From 392551884f44038a921c55ebf39acc71629c2fcd Mon Sep 17 00:00:00 2001 From: Minxi Hou Date: Fri, 18 Sep 2026 10:46:46 -0400 Subject: [PATCH 1/2] selftests/net/openvswitch: add SCTP flow key test over IPv6 The merged SCTP test covers only IPv4. The SCTP branch of the IPv6 extractor (the proto=132 walk after parse_ipv6hdr) and the v6 side of the SCTP netlink validation (match_validate() requires the sctp() key whenever ipv6(proto=132) is matched) have no selftest coverage. Add test_sctp_connect_v6 mirroring the v4 test: bare icmpv6() flows forward NS/NA, and ipv6(proto=132),sctp(dst=4443)/sctp(src=4443) flows gate the association in the same three phases (flows installed, removed, reinstalled). A keyless ipv6(proto=132) install must be refused with EINVAL, pinning the reject side of the match_validate() rule; without it a regression dropping the requirement would pass unnoticed. The refusal is asserted to be EINVAL specifically, not a parse error of the flow string. After the association succeeds the test also pushes a known payload across and waits for the listener to log it, proving the datapath carries the association's traffic end to end, not only its handshake. Skips when the sctp module is missing, socat lacks SCTP or IPv6 support, or IPv6 is unavailable; an association or payload failure with the flows installed fails the test. Signed-off-by: Minxi Hou Reviewed-by: Narcisa Vasile Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260918144647.2024095-2-houminxi@gmail.com Signed-off-by: Jakub Kicinski --- .../selftests/net/openvswitch/openvswitch.sh | 109 ++++++++++++++++++ 1 file changed, 109 insertions(+) diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh index a31f7fb6882d..aa84fafc3201 100755 --- a/tools/testing/selftests/net/openvswitch/openvswitch.sh +++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh @@ -34,6 +34,7 @@ tests=" trunc trunc: output truncation icmpv6 icmpv6: ICMPv6 echo type match sctp_connect_v4 sctp: SCTP flow key matching + sctp_connect_v6 sctp6: SCTP flow keys over IPv6 psample psample: Sampling packets with psample" info() { @@ -700,6 +701,114 @@ test_sctp_connect_v4() { return 0 } +# sctp_connect_v6 test +# - sctp(dst=4443) matches client-to-server INIT +# - sctp(src=4443) matches server-to-client INIT-ACK +# - icmpv6 NS/NA flows forward neighbour discovery +# - remove flows and verify connection fails, reinstall and recover +test_sctp_connect_v6() { + local t="test_sctp_connect_v6" + local v6="eth_type(0x86dd),ipv6(proto=132)" + local payload="SCTP6_DATA_OK" + local rxfile="${ovs_base}/${t}/sctp-rx.txt" + + modprobe -q sctp 2>/dev/null || return "$ksft_skip" + socat -V 2>&1 | grep -q "define WITH_SCTP" || return "$ksft_skip" + socat -V 2>&1 | grep -q "define WITH_IP6" || return "$ksft_skip" + [ -e /proc/sys/net/ipv6 ] || return "$ksft_skip" + + sbx_add "$t" || return $? + ovs_add_dp "$t" sctp6 || return 1 + + info "create namespaces" + for ns in client server; do + ovs_add_netns_and_veths "$t" "sctp6" "$ns" \ + "${ns:0:1}0" "${ns:0:1}1" || return 1 + done + + ip netns exec client ip addr add fd00::1/64 dev c1 nodad + ip netns exec client ip link set c1 up + ip netns exec server ip addr add fd00::2/64 dev s1 nodad + ip netns exec server ip link set s1 up + + # NS/NA forwarding + ovs_add_flow "$t" sctp6 \ + 'in_port(1),eth(),eth_type(0x86dd),ipv6(proto=58),icmpv6()' \ + '2' || return 1 + ovs_add_flow "$t" sctp6 \ + 'in_port(2),eth(),eth_type(0x86dd),ipv6(proto=58),icmpv6()' \ + '1' || return 1 + + # SCTP port matching: dst for request, src for reply + ovs_add_flow "$t" sctp6 \ + "in_port(1),eth(),$v6,sctp(dst=4443)" \ + '2' || return 1 + ovs_add_flow "$t" sctp6 \ + "in_port(2),eth(),$v6,sctp(src=4443)" \ + '1' || return 1 + + # A keyless