1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 // Copyright (c) 2020 Cloudflare
4 * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP).
7 * - attaching/detaching/querying programs to BPF_SK_LOOKUP hook,
8 * - redirecting socket lookup to a socket selected by BPF program,
9 * - failing a socket lookup on BPF program's request,
10 * - error scenarios for selecting a socket from BPF program,
11 * - accessing BPF program context,
12 * - attaching and running multiple BPF programs.
14 * Tests run in a dedicated network namespace.
18 #include <arpa/inet.h>
25 #include <sys/types.h>
29 #include <bpf/libbpf.h>
32 #include "test_progs.h"
33 #include "bpf_rlimit.h"
35 #include "cgroup_helpers.h"
36 #include "network_helpers.h"
37 #include "testing_helpers.h"
38 #include "test_sk_lookup.skel.h"
40 /* External (address, port) pairs the client sends packets to. */
41 #define EXT_IP4 "127.0.0.1"
42 #define EXT_IP6 "fd00::1"
45 /* Internal (address, port) pairs the server listens/receives at. */
46 #define INT_IP4 "127.0.0.2"
47 #define INT_IP4_V6 "::ffff:127.0.0.2"
48 #define INT_IP6 "fd00::2"
51 #define IO_TIMEOUT_SEC 3
71 struct bpf_program *lookup_prog;
72 struct bpf_program *reuseport_prog;
73 struct bpf_map *sock_map;
75 struct inet_addr connect_to;
76 struct inet_addr listen_at;
77 enum server accept_on;
78 bool reuseport_has_conns; /* Add a connected socket to reuseport group */
81 static __u32 duration; /* for CHECK macro */
83 static bool is_ipv6(const char *ip)
85 return !!strchr(ip, ':');
88 static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog)
92 prog_fd = bpf_program__fd(reuseport_prog);
98 err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF,
99 &prog_fd, sizeof(prog_fd));
106 static socklen_t inetaddr_len(const struct sockaddr_storage *addr)
108 return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) :
109 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0);
112 static int make_socket(int sotype, const char *ip, int port,
113 struct sockaddr_storage *addr)
115 struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC };
118 family = is_ipv6(ip) ? AF_INET6 : AF_INET;
119 err = make_sockaddr(family, ip, port, addr, NULL);
120 if (CHECK(err, "make_address", "failed\n"))
123 fd = socket(addr->ss_family, sotype, 0);
124 if (CHECK(fd < 0, "socket", "failed\n")) {
125 log_err("failed to make socket");
129 err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
130 if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) {
131 log_err("failed to set SNDTIMEO");
136 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
137 if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) {
138 log_err("failed to set RCVTIMEO");
146 static int make_server(int sotype, const char *ip, int port,
147 struct bpf_program *reuseport_prog)
149 struct sockaddr_storage addr = {0};
153 fd = make_socket(sotype, ip, port, &addr);
157 /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */
158 if (sotype == SOCK_DGRAM) {
159 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one,
161 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) {
162 log_err("failed to enable IP_RECVORIGDSTADDR");
167 if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) {
168 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one,
170 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) {
171 log_err("failed to enable IPV6_RECVORIGDSTADDR");
176 if (sotype == SOCK_STREAM) {
177 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
179 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) {
180 log_err("failed to enable SO_REUSEADDR");
185 if (reuseport_prog) {
186 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one,
188 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) {
189 log_err("failed to enable SO_REUSEPORT");
194 err = bind(fd, (void *)&addr, inetaddr_len(&addr));
195 if (CHECK(err, "bind", "failed\n")) {
196 log_err("failed to bind listen socket");
200 if (sotype == SOCK_STREAM) {
