Loading...
1// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2// Copyright (c) 2020 Cloudflare
3/*
4 * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP).
5 *
6 * Tests exercise:
7 * - attaching/detaching/querying programs to BPF_SK_LOOKUP hook,
8 * - redirecting socket lookup to a socket selected by BPF program,
9 * - failing a socket lookup on BPF program's request,
10 * - error scenarios for selecting a socket from BPF program,
11 * - accessing BPF program context,
12 * - attaching and running multiple BPF programs.
13 *
14 * Tests run in a dedicated network namespace.
15 */
16
17#define _GNU_SOURCE
18#include <arpa/inet.h>
19#include <assert.h>
20#include <errno.h>
21#include <error.h>
22#include <fcntl.h>
23#include <sched.h>
24#include <stdio.h>
25#include <sys/types.h>
26#include <sys/stat.h>
27#include <unistd.h>
28
29#include <bpf/libbpf.h>
30#include <bpf/bpf.h>
31
32#include "test_progs.h"
33#include "bpf_util.h"
34#include "cgroup_helpers.h"
35#include "network_helpers.h"
36#include "testing_helpers.h"
37#include "test_sk_lookup.skel.h"
38
39/* External (address, port) pairs the client sends packets to. */
40#define EXT_IP4 "127.0.0.1"
41#define EXT_IP6 "fd00::1"
42#define EXT_PORT 7007
43
44/* Internal (address, port) pairs the server listens/receives at. */
45#define INT_IP4 "127.0.0.2"
46#define INT_IP4_V6 "::ffff:127.0.0.2"
47#define INT_IP6 "fd00::2"
48#define INT_PORT 8008
49
50#define IO_TIMEOUT_SEC 3
51
52enum server {
53 SERVER_A = 0,
54 SERVER_B = 1,
55 MAX_SERVERS,
56};
57
58enum {
59 PROG1 = 0,
60 PROG2,
61};
62
63struct inet_addr {
64 const char *ip;
65 unsigned short port;
66};
67
68struct test {
69 const char *desc;
70 struct bpf_program *lookup_prog;
71 struct bpf_program *reuseport_prog;
72 struct bpf_map *sock_map;
73 int sotype;
74 struct inet_addr connect_to;
75 struct inet_addr listen_at;
76 enum server accept_on;
77 bool reuseport_has_conns; /* Add a connected socket to reuseport group */
78};
79
80static __u32 duration; /* for CHECK macro */
81
82static bool is_ipv6(const char *ip)
83{
84 return !!strchr(ip, ':');
85}
86
87static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog)
88{
89 int err, prog_fd;
90
91 prog_fd = bpf_program__fd(reuseport_prog);
92 if (prog_fd < 0) {
93 errno = -prog_fd;
94 return -1;
95 }
96
97 err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF,
98 &prog_fd, sizeof(prog_fd));
99 if (err)
100 return -1;
101
102 return 0;
103}
104
105static socklen_t inetaddr_len(const struct sockaddr_storage *addr)
106{
107 return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) :
108 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0);
109}
110
111static int make_socket(int sotype, const char *ip, int port,
112 struct sockaddr_storage *addr)
113{
114 struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC };
115 int err, family, fd;
116
117 family = is_ipv6(ip) ? AF_INET6 : AF_INET;
118 err = make_sockaddr(family, ip, port, addr, NULL);
119 if (CHECK(err, "make_address", "failed\n"))
120 return -1;
121
122 fd = socket(addr->ss_family, sotype, 0);
123 if (CHECK(fd < 0, "socket", "failed\n")) {
124 log_err("failed to make socket");
125 return -1;
126 }
127
128 err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
129 if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) {
130 log_err("failed to set SNDTIMEO");
131 close(fd);
132 return -1;
133 }
134
135 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
136 if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) {
137 log_err("failed to set RCVTIMEO");
138 close(fd);
139 return -1;
140 }
141
142 return fd;
143}
144
145static int make_server(int sotype, const char *ip, int port,
146 struct bpf_program *reuseport_prog)
147{
148 struct sockaddr_storage addr = {0};
