github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Merge branch 'bpf-bidirectional-vlan-support-for-bpf_fib_lookup'

Browse Source 
Avinash Duduskar says:

====================
bpf: bidirectional VLAN support for bpf_fib_lookup()

This series adds VLAN awareness to bpf_fib_lookup() in both directions.
BPF_FIB_LOOKUP_VLAN resolves a VLAN egress to its underlying real device
plus the VLAN tag (XDP programs need this because VLAN devices have no
XDP xmit), and BPF_FIB_LOOKUP_VLAN_INPUT runs the lookup as if a tagged
frame had arrived on the matching VLAN subinterface, for iif policy
routing and VRF table selection.

BPF_FIB_LOOKUP_VLAN opts in to replacing params->ifindex, whose value
existing programs consume since d1c362e1dd ("bpf: Always return
target ifindex in bpf_fib_lookup"); without it the output is unchanged.

An egress that does not reduce to a real device plus one tag (a QinQ
stack, or a parent in another network namespace) returns
BPF_FIB_LKUP_RET_VLAN_FAILURE with params->ifindex left at the input;
repeating the lookup without the flag, with a re-initialized params,
returns the VLAN device's own ifindex. A VLAN on a bond reduces to the
bond, which picks its egress slave at xmit.

The new return code is appended after BPF_FIB_LKUP_RET_NO_SRC_ADDR
(nothing renumbered, tools/ mirror updated) and is returned only when
the flag is set, so no existing caller can observe it.

Changes v6 -> v7:

- Patch 1 (BPF_FIB_LOOKUP_VLAN: resolve a VLAN egress to its real
  device plus the tag): uapi doc clarified, repeating the lookup after
  BPF_FIB_LKUP_RET_VLAN_FAILURE needs a re-initialized params, since
  output fields overwrite the inputs they share storage with. No
  functional change.
- Patch 2 (BPF_FIB_LOOKUP_VLAN_INPUT: run the lookup as if the tagged
  frame arrived on the matching VLAN subinterface): no code change; a
  commit message correction (an invalid proto returns -EINVAL under
  !CONFIG_VLAN_8021Q too).
- Patch 3 (selftests for both flags, tc and XDP paths): local defines
  for the netns subtest addresses (Emil's review); the netns input arm
  brings the moved device up first, so the namespace check is the only
  condition it can fail on; the live-frames subtest uses its own netns
  name (no collision under test_progs -j) and counts only the test's
  TCP frames, so background traffic cannot satisfy the delivery
  assertion; a stale mtu comment corrected.

v6: https://lore.kernel.org/all/20260704092159.1256823-1-avinash.duduskar@gmail.com/
v5: https://lore.kernel.org/all/20260624030530.3342884-1-avinash.duduskar@gmail.com/
v4: https://lore.kernel.org/all/20260623025147.1001664-1-avinash.duduskar@gmail.com/
v3: https://lore.kernel.org/all/20260617224729.1428662-1-avinash.duduskar@gmail.com/
v2: https://lore.kernel.org/all/20260616223426.3568080-1-avinash.duduskar@gmail.com/
v1: https://lore.kernel.org/all/20260609172052.81613-1-avinash.duduskar@gmail.com/
====================

Link: https://patch.msgid.link/20260713162305.1237211-1-avinash.duduskar@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Kumar Kartikeya Dwivedi 2026-07-15 10:49:59 +02:00
commit 074927b976
No known key found for this signature in database
GPG Key ID: 472D377B63542F83
5 changed files with 964 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
include/uapi/linux/bpf.h
View File

@ -3532,6 +3532,47 @@ union bpf_attr {
* Use the mark present in *params*->mark for the fib lookup.
* This option should not be used with BPF_FIB_LOOKUP_DIRECT,
* as it only has meaning for full lookups.
* **BPF_FIB_LOOKUP_VLAN**
* If the fib lookup resolves to a VLAN device whose
* parent is a real (non-VLAN) device, set
* *params*->h_vlan_proto and *params*->h_vlan_TCI from
* the VLAN device and replace *params*->ifindex with the
* parent's ifindex. *params*->h_vlan_TCI carries the VID
* only, with PCP and DEI bits zero; a consumer wanting to
* set egress priority writes PCP itself. *params*->smac is
* the VLAN device's own address, which can differ from the
* parent's. Only the immediate parent is resolved; if it
* is itself a VLAN device (QinQ) or in another namespace,
* the egress cannot be reduced to a physical device plus
* one tag and the lookup returns
* **BPF_FIB_LKUP_RET_VLAN_FAILURE** with *params*->ifindex
* left at the input. To obtain the VLAN device's own
* ifindex, repeat the lookup without
* **BPF_FIB_LOOKUP_VLAN**, re-initializing *params*
* first: output fields overwrite the inputs they share
* storage with. The swap and the vlan fields
* are written only on success; other output fields keep
* the helper's existing behaviour, so a frag-needed result
* still reports the route mtu in *params*->mtu_result.
* This flag is only valid for XDP programs; tc programs
* receive -EINVAL since they can redirect to the VLAN
* device directly.
* **BPF_FIB_LOOKUP_VLAN_INPUT**
* Treat *params*->h_vlan_proto and *params*->h_vlan_TCI
* as an input VLAN tag and run the lookup as if ingress
* had happened on the VLAN subinterface carrying that tag
* on *params*->ifindex. The VID is the low 12 bits of
* *params*->h_vlan_TCI; *params*->h_vlan_proto must be
* ETH_P_8021Q or ETH_P_8021AD in network byte order, else
* **-EINVAL**. If *params*->ifindex is itself a VLAN
* device, its inner (QinQ) subinterface is matched; for a
* bond or team, pass the master's ifindex. An unmatched
* tag, a down device, or one in another namespace returns
* **BPF_FIB_LKUP_RET_NOT_FWDED**, mirroring real ingress.
* A VID of 0 is looked up literally, so do not set this
* flag for priority-tagged frames. Cannot be combined with
* **BPF_FIB_LOOKUP_TBID** or **BPF_FIB_LOOKUP_OUTPUT**
* (returns **-EINVAL**).
*
* *ctx* is either **struct xdp_md** for XDP programs or
* **struct sk_buff** tc cls_act programs.
@ -7339,6 +7380,8 @@ enum {
BPF_FIB_LOOKUP_TBID = (1U << 3),
BPF_FIB_LOOKUP_SRC = (1U << 4),
BPF_FIB_LOOKUP_MARK = (1U << 5),
BPF_FIB_LOOKUP_VLAN = (1U << 6),
BPF_FIB_LOOKUP_VLAN_INPUT = (1U << 7),
};
enum {
@ -7352,6 +7395,7 @@ enum {
BPF_FIB_LKUP_RET_NO_NEIGH, /* no neighbor entry for nh */
BPF_FIB_LKUP_RET_FRAG_NEEDED, /* fragmentation required to fwd */
BPF_FIB_LKUP_RET_NO_SRC_ADDR, /* failed to derive IP src addr */
BPF_FIB_LKUP_RET_VLAN_FAILURE, /* VLAN egress, parent unresolvable */
};
struct bpf_fib_lookup {
@ -7405,7 +7449,13 @@ struct bpf_fib_lookup {
union {
struct {
/* output */
/*
* output with BPF_FIB_LOOKUP_VLAN: set from the
* resolved egress VLAN device (see the flag); zeroed
* on other successful lookups. input with
* BPF_FIB_LOOKUP_VLAN_INPUT: the VLAN tag to scope
* the lookup by.
*/
__be16 h_vlan_proto;
__be16 h_vlan_TCI;
};

