[PATCH net-next 4/5] selftests: seg6: add tests for PSP together with NEXT-C-SID
From: Andrea Mayer
Date: Sun Oct 11 2026 - 15:27:32 EST
Extend srv6_end_flavors_test.sh with tests for the SRv6 End behavior
with both the NEXT-C-SID and PSP flavors.
The tests use two SRv6 Policies with C-SID containers, where every
router after the ingress one applies End with the NEXT-C-SID and PSP
flavors. To check PSP, set net.ipv6.conf.all.seg6_enabled to 0 on the
hosts in setup_hs(). The hosts then drop any packet that still carries
an SRH, and a ping to an address on the loopback of a host succeeds
only if the router connected to that host has removed the SRH. The tests
fail when PSP is not applied together with NEXT-C-SID.
Signed-off-by: Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
---
.../selftests/net/srv6_end_flavors_test.sh | 229 +++++++++++++++++-
1 file changed, 226 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/net/srv6_end_flavors_test.sh b/tools/testing/selftests/net/srv6_end_flavors_test.sh
index 30a939392eea..baa1b09a1aab 100755
--- a/tools/testing/selftests/net/srv6_end_flavors_test.sh
+++ b/tools/testing/selftests/net/srv6_end_flavors_test.sh
@@ -16,8 +16,9 @@
#
# The End, End.X, and End.T behaviors can support these flavors either
# individually or in combinations.
-# Currently in this selftest we consider only the PSP flavor for the SRv6 End
-# behavior. However, it is possible to extend the script as soon as other
+# Currently in this selftest we consider the PSP flavor for the SRv6 End
+# behavior, both alone and combined with the NEXT-C-SID flavor defined in
+# RFC9800 [2]. However, it is possible to extend the script as soon as other
# flavors will be supported in the kernel.
#
# The purpose of the PSP flavor consists in instructing the penultimate node
@@ -47,7 +48,20 @@
# "standard" End packet processing, ignoring the configured PSP flavor at
# all.
#
+# The NEXT-C-SID flavor (referred to as NEXT-CSID in RFC9800 [2]) and the
+# C-SID containers are described in srv6_end_next_csid_l3vpn_test.sh, which
+# also tests this flavor for the SRv6 End behavior.
+#
+# When the NEXT-C-SID flavor is combined with the PSP, USP or USD flavors, these
+# flavors are left unchanged [2]. The NEXT-C-SID processing comes first: with a
+# non-zero Argument, the IPv6 DA is updated with the next C-SID and the packet
+# is forwarded without changing the SRH, if any. The packet goes through the End
+# behavior with the other flavors only when the Argument is zero, i.e. when the
+# IPv6 DA carries no further C-SID. For example, the PSP operation takes place
+# only for a C-SID container with a zero Argument and SL=1.
+#
# [1] RFC8986: https://datatracker.ietf.org/doc/html/rfc8986
+# [2] RFC9800: https://datatracker.ietf.org/doc/html/rfc9800
#
# Network topology
# ================
@@ -115,12 +129,30 @@
# +---------------------------------------------------------------------+
# |fcff:x::e is associated with the SRv6 End behavior |
# |fcff:x::ef1 is associated with the SRv6 End behavior with PSP flavor |
+# |fcbb:0:0xyy::/48 is associated with the SRv6 behavior and the |
+# | flavors of the Function yy |
# +---------------------------------------------------------------------+
#
# The fcff::/16 prefix is reserved by the operator for the SIDs. Reachability of
# SIDs is ensured by proper configuration of the IPv6 operator's network and
# SRv6 routers.
#
+# Similarly, the fcbb:0::/32 prefix is reserved by the operator for the C-SID
+# containers and it is used as their Locator-Block.
+# A C-SID (16 bits) is made of the Locator-Node (8 bits), i.e. the ID of the
+# router, followed by the Function (8 bits). The first digit of the Function
+# selects the SRv6 behavior and the second one the flavors combined with
+# NEXT-C-SID:
+#
+# +----------+----------+--------------------+
+# | Function | behavior | flavors |
+# +----------+----------+--------------------+
+# | a1 | End | NEXT-C-SID and PSP |
+# +----------+----------+--------------------+
+#
+# For example, fcbb:0:04a1:02a1:: is a C-SID container carrying the C-SID of
+# rt-4 followed by the C-SID of rt-2, both with the NEXT-C-SID and PSP flavors.