149 const int one = 1;
150 int err, fd = -1;
151
152 fd = make_socket(sotype, ip, port, &addr);
153 if (fd < 0)
154 return -1;
155
156 /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */
157 if (sotype == SOCK_DGRAM) {
158 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one,
159 sizeof(one));
160 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) {
161 log_err("failed to enable IP_RECVORIGDSTADDR");
162 goto fail;
163 }
164 }
165
166 if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) {
167 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one,
168 sizeof(one));
169 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) {
170 log_err("failed to enable IPV6_RECVORIGDSTADDR");
171 goto fail;
172 }
173 }
174
175 if (sotype == SOCK_STREAM) {
176 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
177 sizeof(one));
178 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) {
179 log_err("failed to enable SO_REUSEADDR");
180 goto fail;
181 }
182 }
183
184 if (reuseport_prog) {
185 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one,
186 sizeof(one));
187 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) {
188 log_err("failed to enable SO_REUSEPORT");
189 goto fail;
190 }
191 }
192
193 err = bind(fd, (void *)&addr, inetaddr_len(&addr));
194 if (CHECK(err, "bind", "failed\n")) {
195 log_err("failed to bind listen socket");
196 goto fail;
197 }
198
199 if (sotype == SOCK_STREAM) {
200 err = listen(fd, SOMAXCONN);
201 if (CHECK(err, "make_server", "listen")) {
202 log_err("failed to listen on port %d", port);
203 goto fail;
204 }
205 }
206
207 /* Late attach reuseport prog so we can have one init path */
208 if (reuseport_prog) {
209 err = attach_reuseport(fd, reuseport_prog);
210 if (CHECK(err, "attach_reuseport", "failed\n")) {
211 log_err("failed to attach reuseport prog");
212 goto fail;
213 }
214 }
215
216 return fd;
217fail:
218 close(fd);
219 return -1;
220}
221
222static int make_client(int sotype, const char *ip, int port)
223{
224 struct sockaddr_storage addr = {0};
225 int err, fd;
226
227 fd = make_socket(sotype, ip, port, &addr);
228 if (fd < 0)
229 return -1;
230
231 err = connect(fd, (void *)&addr, inetaddr_len(&addr));
232 if (CHECK(err, "make_client", "connect")) {
233 log_err("failed to connect client socket");
234 goto fail;
235 }
236
237 return fd;
238fail:
239 close(fd);
240 return -1;
241}
242
243static __u64 socket_cookie(int fd)
244{
245 __u64 cookie;
246 socklen_t cookie_len = sizeof(cookie);
247
248 if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0,
249 "getsockopt(SO_COOKIE)", "%s\n", strerror(errno)))
250 return 0;
251 return cookie;
252}
253
254static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port,
255 const char *remote_ip, __u16 remote_port)
256{
257 void *local, *remote;
258 int err;
259
260 memset(ctx, 0, sizeof(*ctx));
261 ctx->local_port = local_port;
262 ctx->remote_port = htons(remote_port);
263
264 if (is_ipv6(local_ip)) {
265 ctx->family = AF_INET6;
266 local = &ctx->local_ip6[0];
267 remote = &ctx->remote_ip6[0];
268 } else {
269 ctx->family = AF_INET;
270 local = &ctx->local_ip4;
271 remote = &ctx->remote_ip4;
272 }
273
274 err = inet_pton(ctx->family, local_ip, local);
275 if (CHECK(err != 1, "inet_pton", "local_ip failed\n"))
276 return 1;
277
278 err = inet_pton(ctx->family, remote_ip, remote);
279 if (CHECK(err != 1, "inet_pton", "remote_ip failed\n"))
280 return 1;
281
282 return 0;
283}
284
285static int send_byte(int fd)
286{
287 ssize_t n;
288
289 errno = 0;
290 n = send(fd, "a", 1, 0);
291 if (CHECK(n <= 0, "send_byte", "send")) {
292 log_err("failed/partial send");
293 return -1;
294 }
295 return 0;
296}
297
298static int recv_byte(int fd)
299{
300 char buf[1];
301 ssize_t n;
302
303 n = recv(fd, buf, sizeof(buf), 0);
