selftests: fib_rule_tests: Add DSCP selector connect tests

Test that locally generated traffic from a socket that specifies a DS
Field using the IP_TOS / IPV6_TCLASS socket options is correctly
redirected using a FIB rule that matches on DSCP. Add negative tests to
verify that the rule is not it when it should not. Test with both IPv4
and IPv6 and with both TCP and UDP sockets.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20240911093748.3662015-7-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
index 21d11d23fab78529ca0626dfee6cf448100d193e..1d58b3b87465ef2b48ad05ffca35bdc5930614af 100755 (executable)
--- a/tools/testing/selftests/net/fib_rule_tests.sh
+++ b/tools/testing/selftests/net/fib_rule_tests.sh
@@ -336,6 +336,34 @@ fib_rule6_connect_test()
        log_test $? 1 "rule6 dsfield tcp no connect (dsfield 0x20)"
 
        $IP -6 rule del dsfield 0x04 table $RTABLE_PEER
+
+       ip rule help 2>&1 | grep -q dscp
+       if [ $? -ne 0 ]; then
+               echo "SKIP: iproute2 iprule too old, missing dscp match"
+               cleanup_peer
+               return
+       fi
+
+       $IP -6 rule add dscp 0x3f table $RTABLE_PEER
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -U -D -Q 0xfc \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 0 "rule6 dscp udp connect"
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -Q 0xfc \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 0 "rule6 dscp tcp connect"
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -U -D -Q 0xf4 \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 1 "rule6 dscp udp no connect"
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -Q 0xf4 \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 1 "rule6 dscp tcp no connect"
+
+       $IP -6 rule del dscp 0x3f table $RTABLE_PEER
+
        cleanup_peer
 }
 
@@ -547,6 +575,34 @@ fib_rule4_connect_test()
        log_test $? 1 "rule4 dsfield tcp no connect (dsfield 0x20)"
 
        $IP -4 rule del dsfield 0x04 table $RTABLE_PEER
+
+       ip rule help 2>&1 | grep -q dscp
+       if [ $? -ne 0 ]; then
+               echo "SKIP: iproute2 iprule too old, missing dscp match"
+               cleanup_peer
+               return
+       fi
+
+       $IP -4 rule add dscp 0x3f table $RTABLE_PEER
+
+       nettest -q -B -t 5 -N $testns -O $peerns -D -U -Q 0xfc \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 0 "rule4 dscp udp connect"
+
+       nettest -q -B -t 5 -N $testns -O $peerns -Q 0xfc \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 0 "rule4 dscp tcp connect"
+
+       nettest -q -B -t 5 -N $testns -O $peerns -D -U -Q 0xf4 \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 1 "rule4 dscp udp no connect"
+
+       nettest -q -B -t 5 -N $testns -O $peerns -Q 0xf4 \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 1 "rule4 dscp tcp no connect"
+
+       $IP -4 rule del dscp 0x3f table $RTABLE_PEER
+
        cleanup_peer
 }
 ################################################################################