1// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2// Copyright (c) 2020 Cloudflare 3/* 4 * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP). 5 * 6 * Tests exercise: 7 * - attaching/detaching/querying programs to BPF_SK_LOOKUP hook, 8 * - redirecting socket lookup to a socket selected by BPF program, 9 * - failing a socket lookup on BPF program's request, 10 * - error scenarios for selecting a socket from BPF program, 11 * - accessing BPF program context, 12 * - attaching and running multiple BPF programs. 13 * 14 * Tests run in a dedicated network namespace. 15 */ 16 17#define _GNU_SOURCE 18#include <arpa/inet.h> 19#include <assert.h> 20#include <errno.h> 21#include <error.h> 22#include <fcntl.h> 23#include <sched.h> 24#include <stdio.h> 25#include <sys/types.h> 26#include <sys/stat.h> 27#include <unistd.h> 28 29#include <bpf/libbpf.h> 30#include <bpf/bpf.h> 31 32#include "test_progs.h" 33#include "bpf_util.h" 34#include "cgroup_helpers.h" 35#include "network_helpers.h" 36#include "testing_helpers.h" 37#include "test_sk_lookup.skel.h" 38 39/* External (address, port) pairs the client sends packets to. */ 40#define EXT_IP4 "127.0.0.1" 41#define EXT_IP6 "fd00::1" 42#define EXT_PORT 7007 43 44/* Internal (address, port) pairs the server listens/receives at. */ 45#define INT_IP4 "127.0.0.2" 46#define INT_IP4_V6 "::ffff:127.0.0.2" 47#define INT_IP6 "fd00::2" 48#define INT_PORT 8008 49 50#define IO_TIMEOUT_SEC 3 51 52enum server { 53 SERVER_A = 0, 54 SERVER_B = 1, 55 MAX_SERVERS, 56}; 57 58enum { 59 PROG1 = 0, 60 PROG2, 61}; 62 63struct inet_addr { 64 const char *ip; 65 unsigned short port; 66}; 67 68struct test { 69 const char *desc; 70 struct bpf_program *lookup_prog; 71 struct bpf_program *reuseport_prog; 72 struct bpf_map *sock_map; 73 int sotype; 74 struct inet_addr connect_to; 75 struct inet_addr listen_at; 76 enum server accept_on; 77 bool reuseport_has_conns; /* Add a connected socket to reuseport group */ 78}; 79 80static __u32 duration; /* for CHECK macro */ 81 82static bool is_ipv6(const char *ip) 83{ 84 return !!strchr(ip, ':'); 85} 86 87static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog) 88{ 89 int err, prog_fd; 90 91 prog_fd = bpf_program__fd(reuseport_prog); 92 if (prog_fd < 0) { 93 errno = -prog_fd; 94 return -1; 95 } 96 97 err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF, 98 &prog_fd, sizeof(prog_fd)); 99 if (err) 100 return -1; 101 102 return 0; 103} 104 105static socklen_t inetaddr_len(const struct sockaddr_storage *addr) 106{ 107 return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) : 108 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0); 109} 110 111static int make_socket(int sotype, const char *ip, int port, 112 struct sockaddr_storage *addr) 113{ 114 struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC }; 115 int err, family, fd; 116 117 family = is_ipv6(ip) ? AF_INET6 : AF_INET; 118 err = make_sockaddr(family, ip, port, addr, NULL); 119 if (CHECK(err, "make_address", "failed\n")) 120 return -1; 121 122 fd = socket(addr->ss_family, sotype, 0); 123 if (CHECK(fd < 0, "socket", "failed\n")) { 124 log_err("failed to make socket"); 125 return -1; 126 } 127 128 err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo)); 129 if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) { 130 log_err("failed to set SNDTIMEO"); 131 close(fd); 132 return -1; 133 } 134 135 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo)); 136 if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) { 137 log_err("failed to set RCVTIMEO"); 138 close(fd); 139 return -1; 140 } 141 142 return fd; 143} 144 145static int make_server(int sotype, const char *ip, int port, 146 struct bpf_program *reuseport_prog) 147{ 148 struct sockaddr_storage addr = {0}; 149 const int one = 1; 150 int err, fd = -1; 151 152 fd = make_socket(sotype, ip, port, &addr); 153 if (fd < 0) 154 return -1; 155 156 /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */ 157 if (sotype == SOCK_DGRAM) { 158 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one, 159 sizeof(one)); 160 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) { 161 log_err("failed to enable IP_RECVORIGDSTADDR"); 162 goto fail; 163 } 164 } 165 166 if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) { 167 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one, 168 sizeof(one)); 169 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) { 170 log_err("failed to enable IPV6_RECVORIGDSTADDR"); 171 goto fail; 172 } 173 } 174 175 if (sotype == SOCK_STREAM) { 176 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, 177 sizeof(one)); 178 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) { 179 log_err("failed to enable SO_REUSEADDR"); 180 goto fail; 181 } 182 } 183 184 if (reuseport_prog) { 185 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, 186 sizeof(one)); 187 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) { 188 log_err("failed to enable SO_REUSEPORT"); 