tools/testing/selftests/bpf/prog_tests/sk_lookup.c

   1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
   2 // Copyright (c) 2020 Cloudflare
   3 /*
   4  * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP).
   5  *
   6  * Tests exercise:
   7  *  - attaching/detaching/querying programs to BPF_SK_LOOKUP hook,
   8  *  - redirecting socket lookup to a socket selected by BPF program,
   9  *  - failing a socket lookup on BPF program's request,
  10  *  - error scenarios for selecting a socket from BPF program,
  11  *  - accessing BPF program context,
  12  *  - attaching and running multiple BPF programs.
  13  *
  14  * Tests run in a dedicated network namespace.
  15  */
  16
  17 #define _GNU_SOURCE
  18 #include <arpa/inet.h>
  19 #include <assert.h>
  20 #include <errno.h>
  21 #include <error.h>
  22 #include <fcntl.h>
  23 #include <sched.h>
  24 #include <stdio.h>
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <unistd.h>
  28
  29 #include <bpf/libbpf.h>
  30 #include <bpf/bpf.h>
  31
  32 #include "test_progs.h"
  33 #include "bpf_rlimit.h"
  34 #include "bpf_util.h"
  35 #include "cgroup_helpers.h"
  36 #include "network_helpers.h"
  37 #include "testing_helpers.h"
  38 #include "test_sk_lookup.skel.h"
  39
  40 /* External (address, port) pairs the client sends packets to. */
  41 #define EXT_IP4         "127.0.0.1"
  42 #define EXT_IP6         "fd00::1"
  43 #define EXT_PORT        7007
  44
  45 /* Internal (address, port) pairs the server listens/receives at. */
  46 #define INT_IP4         "127.0.0.2"
  47 #define INT_IP4_V6      "::ffff:127.0.0.2"
  48 #define INT_IP6         "fd00::2"
  49 #define INT_PORT        8008
  50
  51 #define IO_TIMEOUT_SEC  3
  52
  53 enum server {
  54         SERVER_A = 0,
  55         SERVER_B = 1,
  56         MAX_SERVERS,
  57 };
  58
  59 enum {
  60         PROG1 = 0,
  61         PROG2,
  62 };
  63
  64 struct inet_addr {
  65         const char *ip;
  66         unsigned short port;
  67 };
  68
  69 struct test {
  70         const char *desc;
  71         struct bpf_program *lookup_prog;
  72         struct bpf_program *reuseport_prog;
  73         struct bpf_map *sock_map;
  74         int sotype;
  75         struct inet_addr connect_to;
  76         struct inet_addr listen_at;
  77         enum server accept_on;
  78         bool reuseport_has_conns; /* Add a connected socket to reuseport group */
  79 };
  80
  81 static __u32 duration;          /* for CHECK macro */
  82
  83 static bool is_ipv6(const char *ip)
  84 {
  85         return !!strchr(ip, ':');
  86 }
  87
  88 static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog)
  89 {
  90         int err, prog_fd;
  91
  92         prog_fd = bpf_program__fd(reuseport_prog);
  93         if (prog_fd < 0) {
  94                 errno = -prog_fd;
  95                 return -1;
  96         }
  97
  98         err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF,
  99                          &prog_fd, sizeof(prog_fd));
 100         if (err)
 101                 return -1;
 102
 103         return 0;
 104 }
 105
 106 static socklen_t inetaddr_len(const struct sockaddr_storage *addr)
 107 {
 108         return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) :
 109                 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0);
 110 }
 111
 112 static int make_socket(int sotype, const char *ip, int port,
 113                        struct sockaddr_storage *addr)
 114 {
 115         struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC };
 116         int err, family, fd;
 117
 118         family = is_ipv6(ip) ? AF_INET6 : AF_INET;
 119         err = make_sockaddr(family, ip, port, addr, NULL);
 120         if (CHECK(err, "make_address", "failed\n"))
 121                 return -1;
 122
 123         fd = socket(addr->ss_family, sotype, 0);
 124         if (CHECK(fd < 0, "socket", "failed\n")) {
 125                 log_err("failed to make socket");
 126                 return -1;
 127         }
 128
 129         err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
 130         if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) {
 131                 log_err("failed to set SNDTIMEO");
 132                 close(fd);
 133                 return -1;
 134         }
 135
 136         err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
 137         if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) {
 138                 log_err("failed to set RCVTIMEO");
 139                 close(fd);
 140                 return -1;
 141         }
 142
 143         return fd;
 144 }
 145
 146 static int make_server(int sotype, const char *ip, int port,
 147                        struct bpf_program *reuseport_prog)
 148 {
 149         struct sockaddr_storage addr = {0};
 150         const int one = 1;
 151         int err, fd = -1;
 152
 153         fd = make_socket(sotype, ip, port, &addr);
 154         if (fd < 0)
 155                 return -1;
 156
 157         /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */
 158         if (sotype == SOCK_DGRAM) {
 159                 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one,
 160                                  sizeof(one));
 161                 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) {
 162                         log_err("failed to enable IP_RECVORIGDSTADDR");
 163                         goto fail;
 164                 }
 165         }
 166
 167         if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) {
 168                 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one,
 169                                  sizeof(one));
 170                 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) {
 171                         log_err("failed to enable IPV6_RECVORIGDSTADDR");
 172                         goto fail;
 173                 }
 174         }
 175
 176         if (sotype == SOCK_STREAM) {
 177                 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
 178                                  sizeof(one));
 179                 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) {
 180                         log_err("failed to enable SO_REUSEADDR");
 181                         goto fail;
 182                 }
 183         }
 184
 185         if (reuseport_prog) {
 186                 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one,
 187                                  sizeof(one));
 188                 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) {
 189                         log_err("failed to enable SO_REUSEPORT");
 190                         goto fail;
 191                 }
 192         }
 193
 194         err = bind(fd, (void *)&addr, inetaddr_len(&addr));
 195         if (CHECK(err, "bind", "failed\n")) {
 196                 log_err("failed to bind listen socket");
 197                 goto fail;
