tools/testing/selftests/net/netfilter/nft_fib_nexthop.sh

Source file repositories/reference/linux-study-clean/tools/testing/selftests/net/netfilter/nft_fib_nexthop.sh

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/net/netfilter/nft_fib_nexthop.sh
Extension
.sh
Size
5039 bytes
Lines
153
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: tools
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
# shellcheck disable=SC2154
#
# Exercise nft_fib6_eval()'s sibling/nh enumeration on three route shapes:
#   1) route via a single external nexthop (nhid)
#   2) route via an external nexthop group (nhid -> group, two members)
#   3) route via old-style multipath (nexthop ... nexthop ...)
#
# In each scenario the route's nexthop set contains veth0 (the iif of the
# test packet). nft_fib6_info_nh_uses_dev() must walk the set and report
# veth0 as a valid oif. For (2) and (3) the matching nexthop is the second
# member, so the walk has to traverse beyond the primary nh.
#
# After sending $PKTS ICMPv6 echo requests from ns1, check two counters on
# nsrouter:
#   nf_ok  -- `fib daddr . iif oif eq "veth0"`  must equal $PKTS
#   nf_bad -- `fib daddr . iif oif missing`     must stay at 0
# Both rules also match on iif veth0 and ip6 daddr dead:dead::/64 so that
# kernel-generated ND/MLD/RA traffic cannot pollute the counters.
#
# Topology similar to nft_fib.sh, without ns2; two dummy interfaces on
# nsrouter host extra nh devices:
#
#   dead:1::99             dead:1::1
#       ns1 <----veth----> nsrouter --- dummy0 dead:2::1
#                                   \-- dummy1 dead:9::1

source lib.sh

ret=0
PKTS=3

checktool "nft --version" "run test without nft"
checktool "ip -V"         "run test without iproute2"

setup_ns nsrouter ns1
trap cleanup_all_ns EXIT

if ! ip link add veth0 netns "$nsrouter" type veth peer name eth0 netns "$ns1" \
	> /dev/null 2>&1; then
	echo "SKIP: No virtual ethernet pair device support in kernel"
	exit $ksft_skip
fi

ip -net "$ns1" link set lo up
ip -net "$ns1" link set eth0 up
ip -net "$ns1" -6 addr add dead:1::99/64 dev eth0 nodad
ip -net "$ns1" -6 route add default via dead:1::1

ip -net "$nsrouter" link set lo up
ip -net "$nsrouter" link set veth0 up
ip -net "$nsrouter" -6 addr add dead:1::1/64 dev veth0 nodad

if ! ip -net "$nsrouter" link add dummy0 type dummy 2>/dev/null; then
	echo "SKIP: dummy netdev not available"
	exit $ksft_skip
fi
ip -net "$nsrouter" link set dummy0 up
ip -net "$nsrouter" -6 addr add dead:2::1/64 dev dummy0 nodad

ip -net "$nsrouter" link add dummy1 type dummy
ip -net "$nsrouter" link set dummy1 up
ip -net "$nsrouter" -6 addr add dead:9::1/64 dev dummy1 nodad

ip netns exec "$nsrouter" sysctl -q net.ipv6.conf.all.forwarding=1

load_fib_rule() {
	# filter on iif + daddr so the counters only see our test packets
	ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF

Annotation

Implementation Notes