Re: [netfilter-core] [PATCH nft v4] src: Support netdev egress hook

[Phil Sutter <phil@nwl.cc>]

Hi Lukas,

On Sun, Jan 24, 2021 at 03:25:06PM +0100, Lukas Wunner wrote:
[...]
> diff --git a/tests/py/inet/ip.t.payload.netdev b/tests/py/inet/ip.t.payload.netdev
> index 95be919..38ed0ad 100644
> --- a/tests/py/inet/ip.t.payload.netdev
> +++ b/tests/py/inet/ip.t.payload.netdev
> @@ -12,3 +12,17 @@ netdev test-netdev ingress
>    [ payload load 6b @ link header + 6 => reg 10 ]
>    [ lookup reg 1 set __set%d ]
>  
> +# meta protocol ip ip saddr . ip daddr . ether saddr { 1.1.1.1 . 2.2.2.2 . ca:fe:ca:fe:ca:fe }
> +__set%d test-netdev 3
> +__set%d test-netdev 0
> +	element 01010101 02020202 fecafeca 0000feca  : 0 [end]
> +netdev test-netdev egress 
> +  [ meta load protocol => reg 1 ]
> +  [ cmp eq reg 1 0x00000008 ]
> +  [ meta load iiftype => reg 1 ]
> +  [ cmp eq reg 1 0x00000001 ]
> +  [ payload load 4b @ network header + 12 => reg 1 ]
> +  [ payload load 4b @ network header + 16 => reg 9 ]
> +  [ payload load 6b @ link header + 6 => reg 10 ]
> +  [ lookup reg 1 set __set%d ]
> +

This payload dump is identical to the one which exists in that file
already with the exception of the chain name. AFAIR, nft-test.py checks
only element list and VM code when verifying, deliberately ignoring the
chain name (so a single payload dump serves all tested chains). From my
perspective, you should not need to add any payload dump at all. Could
you please try without them?

Thanks, Phil