201 err = listen(fd, SOMAXCONN);
202 if (CHECK(err, "make_server", "listen")) {
203 log_err("failed to listen on port %d", port);
208 /* Late attach reuseport prog so we can have one init path */
209 if (reuseport_prog) {
210 err = attach_reuseport(fd, reuseport_prog);
211 if (CHECK(err, "attach_reuseport", "failed\n")) {
212 log_err("failed to attach reuseport prog");
223 static int make_client(int sotype, const char *ip, int port)
225 struct sockaddr_storage addr = {0};
228 fd = make_socket(sotype, ip, port, &addr);
232 err = connect(fd, (void *)&addr, inetaddr_len(&addr));
233 if (CHECK(err, "make_client", "connect")) {
234 log_err("failed to connect client socket");
244 static __u64 socket_cookie(int fd)
247 socklen_t cookie_len = sizeof(cookie);
249 if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0,
250 "getsockopt(SO_COOKIE)", "%s\n", strerror(errno)))
255 static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port,
256 const char *remote_ip, __u16 remote_port)
258 void *local, *remote;
261 memset(ctx, 0, sizeof(*ctx));
262 ctx->local_port = local_port;
263 ctx->remote_port = htons(remote_port);
265 if (is_ipv6(local_ip)) {
266 ctx->family = AF_INET6;
267 local = &ctx->local_ip6[0];
268 remote = &ctx->remote_ip6[0];
270 ctx->family = AF_INET;
271 local = &ctx->local_ip4;
272 remote = &ctx->remote_ip4;
275 err = inet_pton(ctx->family, local_ip, local);
276 if (CHECK(err != 1, "inet_pton", "local_ip failed\n"))
279 err = inet_pton(ctx->family, remote_ip, remote);
280 if (CHECK(err != 1, "inet_pton", "remote_ip failed\n"))
286 static int send_byte(int fd)
291 n = send(fd, "a", 1, 0);
292 if (CHECK(n <= 0, "send_byte", "send")) {
293 log_err("failed/partial send");
299 static int recv_byte(int fd)
304 n = recv(fd, buf, sizeof(buf), 0);
305 if (CHECK(n <= 0, "recv_byte", "recv")) {
306 log_err("failed/partial recv");
312 static int tcp_recv_send(int server_fd)
318 fd = accept(server_fd, NULL, NULL);
319 if (CHECK(fd < 0, "accept", "failed\n")) {
320 log_err("failed to accept");
324 n = recv(fd, buf, sizeof(buf), 0);
325 if (CHECK(n <= 0, "recv", "failed\n")) {
326 log_err("failed/partial recv");
331 n = send(fd, buf, n, 0);
332 if (CHECK(n <= 0, "send", "failed\n")) {
333 log_err("failed/partial send");
344 static void v4_to_v6(struct sockaddr_storage *ss)
346 struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss;
347 struct sockaddr_in v4 = *(struct sockaddr_in *)ss;
349 v6->sin6_family = AF_INET6;
350 v6->sin6_port = v4.sin_port;
351 v6->sin6_addr.s6_addr[10] = 0xff;
352 v6->sin6_addr.s6_addr[11] = 0xff;
353 memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4);
354 memset(&v6->sin6_addr.s6_addr[0], 0, 10);
357 static int udp_recv_send(int server_fd)
359 char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
360 struct sockaddr_storage _src_addr = { 0 };
361 struct sockaddr_storage *src_addr = &_src_addr;
362 struct sockaddr_storage *dst_addr = NULL;
363 struct msghdr msg = { 0 };
364 struct iovec iov = { 0 };
371 iov.iov_len = sizeof(buf);
373 msg.msg_name = src_addr;
374 msg.msg_namelen = sizeof(*src_addr);
377 msg.msg_control = cmsg_buf;
378 msg.msg_controllen = sizeof(cmsg_buf);
381 n = recvmsg(server_fd, &msg, 0);
382 if (CHECK(n <= 0, "recvmsg", "failed\n")) {
383 log_err("failed to receive");
386 if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n"))
389 for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) {
390 if ((cm->cmsg_level == SOL_IP &&
391 cm->cmsg_type == IP_ORIGDSTADDR) ||
392 (cm->cmsg_level == SOL_IPV6 &&
393 cm->cmsg_type == IPV6_ORIGDSTADDR)) {
394 dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm);
397 log_err("warning: ignored cmsg at level %d type %d",
398 cm->cmsg_level, cm->cmsg_type);
400 if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n"))
403 /* Server socket bound to IPv4-mapped IPv6 address */
404 if (src_addr->ss_family == AF_INET6 &&
405 dst_addr->ss_family == AF_INET) {
409 /* Reply from original destination address. */