189 goto fail; 190 } 191 } 192 193 err = bind(fd, (void *)&addr, inetaddr_len(&addr)); 194 if (CHECK(err, "bind", "failed\n")) { 195 log_err("failed to bind listen socket"); 196 goto fail; 197 } 198 199 if (sotype == SOCK_STREAM) { 200 err = listen(fd, SOMAXCONN); 201 if (CHECK(err, "make_server", "listen")) { 202 log_err("failed to listen on port %d", port); 203 goto fail; 204 } 205 } 206 207 /* Late attach reuseport prog so we can have one init path */ 208 if (reuseport_prog) { 209 err = attach_reuseport(fd, reuseport_prog); 210 if (CHECK(err, "attach_reuseport", "failed\n")) { 211 log_err("failed to attach reuseport prog"); 212 goto fail; 213 } 214 } 215 216 return fd; 217fail: 218 close(fd); 219 return -1; 220} 221 222static int make_client(int sotype, const char *ip, int port) 223{ 224 struct sockaddr_storage addr = {0}; 225 int err, fd; 226 227 fd = make_socket(sotype, ip, port, &addr); 228 if (fd < 0) 229 return -1; 230 231 err = connect(fd, (void *)&addr, inetaddr_len(&addr)); 232 if (CHECK(err, "make_client", "connect")) { 233 log_err("failed to connect client socket"); 234 goto fail; 235 } 236 237 return fd; 238fail: 239 close(fd); 240 return -1; 241} 242 243static __u64 socket_cookie(int fd) 244{ 245 __u64 cookie; 246 socklen_t cookie_len = sizeof(cookie); 247 248 if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0, 249 "getsockopt(SO_COOKIE)", "%s\n", strerror(errno))) 250 return 0; 251 return cookie; 252} 253 254static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port, 255 const char *remote_ip, __u16 remote_port) 256{ 257 void *local, *remote; 258 int err; 259 260 memset(ctx, 0, sizeof(*ctx)); 261 ctx->local_port = local_port; 262 ctx->remote_port = htons(remote_port); 263 264 if (is_ipv6(local_ip)) { 265 ctx->family = AF_INET6; 266 local = &ctx->local_ip6[0]; 267 remote = &ctx->remote_ip6[0]; 268 } else { 269 ctx->family = AF_INET; 270 local = &ctx->local_ip4; 271 remote = &ctx->remote_ip4; 272 } 273 274 err = inet_pton(ctx->family, local_ip, local); 275 if (CHECK(err != 1, "inet_pton", "local_ip failed\n")) 276 return 1; 277 278 err = inet_pton(ctx->family, remote_ip, remote); 279 if (CHECK(err != 1, "inet_pton", "remote_ip failed\n")) 280 return 1; 281 282 return 0; 283} 284 285static int send_byte(int fd) 286{ 287 ssize_t n; 288 289 errno = 0; 290 n = send(fd, "a", 1, 0); 291 if (CHECK(n <= 0, "send_byte", "send")) { 292 log_err("failed/partial send"); 293 return -1; 294 } 295 return 0; 296} 297 298static int recv_byte(int fd) 299{ 300 char buf[1]; 301 ssize_t n; 302 303 n = recv(fd, buf, sizeof(buf), 0); 304 if (CHECK(n <= 0, "recv_byte", "recv")) { 305 log_err("failed/partial recv"); 306 return -1; 307 } 308 return 0; 309} 310 311static int tcp_recv_send(int server_fd) 312{ 313 char buf[1]; 314 int ret, fd; 315 ssize_t n; 316 317 fd = accept(server_fd, NULL, NULL); 318 if (CHECK(fd < 0, "accept", "failed\n")) { 319 log_err("failed to accept"); 320 return -1; 321 } 322 323 n = recv(fd, buf, sizeof(buf), 0); 324 if (CHECK(n <= 0, "recv", "failed\n")) { 325 log_err("failed/partial recv"); 326 ret = -1; 327 goto close; 328 } 329 330 n = send(fd, buf, n, 0); 331 if (CHECK(n <= 0, "send", "failed\n")) { 332 log_err("failed/partial send"); 333 ret = -1; 334 goto close; 335 } 336 337 ret = 0; 338close: 339 close(fd); 340 return ret; 341} 342 343static void v4_to_v6(struct sockaddr_storage *ss) 344{ 345 struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss; 346 struct sockaddr_in v4 = *(struct sockaddr_in *)ss; 347 348 v6->sin6_family = AF_INET6; 349 v6->sin6_port = v4.sin_port; 350 v6->sin6_addr.s6_addr[10] = 0xff; 351 v6->sin6_addr.s6_addr[11] = 0xff; 352 memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4); 353 memset(&v6->sin6_addr.s6_addr[0], 0, 10); 354} 355 356static int udp_recv_send(int server_fd) 357{ 358 char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))]; 359 struct sockaddr_storage _src_addr = { 0 }; 360 struct sockaddr_storage *src_addr = &_src_addr; 361 struct sockaddr_storage *dst_addr = NULL; 362 struct msghdr msg = { 0 }; 363 struct iovec iov = { 0 }; 364 struct cmsghdr *cm; 365 char buf[1]; 366 int ret, fd; 367 ssize_t n; 368 369 iov.iov_base = buf; 370 iov.iov_len = sizeof(buf); 371 372 msg.msg_name = src_addr; 373 msg.msg_namelen = sizeof(*src_addr); 374 msg.msg_iov = &iov; 375 msg.msg_iovlen = 1; 376 msg.msg_control = cmsg_buf; 377 msg.msg_controllen = sizeof(cmsg_buf); 378 379 errno = 0; 380 n = recvmsg(server_fd, &msg, 0); 381 if (CHECK(n <= 0, "recvmsg", "failed\n")) { 382 log_err("failed to receive"); 383 return -1; 384 } 385 if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n")) 386 return -1; 387 388 for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) { 389 if ((cm->cmsg_level == SOL_IP && 390 cm->cmsg_type == IP_ORIGDSTADDR) || 391 (cm->cmsg_level == SOL_IPV6 && 392 cm->cmsg_type == IPV6_ORIGDSTADDR)) { 393 dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm); 