On Thu, Jul 5, 2018 at 4:21 PM, Xin Long <lucien....@gmail.com> wrote: > On Thu, Jul 5, 2018 at 4:39 AM, Ido Schimmel <ido...@idosch.org> wrote: >> On Thu, Jul 05, 2018 at 01:56:23AM +0800, Xin Long wrote: >>> On Wed, Jul 4, 2018 at 3:23 AM, David Ahern <dsah...@gmail.com> wrote: >>> > your commands are not a proper test. The test should succeed and fail >>> > based on the routing lookup, not iptables rules. >>> A proper test can be done easily with netns, as vrf can't isolate much. >>> I don't want to bother forwarding/ directory with netns, so I will probably >>> just drop this selftest, and let the feature patch go first. >>> >>> What do you think? >> >> You can add a tc rule on the ingress of h2 and make sure that in the >> first case ping succeeds and the tc rule wasn't hit. In the second case >> ping should also succeed, but the tc rule should be hit. This is similar >> to your original netns test. > With netns, it will be much easier to use > sysctl net.ipv4.icmp_echo_ignore_broadcasts > to block the echo_request on r1 or h2, and check if ping works. > (this's more like the idea of using 'iptables' above) :D > >> >> You can look at tc_flower.sh for reference and in particular at >> tc_check_packets(). Just noticed this doesn't require reply with MZ. that's better. Thanks.
> This is a way similar idea of using tcpdump, I just feel it's too much, > this test should be an as simple test as route.sh. :)
