1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 // Copyright (c) 2020 Cloudflare 3 /* 4 * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP). 5 * 6 * Tests exercise: 7 * - attaching/detaching/querying programs to BPF_SK_LOOKUP hook, 8 * - redirecting socket lookup to a socket selected by BPF program, 9 * - failing a socket lookup on BPF program's request, 10 * - error scenarios for selecting a socket from BPF program, 11 * - accessing BPF program context, 12 * - attaching and running multiple BPF programs. 13 * 14 * Tests run in a dedicated network namespace. 15 */ 16 17 #define _GNU_SOURCE 18 #include <arpa/inet.h> 19 #include <assert.h> 20 #include <errno.h> 21 #include <error.h> 22 #include <fcntl.h> 23 #include <sched.h> 24 #include <stdio.h> 25 #include <sys/types.h> 26 #include <sys/stat.h> 27 #include <unistd.h> 28 29 #include <bpf/libbpf.h> 30 #include <bpf/bpf.h> 31 32 #include "test_progs.h" 33 #include "bpf_rlimit.h" 34 #include "bpf_util.h" 35 #include "cgroup_helpers.h" 36 #include "network_helpers.h" 37 #include "testing_helpers.h" 38 #include "test_sk_lookup.skel.h" 39 40 /* External (address, port) pairs the client sends packets to. */ 41 #define EXT_IP4 "127.0.0.1" 42 #define EXT_IP6 "fd00::1" 43 #define EXT_PORT 7007 44 45 /* Internal (address, port) pairs the server listens/receives at. */ 46 #define INT_IP4 "127.0.0.2" 47 #define INT_IP4_V6 "::ffff:127.0.0.2" 48 #define INT_IP6 "fd00::2" 49 #define INT_PORT 8008 50 51 #define IO_TIMEOUT_SEC 3 52 53 enum server { 54 SERVER_A = 0, 55 SERVER_B = 1, 56 MAX_SERVERS, 57 }; 58 59 enum { 60 PROG1 = 0, 61 PROG2, 62 }; 63 64 struct inet_addr { 65 const char *ip; 66 unsigned short port; 67 }; 68 69 struct test { 70 const char *desc; 71 struct bpf_program *lookup_prog; 72 struct bpf_program *reuseport_prog; 73 struct bpf_map *sock_map; 74 int sotype; 75 struct inet_addr connect_to; 76 struct inet_addr listen_at; 77 enum server accept_on; 78 bool reuseport_has_conns; /* Add a connected socket to reuseport group */ 79 }; 80 81 static __u32 duration; /* for CHECK macro */ 82 83 static bool is_ipv6(const char *ip) 84 { 85 return !!strchr(ip, ':'); 86 } 87 88 static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog) 89 { 90 int err, prog_fd; 91 92 prog_fd = bpf_program__fd(reuseport_prog); 93 if (prog_fd < 0) { 94 errno = -prog_fd; 95 return -1; 96 } 97 98 err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF, 99 &prog_fd, sizeof(prog_fd)); 100 if (err) 101 return -1; 102 103 return 0; 104 } 105 106 static socklen_t inetaddr_len(const struct sockaddr_storage *addr) 107 { 108 return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) : 109 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0); 110 } 111 112 static int make_socket(int sotype, const char *ip, int port, 113 struct sockaddr_storage *addr) 114 { 115 struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC }; 116 int err, family, fd; 117 118 family = is_ipv6(ip) ? AF_INET6 : AF_INET; 119 err = make_sockaddr(family, ip, port, addr, NULL); 120 if (CHECK(err, "make_address", "failed\n")) 121 return -1; 122 123 fd = socket(addr->ss_family, sotype, 0); 124 if (CHECK(fd < 0, "socket", "failed\n")) { 125 log_err("failed to make socket"); 126 return -1; 127 } 128 129 err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo)); 130 if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) { 131 log_err("failed to set SNDTIMEO"); 132 close(fd); 133 return -1; 134 } 135 136 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo)); 137 if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) { 138 log_err("failed to set RCVTIMEO"); 139 close(fd); 140 return -1; 141 } 142 143 return fd; 144 } 145 146 static int make_server(int sotype, const char *ip, int port, 147 struct bpf_program *reuseport_prog) 148 { 149 struct sockaddr_storage addr = {0}; 150 const int one = 1; 151 int err, fd = -1; 152 153 fd = make_socket(sotype, ip, port, &addr); 154 if (fd < 0) 155 return -1; 156 157 /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */ 158 if (sotype == SOCK_DGRAM) { 159 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one, 160 sizeof(one)); 161 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) { 162 log_err("failed to enable IP_RECVORIGDSTADDR"); 163 goto fail; 164 } 165 } 166 167 if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) { 168 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one, 169 sizeof(one)); 170 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) { 171 log_err("failed to enable IPV6_RECVORIGDSTADDR"); 172 goto fail; 173 } 174 } 175 176 if (sotype == SOCK_STREAM) { 177 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, 178 sizeof(one)); 179 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) { 180 log_err("failed to enable SO_REUSEADDR"); 181 goto fail; 182 } 183 } 184 185 if (reuseport_prog) { 186 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, 187 sizeof(one)); 188 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) { 