+#
#
# SRv6 Policies
# =============
@@ -193,6 +225,39 @@
# set with the last SID; iii) the SRH is removed from the extension headers
# after the IPv6 header. At this point, the packet with IPv6 DA=cafe::1 is sent
# to the destination, i.e. hs-1.
+#
+# Traffic to the loopback addresses of the hosts
+# ----------------------------------------------
+#
+# Each host has an address on its loopback, cafe::x:a1. The traffic from the
+# other host towards this address is steered with C-SID containers: after the
+# ingress router, every router crossed applies the SRv6 End behavior with the
+# NEXT-C-SID and PSP flavors. The following SRv6 Policies are applied by rt-1
+# to the traffic towards cafe::2:a1 (i.c) and by rt-2 to the traffic towards
+# cafe::1:a1 (i.d):
+#
+# i.c) IPv6 traffic, SID List=fcbb:0:03a1::,fcbb:0:04a1:02a1::,cafe::2:a1
+# i.d) IPv6 traffic, SID List=fcbb:0:04a1:03a1:01a1::,cafe::1:a1
+#
+# In the Policy (i.c), rt-3 receives a zero Argument with SL=2 and applies the
+# "standard" End processing. rt-4 receives a non-zero Argument with SL=1: it
+# advances to the next C-SID and does *NOT* apply the PSP operation. rt-2
+# receives a zero Argument with SL=1 and applies the PSP operation.
+#
+# In the Policy (i.d), a single C-SID container carries three C-SIDs. rt-4 and
+# rt-3 receive a non-zero Argument with SL=1: they advance to the next C-SID and
+# do *NOT* apply the PSP operation. rt-1 receives a zero Argument with SL=1
+# and applies the PSP operation.
+#
+# The hosts use cafe::x as the source address, not the loopback address. The
+# replies are sent to cafe::x and follow the Policies (i.a) and (i.b), which
+# are tested first. This way, each ping checks a single Policy with the
+# NEXT-C-SID flavor, and a failure points directly to that Policy.
+#
+# The hosts drop the packets that carry an SRH (seg6_enabled is set to 0 on
+# the hosts). The loopback address of a host is reached only through the
+# router connected to that host: the ping succeeds only if the SRH is removed
+# by that router.
# shellcheck source=lib.sh
source lib.sh
@@ -207,6 +272,17 @@ readonly IPv6_TESTS_ADDR=2001:db8::1
readonly LOCATOR_SERVICE=fcff
readonly END_FUNC=000e
readonly END_PSP_FUNC=0ef1
+readonly END_CSID_PSP_FUNC=a1
+
+readonly LCBLOCK_ADDR=fcbb:0
+readonly LCBLOCK_BLEN=32
+# do not add ':' as separator
+readonly LCNODE_FMT="0%d"
+readonly LCNODE_BLEN=8
+readonly LCNODEFUNC_BLEN=16
+
+readonly LCBLOCK_NODE_BLEN=$((LCBLOCK_BLEN + LCNODE_BLEN))
+readonly LCBLOCK_NODEFUNC_BLEN=$((LCBLOCK_BLEN + LCNODEFUNC_BLEN))
PING_TIMEOUT_SEC=4
PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
@@ -397,6 +473,40 @@ __get_srv6_rtcfg_op()
xargs | sed 's/ /,/g'
}
+# Given the ID of a router and a Function, the function returns the C-SID made
+# of the Locator-Node (8 bits), i.e. the ID of the router, followed by the
+# Function (8 bits).
+# e.g. input: "4" "a1"
+# output: "04a1"
+build_csid()
+{
+ local nodeid="$1"
+ local func="$2"
+
+ printf "${LCNODE_FMT}%s" "${nodeid}" "${func}"
+}
+
+# Given the <nodeid> token of a "next-csid,<flavors>" element, i.e. a
+# comma-separated list of node IDs, and a Function, the function returns the
+# C-SID container carrying the C-SIDs of these nodes.
+# e.g. input: "4,2" "a1"
+# output: "fcbb:0:04a1:02a1::"
+build_csid_container()
+{
+ local nodeids="$1"
+ local func="$2"
+ local csids=''
+ local nodes
+ local node
+
+ nodes="$(echo "${nodeids}" | sed 's/,/ /g')"
+ for node in ${nodes}; do
+ csids="${csids}:$(build_csid "${node}" "${func}")"
+ done
+
+ echo "${LCBLOCK_ADDR}${csids}::"
+}
+
# Setup the basic networking for the routers
setup_rt_networking()
{
@@ -439,6 +549,7 @@ setup_rt_local_sids()
local devname
local nsname
local neigh
+ local csid
nsname="$(get_rtname "${rt}")"
@@ -452,6 +563,14 @@ setup_rt_local_sids()
add "${LOCATOR_SERVICE}:${neigh}::/32" \
table "${LOCALSID_TABLE_ID}" \
via "${net_prefix}::${neigh}" dev "${devname}"
+
+ # set underlay network routes to reach the C-SID containers
+ # that start with a C-SID of the neighbor, for any Function.
