tools/testing/selftests/bpf/prog_tests/sk_lookup.c

   1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
   2 // Copyright (c) 2020 Cloudflare
   3 /*
   4  * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP).
   5  *
   6  * Tests exercise:
   7  *  - attaching/detaching/querying programs to BPF_SK_LOOKUP hook,
   8  *  - redirecting socket lookup to a socket selected by BPF program,
   9  *  - failing a socket lookup on BPF program's request,
  10  *  - error scenarios for selecting a socket from BPF program,
  11  *  - accessing BPF program context,
  12  *  - attaching and running multiple BPF programs.
  13  *
  14  * Tests run in a dedicated network namespace.
  15  */
  16
  17 #define _GNU_SOURCE
  18 #include <arpa/inet.h>
  19 #include <assert.h>
  20 #include <errno.h>
  21 #include <error.h>
  22 #include <fcntl.h>
  23 #include <sched.h>
  24 #include <stdio.h>
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <unistd.h>
  28
  29 #include <bpf/libbpf.h>
  30 #include <bpf/bpf.h>
  31
  32 #include "test_progs.h"
  33 #include "bpf_rlimit.h"
  34 #include "bpf_util.h"
  35 #include "cgroup_helpers.h"
  36 #include "network_helpers.h"
  37 #include "testing_helpers.h"
  38 #include "test_sk_lookup.skel.h"
  39
  40 /* External (address, port) pairs the client sends packets to. */
  41 #define EXT_IP4         "127.0.0.1"
  42 #define EXT_IP6         "fd00::1"
  43 #define EXT_PORT        7007
  44
  45 /* Internal (address, port) pairs the server listens/receives at. */
  46 #define INT_IP4         "127.0.0.2"
  47 #define INT_IP4_V6      "::ffff:127.0.0.2"
  48 #define INT_IP6         "fd00::2"
  49 #define INT_PORT        8008
  50
  51 #define IO_TIMEOUT_SEC  3
  52
  53 enum server {
  54         SERVER_A = 0,
  55         SERVER_B = 1,
  56         MAX_SERVERS,
  57 };
  58
  59 enum {
  60         PROG1 = 0,
  61         PROG2,
  62 };
  63
  64 struct inet_addr {
  65         const char *ip;
  66         unsigned short port;
  67 };
  68
  69 struct test {
  70         const char *desc;
  71         struct bpf_program *lookup_prog;
  72         struct bpf_program *reuseport_prog;
  73         struct bpf_map *sock_map;
  74         int sotype;
  75         struct inet_addr connect_to;
  76         struct inet_addr listen_at;
  77         enum server accept_on;
  78         bool reuseport_has_conns; /* Add a connected socket to reuseport group */
  79 };
  80
  81 static __u32 duration;          /* for CHECK macro */
  82
  83 static bool is_ipv6(const char *ip)
  84 {
  85         return !!strchr(ip, ':');
  86 }
  87
  88 static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog)
  89 {
  90         int err, prog_fd;
  91
  92         prog_fd = bpf_program__fd(reuseport_prog);
  93         if (prog_fd < 0) {
  94                 errno = -prog_fd;
  95                 return -1;
  96         }
  97
  98         err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF,
  99                          &prog_fd, sizeof(prog_fd));
 100         if (err)
 101                 return -1;
 102
 103         return 0;
 104 }
 105
 106 static socklen_t inetaddr_len(const struct sockaddr_storage *addr)
 107 {
 108         return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) :
 109                 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0);
 110 }
 111
 112 static int make_socket(int sotype, const char *ip, int port,
 113                        struct sockaddr_storage *addr)
 114 {
 115         struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC };
 116         int err, family, fd;
 117
 118         family = is_ipv6(ip) ? AF_INET6 : AF_INET;
 119         err = make_sockaddr(family, ip, port, addr, NULL);
 120         if (CHECK(err, "make_address", "failed\n"))
 121                 return -1;
 122
 123         fd = socket(addr->ss_family, sotype, 0);
 124         if (CHECK(fd < 0, "socket", "failed\n")) {
 125                 log_err("failed to make socket");
 126                 return -1;
 127         }
 128
 129         err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
 130         if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) {
 131                 log_err("failed to set SNDTIMEO");
 132                 close(fd);
 133                 return -1;
 134         }
 135
 136         err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
 137         if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) {
 138                 log_err("failed to set RCVTIMEO");
 139                 close(fd);
 140                 return -1;
 141         }
 142
 143         return fd;
 144 }
 145
 146 static int make_server(int sotype, const char *ip, int port,
 147                        struct bpf_program *reuseport_prog)
 148 {
 149         struct sockaddr_storage addr = {0};
 150         const int one = 1;
 151         int err, fd = -1;
 152
 153         fd = make_socket(sotype, ip, port, &addr);
 154         if (fd < 0)
 155                 return -1;
 156
 157         /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */
 158         if (sotype == SOCK_DGRAM) {
 159                 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one,
 160                                  sizeof(one));
 161                 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) {
 162                         log_err("failed to enable IP_RECVORIGDSTADDR");
 163                         goto fail;
 164                 }
 165         }
 166
 167         if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) {
 168                 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one,
 169                                  sizeof(one));
 170                 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) {
 171                         log_err("failed to enable IPV6_RECVORIGDSTADDR");
 172                         goto fail;
 173                 }
 174         }
 175
 176         if (sotype == SOCK_STREAM) {
 177                 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
 178                                  sizeof(one));
 179                 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) {
 180                         log_err("failed to enable SO_REUSEADDR");
 181                         goto fail;
 182                 }
 183         }
 184
 185         if (reuseport_prog) {
 186                 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one,
 187                                  sizeof(one));
 188                 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) {
 189                         log_err("failed to enable SO_REUSEPORT");
 190                         goto fail;
 191                 }
 192         }
 193
 194         err = bind(fd, (void *)&addr, inetaddr_len(&addr));
 195         if (CHECK(err, "bind", "failed\n")) {
 196                 log_err("failed to bind listen socket");
 197                 goto fail;
 198         }
 199
 200         if (sotype == SOCK_STREAM) {
 201                 err = listen(fd, SOMAXCONN);
 202                 if (CHECK(err, "make_server", "listen")) {
 203                         log_err("failed to listen on port %d", port);
 204                         goto fail;
 205                 }
 206         }
 207
 208         /* Late attach reuseport prog so we can have one init path */
 209         if (reuseport_prog) {
 210                 err = attach_reuseport(fd, reuseport_prog);
