Skip to content

Commit 7341c24

Browse files
borkmannkernel-patches-bot
borkmann
authored and
kernel-patches-bot
committed
bpf, selftests: add redirect_neigh selftest
Add a small test that excercises the new redirect_neigh() helper for the IPv4 and IPv6 case. Signed-off-by: Daniel Borkmann <[email protected]>
1 parent 05b9c3d commit 7341c24

File tree

2 files changed

+312
-0
lines changed

2 files changed

+312
-0
lines changed

‎tools/testing/selftests/bpf/progs/test_tc_neigh.c

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
#include <stdint.h>
3+
#include <stdbool.h>
4+
5+
#include <linux/bpf.h>
6+
#include <linux/stddef.h>
7+
#include <linux/pkt_cls.h>
8+
#include <linux/if_ether.h>
9+
#include <linux/in.h>
10+
#include <linux/ip.h>
11+
#include <linux/ipv6.h>
12+
13+
#include <bpf/bpf_helpers.h>
14+
#include <bpf/bpf_endian.h>
15+
16+
#ifndef barrier_data
17+
# define barrier_data(ptr) asm volatile("": :"r"(ptr) :"memory")
18+
#endif
19+
20+
#ifndef ctx_ptr
21+
# define ctx_ptr(field) (void *)(long)(field)
22+
#endif
23+
24+
#define dst_to_src_tmp 0xeeddddeeU
25+
#define src_to_dst_tmp 0xeeffffeeU
26+
27+
#define ip4_src 0xac100164 /* 172.16.1.100 */
28+
#define ip4_dst 0xac100264 /* 172.16.2.100 */
29+
30+
#define ip6_src { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
31+
0x00, 0x01, 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe }
32+
#define ip6_dst { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
33+
0x00, 0x02, 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe }
34+
35+
#ifndef v6_equal
36+
# define v6_equal(a, b) (a.s6_addr32[0] == b.s6_addr32[0] && \
37+
a.s6_addr32[1] == b.s6_addr32[1] && \
38+
a.s6_addr32[2] == b.s6_addr32[2] && \
39+
a.s6_addr32[3] == b.s6_addr32[3])
40+
#endif
41+
42+
static __always_inline bool is_remote_ep_v4(struct __sk_buff *skb,
43+
__be32 addr)
44+
{
45+
void *data_end = ctx_ptr(skb->data_end);
46+
void *data = ctx_ptr(skb->data);
47+
struct iphdr *ip4h;
48+
49+
if (data + sizeof(struct ethhdr) > data_end)
50+
return false;
51+
52+
ip4h = (struct iphdr *)(data + sizeof(struct ethhdr));
53+
if ((void *)(ip4h + 1) > data_end)
54+
return false;
55+
56+
return ip4h->daddr == addr;
57+
}
58+
59+
static __always_inline bool is_remote_ep_v6(struct __sk_buff *skb,
