[PATCH net-next 2/2] selftests/net/openvswitch: add SCTP flow key test across conntrack NAT
From: Minxi Hou
Date: Sat Aug 22 2026 - 22:11:03 EST
Conntrack NAT rewrites the packet between the first-pass and recirc
passes, and OVS re-extracts L3/L4 on the recirculated skb via
ovs_flow_key_update_l3l4(). Nothing in the suite exercises SCTP key
extraction on that post-NAT path: the existing nat test drives TCP
over nc, and the merged SCTP test has no conntrack in the path.
Add test_sctp_nat_connect_v4, reusing the nat4 fixture with the SCTP
socket pair from the v4 SCTP test: untracked ipv4 traffic hits
ct(commit,nat(...)),recirc, and the post-recirc flows match
ct_state(+trk) with the extracted sctp(dst=4443)/sctp(src=4443) ports.
A probe for the SCTP conntrack sysctl turns a kernel without working
SCTP conntrack into a skip instead of an opaque timeout. After the
association succeeds the test pushes a known payload across and
verifies the listener received it, so a flow-key bug that matches
handshake packets but breaks DATA chunks is caught too. If ct+nat is
accepted but the association or DATA fails, the test fails.
Signed-off-by: Minxi Hou <houminxi@xxxxxxxxx>
---
.../selftests/net/openvswitch/openvswitch.sh | 86 +++++++++++++++++++
1 file changed, 86 insertions(+)
diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh
index 06bd98d80a08..d5acdca0a0ac 100755
--- a/tools/testing/selftests/net/openvswitch/openvswitch.sh
+++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh
@@ -35,6 +35,7 @@ tests="
icmpv6 icmpv6: ICMPv6 echo type match
sctp_connect_v4 sctp: SCTP flow key matching
sctp_connect_v6 sctp6: SCTP flow key matching over IPv6
+ sctp_nat_connect_v4 sctpnat4: SCTP flow key across conntrack NAT
psample psample: Sampling packets with psample"
info() {
@@ -1186,6 +1187,91 @@ test_nat_connect_v4 () {
return 0
}
+# sctp_nat_connect_v4 test
+# - SCTP association crosses a ct(commit,nat(dst=...)) translation
+# - post-recirc flows match ct_state(+trk) plus the extracted SCTP ports
+test_sctp_nat_connect_v4 () {
+ local t="test_sctp_nat_connect_v4"
+ local payload="SCTP_NAT_DATA_OK"
+ local rxfile="${ovs_base}/${t}/sctp-rx.txt"
+
+ modprobe -q sctp 2>/dev/null || return "$ksft_skip"
+ socat -V 2>&1 | grep -q "define WITH_SCTP" || return "$ksft_skip"
+ # SCTP conntrack is compiled into nf_conntrack.ko, so check that
+ # loading it actually exposed the SCTP conntrack sysctls.
+ modprobe -q nf_conntrack 2>/dev/null || return "$ksft_skip"
+ [ -e /proc/sys/net/netfilter/nf_conntrack_sctp_timeout_established ] \
+ || { info "no SCTP conntrack support - skipping"
+ return "$ksft_skip"; }
+
+ sbx_add "test_sctp_nat_connect_v4" || return $?
+
+ ovs_add_dp "test_sctp_nat_connect_v4" sctpnat4 || return 1
+ info "create namespaces"
+ for ns in client server; do
+ ovs_add_netns_and_veths "test_sctp_nat_connect_v4" "sctpnat4" \
+ "$ns" "${ns:0:1}0" "${ns:0:1}1" || return 1
+ done
+
+ ip netns exec client ip addr add 172.31.110.10/24 dev c1
+ ip netns exec client ip link set c1 up
+ ip netns exec server ip addr add 172.31.110.20/24 dev s1
+ ip netns exec server ip link set s1 up
+
+ ip netns exec client ip route add default via 172.31.110.20
+
+ # Check if the ct action can be configured.
+ ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \
+ 'in_port(1),eth(),eth_type(0x0800),ipv4()' \
+ 'ct(commit),recirc(0x1)' &> /dev/null
+ if [ $? == 1 ]; then
+ info "no support for ct action - skipping"
+ ovs_exit_sig
+ return $ksft_skip
+ fi
+
+ ovs_del_flows "test_sctp_nat_connect_v4" sctpnat4
+
+ ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \
+ 'in_port(1),eth(),eth_type(0x0806),arp()' '2' || return 1
+ ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \
+ 'in_port(2),eth(),eth_type(0x0806),arp()' '1' || return 1
+ ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \
+ "ct_state(-trk),in_port(1),eth(),eth_type(0x0800),ipv4(dst=192.168.0.20)" \
+ "ct(commit,nat(dst=172.31.110.20)),recirc(0x1)" || return 1
+ ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \
+ "ct_state(-trk),in_port(2),eth(),eth_type(0x0800),ipv4()" \
+ "ct(commit,nat),recirc(0x2)" || return 1
+
+ ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \
+ "recirc_id(0x1),ct_state(+trk-inv),in_port(1),eth(),eth_type(0x0800),ipv4(proto=132),sctp(dst=4443)" \
+ "2" || return 1
+ ovs_add_flow "test_sctp_nat_connect_v4" sctpnat4 \
+ "recirc_id(0x2),ct_state(+trk-inv),in_port(2),eth(),eth_type(0x0800),ipv4(proto=132),sctp(src=4443)" \
+ "1" || return 1
+
+ ovs_netns_spawn_daemon "test_sctp_nat_connect_v4" "server" \
+ socat -u -t 1 SCTP4-LISTEN:4443,fork \
+ OPEN:"$rxfile",creat,append
+ ovs_wait sctp_eps_has server 4443 || return 1
+
+ info "verify SCTP association across NAT"
+ ovs_sbx "test_sctp_nat_connect_v4" ip netns exec client \
+ timeout 3 socat -u STDIN "SCTP4-CONNECT:192.168.0.20:4443" \
+ </dev/null || return 1
+
+ info "verify SCTP DATA chunk crosses NAT"
+ ovs_sbx "test_sctp_nat_connect_v4" ip netns exec client \
+ timeout 3 socat -u STDIN "SCTP4-CONNECT:192.168.0.20:4443" \
+ <<< "$payload" || return 1
+ grep -q "$payload" "$rxfile" 2>/dev/null \
+ || { info "server did not receive SCTP DATA payload"
+ return 1; }
+
+ info "done..."
+ return 0
+}
+
# nat_related_v4 test
# - client->server ip packets go via SNAT
# - client solicits ICMP destination unreachable packet from server
base-commit: 91ec2035134982b98fab0609a9fd8480e8217dc1
prerequisite-patch-id: a3848bf8ef3803b528f964b8e866dd3622e5b154
--
2.55.0