 211                 if (CHECK(err, "attach_reuseport", "failed\n")) {
 212                         log_err("failed to attach reuseport prog");
 213                         goto fail;
 214                 }
 215         }
 216
 217         return fd;
 218 fail:
 219         close(fd);
 220         return -1;
 221 }
 222
 223 static int make_client(int sotype, const char *ip, int port)
 224 {
 225         struct sockaddr_storage addr = {0};
 226         int err, fd;
 227
 228         fd = make_socket(sotype, ip, port, &addr);
 229         if (fd < 0)
 230                 return -1;
 231
 232         err = connect(fd, (void *)&addr, inetaddr_len(&addr));
 233         if (CHECK(err, "make_client", "connect")) {
 234                 log_err("failed to connect client socket");
 235                 goto fail;
 236         }
 237
 238         return fd;
 239 fail:
 240         close(fd);
 241         return -1;
 242 }
 243
 244 static __u64 socket_cookie(int fd)
 245 {
 246         __u64 cookie;
 247         socklen_t cookie_len = sizeof(cookie);
 248
 249         if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0,
 250                   "getsockopt(SO_COOKIE)", "%s\n", strerror(errno)))
 251                 return 0;
 252         return cookie;
 253 }
 254
 255 static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port,
 256                               const char *remote_ip, __u16 remote_port)
 257 {
 258         void *local, *remote;
 259         int err;
 260
 261         memset(ctx, 0, sizeof(*ctx));
 262         ctx->local_port = local_port;
 263         ctx->remote_port = htons(remote_port);
 264
 265         if (is_ipv6(local_ip)) {
 266                 ctx->family = AF_INET6;
 267                 local = &ctx->local_ip6[0];
 268                 remote = &ctx->remote_ip6[0];
 269         } else {
 270                 ctx->family = AF_INET;
 271                 local = &ctx->local_ip4;
 272                 remote = &ctx->remote_ip4;
 273         }
 274
 275         err = inet_pton(ctx->family, local_ip, local);
 276         if (CHECK(err != 1, "inet_pton", "local_ip failed\n"))
 277                 return 1;
 278
 279         err = inet_pton(ctx->family, remote_ip, remote);
 280         if (CHECK(err != 1, "inet_pton", "remote_ip failed\n"))
 281                 return 1;
 282
 283         return 0;
 284 }
 285
 286 static int send_byte(int fd)
 287 {
 288         ssize_t n;
 289
 290         errno = 0;
 291         n = send(fd, "a", 1, 0);
 292         if (CHECK(n <= 0, "send_byte", "send")) {
 293                 log_err("failed/partial send");
 294                 return -1;
 295         }
 296         return 0;
 297 }
 298
 299 static int recv_byte(int fd)
 300 {
 301         char buf[1];
 302         ssize_t n;
 303
 304         n = recv(fd, buf, sizeof(buf), 0);
 305         if (CHECK(n <= 0, "recv_byte", "recv")) {
 306                 log_err("failed/partial recv");
 307                 return -1;
 308         }
 309         return 0;
 310 }
 311
 312 static int tcp_recv_send(int server_fd)
 313 {
 314         char buf[1];
 315         int ret, fd;
 316         ssize_t n;
 317
 318         fd = accept(server_fd, NULL, NULL);
 319         if (CHECK(fd < 0, "accept", "failed\n")) {
 320                 log_err("failed to accept");
 321                 return -1;
 322         }
 323
 324         n = recv(fd, buf, sizeof(buf), 0);
 325         if (CHECK(n <= 0, "recv", "failed\n")) {
 326                 log_err("failed/partial recv");
 327                 ret = -1;
 328                 goto close;
 329         }
 330
 331         n = send(fd, buf, n, 0);
 332         if (CHECK(n <= 0, "send", "failed\n")) {
 333                 log_err("failed/partial send");
 334                 ret = -1;
 335                 goto close;
 336         }
 337
 338         ret = 0;
 339 close:
 340         close(fd);
 341         return ret;
 342 }
 343
 344 static void v4_to_v6(struct sockaddr_storage *ss)
 345 {
 346         struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss;
 347         struct sockaddr_in v4 = *(struct sockaddr_in *)ss;
 348
 349         v6->sin6_family = AF_INET6;
 350         v6->sin6_port = v4.sin_port;
 351         v6->sin6_addr.s6_addr[10] = 0xff;
 352         v6->sin6_addr.s6_addr[11] = 0xff;
 353         memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4);
 354         memset(&v6->sin6_addr.s6_addr[0], 0, 10);
 355 }
 356
 357 static int udp_recv_send(int server_fd)
 358 {
 359         char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
 360         struct sockaddr_storage _src_addr = { 0 };
 361         struct sockaddr_storage *src_addr = &_src_addr;
 362         struct sockaddr_storage *dst_addr = NULL;
 363         struct msghdr msg = { 0 };
 364         struct iovec iov = { 0 };
 365         struct cmsghdr *cm;
 366         char buf[1];
 367         int ret, fd;
 368         ssize_t n;
 369
 370         iov.iov_base = buf;
 371         iov.iov_len = sizeof(buf);
 372
 373         msg.msg_name = src_addr;
 374         msg.msg_namelen = sizeof(*src_addr);
 375         msg.msg_iov = &iov;
 376         msg.msg_iovlen = 1;
 377         msg.msg_control = cmsg_buf;
 378         msg.msg_controllen = sizeof(cmsg_buf);
 379
 380         errno = 0;
 381         n = recvmsg(server_fd, &msg, 0);
 382         if (CHECK(n <= 0, "recvmsg", "failed\n")) {
 383                 log_err("failed to receive");
 384                 return -1;
 385         }
 386         if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n"))
 387                 return -1;
 388
 389         for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) {
 390                 if ((cm->cmsg_level == SOL_IP &&
 391                      cm->cmsg_type == IP_ORIGDSTADDR) ||
 392                     (cm->cmsg_level == SOL_IPV6 &&
 393                      cm->cmsg_type == IPV6_ORIGDSTADDR)) {
 394                         dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm);
 395                         break;
 396                 }
 397                 log_err("warning: ignored cmsg at level %d type %d",
 398                         cm->cmsg_level, cm->cmsg_type);
 399         }
 400         if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n"))
 401                 return -1;
 402
 403         /* Server socket bound to IPv4-mapped IPv6 address */
 404         if (src_addr->ss_family == AF_INET6 &&
 405             dst_addr->ss_family == AF_INET) {
 406                 v4_to_v6(dst_addr);
 407         }
 408
 409         /* Reply from original destination address. */
 410         fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0);
 411         if (CHECK(fd < 0, "socket", "failed\n")) {
 412                 log_err("failed to create tx socket");
 413                 return -1;
 414         }
 415
 416         ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr));
 417         if (CHECK(ret, "bind", "failed\n")) {
 418                 log_err("failed to bind tx socket");
 419                 goto out;
 420         }
 421
 422         msg.msg_control = NULL;
 423         msg.msg_controllen = 0;
 424         n = sendmsg(fd, &msg, 0);
 425         if (CHECK(n <= 0, "sendmsg", "failed\n")) {
 426                 log_err("failed to send echo reply");
 427                 ret = -1;
 428                 goto out;
 429         }
 430
 431         ret = 0;
 432 out:
 433         close(fd);
 434         return ret;
 435 }
 436
 437 static int tcp_echo_test(int client_fd, int server_fd)
 438 {
 439         int err;
 440
 441         err = send_byte(client_fd);
 442         if (err)
 443                 return -1;
 444         err = tcp_recv_send(server_fd);
 445         if (err)
 446                 return -1;
 447         err = recv_byte(client_fd);
 448         if (err)
 449                 return -1;
 450
 451         return 0;
 452 }
 453
 454 static int udp_echo_test(int client_fd, int server_fd)
 455 {
 456         int err;
 457
 458         err = send_byte(client_fd);
 459         if (err)
 460                 return -1;
 461         err = udp_recv_send(server_fd);
 462         if (err)
 463                 return -1;
 464         err = recv_byte(client_fd);
 465         if (err)
 466                 return -1;
 467
 468         return 0;
 469 }
 470
 471 static struct bpf_link *attach_lookup_prog(struct bpf_program *prog)
 472 {
 473         struct bpf_link *link;
 474         int net_fd;
 475
 476         net_fd = open("/proc/self/ns/net", O_RDONLY);
 477         if (CHECK(net_fd < 0, "open", "failed\n")) {
 478                 log_err("failed to open /proc/self/ns/net");
 479                 return NULL;
 480         }
 481
 482         link = bpf_program__attach_netns(prog, net_fd);
 483         if (CHECK(IS_ERR(link), "bpf_program__attach_netns", "failed\n")) {
 484                 errno = -PTR_ERR(link);
 485                 log_err("failed to attach program '%s' to netns",
 486                         bpf_program__name(prog));
 487                 link = NULL;
 488         }
 489
 490         close(net_fd);
 491         return link;
 492 }
 493
 494 static int update_lookup_map(struct bpf_map *map, int index, int sock_fd)
 495 {
 496         int err, map_fd;
 497         uint64_t value;
 498
 499         map_fd = bpf_map__fd(map);
 500         if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) {
 501                 errno = -map_fd;
 502                 log_err("failed to get map FD");
 503                 return -1;
 504         }
 505
 506         value = (uint64_t)sock_fd;
 507         err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST);
 508         if (CHECK(err, "bpf_map_update_elem", "failed\n")) {
 509                 log_err("failed to update redir_map @ %d", index);
 510                 return -1;
 511         }
 512
 513         return 0;
 514 }
 515
 516 static void query_lookup_prog(struct test_sk_lookup *skel)
 517 {
 518         struct bpf_link *link[3] = {};
 519         struct bpf_link_info info;
 520         __u32 attach_flags = 0;
 521         __u32 prog_ids[3] = {};
 522         __u32 prog_cnt = 3;
 523         __u32 prog_id;
 524         int net_fd;
 525         int err;
 526
 527         net_fd = open("/proc/self/ns/net", O_RDONLY);
 528         if (CHECK(net_fd < 0, "open", "failed\n")) {
 529                 log_err("failed to open /proc/self/ns/net");
 530                 return;
 531         }
 532
 533         link[0] = attach_lookup_prog(skel->progs.lookup_pass);
 534         if (!link[0])
 535                 goto close;
 536         link[1] = attach_lookup_prog(skel->progs.lookup_pass);
 537         if (!link[1])
 538                 goto detach;
 539         link[2] = attach_lookup_prog(skel->progs.lookup_drop);
 540         if (!link[2])
 541                 goto detach;
 542
 543         err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */,
 544                              &attach_flags, prog_ids, &prog_cnt);
 545         if (CHECK(err, "bpf_prog_query", "failed\n")) {
 546                 log_err("failed to query lookup prog");
 547                 goto detach;
 548         }
 549
 550         errno = 0;
 551         if (CHECK(attach_flags != 0, "bpf_prog_query",
 552                   "wrong attach_flags on query: %u", attach_flags))
 553                 goto detach;
 554         if (CHECK(prog_cnt != 3, "bpf_prog_query",
 555                   "wrong program count on query: %u", prog_cnt))
 556                 goto detach;
 557         prog_id = link_info_prog_id(link[0], &info);
 558         CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
 559               "invalid program #0 id on query: %u != %u\n",
 560               prog_ids[0], prog_id);
 561         CHECK(info.netns.netns_ino == 0, "netns_ino",
 562               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 563         prog_id = link_info_prog_id(link[1], &info);
 564         CHECK(prog_ids[1] != prog_id, "bpf_prog_query",
 565               "invalid program #1 id on query: %u != %u\n",
 566               prog_ids[1], prog_id);
 567         CHECK(info.netns.netns_ino == 0, "netns_ino",
 568               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 569         prog_id = link_info_prog_id(link[2], &info);
 570         CHECK(prog_ids[2] != prog_id, "bpf_prog_query",
 571               "invalid program #2 id on query: %u != %u\n",
 572               prog_ids[2], prog_id);
 573         CHECK(info.netns.netns_ino == 0, "netns_ino",
 574               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 575
 576         err = bpf_link__detach(link[0]);
 577         if (CHECK(err, "link_detach", "failed %d\n", err))
 578                 goto detach;
 579
 580         /* prog id is still there, but netns_ino is zeroed out */
 581         prog_id = link_info_prog_id(link[0], &info);
 582         CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
 583               "invalid program #0 id on query: %u != %u\n",
 584               prog_ids[0], prog_id);
 585         CHECK(info.netns.netns_ino != 0, "netns_ino",
 586               "unexpected netns_ino: %u\n", info.netns.netns_ino);
 587
 588 detach:
 589         if (link[2])
 590                 bpf_link__destroy(link[2]);
 591         if (link[1])
 592                 bpf_link__destroy(link[1]);
 593         if (link[0])
 594                 bpf_link__destroy(link[0]);
 595 close:
 596         close(net_fd);
 597 }
 598
 599 static void run_lookup_prog(const struct test *t)
 600 {
 601         int server_fds[MAX_SERVERS] = { -1 };
 602         int client_fd, reuse_conn_fd = -1;
 603         struct bpf_link *lookup_link;
 604         int i, err;
 605
 606         lookup_link = attach_lookup_prog(t->lookup_prog);
 607         if (!lookup_link)
 608                 return;
 609
 610         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
 611                 server_fds[i] = make_server(t->sotype, t->listen_at.ip,
 612                                             t->listen_at.port,
 613                                             t->reuseport_prog);
 614                 if (server_fds[i] < 0)
 615                         goto close;
 616
 617                 err = update_lookup_map(t->sock_map, i, server_fds[i]);
 618                 if (err)
 619                         goto close;
 620
 621                 /* want just one server for non-reuseport test */
 622                 if (!t->reuseport_prog)
 623                         break;
 624         }
 625
 626         /* Regular UDP socket lookup with reuseport behaves
 627          * differently when reuseport group contains connected
 628          * sockets. Check that adding a connected UDP socket to the
 629          * reuseport group does not affect how reuseport works with
 630          * BPF socket lookup.