 198         }
 199
 200         if (sotype == SOCK_STREAM) {
 201                 err = listen(fd, SOMAXCONN);
 202                 if (CHECK(err, "make_server", "listen")) {
 203                         log_err("failed to listen on port %d", port);
 204                         goto fail;
 205                 }
 206         }
 207
 208         /* Late attach reuseport prog so we can have one init path */
 209         if (reuseport_prog) {
 210                 err = attach_reuseport(fd, reuseport_prog);
 211                 if (CHECK(err, "attach_reuseport", "failed\n")) {
 212                         log_err("failed to attach reuseport prog");
 213                         goto fail;
 214                 }
 215         }
 216
 217         return fd;
 218 fail:
 219         close(fd);
 220         return -1;
 221 }
 222
 223 static int make_client(int sotype, const char *ip, int port)
 224 {
 225         struct sockaddr_storage addr = {0};
 226         int err, fd;
 227
 228         fd = make_socket(sotype, ip, port, &addr);
 229         if (fd < 0)
 230                 return -1;
 231
 232         err = connect(fd, (void *)&addr, inetaddr_len(&addr));
 233         if (CHECK(err, "make_client", "connect")) {
 234                 log_err("failed to connect client socket");
 235                 goto fail;
 236         }
 237
 238         return fd;
 239 fail:
 240         close(fd);
 241         return -1;
 242 }
 243
 244 static int send_byte(int fd)
 245 {
 246         ssize_t n;
 247
 248         errno = 0;
 249         n = send(fd, "a", 1, 0);
 250         if (CHECK(n <= 0, "send_byte", "send")) {
 251                 log_err("failed/partial send");
 252                 return -1;
 253         }
 254         return 0;
 255 }
 256
 257 static int recv_byte(int fd)
 258 {
 259         char buf[1];
 260         ssize_t n;
 261
 262         n = recv(fd, buf, sizeof(buf), 0);
 263         if (CHECK(n <= 0, "recv_byte", "recv")) {
 264                 log_err("failed/partial recv");
 265                 return -1;
 266         }
 267         return 0;
 268 }
 269
 270 static int tcp_recv_send(int server_fd)
 271 {
 272         char buf[1];
 273         int ret, fd;
 274         ssize_t n;
 275
 276         fd = accept(server_fd, NULL, NULL);
 277         if (CHECK(fd < 0, "accept", "failed\n")) {
 278                 log_err("failed to accept");
 279                 return -1;
 280         }
 281
 282         n = recv(fd, buf, sizeof(buf), 0);
 283         if (CHECK(n <= 0, "recv", "failed\n")) {
 284                 log_err("failed/partial recv");
 285                 ret = -1;
 286                 goto close;
 287         }
 288
 289         n = send(fd, buf, n, 0);
 290         if (CHECK(n <= 0, "send", "failed\n")) {
 291                 log_err("failed/partial send");
 292                 ret = -1;
 293                 goto close;
 294         }
 295
 296         ret = 0;
 297 close:
 298         close(fd);
 299         return ret;
 300 }
 301
 302 static void v4_to_v6(struct sockaddr_storage *ss)
 303 {
 304         struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss;
 305         struct sockaddr_in v4 = *(struct sockaddr_in *)ss;
 306
 307         v6->sin6_family = AF_INET6;
 308         v6->sin6_port = v4.sin_port;
 309         v6->sin6_addr.s6_addr[10] = 0xff;
 310         v6->sin6_addr.s6_addr[11] = 0xff;
 311         memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4);
 312 }
 313
 314 static int udp_recv_send(int server_fd)
 315 {
 316         char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
 317         struct sockaddr_storage _src_addr = { 0 };
 318         struct sockaddr_storage *src_addr = &_src_addr;
 319         struct sockaddr_storage *dst_addr = NULL;
 320         struct msghdr msg = { 0 };
 321         struct iovec iov = { 0 };
 322         struct cmsghdr *cm;
 323         char buf[1];
 324         int ret, fd;
 325         ssize_t n;
 326
 327         iov.iov_base = buf;
 328         iov.iov_len = sizeof(buf);
 329
 330         msg.msg_name = src_addr;
 331         msg.msg_namelen = sizeof(*src_addr);
 332         msg.msg_iov = &iov;
 333         msg.msg_iovlen = 1;
 334         msg.msg_control = cmsg_buf;
 335         msg.msg_controllen = sizeof(cmsg_buf);
 336
 337         errno = 0;
 338         n = recvmsg(server_fd, &msg, 0);
 339         if (CHECK(n <= 0, "recvmsg", "failed\n")) {
 340                 log_err("failed to receive");
 341                 return -1;
 342         }
 343         if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n"))
 344                 return -1;
 345
 346         for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) {
 347                 if ((cm->cmsg_level == SOL_IP &&
 348                      cm->cmsg_type == IP_ORIGDSTADDR) ||
 349                     (cm->cmsg_level == SOL_IPV6 &&
 350                      cm->cmsg_type == IPV6_ORIGDSTADDR)) {
 351                         dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm);
 352                         break;
 353                 }
 354                 log_err("warning: ignored cmsg at level %d type %d",
 355                         cm->cmsg_level, cm->cmsg_type);
 356         }
 357         if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n"))
 358                 return -1;
 359
 360         /* Server socket bound to IPv4-mapped IPv6 address */
 361         if (src_addr->ss_family == AF_INET6 &&
 362             dst_addr->ss_family == AF_INET) {
 363                 v4_to_v6(dst_addr);
 364         }
 365
 366         /* Reply from original destination address. */
 367         fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0);
 368         if (CHECK(fd < 0, "socket", "failed\n")) {
 369                 log_err("failed to create tx socket");
 370                 return -1;
 371         }
 372
 373         ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr));
 374         if (CHECK(ret, "bind", "failed\n")) {
 375                 log_err("failed to bind tx socket");
 376                 goto out;
 377         }
 378
 379         msg.msg_control = NULL;
 380         msg.msg_controllen = 0;
 381         n = sendmsg(fd, &msg, 0);
 382         if (CHECK(n <= 0, "sendmsg", "failed\n")) {
 383                 log_err("failed to send echo reply");
 384                 ret = -1;
 385                 goto out;
 386         }
 387
 388         ret = 0;
 389 out:
 390         close(fd);
 391         return ret;
 392 }
 393
 394 static int tcp_echo_test(int client_fd, int server_fd)
 395 {
 396         int err;
 397
 398         err = send_byte(client_fd);
 399         if (err)
 400                 return -1;
 401         err = tcp_recv_send(server_fd);
 402         if (err)
 403                 return -1;
 404         err = recv_byte(client_fd);
 405         if (err)
 406                 return -1;
 407
 408         return 0;
 409 }
 410
