diff mbox series

[nft] tests: shell: Add coverage for nf_connlabels_replace()

Message ID 20260825102429.173237-1-jpeska@redhat.com
State Changes Requested, archived
Headers show
Series [nft] tests: shell: Add coverage for nf_connlabels_replace() | expand

Commit Message

Jiri Peska Aug. 25, 2026, 10:24 a.m. UTC 
Signed-off-by: Jiri Peska <jpeska@redhat.com>
---
 tests/shell/testcases/packetpath/ct_label_set |  27 ++++
 .../packetpath/dumps/ct_label_set.json-nft    | 132 ++++++++++++++++++
 .../packetpath/dumps/ct_label_set.nft         |  11 ++
 3 files changed, 170 insertions(+)
 create mode 100755 tests/shell/testcases/packetpath/ct_label_set
 create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
 create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.nft

Comments

Florian Westphal Aug. 25, 2026, 10:45 a.m. UTC | #1 
Jiri Peska <jpeska@redhat.com> wrote:
> Signed-off-by: Jiri Peska <jpeska@redhat.com>
> ---
>  tests/shell/testcases/packetpath/ct_label_set |  27 ++++
>  .../packetpath/dumps/ct_label_set.json-nft    | 132 ++++++++++++++++++
>  .../packetpath/dumps/ct_label_set.nft         |  11 ++
>  3 files changed, 170 insertions(+)
>  create mode 100755 tests/shell/testcases/packetpath/ct_label_set
>  create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
>  create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.nft

This fails for me in dump validation, diff is:

-               icmp type echo-request ip daddr 127.0.0.1 ct label set 1
-               icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name "labeled"
+               icmp type echo-request ip daddr 127.0.0.1 ct label set "bar"
+               icmp type echo-request ip daddr 127.0.0.1 ct label "bar" counter name "labeled"

This is caused by local configuration.  I'd remove the dump files here
before applying (and add a nodump file instead).

As the test explicitly checks counters in the script, it will still be
useful to assert match/nomatch.

What do you think?
diff mbox series

Patch

diff --git a/tests/shell/testcases/packetpath/ct_label_set b/tests/shell/testcases/packetpath/ct_label_set
new file mode 100755
index 00000000..554829c0
--- /dev/null
+++ b/tests/shell/testcases/packetpath/ct_label_set
@@ -0,0 +1,27 @@ 
+#!/bin/bash
+
+set -e
+
+ip link set lo up
+
+$NFT -f - <<EOF
+table ip test {
+    counter labeled {}
+    chain output {
+        type filter hook output priority filter; policy accept;
+            # set bit 1 on each echo-request
+            icmp type echo-request ip daddr 127.0.0.1 ct label set 1
+            # count only if label is already set
+            icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name labeled
+    }
+}
+EOF
+
+# Packet 1: replace sets bit 1
+ping -c 1 -W 1 127.0.0.1 >/dev/null
+
+# Packet 2+: same rule applies on same ICMP ct
+ping -c 2 -W 1 127.0.0.1 >/dev/null
+
+# Assert correct number of matched packets
+$NFT list counter ip test labeled | grep -q 'packets 3'
diff --git a/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft b/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
new file mode 100644
index 00000000..f8e2945a
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
@@ -0,0 +1,132 @@ 
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "test",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "test",
+        "name": "output",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": 0,
+        "policy": "accept"
+      }
+    },
+    {
+      "counter": {
+        "family": "ip",
+        "name": "labeled",
+        "table": "test",
+        "handle": 0,
+        "packets": 3,
+        "bytes": 252
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test",
+        "chain": "output",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "ip",
+                  "field": "daddr"
+                }
+              },
+              "right": "127.0.0.1"
+            }
+          },
+          {
+            "mangle": {
+              "key": {
+                "ct": {
+                  "key": "label"
+                }
+              },
+              "value": 1
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test",
+        "chain": "output",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "ip",
+                  "field": "daddr"
+                }
+              },
+              "right": "127.0.0.1"
+            }
+          },
+          {
+            "match": {
+              "op": "in",
+              "left": {
+                "ct": {
+                  "key": "label"
+                }
+              },
+              "right": 1
+            }
+          },
+          {
+            "counter": "labeled"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/shell/testcases/packetpath/dumps/ct_label_set.nft b/tests/shell/testcases/packetpath/dumps/ct_label_set.nft
new file mode 100644
index 00000000..261677f8
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/ct_label_set.nft
@@ -0,0 +1,11 @@ 
+table ip test {
+	counter labeled {
+		packets 3 bytes 252
+	}
+
+	chain output {
+		type filter hook output priority filter; policy accept;
+		icmp type echo-request ip daddr 127.0.0.1 ct label set 1
+		icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name "labeled"
+	}
+}