 631          */
 632         if (t->reuseport_has_conns) {
 633                 struct sockaddr_storage addr = {};
 634                 socklen_t len = sizeof(addr);
 635
 636                 /* Add an extra socket to reuseport group */
 637                 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip,
 638                                             t->listen_at.port,
 639                                             t->reuseport_prog);
 640                 if (reuse_conn_fd < 0)
 641                         goto close;
 642
 643                 /* Connect the extra socket to itself */
 644                 err = getsockname(reuse_conn_fd, (void *)&addr, &len);
 645                 if (CHECK(err, "getsockname", "errno %d\n", errno))
 646                         goto close;
 647                 err = connect(reuse_conn_fd, (void *)&addr, len);
 648                 if (CHECK(err, "connect", "errno %d\n", errno))
 649                         goto close;
 650         }
 651
 652         client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port);
 653         if (client_fd < 0)
 654                 goto close;
 655
 656         if (t->sotype == SOCK_STREAM)
 657                 tcp_echo_test(client_fd, server_fds[t->accept_on]);
 658         else
 659                 udp_echo_test(client_fd, server_fds[t->accept_on]);
 660
 661         close(client_fd);
 662 close:
 663         if (reuse_conn_fd != -1)
 664                 close(reuse_conn_fd);
 665         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
 666                 if (server_fds[i] != -1)
 667                         close(server_fds[i]);
 668         }
 669         bpf_link__destroy(lookup_link);
 670 }
 671
 672 static void test_redirect_lookup(struct test_sk_lookup *skel)
 673 {
 674         const struct test tests[] = {
 675                 {
 676                         .desc           = "TCP IPv4 redir port",
 677                         .lookup_prog    = skel->progs.redir_port,
 678                         .sock_map       = skel->maps.redir_map,
 679                         .sotype         = SOCK_STREAM,
 680                         .connect_to     = { EXT_IP4, EXT_PORT },
 681                         .listen_at      = { EXT_IP4, INT_PORT },
 682                 },
 683                 {
 684                         .desc           = "TCP IPv4 redir addr",
 685                         .lookup_prog    = skel->progs.redir_ip4,
 686                         .sock_map       = skel->maps.redir_map,
 687                         .sotype         = SOCK_STREAM,
 688                         .connect_to     = { EXT_IP4, EXT_PORT },
 689                         .listen_at      = { INT_IP4, EXT_PORT },
 690                 },
 691                 {
 692                         .desc           = "TCP IPv4 redir with reuseport",
 693                         .lookup_prog    = skel->progs.select_sock_a,
 694                         .reuseport_prog = skel->progs.select_sock_b,
 695                         .sock_map       = skel->maps.redir_map,
 696                         .sotype         = SOCK_STREAM,
 697                         .connect_to     = { EXT_IP4, EXT_PORT },
 698                         .listen_at      = { INT_IP4, INT_PORT },
 699                         .accept_on      = SERVER_B,
 700                 },
 701                 {
 702                         .desc           = "TCP IPv4 redir skip reuseport",
 703                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 704                         .reuseport_prog = skel->progs.select_sock_b,
 705                         .sock_map       = skel->maps.redir_map,
 706                         .sotype         = SOCK_STREAM,
 707                         .connect_to     = { EXT_IP4, EXT_PORT },
 708                         .listen_at      = { INT_IP4, INT_PORT },
 709                         .accept_on      = SERVER_A,
 710                 },
 711                 {
 712                         .desc           = "TCP IPv6 redir port",
 713                         .lookup_prog    = skel->progs.redir_port,
 714                         .sock_map       = skel->maps.redir_map,
 715                         .sotype         = SOCK_STREAM,
 716                         .connect_to     = { EXT_IP6, EXT_PORT },
 717                         .listen_at      = { EXT_IP6, INT_PORT },
 718                 },
 719                 {
 720                         .desc           = "TCP IPv6 redir addr",
 721                         .lookup_prog    = skel->progs.redir_ip6,
 722                         .sock_map       = skel->maps.redir_map,
 723                         .sotype         = SOCK_STREAM,
 724                         .connect_to     = { EXT_IP6, EXT_PORT },
 725                         .listen_at      = { INT_IP6, EXT_PORT },
 726                 },
 727                 {
 728                         .desc           = "TCP IPv4->IPv6 redir port",
 729                         .lookup_prog    = skel->progs.redir_port,
 730                         .sock_map       = skel->maps.redir_map,
 731                         .sotype         = SOCK_STREAM,
 732                         .connect_to     = { EXT_IP4, EXT_PORT },
 733                         .listen_at      = { INT_IP4_V6, INT_PORT },
 734                 },
 735                 {
 736                         .desc           = "TCP IPv6 redir with reuseport",
 737                         .lookup_prog    = skel->progs.select_sock_a,
 738                         .reuseport_prog = skel->progs.select_sock_b,
 739                         .sock_map       = skel->maps.redir_map,
 740                         .sotype         = SOCK_STREAM,
 741                         .connect_to     = { EXT_IP6, EXT_PORT },
 742                         .listen_at      = { INT_IP6, INT_PORT },
 743                         .accept_on      = SERVER_B,
 744                 },
 745                 {
 746                         .desc           = "TCP IPv6 redir skip reuseport",
 747                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 748                         .reuseport_prog = skel->progs.select_sock_b,
 749                         .sock_map       = skel->maps.redir_map,
 750                         .sotype         = SOCK_STREAM,
 751                         .connect_to     = { EXT_IP6, EXT_PORT },
 752                         .listen_at      = { INT_IP6, INT_PORT },
 753                         .accept_on      = SERVER_A,
 754                 },
 755                 {
 756                         .desc           = "UDP IPv4 redir port",
 757                         .lookup_prog    = skel->progs.redir_port,
 758                         .sock_map       = skel->maps.redir_map,
 759                         .sotype         = SOCK_DGRAM,
 760                         .connect_to     = { EXT_IP4, EXT_PORT },