410 fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0);
411 if (CHECK(fd < 0, "socket", "failed\n")) {
412 log_err("failed to create tx socket");
416 ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr));
417 if (CHECK(ret, "bind", "failed\n")) {
418 log_err("failed to bind tx socket");
422 msg.msg_control = NULL;
423 msg.msg_controllen = 0;
424 n = sendmsg(fd, &msg, 0);
425 if (CHECK(n <= 0, "sendmsg", "failed\n")) {
426 log_err("failed to send echo reply");
437 static int tcp_echo_test(int client_fd, int server_fd)
441 err = send_byte(client_fd);
444 err = tcp_recv_send(server_fd);
447 err = recv_byte(client_fd);
454 static int udp_echo_test(int client_fd, int server_fd)
458 err = send_byte(client_fd);
461 err = udp_recv_send(server_fd);
464 err = recv_byte(client_fd);
471 static struct bpf_link *attach_lookup_prog(struct bpf_program *prog)
473 struct bpf_link *link;
476 net_fd = open("/proc/self/ns/net", O_RDONLY);
477 if (CHECK(net_fd < 0, "open", "failed\n")) {
478 log_err("failed to open /proc/self/ns/net");
482 link = bpf_program__attach_netns(prog, net_fd);
483 if (CHECK(IS_ERR(link), "bpf_program__attach_netns", "failed\n")) {
484 errno = -PTR_ERR(link);
485 log_err("failed to attach program '%s' to netns",
486 bpf_program__name(prog));
494 static int update_lookup_map(struct bpf_map *map, int index, int sock_fd)
499 map_fd = bpf_map__fd(map);
500 if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) {
502 log_err("failed to get map FD");
506 value = (uint64_t)sock_fd;
507 err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST);
508 if (CHECK(err, "bpf_map_update_elem", "failed\n")) {
509 log_err("failed to update redir_map @ %d", index);
516 static void query_lookup_prog(struct test_sk_lookup *skel)
518 struct bpf_link *link[3] = {};
519 struct bpf_link_info info;
520 __u32 attach_flags = 0;
521 __u32 prog_ids[3] = {};
527 net_fd = open("/proc/self/ns/net", O_RDONLY);
528 if (CHECK(net_fd < 0, "open", "failed\n")) {
529 log_err("failed to open /proc/self/ns/net");
533 link[0] = attach_lookup_prog(skel->progs.lookup_pass);
536 link[1] = attach_lookup_prog(skel->progs.lookup_pass);
539 link[2] = attach_lookup_prog(skel->progs.lookup_drop);
543 err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */,
544 &attach_flags, prog_ids, &prog_cnt);
545 if (CHECK(err, "bpf_prog_query", "failed\n")) {
546 log_err("failed to query lookup prog");
551 if (CHECK(attach_flags != 0, "bpf_prog_query",
552 "wrong attach_flags on query: %u", attach_flags))
554 if (CHECK(prog_cnt != 3, "bpf_prog_query",
555 "wrong program count on query: %u", prog_cnt))
557 prog_id = link_info_prog_id(link[0], &info);
558 CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
559 "invalid program #0 id on query: %u != %u\n",
560 prog_ids[0], prog_id);
561 CHECK(info.netns.netns_ino == 0, "netns_ino",
562 "unexpected netns_ino: %u\n", info.netns.netns_ino);
563 prog_id = link_info_prog_id(link[1], &info);
564 CHECK(prog_ids[1] != prog_id, "bpf_prog_query",
565 "invalid program #1 id on query: %u != %u\n",
566 prog_ids[1], prog_id);
567 CHECK(info.netns.netns_ino == 0, "netns_ino",
568 "unexpected netns_ino: %u\n", info.netns.netns_ino);
569 prog_id = link_info_prog_id(link[2], &info);
570 CHECK(prog_ids[2] != prog_id, "bpf_prog_query",
571 "invalid program #2 id on query: %u != %u\n",
572 prog_ids[2], prog_id);
573 CHECK(info.netns.netns_ino == 0, "netns_ino",
574 "unexpected netns_ino: %u\n", info.netns.netns_ino);
576 err = bpf_link__detach(link[0]);
577 if (CHECK(err, "link_detach", "failed %d\n", err))
580 /* prog id is still there, but netns_ino is zeroed out */
581 prog_id = link_info_prog_id(link[0], &info);
582 CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
583 "invalid program #0 id on query: %u != %u\n",
584 prog_ids[0], prog_id);
585 CHECK(info.netns.netns_ino != 0, "netns_ino",
586 "unexpected netns_ino: %u\n", info.netns.netns_ino);
590 bpf_link__destroy(link[2]);