304 if (CHECK(n <= 0, "recv_byte", "recv")) {
305 log_err("failed/partial recv");
306 return -1;
307 }
308 return 0;
309}
310
311static int tcp_recv_send(int server_fd)
312{
313 char buf[1];
314 int ret, fd;
315 ssize_t n;
316
317 fd = accept(server_fd, NULL, NULL);
318 if (CHECK(fd < 0, "accept", "failed\n")) {
319 log_err("failed to accept");
320 return -1;
321 }
322
323 n = recv(fd, buf, sizeof(buf), 0);
324 if (CHECK(n <= 0, "recv", "failed\n")) {
325 log_err("failed/partial recv");
326 ret = -1;
327 goto close;
328 }
329
330 n = send(fd, buf, n, 0);
331 if (CHECK(n <= 0, "send", "failed\n")) {
332 log_err("failed/partial send");
333 ret = -1;
334 goto close;
335 }
336
337 ret = 0;
338close:
339 close(fd);
340 return ret;
341}
342
343static void v4_to_v6(struct sockaddr_storage *ss)
344{
345 struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss;
346 struct sockaddr_in v4 = *(struct sockaddr_in *)ss;
347
348 v6->sin6_family = AF_INET6;
349 v6->sin6_port = v4.sin_port;
350 v6->sin6_addr.s6_addr[10] = 0xff;
351 v6->sin6_addr.s6_addr[11] = 0xff;
352 memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4);
353 memset(&v6->sin6_addr.s6_addr[0], 0, 10);
354}
355
356static int udp_recv_send(int server_fd)
357{
358 char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
359 struct sockaddr_storage _src_addr = { 0 };
360 struct sockaddr_storage *src_addr = &_src_addr;
361 struct sockaddr_storage *dst_addr = NULL;
362 struct msghdr msg = { 0 };
363 struct iovec iov = { 0 };
364 struct cmsghdr *cm;
365 char buf[1];
366 int ret, fd;
367 ssize_t n;
368
369 iov.iov_base = buf;
370 iov.iov_len = sizeof(buf);
371
372 msg.msg_name = src_addr;
373 msg.msg_namelen = sizeof(*src_addr);
374 msg.msg_iov = &iov;
375 msg.msg_iovlen = 1;
376 msg.msg_control = cmsg_buf;
377 msg.msg_controllen = sizeof(cmsg_buf);
378
379 errno = 0;
380 n = recvmsg(server_fd, &msg, 0);
381 if (CHECK(n <= 0, "recvmsg", "failed\n")) {
382 log_err("failed to receive");
383 return -1;
384 }
385 if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n"))
386 return -1;
387
388 for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) {
389 if ((cm->cmsg_level == SOL_IP &&
390 cm->cmsg_type == IP_ORIGDSTADDR) ||
391 (cm->cmsg_level == SOL_IPV6 &&
392 cm->cmsg_type == IPV6_ORIGDSTADDR)) {
393 dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm);
394 break;
395 }
396 log_err("warning: ignored cmsg at level %d type %d",
397 cm->cmsg_level, cm->cmsg_type);
398 }
399 if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n"))
400 return -1;
401
402 /* Server socket bound to IPv4-mapped IPv6 address */
403 if (src_addr->ss_family == AF_INET6 &&
404 dst_addr->ss_family == AF_INET) {
405 v4_to_v6(dst_addr);
406 }
407
408 /* Reply from original destination address. */
409 fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0);
410 if (CHECK(fd < 0, "socket", "failed\n")) {
411 log_err("failed to create tx socket");
412 return -1;
413 }
414
415 ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr));
416 if (CHECK(ret, "bind", "failed\n")) {
417 log_err("failed to bind tx socket");
418 goto out;
419 }
420
421 msg.msg_control = NULL;
422 msg.msg_controllen = 0;
423 n = sendmsg(fd, &msg, 0);
424 if (CHECK(n <= 0, "sendmsg", "failed\n")) {
425 log_err("failed to send echo reply");
426 ret = -1;
427 goto out;
428 }
429
430 ret = 0;
431out:
432 close(fd);
433 return ret;
434}
435
436static int tcp_echo_test(int client_fd, int server_fd)
437{
438 int err;
439
440 err = send_byte(client_fd);
441 if (err)
442 return -1;
443 err = tcp_recv_send(server_fd);
444 if (err)
445 return -1;
446 err = recv_byte(client_fd);
447 if (err)
448 return -1;
449
450 return 0;
451}
452
453static int udp_echo_test(int client_fd, int server_fd)