 761                         .listen_at      = { EXT_IP4, INT_PORT },
 762                 },
 763                 {
 764                         .desc           = "UDP IPv4 redir addr",
 765                         .lookup_prog    = skel->progs.redir_ip4,
 766                         .sock_map       = skel->maps.redir_map,
 767                         .sotype         = SOCK_DGRAM,
 768                         .connect_to     = { EXT_IP4, EXT_PORT },
 769                         .listen_at      = { INT_IP4, EXT_PORT },
 770                 },
 771                 {
 772                         .desc           = "UDP IPv4 redir with reuseport",
 773                         .lookup_prog    = skel->progs.select_sock_a,
 774                         .reuseport_prog = skel->progs.select_sock_b,
 775                         .sock_map       = skel->maps.redir_map,
 776                         .sotype         = SOCK_DGRAM,
 777                         .connect_to     = { EXT_IP4, EXT_PORT },
 778                         .listen_at      = { INT_IP4, INT_PORT },
 779                         .accept_on      = SERVER_B,
 780                 },
 781                 {
 782                         .desc           = "UDP IPv4 redir and reuseport with conns",
 783                         .lookup_prog    = skel->progs.select_sock_a,
 784                         .reuseport_prog = skel->progs.select_sock_b,
 785                         .sock_map       = skel->maps.redir_map,
 786                         .sotype         = SOCK_DGRAM,
 787                         .connect_to     = { EXT_IP4, EXT_PORT },
 788                         .listen_at      = { INT_IP4, INT_PORT },
 789                         .accept_on      = SERVER_B,
 790                         .reuseport_has_conns = true,
 791                 },
 792                 {
 793                         .desc           = "UDP IPv4 redir skip reuseport",
 794                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 795                         .reuseport_prog = skel->progs.select_sock_b,
 796                         .sock_map       = skel->maps.redir_map,
 797                         .sotype         = SOCK_DGRAM,
 798                         .connect_to     = { EXT_IP4, EXT_PORT },
 799                         .listen_at      = { INT_IP4, INT_PORT },
 800                         .accept_on      = SERVER_A,
 801                 },
 802                 {
 803                         .desc           = "UDP IPv6 redir port",
 804                         .lookup_prog    = skel->progs.redir_port,
 805                         .sock_map       = skel->maps.redir_map,
 806                         .sotype         = SOCK_DGRAM,
 807                         .connect_to     = { EXT_IP6, EXT_PORT },
 808                         .listen_at      = { EXT_IP6, INT_PORT },
 809                 },
 810                 {
 811                         .desc           = "UDP IPv6 redir addr",
 812                         .lookup_prog    = skel->progs.redir_ip6,
 813                         .sock_map       = skel->maps.redir_map,
 814                         .sotype         = SOCK_DGRAM,
 815                         .connect_to     = { EXT_IP6, EXT_PORT },
 816                         .listen_at      = { INT_IP6, EXT_PORT },
 817                 },
 818                 {
 819                         .desc           = "UDP IPv4->IPv6 redir port",
 820                         .lookup_prog    = skel->progs.redir_port,
 821                         .sock_map       = skel->maps.redir_map,
 822                         .sotype         = SOCK_DGRAM,
 823                         .listen_at      = { INT_IP4_V6, INT_PORT },
 824                         .connect_to     = { EXT_IP4, EXT_PORT },
 825                 },
 826                 {
 827                         .desc           = "UDP IPv6 redir and reuseport",
 828                         .lookup_prog    = skel->progs.select_sock_a,
 829                         .reuseport_prog = skel->progs.select_sock_b,
 830                         .sock_map       = skel->maps.redir_map,
 831                         .sotype         = SOCK_DGRAM,
 832                         .connect_to     = { EXT_IP6, EXT_PORT },
 833                         .listen_at      = { INT_IP6, INT_PORT },
 834                         .accept_on      = SERVER_B,
 835                 },
 836                 {
 837                         .desc           = "UDP IPv6 redir and reuseport with conns",
 838                         .lookup_prog    = skel->progs.select_sock_a,
 839                         .reuseport_prog = skel->progs.select_sock_b,
 840                         .sock_map       = skel->maps.redir_map,
 841                         .sotype         = SOCK_DGRAM,
 842                         .connect_to     = { EXT_IP6, EXT_PORT },
 843                         .listen_at      = { INT_IP6, INT_PORT },
 844                         .accept_on      = SERVER_B,
 845                         .reuseport_has_conns = true,
 846                 },
 847                 {
 848                         .desc           = "UDP IPv6 redir skip reuseport",
 849                         .lookup_prog    = skel->progs.select_sock_a_no_reuseport,
 850                         .reuseport_prog = skel->progs.select_sock_b,
 851                         .sock_map       = skel->maps.redir_map,
 852                         .sotype         = SOCK_DGRAM,
 853                         .connect_to     = { EXT_IP6, EXT_PORT },
 854                         .listen_at      = { INT_IP6, INT_PORT },
 855                         .accept_on      = SERVER_A,
 856                 },
 857         };
 858         const struct test *t;
 859
 860         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
 861                 if (test__start_subtest(t->desc))
 862                         run_lookup_prog(t);
 863         }
 864 }
 865
 866 static void drop_on_lookup(const struct test *t)
 867 {
 868         struct sockaddr_storage dst = {};
 869         int client_fd, server_fd, err;
 870         struct bpf_link *lookup_link;
 871         ssize_t n;
 872
 873         lookup_link = attach_lookup_prog(t->lookup_prog);
 874         if (!lookup_link)
 875                 return;
 876
 877         server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
 878                                 t->reuseport_prog);
 879         if (server_fd < 0)
 880                 goto detach;
 881
 882         client_fd = make_socket(t->sotype, t->connect_to.ip,
 883                                 t->connect_to.port, &dst);
 884         if (client_fd < 0)
 885                 goto close_srv;
 886
 887         err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
 888         if (t->sotype == SOCK_DGRAM) {
 889                 err = send_byte(client_fd);
 890                 if (err)
 891                         goto close_all;
