Hi Jakub, On Mon, May 06, 2024 at 06:28:30AM -0700, Jakub Kicinski via Devel wrote: > On Mon, 6 May 2024 10:05:54 +0200 Antony Antony wrote: > > Add IPsec tunnel, aka xfrm state, tests with ICMP flags enabled. > > IPv4 and IPv6, unreachable tests over xfrm/IPsec tunnels, > > xfrm SA with "flag icmp" set. > > Doesn't seem to work: thanks. I am looking into it. I notice two issues. > # selftests: net: xfrm_state.sh > # ./xfrm_state.sh: line 91: test_: command not found > # TEST: unreachable_ipv4IPv6 unreachable from router r3 [ FAIL ] This appears to be an error from the v2 run, which was sent yesterday. The v3 patch should have superseded it. The branch net-dev-testing/net-next-2024-05-06--12-00 contains the v2 patch. I wonder if net-dev testing recognized v3 patch. git diff net-next-2024-05-06--12-00 net-next-2024-05-06--03-00 ./tools/testing/selftests/net/xfrm_state.sh is missing the expected one line diff in IFS. > # ./xfrm_state.sh: line 91: test_: command not found > # TEST: unreachable_gw_ipv6IPv6 unreachable from IPsec gateway s2 [ FAIL ] > # ./xfrm_state.sh: line 91: test_: command not found > # TEST: mtu_ipv6_r2IPv6 MTU exceeded from ESP router r2 [ FAIL ] > # ./xfrm_state.sh: line 91: test_: command not found > # TEST: mtu_ipv6_r3IPv6 MTU exceeded router r3 [ FAIL ] > not ok 1 selftests: net: xfrm_state.sh # exit=1 I suspect there is another another issue with tools/testing/selftests/net/config . It does not appear to support nftables match for ESP. Which this script assumes. # ip netns exec ns_r2-39oUmE nft add rule inet filter FORWARD counter ip protocol esp counter log accept # # Error: Could not process rule: No such file or directory # add rule inet filter FORWARD counter ip protocol esp counter log accept # ^^^^^^ I learning vng also. I will send v4 with change to config, then I hope the test runner will pick up the latest patch. -antony