+ csid="$(build_csid "${neigh}" 00)"
+ ip -netns "${nsname}" -6 route \
+ add "${LCBLOCK_ADDR}:${csid}::/${LCBLOCK_NODE_BLEN}" \
+ table "${LOCALSID_TABLE_ID}" \
+ via "${net_prefix}::${neigh}" dev "${devname}"
done
# Local End behavior (note that "dev" is a dummy interface chosen for
@@ -461,6 +580,17 @@ setup_rt_local_sids()
table "${LOCALSID_TABLE_ID}" \
encap seg6local action End dev "${DUMMY_DEVNAME}"
+ # Local End behavior with the NEXT-C-SID and PSP flavors, bound to the
+ # C-SID of the router (e.g. fcbb:0:04a1::/48 on rt-4). The /48 prefix
+ # covers every C-SID container whose first C-SID is this one, whatever
+ # the Argument that follows.
+ csid="$(build_csid "${rt}" "${END_CSID_PSP_FUNC}")"
+ ip -netns "${nsname}" -6 route \
+ add "${LCBLOCK_ADDR}:${csid}::/${LCBLOCK_NODEFUNC_BLEN}" \
+ table "${LOCALSID_TABLE_ID}" \
+ encap seg6local action End flavors next-csid,psp \
+ lblen "${LCBLOCK_BLEN}" nflen "${LCNODEFUNC_BLEN}" \
+ dev "${DUMMY_DEVNAME}"
# all SIDs start with a common locator. Routes and SRv6 Endpoint
# behavior instances are grouped together in the 'localsid' table.
@@ -468,6 +598,12 @@ setup_rt_local_sids()
add to "${LOCATOR_SERVICE}::/16" \
lookup "${LOCALSID_TABLE_ID}" prio 999
+ # the C-SID containers use their own Locator-Block. Their routes and
+ # SRv6 Endpoint behavior instances are in the 'localsid' table too.
+ ip -netns "${nsname}" -6 rule \
+ add to "${LCBLOCK_ADDR}::/${LCBLOCK_BLEN}" \
+ lookup "${LOCALSID_TABLE_ID}" prio 999
+
# set default routes to unreachable
ip -netns "${nsname}" -6 route \
add unreachable default metric 4278198272 \
@@ -479,12 +615,16 @@ setup_rt_local_sids()
# configures the SRv6 nodes specified in the SID List to process the traffic
# according to the operations required by the Policy itself.
# args:
-# $1 - destination host (i.e. cafe::x host)
+# $1 - destination host (i.e. cafe::x host), or x:a1 for the address
+# cafe::x:a1 on the loopback of the host
# $2 - SRv6 router configured for enforcing the SRv6 Policy
# $3 - compact way to represent a list of SRv6 routers with their operations
# (i.e. behaviors) that each of them needs to perform. Every <nodeid:op>
# element constructs a SID that is associated with the behavior <op> on
# the <nodeid> node. The list of such elements forms an SRv6 Policy.
+# For "next-csid,psp", <nodeid> is a comma-separated list of node IDs.
+# The element constructs a C-SID container with the C-SIDs of these
+# nodes, e.g. "4,2:next-csid,psp" gives fcbb:0:04a1:02a1::.
__setup_rt_policy()
{
local dst="$1"
@@ -494,6 +634,7 @@ __setup_rt_policy()
local in_nsname
local rt_nsname
local policy=''
+ local container
local function
local fullsid
local op_type
@@ -520,6 +661,15 @@ __setup_rt_policy()
behavior_cfg="End flavors psp"
;;
+ "next-csid,psp")
+ # the behavior is already set up on every router by
+ # setup_rt_local_sids.
+ container="$(build_csid_container "${node}" \
+ "${END_CSID_PSP_FUNC}")"
+ policy="${policy}${container},"
+ continue
+ ;;
+
*)
break
;;
@@ -571,6 +721,7 @@ setup_hs()
ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.all.accept_dad=0
ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.default.accept_dad=0
+ ip netns exec "${hsname}" sysctl -wq net.ipv6.conf.all.seg6_enabled=0
ip -netns "${hsname}" link add veth0 type veth \
peer name "${RT2HS_DEVNAME}" netns "${rtname}"
@@ -590,6 +741,33 @@ setup_hs()
sysctl -wq net.ipv6.conf."${RT2HS_DEVNAME}".proxy_ndp=1
}
+# Set up an address on the loopback of a host, and the route towards it on the
+# router connected to the host.