 892
 893                 /* Read out asynchronous error */
 894                 n = recv(client_fd, NULL, 0, 0);
 895                 err = n == -1;
 896         }
 897         if (CHECK(!err || errno != ECONNREFUSED, "connect",
 898                   "unexpected success or error\n"))
 899                 log_err("expected ECONNREFUSED on connect");
 900
 901 close_all:
 902         close(client_fd);
 903 close_srv:
 904         close(server_fd);
 905 detach:
 906         bpf_link__destroy(lookup_link);
 907 }
 908
 909 static void test_drop_on_lookup(struct test_sk_lookup *skel)
 910 {
 911         const struct test tests[] = {
 912                 {
 913                         .desc           = "TCP IPv4 drop on lookup",
 914                         .lookup_prog    = skel->progs.lookup_drop,
 915                         .sotype         = SOCK_STREAM,
 916                         .connect_to     = { EXT_IP4, EXT_PORT },
 917                         .listen_at      = { EXT_IP4, EXT_PORT },
 918                 },
 919                 {
 920                         .desc           = "TCP IPv6 drop on lookup",
 921                         .lookup_prog    = skel->progs.lookup_drop,
 922                         .sotype         = SOCK_STREAM,
 923                         .connect_to     = { EXT_IP6, EXT_PORT },
 924                         .listen_at      = { EXT_IP6, EXT_PORT },
 925                 },
 926                 {
 927                         .desc           = "UDP IPv4 drop on lookup",
 928                         .lookup_prog    = skel->progs.lookup_drop,
 929                         .sotype         = SOCK_DGRAM,
 930                         .connect_to     = { EXT_IP4, EXT_PORT },
 931                         .listen_at      = { EXT_IP4, EXT_PORT },
 932                 },
 933                 {
 934                         .desc           = "UDP IPv6 drop on lookup",
 935                         .lookup_prog    = skel->progs.lookup_drop,
 936                         .sotype         = SOCK_DGRAM,
 937                         .connect_to     = { EXT_IP6, EXT_PORT },
 938                         .listen_at      = { EXT_IP6, INT_PORT },
 939                 },
 940         };
 941         const struct test *t;
 942
 943         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
 944                 if (test__start_subtest(t->desc))
 945                         drop_on_lookup(t);
 946         }
 947 }
 948
 949 static void drop_on_reuseport(const struct test *t)
 950 {
 951         struct sockaddr_storage dst = { 0 };
 952         int client, server1, server2, err;
 953         struct bpf_link *lookup_link;
 954         ssize_t n;
 955
 956         lookup_link = attach_lookup_prog(t->lookup_prog);
 957         if (!lookup_link)
 958                 return;
 959
 960         server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
 961                               t->reuseport_prog);
 962         if (server1 < 0)
 963                 goto detach;
 964
 965         err = update_lookup_map(t->sock_map, SERVER_A, server1);
 966         if (err)
 967                 goto detach;
 968
 969         /* second server on destination address we should never reach */
 970         server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
 971                               NULL /* reuseport prog */);
 972         if (server2 < 0)
 973                 goto close_srv1;
 974
 975         client = make_socket(t->sotype, t->connect_to.ip,
 976                              t->connect_to.port, &dst);
 977         if (client < 0)
 978                 goto close_srv2;
 979
 980         err = connect(client, (void *)&dst, inetaddr_len(&dst));
 981         if (t->sotype == SOCK_DGRAM) {
 982                 err = send_byte(client);
 983                 if (err)
 984                         goto close_all;
 985
 986                 /* Read out asynchronous error */
 987                 n = recv(client, NULL, 0, 0);
 988                 err = n == -1;
 989         }
 990         if (CHECK(!err || errno != ECONNREFUSED, "connect",
 991                   "unexpected success or error\n"))
 992                 log_err("expected ECONNREFUSED on connect");
 993
 994 close_all:
 995         close(client);
 996 close_srv2:
 997         close(server2);
 998 close_srv1:
 999         close(server1);
1000 detach:
1001         bpf_link__destroy(lookup_link);
1002 }
1003
1004 static void test_drop_on_reuseport(struct test_sk_lookup *skel)
1005 {
1006         const struct test tests[] = {
1007                 {
1008                         .desc           = "TCP IPv4 drop on reuseport",
1009                         .lookup_prog    = skel->progs.select_sock_a,
1010                         .reuseport_prog = skel->progs.reuseport_drop,
1011                         .sock_map       = skel->maps.redir_map,
1012                         .sotype         = SOCK_STREAM,
1013                         .connect_to     = { EXT_IP4, EXT_PORT },
1014                         .listen_at      = { INT_IP4, INT_PORT },
1015                 },
1016                 {
1017                         .desc           = "TCP IPv6 drop on reuseport",
1018                         .lookup_prog    = skel->progs.select_sock_a,
1019                         .reuseport_prog = skel->progs.reuseport_drop,
1020                         .sock_map       = skel->maps.redir_map,
1021                         .sotype         = SOCK_STREAM,
1022                         .connect_to     = { EXT_IP6, EXT_PORT },
1023                         .listen_at      = { INT_IP6, INT_PORT },
1024                 },
1025                 {
1026                         .desc           = "UDP IPv4 drop on reuseport",
1027                         .lookup_prog    = skel->progs.select_sock_a,
1028                         .reuseport_prog = skel->progs.reuseport_drop,
1029                         .sock_map       = skel->maps.redir_map,
1030                         .sotype         = SOCK_DGRAM,
1031                         .connect_to     = { EXT_IP4, EXT_PORT },
1032                         .listen_at      = { INT_IP4, INT_PORT },
1033                 },
1034                 {
1035                         .desc           = "TCP IPv6 drop on reuseport",
1036                         .lookup_prog    = skel->progs.select_sock_a,
1037                         .reuseport_prog = skel->progs.reuseport_drop,
1038                         .sock_map       = skel->maps.redir_map,
1039                         .sotype         = SOCK_STREAM,
1040                         .connect_to     = { EXT_IP6, EXT_PORT },
1041                         .listen_at      = { INT_IP6, INT_PORT },
1042                 },
1043         };
1044         const struct test *t;
1045
1046         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1047                 if (test__start_subtest(t->desc))