454{
455 int err;
456
457 err = send_byte(client_fd);
458 if (err)
459 return -1;
460 err = udp_recv_send(server_fd);
461 if (err)
462 return -1;
463 err = recv_byte(client_fd);
464 if (err)
465 return -1;
466
467 return 0;
468}
469
470static struct bpf_link *attach_lookup_prog(struct bpf_program *prog)
471{
472 struct bpf_link *link;
473 int net_fd;
474
475 net_fd = open("/proc/self/ns/net", O_RDONLY);
476 if (CHECK(net_fd < 0, "open", "failed\n")) {
477 log_err("failed to open /proc/self/ns/net");
478 return NULL;
479 }
480
481 link = bpf_program__attach_netns(prog, net_fd);
482 if (!ASSERT_OK_PTR(link, "bpf_program__attach_netns")) {
483 errno = -PTR_ERR(link);
484 log_err("failed to attach program '%s' to netns",
485 bpf_program__name(prog));
486 link = NULL;
487 }
488
489 close(net_fd);
490 return link;
491}
492
493static int update_lookup_map(struct bpf_map *map, int index, int sock_fd)
494{
495 int err, map_fd;
496 uint64_t value;
497
498 map_fd = bpf_map__fd(map);
499 if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) {
500 errno = -map_fd;
501 log_err("failed to get map FD");
502 return -1;
503 }
504
505 value = (uint64_t)sock_fd;
506 err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST);
507 if (CHECK(err, "bpf_map_update_elem", "failed\n")) {
508 log_err("failed to update redir_map @ %d", index);
509 return -1;
510 }
511
512 return 0;
513}
514
515static void query_lookup_prog(struct test_sk_lookup *skel)
516{
517 struct bpf_link *link[3] = {};
518 struct bpf_link_info info;
519 __u32 attach_flags = 0;
520 __u32 prog_ids[3] = {};
521 __u32 prog_cnt = 3;
522 __u32 prog_id;
523 int net_fd;
524 int err;
525
526 net_fd = open("/proc/self/ns/net", O_RDONLY);
527 if (CHECK(net_fd < 0, "open", "failed\n")) {
528 log_err("failed to open /proc/self/ns/net");
529 return;
530 }
531
532 link[0] = attach_lookup_prog(skel->progs.lookup_pass);
533 if (!link[0])
534 goto close;
535 link[1] = attach_lookup_prog(skel->progs.lookup_pass);
536 if (!link[1])
537 goto detach;
538 link[2] = attach_lookup_prog(skel->progs.lookup_drop);
539 if (!link[2])
540 goto detach;
541
542 err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */,
543 &attach_flags, prog_ids, &prog_cnt);
544 if (CHECK(err, "bpf_prog_query", "failed\n")) {
545 log_err("failed to query lookup prog");
546 goto detach;
547 }
548
549 errno = 0;
550 if (CHECK(attach_flags != 0, "bpf_prog_query",
551 "wrong attach_flags on query: %u", attach_flags))
552 goto detach;
553 if (CHECK(prog_cnt != 3, "bpf_prog_query",
554 "wrong program count on query: %u", prog_cnt))
555 goto detach;
556 prog_id = link_info_prog_id(link[0], &info);
557 CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
558 "invalid program #0 id on query: %u != %u\n",
559 prog_ids[0], prog_id);
560 CHECK(info.netns.netns_ino == 0, "netns_ino",
561 "unexpected netns_ino: %u\n", info.netns.netns_ino);
562 prog_id = link_info_prog_id(link[1], &info);
563 CHECK(prog_ids[1] != prog_id, "bpf_prog_query",
564 "invalid program #1 id on query: %u != %u\n",
565 prog_ids[1], prog_id);
566 CHECK(info.netns.netns_ino == 0, "netns_ino",
567 "unexpected netns_ino: %u\n", info.netns.netns_ino);
568 prog_id = link_info_prog_id(link[2], &info);
569 CHECK(prog_ids[2] != prog_id, "bpf_prog_query",
570 "invalid program #2 id on query: %u != %u\n",
571 prog_ids[2], prog_id);
572 CHECK(info.netns.netns_ino == 0, "netns_ino",
573 "unexpected netns_ino: %u\n", info.netns.netns_ino);
574
575 err = bpf_link__detach(link[0]);
576 if (CHECK(err, "link_detach", "failed %d\n", err))
577 goto detach;
578
579 /* prog id is still there, but netns_ino is zeroed out */
580 prog_id = link_info_prog_id(link[0], &info);
581 CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