97
net/core/filter.c
View File

@ -6206,21 +6206,60 @@ static const struct bpf_func_proto bpf_skb_get_xfrm_state_proto = {
#endif
#if IS_ENABLED(CONFIG_INET) || IS_ENABLED(CONFIG_IPV6)
static int bpf_fib_set_fwd_params(struct bpf_fib_lookup *params, u32 mtu)
static int bpf_fib_set_fwd_params(struct net_device *dev,
struct bpf_fib_lookup *params,
u32 flags, u32 mtu, u32 in_ifindex)
{
params->h_vlan_TCI = 0;
params->h_vlan_proto = 0;
#if IS_ENABLED(CONFIG_VLAN_8021Q)
if ((flags & BPF_FIB_LOOKUP_VLAN) && is_vlan_dev(dev)) {
struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
if (!is_vlan_dev(real_dev) &&
net_eq(dev_net(real_dev), dev_net(dev))) {
params->h_vlan_proto = vlan_dev_vlan_proto(dev);
params->h_vlan_TCI = htons(vlan_dev_vlan_id(dev));
params->ifindex = real_dev->ifindex;
} else {
params->ifindex = in_ifindex;
return BPF_FIB_LKUP_RET_VLAN_FAILURE;
}
}
#endif
if (mtu)
params->mtu_result = mtu; /* union with tot_len */
return 0;
}
static struct net_device *bpf_fib_vlan_input_dev(struct net_device *dev,
const struct bpf_fib_lookup *params)
{
__be16 proto = params->h_vlan_proto;
struct net_device *vlan_dev;
u16 vid;
if (proto != htons(ETH_P_8021Q) && proto != htons(ETH_P_8021AD))
return ERR_PTR(-EINVAL);
vid = ntohs(params->h_vlan_TCI) & VLAN_VID_MASK;
vlan_dev = __vlan_find_dev_deep_rcu(dev, proto, vid);
if (!vlan_dev || !(vlan_dev->flags & IFF_UP) ||
!net_eq(dev_net(vlan_dev), dev_net(dev)))
return NULL;
return vlan_dev;
}
#endif
#if IS_ENABLED(CONFIG_INET)
static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
u32 flags, bool check_mtu)
{
u32 in_ifindex = params->ifindex;
struct neighbour *neigh = NULL;
struct fib_nh_common *nhc;
struct in_device *in_dev;
@ -6234,6 +6273,14 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
if (unlikely(!dev))
return -ENODEV;
if (flags & BPF_FIB_LOOKUP_VLAN_INPUT) {
dev = bpf_fib_vlan_input_dev(dev, params);
if (IS_ERR(dev))
return PTR_ERR(dev);
if (!dev)
return BPF_FIB_LKUP_RET_NOT_FWDED;
}
/* verify forwarding is enabled on this interface */
in_dev = __in_dev_get_rcu(dev);
if (unlikely(!in_dev || !IN_DEV_FORWARD(in_dev)))
@ -6243,7 +6290,11 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
fl4.flowi4_iif = 1;
fl4.flowi4_oif = params->ifindex;
} else {
fl4.flowi4_iif = params->ifindex;
/*
* dev->ifindex, not params->ifindex: VLAN_INPUT may have
* resolved dev to a subinterface above.
*/
fl4.flowi4_iif = dev->ifindex;
fl4.flowi4_oif = 0;
}
fl4.flowi4_dscp = inet_dsfield_to_dscp(params->tos);
@ -6352,7 +6403,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
memcpy(params->smac, dev->dev_addr, ETH_ALEN);
set_fwd_params:
return bpf_fib_set_fwd_params(params, mtu);
return bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);
}
#endif
@ -6362,6 +6413,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
{
struct in6_addr *src = (struct in6_addr *) params->ipv6_src;
struct in6_addr *dst = (struct in6_addr *) params->ipv6_dst;
u32 in_ifindex = params->ifindex;
struct fib6_result res = {};
struct neighbour *neigh;
struct net_device *dev;
@ -6379,6 +6431,14 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
if (unlikely(!dev))
return -ENODEV;
if (flags & BPF_FIB_LOOKUP_VLAN_INPUT) {
dev = bpf_fib_vlan_input_dev(dev, params);
if (IS_ERR(dev))
return PTR_ERR(dev);
if (!dev)
return BPF_FIB_LKUP_RET_NOT_FWDED;
}
idev = __in6_dev_get_safely(dev);
if (unlikely(!idev || !READ_ONCE(idev->cnf.forwarding)))
return BPF_FIB_LKUP_RET_FWD_DISABLED;
@ -6387,7 +6447,12 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
fl6.flowi6_iif = 1;
oif = fl6.flowi6_oif = params->ifindex;
} else {
oif = fl6.flowi6_iif = params->ifindex;
/*
* dev->ifindex, not params->ifindex: VLAN_INPUT may have
* resolved dev to a subinterface above.
*/
oif = dev->ifindex;
fl6.flowi6_iif = oif;
fl6.flowi6_oif = 0;
strict = RT6_LOOKUP_F_HAS_SADDR;
}
@ -6491,13 +6556,26 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
memcpy(params->smac, dev->dev_addr, ETH_ALEN);
set_fwd_params:
return bpf_fib_set_fwd_params(params, mtu);
return bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);
}
#endif
#define BPF_FIB_LOOKUP_MASK (BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT | \
BPF_FIB_LOOKUP_SKIP_NEIGH | BPF_FIB_LOOKUP_TBID | \
BPF_FIB_LOOKUP_SRC | BPF_FIB_LOOKUP_MARK)
BPF_FIB_LOOKUP_SRC | BPF_FIB_LOOKUP_MARK | \
BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_VLAN_INPUT)
static bool bpf_fib_lookup_flags_ok(u32 flags)
{
if (flags & ~BPF_FIB_LOOKUP_MASK)
return false;
if ((flags & BPF_FIB_LOOKUP_VLAN_INPUT) &&
(flags & (BPF_FIB_LOOKUP_TBID | BPF_FIB_LOOKUP_OUTPUT)))
return false;
return true;
}
BPF_CALL_4(bpf_xdp_fib_lookup, struct xdp_buff *, ctx,
struct bpf_fib_lookup *, params, int, plen, u32, flags)
@ -6505,7 +6583,7 @@ BPF_CALL_4(bpf_xdp_fib_lookup, struct xdp_buff *, ctx,
if (plen < sizeof(*params))
return -EINVAL;
if (flags & ~BPF_FIB_LOOKUP_MASK)
if (!bpf_fib_lookup_flags_ok(flags))
return -EINVAL;
switch (params->family) {
@ -6543,7 +6621,10 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
if (plen < sizeof(*params))
return -EINVAL;
if (flags & ~BPF_FIB_LOOKUP_MASK)
if (!bpf_fib_lookup_flags_ok(flags))
return -EINVAL;
if (flags & BPF_FIB_LOOKUP_VLAN)
return -EINVAL;
if (params->tot_len)