394 break; 395 } 396 log_err("warning: ignored cmsg at level %d type %d", 397 cm->cmsg_level, cm->cmsg_type); 398 } 399 if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n")) 400 return -1; 401 402 /* Server socket bound to IPv4-mapped IPv6 address */ 403 if (src_addr->ss_family == AF_INET6 && 404 dst_addr->ss_family == AF_INET) { 405 v4_to_v6(dst_addr); 406 } 407 408 /* Reply from original destination address. */ 409 fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0); 410 if (CHECK(fd < 0, "socket", "failed\n")) { 411 log_err("failed to create tx socket"); 412 return -1; 413 } 414 415 ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr)); 416 if (CHECK(ret, "bind", "failed\n")) { 417 log_err("failed to bind tx socket"); 418 goto out; 419 } 420 421 msg.msg_control = NULL; 422 msg.msg_controllen = 0; 423 n = sendmsg(fd, &msg, 0); 424 if (CHECK(n <= 0, "sendmsg", "failed\n")) { 425 log_err("failed to send echo reply"); 426 ret = -1; 427 goto out; 428 } 429 430 ret = 0; 431out: 432 close(fd); 433 return ret; 434} 435 436static int tcp_echo_test(int client_fd, int server_fd) 437{ 438 int err; 439 440 err = send_byte(client_fd); 441 if (err) 442 return -1; 443 err = tcp_recv_send(server_fd); 444 if (err) 445 return -1; 446 err = recv_byte(client_fd); 447 if (err) 448 return -1; 449 450 return 0; 451} 452 453static int udp_echo_test(int client_fd, int server_fd) 454{ 455 int err; 456 457 err = send_byte(client_fd); 458 if (err) 459 return -1; 460 err = udp_recv_send(server_fd); 461 if (err) 462 return -1; 463 err = recv_byte(client_fd); 464 if (err) 465 return -1; 466 467 return 0; 468} 469 470static struct bpf_link *attach_lookup_prog(struct bpf_program *prog) 471{ 472 struct bpf_link *link; 473 int net_fd; 474 475 net_fd = open("/proc/self/ns/net", O_RDONLY); 476 if (CHECK(net_fd < 0, "open", "failed\n")) { 477 log_err("failed to open /proc/self/ns/net"); 478 return NULL; 479 } 480 481 link = bpf_program__attach_netns(prog, net_fd); 482 if (!ASSERT_OK_PTR(link, "bpf_program__attach_netns")) { 483 errno = -PTR_ERR(link); 484 log_err("failed to attach program '%s' to netns", 485 bpf_program__name(prog)); 486 link = NULL; 487 } 488 489 close(net_fd); 490 return link; 491} 492 493static int update_lookup_map(struct bpf_map *map, int index, int sock_fd) 494{ 495 int err, map_fd; 496 uint64_t value; 497 498 map_fd = bpf_map__fd(map); 499 if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) { 500 errno = -map_fd; 501 log_err("failed to get map FD"); 502 return -1; 503 } 504 505 value = (uint64_t)sock_fd; 506 err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST); 507 if (CHECK(err, "bpf_map_update_elem", "failed\n")) { 508 log_err("failed to update redir_map @ %d", index); 509 return -1; 510 } 511 512 return 0; 513} 514 515static void query_lookup_prog(struct test_sk_lookup *skel) 516{ 517 struct bpf_link *link[3] = {}; 518 struct bpf_link_info info; 519 __u32 attach_flags = 0; 520 __u32 prog_ids[3] = {}; 521 __u32 prog_cnt = 3; 522 __u32 prog_id; 523 int net_fd; 524 int err; 525 526 net_fd = open("/proc/self/ns/net", O_RDONLY); 527 if (CHECK(net_fd < 0, "open", "failed\n")) { 528 log_err("failed to open /proc/self/ns/net"); 529 return; 530 } 531 532 link[0] = attach_lookup_prog(skel->progs.lookup_pass); 533 if (!link[0]) 534 goto close; 535 link[1] = attach_lookup_prog(skel->progs.lookup_pass); 536 if (!link[1]) 537 goto detach; 538 link[2] = attach_lookup_prog(skel->progs.lookup_drop); 539 if (!link[2]) 540 goto detach; 541 542 err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */, 543 &attach_flags, prog_ids, &prog_cnt); 544 if (CHECK(err, "bpf_prog_query", "failed\n")) { 545 log_err("failed to query lookup prog"); 546 goto detach; 547 } 548 549 errno = 0; 550 if (CHECK(attach_flags != 0, "bpf_prog_query", 551 "wrong attach_flags on query: %u", attach_flags)) 552 goto detach; 553 if (CHECK(prog_cnt != 3, "bpf_prog_query", 554 "wrong program count on query: %u", prog_cnt)) 555 goto detach; 556 prog_id = link_info_prog_id(link[0], &info); 557 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 558 "invalid program #0 id on query: %u != %u\n", 559 prog_ids[0], prog_id); 560 CHECK(info.netns.netns_ino == 0, "netns_ino", 561 "unexpected netns_ino: %u\n", info.netns.netns_ino); 562 prog_id = link_info_prog_id(link[1], &info); 563 CHECK(prog_ids[1] != prog_id, "bpf_prog_query", 564 "invalid program #1 id on query: %u != %u\n", 565 prog_ids[1], prog_id); 566 CHECK(info.netns.netns_ino == 0, "netns_ino", 567 "unexpected netns_ino: %u\n", info.netns.netns_ino); 568 prog_id = link_info_prog_id(link[2], &info); 569 CHECK(prog_ids[2] != prog_id, "bpf_prog_query", 570 "invalid program #2 id on query: %u != %u\n", 571 prog_ids[2], prog_id); 572 CHECK(info.netns.netns_ino == 0, "netns_ino", 573 "unexpected netns_ino: %u\n", info.netns.netns_ino); 574 575 err = bpf_link__detach(link[0]); 576 if (CHECK(err, "link_detach", "failed %d\n", err)) 577 goto