 411 static int udp_echo_test(int client_fd, int server_fd)
 412 {
 413         int err;
 414
 415         err = send_byte(client_fd);
 416         if (err)
 417                 return -1;
 418         err = udp_recv_send(server_fd);
 419         if (err)
 420                 return -1;
 421         err = recv_byte(client_fd);
 422         if (err)
 423                 return -1;
 424
 425         return 0;
 426 }
 427
 428 static struct bpf_link *attach_lookup_prog(struct bpf_program *prog)
 429 {
 430         struct bpf_link *link;
 431         int net_fd;
 432
 433         net_fd = open("/proc/self/ns/net", O_RDONLY);
 434         if (CHECK(net_fd < 0, "open", "failed\n")) {
 435                 log_err("failed to open /proc/self/ns/net");
 436                 return NULL;
 437         }
 438
 439         link = bpf_program__attach_netns(prog, net_fd);
 440         if (CHECK(IS_ERR(link), "bpf_program__attach_netns", "failed\n")) {
 441                 errno = -PTR_ERR(link);
 442                 log_err("failed to attach program '%s' to netns",
 443                         bpf_program__name(prog));
 444                 link = NULL;
 445         }
 446
 447         close(net_fd);
 448         return link;
 449 }
 450
 451 static int update_lookup_map(struct bpf_map *map, int index, int sock_fd)
 452 {
 453         int err, map_fd;
 454         uint64_t value;
 455
 456         map_fd = bpf_map__fd(map);
 457         if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) {
 458                 errno = -map_fd;
 459                 log_err("failed to get map FD");
 460                 return -1;
 461         }
 462
 463         value = (uint64_t)sock_fd;
 464         err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST);
 465         if (CHECK(err, "bpf_map_update_elem", "failed\n")) {
 466                 log_err("failed to update redir_map @ %d", index);
 467                 return -1;
 468         }
 469
 470         return 0;
 471 }
 472
 473 static void query_lookup_prog(struct test_sk_lookup *skel)
 474 {
 475         struct bpf_link *link[3] = {};
 476         struct bpf_link_info info;
 477         __u32 attach_flags = 0;
 478         __u32 prog_ids[3] = {};
 479         __u32 prog_cnt = 3;
 480         __u32 prog_id;
 481         int net_fd;
 482         int err;
 483
 484         net_fd = open("/proc/self/ns/net", O_RDONLY);
 485         if (CHECK(net_fd < 0, "open", "failed\n")) {
 486                 log_err("failed to open /proc/self/ns/net");
 487                 return;
 488         }
 489
 490         link[0] = attach_lookup_prog(skel->progs.lookup_pass);
 491         if (!link[0])
 492                 goto close;
 493         link[1] = attach_lookup_prog(skel->progs.lookup_pass);
 494         if (!link[1])
 495                 goto detach;
 496         link[2] = attach_lookup_prog(skel->progs.lookup_drop);
 497         if (!link[2])
 498                 goto detach;
 499
 500         err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */,
 501                              &attach_flags, prog_ids, &prog_cnt);
 502         if (CHECK(err, "bpf_prog_query", "failed\n")) {
 503                 log_err("failed to query lookup prog");
 504                 goto detach;
 505         }
 506
 507         errno = 0;
 508         if (CHECK(attach_flags != 0, "bpf_prog_query",
 509                   "wrong attach_flags on query: %u", attach_flags))
 510                 goto detach;
 511         if (CHECK(prog_cnt != 3, "bpf_prog_query",
 512                   "wrong program count on query: %u", prog_cnt))
 513                 goto detach;
 514         prog_id = link_info_prog_id(link[0], &info);
 515         CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
 516               "invalid program #0 id on query: %u != %u\n",
 517               prog_ids[0], prog_id);
 518         CHECK(info.netns.netns_ino == 0, "netns_ino",
 519               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 520         prog_id = link_info_prog_id(link[1], &info);
 521         CHECK(prog_ids[1] != prog_id, "bpf_prog_query",
 522               "invalid program #1 id on query: %u != %u\n",
 523               prog_ids[1], prog_id);
 524         CHECK(info.netns.netns_ino == 0, "netns_ino",
 525               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 526         prog_id = link_info_prog_id(link[2], &info);
 527         CHECK(prog_ids[2] != prog_id, "bpf_prog_query",
 528               "invalid program #2 id on query: %u != %u\n",
 529               prog_ids[2], prog_id);
 530         CHECK(info.netns.netns_ino == 0, "netns_ino",
 531               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 532
 533         err = bpf_link__detach(link[0]);
 534         if (CHECK(err, "link_detach", "failed %d\n", err))
 535                 goto detach;
 536
 537         /* prog id is still there, but netns_ino is zeroed out */
 538         prog_id = link_info_prog_id(link[0], &info);
 539         CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
 540               "invalid program #0 id on query: %u != %u\n",
 541               prog_ids[0], prog_id);
 542         CHECK(info.netns.netns_ino != 0, "netns_ino",
 543               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 544
 545 detach:
 546         if (link[2])
 547                 bpf_link__destroy(link[2]);
 548         if (link[1])
 549                 bpf_link__destroy(link[1]);
 550         if (link[0])
 551                 bpf_link__destroy(link[0]);
 552 close:
 553         close(net_fd);
 554 }
 555
 556 static void run_lookup_prog(const struct test *t)
 557 {
 558         int server_fds[MAX_SERVERS] = { -1 };
 559         int client_fd, reuse_conn_fd = -1;
 560         struct bpf_link *lookup_link;
 561         int i, err;
 562
 563         lookup_link = attach_lookup_prog(t->lookup_prog);
 564         if (!lookup_link)
 565                 return;
 566
 567         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
 568                 server_fds[i] = make_server(t->sotype, t->listen_at.ip,
 569                                             t->listen_at.port,
 570                                             t->reuseport_prog);
 571                 if (server_fds[i] < 0)
 572                         goto close;
 573
 574                 err = update_lookup_map(t->sock_map, i, server_fds[i]);
 575                 if (err)
 576                         goto close;
 577
 578                 /* want just one server for non-reuseport test */
 579                 if (!t->reuseport_prog)
 580                         break;
 581         }
 582
 583         /* Regular UDP socket lookup with reuseport behaves
 584          * differently when reuseport group contains connected
 585          * sockets. Check that adding a connected UDP socket to the
 586          * reuseport group does not affect how reuseport works with
 587          * BPF socket lookup.