52
tools/include/uapi/linux/bpf.h
View File

@ -3532,6 +3532,47 @@ union bpf_attr {
* Use the mark present in *params*->mark for the fib lookup.
* This option should not be used with BPF_FIB_LOOKUP_DIRECT,
* as it only has meaning for full lookups.
* **BPF_FIB_LOOKUP_VLAN**
* If the fib lookup resolves to a VLAN device whose
* parent is a real (non-VLAN) device, set
* *params*->h_vlan_proto and *params*->h_vlan_TCI from
* the VLAN device and replace *params*->ifindex with the
* parent's ifindex. *params*->h_vlan_TCI carries the VID
* only, with PCP and DEI bits zero; a consumer wanting to
* set egress priority writes PCP itself. *params*->smac is
* the VLAN device's own address, which can differ from the
* parent's. Only the immediate parent is resolved; if it
* is itself a VLAN device (QinQ) or in another namespace,
* the egress cannot be reduced to a physical device plus
* one tag and the lookup returns
* **BPF_FIB_LKUP_RET_VLAN_FAILURE** with *params*->ifindex
* left at the input. To obtain the VLAN device's own
* ifindex, repeat the lookup without
* **BPF_FIB_LOOKUP_VLAN**, re-initializing *params*
* first: output fields overwrite the inputs they share
* storage with. The swap and the vlan fields
* are written only on success; other output fields keep
* the helper's existing behaviour, so a frag-needed result
* still reports the route mtu in *params*->mtu_result.
* This flag is only valid for XDP programs; tc programs
* receive -EINVAL since they can redirect to the VLAN
* device directly.
* **BPF_FIB_LOOKUP_VLAN_INPUT**
* Treat *params*->h_vlan_proto and *params*->h_vlan_TCI
* as an input VLAN tag and run the lookup as if ingress
* had happened on the VLAN subinterface carrying that tag
* on *params*->ifindex. The VID is the low 12 bits of
* *params*->h_vlan_TCI; *params*->h_vlan_proto must be
* ETH_P_8021Q or ETH_P_8021AD in network byte order, else
* **-EINVAL**. If *params*->ifindex is itself a VLAN
* device, its inner (QinQ) subinterface is matched; for a
* bond or team, pass the master's ifindex. An unmatched
* tag, a down device, or one in another namespace returns
* **BPF_FIB_LKUP_RET_NOT_FWDED**, mirroring real ingress.
* A VID of 0 is looked up literally, so do not set this
* flag for priority-tagged frames. Cannot be combined with
* **BPF_FIB_LOOKUP_TBID** or **BPF_FIB_LOOKUP_OUTPUT**
* (returns **-EINVAL**).
*
* *ctx* is either **struct xdp_md** for XDP programs or
* **struct sk_buff** tc cls_act programs.
@ -7339,6 +7380,8 @@ enum {
BPF_FIB_LOOKUP_TBID = (1U << 3),
BPF_FIB_LOOKUP_SRC = (1U << 4),
BPF_FIB_LOOKUP_MARK = (1U << 5),
BPF_FIB_LOOKUP_VLAN = (1U << 6),
BPF_FIB_LOOKUP_VLAN_INPUT = (1U << 7),
};
enum {
@ -7352,6 +7395,7 @@ enum {
BPF_FIB_LKUP_RET_NO_NEIGH, /* no neighbor entry for nh */
BPF_FIB_LKUP_RET_FRAG_NEEDED, /* fragmentation required to fwd */
BPF_FIB_LKUP_RET_NO_SRC_ADDR, /* failed to derive IP src addr */
BPF_FIB_LKUP_RET_VLAN_FAILURE, /* VLAN egress, parent unresolvable */
};
struct bpf_fib_lookup {
@ -7405,7 +7449,13 @@ struct bpf_fib_lookup {
union {
struct {
/* output */
/*
* output with BPF_FIB_LOOKUP_VLAN: set from the
* resolved egress VLAN device (see the flag); zeroed
* on other successful lookups. input with
* BPF_FIB_LOOKUP_VLAN_INPUT: the VLAN tag to scope
* the lookup by.
*/
__be16 h_vlan_proto;
__be16 h_vlan_TCI;
};