detach; 578 579 /* prog id is still there, but netns_ino is zeroed out */ 580 prog_id = link_info_prog_id(link[0], &info); 581 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 582 "invalid program #0 id on query: %u != %u\n", 583 prog_ids[0], prog_id); 584 CHECK(info.netns.netns_ino != 0, "netns_ino", 585 "unexpected netns_ino: %u\n", info.netns.netns_ino); 586 587detach: 588 if (link[2]) 589 bpf_link__destroy(link[2]); 590 if (link[1]) 591 bpf_link__destroy(link[1]); 592 if (link[0]) 593 bpf_link__destroy(link[0]); 594close: 595 close(net_fd); 596} 597 598static void run_lookup_prog(const struct test *t) 599{ 600 int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 }; 601 int client_fd, reuse_conn_fd = -1; 602 struct bpf_link *lookup_link; 603 int i, err; 604 605 lookup_link = attach_lookup_prog(t->lookup_prog); 606 if (!lookup_link) 607 return; 608 609 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 610 server_fds[i] = make_server(t->sotype, t->listen_at.ip, 611 t->listen_at.port, 612 t->reuseport_prog); 613 if (server_fds[i] < 0) 614 goto close; 615 616 err = update_lookup_map(t->sock_map, i, server_fds[i]); 617 if (err) 618 goto close; 619 620 /* want just one server for non-reuseport test */ 621 if (!t->reuseport_prog) 622 break; 623 } 624 625 /* Regular UDP socket lookup with reuseport behaves 626 * differently when reuseport group contains connected 627 * sockets. Check that adding a connected UDP socket to the 628 * reuseport group does not affect how reuseport works with 629 * BPF socket lookup. 630 */ 631 if (t->reuseport_has_conns) { 632 struct sockaddr_storage addr = {}; 633 socklen_t len = sizeof(addr); 634 635 /* Add an extra socket to reuseport group */ 636 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip, 637 t->listen_at.port, 638 t->reuseport_prog); 639 if (reuse_conn_fd < 0) 640 goto close; 641 642 /* Connect the extra socket to itself */ 643 err = getsockname(reuse_conn_fd, (void *)&addr, &len); 644 if (CHECK(err, "getsockname", "errno %d\n", errno)) 645 goto close; 646 err = connect(reuse_conn_fd, (void *)&addr, len); 647 if (CHECK(err, "connect", "errno %d\n", errno)) 648 goto close; 649 } 650 651 client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port); 652 if (client_fd < 0) 653 goto close; 654 655 if (t->sotype == SOCK_STREAM) 656 tcp_echo_test(client_fd, server_fds[t->accept_on]); 657 else 658 udp_echo_test(client_fd, server_fds[t->accept_on]); 659 660 close(client_fd); 661close: 662 if (reuse_conn_fd != -1) 663 close(reuse_conn_fd); 664 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 665 if (server_fds[i] != -1) 666 close(server_fds[i]); 667 } 668 bpf_link__destroy(lookup_link); 669} 670 671static void test_redirect_lookup(struct test_sk_lookup *skel) 672{ 673 const struct test tests[] = { 674 { 675 .desc = "TCP IPv4 redir port", 676 .lookup_prog = skel->progs.redir_port, 677 .sock_map = skel->maps.redir_map, 678 .sotype = SOCK_STREAM, 679 .connect_to = { EXT_IP4, EXT_PORT }, 680 .listen_at = { EXT_IP4, INT_PORT }, 681 }, 682 { 683 .desc = "TCP IPv4 redir addr", 684 .lookup_prog = skel->progs.redir_ip4, 685 .sock_map = skel->maps.redir_map, 686 .sotype = SOCK_STREAM, 687 .connect_to = { EXT_IP4, EXT_PORT }, 688 .listen_at = { INT_IP4, EXT_PORT }, 689 }, 690 { 691 .desc = "TCP IPv4 redir with reuseport", 692 .lookup_prog = skel->progs.select_sock_a, 693 .reuseport_prog = skel->progs.select_sock_b, 694 .sock_map = skel->maps.redir_map, 695 .sotype = SOCK_STREAM, 696 .connect_to = { EXT_IP4, EXT_PORT }, 697 .listen_at = { INT_IP4, INT_PORT }, 698 .accept_on = SERVER_B, 699 }, 700 { 701 .desc = "TCP IPv4 redir skip reuseport", 702 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 703 .reuseport_prog = skel->progs.select_sock_b, 704 .sock_map = skel->maps.redir_map, 705 .sotype = SOCK_STREAM, 706 .connect_to = { EXT_IP4, EXT_PORT }, 707 .listen_at = { INT_IP4, INT_PORT }, 708 .accept_on = SERVER_A, 709 }, 710 { 711 .desc = "TCP IPv6 redir port", 712 .lookup_prog = skel->progs.redir_port, 713 .sock_map = skel->maps.redir_map, 714 .sotype = SOCK_STREAM, 715 .connect_to = { EXT_IP6, EXT_PORT }, 716 .listen_at = { EXT_IP6, INT_PORT }, 717 }, 718 { 719 .desc = "TCP IPv6 redir addr", 720 .lookup_prog = skel->progs.redir_ip6, 721 .sock_map = skel->maps.redir_map, 722 .sotype = SOCK_STREAM, 723 .connect_to = { EXT_IP6, EXT_PORT }, 724 .listen_at = { INT_IP6, EXT_PORT }, 725 }, 726 { 727 .desc = "TCP IPv4->IPv6 redir port", 728 .lookup_prog = skel->progs.redir_port, 729 .sock_map = skel->maps.redir_map, 730 .sotype = SOCK_STREAM, 731 .connect_to = { EXT_IP4, EXT_PORT }, 732 .listen_at = { INT_IP4_V6, INT_PORT }, 733 }, 734 { 735 .desc = "TCP IPv6 redir with reuseport", 736 .lookup_prog = skel->progs.select_sock_a, 737 .reuseport_prog = skel->progs.select_sock_b, 738 .sock_map = skel->maps.redir_map, 739 .sotype = SOCK_STREAM, 740 .connect_to = { EXT_IP6, EXT_PORT }, 741 .listen_at = { INT_IP6, INT_PORT }, 