Hi Daniel,
On Tue, Aug 9, 2022, at 3:14 PM, Daniel Borkmann wrote:
> Hi Daniel,
>
> On 8/9/22 6:34 PM, Daniel Xu wrote:
>> Test that the prog can read from the connection mark. This test is nice
>> because it ensures progs can interact with netfilter subsystem
>> correctly.
>>
>> Signed-off-by: Daniel Xu <dxu@xxxxxxxxx>
>> ---
>> tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 3 ++-
>> tools/testing/selftests/bpf/progs/test_bpf_nf.c | 3 +++
>> 2 files changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
>> index 317978cac029..7232f6dcd252 100644
>> --- a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
>> +++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
>> @@ -44,7 +44,7 @@ static int connect_to_server(int srv_fd)
>>
>> static void test_bpf_nf_ct(int mode)
>> {
>> - const char *iptables = "iptables -t raw %s PREROUTING -j CT";
>> + const char *iptables = "iptables -t raw %s PREROUTING -j CONNMARK --set-mark 42/0";
>> int srv_fd = -1, client_fd = -1, srv_client_fd = -1;
>> struct sockaddr_in peer_addr = {};
>> struct test_bpf_nf *skel;
>> @@ -114,6 +114,7 @@ static void test_bpf_nf_ct(int mode)
>> /* expected status is IPS_SEEN_REPLY */
>> ASSERT_EQ(skel->bss->test_status, 2, "Test for ct status update ");
>> ASSERT_EQ(skel->data->test_exist_lookup, 0, "Test existing connection lookup");
>> + ASSERT_EQ(skel->bss->test_exist_lookup_mark, 43, "Test existing connection lookup ctmark");
>> end:
>> if (srv_client_fd != -1)
>> close(srv_client_fd);
>> diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c b/tools/testing/selftests/bpf/progs/test_bpf_nf.c
>> index 84e0fd479794..2722441850cc 100644
>> --- a/tools/testing/selftests/bpf/progs/test_bpf_nf.c
>> +++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c
>> @@ -28,6 +28,7 @@ __be16 sport = 0;
>> __be32 daddr = 0;
>> __be16 dport = 0;
>> int test_exist_lookup = -ENOENT;
>> +u32 test_exist_lookup_mark = 0;
>>
>> struct nf_conn;
>>
>> @@ -174,6 +175,8 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
>> sizeof(opts_def));
>> if (ct) {
>> test_exist_lookup = 0;
>> + if (ct->mark == 42)
>> + test_exist_lookup_mark = 43;
>
> Looks like CI failed here:
>
> [...]
> progs/test_bpf_nf.c:178:11: error: no member named 'mark' in 'struct
> nf_conn'
> if (ct->mark == 42)
> ~~ ^
> 1 error generated.
> make: *** [Makefile:521:
> /tmp/runner/work/bpf/bpf/tools/testing/selftests/bpf/test_bpf_nf.o]
> Error 1
> make: *** Waiting for unfinished jobs....
> Error: Process completed with exit code 2.
>
> Likely due to missing CONFIG_NF_CONNTRACK_MARK for the CI instance.
Originally (as stated in the cover letter) I thought the CI kconfig was hosted
somewhere else. Looking closer I see the kconfigs are checked into the
selftest tree.
I think the following should fix the CI. I'll send out a v3 tomorrow morning:
diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config
index fabf0c014349..3fc46f9cfb22 100644
--- a/tools/testing/selftests/bpf/config
+++ b/tools/testing/selftests/bpf/config
@@ -50,9 +50,11 @@ CONFIG_NET_SCHED=y
CONFIG_NETDEVSIM=m
CONFIG_NETFILTER=y
CONFIG_NETFILTER_SYNPROXY=y
+CONFIG_NETFILTER_XT_CONNMARK=y
CONFIG_NETFILTER_XT_MATCH_STATE=y
CONFIG_NETFILTER_XT_TARGET_CT=y
CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_DEFRAG_IPV4=y
CONFIG_NF_DEFRAG_IPV6=y
CONFIG_RC_CORE=y
[...]
Thanks,
Daniel