189 log_err("failed to enable SO_REUSEPORT"); 190 goto fail; 191 } 192 } 193 194 err = bind(fd, (void *)&addr, inetaddr_len(&addr)); 195 if (CHECK(err, "bind", "failed\n")) { 196 log_err("failed to bind listen socket"); 197 goto fail; 198 } 199 200 if (sotype == SOCK_STREAM) { 201 err = listen(fd, SOMAXCONN); 202 if (CHECK(err, "make_server", "listen")) { 203 log_err("failed to listen on port %d", port); 204 goto fail; 205 } 206 } 207 208 /* Late attach reuseport prog so we can have one init path */ 209 if (reuseport_prog) { 210 err = attach_reuseport(fd, reuseport_prog); 211 if (CHECK(err, "attach_reuseport", "failed\n")) { 212 log_err("failed to attach reuseport prog"); 213 goto fail; 214 } 215 } 216 217 return fd; 218 fail: 219 close(fd); 220 return -1; 221 } 222 223 static int make_client(int sotype, const char *ip, int port) 224 { 225 struct sockaddr_storage addr = {0}; 226 int err, fd; 227 228 fd = make_socket(sotype, ip, port, &addr); 229 if (fd < 0) 230 return -1; 231 232 err = connect(fd, (void *)&addr, inetaddr_len(&addr)); 233 if (CHECK(err, "make_client", "connect")) { 234 log_err("failed to connect client socket"); 235 goto fail; 236 } 237 238 return fd; 239 fail: 240 close(fd); 241 return -1; 242 } 243 244 static __u64 socket_cookie(int fd) 245 { 246 __u64 cookie; 247 socklen_t cookie_len = sizeof(cookie); 248 249 if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0, 250 "getsockopt(SO_COOKIE)", "%s\n", strerror(errno))) 251 return 0; 252 return cookie; 253 } 254 255 static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port, 256 const char *remote_ip, __u16 remote_port) 257 { 258 void *local, *remote; 259 int err; 260 261 memset(ctx, 0, sizeof(*ctx)); 262 ctx->local_port = local_port; 263 ctx->remote_port = htons(remote_port); 264 265 if (is_ipv6(local_ip)) { 266 ctx->family = AF_INET6; 267 local = &ctx->local_ip6[0]; 268 remote = &ctx->remote_ip6[0]; 269 } else { 270 ctx->family = AF_INET; 271 local = &ctx->local_ip4; 272 remote = &ctx->remote_ip4; 273 } 274 275 err = inet_pton(ctx->family, local_ip, local); 276 if (CHECK(err != 1, "inet_pton", "local_ip failed\n")) 277 return 1; 278 279 err = inet_pton(ctx->family, remote_ip, remote); 280 if (CHECK(err != 1, "inet_pton", "remote_ip failed\n")) 281 return 1; 282 283 return 0; 284 } 285 286 static int send_byte(int fd) 287 { 288 ssize_t n; 289 290 errno = 0; 291 n = send(fd, "a", 1, 0); 292 if (CHECK(n <= 0, "send_byte", "send")) { 293 log_err("failed/partial send"); 294 return -1; 295 } 296 return 0; 297 } 298 299 static int recv_byte(int fd) 300 { 301 char buf[1]; 302 ssize_t n; 303 304 n = recv(fd, buf, sizeof(buf), 0); 305 if (CHECK(n <= 0, "recv_byte", "recv")) { 306 log_err("failed/partial recv"); 307 return -1; 308 } 309 return 0; 310 } 311 312 static int tcp_recv_send(int server_fd) 313 { 314 char buf[1]; 315 int ret, fd; 316 ssize_t n; 317 318 fd = accept(server_fd, NULL, NULL); 319 if (CHECK(fd < 0, "accept", "failed\n")) { 320 log_err("failed to accept"); 321 return -1; 322 } 323 324 n = recv(fd, buf, sizeof(buf), 0); 325 if (CHECK(n <= 0, "recv", "failed\n")) { 326 log_err("failed/partial recv"); 327 ret = -1; 328 goto close; 329 } 330 331 n = send(fd, buf, n, 0); 332 if (CHECK(n <= 0, "send", "failed\n")) { 333 log_err("failed/partial send"); 334 ret = -1; 335 goto close; 336 } 337 338 ret = 0; 339 close: 340 close(fd); 341 return ret; 342 } 343 344 static void v4_to_v6(struct sockaddr_storage *ss) 345 { 346 struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss; 347 struct sockaddr_in v4 = *(struct sockaddr_in *)ss; 348 349 v6->sin6_family = AF_INET6; 350 v6->sin6_port = v4.sin_port; 351 v6->sin6_addr.s6_addr[10] = 0xff; 352 v6->sin6_addr.s6_addr[11] = 0xff; 353 memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4); 354 memset(&v6->sin6_addr.s6_addr[0], 0, 10); 355 } 356 357 static int udp_recv_send(int server_fd) 358 { 359 char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))]; 360 struct sockaddr_storage _src_addr = { 0 }; 361 struct sockaddr_storage *src_addr = &_src_addr; 362 struct sockaddr_storage *dst_addr = NULL; 363 struct msghdr msg = { 0 }; 364 struct iovec iov = { 0 }; 365 struct cmsghdr *cm; 366 char buf[1]; 367 int ret, fd; 368 ssize_t n; 369 370 iov.iov_base = buf; 371 iov.iov_len = sizeof(buf); 372 373 msg.msg_name = src_addr; 374 msg.msg_namelen = sizeof(*src_addr); 375 msg.msg_iov = &iov; 376 msg.msg_iovlen = 1; 377 msg.msg_control = cmsg_buf; 378 msg.msg_controllen = sizeof(cmsg_buf); 379 380 errno = 0; 381 n = recvmsg(server_fd, &msg, 0); 382 if (CHECK(n <= 0, "recvmsg", "failed\n")) { 383 log_err("failed to receive"); 384 return -1; 385 } 386 if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n")) 387 return -1; 388 389 for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) { 390 if ((cm->cmsg_level == SOL_IP && 391 cm->cmsg_type == IP_ORIGDSTADDR) || 392 (cm->cmsg_level == SOL_IPV6 && 393 cm->cmsg_type == IPV6_ORIGDSTADDR)) { 394 dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm); 395 break; 396 } 397 log_err("warning: ignored cmsg at level %d type %d", 398 cm->cmsg_level, cm->cmsg_type); 399 } 400 if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n")) 401 return -1; 402 403 /* Server socket bound to IPv4-mapped IPv6 address */ 404 if (src_addr->ss_family == AF_INET6 && 405 dst_addr->ss_family == AF_INET) { 406 v4_to_v6(dst_addr); 407 } 408 409 /* Reply from original destination address. */ 410 fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0); 411 if (CHECK(fd < 0, "socket", "failed\n")) { 412 log_err("failed to create tx socket"); 413 return -1; 414 } 415 416 ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr)); 417 if (CHECK(ret, "bind", "failed\n")) { 418 log_err("failed to bind tx socket"); 419 goto out; 420 } 421 422 msg.msg_control = NULL; 423 msg.msg_controllen = 0; 424 n = sendmsg(fd, &msg, 0); 425 if (CHECK(n <= 0, "sendmsg", "failed\n")) { 426 log_err("failed to send echo reply"); 427 ret = -1; 428 goto out; 429 } 430 431 ret = 0; 432 out: 433 close(fd); 434 return ret; 435 } 436 437 static int tcp_echo_test(int client_fd, int server_fd) 438 { 439 int err; 440 441 err = send_byte(client_fd); 442 if (err) 443 return -1; 444 err = tcp_recv_send(server_fd); 445 if (err) 446 return -1; 447 err = recv_byte(client_fd); 448 if (err) 449 return -1; 450 451 return 0; 452 } 453 454 static int udp_echo_test(int client_fd, int server_fd) 455 { 456 int err; 457 458 err = send_byte(client_fd); 459 if (err) 460 return -1; 461 err = udp_recv_send(server_fd); 462 if (err) 463 return -1; 464 err = recv_byte(client_fd); 465 if (err) 466 return -1; 467 468 return 0; 469 } 470 471 static struct bpf_link *attach_lookup_prog(struct bpf_program *prog) 472 { 473 struct bpf_link *link; 474 int net_fd; 475 476 net_fd = open("/proc/self/ns/net", O_RDONLY); 477 if (CHECK(net_fd < 0, "open", "failed\n")) { 478 log_err("failed to open /proc/self/ns/net"); 479 return NULL; 480 } 481 482 link = bpf_program__attach_netns(prog, net_fd); 483 if (!ASSERT_OK_PTR(link, "bpf_program__attach_netns")) { 484 errno = -PTR_ERR(link); 485 log_err("failed to attach program '%s' to netns", 486 bpf_program__name(prog)); 487 link = NULL; 488 } 489 490 close(net_fd); 491 return link; 492 } 493 494 static int update_lookup_map(struct bpf_map *map, int index, int sock_fd) 495 { 496 int err, map_fd; 497 uint64_t value; 498 499 map_fd = bpf_map__fd(map); 500 if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) { 501 errno = -map_fd; 502 log_err("failed to get map FD"); 503 return -1; 504 } 505 506 value = (uint64_t)sock_fd; 507 err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST); 508 if (CHECK(err, "bpf_map_update_elem", "failed\n")) { 509 log_err("failed to update redir_map @ %d", index); 510 return -1; 511 } 512 513 return 0; 514 } 515 516 static void query_lookup_prog(struct test_sk_lookup *skel) 517 { 518 struct bpf_link *link[3] = {}; 519 struct bpf_link_info info; 520 __u32 attach_flags = 0; 521 __u32 prog_ids[3] = {}; 522 __u32 prog_cnt = 3; 523 __u32 prog_id; 524 int net_fd; 525 int err; 526 527 net_fd = open("/proc/self/ns/net", O_RDONLY); 528 if (CHECK(net_fd < 0, "open", "failed\n")) { 529 log_err("failed to open /proc/self/ns/net"); 530 return; 531 } 532 533 link[0] = attach_lookup_prog(skel->progs.lookup_pass); 534 if (!link[0]) 535 goto close; 536 link[1] = attach_lookup_prog(skel->progs.lookup_pass); 537 if (!link[1]) 538 goto detach; 539 link[2] = attach_lookup_prog(skel->progs.lookup_drop); 540 if (!link[2]) 541 goto detach; 542 543 err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */, 544 &attach_flags, prog_ids, &prog_cnt); 545 if (CHECK(err, "bpf_prog_query", "failed\n")) { 546 log_err("failed to query lookup prog"); 547 goto detach; 548 } 549 550 errno = 0; 551 if (CHECK(attach_flags != 0, "bpf_prog_query", 552 "wrong attach_flags on query: %u", attach_flags)) 553 goto detach; 554 if (CHECK(prog_cnt != 3, "bpf_prog_query", 555 "wrong program count on query: %u", prog_cnt)) 556 goto detach; 557 prog_id = link_info_prog_id(link[0], &info); 558 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 559 "invalid program #0 id on query: %u != %u\n", 560 prog_ids[0], prog_id); 561 CHECK(info.netns.netns_ino == 0, "netns_ino", 562 "unexpected netns_ino: %u\n", info.netns.netns_ino); 563 prog_id = link_info_prog_id(link[1], &info); 564 CHECK(prog_ids[1] != prog_id, "bpf_prog_query", 565 "invalid program #1 id on query: %u != %u\n", 566 prog_ids[1], prog_id); 567 CHECK(info.netns.netns_ino == 0, "netns_ino", 568 "unexpected netns_ino: %u\n", info.netns.netns_ino); 569 prog_id = link_info_prog_id(link[2], &info); 570 CHECK(prog_ids[2] != prog_id, "bpf_prog_query", 571 "invalid program #2 id on query: %u != %u\n", 572 prog_ids[2], prog_id); 573 CHECK(info.netns.netns_ino == 0, "netns_ino", 574 "unexpected netns_ino: %u\n", info.netns.netns_ino); 575 576 err = bpf_link__detach(link[0]); 577 if (CHECK(err, "link_detach", "failed %d\n", err)) 578 goto detach; 579 580 /* prog id is still there, but netns_ino is zeroed out */ 581 prog_id = link_info_prog_id(link[0], &info); 582 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 583 "invalid program #0 id on query: %u != %u\n", 584 prog_ids[0], prog_id); 585 CHECK(info.netns.netns_ino != 0, "netns_ino", 586 "unexpected netns_ino: %u\n", info.netns.netns_ino); 587 588 detach: 589 if (link[2]) 590 bpf_link__destroy(link[2]); 591 if (link[1]) 592 bpf_link__destroy(link[1]); 593 if (link[0]) 594 bpf_link__destroy(link[0]); 595 close: 596 close(net_fd); 597 } 598 599 static void run_lookup_prog(const struct test *t) 600 { 601 int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 }; 602 int client_fd, reuse_conn_fd = -1; 603 struct bpf_link *lookup_link; 604 int i, err; 605 606 lookup_link = attach_lookup_prog(t->lookup_prog); 607 if (!lookup_link) 608 return; 609 610 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 611 server_fds[i] = make_server(t->sotype, t->listen_at.ip, 612 t->listen_at.port, 613 t->reuseport_prog); 614 if (server_fds[i] < 0) 615 goto close; 616 617 err = update_lookup_map(t->sock_map, i, server_fds[i]); 618 if (err) 619 goto close; 620 621 /* want just one server for non-reuseport test */ 622 if (!t->reuseport_prog) 623 break; 624 } 625 626 /* Regular UDP socket lookup with reuseport behaves 627 * differently when reuseport group contains connected 628 * sockets. Check that adding a connected UDP socket to the 629 * reuseport group does not affect how reuseport works with 630 * BPF socket lookup. 631 */ 632 if (t->reuseport_has_conns) { 633 struct sockaddr_storage addr = {}; 634 socklen_t len = sizeof(addr); 635 636 /* Add an extra socket to reuseport group */ 637 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip, 638 t->listen_at.port, 639 t->reuseport_prog); 640 if (reuse_conn_fd < 0) 641 goto close; 642 643 /* Connect the extra socket to itself */ 644 err = getsockname(reuse_conn_fd, (void *)&addr, &len); 645 if (CHECK(err, "getsockname", "errno %d\n", errno)) 646 goto close; 647 err = connect(reuse_conn_fd, (void *)&addr, len); 648 if (CHECK(err, "connect", "errno %d\n", errno)) 649 goto close; 650 } 651 652 client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port); 653 if (client_fd < 0) 654 goto close; 655 656 if (t->sotype == SOCK_STREAM) 657 tcp_echo_test(client_fd, server_fds[t->accept_on]); 658 else 659 udp_echo_test(client_fd, server_fds[t->accept_on]); 660 661 close(client_fd); 662 close: 663 if (reuse_conn_fd != -1) 664 close(reuse_conn_fd); 665 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 666 if (server_fds[i] != -1) 667 close(server_fds[i]); 668 } 669 bpf_link__destroy(lookup_link); 670 } 671 672 static void test_redirect_lookup(struct test_sk_lookup *skel) 673 { 674 const struct test tests[] = { 675 { 676 .desc = "TCP IPv4 redir port", 677 .lookup_prog = skel->progs.redir_port, 678 .sock_map = skel->maps.redir_map, 679 .sotype = SOCK_STREAM, 680 .connect_to = { EXT_IP4, EXT_PORT }, 681 .listen_at = { EXT_IP4, INT_PORT }, 682 }, 683 { 684 .desc = "TCP IPv4 redir addr", 685 .lookup_prog = skel->progs.redir_ip4, 686 .sock_map = skel->maps.redir_map, 687 .sotype = SOCK_STREAM, 688 .connect_to = { EXT_IP4, EXT_PORT }, 689 .listen_at = { INT_IP4, EXT_PORT }, 690 }, 691 { 692 .desc = "TCP IPv4 redir with reuseport", 693 .lookup_prog = skel->progs.select_sock_a, 694 .reuseport_prog = skel->progs.select_sock_b, 695 .sock_map = skel->maps.redir_map, 696 .sotype = SOCK_STREAM, 697 .connect_to = { EXT_IP4, EXT_PORT }, 698 .listen_at = { INT_IP4, INT_PORT }, 699 .accept_on = SERVER_B, 700 }, 701 { 702 .desc = "TCP IPv4 redir skip reuseport", 703 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 704 .reuseport_prog = skel->progs.select_sock_b, 705 .sock_map = skel->maps.redir_map, 706 .sotype = SOCK_STREAM, 707 .connect_to = { EXT_IP4, EXT_PORT }, 708 .listen_at = { INT_IP4, INT_PORT }, 709 .accept_on = SERVER_A, 710 }, 711 { 712 .desc = "TCP IPv6 redir port", 713 .lookup_prog = skel->progs.redir_port, 714 .sock_map = skel->maps.redir_map, 715 .sotype = SOCK_STREAM, 716 .connect_to = { EXT_IP6, EXT_PORT }, 717 .listen_at = { EXT_IP6, INT_PORT }, 718 }, 719 { 720 .desc = "TCP IPv6 redir addr", 721 .lookup_prog = skel->progs.redir_ip6, 722 .sock_map = skel->maps.redir_map, 723 .sotype = SOCK_STREAM, 724 .connect_to = { EXT_IP6, EXT_PORT }, 725 .listen_at = { INT_IP6, EXT_PORT }, 726 }, 727 { 728 .desc = "TCP IPv4->IPv6 redir port", 729 .lookup_prog = skel->progs.redir_port, 730 .sock_map = skel->maps.redir_map, 731 .sotype = SOCK_STREAM, 732 .connect_to = { EXT_IP4, EXT_PORT }, 733 .listen_at = { INT_IP4_V6, INT_PORT }, 734 }, 735 { 736 .desc = "TCP IPv6 redir with reuseport", 737 .lookup_prog = skel->progs.select_sock_a, 738 .reuseport_prog = skel->progs.select_sock_b, 739 .sock_map = skel->maps.redir_map, 740 .sotype = SOCK_STREAM, 741 .connect_to = { EXT_IP6, EXT_PORT }, 742 .listen_at = { INT_IP6, INT_PORT }, 743 .accept_on = SERVER_B, 744 }, 745 { 746 .desc = "TCP IPv6 redir skip reuseport", 747 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 748 .reuseport_prog = skel->progs.select_sock_b, 749 .sock_map = skel->maps.redir_map, 750 .sotype = SOCK_STREAM, 751 .connect_to = { EXT_IP6, EXT_PORT }, 752 .listen_at = { INT_IP6, INT_PORT }, 753 .accept_on = SERVER_A, 754 }, 755 { 756 .desc = "UDP IPv4 redir port", 757 .lookup_prog = skel->progs.redir_port, 758 .sock_map = skel->maps.redir_map, 759 .sotype = SOCK_DGRAM, 760 .connect_to = { EXT_IP4, EXT_PORT }, 761 .listen_at = { EXT_IP4, INT_PORT }, 762 }, 763 { 764 .desc = "UDP IPv4 redir addr", 765 .lookup_prog = skel->progs.redir_ip4, 766 .sock_map = skel->maps.redir_map, 767 .sotype = SOCK_DGRAM, 768 .connect_to = { EXT_IP4, EXT_PORT }, 769 .listen_at = { INT_IP4, EXT_PORT }, 770 }, 771 { 772 .desc = "UDP IPv4 redir with reuseport", 773 .lookup_prog = skel->progs.select_sock_a, 774 .reuseport_prog = skel->progs.select_sock_b, 775 .sock_map = skel->maps.redir_map, 776 .sotype = SOCK_DGRAM, 777 .connect_to = { EXT_IP4, EXT_PORT }, 778 .listen_at = { INT_IP4, INT_PORT }, 779 .accept_on = SERVER_B, 780 }, 781 { 782 .desc = "UDP IPv4 redir and reuseport with conns", 783 .lookup_prog = skel->progs.select_sock_a, 784 .reuseport_prog = skel->progs.select_sock_b, 785 .sock_map = skel->maps.redir_map, 786 .sotype = SOCK_DGRAM, 787 .connect_to = { EXT_IP4, EXT_PORT }, 788 .listen_at = { INT_IP4, INT_PORT }, 789 .accept_on = SERVER_B, 790 .reuseport_has_conns = true, 791 }, 792 { 793 .desc = "UDP IPv4 redir skip reuseport", 794 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 795 .reuseport_prog = skel->progs.select_sock_b, 796 .sock_map = skel->maps.redir_map, 797 .sotype = SOCK_DGRAM, 798 .connect_to = { EXT_IP4, EXT_PORT }, 799 .listen_at = { INT_IP4, INT_PORT }, 800 .accept_on = SERVER_A, 801 }, 802 { 803 .desc = "UDP IPv6 redir port", 804 .lookup_prog = skel->progs.redir_port, 805 .sock_map = skel->maps.redir_map, 806 .sotype = SOCK_DGRAM, 807 .connect_to = { EXT_IP6, EXT_PORT }, 808 .listen_at = { EXT_IP6, INT_PORT }, 809 }, 810 { 811 .desc = "UDP IPv6 redir addr", 812 .lookup_prog = skel->progs.redir_ip6, 813 .sock_map = skel->maps.redir_map, 814 .sotype = SOCK_DGRAM, 815 .connect_to = { EXT_IP6, EXT_PORT }, 816 .listen_at = { INT_IP6, EXT_PORT }, 817 }, 818 { 819 .desc = "UDP IPv4->IPv6 redir port", 820 .lookup_prog = skel->progs.redir_port, 821 .sock_map = skel->maps.redir_map, 822 .sotype = SOCK_DGRAM, 823 .listen_at = { INT_IP4_V6, INT_PORT }, 824 .connect_to = { EXT_IP4, EXT_PORT }, 825 }, 826 { 827 .desc = "UDP IPv6 redir and reuseport", 828 .lookup_prog = skel->progs.select_sock_a, 829 .reuseport_prog = skel->progs.select_sock_b, 830 .sock_map = skel->maps.redir_map, 831 .sotype = SOCK_DGRAM, 832 .connect_to = { EXT_IP6, EXT_PORT }, 833 .listen_at = { INT_IP6, INT_PORT }, 834 .accept_on = SERVER_B, 835 }, 836 { 837 .desc = "UDP IPv6 redir and reuseport with conns", 838 .lookup_prog = skel->progs.select_sock_a, 839 .reuseport_prog = skel->progs.select_sock_b, 840 .sock_map = skel->maps.redir_map, 841 .sotype = SOCK_DGRAM, 842 .connect_to = { EXT_IP6, EXT_PORT }, 843 .listen_at = { INT_IP6, INT_PORT }, 844 .accept_on = SERVER_B, 845 .reuseport_has_conns = true, 846 }, 847 { 848 .desc = "UDP IPv6 redir skip reuseport", 849 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 850 .reuseport_prog = skel->progs.select_sock_b, 851 .sock_map = skel->maps.redir_map, 852 .sotype = SOCK_DGRAM, 853 .connect_to = { EXT_IP6, EXT_PORT }, 854 .listen_at = { INT_IP6, INT_PORT }, 855 .accept_on = SERVER_A, 856 }, 857 }; 858 const struct test *t; 859 860 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 861 if (test__start_subtest(t->desc)) 862 run_lookup_prog(t); 863 } 864 } 865 866 static void drop_on_lookup(const struct test *t) 867 { 868 struct sockaddr_storage dst = {}; 869 int client_fd, server_fd, err; 870 struct bpf_link *lookup_link; 871 ssize_t n; 872 873 lookup_link = attach_lookup_prog(t->lookup_prog); 874 if (!lookup_link) 875 return; 876 877 server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 878 t->reuseport_prog); 879 if (server_fd < 0) 880 goto detach; 881 882 client_fd = make_socket(t->sotype, t->connect_to.ip, 883 t->connect_to.port, &dst); 884 if (client_fd < 0) 885 goto close_srv; 886 887 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 888 if (t->sotype == SOCK_DGRAM) { 889 err = send_byte(client_fd); 890 if (err) 891 goto close_all; 892 893 /* Read out asynchronous error */ 894 n = recv(client_fd, NULL, 0, 0); 895 err = n == -1; 896 } 897 if (CHECK(!err || errno != ECONNREFUSED, "connect", 898 "unexpected success or error\n")) 899 log_err("expected ECONNREFUSED on connect"); 900 901 close_all: 902 close(client_fd); 903 close_srv: 904 close(server_fd); 905 detach: 906 bpf_link__destroy(lookup_link); 907 } 908 909 static void test_drop_on_lookup(struct test_sk_lookup *skel) 910 { 911 const struct test tests[] = { 912 { 913 .desc = "TCP IPv4 drop on lookup", 914 .lookup_prog = skel->progs.lookup_drop, 915 .sotype = SOCK_STREAM, 916 .connect_to = { EXT_IP4, EXT_PORT }, 917 .listen_at = { EXT_IP4, EXT_PORT }, 918 }, 919 { 920 .desc = "TCP IPv6 drop on lookup", 921 .lookup_prog = skel->progs.lookup_drop, 922 .sotype = SOCK_STREAM, 923 .connect_to = { EXT_IP6, EXT_PORT }, 924 .listen_at = { EXT_IP6, EXT_PORT }, 925 }, 926 { 927 .desc = "UDP IPv4 drop on lookup", 928 .lookup_prog = skel->progs.lookup_drop, 929 .sotype = SOCK_DGRAM, 930 .connect_to = { EXT_IP4, EXT_PORT }, 931 .listen_at = { EXT_IP4, EXT_PORT }, 932 }, 933 { 934 .desc = "UDP IPv6 drop on lookup", 935 .lookup_prog = skel->progs.lookup_drop, 936 .sotype = SOCK_DGRAM, 937 .connect_to = { EXT_IP6, EXT_PORT }, 938 .listen_at = { EXT_IP6, INT_PORT }, 939 }, 940 /* The program will drop on success, meaning that the ifindex 941 * was 1. 942 */ 943 { 944 .desc = "TCP IPv4 drop on valid ifindex", 945 .lookup_prog = skel->progs.check_ifindex, 946 .sotype = SOCK_STREAM, 947 .connect_to = { EXT_IP4, EXT_PORT }, 948 .listen_at = { EXT_IP4, EXT_PORT }, 949 }, 950 { 951 .desc = "TCP IPv6 drop on valid ifindex", 952 .lookup_prog = skel->progs.check_ifindex, 953 .sotype = SOCK_STREAM, 954 .connect_to = { EXT_IP6, EXT_PORT }, 955 .listen_at = { EXT_IP6, EXT_PORT }, 956 }, 957 { 958 .desc = "UDP IPv4 drop on valid ifindex", 959 .lookup_prog = skel->progs.check_ifindex, 960 .sotype = SOCK_DGRAM, 961 .connect_to = { EXT_IP4, EXT_PORT }, 962 .listen_at = { EXT_IP4, EXT_PORT }, 963 }, 964 { 965 .desc = "UDP IPv6 drop on valid ifindex", 966 .lookup_prog = skel->progs.check_ifindex, 967 .sotype = SOCK_DGRAM, 968 .connect_to = { EXT_IP6, EXT_PORT }, 969 .listen_at = { EXT_IP6, EXT_PORT }, 970 }, 971 }; 972 const struct test *t; 973 974 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 975 if (test__start_subtest(t->desc)) 976 drop_on_lookup(t); 977 } 978 } 979 980 static void drop_on_reuseport(const struct test *t) 981 { 982 struct sockaddr_storage dst = { 0 }; 983 int client, server1, server2, err; 984 struct bpf_link *lookup_link; 985 ssize_t n; 986 987 lookup_link = attach_lookup_prog(t->lookup_prog); 988 if (!lookup_link) 989 return; 990 991 server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 992 t->reuseport_prog); 993 if (server1 < 0) 994 goto detach; 995 996 err = update_lookup_map(t->sock_map, SERVER_A, server1); 997 if (err) 998 goto detach; 999 1000 /* second server on destination address we should never reach */ 1001 server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port, 1002 NULL /* reuseport prog */); 1003 if (server2 < 0) 1004 goto close_srv1; 1005 1006 client = make_socket(t->sotype, t->connect_to.ip, 1007 t->connect_to.port, &dst); 1008 if (client < 0) 1009 goto close_srv2; 1010 1011 err = connect(client, (void *)&dst, inetaddr_len(&dst)); 1012 if (t->sotype == SOCK_DGRAM) { 1013 err = send_byte(client); 1014 if (err) 1015 goto close_all; 1016 1017 /* Read out asynchronous error */ 1018 n = recv(client, NULL, 0, 0); 1019 err = n == -1; 1020 } 1021 if (CHECK(!err || errno != ECONNREFUSED, "connect", 1022 "unexpected success or error\n")) 1023 log_err("expected ECONNREFUSED on connect"); 1024 1025 close_all: 1026 close(client); 1027 close_srv2: 1028 close(server2); 1029 close_srv1: 1030 close(server1); 1031 detach: 1032 bpf_link__destroy(lookup_link); 1033 } 1034 1035 static void test_drop_on_reuseport(struct test_sk_lookup *skel) 1036 { 1037 const struct test tests[] = { 1038 { 1039 .desc = "TCP IPv4 drop on reuseport", 1040 .lookup_prog = skel->progs.select_sock_a, 1041 .reuseport_prog = skel->progs.reuseport_drop, 1042 .sock_map = skel->maps.redir_map, 1043 .sotype = SOCK_STREAM, 1044 .connect_to = { EXT_IP4, EXT_PORT }, 1045 .listen_at = { INT_IP4, INT_PORT }, 1046 }, 1047 { 1048 .desc = "TCP IPv6 drop on reuseport", 1049 .lookup_prog = skel->progs.select_sock_a, 1050 .reuseport_prog = skel->progs.reuseport_drop, 1051 .sock_map = skel->maps.redir_map, 1052 .sotype = SOCK_STREAM, 1053 .connect_to = { EXT_IP6, EXT_PORT }, 1054 .listen_at = { INT_IP6, INT_PORT }, 1055 }, 1056 { 1057 .desc = "UDP IPv4 drop on reuseport", 1058 .lookup_prog = skel->progs.select_sock_a, 1059 .reuseport_prog = skel->progs.reuseport_drop, 1060 .sock_map = skel->maps.redir_map, 1061 .sotype = SOCK_DGRAM, 1062 .connect_to = { EXT_IP4, EXT_PORT }, 1063 .listen_at = { INT_IP4, INT_PORT }, 1064 }, 1065 { 1066 .desc = "TCP IPv6 drop on reuseport", 1067 .lookup_prog = skel->progs.select_sock_a, 1068 .reuseport_prog = skel->progs.reuseport_drop, 1069 .sock_map = skel->maps.redir_map, 1070 .sotype = SOCK_STREAM, 1071 .connect_to = { EXT_IP6, EXT_PORT }, 1072 .listen_at = { INT_IP6, INT_PORT }, 1073 }, 1074 }; 1075 const struct test *t; 1076 1077 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1078 if (test__start_subtest(t->desc)) 1079 drop_on_reuseport(t); 1080 } 1081 } 1082 1083 static void