1048                         drop_on_reuseport(t);
1049         }
1050 }
1051
1052 static void run_sk_assign(struct test_sk_lookup *skel,
1053                           struct bpf_program *lookup_prog,
1054                           const char *remote_ip, const char *local_ip)
1055 {
1056         int server_fds[MAX_SERVERS] = { -1 };
1057         struct bpf_sk_lookup ctx;
1058         __u64 server_cookie;
1059         int i, err;
1060
1061         DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
1062                 .ctx_in = &ctx,
1063                 .ctx_size_in = sizeof(ctx),
1064                 .ctx_out = &ctx,
1065                 .ctx_size_out = sizeof(ctx),
1066         );
1067
1068         if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT))
1069                 return;
1070
1071         ctx.protocol = IPPROTO_TCP;
1072
1073         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1074                 server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL);
1075                 if (server_fds[i] < 0)
1076                         goto close_servers;
1077
1078                 err = update_lookup_map(skel->maps.redir_map, i,
1079                                         server_fds[i]);
1080                 if (err)
1081                         goto close_servers;
1082         }
1083
1084         server_cookie = socket_cookie(server_fds[SERVER_B]);
1085         if (!server_cookie)
1086                 return;
1087
1088         err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts);
1089         if (CHECK(err, "test_run", "failed with error %d\n", errno))
1090                 goto close_servers;
1091
1092         if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n"))
1093                 goto close_servers;
1094
1095         CHECK(ctx.cookie != server_cookie, "ctx.cookie",
1096               "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie);
1097
1098 close_servers:
1099         for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1100                 if (server_fds[i] != -1)
1101                         close(server_fds[i]);
1102         }
1103 }
1104
1105 static void run_sk_assign_v4(struct test_sk_lookup *skel,
1106                              struct bpf_program *lookup_prog)
1107 {
1108         run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4);
1109 }
1110
1111 static void run_sk_assign_v6(struct test_sk_lookup *skel,
1112                              struct bpf_program *lookup_prog)
1113 {
1114         run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6);
1115 }
1116
1117 static void run_sk_assign_connected(struct test_sk_lookup *skel,
1118                                     int sotype)
1119 {
1120         int err, client_fd, connected_fd, server_fd;
1121         struct bpf_link *lookup_link;
1122
1123         server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL);
1124         if (server_fd < 0)
1125                 return;
1126
1127         connected_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1128         if (connected_fd < 0)
1129                 goto out_close_server;
1130
1131         /* Put a connected socket in redirect map */
1132         err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd);
1133         if (err)
1134                 goto out_close_connected;
1135
1136         lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport);
1137         if (!lookup_link)
1138                 goto out_close_connected;
1139
1140         /* Try to redirect TCP SYN / UDP packet to a connected socket */
1141         client_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1142         if (client_fd < 0)
1143                 goto out_unlink_prog;
1144         if (sotype == SOCK_DGRAM) {
1145                 send_byte(client_fd);
1146                 recv_byte(server_fd);
1147         }
1148
1149         close(client_fd);
1150 out_unlink_prog:
1151         bpf_link__destroy(lookup_link);
1152 out_close_connected:
1153         close(connected_fd);
1154 out_close_server:
1155         close(server_fd);
1156 }
1157
1158 static void test_sk_assign_helper(struct test_sk_lookup *skel)
1159 {
1160         if (test__start_subtest("sk_assign returns EEXIST"))
1161                 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist);
1162         if (test__start_subtest("sk_assign honors F_REPLACE"))
1163                 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag);
1164         if (test__start_subtest("sk_assign accepts NULL socket"))
1165                 run_sk_assign_v4(skel, skel->progs.sk_assign_null);
1166         if (test__start_subtest("access ctx->sk"))
1167                 run_sk_assign_v4(skel, skel->progs.access_ctx_sk);
1168         if (test__start_subtest("narrow access to ctx v4"))
1169                 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access);
1170         if (test__start_subtest("narrow access to ctx v6"))
1171                 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access);
1172         if (test__start_subtest("sk_assign rejects TCP established"))
1173                 run_sk_assign_connected(skel, SOCK_STREAM);
1174         if (test__start_subtest("sk_assign rejects UDP connected"))
1175                 run_sk_assign_connected(skel, SOCK_DGRAM);
1176 }
1177
1178 struct test_multi_prog {
1179         const char *desc;
1180         struct bpf_program *prog1;
1181         struct bpf_program *prog2;
1182         struct bpf_map *redir_map;
1183         struct bpf_map *run_map;
1184         int expect_errno;
1185         struct inet_addr listen_at;
1186 };
1187
1188 static void run_multi_prog_lookup(const struct test_multi_prog *t)
1189 {
1190         struct sockaddr_storage dst = {};
1191         int map_fd, server_fd, client_fd;
1192         struct bpf_link *link1, *link2;
1193         int prog_idx, done, err;
1194
1195         map_fd = bpf_map__fd(t->run_map);
1196
1197         done = 0;
1198         prog_idx = PROG1;
1199         err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1200         if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1201                 return;
1202         prog_idx = PROG2;
1203         err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1204         if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1205                 return;
1206
1207         link1 = attach_lookup_prog(t->prog1);
1208         if (!link1)
1209                 return;
1210         link2 = attach_lookup_prog(t->prog2);
1211         if (!link2)
1212                 goto out_unlink1;
1213
1214         server_fd = make_server(SOCK_STREAM, t->listen_at.ip,
1215                                 t->listen_at.port, NULL);
1216         if (server_fd < 0)
1217                 goto out_unlink2;
1218
1219         err = update_lookup_map(t->redir_map, SERVER_A, server_fd);
1220         if (err)
