[PATCH bpf-next v2] selftests/bpf: Record only the test ICMP echo in tc8 of tc_netkit_scrub

[PATCH bpf-next v2] selftests/bpf: Record only the test ICMP echo in tc8 of tc_netkit_scrub

[Qiliang Yuan]

tc_netkit_scrub attaches tc8 to the primary netkit device, sends an ICMP
echo with a mark and a priority through it, and checks the mark and the
priority that tc8 saw against what the scrub mode lets through.

tc8 records the mark and priority of every packet it sees, and the
device also carries what the system sends on its own once the device
is up, like IPv6 neighbor discovery or the mDNS of avahi-daemon. When
such a packet goes out after the echo, it overwrites what tc8 recorded,
and the test finds a mark and a priority of 0.

Record only IPv4 ICMP packets in tc8.

tc_netkit_scrub run 100 times on a bpf-next kernel with KASAN enabled,
x86_64 VM with 32 vCPUs and avahi-daemon running, before and after this
patch:

            before                                after
  outcome   2 of 100 failed (mark and priority 0)   0 of 100 failed

Fixes: 716fa7dadf11 ("selftests/bpf: Extend netkit tests to validate skb meta data")
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
---
V1 -> V2:
- Check the packet in tc8 the way tc1 and tc7 do, with
  __bpf_constant_htons() and a goto out for each check (Daniel)
- Add before/after data

v1: https://lore.kernel.org/r/20261009-selftests-bpf-tc-netkit-scrub-v1-1-f46c07a40e7c@gmail.com
---
 tools/testing/selftests/bpf/progs/test_tc_link.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/test_tc_link.c b/tools/testing/selftests/bpf/progs/test_tc_link.c
index 630f12e51b075..917d5e6c84c6f 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_link.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_link.c
@@ -4,6 +4,8 @@
 
 #include <linux/bpf.h>
 #include <linux/if_ether.h>
+#include <linux/in.h>
+#include <linux/ip.h>
 #include <linux/stddef.h>
 #include <linux/if_packet.h>
 #include <bpf/bpf_endian.h>
@@ -119,11 +121,21 @@ SEC("tc/egress")
 int tc8(struct __sk_buff *skb)
 {
 	struct net_device *dev = BPF_CORE_READ((struct sk_buff *)skb, dev);
+	struct iphdr iph = {};
+
+	/* Look only at the ICMP echo of the test, not at IPv6 ND or mDNS */
+	if (skb->protocol != __bpf_constant_htons(ETH_P_IP))
+		goto out;
+	if (bpf_skb_load_bytes(skb, sizeof(struct ethhdr), &iph, sizeof(iph)))
+		goto out;
+	if (iph.protocol != IPPROTO_ICMP)
+		goto out;
 
 	seen_tc8 = true;
 	mark = skb->mark;
 	prio = skb->priority;
 	headroom = BPF_CORE_READ(dev, needed_headroom);
 	tailroom = BPF_CORE_READ(dev, needed_tailroom);
+out:
 	return TCX_PASS;
 }

---
base-commit: e1d84a37cba984388988d2f1ddc84561413f0db2
change-id: 20261009-selftests-bpf-tc-netkit-scrub-f0eb9904d0c7

Best regards,
-- 
Qiliang Yuan <odys.yuan@gmail.com>

Re: [PATCH bpf-next v2] selftests/bpf: Record only the test ICMP echo in tc8 of tc_netkit_scrub

[Daniel Borkmann]

On 10/16/26 5:25 AM, Qiliang Yuan wrote:
> tc_netkit_scrub attaches tc8 to the primary netkit device, sends an ICMP
> echo with a mark and a priority through it, and checks the mark and the
> priority that tc8 saw against what the scrub mode lets through.
> 
> tc8 records the mark and priority of every packet it sees, and the
> device also carries what the system sends on its own once the device
> is up, like IPv6 neighbor discovery or the mDNS of avahi-daemon. When
> such a packet goes out after the echo, it overwrites what tc8 recorded,
> and the test finds a mark and a priority of 0.
> 
> Record only IPv4 ICMP packets in tc8.
> 
> tc_netkit_scrub run 100 times on a bpf-next kernel with KASAN enabled,
> x86_64 VM with 32 vCPUs and avahi-daemon running, before and after this
> patch:
> 
>              before                                after
>    outcome   2 of 100 failed (mark and priority 0)   0 of 100 failed
> 
> Fixes: 716fa7dadf11 ("selftests/bpf: Extend netkit tests to validate skb meta data")
> Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
> ---
> V1 -> V2:
> - Check the packet in tc8 the way tc1 and tc7 do, with
>    __bpf_constant_htons() and a goto out for each check (Daniel)
> - Add before/after data
Looks good, took this into bpf-next, thanks!