 588          */
 589         if (t->reuseport_has_conns) {
 590                 struct sockaddr_storage addr = {};
 591                 socklen_t len = sizeof(addr);
 592
 593                 /* Add an extra socket to reuseport group */
 594                 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip,
 595                                             t->listen_at.port,
 596                                             t->reuseport_prog);
 597                 if (reuse_conn_fd < 0)
 598                         goto close;
 599
 600                 /* Connect the extra socket to itself */
 601                 err = getsockname(reuse_conn_fd, (void *)&addr, &len);
 602                 if (CHECK(err, "getsockname", "errno %d\n", errno))
 603                         goto close;
 604                 err = connect(reuse_conn_fd, (void *)&addr, len);
 605                 if (CHECK(err, "connect", "errno %d\n", errno))
 606                         goto close;
 607         }
 608
 609         client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port);
 610         if (client_fd < 0)
 611                 goto close;
 612
 613         if (t->sotype == SOCK_STREAM)
 614                 tcp_echo_test(client_fd, server_fds[t->accept_on]);
 615         else
 616                 udp_echo_test(client_fd, server_fds[t->accept_on]);
 617
 618         close(client_fd);
 619 close:
 620         if (reuse_conn_fd != -1)
 621                 close(reuse_conn_fd);
 622         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
 623                 if (server_fds[i] != -1)
 624                         close(server_fds[i]);
 625         }
 626         bpf_link__destroy(lookup_link);
 627 }
 628
 629 static void test_redirect_lookup(struct test_sk_lookup *skel)
 630 {
 631         const struct test tests[] = {
 632                 {
 633                         .desc           = "TCP IPv4 redir port",
 634                         .lookup_prog    = skel->progs.redir_port,
 635                         .sock_map       = skel->maps.redir_map,
 636                         .sotype         = SOCK_STREAM,
 637                         .connect_to     = { EXT_IP4, EXT_PORT },
 638                         .listen_at      = { EXT_IP4, INT_PORT },
 639                 },
 640                 {
 641                         .desc           = "TCP IPv4 redir addr",
 642                         .lookup_prog    = skel->progs.redir_ip4,
 643                         .sock_map       = skel->maps.redir_map,
 644                         .sotype         = SOCK_STREAM,
 645                         .connect_to     = { EXT_IP4, EXT_PORT },
 646                         .listen_at      = { INT_IP4, EXT_PORT },
 647                 },
 648                 {
 649                         .desc           = "TCP IPv4 redir with reuseport",
 650                         .lookup_prog    = skel->progs.select_sock_a,
 651                         .reuseport_prog = skel->progs.select_sock_b,
 652                         .sock_map       = skel->maps.redir_map,
 653                         .sotype         = SOCK_STREAM,
 654                         .connect_to     = { EXT_IP4, EXT_PORT },
 655                         .listen_at      = { INT_IP4, INT_PORT },
 656                         .accept_on      = SERVER_B,
 657                 },
 658                 {
 659                         .desc           = "TCP IPv4 redir skip reuseport",
 660                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 661                         .reuseport_prog = skel->progs.select_sock_b,
 662                         .sock_map       = skel->maps.redir_map,
 663                         .sotype         = SOCK_STREAM,
 664                         .connect_to     = { EXT_IP4, EXT_PORT },
 665                         .listen_at      = { INT_IP4, INT_PORT },
 666                         .accept_on      = SERVER_A,
 667                 },
 668                 {
 669                         .desc           = "TCP IPv6 redir port",
 670                         .lookup_prog    = skel->progs.redir_port,
 671                         .sock_map       = skel->maps.redir_map,
 672                         .sotype         = SOCK_STREAM,
 673                         .connect_to     = { EXT_IP6, EXT_PORT },
 674                         .listen_at      = { EXT_IP6, INT_PORT },
 675                 },
 676                 {
 677                         .desc           = "TCP IPv6 redir addr",
 678                         .lookup_prog    = skel->progs.redir_ip6,
 679                         .sock_map       = skel->maps.redir_map,
 680                         .sotype         = SOCK_STREAM,
 681                         .connect_to     = { EXT_IP6, EXT_PORT },
 682                         .listen_at      = { INT_IP6, EXT_PORT },
 683                 },
 684                 {
 685                         .desc           = "TCP IPv4->IPv6 redir port",
 686                         .lookup_prog    = skel->progs.redir_port,
 687                         .sock_map       = skel->maps.redir_map,
 688                         .sotype         = SOCK_STREAM,
 689                         .connect_to     = { EXT_IP4, EXT_PORT },
 690                         .listen_at      = { INT_IP4_V6, INT_PORT },
 691                 },
 692                 {
 693                         .desc           = "TCP IPv6 redir with reuseport",
 694                         .lookup_prog    = skel->progs.select_sock_a,
 695                         .reuseport_prog = skel->progs.select_sock_b,
 696                         .sock_map       = skel->maps.redir_map,
 697                         .sotype         = SOCK_STREAM,
 698                         .connect_to     = { EXT_IP6, EXT_PORT },
 699                         .listen_at      = { INT_IP6, INT_PORT },
 700                         .accept_on      = SERVER_B,
 701                 },
 702                 {
 703                         .desc           = "TCP IPv6 redir skip reuseport",
 704                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 705                         .reuseport_prog = skel->progs.select_sock_b,
 706                         .sock_map       = skel->maps.redir_map,
 707                         .sotype         = SOCK_STREAM,
 708                         .connect_to     = { EXT_IP6, EXT_PORT },
 709                         .listen_at      = { INT_IP6, INT_PORT },
 710                         .accept_on      = SERVER_A,
 711                 },
 712                 {
 713                         .desc           = "UDP IPv4 redir port",
 714                         .lookup_prog    = skel->progs.redir_port,
 715                         .sock_map       = skel->maps.redir_map,
 716                         .sotype         = SOCK_DGRAM,