1221                 goto out_close_server;
1222
1223         client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst);
1224         if (client_fd < 0)
1225                 goto out_close_server;
1226
1227         err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
1228         if (CHECK(err && !t->expect_errno, "connect",
1229                   "unexpected error %d\n", errno))
1230                 goto out_close_client;
1231         if (CHECK(err && t->expect_errno && errno != t->expect_errno,
1232                   "connect", "unexpected error %d\n", errno))
1233                 goto out_close_client;
1234
1235         done = 0;
1236         prog_idx = PROG1;
1237         err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1238         CHECK(err, "bpf_map_lookup_elem", "failed\n");
1239         CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n");
1240
1241         done = 0;
1242         prog_idx = PROG2;
1243         err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1244         CHECK(err, "bpf_map_lookup_elem", "failed\n");
1245         CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n");
1246
1247 out_close_client:
1248         close(client_fd);
1249 out_close_server:
1250         close(server_fd);
1251 out_unlink2:
1252         bpf_link__destroy(link2);
1253 out_unlink1:
1254         bpf_link__destroy(link1);
1255 }
1256
1257 static void test_multi_prog_lookup(struct test_sk_lookup *skel)
1258 {
1259         struct test_multi_prog tests[] = {
1260                 {
1261                         .desc           = "multi prog - pass, pass",
1262                         .prog1          = skel->progs.multi_prog_pass1,
1263                         .prog2          = skel->progs.multi_prog_pass2,
1264                         .listen_at      = { EXT_IP4, EXT_PORT },
1265                 },
1266                 {
1267                         .desc           = "multi prog - drop, drop",
1268                         .prog1          = skel->progs.multi_prog_drop1,
1269                         .prog2          = skel->progs.multi_prog_drop2,
1270                         .listen_at      = { EXT_IP4, EXT_PORT },
1271                         .expect_errno   = ECONNREFUSED,
1272                 },
1273                 {
1274                         .desc           = "multi prog - pass, drop",
1275                         .prog1          = skel->progs.multi_prog_pass1,
1276                         .prog2          = skel->progs.multi_prog_drop2,
1277                         .listen_at      = { EXT_IP4, EXT_PORT },
1278                         .expect_errno   = ECONNREFUSED,
1279                 },
1280                 {
1281                         .desc           = "multi prog - drop, pass",
1282                         .prog1          = skel->progs.multi_prog_drop1,
1283                         .prog2          = skel->progs.multi_prog_pass2,
1284                         .listen_at      = { EXT_IP4, EXT_PORT },
1285                         .expect_errno   = ECONNREFUSED,
1286                 },
1287                 {
1288                         .desc           = "multi prog - pass, redir",
1289                         .prog1          = skel->progs.multi_prog_pass1,
1290                         .prog2          = skel->progs.multi_prog_redir2,
1291                         .listen_at      = { INT_IP4, INT_PORT },
1292                 },
1293                 {
1294                         .desc           = "multi prog - redir, pass",
1295                         .prog1          = skel->progs.multi_prog_redir1,
1296                         .prog2          = skel->progs.multi_prog_pass2,
1297                         .listen_at      = { INT_IP4, INT_PORT },
1298                 },
1299                 {
1300                         .desc           = "multi prog - drop, redir",
1301                         .prog1          = skel->progs.multi_prog_drop1,
1302                         .prog2          = skel->progs.multi_prog_redir2,
1303                         .listen_at      = { INT_IP4, INT_PORT },
1304                 },
1305                 {
1306                         .desc           = "multi prog - redir, drop",
1307                         .prog1          = skel->progs.multi_prog_redir1,
1308                         .prog2          = skel->progs.multi_prog_drop2,
1309                         .listen_at      = { INT_IP4, INT_PORT },
1310                 },
1311                 {
1312                         .desc           = "multi prog - redir, redir",
1313                         .prog1          = skel->progs.multi_prog_redir1,
1314                         .prog2          = skel->progs.multi_prog_redir2,
1315                         .listen_at      = { INT_IP4, INT_PORT },
1316                 },
1317         };
1318         struct test_multi_prog *t;
1319
1320         for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1321                 t->redir_map = skel->maps.redir_map;
1322                 t->run_map = skel->maps.run_map;
1323                 if (test__start_subtest(t->desc))
1324                         run_multi_prog_lookup(t);
1325         }
1326 }
1327
1328 static void run_tests(struct test_sk_lookup *skel)
1329 {
1330         if (test__start_subtest("query lookup prog"))
1331                 query_lookup_prog(skel);
1332         test_redirect_lookup(skel);
1333         test_drop_on_lookup(skel);
1334         test_drop_on_reuseport(skel);
1335         test_sk_assign_helper(skel);
1336         test_multi_prog_lookup(skel);
1337 }
1338
1339 static int switch_netns(void)
1340 {
1341         static const char * const setup_script[] = {
1342                 "ip -6 addr add dev lo " EXT_IP6 "/128",
1343                 "ip -6 addr add dev lo " INT_IP6 "/128",
1344                 "ip link set dev lo up",
1345                 NULL,
1346         };
1347         const char * const *cmd;
1348         int err;
1349
1350         err = unshare(CLONE_NEWNET);
1351         if (CHECK(err, "unshare", "failed\n")) {
1352                 log_err("unshare(CLONE_NEWNET)");
1353                 return -1;
1354         }
1355
1356         for (cmd = setup_script; *cmd; cmd++) {
1357                 err = system(*cmd);
1358                 if (CHECK(err, "system", "failed\n")) {
1359                         log_err("system(%s)", *cmd);
1360                         return -1;
1361                 }
1362         }
1363
1364         return 0;
1365 }
1366
1367 void test_sk_lookup(void)
1368 {
1369         struct test_sk_lookup *skel;
1370         int err;
1371
1372         err = switch_netns();
1373         if (err)
1374                 return;
1375
1376         skel = test_sk_lookup__open_and_load();
1377         if (CHECK(!skel, "skel open_and_load", "failed\n"))
1378                 return;
1379
1380         run_tests(skel);
1381
1382         test_sk_lookup__destroy(skel);
1383 }