selftests: fib_rule_tests: Add DSCP selector connect tests

Test that locally generated traffic from a socket that specifies a DS
Field using the IP_TOS / IPV6_TCLASS socket options is correctly
redirected using a FIB rule that matches on DSCP. Add negative tests to
verify that the rule is not it when it should not. Test with both IPv4
and IPv6 and with both TCP and UDP sockets.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20240911093748.3662015-7-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
index 21d11d2..1d58b3b 100755 (executable)
--- a/tools/testing/selftests/net/fib_rule_tests.sh
+++ b/tools/testing/selftests/net/fib_rule_tests.sh
@@ -336,6 +336,34 @@ fib_rule6_connect_test()
        log_test $? 1 "rule6 dsfield tcp no connect (dsfield 0x20)"
 
        $IP -6 rule del dsfield 0x04 table $RTABLE_PEER
+
+       ip rule help 2>&1 | grep -q dscp
+       if [ $? -ne 0 ]; then
+               echo "SKIP: iproute2 iprule too old, missing dscp match"
+               cleanup_peer
+               return
+       fi
+
+       $IP -6 rule add dscp 0x3f table $RTABLE_PEER
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -U -D -Q 0xfc \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 0 "rule6 dscp udp connect"
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -Q 0xfc \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 0 "rule6 dscp tcp connect"
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -U -D -Q 0xf4 \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 1 "rule6 dscp udp no connect"
+
+       nettest -q -6 -B -t 5 -N $testns -O $peerns -Q 0xf4 \
+               -l 2001:db8::1:11 -r 2001:db8::1:11
+       log_test $? 1 "rule6 dscp tcp no connect"
+
+       $IP -6 rule del dscp 0x3f table $RTABLE_PEER
+
        cleanup_peer
 }
 
@@ -547,6 +575,34 @@ fib_rule4_connect_test()
        log_test $? 1 "rule4 dsfield tcp no connect (dsfield 0x20)"
 
        $IP -4 rule del dsfield 0x04 table $RTABLE_PEER
+
+       ip rule help 2>&1 | grep -q dscp
+       if [ $? -ne 0 ]; then
+               echo "SKIP: iproute2 iprule too old, missing dscp match"
+               cleanup_peer
+               return
+       fi
+
+       $IP -4 rule add dscp 0x3f table $RTABLE_PEER
+
+       nettest -q -B -t 5 -N $testns -O $peerns -D -U -Q 0xfc \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 0 "rule4 dscp udp connect"
+
+       nettest -q -B -t 5 -N $testns -O $peerns -Q 0xfc \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 0 "rule4 dscp tcp connect"
+
+       nettest -q -B -t 5 -N $testns -O $peerns -D -U -Q 0xf4 \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 1 "rule4 dscp udp no connect"
+
+       nettest -q -B -t 5 -N $testns -O $peerns -Q 0xf4 \
+               -l 198.51.100.11 -r 198.51.100.11
+       log_test $? 1 "rule4 dscp tcp no connect"
+
+       $IP -4 rule del dscp 0x3f table $RTABLE_PEER
+
        cleanup_peer
 }
 ################################################################################