742 .accept_on = SERVER_B, 743 }, 744 { 745 .desc = "TCP IPv6 redir skip reuseport", 746 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 747 .reuseport_prog = skel->progs.select_sock_b, 748 .sock_map = skel->maps.redir_map, 749 .sotype = SOCK_STREAM, 750 .connect_to = { EXT_IP6, EXT_PORT }, 751 .listen_at = { INT_IP6, INT_PORT }, 752 .accept_on = SERVER_A, 753 }, 754 { 755 .desc = "UDP IPv4 redir port", 756 .lookup_prog = skel->progs.redir_port, 757 .sock_map = skel->maps.redir_map, 758 .sotype = SOCK_DGRAM, 759 .connect_to = { EXT_IP4, EXT_PORT }, 760 .listen_at = { EXT_IP4, INT_PORT }, 761 }, 762 { 763 .desc = "UDP IPv4 redir addr", 764 .lookup_prog = skel->progs.redir_ip4, 765 .sock_map = skel->maps.redir_map, 766 .sotype = SOCK_DGRAM, 767 .connect_to = { EXT_IP4, EXT_PORT }, 768 .listen_at = { INT_IP4, EXT_PORT }, 769 }, 770 { 771 .desc = "UDP IPv4 redir with reuseport", 772 .lookup_prog = skel->progs.select_sock_a, 773 .reuseport_prog = skel->progs.select_sock_b, 774 .sock_map = skel->maps.redir_map, 775 .sotype = SOCK_DGRAM, 776 .connect_to = { EXT_IP4, EXT_PORT }, 777 .listen_at = { INT_IP4, INT_PORT }, 778 .accept_on = SERVER_B, 779 }, 780 { 781 .desc = "UDP IPv4 redir and reuseport with conns", 782 .lookup_prog = skel->progs.select_sock_a, 783 .reuseport_prog = skel->progs.select_sock_b, 784 .sock_map = skel->maps.redir_map, 785 .sotype = SOCK_DGRAM, 786 .connect_to = { EXT_IP4, EXT_PORT }, 787 .listen_at = { INT_IP4, INT_PORT }, 788 .accept_on = SERVER_B, 789 .reuseport_has_conns = true, 790 }, 791 { 792 .desc = "UDP IPv4 redir skip reuseport", 793 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 794 .reuseport_prog = skel->progs.select_sock_b, 795 .sock_map = skel->maps.redir_map, 796 .sotype = SOCK_DGRAM, 797 .connect_to = { EXT_IP4, EXT_PORT }, 798 .listen_at = { INT_IP4, INT_PORT }, 799 .accept_on = SERVER_A, 800 }, 801 { 802 .desc = "UDP IPv6 redir port", 803 .lookup_prog = skel->progs.redir_port, 804 .sock_map = skel->maps.redir_map, 805 .sotype = SOCK_DGRAM, 806 .connect_to = { EXT_IP6, EXT_PORT }, 807 .listen_at = { EXT_IP6, INT_PORT }, 808 }, 809 { 810 .desc = "UDP IPv6 redir addr", 811 .lookup_prog = skel->progs.redir_ip6, 812 .sock_map = skel->maps.redir_map, 813 .sotype = SOCK_DGRAM, 814 .connect_to = { EXT_IP6, EXT_PORT }, 815 .listen_at = { INT_IP6, EXT_PORT }, 816 }, 817 { 818 .desc = "UDP IPv4->IPv6 redir port", 819 .lookup_prog = skel->progs.redir_port, 820 .sock_map = skel->maps.redir_map, 821 .sotype = SOCK_DGRAM, 822 .listen_at = { INT_IP4_V6, INT_PORT }, 823 .connect_to = { EXT_IP4, EXT_PORT }, 824 }, 825 { 826 .desc = "UDP IPv6 redir and reuseport", 827 .lookup_prog = skel->progs.select_sock_a, 828 .reuseport_prog = skel->progs.select_sock_b, 829 .sock_map = skel->maps.redir_map, 830 .sotype = SOCK_DGRAM, 831 .connect_to = { EXT_IP6, EXT_PORT }, 832 .listen_at = { INT_IP6, INT_PORT }, 833 .accept_on = SERVER_B, 834 }, 835 { 836 .desc = "UDP IPv6 redir and reuseport with conns", 837 .lookup_prog = skel->progs.select_sock_a, 838 .reuseport_prog = skel->progs.select_sock_b, 839 .sock_map = skel->maps.redir_map, 840 .sotype = SOCK_DGRAM, 841 .connect_to = { EXT_IP6, EXT_PORT }, 842 .listen_at = { INT_IP6, INT_PORT }, 843 .accept_on = SERVER_B, 844 .reuseport_has_conns = true, 845 }, 846 { 847 .desc = "UDP IPv6 redir skip reuseport", 848 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 849 .reuseport_prog = skel->progs.select_sock_b, 850 .sock_map = skel->maps.redir_map, 851 .sotype = SOCK_DGRAM, 852 .connect_to = { EXT_IP6, EXT_PORT }, 853 .listen_at = { INT_IP6, INT_PORT }, 854 .accept_on = SERVER_A, 855 }, 856 }; 857 const struct test *t; 858 859 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 860 if (test__start_subtest(t->desc)) 861 run_lookup_prog(t); 862 } 863} 864 865static void drop_on_lookup(const struct test *t) 866{ 867 struct sockaddr_storage dst = {}; 868 int client_fd, server_fd, err; 869 struct bpf_link *lookup_link; 870 ssize_t n; 871 872 lookup_link = attach_lookup_prog(t->lookup_prog); 873 if (!lookup_link) 874 return; 875 876 server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 877 t->reuseport_prog); 878 if (server_fd < 0) 879 goto detach; 880 881 client_fd = make_socket(t->sotype, t->connect_to.ip, 882 t->connect_to.port, &dst); 883 if (client_fd < 0) 884 goto close_srv; 885 886 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 887 if (t->sotype == SOCK_DGRAM) { 888 err = send_byte(client_fd); 889 if (err) 890 goto close_all; 891 892 /* Read out asynchronous error */ 893 n = recv(client_fd, NULL, 0, 0); 894 err = n == -1; 895 } 896 if (CHECK(!err || errno != ECONNREFUSED, "connect", 897 "unexpected success or error\n")) 898 log_err("expected ECONNREFUSED on connect"); 899 900close_all: 901 close(client_fd); 902close_srv: 903 close(server_fd); 904detach: 905 bpf_link__destroy(lookup_link); 906} 907 908static void test_drop_on_lookup(struct test_sk_lookup *skel) 909{ 910 const