run_sk_assign(struct test_sk_lookup *skel, 1084 struct bpf_program *lookup_prog, 1085 const char *remote_ip, const char *local_ip) 1086 { 1087 int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 }; 1088 struct bpf_sk_lookup ctx; 1089 __u64 server_cookie; 1090 int i, err; 1091 1092 DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts, 1093 .ctx_in = &ctx, 1094 .ctx_size_in = sizeof(ctx), 1095 .ctx_out = &ctx, 1096 .ctx_size_out = sizeof(ctx), 1097 ); 1098 1099 if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT)) 1100 return; 1101 1102 ctx.protocol = IPPROTO_TCP; 1103 1104 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1105 server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL); 1106 if (server_fds[i] < 0) 1107 goto close_servers; 1108 1109 err = update_lookup_map(skel->maps.redir_map, i, 1110 server_fds[i]); 1111 if (err) 1112 goto close_servers; 1113 } 1114 1115 server_cookie = socket_cookie(server_fds[SERVER_B]); 1116 if (!server_cookie) 1117 return; 1118 1119 err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts); 1120 if (CHECK(err, "test_run", "failed with error %d\n", errno)) 1121 goto close_servers; 1122 1123 if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n")) 1124 goto close_servers; 1125 1126 CHECK(ctx.cookie != server_cookie, "ctx.cookie", 1127 "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie); 1128 1129 close_servers: 1130 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1131 if (server_fds[i] != -1) 1132 close(server_fds[i]); 1133 } 1134 } 1135 1136 static void run_sk_assign_v4(struct test_sk_lookup *skel, 1137 struct bpf_program *lookup_prog) 1138 { 1139 run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4); 1140 } 1141 1142 static void run_sk_assign_v6(struct test_sk_lookup *skel, 1143 struct bpf_program *lookup_prog) 1144 { 1145 run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6); 1146 } 1147 1148 static void run_sk_assign_connected(struct test_sk_lookup *skel, 1149 int sotype) 1150 { 1151 int err, client_fd, connected_fd, server_fd; 1152 struct bpf_link *lookup_link; 1153 1154 server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL); 1155 if (server_fd < 0) 1156 return; 1157 1158 connected_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1159 if (connected_fd < 0) 1160 goto out_close_server; 1161 1162 /* Put a connected socket in redirect map */ 1163 err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd); 1164 if (err) 1165 goto out_close_connected; 1166 1167 lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport); 1168 if (!lookup_link) 1169 goto out_close_connected; 1170 1171 /* Try to redirect TCP SYN / UDP packet to a connected socket */ 1172 client_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1173 if (client_fd < 0) 1174 goto out_unlink_prog; 1175 if (sotype == SOCK_DGRAM) { 1176 send_byte(client_fd); 1177 recv_byte(server_fd); 1178 } 1179 1180 close(client_fd); 1181 out_unlink_prog: 1182 bpf_link__destroy(lookup_link); 1183 out_close_connected: 1184 close(connected_fd); 1185 out_close_server: 1186 close(server_fd); 1187 } 1188 1189 static void test_sk_assign_helper(struct test_sk_lookup *skel) 1190 { 1191 if (test__start_subtest("sk_assign returns EEXIST")) 1192 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist); 1193 if (test__start_subtest("sk_assign honors F_REPLACE")) 1194 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag); 1195 if (test__start_subtest("sk_assign accepts NULL socket")) 1196 run_sk_assign_v4(skel, skel->progs.sk_assign_null); 1197 if (test__start_subtest("access ctx->sk")) 1198 run_sk_assign_v4(skel, skel->progs.access_ctx_sk); 1199 if (test__start_subtest("narrow access to ctx v4")) 1200 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access); 1201 if (test__start_subtest("narrow access to ctx v6")) 1202 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access); 1203 if (test__start_subtest("sk_assign rejects TCP established")) 1204 run_sk_assign_connected(skel, SOCK_STREAM); 1205 if (test__start_subtest("sk_assign rejects UDP connected")) 1206 run_sk_assign_connected(skel, SOCK_DGRAM); 1207 } 1208 1209 struct test_multi_prog { 1210 const char *desc; 1211 struct bpf_program *prog1; 1212 struct bpf_program *prog2; 1213 struct bpf_map *redir_map; 1214 struct bpf_map *run_map; 1215 int expect_errno; 1216 struct inet_addr listen_at; 1217 }; 1218 1219 static void run_multi_prog_lookup(const struct test_multi_prog *t) 1220 { 1221 struct sockaddr_storage dst = {}; 1222 int map_fd, server_fd, client_fd; 1223 struct bpf_link *link1, *link2; 1224 int prog_idx, done, err; 1225 1226 map_fd = bpf_map__fd(t->run_map); 1227 1228 done = 0; 1229 prog_idx = PROG1; 1230 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1231 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1232 return; 1233 prog_idx = PROG2; 1234 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1235 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1236 return; 1237 1238 link1 = attach_lookup_prog(t->prog1); 1239 if (!link1) 1240 return; 1241 link2 = attach_lookup_prog(t->prog2); 1242 if (!link2) 1243 goto out_unlink1; 1244 1245 server_fd = make_server(SOCK_STREAM, t->listen_at.ip, 1246 t->listen_at.port, NULL); 1247 if (server_fd < 0) 1248 goto out_unlink2; 1249 1250 err = update_lookup_map(t->redir_map, SERVER_A, server_fd); 1251 if (err) 1252 goto out_close_server; 1253 1254 client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst); 1255 if (client_fd < 0) 1256 goto out_close_server; 1257 1258 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 1259 if (CHECK(err && !t->expect_errno, "connect", 1260 "unexpected error %d\n", errno)) 1261 goto out_close_client; 1262 if (CHECK(err && t->expect_errno && errno != t->expect_errno, 1263 "connect", "unexpected error %d\n", errno)) 1264 goto out_close_client; 1265 1266 done = 0; 1267 prog_idx = PROG1; 1268 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1269 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1270 CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n"); 1271 1272 done = 0; 1273 prog_idx = PROG2; 1274 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1275 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1276 CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n"); 1277 1278 out_close_client: 1279 close(client_fd); 1280 out_close_server: 1281 close(server_fd); 1282 out_unlink2: 1283 bpf_link__destroy(link2); 1284 out_unlink1: 1285 bpf_link__destroy(link1); 1286 } 1287 1288 static void test_multi_prog_lookup(struct test_sk_lookup *skel) 1289 { 1290 struct test_multi_prog tests[] = { 1291 { 1292 .desc = "multi prog - pass, pass", 1293 .prog1 = skel->progs.multi_prog_pass1, 1294 .prog2 = skel->progs.multi_prog_pass2, 1295 .listen_at = { EXT_IP4, EXT_PORT }, 1296 }, 1297 { 1298 .desc = "multi prog - drop, drop", 1299 .prog1 = skel->progs.multi_prog_drop1, 1300 .prog2 = skel->progs.multi_prog_drop2, 1301 .listen_at = { EXT_IP4, EXT_PORT }, 1302 .expect_errno = ECONNREFUSED, 1303 }, 1304 { 1305 .desc = "multi prog - pass, drop", 1306 .prog1 = skel->progs.multi_prog_pass1, 1307 .prog2 = skel->progs.multi_prog_drop2, 1308 .listen_at = { EXT_IP4, EXT_PORT }, 1309 .expect_errno = ECONNREFUSED, 1310 }, 1311 { 1312 .desc = "multi prog - drop, pass", 1313 .prog1 = skel->progs.multi_prog_drop1, 1314 .prog2 = skel->progs.multi_prog_pass2, 1315 .listen_at = { EXT_IP4, EXT_PORT }, 1316 .expect_errno = ECONNREFUSED, 1317 }, 1318 { 1319 .desc = "multi prog - pass, redir", 1320 .prog1 = skel->progs.multi_prog_pass1, 1321 .prog2 = skel->progs.multi_prog_redir2, 1322 .listen_at = { INT_IP4, INT_PORT }, 1323 }, 1324 { 1325 .desc = "multi prog - redir, pass", 1326 .prog1 = skel->progs.multi_prog_redir1, 1327 .prog2 = skel->progs.multi_prog_pass2, 1328 .listen_at = { INT_IP4, INT_PORT }, 1329 }, 1330 { 1331 .desc = "multi prog - drop, redir", 1332 .prog1 = skel->progs.multi_prog_drop1, 1333 .prog2 = skel->progs.multi_prog_redir2, 1334 .listen_at = { INT_IP4, INT_PORT }, 1335 }, 1336 { 1337 .desc = "multi prog - redir, drop", 1338 .prog1 = skel->progs.multi_prog_redir1, 1339 .prog2 = skel->progs.multi_prog_drop2, 1340 .listen_at = { INT_IP4, INT_PORT }, 1341 }, 1342 { 1343 .desc = "multi prog - redir, redir", 1344 .prog1 = skel->progs.multi_prog_redir1, 1345 .prog2 = skel->progs.multi_prog_redir2, 1346 .listen_at = { INT_IP4, INT_PORT }, 1347 }, 1348 }; 1349 struct test_multi_prog *t; 1350 1351 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1352 t->redir_map = skel->maps.redir_map; 1353 t->run_map = skel->maps.run_map; 1354 if (test__start_subtest(t->desc)) 1355 run_multi_prog_lookup(t); 1356 } 1357 } 1358 1359 static void run_tests(struct test_sk_lookup *skel) 1360 { 1361 if (test__start_subtest("query lookup prog")) 1362 query_lookup_prog(skel); 1363 test_redirect_lookup(skel); 1364 test_drop_on_lookup(skel); 1365 test_drop_on_reuseport(skel); 1366 test_sk_assign_helper(skel); 1367 test_multi_prog_lookup(skel); 1368 } 1369 1370 static int switch_netns(void) 1371 { 1372 static const char * const setup_script[] = { 1373 "ip -6 addr add dev lo " EXT_IP6 "/128", 1374 "ip -6 addr add dev lo " INT_IP6 "/128", 1375 "ip link set dev lo up", 1376 NULL, 1377 }; 1378 const char * const *cmd; 1379 int err; 1380 1381 err = unshare(CLONE_NEWNET); 1382 if (CHECK(err, "unshare", "failed\n")) { 1383 log_err("unshare(CLONE_NEWNET)"); 1384 return -1; 1385 } 1386 1387 for (cmd = setup_script; *cmd; cmd++) { 1388 err = system(*cmd); 1389 if (CHECK(err, "system", "failed\n")) { 1390 log_err("system(%s)", *cmd); 1391 return -1; 1392 } 1393 } 1394 1395 return 0; 1396 } 1397 1398 void test_sk_lookup(void) 1399 { 1400 struct test_sk_lookup *skel; 1401 int err; 1402 1403 err = switch_netns(); 1404 if (err) 1405 return; 1406 1407 skel = test_sk_lookup__open_and_load(); 1408 if (CHECK(!skel, "skel open_and_load", "failed\n")) 1409 return; 1410 1411 run_tests(skel); 1412 1413 test_sk_lookup__destroy(skel); 1414 } 1415