720
tools/testing/selftests/bpf/prog_tests/fib_lookup.c
View File

@ -2,6 +2,7 @@
/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
#include <linux/rtnetlink.h>
#include <linux/if_ether.h>
#include <sys/types.h>
#include <net/if.h>
@ -23,6 +24,7 @@
#define IPV4_TBID_ADDR "172.0.0.254"
#define IPV4_TBID_NET "172.0.0.0"
#define IPV4_TBID_DST "172.0.0.2"
#define IPV4_TBID_NONEIGH_DST "172.0.0.5"
#define IPV6_TBID_ADDR "fd00::FFFF"
#define IPV6_TBID_NET "fd00::"
#define IPV6_TBID_DST "fd00::2"
@ -37,6 +39,41 @@
#define IPV6_LOCAL "fd01::3"
#define IPV6_GW1 "fd01::1"
#define IPV6_GW2 "fd01::2"
#define VLAN_ID 100
#define VLAN_IFACE "veth1.100"
#define VLAN_ID_DOWN 102
#define VLAN_IFACE_DOWN "veth1.102"
#define QINQ_OUTER_IFACE "veth1.200"
#define QINQ_INNER_IFACE "veth1.200.300"
#define VLAN_TABLE "300"
#define IPV4_VLAN_IFACE_ADDR "10.5.0.254"
#define IPV4_VLAN_EGRESS_DST "10.5.0.2"
#define IPV4_QINQ_DST "10.7.0.2"
#define IPV4_VLAN_DST "10.6.0.2"
#define IPV4_VLAN_GW "10.5.0.1"
#define IPV6_VLAN_IFACE_ADDR "fd02::254"
#define IPV6_VLAN_EGRESS_DST "fd02::2"
#define IPV6_VLAN_DST "fd03::2"
#define IPV6_VLAN_GW "fd02::1"
#define VLAN_VID_UNUSED 999
#define VRF_IFACE "vrf-blue"
#define VRF_TABLE "1000"
#define VRF_VLAN_ID 101
#define VRF_VLAN_IFACE "veth1.101"
#define IPV4_VRF_IFACE_ADDR "10.8.0.254"
#define IPV4_VRF_GW "10.8.0.1"
#define IPV4_VRF_DST "10.9.0.2"
#define TBID_VLAN_ID 50
#define TBID_VLAN_IFACE "veth2.50"
#define IPV4_TBID_VLAN_DST "172.2.0.2"
#define IPV4_BOND_VLAN_DST "10.11.0.2"
#define IPV4_VLAN_MTU_DST "10.5.9.2"
#define QINQ_AD_VLAN_ID 200
#define QINQ_INNER_VLAN_ID 300
#define BOND_IFACE "bond99"
#define BOND_PORT "veth3"
#define BOND_PORT_PEER "veth4"
#define BOND_VLAN_ID 500
#define DMAC "11:11:11:11:11:11"
#define DMAC_INIT { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, }
#define DMAC2 "01:01:01:01:01:01"
@ -52,6 +89,17 @@ struct fib_lookup_test {
__u32 tbid;
__u8 dmac[6];
__u32 mark;
/*
* input tag with BPF_FIB_LOOKUP_VLAN_INPUT; expected output tag
* with BPF_FIB_LOOKUP_VLAN (checked when check_vlan is set)
*/
__u16 vlan_proto;
__u16 vlan_id;
bool check_vlan;
const char *expected_dev; /* expected params->ifindex after lookup */
const char *iif; /* override the default veth1 input device */
__u16 tot_len; /* triggers the in-lookup mtu check when set */
__u16 expected_mtu; /* expected mtu_result (union with tot_len) */
};
static const struct fib_lookup_test tests[] = {
@ -79,6 +127,17 @@ static const struct fib_lookup_test tests[] = {
.daddr = IPV4_TBID_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID, .tbid = 100,
.dmac = DMAC_INIT2, },
/*
* An error that returns after the egress device is resolved must
* report the egress ifindex, not the input. This routes from input
* veth1 via veth2 (table 100) to a dst with no neighbour, so
* input != egress, pinning NO_NEIGH to the egress device.
*/
{ .desc = "IPv4 NO_NEIGH reports the egress ifindex, not the input",
.daddr = IPV4_TBID_NONEIGH_DST,
.expected_ret = BPF_FIB_LKUP_RET_NO_NEIGH,
.lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID, .tbid = 100,
.expected_dev = "veth2", },
{ .desc = "IPv6 TBID lookup failure",
.daddr = IPV6_TBID_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID,
@ -142,6 +201,218 @@ static const struct fib_lookup_test tests[] = {
.expected_dst = IPV6_GW1,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
.mark = MARK, },
/* vlan egress resolution */
/*
* Invariant the VLAN-egress arms jointly enforce: a
* BPF_FIB_LOOKUP_VLAN SUCCESS always carries a physical,
* xmit-capable ifindex; no SUCCESS ever returns a VLAN-device
* ifindex. Reducible arms pin ifindex == the physical parent; the
* QinQ and foreign-netns arms pin VLAN_FAILURE with params->ifindex
* left at the input, so a regression to best-effort (SUCCESS + the
* VLAN ifindex) fails one.
*/
{ .desc = "IPv4 VLAN egress, no flag",
.daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = VLAN_IFACE, .check_vlan = true, },
{ .desc = "IPv4 VLAN egress, single VLAN",
.daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = "veth1", .check_vlan = true,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
/*
* skb path without tot_len: mtu_result is the VLAN device's mtu
* (1400), not the parent's (1500)
*/
{ .desc = "IPv4 VLAN egress, skb-path mtu is the VLAN device's without the flag",
.daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = VLAN_IFACE, .check_vlan = true, .expected_mtu = 1400, },
{ .desc = "IPv4 VLAN egress, flag set but egress is not a VLAN",
.daddr = IPV4_NUD_FAILED_ADDR, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = "veth1", .check_vlan = true, },
{ .desc = "IPv4 VLAN egress, QinQ not reducible (VLAN_FAILURE)",
.daddr = IPV4_QINQ_DST,
.expected_ret = BPF_FIB_LKUP_RET_VLAN_FAILURE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = "veth1", .check_vlan = true, },
{ .desc = "IPv4 QinQ egress without the flag (escape hatch)",
.daddr = IPV4_QINQ_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = QINQ_INNER_IFACE, },
{ .desc = "IPv6 VLAN egress, single VLAN",
.daddr = IPV6_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = "veth1", .check_vlan = true,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN egress, neighbour on the VLAN device",
.daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_VLAN,
.expected_dev = "veth1", .check_vlan = true,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, .dmac = DMAC_INIT, },
{ .desc = "IPv4 VLAN egress in OUTPUT mode",
.daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.iif = VLAN_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_VLAN |
BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = "veth1", .check_vlan = true,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN egress over a bond",
.daddr = IPV4_BOND_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = BOND_IFACE, .check_vlan = true,
.vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },
{ .desc = "IPv4 VLAN egress via TBID table",
.daddr = IPV4_TBID_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID |
BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.tbid = 100,
.expected_dev = "veth2", .check_vlan = true,
.vlan_proto = ETH_P_8021Q, .vlan_id = TBID_VLAN_ID, },
{ .desc = "IPv4 VLAN egress, success writes mtu_result with the swap",
.daddr = IPV4_VLAN_MTU_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.tot_len = 500, .expected_mtu = 1000,
.lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = "veth1", .check_vlan = true,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN egress, FRAG_NEEDED reports mtu, swap unwritten",
.daddr = IPV4_VLAN_MTU_DST, .expected_ret = BPF_FIB_LKUP_RET_FRAG_NEEDED,
.tot_len = 1400, .expected_mtu = 1000,
.lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
.expected_dev = "veth1", .check_vlan = true, },
/* vlan tag as lookup input */
{ .desc = "IPv4 VLAN input, no flag",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_GW1,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH, },
{ .desc = "IPv4 VLAN input, tag selects subinterface route",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_VLAN_GW, .expected_dev = VLAN_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
{ .desc = "IPv6 VLAN input, tag selects subinterface route",
.daddr = IPV6_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV6_VLAN_GW, .expected_dev = VLAN_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN input and egress combined",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_VLAN_GW, .expected_dev = "veth1",