struct test tests[] = { 911 { 912 .desc = "TCP IPv4 drop on lookup", 913 .lookup_prog = skel->progs.lookup_drop, 914 .sotype = SOCK_STREAM, 915 .connect_to = { EXT_IP4, EXT_PORT }, 916 .listen_at = { EXT_IP4, EXT_PORT }, 917 }, 918 { 919 .desc = "TCP IPv6 drop on lookup", 920 .lookup_prog = skel->progs.lookup_drop, 921 .sotype = SOCK_STREAM, 922 .connect_to = { EXT_IP6, EXT_PORT }, 923 .listen_at = { EXT_IP6, EXT_PORT }, 924 }, 925 { 926 .desc = "UDP IPv4 drop on lookup", 927 .lookup_prog = skel->progs.lookup_drop, 928 .sotype = SOCK_DGRAM, 929 .connect_to = { EXT_IP4, EXT_PORT }, 930 .listen_at = { EXT_IP4, EXT_PORT }, 931 }, 932 { 933 .desc = "UDP IPv6 drop on lookup", 934 .lookup_prog = skel->progs.lookup_drop, 935 .sotype = SOCK_DGRAM, 936 .connect_to = { EXT_IP6, EXT_PORT }, 937 .listen_at = { EXT_IP6, INT_PORT }, 938 }, 939 /* The program will drop on success, meaning that the ifindex 940 * was 1. 941 */ 942 { 943 .desc = "TCP IPv4 drop on valid ifindex", 944 .lookup_prog = skel->progs.check_ifindex, 945 .sotype = SOCK_STREAM, 946 .connect_to = { EXT_IP4, EXT_PORT }, 947 .listen_at = { EXT_IP4, EXT_PORT }, 948 }, 949 { 950 .desc = "TCP IPv6 drop on valid ifindex", 951 .lookup_prog = skel->progs.check_ifindex, 952 .sotype = SOCK_STREAM, 953 .connect_to = { EXT_IP6, EXT_PORT }, 954 .listen_at = { EXT_IP6, EXT_PORT }, 955 }, 956 { 957 .desc = "UDP IPv4 drop on valid ifindex", 958 .lookup_prog = skel->progs.check_ifindex, 959 .sotype = SOCK_DGRAM, 960 .connect_to = { EXT_IP4, EXT_PORT }, 961 .listen_at = { EXT_IP4, EXT_PORT }, 962 }, 963 { 964 .desc = "UDP IPv6 drop on valid ifindex", 965 .lookup_prog = skel->progs.check_ifindex, 966 .sotype = SOCK_DGRAM, 967 .connect_to = { EXT_IP6, EXT_PORT }, 968 .listen_at = { EXT_IP6, EXT_PORT }, 969 }, 970 }; 971 const struct test *t; 972 973 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 974 if (test__start_subtest(t->desc)) 975 drop_on_lookup(t); 976 } 977} 978 979static void drop_on_reuseport(const struct test *t) 980{ 981 struct sockaddr_storage dst = { 0 }; 982 int client, server1, server2, err; 983 struct bpf_link *lookup_link; 984 ssize_t n; 985 986 lookup_link = attach_lookup_prog(t->lookup_prog); 987 if (!lookup_link) 988 return; 989 990 server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 991 t->reuseport_prog); 992 if (server1 < 0) 993 goto detach; 994 995 err = update_lookup_map(t->sock_map, SERVER_A, server1); 996 if (err) 997 goto detach; 998 999 /* second server on destination address we should never reach */ 1000 server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port, 1001 NULL /* reuseport prog */); 1002 if (server2 < 0) 1003 goto close_srv1; 1004 1005 client = make_socket(t->sotype, t->connect_to.ip, 1006 t->connect_to.port, &dst); 1007 if (client < 0) 1008 goto close_srv2; 1009 1010 err = connect(client, (void *)&dst, inetaddr_len(&dst)); 1011 if (t->sotype == SOCK_DGRAM) { 1012 err = send_byte(client); 1013 if (err) 1014 goto close_all; 1015 1016 /* Read out asynchronous error */ 1017 n = recv(client, NULL, 0, 0); 1018 err = n == -1; 1019 } 1020 if (CHECK(!err || errno != ECONNREFUSED, "connect", 1021 "unexpected success or error\n")) 1022 log_err("expected ECONNREFUSED on connect"); 1023 1024close_all: 1025 close(client); 1026close_srv2: 1027 close(server2); 1028close_srv1: 1029 close(server1); 1030detach: 1031 bpf_link__destroy(lookup_link); 1032} 1033 1034static void test_drop_on_reuseport(struct test_sk_lookup *skel) 1035{ 1036 const struct test tests[] = { 1037 { 1038 .desc = "TCP IPv4 drop on reuseport", 1039 .lookup_prog = skel->progs.select_sock_a, 1040 .reuseport_prog = skel->progs.reuseport_drop, 1041 .sock_map = skel->maps.redir_map, 1042 .sotype = SOCK_STREAM, 1043 .connect_to = { EXT_IP4, EXT_PORT }, 1044 .listen_at = { INT_IP4, INT_PORT }, 1045 }, 1046 { 1047 .desc = "TCP IPv6 drop on reuseport", 1048 .lookup_prog = skel->progs.select_sock_a, 1049 .reuseport_prog = skel->progs.reuseport_drop, 1050 .sock_map = skel->maps.redir_map, 1051 .sotype = SOCK_STREAM, 1052 .connect_to = { EXT_IP6, EXT_PORT }, 1053 .listen_at = { INT_IP6, INT_PORT }, 1054 }, 1055 { 1056 .desc = "UDP IPv4 drop on reuseport", 1057 .lookup_prog = skel->progs.select_sock_a, 1058 .reuseport_prog = skel->progs.reuseport_drop, 1059 .sock_map = skel->maps.redir_map, 1060 .sotype = SOCK_DGRAM, 1061 .connect_to = { EXT_IP4, EXT_PORT }, 1062 .listen_at = { INT_IP4, INT_PORT }, 1063 }, 1064 { 1065 .desc = "TCP IPv6 drop on reuseport", 1066 .lookup_prog = skel->progs.select_sock_a, 1067 .reuseport_prog = skel->progs.reuseport_drop, 1068 .sock_map = skel->maps.redir_map, 1069 .sotype = SOCK_STREAM, 1070 .connect_to = { EXT_IP6, EXT_PORT }, 1071 .listen_at = { INT_IP6, INT_PORT }, 1072 }, 1073 }; 1074 const struct test *t; 1075 1076 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1077 if (test__start_subtest(t->desc)) 1078 drop_on_reuseport(t); 1079 } 1080} 1081 1082static void run_sk_assign(struct