 717                         .connect_to     = { EXT_IP4, EXT_PORT },
 718                         .listen_at      = { EXT_IP4, INT_PORT },
 719                 },
 720                 {
 721                         .desc           = "UDP IPv4 redir addr",
 722                         .lookup_prog    = skel->progs.redir_ip4,
 723                         .sock_map       = skel->maps.redir_map,
 724                         .sotype         = SOCK_DGRAM,
 725                         .connect_to     = { EXT_IP4, EXT_PORT },
 726                         .listen_at      = { INT_IP4, EXT_PORT },
 727                 },
 728                 {
 729                         .desc           = "UDP IPv4 redir with reuseport",
 730                         .lookup_prog    = skel->progs.select_sock_a,
 731                         .reuseport_prog = skel->progs.select_sock_b,
 732                         .sock_map       = skel->maps.redir_map,
 733                         .sotype         = SOCK_DGRAM,
 734                         .connect_to     = { EXT_IP4, EXT_PORT },
 735                         .listen_at      = { INT_IP4, INT_PORT },
 736                         .accept_on      = SERVER_B,
 737                 },
 738                 {
 739                         .desc           = "UDP IPv4 redir and reuseport with conns",
 740                         .lookup_prog    = skel->progs.select_sock_a,
 741                         .reuseport_prog = skel->progs.select_sock_b,
 742                         .sock_map       = skel->maps.redir_map,
 743                         .sotype         = SOCK_DGRAM,
 744                         .connect_to     = { EXT_IP4, EXT_PORT },
 745                         .listen_at      = { INT_IP4, INT_PORT },
 746                         .accept_on      = SERVER_B,
 747                         .reuseport_has_conns = true,
 748                 },
 749                 {
 750                         .desc           = "UDP IPv4 redir skip reuseport",
 751                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 752                         .reuseport_prog = skel->progs.select_sock_b,
 753                         .sock_map       = skel->maps.redir_map,
 754                         .sotype         = SOCK_DGRAM,
 755                         .connect_to     = { EXT_IP4, EXT_PORT },
 756                         .listen_at      = { INT_IP4, INT_PORT },
 757                         .accept_on      = SERVER_A,
 758                 },
 759                 {
 760                         .desc           = "UDP IPv6 redir port",
 761                         .lookup_prog    = skel->progs.redir_port,
 762                         .sock_map       = skel->maps.redir_map,
 763                         .sotype         = SOCK_DGRAM,
 764                         .connect_to     = { EXT_IP6, EXT_PORT },
 765                         .listen_at      = { EXT_IP6, INT_PORT },
 766                 },
 767                 {
 768                         .desc           = "UDP IPv6 redir addr",
 769                         .lookup_prog    = skel->progs.redir_ip6,
 770                         .sock_map       = skel->maps.redir_map,
 771                         .sotype         = SOCK_DGRAM,
 772                         .connect_to     = { EXT_IP6, EXT_PORT },
 773                         .listen_at      = { INT_IP6, EXT_PORT },
 774                 },
 775                 {
 776                         .desc           = "UDP IPv4->IPv6 redir port",
 777                         .lookup_prog    = skel->progs.redir_port,
 778                         .sock_map       = skel->maps.redir_map,
 779                         .sotype         = SOCK_DGRAM,
 780                         .listen_at      = { INT_IP4_V6, INT_PORT },
 781                         .connect_to     = { EXT_IP4, EXT_PORT },
 782                 },
 783                 {
 784                         .desc           = "UDP IPv6 redir and reuseport",
 785                         .lookup_prog    = skel->progs.select_sock_a,
 786                         .reuseport_prog = skel->progs.select_sock_b,
 787                         .sock_map       = skel->maps.redir_map,
 788                         .sotype         = SOCK_DGRAM,
 789                         .connect_to     = { EXT_IP6, EXT_PORT },
 790                         .listen_at      = { INT_IP6, INT_PORT },
 791                         .accept_on      = SERVER_B,
 792                 },
 793                 {
 794                         .desc           = "UDP IPv6 redir and reuseport with conns",
 795                         .lookup_prog    = skel->progs.select_sock_a,
 796                         .reuseport_prog = skel->progs.select_sock_b,
 797                         .sock_map       = skel->maps.redir_map,
 798                         .sotype         = SOCK_DGRAM,
 799                         .connect_to     = { EXT_IP6, EXT_PORT },
 800                         .listen_at      = { INT_IP6, INT_PORT },
 801                         .accept_on      = SERVER_B,
 802                         .reuseport_has_conns = true,
 803                 },
 804                 {
 805                         .desc           = "UDP IPv6 redir skip reuseport",
 806                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 807                         .reuseport_prog = skel->progs.select_sock_b,
 808                         .sock_map       = skel->maps.redir_map,
 809                         .sotype         = SOCK_DGRAM,
 810                         .connect_to     = { EXT_IP6, EXT_PORT },
 811                         .listen_at      = { INT_IP6, INT_PORT },
 812                         .accept_on      = SERVER_A,
 813                 },
 814         };
 815         const struct test *t;
 816
 817         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
 818                 if (test__start_subtest(t->desc))
 819                         run_lookup_prog(t);
 820         }
 821 }
 822
 823 static void drop_on_lookup(const struct test *t)
 824 {
 825         struct sockaddr_storage dst = {};
 826         int client_fd, server_fd, err;
 827         struct bpf_link *lookup_link;
 828         ssize_t n;
 829
 830         lookup_link = attach_lookup_prog(t->lookup_prog);
 831         if (!lookup_link)
 832                 return;
 833
 834         server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
 835                                 t->reuseport_prog);
 836         if (server_fd < 0)
 837                 goto detach;
 838
 839         client_fd = make_socket(t->sotype, t->connect_to.ip,
 840                                 t->connect_to.port, &dst);
 841         if (client_fd < 0)
 842                 goto close_srv;
 843
 844         err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