.check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_VLAN |
BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN input, neighbour resolved on the route",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_VLAN_GW, .expected_dev = VLAN_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, .dmac = DMAC_INIT2, },
{ .desc = "IPv4 VLAN input, source address from the subinterface",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_src = IPV4_VLAN_IFACE_ADDR,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SRC |
BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
/*
* VRF: the resolved subinterface is enslaved, so the l3mdev rule
* (full lookup) and l3mdev_fib_table_rcu() (DIRECT) must select
* the VRF table from the resolved ingress
*/
{ .desc = "IPv4 VLAN input, VRF subinterface, no flag",
.daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_GW1,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH, },
{ .desc = "IPv4 VLAN input, tag selects VRF table",
.daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_VRF_GW, .expected_dev = VRF_VLAN_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VRF_VLAN_ID, },
{ .desc = "IPv4 VLAN input, DIRECT uses VRF table from resolved ingress",
.daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_VRF_GW, .expected_dev = VRF_VLAN_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_DIRECT |
BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VRF_VLAN_ID, },
/*
* failure arms also assert params is left untouched: ifindex still
* names the physical device and the input tag bytes survive
*/
{ .desc = "IPv4 VLAN input, invalid proto",
.daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
.expected_dev = "veth1", .check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = 0x1234, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN input, unmatched VID",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.expected_dev = "veth1", .check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_VID_UNUSED, },
{ .desc = "IPv4 VLAN input, subinterface down",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.expected_dev = "veth1", .check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID_DOWN, },
/*
* the resolver runs before the forwarding check, so on devices
* with forwarding off FWD_DISABLED (not NOT_FWDED) proves the tag
* resolved to that device and the lookup used it as ingress
*/
{ .desc = "IPv4 VLAN input, 802.1ad tag",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021AD, .vlan_id = QINQ_AD_VLAN_ID, },
{ .desc = "IPv4 VLAN input, PCP and DEI bits ignored in TCI",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.expected_dst = IPV4_VLAN_GW,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = 0xe000 | VLAN_ID, },
{ .desc = "IPv4 VLAN input, inner QinQ device from VLAN ifindex",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,
.iif = QINQ_OUTER_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = QINQ_INNER_VLAN_ID, },
/*
* bonding: the VLANs live on the master, as on receive, where the
* frame is steered to the master before VLAN processing; a port
* ifindex does not match (ports carry vid state but no VLAN devs)
*/
{ .desc = "IPv4 VLAN input, tag on bond master resolves",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,
.iif = BOND_IFACE,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },
{ .desc = "IPv4 VLAN input, tag on bond port does not match",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.iif = BOND_PORT, .expected_dev = BOND_PORT, .check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },
{ .desc = "IPv6 VLAN input, invalid proto",
.daddr = IPV6_VLAN_DST, .expected_ret = -EINVAL,
.expected_dev = "veth1", .check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = 0x1234, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN input, VID 0 priority tag fails closed",
.daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.expected_dev = "veth1", .check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = 0, },
{ .desc = "IPv6 VLAN input, unmatched VID",
.daddr = IPV6_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.expected_dev = "veth1", .check_vlan = true,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_VID_UNUSED, },
{ .desc = "unknown flag bit rejected",
.daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
.lookup_flags = (1 << 14) | BPF_FIB_LOOKUP_SKIP_NEIGH, },
{ .desc = "IPv4 VLAN input rejected with TBID",
.daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_TBID,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
{ .desc = "IPv4 VLAN input rejected with OUTPUT",
.daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
.lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_OUTPUT,
.vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
};
static int setup_netns(void)
@ -204,6 +475,105 @@ static int setup_netns(void)
SYS(fail, "ip rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
SYS(fail, "ip -6 rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
/*
* Setup for vlan tests: a subinterface for egress resolution and
* tag-as-input, a QinQ stack, and an iif rule so the input tests
* observe which device the lookup used as ingress.
*/
SYS(fail, "ip link add link veth1 name %s type vlan id %d",
VLAN_IFACE, VLAN_ID);
SYS(fail, "ip link set dev %s up", VLAN_IFACE);
/*
* lower than the veth1 parent (1500): the skb-path mtu check uses the
* FIB result (VLAN) device, so mtu_result is this value, which the
* no-flag arm below pins
*/
SYS(fail, "ip link set dev %s mtu 1400", VLAN_IFACE);
SYS(fail, "ip addr add %s/24 dev %s", IPV4_VLAN_IFACE_ADDR, VLAN_IFACE);
SYS(fail, "ip addr add %s/64 dev %s nodad", IPV6_VLAN_IFACE_ADDR, VLAN_IFACE);
/*
* stays down: the input flag must treat its tag the way real
* ingress treats a frame arriving on a down VLAN device (drop)
*/
SYS(fail, "ip link add link veth1 name %s type vlan id %d",
VLAN_IFACE_DOWN, VLAN_ID_DOWN);
err = write_sysctl("/proc/sys/net/ipv4/conf/" VLAN_IFACE "/forwarding", "1");
if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf." VLAN_IFACE ".forwarding)"))
goto fail;
err = write_sysctl("/proc/sys/net/ipv6/conf/" VLAN_IFACE "/forwarding", "1");
if (!ASSERT_OK(err, "write_sysctl(net.ipv6.conf." VLAN_IFACE ".forwarding)"))
goto fail;
SYS(fail, "ip link add link veth1 name %s type vlan proto 802.1ad id 200",
QINQ_OUTER_IFACE);
SYS(fail, "ip link add link %s name %s type vlan id 300",
QINQ_OUTER_IFACE, QINQ_INNER_IFACE);
SYS(fail, "ip link set dev %s up", QINQ_OUTER_IFACE);
SYS(fail, "ip link set dev %s up", QINQ_INNER_IFACE);
SYS(fail, "ip route add %s/32 dev %s", IPV4_QINQ_DST, QINQ_INNER_IFACE);
SYS(fail, "ip route add %s/32 via %s", IPV4_VLAN_DST, IPV4_GW1);
SYS(fail, "ip route add table %s %s/32 via %s",
VLAN_TABLE, IPV4_VLAN_DST, IPV4_VLAN_GW);
SYS(fail, "ip rule add prio 3 iif %s lookup %s", VLAN_IFACE, VLAN_TABLE);
SYS(fail, "ip -6 route add %s/128 via %s", IPV6_VLAN_DST, IPV6_GW1);
SYS(fail, "ip -6 route add table %s %s/128 via %s",
VLAN_TABLE, IPV6_VLAN_DST, IPV6_VLAN_GW);
SYS(fail, "ip -6 rule add prio 3 iif %s lookup %s", VLAN_IFACE, VLAN_TABLE);
/* a bond with one port and a VLAN on the bond */
SYS(fail, "ip link add %s type bond", BOND_IFACE);
SYS(fail, "ip link add %s type veth peer name %s", BOND_PORT, BOND_PORT_PEER);
SYS(fail, "ip link set %s master %s", BOND_PORT, BOND_IFACE);
SYS(fail, "ip link set dev %s up", BOND_IFACE);
SYS(fail, "ip link set dev %s up", BOND_PORT);
SYS(fail, "ip link add link %s name %s.%d type vlan id %d",
BOND_IFACE, BOND_IFACE, BOND_VLAN_ID, BOND_VLAN_ID);
