Signed-off-by: Jiri Peska <jpeska@redhat.com>
---
 tests/shell/testcases/packetpath/ct_label_set |  27 ++++
 .../packetpath/dumps/ct_label_set.json-nft    | 132 ++++++++++++++++++
 .../packetpath/dumps/ct_label_set.nft         |  11 ++
 3 files changed, 170 insertions(+)
 create mode 100755 tests/shell/testcases/packetpath/ct_label_set
 create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
 create mode 100644 tests/shell/testcases/packetpath/dumps/ct_label_set.nft

diff --git a/tests/shell/testcases/packetpath/ct_label_set b/tests/shell/testcases/packetpath/ct_label_set
new file mode 100755
index 00000000..554829c0
--- /dev/null
+++ b/tests/shell/testcases/packetpath/ct_label_set
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e
+
+ip link set lo up
+
+$NFT -f - <<EOF
+table ip test {
+    counter labeled {}
+    chain output {
+        type filter hook output priority filter; policy accept;
+            # set bit 1 on each echo-request
+            icmp type echo-request ip daddr 127.0.0.1 ct label set 1
+            # count only if label is already set
+            icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name labeled
+    }
+}
+EOF
+
+# Packet 1: replace sets bit 1
+ping -c 1 -W 1 127.0.0.1 >/dev/null
+
+# Packet 2+: same rule applies on same ICMP ct
+ping -c 2 -W 1 127.0.0.1 >/dev/null
+
+# Assert correct number of matched packets
+$NFT list counter ip test labeled | grep -q 'packets 3'
diff --git a/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft b/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
new file mode 100644
index 00000000..f8e2945a
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/ct_label_set.json-nft
@@ -0,0 +1,132 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "test",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "test",
+        "name": "output",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": 0,
+        "policy": "accept"
+      }
+    },
+    {
+      "counter": {
+        "family": "ip",
+        "name": "labeled",
+        "table": "test",
+        "handle": 0,
+        "packets": 3,
+        "bytes": 252
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test",
+        "chain": "output",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "ip",
+                  "field": "daddr"
+                }
+              },
+              "right": "127.0.0.1"
+            }
+          },
+          {
+            "mangle": {
+              "key": {
+                "ct": {
+                  "key": "label"
+                }
+              },
+              "value": 1
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test",
+        "chain": "output",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "ip",
+                  "field": "daddr"
+                }
+              },
+              "right": "127.0.0.1"
+            }
+          },
+          {
+            "match": {
+              "op": "in",
+              "left": {
+                "ct": {
+                  "key": "label"
+                }
+              },
+              "right": 1
+            }
+          },
+          {
+            "counter": "labeled"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/shell/testcases/packetpath/dumps/ct_label_set.nft b/tests/shell/testcases/packetpath/dumps/ct_label_set.nft
new file mode 100644
index 00000000..261677f8
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/ct_label_set.nft
@@ -0,0 +1,11 @@
+table ip test {
+	counter labeled {
+		packets 3 bytes 252
+	}
+
+	chain output {
+		type filter hook output priority filter; policy accept;
+		icmp type echo-request ip daddr 127.0.0.1 ct label set 1
+		icmp type echo-request ip daddr 127.0.0.1 ct label 1 counter name "labeled"
+	}
+}
-- 
2.54.0