 845         if (t->sotype == SOCK_DGRAM) {
 846                 err = send_byte(client_fd);
 847                 if (err)
 848                         goto close_all;
 849
 850                 /* Read out asynchronous error */
 851                 n = recv(client_fd, NULL, 0, 0);
 852                 err = n == -1;
 853         }
 854         if (CHECK(!err || errno != ECONNREFUSED, "connect",
 855                   "unexpected success or error\n"))
 856                 log_err("expected ECONNREFUSED on connect");
 857
 858 close_all:
 859         close(client_fd);
 860 close_srv:
 861         close(server_fd);
 862 detach:
 863         bpf_link__destroy(lookup_link);
 864 }
 865
 866 static void test_drop_on_lookup(struct test_sk_lookup *skel)
 867 {
 868         const struct test tests[] = {
 869                 {
 870                         .desc           = "TCP IPv4 drop on lookup",
 871                         .lookup_prog    = skel->progs.lookup_drop,
 872                         .sotype         = SOCK_STREAM,
 873                         .connect_to     = { EXT_IP4, EXT_PORT },
 874                         .listen_at      = { EXT_IP4, EXT_PORT },
 875                 },
 876                 {
 877                         .desc           = "TCP IPv6 drop on lookup",
 878                         .lookup_prog    = skel->progs.lookup_drop,
 879                         .sotype         = SOCK_STREAM,
 880                         .connect_to     = { EXT_IP6, EXT_PORT },
 881                         .listen_at      = { EXT_IP6, EXT_PORT },
 882                 },
 883                 {
 884                         .desc           = "UDP IPv4 drop on lookup",
 885                         .lookup_prog    = skel->progs.lookup_drop,
 886                         .sotype         = SOCK_DGRAM,
 887                         .connect_to     = { EXT_IP4, EXT_PORT },
 888                         .listen_at      = { EXT_IP4, EXT_PORT },
 889                 },
 890                 {
 891                         .desc           = "UDP IPv6 drop on lookup",
 892                         .lookup_prog    = skel->progs.lookup_drop,
 893                         .sotype         = SOCK_DGRAM,
 894                         .connect_to     = { EXT_IP6, EXT_PORT },
 895                         .listen_at      = { EXT_IP6, INT_PORT },
 896                 },
 897         };
 898         const struct test *t;
 899
 900         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
 901                 if (test__start_subtest(t->desc))
 902                         drop_on_lookup(t);
 903         }
 904 }
 905
 906 static void drop_on_reuseport(const struct test *t)
 907 {
 908         struct sockaddr_storage dst = { 0 };
 909         int client, server1, server2, err;
 910         struct bpf_link *lookup_link;
 911         ssize_t n;
 912
 913         lookup_link = attach_lookup_prog(t->lookup_prog);
 914         if (!lookup_link)
 915                 return;
 916
 917         server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
 918                               t->reuseport_prog);
 919         if (server1 < 0)
 920                 goto detach;
 921
 922         err = update_lookup_map(t->sock_map, SERVER_A, server1);
 923         if (err)
 924                 goto detach;
 925
 926         /* second server on destination address we should never reach */
 927         server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
 928                               NULL /* reuseport prog */);
 929         if (server2 < 0)
 930                 goto close_srv1;
 931
 932         client = make_socket(t->sotype, t->connect_to.ip,
 933                              t->connect_to.port, &dst);
 934         if (client < 0)
 935                 goto close_srv2;
 936
 937         err = connect(client, (void *)&dst, inetaddr_len(&dst));
 938         if (t->sotype == SOCK_DGRAM) {
 939                 err = send_byte(client);
 940                 if (err)
 941                         goto close_all;
 942
 943                 /* Read out asynchronous error */
 944                 n = recv(client, NULL, 0, 0);
 945                 err = n == -1;
 946         }
 947         if (CHECK(!err || errno != ECONNREFUSED, "connect",
 948                   "unexpected success or error\n"))
 949                 log_err("expected ECONNREFUSED on connect");
 950
 951 close_all:
 952         close(client);
 953 close_srv2:
 954         close(server2);
 955 close_srv1:
 956         close(server1);
 957 detach:
 958         bpf_link__destroy(lookup_link);
 959 }
 960
 961 static void test_drop_on_reuseport(struct test_sk_lookup *skel)
 962 {
 963         const struct test tests[] = {
 964                 {
 965                         .desc           = "TCP IPv4 drop on reuseport",
 966                         .lookup_prog    = skel->progs.select_sock_a,
 967                         .reuseport_prog = skel->progs.reuseport_drop,
 968                         .sock_map       = skel->maps.redir_map,
 969                         .sotype         = SOCK_STREAM,
 970                         .connect_to     = { EXT_IP4, EXT_PORT },
 971                         .listen_at      = { INT_IP4, INT_PORT },
 972                 },
 973                 {
 974                         .desc           = "TCP IPv6 drop on reuseport",
 975                         .lookup_prog    = skel->progs.select_sock_a,
 976                         .reuseport_prog = skel->progs.reuseport_drop,
 977                         .sock_map       = skel->maps.redir_map,
 978                         .sotype         = SOCK_STREAM,
 979                         .connect_to     = { EXT_IP6, EXT_PORT },
 980                         .listen_at      = { INT_IP6, INT_PORT },
 981                 },
 982                 {
 983                         .desc           = "UDP IPv4 drop on reuseport",
 984                         .lookup_prog    = skel->progs.select_sock_a,
 985                         .reuseport_prog = skel->progs.reuseport_drop,
 986                         .sock_map       = skel->maps.redir_map,
 987                         .sotype         = SOCK_DGRAM,
 988                         .connect_to     = { EXT_IP4, EXT_PORT },
 989                         .listen_at      = { INT_IP4, INT_PORT },
 990                 },
 991                 {
 992                         .desc           = "TCP IPv6 drop on reuseport",
 993                         .lookup_prog    = skel->progs.select_sock_a,
 994                         .reuseport_prog = skel->progs.reuseport_drop,
 995                         .sock_map       = skel->maps.redir_map,
 996                         .sotype         = SOCK_STREAM,
 997                         .connect_to     = { EXT_IP6, EXT_PORT },