592 bpf_link__destroy(link[1]);
594 bpf_link__destroy(link[0]);
599 static void run_lookup_prog(const struct test *t)
601 int server_fds[MAX_SERVERS] = { -1 };
602 int client_fd, reuse_conn_fd = -1;
603 struct bpf_link *lookup_link;
606 lookup_link = attach_lookup_prog(t->lookup_prog);
610 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
611 server_fds[i] = make_server(t->sotype, t->listen_at.ip,
614 if (server_fds[i] < 0)
617 err = update_lookup_map(t->sock_map, i, server_fds[i]);
621 /* want just one server for non-reuseport test */
622 if (!t->reuseport_prog)
626 /* Regular UDP socket lookup with reuseport behaves
627 * differently when reuseport group contains connected
628 * sockets. Check that adding a connected UDP socket to the
629 * reuseport group does not affect how reuseport works with
632 if (t->reuseport_has_conns) {
633 struct sockaddr_storage addr = {};
634 socklen_t len = sizeof(addr);
636 /* Add an extra socket to reuseport group */
637 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip,
640 if (reuse_conn_fd < 0)
643 /* Connect the extra socket to itself */
644 err = getsockname(reuse_conn_fd, (void *)&addr, &len);
645 if (CHECK(err, "getsockname", "errno %d\n", errno))
647 err = connect(reuse_conn_fd, (void *)&addr, len);
648 if (CHECK(err, "connect", "errno %d\n", errno))
652 client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port);
656 if (t->sotype == SOCK_STREAM)
657 tcp_echo_test(client_fd, server_fds[t->accept_on]);
659 udp_echo_test(client_fd, server_fds[t->accept_on]);
663 if (reuse_conn_fd != -1)
664 close(reuse_conn_fd);
665 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
666 if (server_fds[i] != -1)
667 close(server_fds[i]);
669 bpf_link__destroy(lookup_link);
672 static void test_redirect_lookup(struct test_sk_lookup *skel)
674 const struct test tests[] = {
676 .desc = "TCP IPv4 redir port",
677 .lookup_prog = skel->progs.redir_port,
678 .sock_map = skel->maps.redir_map,
679 .sotype = SOCK_STREAM,
680 .connect_to = { EXT_IP4, EXT_PORT },
681 .listen_at = { EXT_IP4, INT_PORT },
684 .desc = "TCP IPv4 redir addr",
685 .lookup_prog = skel->progs.redir_ip4,
686 .sock_map = skel->maps.redir_map,
687 .sotype = SOCK_STREAM,
688 .connect_to = { EXT_IP4, EXT_PORT },
689 .listen_at = { INT_IP4, EXT_PORT },
692 .desc = "TCP IPv4 redir with reuseport",
693 .lookup_prog = skel->progs.select_sock_a,
694 .reuseport_prog = skel->progs.select_sock_b,
695 .sock_map = skel->maps.redir_map,
696 .sotype = SOCK_STREAM,
697 .connect_to = { EXT_IP4, EXT_PORT },
698 .listen_at = { INT_IP4, INT_PORT },
699 .accept_on = SERVER_B,
702 .desc = "TCP IPv4 redir skip reuseport",
703 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
704 .reuseport_prog = skel->progs.select_sock_b,
705 .sock_map = skel->maps.redir_map,
706 .sotype = SOCK_STREAM,
707 .connect_to = { EXT_IP4, EXT_PORT },
708 .listen_at = { INT_IP4, INT_PORT },
709 .accept_on = SERVER_A,
712 .desc = "TCP IPv6 redir port",
713 .lookup_prog = skel->progs.redir_port,
714 .sock_map = skel->maps.redir_map,
715 .sotype = SOCK_STREAM,
716 .connect_to = { EXT_IP6, EXT_PORT },
717 .listen_at = { EXT_IP6, INT_PORT },
720 .desc = "TCP IPv6 redir addr",
721 .lookup_prog = skel->progs.redir_ip6,
722 .sock_map = skel->maps.redir_map,
723 .sotype = SOCK_STREAM,
724 .connect_to = { EXT_IP6, EXT_PORT },
725 .listen_at = { INT_IP6, EXT_PORT },
728 .desc = "TCP IPv4->IPv6 redir port",
729 .lookup_prog = skel->progs.redir_port,
730 .sock_map = skel->maps.redir_map,
731 .sotype = SOCK_STREAM,
732 .connect_to = { EXT_IP4, EXT_PORT },
733 .listen_at = { INT_IP4_V6, INT_PORT },
736 .desc = "TCP IPv6 redir with reuseport",
737 .lookup_prog = skel->progs.select_sock_a,
738 .reuseport_prog = skel->progs.select_sock_b,
739 .sock_map = skel->maps.redir_map,
740 .sotype = SOCK_STREAM,
741 .connect_to = { EXT_IP6, EXT_PORT },
742 .listen_at = { INT_IP6, INT_PORT },
743 .accept_on = SERVER_B,
746 .desc = "TCP IPv6 redir skip reuseport",
