]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
tools/selftests: Add a VXLAN+IPsec traffic test
authorCosmin Ratiu <cratiu@nvidia.com>
Wed, 22 Apr 2026 14:06:47 +0000 (17:06 +0300)
committerSteffen Klassert <steffen.klassert@secunet.com>
Tue, 28 Apr 2026 04:47:19 +0000 (06:47 +0200)
commite64e03b478e2da7093564819e903932fca2ddfa1
tree74819edda81c2b7d218260042cc63c2b80d7d0bd
parentada95e5e603bc6e353ee029f2ba7a7d9a42ad018
tools/selftests: Add a VXLAN+IPsec traffic test

There are VXLAN tests and IPsec tests, but there is no test that
combines the two protocols and exercises the tunnel-over-ipsec code
paths. Fix that by adding a traffic test with VXLAN and IPsec using
crypto offload. This is runnable on HW which supports ESP offload (so no
nsim unfortunately).

Traffic is done with iperf3 and the test validates that there are no
packet drops and iperf3 can get to at least 100 Mbps (a very
conservative value on today's crypto offload HW, as it can typically
reach multi-Gbps rates).

Ran right now, the test fails due to a recently exposed bug in xfrm,
which will be fixed in the next patch:
 # ./tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py
 TAP version 13
 1..4
 # Check| At ./tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py,
 # line 161, in test_vxlan_ipsec_crypto_offload:
 # Check|     ksft_eq(drops_after - drops_before, 0,
 # Check failed 189 != 0 TX drops during VXLAN+IPsec
 # Check| At ./tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py,
 # line 163, in test_vxlan_ipsec_crypto_offload:
 # Check|     ksft_ge(bw_gbps, 0.1,
 # Check failed 0.0015058278404812596 < 0.1 Minimum 100Mbps over
 # VXLAN+IPsec
 not ok 1 ipsec_vxlan.test_vxlan_ipsec_crypto_offload.outer_v4_inner_v4
 ...

Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
tools/testing/selftests/drivers/net/hw/Makefile
tools/testing/selftests/drivers/net/hw/config
tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py [new file with mode: 0755]