 998                         .listen_at      = { INT_IP6, INT_PORT },
 999                 },
1000         };
1001         const struct test *t;
1002
1003         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1004                 if (test__start_subtest(t->desc))
1005                         drop_on_reuseport(t);
1006         }
1007 }
1008
1009 static void run_sk_assign(struct test_sk_lookup *skel,
1010                           struct bpf_program *lookup_prog,
1011                           const char *listen_ip, const char *connect_ip)
1012 {
1013         int client_fd, peer_fd, server_fds[MAX_SERVERS] = { -1 };
1014         struct bpf_link *lookup_link;
1015         int i, err;
1016
1017         lookup_link = attach_lookup_prog(lookup_prog);
1018         if (!lookup_link)
1019                 return;
1020
1021         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1022                 server_fds[i] = make_server(SOCK_STREAM, listen_ip, 0, NULL);
1023                 if (server_fds[i] < 0)
1024                         goto close_servers;
1025
1026                 err = update_lookup_map(skel->maps.redir_map, i,
1027                                         server_fds[i]);
1028                 if (err)
1029                         goto close_servers;
1030         }
1031
1032         client_fd = make_client(SOCK_STREAM, connect_ip, EXT_PORT);
1033         if (client_fd < 0)
1034                 goto close_servers;
1035
1036         peer_fd = accept(server_fds[SERVER_B], NULL, NULL);
1037         if (CHECK(peer_fd < 0, "accept", "failed\n"))
1038                 goto close_client;
1039
1040         close(peer_fd);
1041 close_client:
1042         close(client_fd);
1043 close_servers:
1044         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1045                 if (server_fds[i] != -1)
1046                         close(server_fds[i]);
1047         }
1048         bpf_link__destroy(lookup_link);
1049 }
1050
1051 static void run_sk_assign_v4(struct test_sk_lookup *skel,
1052                              struct bpf_program *lookup_prog)
1053 {
1054         run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4);
1055 }
1056
1057 static void run_sk_assign_v6(struct test_sk_lookup *skel,
1058                              struct bpf_program *lookup_prog)
1059 {
1060         run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6);
1061 }
1062
1063 static void run_sk_assign_connected(struct test_sk_lookup *skel,
1064                                     int sotype)
1065 {
1066         int err, client_fd, connected_fd, server_fd;
1067         struct bpf_link *lookup_link;
1068
1069         server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL);
1070         if (server_fd < 0)
1071                 return;
1072
1073         connected_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1074         if (connected_fd < 0)
1075                 goto out_close_server;
1076
1077         /* Put a connected socket in redirect map */
1078         err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd);
1079         if (err)
1080                 goto out_close_connected;
1081
1082         lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport);
1083         if (!lookup_link)
1084                 goto out_close_connected;
1085
1086         /* Try to redirect TCP SYN / UDP packet to a connected socket */
1087         client_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1088         if (client_fd < 0)
1089                 goto out_unlink_prog;
1090         if (sotype == SOCK_DGRAM) {
1091                 send_byte(client_fd);
1092                 recv_byte(server_fd);
1093         }
1094
1095         close(client_fd);
1096 out_unlink_prog:
1097         bpf_link__destroy(lookup_link);
1098 out_close_connected:
1099         close(connected_fd);
1100 out_close_server:
1101         close(server_fd);
1102 }
1103
1104 static void test_sk_assign_helper(struct test_sk_lookup *skel)
1105 {
1106         if (test__start_subtest("sk_assign returns EEXIST"))
1107                 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist);
1108         if (test__start_subtest("sk_assign honors F_REPLACE"))
1109                 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag);
1110         if (test__start_subtest("sk_assign accepts NULL socket"))
1111                 run_sk_assign_v4(skel, skel->progs.sk_assign_null);
1112         if (test__start_subtest("access ctx->sk"))
1113                 run_sk_assign_v4(skel, skel->progs.access_ctx_sk);
1114         if (test__start_subtest("narrow access to ctx v4"))
1115                 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access);
1116         if (test__start_subtest("narrow access to ctx v6"))
1117                 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access);
1118         if (test__start_subtest("sk_assign rejects TCP established"))
1119                 run_sk_assign_connected(skel, SOCK_STREAM);
1120         if (test__start_subtest("sk_assign rejects UDP connected"))
1121                 run_sk_assign_connected(skel, SOCK_DGRAM);
1122 }
1123
1124 struct test_multi_prog {
1125         const char *desc;
1126         struct bpf_program *prog1;
1127         struct bpf_program *prog2;
1128         struct bpf_map *redir_map;
1129         struct bpf_map *run_map;
1130         int expect_errno;
1131         struct inet_addr listen_at;
1132 };
1133
1134 static void run_multi_prog_lookup(const struct test_multi_prog *t)
1135 {
1136         struct sockaddr_storage dst = {};
1137         int map_fd, server_fd, client_fd;
1138         struct bpf_link *link1, *link2;
1139         int prog_idx, done, err;
1140
1141         map_fd = bpf_map__fd(t->run_map);
1142
1143         done = 0;
1144         prog_idx = PROG1;
1145         err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1146         if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1147                 return;
1148         prog_idx = PROG2;
1149         err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1150         if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1151                 return;
1152
1153         link1 = attach_lookup_prog(t->prog1);
1154         if (!link1)
1155                 return;
1156         link2 = attach_lookup_prog(t->prog2);
1157         if (!link2)
1158                 goto out_unlink1;
1159
1160         server_fd = make_server(SOCK_STREAM, t->listen_at.ip,
1161                                 t->listen_at.port, NULL);
1162         if (server_fd < 0)
1163                 goto out_unlink2;
1164
1165         err = update_lookup_map(t->redir_map, SERVER_A, server_fd);
1166         if (err)
1167                 goto out_close_server;
1168
1169         client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst);