747 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
748 .reuseport_prog = skel->progs.select_sock_b,
749 .sock_map = skel->maps.redir_map,
750 .sotype = SOCK_STREAM,
751 .connect_to = { EXT_IP6, EXT_PORT },
752 .listen_at = { INT_IP6, INT_PORT },
753 .accept_on = SERVER_A,
756 .desc = "UDP IPv4 redir port",
757 .lookup_prog = skel->progs.redir_port,
758 .sock_map = skel->maps.redir_map,
759 .sotype = SOCK_DGRAM,
760 .connect_to = { EXT_IP4, EXT_PORT },
761 .listen_at = { EXT_IP4, INT_PORT },
764 .desc = "UDP IPv4 redir addr",
765 .lookup_prog = skel->progs.redir_ip4,
766 .sock_map = skel->maps.redir_map,
767 .sotype = SOCK_DGRAM,
768 .connect_to = { EXT_IP4, EXT_PORT },
769 .listen_at = { INT_IP4, EXT_PORT },
772 .desc = "UDP IPv4 redir with reuseport",
773 .lookup_prog = skel->progs.select_sock_a,
774 .reuseport_prog = skel->progs.select_sock_b,
775 .sock_map = skel->maps.redir_map,
776 .sotype = SOCK_DGRAM,
777 .connect_to = { EXT_IP4, EXT_PORT },
778 .listen_at = { INT_IP4, INT_PORT },
779 .accept_on = SERVER_B,
782 .desc = "UDP IPv4 redir and reuseport with conns",
783 .lookup_prog = skel->progs.select_sock_a,
784 .reuseport_prog = skel->progs.select_sock_b,
785 .sock_map = skel->maps.redir_map,
786 .sotype = SOCK_DGRAM,
787 .connect_to = { EXT_IP4, EXT_PORT },
788 .listen_at = { INT_IP4, INT_PORT },
789 .accept_on = SERVER_B,
790 .reuseport_has_conns = true,
793 .desc = "UDP IPv4 redir skip reuseport",
794 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
795 .reuseport_prog = skel->progs.select_sock_b,
796 .sock_map = skel->maps.redir_map,
797 .sotype = SOCK_DGRAM,
798 .connect_to = { EXT_IP4, EXT_PORT },
799 .listen_at = { INT_IP4, INT_PORT },
800 .accept_on = SERVER_A,
803 .desc = "UDP IPv6 redir port",
804 .lookup_prog = skel->progs.redir_port,
805 .sock_map = skel->maps.redir_map,
806 .sotype = SOCK_DGRAM,
807 .connect_to = { EXT_IP6, EXT_PORT },
808 .listen_at = { EXT_IP6, INT_PORT },
811 .desc = "UDP IPv6 redir addr",
812 .lookup_prog = skel->progs.redir_ip6,
813 .sock_map = skel->maps.redir_map,
814 .sotype = SOCK_DGRAM,
815 .connect_to = { EXT_IP6, EXT_PORT },
816 .listen_at = { INT_IP6, EXT_PORT },
819 .desc = "UDP IPv4->IPv6 redir port",
820 .lookup_prog = skel->progs.redir_port,
821 .sock_map = skel->maps.redir_map,
822 .sotype = SOCK_DGRAM,
823 .listen_at = { INT_IP4_V6, INT_PORT },
824 .connect_to = { EXT_IP4, EXT_PORT },
827 .desc = "UDP IPv6 redir and reuseport",
828 .lookup_prog = skel->progs.select_sock_a,
829 .reuseport_prog = skel->progs.select_sock_b,
830 .sock_map = skel->maps.redir_map,
831 .sotype = SOCK_DGRAM,
832 .connect_to = { EXT_IP6, EXT_PORT },
833 .listen_at = { INT_IP6, INT_PORT },
834 .accept_on = SERVER_B,
837 .desc = "UDP IPv6 redir and reuseport with conns",
838 .lookup_prog = skel->progs.select_sock_a,
839 .reuseport_prog = skel->progs.select_sock_b,
840 .sock_map = skel->maps.redir_map,
841 .sotype = SOCK_DGRAM,
842 .connect_to = { EXT_IP6, EXT_PORT },
843 .listen_at = { INT_IP6, INT_PORT },
844 .accept_on = SERVER_B,
845 .reuseport_has_conns = true,
848 .desc = "UDP IPv6 redir skip reuseport",
849 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
850 .reuseport_prog = skel->progs.select_sock_b,
851 .sock_map = skel->maps.redir_map,
852 .sotype = SOCK_DGRAM,
853 .connect_to = { EXT_IP6, EXT_PORT },
854 .listen_at = { INT_IP6, INT_PORT },
855 .accept_on = SERVER_A,
858 const struct test *t;
860 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
861 if (test__start_subtest(t->desc))
866 static void drop_on_lookup(const struct test *t)
868 struct sockaddr_storage dst = {};
869 int client_fd, server_fd, err;
870 struct bpf_link *lookup_link;
873 lookup_link = attach_lookup_prog(t->lookup_prog);
877 server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
882 client_fd = make_socket(t->sotype, t->connect_to.ip,
883 t->connect_to.port, &dst);
887 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
888 if (t->sotype == SOCK_DGRAM) {
