@@ -25,6 +25,9 @@ cleanup()
}
checktool "nft --version" "test without nft tool"
+checktool "socat -h" "run test without socat"
+
+modprobe -q sctp
trap cleanup EXIT
@@ -375,6 +378,40 @@ EOF
wait 2>/dev/null
}
+test_sctp_forward()
+{
+ ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF
+table inet sctpq {
+ chain forward {
+ type filter hook forward priority 0; policy accept;
+ sctp dport 12345 queue num 10
+ }
+}
+EOF
+ ip netns exec "$nsrouter" ./nf_queue -q 10 -G -t "$timeout" &
+ local nfqpid=$!
+
+ timeout 5 ip netns exec "$ns2" socat -u SCTP-LISTEN:12345 STDOUT > "$TMPFILE1" &
+ local rpid=$!
+
+ # ss does not show the sctp socket?
+ busywait "$BUSYWAIT_TIMEOUT" sh -c "ps axf | grep -q SCTP-LISTEN" "$ns2"
+
+ ip netns exec "$ns1" socat -u STDIN SCTP:10.0.2.99:12345 <"$TMPINPUT" >/dev/null
+
+ if ! ip netns exec "$nsrouter" nft delete table inet sctpq; then
+ echo "FAIL: Could not delete sctpq table"
+ exit 1
+ fi
+
+ if ! diff -u "$TMPINPUT" "$TMPFILE1" ; then
+ echo "FAIL: lost packets?!" 1>&2
+ return
+ fi
+
+ wait "$rpid" && echo "PASS: sctp and nfqueue in forward chain with GSO"
+}
+
ip netns exec "$nsrouter" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
@@ -413,5 +450,6 @@ test_tcp_localhost
test_tcp_localhost_connectclose
test_tcp_localhost_requeue
test_icmp_vrf
+test_sctp_forward
exit $ret
Test that nfqueue, when using GSO, process SCTP packets correctly. Regression test for https://bugzilla.netfilter.org/show_bug.cgi?id=1742 Signed-off-by: Antonio Ojea <aojea@google.com> --- .../selftests/net/netfilter/nft_queue.sh | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+)