Re: [PATCH nf v3 2/2] selftests: netfilter: add bridge tunnel flowtable regression

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jun 22, 2026 at 06:10:27PM +0800, Ren Wei wrote:
> From: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> 
> Add a nft_flowtable.sh regression test for the bridge direct-xmit plus
> IPIP/IP6IP6 underlay configuration that reproduces the reachable
> DIRECT+tunnel tuple combination exercised by the flowtable fix.
> 
> The test reuses the existing bridge and tunnel topology, installs flow
> rules for the tunnel egress and bridge reply path, verifies IPv4 and
> IPv6 forwarding, and checks the flowtable counters after the transfer.

Hm, this selftest extension did not help to catch this issue:

https://sashiko.dev/#/patchset/20260709114025.1294044-1-pablo%40netfilter.org

This selftest extension is not yet in the tree, I remember it helped
me reproduce the crash that was reported here, but it did not help to
detect that this is incorrectly setting up flowtable path.

> Signed-off-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
> ---
> changes in v3:
>   - Add nft_flowtable.sh coverage for the bridge direct-xmit plus
>     IPIP/IP6IP6 underlay case
>   - v2 Link: https://lore.kernel.org/all/7016923271a6bb3e26f9a21757922d3c5b1a7487.1781683535.git.chzhengyang2023@lzu.edu.cn/
> ---
>  .../selftests/net/netfilter/nft_flowtable.sh  | 55 +++++++++++++++++++
>  1 file changed, 55 insertions(+)
> 
> diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> index 7a34ef468975..cecbec148bdb 100755
> --- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> +++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> @@ -736,6 +736,61 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "on bridge"; then
>  	ret=1
>  fi
>  
> +if ip -net "$nsr1" link show tun0 > /dev/null 2>&1 &&
> +   ip -net "$nsr2" link show tun0 > /dev/null 2>&1; then
> +	ip -net "$nsr1" route change default via 192.168.100.2
> +	ip -net "$nsr2" route change default via 192.168.100.1
> +	ip -6 -net "$nsr1" route delete default
> +	ip -6 -net "$nsr1" route add default via fee1:3::2
> +	ip -6 -net "$nsr2" route delete default
> +	ip -6 -net "$nsr2" route add default via fee1:3::1
> +	ip -net "$ns2" route add default via 10.0.2.1
> +	ip -6 -net "$ns2" route add default via dead:2::1
> +
> +	ip netns exec "$nsr1" nft -a insert rule inet filter forward \
> +		'meta oif "tun0" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
> +	ip netns exec "$nsr1" nft -a insert rule inet filter forward \
> +		'meta oif "tun6" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
> +	ip netns exec "$nsr1" nft -a insert rule inet filter forward \
> +		'meta oif "veth0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
> +	ip netns exec "$nsr1" nft -a insert rule inet filter forward \
> +		'meta oif "br0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
> +	ip netns exec "$nsr1" nft -a insert rule inet filter forward \
> +		'meta oif "tun0" accept'
> +	ip netns exec "$nsr1" nft -a insert rule inet filter forward \
> +		'meta oif "tun6" accept'
> +
> +	ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
> +
> +	if test_tcp_forwarding "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
> +		check_counters "bridge + IPIP tunnel"
> +	else
> +		echo "FAIL: flow offload for ns1/ns2 with bridge + IPIP tunnel" 1>&2
> +		ip netns exec "$nsr1" nft list ruleset
> +		ret=1
> +	fi
> +
> +	if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then
> +		check_counters "bridge + IP6IP6 tunnel"
> +	else
> +		echo "FAIL: flow offload for ns1/ns2 with bridge + IP6IP6 tunnel" 1>&2
> +		ip netns exec "$nsr1" nft list ruleset
> +		ret=1
> +	fi
> +
> +	ip -net "$nsr1" route change default via 192.168.10.2
> +	ip -net "$nsr2" route change default via 192.168.10.1
> +	ip -net "$ns2" route del default via 10.0.2.1
> +	ip -6 -net "$nsr1" route delete default
> +	ip -6 -net "$nsr1" route add default via fee1:2::2
> +	ip -6 -net "$nsr2" route delete default
> +	ip -6 -net "$nsr2" route add default via fee1:2::1
> +	ip -6 -net "$ns2" route del default via dead:2::1
> +else
> +	echo "SKIP: bridge + tunnel flowtable regression (tun0 missing)"
> +	[ "$ret" -eq 0 ] && ret=$ksft_skip
> +fi
> +
>  
>  # Another test:
>  # Add bridge interface br0 to Router1, with NAT and VLAN.
> -- 
> 2.43.0
>