1170         if (client_fd < 0)
1171                 goto out_close_server;
1172
1173         err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
1174         if (CHECK(err && !t->expect_errno, "connect",
1175                   "unexpected error %d\n", errno))
1176                 goto out_close_client;
1177         if (CHECK(err && t->expect_errno && errno != t->expect_errno,
1178                   "connect", "unexpected error %d\n", errno))
1179                 goto out_close_client;
1180
1181         done = 0;
1182         prog_idx = PROG1;
1183         err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1184         CHECK(err, "bpf_map_lookup_elem", "failed\n");
1185         CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n");
1186
1187         done = 0;
1188         prog_idx = PROG2;
1189         err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1190         CHECK(err, "bpf_map_lookup_elem", "failed\n");
1191         CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n");
1192
1193 out_close_client:
1194         close(client_fd);
1195 out_close_server:
1196         close(server_fd);
1197 out_unlink2:
1198         bpf_link__destroy(link2);
1199 out_unlink1:
1200         bpf_link__destroy(link1);
1201 }
1202
1203 static void test_multi_prog_lookup(struct test_sk_lookup *skel)
1204 {
1205         struct test_multi_prog tests[] = {
1206                 {
1207                         .desc           = "multi prog - pass, pass",
1208                         .prog1          = skel->progs.multi_prog_pass1,
1209                         .prog2          = skel->progs.multi_prog_pass2,
1210                         .listen_at      = { EXT_IP4, EXT_PORT },
1211                 },
1212                 {
1213                         .desc           = "multi prog - drop, drop",
1214                         .prog1          = skel->progs.multi_prog_drop1,
1215                         .prog2          = skel->progs.multi_prog_drop2,
1216                         .listen_at      = { EXT_IP4, EXT_PORT },
1217                         .expect_errno   = ECONNREFUSED,
1218                 },
1219                 {
1220                         .desc           = "multi prog - pass, drop",
1221                         .prog1          = skel->progs.multi_prog_pass1,
1222                         .prog2          = skel->progs.multi_prog_drop2,
1223                         .listen_at      = { EXT_IP4, EXT_PORT },
1224                         .expect_errno   = ECONNREFUSED,
1225                 },
1226                 {
1227                         .desc           = "multi prog - drop, pass",
1228                         .prog1          = skel->progs.multi_prog_drop1,
1229                         .prog2          = skel->progs.multi_prog_pass2,
1230                         .listen_at      = { EXT_IP4, EXT_PORT },
1231                         .expect_errno   = ECONNREFUSED,
1232                 },
1233                 {
1234                         .desc           = "multi prog - pass, redir",
1235                         .prog1          = skel->progs.multi_prog_pass1,
1236                         .prog2          = skel->progs.multi_prog_redir2,
1237                         .listen_at      = { INT_IP4, INT_PORT },
1238                 },
1239                 {
1240                         .desc           = "multi prog - redir, pass",
1241                         .prog1          = skel->progs.multi_prog_redir1,
1242                         .prog2          = skel->progs.multi_prog_pass2,
1243                         .listen_at      = { INT_IP4, INT_PORT },
1244                 },
1245                 {
1246                         .desc           = "multi prog - drop, redir",
1247                         .prog1          = skel->progs.multi_prog_drop1,
1248                         .prog2          = skel->progs.multi_prog_redir2,
1249                         .listen_at      = { INT_IP4, INT_PORT },
1250                 },
1251                 {
1252                         .desc           = "multi prog - redir, drop",
1253                         .prog1          = skel->progs.multi_prog_redir1,
1254                         .prog2          = skel->progs.multi_prog_drop2,
1255                         .listen_at      = { INT_IP4, INT_PORT },
1256                 },
1257                 {
1258                         .desc           = "multi prog - redir, redir",
1259                         .prog1          = skel->progs.multi_prog_redir1,
1260                         .prog2          = skel->progs.multi_prog_redir2,
1261                         .listen_at      = { INT_IP4, INT_PORT },
1262                 },
1263         };
1264         struct test_multi_prog *t;
1265
1266         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1267                 t->redir_map = skel->maps.redir_map;
1268                 t->run_map = skel->maps.run_map;
1269                 if (test__start_subtest(t->desc))
1270                         run_multi_prog_lookup(t);
1271         }
1272 }
1273
1274 static void run_tests(struct test_sk_lookup *skel)
1275 {
1276         if (test__start_subtest("query lookup prog"))
1277                 query_lookup_prog(skel);
1278         test_redirect_lookup(skel);
1279         test_drop_on_lookup(skel);
1280         test_drop_on_reuseport(skel);
1281         test_sk_assign_helper(skel);
1282         test_multi_prog_lookup(skel);
1283 }
1284
1285 static int switch_netns(void)
1286 {
1287         static const char * const setup_script[] = {
1288                 "ip -6 addr add dev lo " EXT_IP6 "/128",
1289                 "ip -6 addr add dev lo " INT_IP6 "/128",
1290                 "ip link set dev lo up",
1291                 NULL,
1292         };
1293         const char * const *cmd;
1294         int err;
1295
1296         err = unshare(CLONE_NEWNET);
1297         if (CHECK(err, "unshare", "failed\n")) {
1298                 log_err("unshare(CLONE_NEWNET)");
1299                 return -1;
1300         }
1301
1302         for (cmd = setup_script; *cmd; cmd++) {
1303                 err = system(*cmd);
1304                 if (CHECK(err, "system", "failed\n")) {
1305                         log_err("system(%s)", *cmd);
1306                         return -1;
1307                 }
1308         }
1309
1310         return 0;
1311 }
1312
1313 void test_sk_lookup(void)
1314 {
1315         struct test_sk_lookup *skel;
1316         int err;
1317
1318         err = switch_netns();
1319         if (err)
1320                 return;
1321
1322         skel = test_sk_lookup__open_and_load();
1323         if (CHECK(!skel, "skel open_and_load", "failed\n"))
1324                 return;
1325
1326         run_tests(skel);
1327
1328         test_sk_lookup__destroy(skel);
1329 }