[Devel] [PATCH hci-8.1 v3 0/5] selftests: netfilter: make the suite pass on a routing host

[Konstantin Khorenko]

On Thu, 24 Sep 2026 13:06:05 +0200, Konstantin Khorenko wrote:
> selftests: netfilter: make the suite pass on a routing host
> 
> The net/netfilter selftests fail on the hci nodes for reasons outside
> the code under test: a new network namespace copies ip_forward and
> send_redirects from init_net, so a routing host with redirects turned
> off breaks nft_fib.sh and conntrack_icmp_related.sh; a veth name left
> behind in init_net by another test makes br_netfilter.sh and
> nf_nat_edemux.sh add their pairs into nothing; rpath.sh fails instead
> of skipping without nft; and conntrack_resize.sh expects
> nf_conntrack_expect_max to be read-only outside init_net, which vz
> virtualizes on purpose.
> 
> [...]

Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.3.vz10, thanks!

[1/5] selftests: net: turn ip_forward off in setup_ns
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/1e7d1447efd6
[2/5] selftests: netfilter: let the router send redirects
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/ec4a461f489f
[3/5] selftests: netfilter: add the veth pair from inside the namespace
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/21d20beb231d
[4/5] selftests: netfilter: skip rpath.sh without the nft tool
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/29f7cd8389f2
[5/5] selftests: netfilter: account for a per-namespace nf_conntrack_expect_max
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/ad76ffbef974

-- 
Konstantin Khorenko <khorenko at virtuozzo.com>