889 err = send_byte(client_fd);
893 /* Read out asynchronous error */
894 n = recv(client_fd, NULL, 0, 0);
897 if (CHECK(!err || errno != ECONNREFUSED, "connect",
898 "unexpected success or error\n"))
899 log_err("expected ECONNREFUSED on connect");
906 bpf_link__destroy(lookup_link);
909 static void test_drop_on_lookup(struct test_sk_lookup *skel)
911 const struct test tests[] = {
913 .desc = "TCP IPv4 drop on lookup",
914 .lookup_prog = skel->progs.lookup_drop,
915 .sotype = SOCK_STREAM,
916 .connect_to = { EXT_IP4, EXT_PORT },
917 .listen_at = { EXT_IP4, EXT_PORT },
920 .desc = "TCP IPv6 drop on lookup",
921 .lookup_prog = skel->progs.lookup_drop,
922 .sotype = SOCK_STREAM,
923 .connect_to = { EXT_IP6, EXT_PORT },
924 .listen_at = { EXT_IP6, EXT_PORT },
927 .desc = "UDP IPv4 drop on lookup",
928 .lookup_prog = skel->progs.lookup_drop,
929 .sotype = SOCK_DGRAM,
930 .connect_to = { EXT_IP4, EXT_PORT },
931 .listen_at = { EXT_IP4, EXT_PORT },
934 .desc = "UDP IPv6 drop on lookup",
935 .lookup_prog = skel->progs.lookup_drop,
936 .sotype = SOCK_DGRAM,
937 .connect_to = { EXT_IP6, EXT_PORT },
938 .listen_at = { EXT_IP6, INT_PORT },
941 const struct test *t;
943 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
944 if (test__start_subtest(t->desc))
949 static void drop_on_reuseport(const struct test *t)
951 struct sockaddr_storage dst = { 0 };
952 int client, server1, server2, err;
953 struct bpf_link *lookup_link;
956 lookup_link = attach_lookup_prog(t->lookup_prog);
960 server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
965 err = update_lookup_map(t->sock_map, SERVER_A, server1);
969 /* second server on destination address we should never reach */
970 server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
971 NULL /* reuseport prog */);
975 client = make_socket(t->sotype, t->connect_to.ip,
976 t->connect_to.port, &dst);
980 err = connect(client, (void *)&dst, inetaddr_len(&dst));
981 if (t->sotype == SOCK_DGRAM) {
982 err = send_byte(client);
986 /* Read out asynchronous error */
987 n = recv(client, NULL, 0, 0);
990 if (CHECK(!err || errno != ECONNREFUSED, "connect",
991 "unexpected success or error\n"))
992 log_err("expected ECONNREFUSED on connect");
1001 bpf_link__destroy(lookup_link);
1004 static void test_drop_on_reuseport(struct test_sk_lookup *skel)
1006 const struct test tests[] = {
1008 .desc = "TCP IPv4 drop on reuseport",
1009 .lookup_prog = skel->progs.select_sock_a,
1010 .reuseport_prog = skel->progs.reuseport_drop,
1011 .sock_map = skel->maps.redir_map,
1012 .sotype = SOCK_STREAM,
1013 .connect_to = { EXT_IP4, EXT_PORT },
1014 .listen_at = { INT_IP4, INT_PORT },
1017 .desc = "TCP IPv6 drop on reuseport",
1018 .lookup_prog = skel->progs.select_sock_a,
1019 .reuseport_prog = skel->progs.reuseport_drop,
1020 .sock_map = skel->maps.redir_map,
1021 .sotype = SOCK_STREAM,
1022 .connect_to = { EXT_IP6, EXT_PORT },
1023 .listen_at = { INT_IP6, INT_PORT },
1026 .desc = "UDP IPv4 drop on reuseport",
1027 .lookup_prog = skel->progs.select_sock_a,
1028 .reuseport_prog = skel->progs.reuseport_drop,
1029 .sock_map = skel->maps.redir_map,
1030 .sotype = SOCK_DGRAM,
1031 .connect_to = { EXT_IP4, EXT_PORT },
1032 .listen_at = { INT_IP4, INT_PORT },
1035 .desc = "TCP IPv6 drop on reuseport",
1036 .lookup_prog = skel->progs.select_sock_a,
1037 .reuseport_prog = skel->progs.reuseport_drop,
1038 .sock_map = skel->maps.redir_map,
1039 .sotype = SOCK_STREAM,
1040 .connect_to = { EXT_IP6, EXT_PORT },
1041 .listen_at = { INT_IP6, INT_PORT },
1044 const struct test *t;
1046 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1047 if (test__start_subtest(t->desc))
1048 drop_on_reuseport(t);
1052 static void run_sk_assign(struct test_sk_lookup *skel,
1053 struct bpf_program *lookup_prog,
1054 const char *remote_ip, const char *local_ip)
1056 int server_fds[MAX_SERVERS] = { -1 };
1057 struct bpf_sk_lookup ctx;
1058 __u64 server_cookie;
1061 DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