SYS(fail, "ip link set dev %s.%d up", BOND_IFACE, BOND_VLAN_ID);
SYS(fail, "ip route add %s/32 dev %s.%d",
IPV4_BOND_VLAN_DST, BOND_IFACE, BOND_VLAN_ID);
/*
* a VRF with its own dedicated subinterface (the iif rules above
* must not see it), for the table-selection-by-ingress cases
*/
SYS(fail, "ip link add %s type vrf table %s", VRF_IFACE, VRF_TABLE);
SYS(fail, "ip link set dev %s up", VRF_IFACE);
SYS(fail, "ip link add link veth1 name %s type vlan id %d",
VRF_VLAN_IFACE, VRF_VLAN_ID);
SYS(fail, "ip link set %s master %s", VRF_VLAN_IFACE, VRF_IFACE);
SYS(fail, "ip link set dev %s up", VRF_VLAN_IFACE);
SYS(fail, "ip addr add %s/24 dev %s", IPV4_VRF_IFACE_ADDR, VRF_VLAN_IFACE);
err = write_sysctl("/proc/sys/net/ipv4/conf/" VRF_VLAN_IFACE "/forwarding", "1");
if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf." VRF_VLAN_IFACE ".forwarding)"))
goto fail;
SYS(fail, "ip route add %s/32 via %s", IPV4_VRF_DST, IPV4_GW1);
SYS(fail, "ip route add table %s %s/32 via %s",
VRF_TABLE, IPV4_VRF_DST, IPV4_VRF_GW);
/* neighbours on the VLAN subinterface for the non-SKIP_NEIGH cases */
err = write_sysctl("/proc/sys/net/ipv4/neigh/" VLAN_IFACE "/gc_stale_time", "900");
if (!ASSERT_OK(err, "write_sysctl(net.ipv4.neigh." VLAN_IFACE ".gc_stale_time)"))
goto fail;
SYS(fail, "ip neigh add %s dev %s lladdr %s nud stale",
IPV4_VLAN_EGRESS_DST, VLAN_IFACE, DMAC);
SYS(fail, "ip neigh add %s dev %s lladdr %s nud stale",
IPV4_VLAN_GW, VLAN_IFACE, DMAC2);
/* a VLAN on veth2 with a route in the tbid test table */
SYS(fail, "ip link add link veth2 name %s type vlan id %d",
TBID_VLAN_IFACE, TBID_VLAN_ID);
SYS(fail, "ip link set dev %s up", TBID_VLAN_IFACE);
SYS(fail, "ip route add table 100 %s/32 dev %s",
IPV4_TBID_VLAN_DST, TBID_VLAN_IFACE);
/* a locked-mtu route via the subinterface for the FRAG_NEEDED case */
SYS(fail, "ip route add %s/32 dev %s mtu lock 1000",
IPV4_VLAN_MTU_DST, VLAN_IFACE);
return 0;
fail:
return -1;
@ -218,9 +588,16 @@ static int set_lookup_params(struct bpf_fib_lookup *params,
memset(params, 0, sizeof(*params));
params->l4_protocol = IPPROTO_TCP;
params->ifindex = ifindex;
params->ifindex = test->iif ? if_nametoindex(test->iif) : ifindex;
params->tbid = test->tbid;
params->mark = test->mark;
params->tot_len = test->tot_len;
/* h_vlan_proto/h_vlan_TCI union with tbid */
if (test->lookup_flags & BPF_FIB_LOOKUP_VLAN_INPUT) {
params->h_vlan_proto = htons(test->vlan_proto);
params->h_vlan_TCI = htons(test->vlan_id);
}
if (inet_pton(AF_INET6, test->daddr, params->ipv6_dst) == 1) {
params->family = AF_INET6;
@ -298,7 +675,7 @@ void test_fib_lookup(void)
struct nstoken *nstoken = NULL;
struct __sk_buff skb = { };
struct fib_lookup *skel;
int prog_fd, err, ret, i;
int prog_fd, xdp_fd, err, ret, i;
/* The test does not use the skb->data, so
* use pkt_v6 for both v6 and v4 test.
@ -309,11 +686,16 @@ void test_fib_lookup(void)
.ctx_in = &skb,
.ctx_size_in = sizeof(skb),
);
LIBBPF_OPTS(bpf_test_run_opts, xdp_opts,
.data_in = &pkt_v6,
.data_size_in = sizeof(pkt_v6),
);
skel = fib_lookup__open_and_load();
if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
return;
prog_fd = bpf_program__fd(skel->progs.fib_lookup);
xdp_fd = bpf_program__fd(skel->progs.fib_lookup_xdp);
SYS(fail, "ip netns add %s", NS_TEST);
@ -343,6 +725,16 @@ void test_fib_lookup(void)
if (!ASSERT_OK(err, "bpf_prog_test_run_opts"))
continue;
/*
* BPF_FIB_LOOKUP_VLAN is XDP-only; the tc helper rejects it.
* These cases are exercised on the XDP path below.
*/
if (tests[i].lookup_flags & BPF_FIB_LOOKUP_VLAN) {
ASSERT_EQ(skel->bss->fib_lookup_ret, -EINVAL,
"tc rejects BPF_FIB_LOOKUP_VLAN");
continue;
}
ASSERT_EQ(skel->bss->fib_lookup_ret, tests[i].expected_ret,
"fib_lookup_ret");
@ -352,6 +744,21 @@ void test_fib_lookup(void)
if (tests[i].expected_dst)
assert_dst_ip(fib_params, tests[i].expected_dst);
if (tests[i].expected_dev)
ASSERT_EQ(fib_params->ifindex,
if_nametoindex(tests[i].expected_dev), "ifindex");
if (tests[i].expected_mtu)
ASSERT_EQ(fib_params->mtu_result, tests[i].expected_mtu,
"mtu_result");
if (tests[i].check_vlan) {
ASSERT_EQ(fib_params->h_vlan_proto,
htons(tests[i].vlan_proto), "h_vlan_proto");
ASSERT_EQ(fib_params->h_vlan_TCI,
htons(tests[i].vlan_id), "h_vlan_TCI");
}
ret = memcmp(tests[i].dmac, fib_params->dmac, sizeof(tests[i].dmac));
if (!ASSERT_EQ(ret, 0, "dmac not match")) {
char expected[18], actual[18];
@ -361,17 +768,322 @@ void test_fib_lookup(void)
printf("dmac expected %s actual %s ", expected, actual);
}
// ensure tbid is zero'd out after fib lookup.
if (tests[i].lookup_flags & BPF_FIB_LOOKUP_DIRECT) {
/*
* ensure tbid is zero'd out after fib lookup. With
* BPF_FIB_LOOKUP_VLAN the union holds the packed vlan
* fields instead, so skip the check for those.
*/
if ((tests[i].lookup_flags & BPF_FIB_LOOKUP_DIRECT) &&
!(tests[i].lookup_flags & BPF_FIB_LOOKUP_VLAN)) {
if (!ASSERT_EQ(skel->bss->fib_params.tbid, 0,
"expected fib_params.tbid to be zero"))
goto fail;
}
}
/*
* Re-run the cases through bpf_xdp_fib_lookup(). test_run uses the
* current netns' loopback for ctx->rxq->dev, so dev_net() is NS_TEST
* and the lookup runs against its FIB. The path-independent results
* (return code, swapped ifindex, vlan tag, gateway) must match the skb
* path; the no-tot_len mtu_result is skb-specific and not rechecked.
*/
for (i = 0; i < ARRAY_SIZE(tests); i++) {
if (set_lookup_params(fib_params, &tests[i], skb.ifindex))
continue;
skel->bss->fib_lookup_ret = -1;
skel->bss->lookup_flags = tests[i].lookup_flags;
err = bpf_prog_test_run_opts(xdp_fd, &xdp_opts);
if (!ASSERT_OK(err, "xdp test_run"))
continue;
if (!ASSERT_EQ(skel->bss->fib_lookup_ret, tests[i].expected_ret,
"xdp fib_lookup_ret"))
printf("(xdp) %s\n", tests[i].desc);
if (tests[i].expected_dev)
ASSERT_EQ(fib_params->ifindex,
if_nametoindex(tests[i].expected_dev),
"xdp ifindex");
if (tests[i].expected_dst)
assert_dst_ip(fib_params, tests[i].expected_dst);
if (tests[i].check_vlan) {
ASSERT_EQ(fib_params->h_vlan_proto,
htons(tests[i].vlan_proto), "xdp h_vlan_proto");
ASSERT_EQ(fib_params->h_vlan_TCI,
htons(tests[i].vlan_id), "xdp h_vlan_TCI");
}
ret = memcmp(tests[i].dmac, fib_params->dmac, sizeof(tests[i].dmac));
ASSERT_EQ(ret, 0, "xdp dmac");
/*
* mtu_result from a tot_len lookup is the route mtu and is
* path-independent; the no-tot_len arm reads dev->mtu and is
* skb-only, so gate on tot_len
*/
if (tests[i].expected_mtu && tests[i].tot_len)
ASSERT_EQ(fib_params->mtu_result, tests[i].expected_mtu,
"xdp mtu_result");
}
fail:
if (nstoken)
close_netns(nstoken);
SYS_NOFAIL("ip netns del " NS_TEST);
fib_lookup__destroy(skel);
}
#define NS_VLAN_A "fib_lookup_vlan_ns_a"
#define NS_VLAN_B "fib_lookup_vlan_ns_b"
#define IPV4_VLAN_NETNS_ADDR "10.66.0.1"
#define IPV4_VLAN_NETNS_DST "10.66.0.2"
/*
* A VLAN device can be moved to another netns while staying registered
* on its parent. Neither direction may then cross the boundary: the
* egress flag must not publish the foreign parent's ifindex, and the
* input flag must fail closed rather than use a foreign ingress.
*/
void test_fib_lookup_vlan_netns(void)
{
struct bpf_fib_lookup *fib_params;
struct nstoken *nstoken = NULL;
struct __sk_buff skb = { };
struct fib_lookup *skel = NULL;
int prog_fd, xdp_fd, err, parent_idx, vlan_idx;
LIBBPF_OPTS(bpf_test_run_opts, run_opts,
.data_in = &pkt_v6,
.data_size_in = sizeof(pkt_v6),
.ctx_in = &skb,
.ctx_size_in = sizeof(skb),
);
LIBBPF_OPTS(bpf_test_run_opts, xdp_opts,
.data_in = &pkt_v6,
.data_size_in = sizeof(pkt_v6),
);
skel = fib_lookup__open_and_load();
if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