test_sk_lookup *skel, 1083 struct bpf_program *lookup_prog, 1084 const char *remote_ip, const char *local_ip) 1085{ 1086 int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 }; 1087 struct bpf_sk_lookup ctx; 1088 __u64 server_cookie; 1089 int i, err; 1090 1091 DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts, 1092 .ctx_in = &ctx, 1093 .ctx_size_in = sizeof(ctx), 1094 .ctx_out = &ctx, 1095 .ctx_size_out = sizeof(ctx), 1096 ); 1097 1098 if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT)) 1099 return; 1100 1101 ctx.protocol = IPPROTO_TCP; 1102 1103 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1104 server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL); 1105 if (server_fds[i] < 0) 1106 goto close_servers; 1107 1108 err = update_lookup_map(skel->maps.redir_map, i, 1109 server_fds[i]); 1110 if (err) 1111 goto close_servers; 1112 } 1113 1114 server_cookie = socket_cookie(server_fds[SERVER_B]); 1115 if (!server_cookie) 1116 return; 1117 1118 err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts); 1119 if (CHECK(err, "test_run", "failed with error %d\n", errno)) 1120 goto close_servers; 1121 1122 if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n")) 1123 goto close_servers; 1124 1125 CHECK(ctx.cookie != server_cookie, "ctx.cookie", 1126 "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie); 1127 1128close_servers: 1129 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1130 if (server_fds[i] != -1) 1131 close(server_fds[i]); 1132 } 1133} 1134 1135static void run_sk_assign_v4(struct test_sk_lookup *skel, 1136 struct bpf_program *lookup_prog) 1137{ 1138 run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4); 1139} 1140 1141static void run_sk_assign_v6(struct test_sk_lookup *skel, 1142 struct bpf_program *lookup_prog) 1143{ 1144 run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6); 1145} 1146 1147static void run_sk_assign_connected(struct test_sk_lookup *skel, 1148 int sotype) 1149{ 1150 int err, client_fd, connected_fd, server_fd; 1151 struct bpf_link *lookup_link; 1152 1153 server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL); 1154 if (server_fd < 0) 1155 return; 1156 1157 connected_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1158 if (connected_fd < 0) 1159 goto out_close_server; 1160 1161 /* Put a connected socket in redirect map */ 1162 err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd); 1163 if (err) 1164 goto out_close_connected; 1165 1166 lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport); 1167 if (!lookup_link) 1168 goto out_close_connected; 1169 1170 /* Try to redirect TCP SYN / UDP packet to a connected socket */ 1171 client_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1172 if (client_fd < 0) 1173 goto out_unlink_prog; 1174 if (sotype == SOCK_DGRAM) { 1175 send_byte(client_fd); 1176 recv_byte(server_fd); 1177 } 1178 1179 close(client_fd); 1180out_unlink_prog: 1181 bpf_link__destroy(lookup_link); 1182out_close_connected: 1183 close(connected_fd); 1184out_close_server: 1185 close(server_fd); 1186} 1187 1188static void test_sk_assign_helper(struct test_sk_lookup *skel) 1189{ 1190 if (test__start_subtest("sk_assign returns EEXIST")) 1191 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist); 1192 if (test__start_subtest("sk_assign honors F_REPLACE")) 1193 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag); 1194 if (test__start_subtest("sk_assign accepts NULL socket")) 1195 run_sk_assign_v4(skel, skel->progs.sk_assign_null); 1196 if (test__start_subtest("access ctx->sk")) 1197 run_sk_assign_v4(skel, skel->progs.access_ctx_sk); 1198 if (test__start_subtest("narrow access to ctx v4")) 1199 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access); 1200 if (test__start_subtest("narrow access to ctx v6")) 1201 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access); 1202 if (test__start_subtest("sk_assign rejects TCP established")) 1203 run_sk_assign_connected(skel, SOCK_STREAM); 1204 if (test__start_subtest("sk_assign rejects UDP connected")) 1205 run_sk_assign_connected(skel, SOCK_DGRAM); 1206} 1207 1208struct test_multi_prog { 1209 const char *desc; 1210 struct bpf_program *prog1; 1211 struct bpf_program *prog2; 1212 struct bpf_map *redir_map; 1213 struct bpf_map *run_map; 1214 int expect_errno; 1215 struct inet_addr listen_at; 1216}; 1217 1218static void run_multi_prog_lookup(const struct test_multi_prog *t) 1219{ 1220 struct sockaddr_storage dst = {}; 1221 int map_fd, server_fd, client_fd; 1222 struct bpf_link *link1, *link2; 1223 int prog_idx, done, err; 1224 1225 map_fd = bpf_map__fd(t->run_map); 1226 1227 done = 0; 1228 prog_idx = PROG1; 1229 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1230 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1231 return; 1232 prog_idx = PROG2; 1233 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1234 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1235 return; 1236 1237 link1 = attach_lookup_prog(t->prog1); 1238 if (!link1) 1239 return; 1240 link2 = attach_lookup_prog(t->prog2); 1241 if (!link2) 1242 goto out_unlink1; 1243 1244 server_fd = make_server(SOCK_STREAM, t->listen_at.ip, 1245 t->listen_at.port, NULL); 1246 if (server_fd < 0) 1247 goto out_unlink2; 1248 1249 err = update_lookup_map(t->redir_map, SERVER_A, server_fd); 1250 if (err) 1251 goto out_close_server; 1252 1253 client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst); 1254 if (client_fd < 0) 1255 goto out_close_server; 1256 1257 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 1258 if (CHECK(err && !t->expect_errno, "connect", 1259 "unexpected error %d\n", errno)) 1260 goto out_close_client; 1261 if (CHECK(err && t->expect_errno && errno != t->expect_errno, 1262 "connect", "unexpected error %d\n", errno)) 1263 goto out_close_client; 1264 1265 done = 0; 1266 prog_idx = PROG1; 1267 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1268 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1269 CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n"); 1270 1271 done = 0; 1272 prog_idx = PROG2; 1273 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1274 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1275 CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n"); 1276 1277out_close_client: 1278 close(client_fd); 1279out_close_server: 1280 close(server_fd); 1281out_unlink2: 1282 bpf_link__destroy(link2); 1283out_unlink1: 1284 bpf_link__destroy(link1); 1285} 1286 1287static void test_multi_prog_lookup(struct test_sk_lookup *skel) 1288{ 1289 struct test_multi_prog tests[] = { 1290 { 1291 .desc = "multi prog - pass, pass", 1292 .prog1 = skel->progs.multi_prog_pass1, 1293 .prog2 = skel->progs.multi_prog_pass2, 1294 .listen_at = { EXT_IP4, EXT_PORT }, 1295 }, 1296 { 1297 .desc = "multi prog - drop, drop", 1298 .prog1 = skel->progs.multi_prog_drop1, 1299 .prog2 = skel->progs.multi_prog_drop2, 1300 .listen_at = { EXT_IP4, EXT_PORT }, 1301 .expect_errno = ECONNREFUSED, 1302 }, 1303 { 1304 .desc = "multi prog - pass, drop", 1305 .prog1 = skel->progs.multi_prog_pass1, 1306 .prog2 = skel->progs.multi_prog_drop2, 1307 .listen_at = { EXT_IP4, EXT_PORT }, 1308 .expect_errno = ECONNREFUSED, 1309 }, 1310 { 1311 .desc = "multi prog - drop, pass", 1312 .prog1 = skel->progs.multi_prog_drop1, 1313 .prog2 = skel->progs.multi_prog_pass2, 1314 .listen_at = { EXT_IP4, EXT_PORT }, 1315 .expect_errno = ECONNREFUSED, 1316 }, 1317 { 1318 .desc = "multi prog - pass, redir", 1319 .prog1 = skel->progs.multi_prog_pass1, 1320 .prog2 = skel->progs.multi_prog_redir2, 1321 .listen_at = { INT_IP4, INT_PORT }, 1322 }, 1323 { 1324 .desc = "multi prog - redir, pass", 1325 .prog1 = skel->progs.multi_prog_redir1, 1326 .prog2 = skel->progs.multi_prog_pass2, 1327 .listen_at = { INT_IP4, INT_PORT }, 1328 }, 1329 { 1330 .desc = "multi prog - drop, redir", 1331 .prog1 = skel->progs.multi_prog_drop1, 1332 .prog2 = skel->progs.multi_prog_redir2, 1333 .listen_at = { INT_IP4, INT_PORT }, 1334 }, 1335 { 1336 .desc = "multi prog - redir, drop", 1337 .prog1 = skel->progs.multi_prog_redir1, 1338 .prog2 = skel->progs.multi_prog_drop2, 1339 .listen_at = { INT_IP4, INT_PORT }, 1340 }, 1341 { 1342 .desc = "multi prog - redir, redir", 1343 .prog1 = skel->progs.multi_prog_redir1, 1344 .prog2 = skel->progs.multi_prog_redir2, 1345 .listen_at = { INT_IP4, INT_PORT }, 1346 }, 1347 }; 1348 struct test_multi_prog *t; 1349 1350 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1351 t->redir_map = skel->maps.redir_map; 1352 t->run_map = skel->maps.run_map; 1353 if (test__start_subtest(t->desc)) 1354 run_multi_prog_lookup(t); 1355 } 1356} 1357 1358static void run_tests(struct test_sk_lookup *skel) 1359{ 1360 if (test__start_subtest("query lookup prog")) 1361 query_lookup_prog(skel); 1362 test_redirect_lookup(skel); 1363 test_drop_on_lookup(skel); 1364 test_drop_on_reuseport(skel); 1365 test_sk_assign_helper(skel); 1366 test_multi_prog_lookup(skel); 1367} 1368 1369static int switch_netns(void) 1370{ 1371 static const char * const setup_script[] = { 1372 "ip -6 addr add dev lo " EXT_IP6 "/128", 1373 "ip -6 addr add dev lo " INT_IP6 "/128", 1374 "ip link set dev lo up", 1375 NULL, 1376 }; 1377 const char * const *cmd; 1378 int err; 1379 1380 err = unshare(CLONE_NEWNET); 1381 if (CHECK(err, "unshare", "failed\n")) { 1382 log_err("unshare(CLONE_NEWNET)"); 1383 return -1; 1384 } 1385 1386 for (cmd = setup_script; *cmd; cmd++) { 1387 err = system(*cmd); 1388 if (CHECK(err, "system", "failed\n")) { 1389 log_err("system(%s)", *cmd); 1390 return -1; 1391 } 1392 } 1393 1394 return 0; 1395} 1396 1397void test_sk_lookup(void) 1398{ 1399 struct test_sk_lookup *skel; 1400 int err; 1401 1402 err = switch_netns(); 1403 if (err) 1404 return; 1405 1406 skel = test_sk_lookup__open_and_load(); 1407 if (CHECK(!skel, "skel open_and_load", "failed\n")) 1408 return; 1409 1410 run_tests(skel); 1411 1412 test_sk_lookup__destroy(skel); 1413} 1414