1063 .ctx_size_in = sizeof(ctx),
1065 .ctx_size_out = sizeof(ctx),
1068 if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT))
1071 ctx.protocol = IPPROTO_TCP;
1073 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1074 server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL);
1075 if (server_fds[i] < 0)
1078 err = update_lookup_map(skel->maps.redir_map, i,
1084 server_cookie = socket_cookie(server_fds[SERVER_B]);
1088 err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts);
1089 if (CHECK(err, "test_run", "failed with error %d\n", errno))
1092 if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n"))
1095 CHECK(ctx.cookie != server_cookie, "ctx.cookie",
1096 "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie);
1099 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1100 if (server_fds[i] != -1)
1101 close(server_fds[i]);
1105 static void run_sk_assign_v4(struct test_sk_lookup *skel,
1106 struct bpf_program *lookup_prog)
1108 run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4);
1111 static void run_sk_assign_v6(struct test_sk_lookup *skel,
1112 struct bpf_program *lookup_prog)
1114 run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6);
1117 static void run_sk_assign_connected(struct test_sk_lookup *skel,
1120 int err, client_fd, connected_fd, server_fd;
1121 struct bpf_link *lookup_link;
1123 server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL);
1127 connected_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1128 if (connected_fd < 0)
1129 goto out_close_server;
1131 /* Put a connected socket in redirect map */
1132 err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd);
1134 goto out_close_connected;
1136 lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport);
1138 goto out_close_connected;
1140 /* Try to redirect TCP SYN / UDP packet to a connected socket */
1141 client_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1143 goto out_unlink_prog;
1144 if (sotype == SOCK_DGRAM) {
1145 send_byte(client_fd);
1146 recv_byte(server_fd);
1151 bpf_link__destroy(lookup_link);
1152 out_close_connected:
1153 close(connected_fd);
1158 static void test_sk_assign_helper(struct test_sk_lookup *skel)
1160 if (test__start_subtest("sk_assign returns EEXIST"))
1161 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist);
1162 if (test__start_subtest("sk_assign honors F_REPLACE"))
1163 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag);
1164 if (test__start_subtest("sk_assign accepts NULL socket"))
1165 run_sk_assign_v4(skel, skel->progs.sk_assign_null);
1166 if (test__start_subtest("access ctx->sk"))
1167 run_sk_assign_v4(skel, skel->progs.access_ctx_sk);
1168 if (test__start_subtest("narrow access to ctx v4"))
1169 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access);
1170 if (test__start_subtest("narrow access to ctx v6"))
1171 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access);
1172 if (test__start_subtest("sk_assign rejects TCP established"))
1173 run_sk_assign_connected(skel, SOCK_STREAM);
1174 if (test__start_subtest("sk_assign rejects UDP connected"))
1175 run_sk_assign_connected(skel, SOCK_DGRAM);
1178 struct test_multi_prog {
1180 struct bpf_program *prog1;
1181 struct bpf_program *prog2;
1182 struct bpf_map *redir_map;
1183 struct bpf_map *run_map;
1185 struct inet_addr listen_at;
1188 static void run_multi_prog_lookup(const struct test_multi_prog *t)
1190 struct sockaddr_storage dst = {};
1191 int map_fd, server_fd, client_fd;
1192 struct bpf_link *link1, *link2;
1193 int prog_idx, done, err;
1195 map_fd = bpf_map__fd(t->run_map);
1199 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1200 if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1203 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1204 if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1207 link1 = attach_lookup_prog(t->prog1);
1210 link2 = attach_lookup_prog(t->prog2);
1214 server_fd = make_server(SOCK_STREAM, t->listen_at.ip,