return;
prog_fd = bpf_program__fd(skel->progs.fib_lookup);
xdp_fd = bpf_program__fd(skel->progs.fib_lookup_xdp);
fib_params = &skel->bss->fib_params;
SYS(fail, "ip netns add %s", NS_VLAN_A);
SYS(fail, "ip netns add %s", NS_VLAN_B);
nstoken = open_netns(NS_VLAN_A);
if (!ASSERT_OK_PTR(nstoken, "open_netns(a)"))
goto fail;
SYS(fail, "ip link add veth7 type veth peer name veth8");
SYS(fail, "ip link set dev veth7 up");
SYS(fail, "ip link add link veth7 name veth7.66 type vlan id 66");
SYS(fail, "ip link set veth7.66 netns %s", NS_VLAN_B);
/*
* up it in B before the input lookup: the move closed it, and a
* down device fails the resolver on IFF_UP before reaching the
* netns check this subtest exists to pin
*/
SYS(fail, "ip -n %s link set dev veth7.66 up", NS_VLAN_B);
parent_idx = if_nametoindex("veth7");
if (!ASSERT_NEQ(parent_idx, 0, "if_nametoindex(veth7)"))
goto fail;
/*
* input: the moved device is still in veth7's VLAN group, but it
* lives in another netns, so the lookup must fail closed
*/
skb.ifindex = parent_idx;
memset(fib_params, 0, sizeof(*fib_params));
fib_params->family = AF_INET;
fib_params->l4_protocol = IPPROTO_TCP;
fib_params->ifindex = parent_idx;
fib_params->h_vlan_proto = htons(ETH_P_8021Q);
fib_params->h_vlan_TCI = htons(66);
if (!ASSERT_EQ(inet_pton(AF_INET, IPV4_VLAN_NETNS_DST, &fib_params->ipv4_dst),
1, "inet_pton(dst)"))
goto fail;
skel->bss->fib_lookup_ret = -1;
skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT |
BPF_FIB_LOOKUP_SKIP_NEIGH;
err = bpf_prog_test_run_opts(prog_fd, &run_opts);
if (!ASSERT_OK(err, "test_run(input)"))
goto fail;
ASSERT_EQ(skel->bss->fib_lookup_ret, BPF_FIB_LKUP_RET_NOT_FWDED,
"input across netns fails closed");
ASSERT_EQ(fib_params->ifindex, parent_idx, "ifindex untouched");
ASSERT_EQ(fib_params->h_vlan_TCI, htons(66), "tag untouched");
close_netns(nstoken);
nstoken = open_netns(NS_VLAN_B);
if (!ASSERT_OK_PTR(nstoken, "open_netns(b)"))
goto fail;
/*
* egress: the fib result is the VLAN device here, but its parent
* is in the other netns, so the swap must not happen
*/
SYS(fail, "ip addr add %s/24 dev veth7.66", IPV4_VLAN_NETNS_ADDR);
err = write_sysctl("/proc/sys/net/ipv4/conf/veth7.66/forwarding", "1");
if (!ASSERT_OK(err, "write_sysctl(forwarding)"))
goto fail;
vlan_idx = if_nametoindex("veth7.66");
if (!ASSERT_NEQ(vlan_idx, 0, "if_nametoindex(veth7.66)"))
goto fail;
memset(fib_params, 0, sizeof(*fib_params));
fib_params->family = AF_INET;
fib_params->l4_protocol = IPPROTO_TCP;
fib_params->ifindex = vlan_idx;
if (!ASSERT_EQ(inet_pton(AF_INET, IPV4_VLAN_NETNS_DST, &fib_params->ipv4_dst),
1, "inet_pton(dst)") ||
!ASSERT_EQ(inet_pton(AF_INET, IPV4_VLAN_NETNS_ADDR, &fib_params->ipv4_src),
1, "inet_pton(src)"))
goto fail;
skel->bss->fib_lookup_ret = -1;
skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN |
BPF_FIB_LOOKUP_SKIP_NEIGH;
err = bpf_prog_test_run_opts(xdp_fd, &xdp_opts);
if (!ASSERT_OK(err, "test_run(egress)"))
goto fail;
ASSERT_EQ(skel->bss->fib_lookup_ret, BPF_FIB_LKUP_RET_VLAN_FAILURE,
"egress returns VLAN_FAILURE");
ASSERT_EQ(fib_params->ifindex, vlan_idx,
"foreign parent not published");
ASSERT_EQ(fib_params->h_vlan_TCI, 0, "vlan fields zero");
fail:
if (nstoken)
close_netns(nstoken);
SYS_NOFAIL("ip netns del " NS_VLAN_A);
SYS_NOFAIL("ip netns del " NS_VLAN_B);
fib_lookup__destroy(skel);
}
#define REDIRECT_NPKTS 1000
#define NS_REDIRECT "fib_lookup_redirect_ns"
/*
* The egress flag exists so an XDP program can redirect to the physical
* parent. A redirect that lands on a VLAN device is dropped at
* xdp_do_flush(), because a VLAN device has no ndo_xdp_xmit. Drive real
* frames with BPF_F_TEST_XDP_LIVE_FRAMES, which runs the native
* xdp_do_redirect() + xdp_do_flush() path: a reducible VLAN egress
* resolves to veth1 and is delivered to its peer veth2, while a QinQ
* egress returns VLAN_FAILURE and is passed to the stack instead of
* redirected to a device that would silently drop it.
*/
void test_fib_lookup_vlan_redirect(void)
{
int redirect_fd, err, veth1_idx, veth2_idx = -1;
struct bpf_fib_lookup *fib_params;
struct nstoken *nstoken = NULL;
struct fib_lookup *skel = NULL;
bool xdp_attached = false;
LIBBPF_OPTS(bpf_test_run_opts, lf_opts,
.data_in = &pkt_v4,
.data_size_in = sizeof(pkt_v4),
.flags = BPF_F_TEST_XDP_LIVE_FRAMES,
.repeat = REDIRECT_NPKTS,
);
skel = fib_lookup__open_and_load();
if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
return;
redirect_fd = bpf_program__fd(skel->progs.fib_lookup_redirect);
fib_params = &skel->bss->fib_params;
SYS(fail, "ip netns add %s", NS_REDIRECT);
nstoken = open_netns(NS_REDIRECT);
if (!ASSERT_OK_PTR(nstoken, "open_netns"))
goto fail;
if (setup_netns())
goto fail;
veth1_idx = if_nametoindex("veth1");
veth2_idx = if_nametoindex("veth2");
if (!ASSERT_NEQ(veth1_idx, 0, "if_nametoindex(veth1)") ||
!ASSERT_NEQ(veth2_idx, 0, "if_nametoindex(veth2)"))
goto fail;
/*
* A redirect to veth1 is delivered to its peer veth2. veth_xdp_xmit()
* only accepts the frame if veth2's NAPI is up, which on veth means
* veth2 carries an XDP program; xdp_count tallies what arrives.
*/
err = bpf_xdp_attach(veth2_idx, bpf_program__fd(skel->progs.xdp_count),
XDP_FLAGS_DRV_MODE, NULL);
if (!ASSERT_OK(err, "attach xdp_count on veth2"))
goto fail;
xdp_attached = true;
/* reducible VLAN egress: resolves to the physical parent veth1 */
memset(fib_params, 0, sizeof(*fib_params));
fib_params->family = AF_INET;
fib_params->l4_protocol = IPPROTO_TCP;
fib_params->ifindex = veth1_idx;
if (!ASSERT_EQ(inet_pton(AF_INET, IPV4_IFACE_ADDR, &fib_params->ipv4_src),
1, "inet_pton(src)") ||
!ASSERT_EQ(inet_pton(AF_INET, IPV4_VLAN_EGRESS_DST, &fib_params->ipv4_dst),
1, "inet_pton(reducible dst)"))
goto fail;
skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH;
skel->bss->redirected = 0;
skel->bss->passed = 0;
skel->bss->delivered = 0;
err = bpf_prog_test_run_opts(redirect_fd, &lf_opts);
if (!ASSERT_OK(err, "test_run(reducible egress)"))
goto fail;
ASSERT_EQ(skel->bss->redirected, REDIRECT_NPKTS, "reducible egress redirected");
ASSERT_EQ(skel->bss->passed, 0, "reducible egress not passed");
ASSERT_GT(skel->bss->delivered, 0, "reducible egress delivered to veth2");
/*
* QinQ egress: not reducible, so the lookup returns VLAN_FAILURE and
* the program passes the frame instead of redirecting to the inner
* VLAN device. redirected == 0 is the assertion that matters: the
* program did not redirect to a device that would drop the frame at
* xdp_do_flush(). veth2's delivered count is not checked here, since
* a passed frame can still reach veth2 through the stack's forwarding
* path, which is unrelated to the redirect under test.
*/
memset(fib_params, 0, sizeof(*fib_params));
fib_params->family = AF_INET;
fib_params->l4_protocol = IPPROTO_TCP;
fib_params->ifindex = veth1_idx;
if (!ASSERT_EQ(inet_pton(AF_INET, IPV4_IFACE_ADDR, &fib_params->ipv4_src),
1, "inet_pton(src)") ||
!ASSERT_EQ(inet_pton(AF_INET, IPV4_QINQ_DST, &fib_params->ipv4_dst),
1, "inet_pton(qinq dst)"))
goto fail;
skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH;
skel->bss->redirected = 0;
skel->bss->passed = 0;
err = bpf_prog_test_run_opts(redirect_fd, &lf_opts);
if (!ASSERT_OK(err, "test_run(qinq egress)"))
goto fail;
ASSERT_EQ(skel->bss->passed, REDIRECT_NPKTS, "qinq egress passed");
ASSERT_EQ(skel->bss->redirected, 0, "qinq egress not redirected");
fail:
if (xdp_attached)
bpf_xdp_detach(veth2_idx, XDP_FLAGS_DRV_MODE, NULL);
if (nstoken)
close_netns(nstoken);
SYS_NOFAIL("ip netns del " NS_REDIRECT);
fib_lookup__destroy(skel);
}

57
tools/testing/selftests/bpf/progs/fib_lookup.c
View File

@ -4,7 +4,11 @@
#include <linux/types.h>
#include <linux/bpf.h>
#include <linux/pkt_cls.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
struct bpf_fib_lookup fib_params = {};
int fib_lookup_ret = 0;
@ -19,4 +23,57 @@ int fib_lookup(struct __sk_buff *skb)
return TC_ACT_SHOT;
}
SEC("xdp")
int fib_lookup_xdp(struct xdp_md *ctx)
{
fib_lookup_ret = bpf_fib_lookup(ctx, &fib_params, sizeof(fib_params),
lookup_flags);
return XDP_DROP;
}
int redirected = 0;
int passed = 0;
int delivered = 0;
SEC("xdp")
int fib_lookup_redirect(struct xdp_md *ctx)
{
struct bpf_fib_lookup params = fib_params;
long ret;
ret = bpf_fib_lookup(ctx, &params, sizeof(params), lookup_flags);
if (ret == BPF_FIB_LKUP_RET_SUCCESS) {
redirected++;
return bpf_redirect(params.ifindex, 0);
}
passed++;
return XDP_PASS;
}
SEC("xdp")
int xdp_count(struct xdp_md *ctx)
{
void *data = (void *)(long)ctx->data;
void *data_end = (void *)(long)ctx->data_end;
struct ethhdr *eth = data;
struct iphdr *iph;
/*
* count only the test's TCP frames: the netns has live
* link-local traffic (DAD, MLD) that would satisfy a bare
* counter
*/
if ((void *)(eth + 1) > data_end ||
eth->h_proto != bpf_htons(ETH_P_IP))
return XDP_DROP;
iph = (void *)(eth + 1);
if ((void *)(iph + 1) > data_end || iph->protocol != IPPROTO_TCP)
return XDP_DROP;
delivered++;
return XDP_DROP;
}
char _license[] SEC("license") = "GPL";