Commit d9688f89 authored by Christian Ehrig's avatar Christian Ehrig Committed by Alexei Starovoitov
Browse files

selftests/bpf: Test FOU kfuncs for externally controlled ipip devices 



Add tests for FOU and GUE encapsulation via the bpf_skb_{set,get}_fou_encap
kfuncs, using ipip devices in collect-metadata mode.

These tests make sure that we can successfully set and obtain FOU and GUE
encap parameters using ingress / egress BPF tc-hooks.

Signed-off-by: default avatarChristian Ehrig <cehrig@cloudflare.com>
Link: https://lore.kernel.org/r/040193566ddbdb0b53eb359f7ac7bbd316f338b5.1680874078.git.cehrig@cloudflare.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent c50e9609

tools/testing/selftests/bpf/prog_tests/test_tunnel.c

+151 −2
Original line number Diff line number Diff line
@@ -89,6 +89,9 @@ 
#define IP6VXLAN_TUNL_DEV0 "ip6vxlan00"

#define IP6VXLAN_TUNL_DEV1 "ip6vxlan11"



#define IPIP_TUNL_DEV0 "ipip00"

#define IPIP_TUNL_DEV1 "ipip11"



#define PING_ARGS "-i 0.01 -c 3 -w 10 -q"



static int config_device(void)
@@ -188,6 +191,79 @@ static void delete_ip6vxlan_tunnel(void) 
	SYS_NOFAIL("ip link delete dev %s", IP6VXLAN_TUNL_DEV1);

}



enum ipip_encap {

	NONE	= 0,

	FOU	= 1,

	GUE	= 2,

};



static int set_ipip_encap(const char *ipproto, const char *type)

{

	SYS(fail, "ip -n at_ns0 fou add port 5555 %s", ipproto);

	SYS(fail, "ip -n at_ns0 link set dev %s type ipip encap %s",

	    IPIP_TUNL_DEV0, type);

	SYS(fail, "ip -n at_ns0 link set dev %s type ipip encap-dport 5555",

	    IPIP_TUNL_DEV0);



	return 0;

fail:

	return -1;

}



static int add_ipip_tunnel(enum ipip_encap encap)

{

	int err;

	const char *ipproto, *type;



	switch (encap) {

	case FOU:

		ipproto = "ipproto 4";

		type = "fou";

		break;

	case GUE:

		ipproto = "gue";

		type = ipproto;

		break;

	default:

		ipproto = NULL;

		type = ipproto;

	}



	/* at_ns0 namespace */

	SYS(fail, "ip -n at_ns0 link add dev %s type ipip local %s remote %s",

	    IPIP_TUNL_DEV0, IP4_ADDR_VETH0, IP4_ADDR1_VETH1);



	if (type && ipproto) {

		err = set_ipip_encap(ipproto, type);

		if (!ASSERT_OK(err, "set_ipip_encap"))

			goto fail;

	}



	SYS(fail, "ip -n at_ns0 link set dev %s up", IPIP_TUNL_DEV0);

	SYS(fail, "ip -n at_ns0 addr add dev %s %s/24",

	    IPIP_TUNL_DEV0, IP4_ADDR_TUNL_DEV0);



	/* root namespace */

	if (type && ipproto)

		SYS(fail, "ip fou add port 5555 %s", ipproto);

	SYS(fail, "ip link add dev %s type ipip external", IPIP_TUNL_DEV1);

	SYS(fail, "ip link set dev %s up", IPIP_TUNL_DEV1);

	SYS(fail, "ip addr add dev %s %s/24", IPIP_TUNL_DEV1,

	    IP4_ADDR_TUNL_DEV1);



	return 0;

fail:

	return -1;

}



static void delete_ipip_tunnel(void)

{

	SYS_NOFAIL("ip -n at_ns0 link delete dev %s", IPIP_TUNL_DEV0);

	SYS_NOFAIL("ip -n at_ns0 fou del port 5555 2> /dev/null");

	SYS_NOFAIL("ip link delete dev %s", IPIP_TUNL_DEV1);

	SYS_NOFAIL("ip fou del port 5555 2> /dev/null");

}



static int test_ping(int family, const char *addr)

{

	SYS(fail, "%s %s %s > /dev/null", ping_command(family), PING_ARGS, addr);
@@ -386,10 +462,80 @@ static void test_ip6vxlan_tunnel(void) 
		test_tunnel_kern__destroy(skel);

}



#define RUN_TEST(name)							\

static void test_ipip_tunnel(enum ipip_encap encap)

{

	struct test_tunnel_kern *skel = NULL;

	struct nstoken *nstoken;

	int set_src_prog_fd, get_src_prog_fd;

	int ifindex = -1;

	int err;

	DECLARE_LIBBPF_OPTS(bpf_tc_hook, tc_hook,

			    .attach_point = BPF_TC_INGRESS);



	/* add ipip tunnel */

	err = add_ipip_tunnel(encap);

	if (!ASSERT_OK(err, "add_ipip_tunnel"))

		goto done;



	/* load and attach bpf prog to tunnel dev tc hook point */

	skel = test_tunnel_kern__open_and_load();

	if (!ASSERT_OK_PTR(skel, "test_tunnel_kern__open_and_load"))

		goto done;

	ifindex = if_nametoindex(IPIP_TUNL_DEV1);

	if (!ASSERT_NEQ(ifindex, 0, "ipip11 ifindex"))

		goto done;

	tc_hook.ifindex = ifindex;



	switch (encap) {

	case FOU:

		get_src_prog_fd = bpf_program__fd(

			skel->progs.ipip_encap_get_tunnel);

		set_src_prog_fd = bpf_program__fd(

			skel->progs.ipip_fou_set_tunnel);

		break;

	case GUE:

		get_src_prog_fd = bpf_program__fd(

			skel->progs.ipip_encap_get_tunnel);

		set_src_prog_fd = bpf_program__fd(

			skel->progs.ipip_gue_set_tunnel);

		break;

	default:

		get_src_prog_fd = bpf_program__fd(

			skel->progs.ipip_get_tunnel);

		set_src_prog_fd = bpf_program__fd(

			skel->progs.ipip_set_tunnel);

	}



	if (!ASSERT_GE(set_src_prog_fd, 0, "bpf_program__fd"))

		goto done;

	if (!ASSERT_GE(get_src_prog_fd, 0, "bpf_program__fd"))

		goto done;

	if (attach_tc_prog(&tc_hook, get_src_prog_fd, set_src_prog_fd))

		goto done;



	/* ping from root namespace test */

	err = test_ping(AF_INET, IP4_ADDR_TUNL_DEV0);

	if (!ASSERT_OK(err, "test_ping"))

		goto done;



	/* ping from at_ns0 namespace test */

	nstoken = open_netns("at_ns0");

	err = test_ping(AF_INET, IP4_ADDR_TUNL_DEV1);

	if (!ASSERT_OK(err, "test_ping"))

		goto done;

	close_netns(nstoken);



done:

	/* delete ipip tunnel */

	delete_ipip_tunnel();

	if (skel)

		test_tunnel_kern__destroy(skel);

}



#define RUN_TEST(name, ...)						\

	({								\

		if (test__start_subtest(#name)) {			\

			test_ ## name();				\

			test_ ## name(__VA_ARGS__);			\

		}							\

	})
@@ -400,6 +546,9 @@ static void *test_tunnel_run_tests(void *arg) 


	RUN_TEST(vxlan_tunnel);

	RUN_TEST(ip6vxlan_tunnel);

	RUN_TEST(ipip_tunnel, NONE);

	RUN_TEST(ipip_tunnel, FOU);

	RUN_TEST(ipip_tunnel, GUE);



	cleanup();

tools/testing/selftests/bpf/progs/test_tunnel_kern.c

+117 −0
Original line number Diff line number Diff line
@@ -52,6 +52,21 @@ struct vxlan_metadata { 
	__u32     gbp;

};



struct bpf_fou_encap {

	__be16 sport;

	__be16 dport;

};



enum bpf_fou_encap_type {

	FOU_BPF_ENCAP_FOU,

	FOU_BPF_ENCAP_GUE,

};



int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx,

			  struct bpf_fou_encap *encap, int type) __ksym;

int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx,

			  struct bpf_fou_encap *encap) __ksym;



struct {

	__uint(type, BPF_MAP_TYPE_ARRAY);

	__uint(max_entries, 1);
@@ -749,6 +764,108 @@ int ipip_get_tunnel(struct __sk_buff *skb) 
	return TC_ACT_OK;

}



SEC("tc")

int ipip_gue_set_tunnel(struct __sk_buff *skb)

{

	struct bpf_tunnel_key key = {};

	struct bpf_fou_encap encap = {};

	void *data = (void *)(long)skb->data;

	struct iphdr *iph = data;

	void *data_end = (void *)(long)skb->data_end;

	int ret;



	if (data + sizeof(*iph) > data_end) {

		log_err(1);

		return TC_ACT_SHOT;

	}



	key.tunnel_ttl = 64;

	if (iph->protocol == IPPROTO_ICMP)

		key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */



	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0);

	if (ret < 0) {

		log_err(ret);

		return TC_ACT_SHOT;

	}



	encap.sport = 0;

	encap.dport = bpf_htons(5555);



	ret = bpf_skb_set_fou_encap(skb, &encap, FOU_BPF_ENCAP_GUE);

	if (ret < 0) {

		log_err(ret);

		return TC_ACT_SHOT;

	}



	return TC_ACT_OK;

}



SEC("tc")

int ipip_fou_set_tunnel(struct __sk_buff *skb)

{

	struct bpf_tunnel_key key = {};

	struct bpf_fou_encap encap = {};

	void *data = (void *)(long)skb->data;

	struct iphdr *iph = data;

	void *data_end = (void *)(long)skb->data_end;

	int ret;



	if (data + sizeof(*iph) > data_end) {

		log_err(1);

		return TC_ACT_SHOT;

	}



	key.tunnel_ttl = 64;

	if (iph->protocol == IPPROTO_ICMP)

		key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */



	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0);

	if (ret < 0) {

		log_err(ret);

		return TC_ACT_SHOT;

	}



	encap.sport = 0;

	encap.dport = bpf_htons(5555);



	ret = bpf_skb_set_fou_encap(skb, &encap, FOU_BPF_ENCAP_FOU);

	if (ret < 0) {

		log_err(ret);

		return TC_ACT_SHOT;

	}



	return TC_ACT_OK;

}



SEC("tc")

int ipip_encap_get_tunnel(struct __sk_buff *skb)

{

	int ret;

	struct bpf_tunnel_key key = {};

	struct bpf_fou_encap encap = {};



	ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);

	if (ret < 0) {

		log_err(ret);

		return TC_ACT_SHOT;

	}



	ret = bpf_skb_get_fou_encap(skb, &encap);

	if (ret < 0) {

		log_err(ret);

		return TC_ACT_SHOT;

	}



	if (bpf_ntohs(encap.dport) != 5555)

		return TC_ACT_SHOT;



	bpf_printk("%d remote ip 0x%x, sport %d, dport %d\n", ret,

		   key.remote_ipv4, bpf_ntohs(encap.sport),

		   bpf_ntohs(encap.dport));

	return TC_ACT_OK;

}



SEC("tc")

int ipip6_set_tunnel(struct __sk_buff *skb)

{