ipv6(proto=132) install must be refused (EINVAL): + # match_validate() requires the sctp() key. Pin the reject side + # of that rule; the keyed installs above cover the accept side. + # Verify the refusal is EINVAL (missing key), not a parse error. + err=$(ovs_sbx "$t" python3 $ovs_base/ovs-dpctl.py add-flow sctp6 \ + "in_port(1),eth(),$v6" '2' 2>&1 >/dev/null) \ + && { info "keyless SCTP flow should be refused" + return 1; } + echo "$err" | grep -q "(22," || { + info "keyless SCTP flow refused for wrong reason: $err" + return 1 + } + + ovs_netns_spawn_daemon "$t" "server" \ + socat -u -t 1 SCTP6-LISTEN:4443,fork \ + OPEN:"$rxfile",creat,append + ovs_wait sctp_eps_has server 4443 || return 1 + + info "verify SCTP association with port-keyed flows" + ovs_sbx "$t" ip netns exec client \ + timeout 3 socat -u STDIN "SCTP6-CONNECT:[fd00::2]:4443" /dev/null 2>&1 \ + && { info "connection should fail without flows" + return 1; } + + info "reinstall flows and verify recovery" + ovs_add_flow "$t" sctp6 \ + "in_port(1),eth(),$v6,sctp(dst=4443)" \ + '2' || return 1 + ovs_add_flow "$t" sctp6 \ + "in_port(2),eth(),$v6,sctp(src=4443)" \ + '1' || return 1 + + ovs_sbx "$t" ip netns exec client \ + timeout 3 socat -u STDIN "SCTP6-CONNECT:[fd00::2]:4443" Date: Fri, 18 Sep 2026 10:46:47 -0400 Subject: [PATCH 2/2] selftests/net/openvswitch: add SCTP flow key test across conntrack NAT After conntrack NAT rewrites a packet, OVS refreshes the cached flow key in ovs_nat_update_key(), which has a per-protocol branch for the L4 ports (UDP/TCP/SCTP, conntrack.c). Address-only NAT cannot tell a working SCTP branch from a missing one: the ports survive unchanged either way, so a post-recirc match on the original port stays green even with the branch deleted. The suite's NAT coverage drives TCP over nc, and the merged SCTP test has no conntrack in the path, so the SCTP branch goes unexercised. Add test_sctp_nat_connect_v4: untracked client traffic to 192.168.0.20:4443 hits ct(commit,nat(dst=172.31.110.20:5555)),recirc, and the post-recirc flows match the translated tuple, ipv4(dst=172.31.110.20),sctp(dst=5555). Reply traffic is matched on the restored original tuple, sctp(src=4443). With the SCTP branch broken the translated port never reaches the key, no post-recirc flow matches, and the association fails. The probe flow uses the same ct+nat action as the real flows, so a kernel without CONFIG_NF_NAT rejects it at flow-add time and the test skips instead of failing. The config fragment sets CONFIG_NETFILTER_ADVANCED=y so CONFIG_NF_CT_PROTO_SCTP is visible, CONFIG_NF_CT_PROTO_SCTP=y, and CONFIG_NF_NAT=m so the reference build actually has those pieces. After the association succeeds the test pushes a known payload across and waits for the listener to log it. Signed-off-by: Minxi Hou Reviewed-by: Narcisa Vasile Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260918144647.2024095-3-houminxi@gmail.com Signed-off-by: Jakub Kicinski --- .../testing/selftests/net/openvswitch/config | 3 + .../selftests/net/openvswitch/openvswitch.sh | 93 +++++++++++++++++++ 2 files changed, 96 insertions(+) diff --git a/tools/testing/selftests/net/openvswitch/config b/tools/testing/selftests/net/openvswitch/config index a825e0b5c88e..15685d242813 100644 --- a/tools/testing/selftests/net/openvswitch/config +++ b/tools/testing/selftests/net/openvswitch/config @@ -3,10 +3,13 @@ CONFIG_INET_DIAG=y CONFIG_IP_SCTP=y CONFIG_IPV6=y CONFIG_NETFILTER=y +CONFIG_NETFILTER_ADVANCED=y CONFIG_NET_IPGRE=m CONFIG_NET_IPGRE_DEMUX=m CONFIG_NF_CONNTRACK=m CONFIG_NF_CONNTRACK_OVS=y +CONFIG_NF_CT_PROTO_SCTP=y +CONFIG_NF_NAT=m CONFIG_OPENVSWITCH=m CONFIG_PSAMPLE=m CONFIG_VETH=y diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh index aa84fafc3201..21444657a040 100755 --- a/tools/testing/selftests/net/openvswitch/openvswitch.sh +++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh @@ -35,6 +35,7 @@ tests=" icmpv6 icmpv6: ICMPv6 echo type match sctp_connect_v4 sctp: SCTP flow key matching sctp_connect_v6 sctp6: SCTP flow keys over IPv6 + sctp_nat_connect_v4 sctpnat4: SCTP NAT translation psample psample: Sampling packets with psample" info() { @@ -1200,6 +1201,98 @@ test_nat_connect_v4 () { return 0 } +# sctp_nat_connect_v4 test +# - SCTP association crosses a ct(commit,nat(dst=ip:port)) DNAT +# - post-recirc flows match the translated address and port, so the +# SCTP branch of the post-NAT flow key update is load-bearing +test_sctp_nat_connect_v4 () { + local t="test_sctp_nat_connect_v4" + local payload="SCTP_NAT_DATA_OK" + local rxfile="${ovs_base}/${t}/sctp-rx.txt" + + modprobe -q sctp 2>/dev/null || return "$ksft_skip" + socat -V 2>&1 | grep -q "define WITH_SCTP" || return "$ksft_skip" + # SCTP conntrack is compiled into nf_conntrack.ko, so check that + # loading it actually exposed the SCTP conntrack sysctls. + modprobe -q nf_conntrack 2>/dev/null || return "$ksft_skip" + [ -e /proc/sys/net/netfilter/nf_conntrack_sctp_timeout_established ] \ + || { info "no SCTP conntrack support - skipping" + return "$ksft_skip"; } + + sbx_add "test_sctp_nat_connect_v4" || return $? + + ovs_add_dp "test_sctp_nat_connect_v4" sctpnat4 || return 1 + info "create namespaces" + for ns in client server; do + ovs_add_netns_and_veths "test_sctp_nat_connect_v4" "sctpnat4" \ + "$ns" "${ns:0:1}0" "${ns:0:1}1" || return 1 + done + + ip netns exec client ip addr add 172.31.110.10/24 dev c1 + ip netns exec client ip link set c1 up + ip netns exec server ip addr add 172.31.110.20/24 dev s1 + ip netns exec server ip link set s1 up + + ip netns exec client ip route add default via 172.31.110.20 + + # Check if the ct and nat actions can be configured. + ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \ + 'in_port(1),eth(),eth_type(0x0800),ipv4()' \ + 'ct(commit,nat(dst=172.31.110.20:5555)),recirc(0x1)' \ + &> /dev/null + if [ $? == 1 ]; then + info "no support for ct/nat actions - skipping" + ovs_exit_sig + return $ksft_skip + fi + + ovs_del_flows "test_sctp_nat_connect_v4" sctpnat4 + + ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \ + 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1 + ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \ + 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1 + ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \ + "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),"\ +"ipv4(dst=192.168.0.20)" \ + "ct(commit,nat(dst=172.31.110.20:5555)),recirc(0x1)" || return 1 + ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \ + "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \ + "ct(commit,nat),recirc(0x2)" || return 1 + + ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \ + "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),"\ +"eth_type(0x0800),ipv4(dst=172.31.110.20,proto=132),"\ +"sctp(dst=5555)" \ + "2" || return 1 + ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \ + "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),"\ +"eth_type(0x0800),ipv4(src=192.168.0.20,proto=132),"\ +"sctp(src=4443)" \ + "1" || return 1 + + ovs_netns_spawn_daemon "test_sctp_nat_connect_v4" "server" \ + socat -u -t 1 SCTP4-LISTEN:5555,fork \ + OPEN:"$rxfile",creat,append + ovs_wait sctp_eps_has server 5555 || return 1 + + info "verify SCTP association across NAT" + ovs_sbx "test_sctp_nat_connect_v4" ip netns exec client \ + timeout 3 socat -u STDIN "SCTP4-CONNECT:192.168.0.20:4443" \ + server ip packets go via SNAT # - client solicits ICMP destination unreachable packet from server