60+
struct in6_addr addr)
61+
{
62+
void *data_end = ctx_ptr(skb->data_end);
63+
void *data = ctx_ptr(skb->data);
64+
struct ipv6hdr *ip6h;
65+
66+
if (data + sizeof(struct ethhdr) > data_end)
67+
return false;
68+
69+
ip6h = (struct ipv6hdr *)(data + sizeof(struct ethhdr));
70+
if ((void *)(ip6h + 1) > data_end)
71+
return false;
72+
73+
return v6_equal(ip6h->daddr, addr);
74+
}
75+
76+
SEC("chk_neigh") int tc_chk(struct __sk_buff *skb)
77+
{
78+
void *data_end = ctx_ptr(skb->data_end);
79+
void *data = ctx_ptr(skb->data);
80+
__u32 *raw = data;
81+
82+
if (data + sizeof(struct ethhdr) > data_end)
83+
return TC_ACT_SHOT;
84+
85+
return !raw[0] && !raw[1] && !raw[2] ? TC_ACT_SHOT : TC_ACT_OK;
86+
}
87+
88+
SEC("dst_ingress") int tc_dst(struct __sk_buff *skb)
89+
{
90+
int idx = dst_to_src_tmp;
91+
__u8 zero[ETH_ALEN * 2];
92+
bool redirect = false;
93+
94+
switch (skb->protocol) {
95+
case __bpf_constant_htons(ETH_P_IP):
96+
redirect = is_remote_ep_v4(skb, __bpf_constant_htonl(ip4_src));
97+
break;
98+
case __bpf_constant_htons(ETH_P_IPV6):
99+
redirect = is_remote_ep_v6(skb, (struct in6_addr)ip6_src);
100+
break;
101+
}
102+
103+
if (!redirect)
104+
return TC_ACT_OK;
105+
106+
barrier_data(&idx);
107+
idx = bpf_ntohl(idx);
108+
109+
__builtin_memset(&zero, 0, sizeof(zero));
110+
if (bpf_skb_store_bytes(skb, 0, &zero, sizeof(zero), 0) < 0)
111+
return TC_ACT_SHOT;
112+
113+
return bpf_redirect_neigh(idx, 0);
114+
}
115+
116+
SEC("src_ingress") int tc_src(struct __sk_buff *skb)
117+
{
118+
int idx = src_to_dst_tmp;
119+
__u8 zero[ETH_ALEN * 2];
120+
bool redirect = false;
121+
122+
switch (skb->protocol) {
123+
case __bpf_constant_htons(ETH_P_IP):
124+
redirect = is_remote_ep_v4(skb, __bpf_constant_htonl(ip4_dst));
125+
break;
126+
case __bpf_constant_htons(ETH_P_IPV6):
127+
redirect = is_remote_ep_v6(skb, (struct in6_addr)ip6_dst);
128+
break;
129+
}
130+
131+
if (!redirect)
132+
return TC_ACT_OK;
133+
134+
barrier_data(&idx);
135+
idx = bpf_ntohl(idx);
136+
137+
__builtin_memset(&zero, 0, sizeof(zero));
138+
if (bpf_skb_store_bytes(skb, 0, &zero, sizeof(zero), 0) < 0)
139+
return TC_ACT_SHOT;
140+
141+
return bpf_redirect_neigh(idx, 0);
142+
}
143+
144+
char __license[] SEC("license") = "GPL";