+# args:
+# $1 - host
+# $2 - router connected to the host
+# $3 - suffix of the address (i.e. cafe::<host>:<suffix>)
+setup_hs_lo_addr()
+{
+ local hs="$1"
+ local rt="$2"
+ local suffix="$3"
+ local hsname
+ local rtname
+ local addr
+
+ hsname="$(get_hsname "${hs}")"
+ rtname="$(get_rtname "${rt}")"
+ addr="${IPv6_HS_NETWORK}::${hs}:${suffix}"
+
+ ip -netns "${hsname}" addr \
+ add "${addr}/128" dev lo nodad
+
+ ip -netns "${rtname}" -6 route \
+ add "${addr}" \
+ via "${IPv6_HS_NETWORK}::${hs}" dev "${RT2HS_DEVNAME}"
+}
+
setup()
{
local i
@@ -622,6 +800,11 @@ setup()
setup_hs 1 1
setup_hs 2 2
+ # set up the loopback addresses of the hosts used by the Policies (i.c)
+ # and (i.d).
+ setup_hs_lo_addr 1 1 "${END_CSID_PSP_FUNC}"
+ setup_hs_lo_addr 2 2 "${END_CSID_PSP_FUNC}"
+
# set up default SRv6 Endpoints (i.e. SRv6 End behavior)
setup_rt_local_sids 1 "2 3 4"
setup_rt_local_sids 2 "1 3 4"
@@ -645,6 +828,21 @@ setup()
setup_rt_policy_ipv6 2 1 "3:noflv 4:psp 2:psp"
setup_rt_policy_ipv6 1 2 "1:psp"
+ # Direction hs-1 -> hs-2 (cafe::2:a1, NEXT-C-SID and PSP flavors)
+ # - rt-1 (SRv6 H.Insert policy)
+ # - rt-3 (Argument=0 and SL>1, acting as an End behavior)
+ # - rt-4 (Argument!=0 and SL=1, advancing the C-SID)
+ # - rt-2 (Argument=0 and SL=1, PSP)
+ #
+ # Direction hs-2 -> hs-1 (cafe::1:a1, NEXT-C-SID and PSP flavors)
+ # - rt-2 (SRv6 H.Insert policy)
+ # - rt-4 (Argument!=0 and SL=1, advancing the C-SID)
+ # - rt-3 (Argument!=0 and SL=1, advancing the C-SID)
+ # - rt-1 (Argument=0 and SL=1, PSP)
+ setup_rt_policy_ipv6 "2:${END_CSID_PSP_FUNC}" 1 \
+ "3:next-csid,psp 4,2:next-csid,psp"
+ setup_rt_policy_ipv6 "1:${END_CSID_PSP_FUNC}" 2 "4,3,1:next-csid,psp"
+
# testing environment was set up successfully
SETUP_ERR=0
}
@@ -710,6 +908,20 @@ check_and_log_hs_connectivity()
check_and_log_hs_ipv6_connectivity "${hssrc}" "${hsdst}"
}
+check_and_log_hs_lo_addr_connectivity()
+{
+ local hssrc="$1"
+ local hsdst="$2"
+ local suffix="$3"
+ local dst
+
+ dst="${IPv6_HS_NETWORK}::${hsdst}:${suffix}"
+
+ check_hs_ipv6_connectivity "${hssrc}" "${hsdst}:${suffix}"
+ log_test $? 0 \
+ "IPv6 Hosts connectivity: hs-${hssrc} -> hs-${hsdst} (${dst})"
+}
+
router_tests()
{
local i
@@ -747,6 +959,14 @@ host_srv6_end_flv_psp_tests()
check_and_log_hs_connectivity 2 1
}
+host_srv6_end_flv_next_csid_psp_tests()
+{
+ log_section "SRv6 connectivity test hosts (h1 <-> h2, NEXT-C-SID,PSP)"
+
+ check_and_log_hs_lo_addr_connectivity 1 2 "${END_CSID_PSP_FUNC}"
+ check_and_log_hs_lo_addr_connectivity 2 1 "${END_CSID_PSP_FUNC}"
+}
+
test_iproute2_supp_or_ksft_skip()
{
local flavor="$1"
@@ -836,6 +1056,8 @@ test_command_or_ksft_skip sort
test_command_or_ksft_skip xargs
test_dummy_dev_or_ksft_skip
+# NEXT-C-SID is not checked: every kernel and iproute2 version that
+# supports PSP also supports NEXT-C-SID.
test_iproute2_supp_or_ksft_skip psp
test_kernel_supp_or_ksft_skip psp
@@ -848,5 +1070,6 @@ set +e
router_tests
host2gateway_tests
host_srv6_end_flv_psp_tests
+host_srv6_end_flv_next_csid_psp_tests
print_log_test_results
--
2.43.0