp_forwarding_ip()
> >  	local nsa=$1
> >  	local nsb=$2
> >  	local pmtu=$3
> > -	local dstip=$4
> > -	local dstport=$5
> > +	local proto=$4
> > +	local dstip=$5
> > +	local dstport=$6
> >  	local lret=0
> >  	local socatc
> >  	local socatl
> > @@ -363,12 +368,12 @@ test_tcp_forwarding_ip()
> >  		infile="$nsin_small"
> >  	fi
> >  
> > -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
> > +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -${proto} TCP${proto}-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
> 
> Hi Lorenzo,
> 
> Some minor nits:
> 
> 1. This line is (and was) excessively long.
>    Maybe it can be addressed as the line is being modified anyway.
> 
>    Flagged by checkpatch
> 
> 2. Prior to this patch, variables on this line were enclosed in "" to
>    guard against word splitting when expansion occurs.
>    This is no longer the case.
> 
>    Flagged by shellcheck
> 
> >  	lpid=$!
> >  
> >  	busywait 1000 listener_ready
> >  
> > -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
> > +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -${proto} TCP${proto}:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
> >  	socatc=$?
> 
> Likewise here.
> 
> >  
> >  	wait $lpid
> 
> Otherwise this LGTM.

Hi Simon,

ack, fine. Is it ok to address them in subsequent patch or do you prefer to
address them here?
@Pablo: what do you prefer?

Regards,
Lorenzo

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH nf-next] selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic

[Simon Horman]

On Thu, Nov 27, 2025 at 12:25:37PM +0100, Lorenzo Bianconi wrote:
> > On Sat, Nov 22, 2025 at 07:41:38PM +0100, Lorenzo Bianconi wrote:
> > > Introduce the capability to send TCP traffic over IPv6 to
> > > nft_flowtable netfilter selftest.
> > > 
> > > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> > > ---
> > >  .../selftests/net/netfilter/nft_flowtable.sh       | 47 +++++++++++++++-------
> > >  1 file changed, 33 insertions(+), 14 deletions(-)
> > > 
> > > diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > > index 1fbfc8ad8dcdc5db2ab1a1ea9310f655d09eee83..24b4e60b91451e7ea7f6a041b0335233047c6242 100755
> > > --- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > > +++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> > > @@ -127,6 +127,8 @@ ip -net "$nsr1" addr add fee1:2::1/64 dev veth1 nodad
> > >  ip -net "$nsr2" addr add 192.168.10.2/24 dev veth0
> > >  ip -net "$nsr2" addr add fee1:2::2/64 dev veth0 nodad
> > >  
> > > +ip netns exec "$nsr1" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
> > > +ip netns exec "$nsr2" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
> > >  for i in 0 1; do
> > >    ip netns exec "$nsr1" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
> > >    ip netns exec "$nsr2" sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
> > > @@ -153,7 +155,9 @@ ip -net "$ns1" route add default via dead:1::1
> > >  ip -net "$ns2" route add default via dead:2::1
> > >  
> > >  ip -net "$nsr1" route add default via 192.168.10.2
> > > +ip -6 -net "$nsr1" route add default via fee1:2::2
> > >  ip -net "$nsr2" route add default via 192.168.10.1
> > > +ip -6 -net "$nsr2" route add default via fee1:2::1
> > >  
> > >  ip netns exec "$nsr1" nft -f - <<EOF
> > >  table inet filter {
> > > @@ -352,8 +356,9 @@ test_tcp_forwarding_ip()
> > >  	local nsa=$1
> > >  	local nsb=$2
> > >  	local pmtu=$3
> > > -	local dstip=$4
> > > -	local dstport=$5
> > > +	local proto=$4
> > > +	local dstip=$5
> > > +	local dstport=$6
> > >  	local lret=0
> > >  	local socatc
> > >  	local socatl
> > > @@ -363,12 +368,12 @@ test_tcp_forwarding_ip()
> > >  		infile="$nsin_small"
> > >  	fi
> > >  
> > > -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
> > > +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -${proto} TCP${proto}-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" &
> > 
> > Hi Lorenzo,
> > 
> > Some minor nits:
> > 
> > 1. This line is (and was) excessively long.
> >    Maybe it can be addressed as the line is being modified anyway.
> > 
> >    Flagged by checkpatch
> > 
> > 2. Prior to this patch, variables on this line were enclosed in "" to
> >    guard against word splitting when expansion occurs.
> >    This is no longer the case.
> > 
> >    Flagged by shellcheck
> > 
> > >  	lpid=$!
> > >  
> > >  	busywait 1000 listener_ready
> > >  
> > > -	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
> > > +	timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -${proto} TCP${proto}:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out"
> > >  	socatc=$?
> > 
> > Likewise here.
> > 
> > >  
> > >  	wait $lpid
> > 
> > Otherwise this LGTM.
> 
> Hi Simon,
> 
> ack, fine. Is it ok to address them in subsequent patch or do you prefer to
> address them here?

Hi Lorenzo,

No preference on my side.
And feel free to include the following either way.

Reviewed-by: Simon Horman <horms@kernel.org>

> @Pablo: what do you prefer?