selftests: netfilter: add bridge tunnel flowtable regression

Add a nft_flowtable.sh regression test for the bridge direct-xmit plus
IPIP/IP6IP6 underlay configuration that reproduces the reachable
DIRECT+tunnel tuple combination exercised by the flowtable fix.

The test reuses the existing bridge and tunnel topology, installs flow
rules for the tunnel egress and bridge reply path, verifies IPv4 and
IPv6 forwarding, and checks the flowtable counters after the transfer.

Signed-off-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
index 08ad07500e8a7156eeec55c7bf0fc7a7076f5b73..fb1c59d45567aff498ea283742906f72a6cf4acc 100755 (executable)
--- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
+++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
@@ -736,6 +736,61 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "on bridge"; then
        ret=1
 fi
 
+if ip -net "$nsr1" link show tun0 > /dev/null 2>&1 &&
+   ip -net "$nsr2" link show tun0 > /dev/null 2>&1; then
+       ip -net "$nsr1" route change default via 192.168.100.2
+       ip -net "$nsr2" route change default via 192.168.100.1
+       ip -6 -net "$nsr1" route delete default
+       ip -6 -net "$nsr1" route add default via fee1:3::2
+       ip -6 -net "$nsr2" route delete default
+       ip -6 -net "$nsr2" route add default via fee1:3::1
+       ip -net "$ns2" route add default via 10.0.2.1
+       ip -6 -net "$ns2" route add default via dead:2::1
+
+       ip netns exec "$nsr1" nft -a insert rule inet filter forward \
+               'meta oif "tun0" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
+       ip netns exec "$nsr1" nft -a insert rule inet filter forward \
+               'meta oif "tun6" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
+       ip netns exec "$nsr1" nft -a insert rule inet filter forward \
+               'meta oif "veth0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
+       ip netns exec "$nsr1" nft -a insert rule inet filter forward \
+               'meta oif "br0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
+       ip netns exec "$nsr1" nft -a insert rule inet filter forward \
+               'meta oif "tun0" accept'
+       ip netns exec "$nsr1" nft -a insert rule inet filter forward \
+               'meta oif "tun6" accept'
+
+       ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
+
+       if test_tcp_forwarding "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
+               check_counters "bridge + IPIP tunnel"
+       else
+               echo "FAIL: flow offload for ns1/ns2 with bridge + IPIP tunnel" 1>&2
+               ip netns exec "$nsr1" nft list ruleset
+               ret=1
+       fi
+
+       if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then
+               check_counters "bridge + IP6IP6 tunnel"
+       else
+               echo "FAIL: flow offload for ns1/ns2 with bridge + IP6IP6 tunnel" 1>&2
+               ip netns exec "$nsr1" nft list ruleset
+               ret=1
+       fi
+
+       ip -net "$nsr1" route change default via 192.168.10.2
+       ip -net "$nsr2" route change default via 192.168.10.1
+       ip -net "$ns2" route del default via 10.0.2.1
+       ip -6 -net "$nsr1" route delete default
+       ip -6 -net "$nsr1" route add default via fee1:2::2
+       ip -6 -net "$nsr2" route delete default
+       ip -6 -net "$nsr2" route add default via fee1:2::1
+       ip -6 -net "$ns2" route del default via dead:2::1
+else
+       echo "SKIP: bridge + tunnel flowtable regression (tun0 missing)"
+       [ "$ret" -eq 0 ] && ret=$ksft_skip
+fi
+
 
 # Another test:
 # Add bridge interface br0 to Router1, with NAT and VLAN.