‎tools/testing/selftests/bpf/test_tc_neigh.sh

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
#!/bin/bash
2+
# SPDX-License-Identifier: GPL-2.0
3+
#
4+
# This test sets up 3 netns (src <-> fwd <-> dst). There is no direct veth link
5+
# between src and dst. The netns fwd has veth links to each src and dst. The
6+
# client is in src and server in dst. The test installs a TC BPF program to each
7+
# host facing veth in fwd which calls into bpf_redirect_peer() to perform the
8+
# neigh addr population and redirect; it also installs a dropper prog on the
9+
# egress side to drop skbs if neigh addrs were not populated.
10+
11+
if [[ $EUID -ne 0 ]]; then
12+
echo "This script must be run as root"
13+
echo "FAIL"
14+
exit 1
15+
fi
16+
17+
# check that nc, dd, ping, ping6 and timeout are present
18+
command -v nc >/dev/null 2>&1 || \
19+
{ echo >&2 "nc is not available"; exit 1; }
20+
command -v dd >/dev/null 2>&1 || \
21+
{ echo >&2 "dd is not available"; exit 1; }
22+
command -v timeout >/dev/null 2>&1 || \
23+
{ echo >&2 "timeout is not available"; exit 1; }
24+
command -v ping >/dev/null 2>&1 || \
25+
{ echo >&2 "ping is not available"; exit 1; }
26+
command -v ping6 >/dev/null 2>&1 || \
27+
{ echo >&2 "ping6 is not available"; exit 1; }
28+
29+
readonly GREEN='\033[0;92m'
30+
readonly RED='\033[0;31m'
31+
readonly NC='\033[0m' # No Color
32+
33+
readonly PING_ARG="-c 3 -w 10 -q"
34+
35+
readonly TIMEOUT=10
36+
37+
readonly NS_SRC="ns-src-$(mktemp -u XXXXXX)"
38+
readonly NS_FWD="ns-fwd-$(mktemp -u XXXXXX)"
39+
readonly NS_DST="ns-dst-$(mktemp -u XXXXXX)"
40+
41+
readonly IP4_SRC="172.16.1.100"
42+
readonly IP4_DST="172.16.2.100"
43+
44+
readonly IP6_SRC="::1:dead:beef:cafe"
45+
readonly IP6_DST="::2:dead:beef:cafe"
46+
47+
readonly IP4_SLL="169.254.0.1"
48+
readonly IP4_DLL="169.254.0.2"
49+
readonly IP4_NET="169.254.0.0"
50+
51+
cleanup()
52+
{
53+
ip netns del ${NS_SRC}
54+
ip netns del ${NS_FWD}
55+
ip netns del ${NS_DST}
56+
}
57+
58+
trap cleanup EXIT
59+
60+
set -e
61+
62+
ip netns add "${NS_SRC}"
63+
ip netns add "${NS_FWD}"
64+
ip netns add "${NS_DST}"
65+
66+
ip link add veth_src type veth peer name veth_src_fwd
67+
ip link add veth_dst type veth peer name veth_dst_fwd
68+
69+
ip link set veth_src netns ${NS_SRC}
70+
ip link set veth_src_fwd netns ${NS_FWD}
71+
72+
ip link set veth_dst netns ${NS_DST}
73+
ip link set veth_dst_fwd netns ${NS_FWD}
74+
75+
ip -netns ${NS_SRC} addr add ${IP4_SRC}/32 dev veth_src
76+
ip -netns ${NS_DST} addr add ${IP4_DST}/32 dev veth_dst
77+
78+
# The fwd netns automatically get a v6 LL address / routes, but also needs v4
79+
# one in order to start ARP probing. IP4_NET route is added to the endpoints
80+
# so that the ARP processing will reply.
81+
82+
ip -netns ${NS_FWD} addr add ${IP4_SLL}/32 dev veth_src_fwd
83+
ip -netns ${NS_FWD} addr add ${IP4_DLL}/32 dev veth_dst_fwd
84+
85+
ip -netns ${NS_SRC} addr add ${IP6_SRC}/128 dev veth_src nodad
86+
ip -netns ${NS_DST} addr add ${IP6_DST}/128 dev veth_dst nodad
87+
88+
ip -netns ${NS_SRC} link set dev veth_src up
89+
ip -netns ${NS_FWD} link set dev veth_src_fwd up
90+
91+
ip -netns ${NS_DST} link set dev veth_dst up
92+
ip -netns ${NS_FWD} link set dev veth_dst_fwd up
93+
94+
ip -netns ${NS_SRC} route add ${IP4_DST}/32 dev veth_src scope global
95+
ip -netns ${NS_SRC} route add ${IP4_NET}/16 dev veth_src scope global
96+
