* [PATCH nft] tests: shell: Add coverage for nf_connlabels_replace()
@ 2026-08-25 10:24 Jiri Peska
2026-08-25 10:45 ` Florian Westphal
0 siblings, 1 reply; 2+ messages in thread
From: Jiri Peska @ 2026-08-25 10:24 UTC (permalink / raw)
To: netfilter-devel; +Cc: jpeska, fwestpha
Signed-off-by: Jiri Peska <jpeska@redhat.com>
---
tests/shell/testcases/packetpath/ct_label_set | 27 ++++
.../packetpath/dumps/ct_label_set.json-nft | 132 ++++++++++++++++++
.../packetpath/dumps/ct_label_set.nft | 11 ++
3 files changed, 170 insertions(+)
create mode 100755 tests/shell/testcases/packetpath/ct_label_set
create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.nft
diff --git a/tests/shell/testcases/packetpath/ct_label_set b/tests/shell/testcases/packetpath/ct_label_set
new file mode 100755
index 00000000..554829c0
--- /dev/null
+++ b/tests/shell/testcases/packetpath/ct_label_set
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e
+
+ip link set lo up
+
+$NFT -f - <<EOF
+table ip test {
+ counter labeled {}
+ chain output {
+ type filter hook output priority filter; policy accept;
+ # set bit 1 on each echo-request
+ icmp type echo-request ip daddr 127.0.0.1 ct label set 1
+ # count only if label is already set
+ icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name labeled
+ }
+}
+EOF
+
+# Packet 1: replace sets bit 1
+ping -c 1 -W 1 127.0.0.1 >/dev/null
+
+# Packet 2+: same rule applies on same ICMP ct
+ping -c 2 -W 1 127.0.0.1 >/dev/null
+
+# Assert correct number of matched packets
+$NFT list counter ip test labeled | grep -q 'packets 3'
diff --git a/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft b/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
new file mode 100644
index 00000000..f8e2945a
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
@@ -0,0 +1,132 @@
+{
+ "nftables": [
+ {
+ "metainfo": {
+ "version": "VERSION",
+ "release_name": "RELEASE_NAME",
+ "json_schema_version": 1
+ }
+ },
+ {
+ "table": {
+ "family": "ip",
+ "name": "test",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "test",
+ "name": "output",
+ "handle": 0,
+ "type": "filter",
+ "hook": "output",
+ "prio": 0,
+ "policy": "accept"
+ }
+ },
+ {
+ "counter": {
+ "family": "ip",
+ "name": "labeled",
+ "table": "test",
+ "handle": 0,
+ "packets": 3,
+ "bytes": 252
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "test",
+ "chain": "output",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "payload": {
+ "protocol": "icmp",
+ "field": "type"
+ }
+ },
+ "right": "echo-request"
+ }
+ },
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "payload": {
+ "protocol": "ip",
+ "field": "daddr"
+ }
+ },
+ "right": "127.0.0.1"
+ }
+ },
+ {
+ "mangle": {
+ "key": {
+ "ct": {
+ "key": "label"
+ }
+ },
+ "value": 1
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "test",
+ "chain": "output",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "payload": {
+ "protocol": "icmp",
+ "field": "type"
+ }
+ },
+ "right": "echo-request"
+ }
+ },
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "payload": {
+ "protocol": "ip",
+ "field": "daddr"
+ }
+ },
+ "right": "127.0.0.1"
+ }
+ },
+ {
+ "match": {
+ "op": "in",
+ "left": {
+ "ct": {
+ "key": "label"
+ }
+ },
+ "right": 1
+ }
+ },
+ {
+ "counter": "labeled"
+ }
+ ]
+ }
+ }
+ ]
+}
diff --git a/tests/shell/testcases/packetpath/dumps/ct_label_set.nft b/tests/shell/testcases/packetpath/dumps/ct_label_set.nft
new file mode 100644
index 00000000..261677f8
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/ct_label_set.nft
@@ -0,0 +1,11 @@
+table ip test {
+ counter labeled {
+ packets 3 bytes 252
+ }
+
+ chain output {
+ type filter hook output priority filter; policy accept;
+ icmp type echo-request ip daddr 127.0.0.1 ct label set 1
+ icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name "labeled"
+ }
+}
--
2.54.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH nft] tests: shell: Add coverage for nf_connlabels_replace()
2026-08-25 10:24 [PATCH nft] tests: shell: Add coverage for nf_connlabels_replace() Jiri Peska
@ 2026-08-25 10:45 ` Florian Westphal
0 siblings, 0 replies; 2+ messages in thread
From: Florian Westphal @ 2026-08-25 10:45 UTC (permalink / raw)
To: Jiri Peska; +Cc: netfilter-devel
Jiri Peska <jpeska@redhat.com> wrote:
> Signed-off-by: Jiri Peska <jpeska@redhat.com>
> ---
> tests/shell/testcases/packetpath/ct_label_set | 27 ++++
> .../packetpath/dumps/ct_label_set.json-nft | 132 ++++++++++++++++++
> .../packetpath/dumps/ct_label_set.nft | 11 ++
> 3 files changed, 170 insertions(+)
> create mode 100755 tests/shell/testcases/packetpath/ct_label_set
> create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
> create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.nft
This fails for me in dump validation, diff is:
- icmp type echo-request ip daddr 127.0.0.1 ct label set 1
- icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name "labeled"
+ icmp type echo-request ip daddr 127.0.0.1 ct label set "bar"
+ icmp type echo-request ip daddr 127.0.0.1 ct label "bar" counter name "labeled"
This is caused by local configuration. I'd remove the dump files here
before applying (and add a nodump file instead).
As the test explicitly checks counters in the script, it will still be
useful to assert match/nomatch.
What do you think?
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-25 10:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-25 10:24 [PATCH nft] tests: shell: Add coverage for nf_connlabels_replace() Jiri Peska
2026-08-25 10:45 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox