mirror of
https://github.com/torvalds/linux.git
synced 2026-05-30 18:13:41 +02:00
bpf-next-for-netdev
-----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQ6NaUOruQGUkvPdG4raS+Z+3y5EwUCac2n1wAKCRAraS+Z+3y5 E7INAPwOyqMJws2kswrIPZ8jqfaBIcNVe9MM9a9Ldp8qZmWUHAD/ayqW4hHP6eMA WBNcVCDGStYeI4lyINS5AqPN8mMhOAI= =iquL -----END PGP SIGNATURE----- Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2026-04-01 We've added 2 non-merge commits during the last 2 day(s) which contain a total of 3 files changed, 139 insertions(+), 23 deletions(-). The main changes are: 1) skb_dst_drop(skb) when bpf prog does a encap or decap, from Jakub Kicinski * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests/bpf: Test that dst is cleared on same-protocol encap net: Clear the dst when performing encap / decap ==================== Link: https://patch.msgid.link/20260401233956.4133413-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski
commit
6c3dec3e3d
|
|
@ -3256,13 +3256,6 @@ static const struct bpf_func_proto bpf_skb_vlan_pop_proto = {
|
|||
.arg1_type = ARG_PTR_TO_CTX,
|
||||
};
|
||||
|
||||
static void bpf_skb_change_protocol(struct sk_buff *skb, u16 proto)
|
||||
{
|
||||
skb->protocol = htons(proto);
|
||||
if (skb_valid_dst(skb))
|
||||
skb_dst_drop(skb);
|
||||
}
|
||||
|
||||
static int bpf_skb_generic_push(struct sk_buff *skb, u32 off, u32 len)
|
||||
{
|
||||
/* Caller already did skb_cow() with meta_len+len as headroom,
|
||||
|
|
@ -3361,7 +3354,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
|
|||
shinfo->gso_type |= SKB_GSO_DODGY;
|
||||
}
|
||||
|
||||
bpf_skb_change_protocol(skb, ETH_P_IPV6);
|
||||
skb->protocol = htons(ETH_P_IPV6);
|
||||
skb_clear_hash(skb);
|
||||
|
||||
return 0;
|
||||
|
|
@ -3392,7 +3385,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
|
|||
shinfo->gso_type |= SKB_GSO_DODGY;
|
||||
}
|
||||
|
||||
bpf_skb_change_protocol(skb, ETH_P_IP);
|
||||
skb->protocol = htons(ETH_P_IP);
|
||||
skb_clear_hash(skb);
|
||||
|
||||
return 0;
|
||||
|
|
@ -3440,7 +3433,13 @@ BPF_CALL_3(bpf_skb_change_proto, struct sk_buff *, skb, __be16, proto,
|
|||
*/
|
||||
ret = bpf_skb_proto_xlat(skb, proto);
|
||||
bpf_compute_data_pointers(skb);
|
||||
return ret;
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (skb_valid_dst(skb))
|
||||
skb_dst_drop(skb);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static const struct bpf_func_proto bpf_skb_change_proto_proto = {
|
||||
|
|
@ -3582,12 +3581,13 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
|
|||
}
|
||||
|
||||
/* Match skb->protocol to new outer l3 protocol */
|
||||
if (skb->protocol == htons(ETH_P_IP) &&
|
||||
flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
|
||||
bpf_skb_change_protocol(skb, ETH_P_IPV6);
|
||||
else if (skb->protocol == htons(ETH_P_IPV6) &&
|
||||
flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
|
||||
bpf_skb_change_protocol(skb, ETH_P_IP);
|
||||
if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
|
||||
skb->protocol = htons(ETH_P_IPV6);
|
||||
else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
|
||||
skb->protocol = htons(ETH_P_IP);
|
||||
|
||||
if (skb_valid_dst(skb))
|
||||
skb_dst_drop(skb);
|
||||
}
|
||||
|
||||
if (skb_is_gso(skb)) {
|
||||
|
|
@ -3615,6 +3615,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
|
|||
static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff,
|
||||
u64 flags)
|
||||
{
|
||||
bool decap = flags & BPF_F_ADJ_ROOM_DECAP_L3_MASK;
|
||||
int ret;
|
||||
|
||||
if (unlikely(flags & ~(BPF_F_ADJ_ROOM_FIXED_GSO |
|
||||
|
|
@ -3637,13 +3638,16 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff,
|
|||
if (unlikely(ret < 0))
|
||||
return ret;
|
||||
|
||||
/* Match skb->protocol to new outer l3 protocol */
|
||||
if (skb->protocol == htons(ETH_P_IP) &&
|
||||
flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV6)
|
||||
bpf_skb_change_protocol(skb, ETH_P_IPV6);
|
||||
else if (skb->protocol == htons(ETH_P_IPV6) &&
|
||||
flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV4)
|
||||
bpf_skb_change_protocol(skb, ETH_P_IP);
|
||||
if (decap) {
|
||||
/* Match skb->protocol to new outer l3 protocol */
|
||||
if (flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV6)
|
||||
skb->protocol = htons(ETH_P_IPV6);
|
||||
else if (flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV4)
|
||||
skb->protocol = htons(ETH_P_IP);
|
||||
|
||||
if (skb_valid_dst(skb))
|
||||
skb_dst_drop(skb);
|
||||
}
|
||||
|
||||
if (skb_is_gso(skb)) {
|
||||
struct skb_shared_info *shinfo = skb_shinfo(skb);
|
||||
|
|
|
|||
55
tools/testing/selftests/bpf/prog_tests/test_dst_clear.c
Normal file
55
tools/testing/selftests/bpf/prog_tests/test_dst_clear.c
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
// SPDX-License-Identifier: GPL-2.0
|
||||
/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/socket.h>
|
||||
#include <net/if.h>
|
||||
|
||||
#include "test_progs.h"
|
||||
#include "network_helpers.h"
|
||||
#include "test_dst_clear.skel.h"
|
||||
|
||||
#define IPV4_IFACE_ADDR "1.0.0.1"
|
||||
#define UDP_TEST_PORT 7777
|
||||
|
||||
void test_ns_dst_clear(void)
|
||||
{
|
||||
LIBBPF_OPTS(bpf_tcx_opts, tcx_opts);
|
||||
struct test_dst_clear *skel;
|
||||
struct sockaddr_in addr;
|
||||
struct bpf_link *link;
|
||||
socklen_t addrlen;
|
||||
char buf[128] = {};
|
||||
int sockfd, err;
|
||||
|
||||
skel = test_dst_clear__open_and_load();
|
||||
if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
|
||||
return;
|
||||
|
||||
SYS(fail, "ip addr add %s/8 dev lo", IPV4_IFACE_ADDR);
|
||||
|
||||
link = bpf_program__attach_tcx(skel->progs.dst_clear,
|
||||
if_nametoindex("lo"), &tcx_opts);
|
||||
if (!ASSERT_OK_PTR(link, "attach_tcx"))
|
||||
goto fail;
|
||||
skel->links.dst_clear = link;
|
||||
|
||||
addrlen = sizeof(addr);
|
||||
err = make_sockaddr(AF_INET, IPV4_IFACE_ADDR, UDP_TEST_PORT,
|
||||
(void *)&addr, &addrlen);
|
||||
if (!ASSERT_OK(err, "make_sockaddr"))
|
||||
goto fail;
|
||||
sockfd = socket(AF_INET, SOCK_DGRAM, 0);
|
||||
if (!ASSERT_NEQ(sockfd, -1, "socket"))
|
||||
goto fail;
|
||||
err = sendto(sockfd, buf, sizeof(buf), 0, (void *)&addr, addrlen);
|
||||
close(sockfd);
|
||||
if (!ASSERT_EQ(err, sizeof(buf), "send"))
|
||||
goto fail;
|
||||
|
||||
ASSERT_TRUE(skel->bss->had_dst, "had_dst");
|
||||
ASSERT_TRUE(skel->bss->dst_cleared, "dst_cleared");
|
||||
|
||||
fail:
|
||||
test_dst_clear__destroy(skel);
|
||||
}
|
||||
57
tools/testing/selftests/bpf/progs/test_dst_clear.c
Normal file
57
tools/testing/selftests/bpf/progs/test_dst_clear.c
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
// SPDX-License-Identifier: GPL-2.0
|
||||
/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
|
||||
|
||||
#include "vmlinux.h"
|
||||
#include "bpf_tracing_net.h"
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <bpf/bpf_endian.h>
|
||||
|
||||
#define UDP_TEST_PORT 7777
|
||||
|
||||
void *bpf_cast_to_kern_ctx(void *) __ksym;
|
||||
|
||||
bool had_dst = false;
|
||||
bool dst_cleared = false;
|
||||
|
||||
SEC("tc/egress")
|
||||
int dst_clear(struct __sk_buff *skb)
|
||||
{
|
||||
struct sk_buff *kskb;
|
||||
struct iphdr iph;
|
||||
struct udphdr udph;
|
||||
int err;
|
||||
|
||||
if (skb->protocol != __bpf_constant_htons(ETH_P_IP))
|
||||
return TC_ACT_OK;
|
||||
|
||||
if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph, sizeof(iph)))
|
||||
return TC_ACT_OK;
|
||||
|
||||
if (iph.protocol != IPPROTO_UDP)
|
||||
return TC_ACT_OK;
|
||||
|
||||
if (bpf_skb_load_bytes(skb, ETH_HLEN + sizeof(iph), &udph, sizeof(udph)))
|
||||
return TC_ACT_OK;
|
||||
|
||||
if (udph.dest != __bpf_constant_htons(UDP_TEST_PORT))
|
||||
return TC_ACT_OK;
|
||||
|
||||
kskb = bpf_cast_to_kern_ctx(skb);
|
||||
had_dst = (kskb->_skb_refdst != 0);
|
||||
|
||||
/* Same-protocol encap (IPIP): protocol stays IPv4, but the dst
|
||||
* from the original routing is no longer valid for the outer hdr.
|
||||
*/
|
||||
err = bpf_skb_adjust_room(skb, (s32)sizeof(struct iphdr),
|
||||
BPF_ADJ_ROOM_MAC,
|
||||
BPF_F_ADJ_ROOM_FIXED_GSO |
|
||||
BPF_F_ADJ_ROOM_ENCAP_L3_IPV4);
|
||||
if (err)
|
||||
return TC_ACT_SHOT;
|
||||
|
||||
dst_cleared = (kskb->_skb_refdst == 0);
|
||||
|
||||
return TC_ACT_SHOT;
|
||||
}
|
||||
|
||||
char __license[] SEC("license") = "GPL";
|
||||
Loading…
Reference in New Issue
Block a user