ip -netns ${NS_FWD} route add ${IP4_SRC}/32 dev veth_src_fwd scope global
97+
98+
ip -netns ${NS_SRC} route add ${IP6_DST}/128 dev veth_src scope global
99+
ip -netns ${NS_FWD} route add ${IP6_SRC}/128 dev veth_src_fwd scope global
100+
101+
ip -netns ${NS_DST} route add ${IP4_SRC}/32 dev veth_dst scope global
102+
ip -netns ${NS_DST} route add ${IP4_NET}/16 dev veth_dst scope global
103+
ip -netns ${NS_FWD} route add ${IP4_DST}/32 dev veth_dst_fwd scope global
104+
105+
ip -netns ${NS_DST} route add ${IP6_SRC}/128 dev veth_dst scope global
106+
ip -netns ${NS_FWD} route add ${IP6_DST}/128 dev veth_dst_fwd scope global
107+
108+
fmac_src=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_src_fwd/address)
109+
fmac_dst=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_dst_fwd/address)
110+
111+
ip -netns ${NS_SRC} neigh add ${IP4_DST} dev veth_src lladdr $fmac_src
112+
ip -netns ${NS_DST} neigh add ${IP4_SRC} dev veth_dst lladdr $fmac_dst
113+
114+
ip -netns ${NS_SRC} neigh add ${IP6_DST} dev veth_src lladdr $fmac_src
115+
ip -netns ${NS_DST} neigh add ${IP6_SRC} dev veth_dst lladdr $fmac_dst
116+
117+
veth_dst=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_dst_fwd/ifindex | awk '{printf "%08x\n", $1}')
118+
veth_src=$(ip netns exec ${NS_FWD} cat /sys/class/net/veth_src_fwd/ifindex | awk '{printf "%08x\n", $1}')
119+
120+
xxd -p < test_tc_neigh.o | sed "s/eeddddee/$veth_src/g" | xxd -r -p > test_tc_neigh.x.o
121+
xxd -p < test_tc_neigh.x.o | sed "s/eeffffee/$veth_dst/g" | xxd -r -p > test_tc_neigh.y.o
122+
123+
ip netns exec ${NS_FWD} tc qdisc add dev veth_src_fwd clsact
124+
ip netns exec ${NS_FWD} tc filter add dev veth_src_fwd ingress bpf da obj test_tc_neigh.y.o sec src_ingress
125+
ip netns exec ${NS_FWD} tc filter add dev veth_src_fwd egress bpf da obj test_tc_neigh.y.o sec chk_neigh
126+
127+
ip netns exec ${NS_FWD} tc qdisc add dev veth_dst_fwd clsact
128+
ip netns exec ${NS_FWD} tc filter add dev veth_dst_fwd ingress bpf da obj test_tc_neigh.y.o sec dst_ingress
129+
ip netns exec ${NS_FWD} tc filter add dev veth_dst_fwd egress bpf da obj test_tc_neigh.y.o sec chk_neigh
130+
131+
rm -f test_tc_neigh.x.o test_tc_neigh.y.o
132+
133+
ip netns exec ${NS_DST} bash -c "nc -4 -l -p 9004 &"
134+
ip netns exec ${NS_DST} bash -c "nc -6 -l -p 9006 &"
135+
136+
set +e
137+
138+
TEST="TCPv4 connectivity test"
139+
ip netns exec ${NS_SRC} bash -c "timeout ${TIMEOUT} dd if=/dev/zero bs=1000 count=100 > /dev/tcp/${IP4_DST}/9004"
140+
if [ $? -ne 0 ]; then
141+
echo -e "${TEST}: ${RED}FAIL${NC}"
142+
exit 1
143+
fi
144+
echo -e "${TEST}: ${GREEN}PASS${NC}"
145+
146+
TEST="TCPv6 connectivity test"
147+
ip netns exec ${NS_SRC} bash -c "timeout ${TIMEOUT} dd if=/dev/zero bs=1000 count=100 > /dev/tcp/${IP6_DST}/9006"
148+
if [ $? -ne 0 ]; then
149+
echo -e "${TEST}: ${RED}FAIL${NC}"
150+
exit 1
151+
fi
152+
echo -e "${TEST}: ${GREEN}PASS${NC}"
153+
154+
TEST="ICMPv4 connectivity test"
155+
ip netns exec ${NS_SRC} ping $PING_ARG ${IP4_DST}
156+
if [ $? -ne 0 ]; then
157+
echo -e "${TEST}: ${RED}FAIL${NC}"
158+
exit 1
159+
fi
160+
echo -e "${TEST}: ${GREEN}PASS${NC}"
161+
162+
TEST="ICMPv6 connectivity test"
163+
ip netns exec ${NS_SRC} ping6 $PING_ARG ${IP6_DST}
164+
if [ $? -ne 0 ]; then
165+
echo -e "${TEST}: ${RED}FAIL${NC}"
166+
exit 1
167+
fi
168+
echo -e "${TEST}: ${GREEN}PASS${NC}"

0 commit comments

Comments
 (0)