1215 t->listen_at.port, NULL);
1219 err = update_lookup_map(t->redir_map, SERVER_A, server_fd);
1221 goto out_close_server;
1223 client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst);
1225 goto out_close_server;
1227 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
1228 if (CHECK(err && !t->expect_errno, "connect",
1229 "unexpected error %d\n", errno))
1230 goto out_close_client;
1231 if (CHECK(err && t->expect_errno && errno != t->expect_errno,
1232 "connect", "unexpected error %d\n", errno))
1233 goto out_close_client;
1237 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1238 CHECK(err, "bpf_map_lookup_elem", "failed\n");
1239 CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n");
1243 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1244 CHECK(err, "bpf_map_lookup_elem", "failed\n");
1245 CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n");
1252 bpf_link__destroy(link2);
1254 bpf_link__destroy(link1);
1257 static void test_multi_prog_lookup(struct test_sk_lookup *skel)
1259 struct test_multi_prog tests[] = {
1261 .desc = "multi prog - pass, pass",
1262 .prog1 = skel->progs.multi_prog_pass1,
1263 .prog2 = skel->progs.multi_prog_pass2,
1264 .listen_at = { EXT_IP4, EXT_PORT },
1267 .desc = "multi prog - drop, drop",
1268 .prog1 = skel->progs.multi_prog_drop1,
1269 .prog2 = skel->progs.multi_prog_drop2,
1270 .listen_at = { EXT_IP4, EXT_PORT },
1271 .expect_errno = ECONNREFUSED,
1274 .desc = "multi prog - pass, drop",
1275 .prog1 = skel->progs.multi_prog_pass1,
1276 .prog2 = skel->progs.multi_prog_drop2,
1277 .listen_at = { EXT_IP4, EXT_PORT },
1278 .expect_errno = ECONNREFUSED,
1281 .desc = "multi prog - drop, pass",
1282 .prog1 = skel->progs.multi_prog_drop1,
1283 .prog2 = skel->progs.multi_prog_pass2,
1284 .listen_at = { EXT_IP4, EXT_PORT },
1285 .expect_errno = ECONNREFUSED,
1288 .desc = "multi prog - pass, redir",
1289 .prog1 = skel->progs.multi_prog_pass1,
1290 .prog2 = skel->progs.multi_prog_redir2,
1291 .listen_at = { INT_IP4, INT_PORT },
1294 .desc = "multi prog - redir, pass",
1295 .prog1 = skel->progs.multi_prog_redir1,
1296 .prog2 = skel->progs.multi_prog_pass2,
1297 .listen_at = { INT_IP4, INT_PORT },
1300 .desc = "multi prog - drop, redir",
1301 .prog1 = skel->progs.multi_prog_drop1,
1302 .prog2 = skel->progs.multi_prog_redir2,
1303 .listen_at = { INT_IP4, INT_PORT },
1306 .desc = "multi prog - redir, drop",
1307 .prog1 = skel->progs.multi_prog_redir1,
1308 .prog2 = skel->progs.multi_prog_drop2,
1309 .listen_at = { INT_IP4, INT_PORT },
1312 .desc = "multi prog - redir, redir",
1313 .prog1 = skel->progs.multi_prog_redir1,
1314 .prog2 = skel->progs.multi_prog_redir2,
1315 .listen_at = { INT_IP4, INT_PORT },
1318 struct test_multi_prog *t;
1320 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1321 t->redir_map = skel->maps.redir_map;
1322 t->run_map = skel->maps.run_map;
1323 if (test__start_subtest(t->desc))
1324 run_multi_prog_lookup(t);
1328 static void run_tests(struct test_sk_lookup *skel)
1330 if (test__start_subtest("query lookup prog"))
1331 query_lookup_prog(skel);
1332 test_redirect_lookup(skel);
1333 test_drop_on_lookup(skel);
1334 test_drop_on_reuseport(skel);
1335 test_sk_assign_helper(skel);
1336 test_multi_prog_lookup(skel);
1339 static int switch_netns(void)
1341 static const char * const setup_script[] = {
1342 "ip -6 addr add dev lo " EXT_IP6 "/128",
1343 "ip -6 addr add dev lo " INT_IP6 "/128",
1344 "ip link set dev lo up",
1347 const char * const *cmd;
1350 err = unshare(CLONE_NEWNET);
1351 if (CHECK(err, "unshare", "failed\n")) {
1352 log_err("unshare(CLONE_NEWNET)");
1356 for (cmd = setup_script; *cmd; cmd++) {
1358 if (CHECK(err, "system", "failed\n")) {
1359 log_err("system(%s)", *cmd);
1367 void test_sk_lookup(void)
1369 struct test_sk_lookup *skel;
1372 err = switch_netns();
1376 skel = test_sk_lookup__open_and_load();
1377 if (CHECK(!skel, "skel open_and_load", "failed\n"))
1382 test_sk_lookup__destroy(skel);