Add a tdc case covering the leak fixed by the previous patch. The test attaches "action ct" to a clsact ingress chain and injects ten IPv6 frames whose nexthdr says hop-by-hop but which carry nothing after the 40-byte header, so ipv6_find_hdr() fails and tcf_ct_ipv6_is_fragment() returns -EPROTO.
Before the fix act_ct returned TC_ACT_CONSUMED for these packets, so tc_run() never reached its TC_ACT_SHOT arm and the clsact drop counter stayed at zero while the skbs leaked. After the fix the packets are dropped properly and the counter reflects them, which is what the test matches on: before: Sent 476 bytes 11 pkt (dropped 0, overlimits 0 requeues 0) after: Sent 400 bytes 10 pkt (dropped 10, overlimits 0 requeues 0) Assisted-by: Anthropic-Claude-Code:Claude-Opus-5 Signed-off-by: Hyunjung Ko <[email protected]> --- .../selftests/tc-testing/tc-tests/actions/ct.json | 40 ++++++++++++++++++++++ 1 file changed, 40 insertions(+) New in v2, requested by Jamal. Caveat on how far I verified it: I do not have a scapy-capable tdc environment set up, so I have not run tdc.py over this case itself. What I did run, on both an unpatched and a patched v7.2-rc6 under qemu, is exactly what the case does - clsact ingress plus "matchall action ct" on a veth pair, ten of the same malformed frames injected on the peer, then "tc -s qdisc show dev <dev> clsact": unpatched: Sent 476 bytes 11 pkt (dropped 0, overlimits 0 requeues 0) patched: Sent 400 bytes 10 pkt (dropped 10, overlimits 0 requeues 0) so the matchPattern does discriminate. The JSON itself is modelled on the existing scapy cases in the same file (3992, 9c2a). A run through tdc.py proper before this is applied would be welcome. diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json index da65f838bd52..8ab48def89b6 100644 --- a/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json +++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ct.json @@ -702,5 +702,45 @@ "$TC qdisc del dev $DUMMY clsact", "$TC qdisc del dev $DUMMY root handle 1:" ] + }, + { + "id": "c7a3", + "name": "Verify act_ct drops a packet whose header checks fail", + "category": [ + "actions", + "ct", + "scapy" + ], + "plugins": { + "requires": [ + "nsPlugin", + "scapyPlugin" + ] + }, + "setup": [ + [ + "$TC qdisc del dev $DEV1 clsact", + 0, + 1, + 2, + 255 + ], + "$TC qdisc add dev $DEV1 clsact" + ], + "cmdUnderTest": "$TC filter add dev $DEV1 ingress protocol all prio 1 matchall action ct", + "scapy": [ + { + "iface": "$DEV0", + "count": 10, + "packet": "Ether(type=0x86dd)/IPv6(nh=0, plen=0, src='::1', dst='::2')" + } + ], + "expExitCode": "0", + "verifyCmd": "$TC -s qdisc show dev $DEV1 clsact", + "matchPattern": "dropped 10", + "matchCount": "1", + "teardown": [ + "$TC qdisc del dev $DEV1 clsact" + ] } ] -- 2.43.0