582 "invalid program #0 id on query: %u != %u\n",
583 prog_ids[0], prog_id);
584 CHECK(info.netns.netns_ino != 0, "netns_ino",
585 "unexpected netns_ino: %u\n", info.netns.netns_ino);
586
587detach:
588 if (link[2])
589 bpf_link__destroy(link[2]);
590 if (link[1])
591 bpf_link__destroy(link[1]);
592 if (link[0])
593 bpf_link__destroy(link[0]);
594close:
595 close(net_fd);
596}
597
598static void run_lookup_prog(const struct test *t)
599{
600 int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 };
601 int client_fd, reuse_conn_fd = -1;
602 struct bpf_link *lookup_link;
603 int i, err;
604
605 lookup_link = attach_lookup_prog(t->lookup_prog);
606 if (!lookup_link)
607 return;
608
609 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
610 server_fds[i] = make_server(t->sotype, t->listen_at.ip,
611 t->listen_at.port,
612 t->reuseport_prog);
613 if (server_fds[i] < 0)
614 goto close;
615
616 err = update_lookup_map(t->sock_map, i, server_fds[i]);
617 if (err)
618 goto close;
619
620 /* want just one server for non-reuseport test */
621 if (!t->reuseport_prog)
622 break;
623 }
624
625 /* Regular UDP socket lookup with reuseport behaves
626 * differently when reuseport group contains connected
627 * sockets. Check that adding a connected UDP socket to the
628 * reuseport group does not affect how reuseport works with
629 * BPF socket lookup.
630 */
631 if (t->reuseport_has_conns) {
632 struct sockaddr_storage addr = {};
633 socklen_t len = sizeof(addr);
634
635 /* Add an extra socket to reuseport group */
636 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip,
637 t->listen_at.port,
638 t->reuseport_prog);
639 if (reuse_conn_fd < 0)
640 goto close;
641
642 /* Connect the extra socket to itself */
643 err = getsockname(reuse_conn_fd, (void *)&addr, &len);
644 if (CHECK(err, "getsockname", "errno %d\n", errno))
645 goto close;
646 err = connect(reuse_conn_fd, (void *)&addr, len);
647 if (CHECK(err, "connect", "errno %d\n", errno))
648 goto close;
649 }
650
651 client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port);
652 if (client_fd < 0)
653 goto close;
654
655 if (t->sotype == SOCK_STREAM)
656 tcp_echo_test(client_fd, server_fds[t->accept_on]);
657 else
658 udp_echo_test(client_fd, server_fds[t->accept_on]);
659
660 close(client_fd);
661close:
662 if (reuse_conn_fd != -1)
663 close(reuse_conn_fd);
664 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
665 if (server_fds[i] != -1)
666 close(server_fds[i]);
667 }
668 bpf_link__destroy(lookup_link);
669}
670
671static void test_redirect_lookup(struct test_sk_lookup *skel)
672{
673 const struct test tests[] = {
674 {
675 .desc = "TCP IPv4 redir port",
676 .lookup_prog = skel->progs.redir_port,
677 .sock_map = skel->maps.redir_map,
678 .sotype = SOCK_STREAM,
679 .connect_to = { EXT_IP4, EXT_PORT },
680 .listen_at = { EXT_IP4, INT_PORT },
681 },
682 {
683 .desc = "TCP IPv4 redir addr",
684 .lookup_prog = skel->progs.redir_ip4,
685 .sock_map = skel->maps.redir_map,
686 .sotype = SOCK_STREAM,
687 .connect_to = { EXT_IP4, EXT_PORT },
688 .listen_at = { INT_IP4, EXT_PORT },
689 },
690 {
691 .desc = "TCP IPv4 redir with reuseport",
692 .lookup_prog = skel->progs.select_sock_a,
693 .reuseport_prog = skel->progs.select_sock_b,
694 .sock_map = skel->maps.redir_map,
695 .sotype = SOCK_STREAM,
696 .connect_to = { EXT_IP4, EXT_PORT },
697 .listen_at = { INT_IP4, INT_PORT },
698 .accept_on = SERVER_B,
699 },
700 {
701 .desc = "TCP IPv4 redir skip reuseport",
702 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
703 .reuseport_prog = skel->progs.select_sock_b,
704 .sock_map = skel->maps.redir_map,
705 .sotype = SOCK_STREAM,
706 .connect_to = { EXT_IP4, EXT_PORT },
707 .listen_at = { INT_IP4, INT_PORT },
708 .accept_on = SERVER_A,
709 },
710 {
711 .desc = "TCP IPv6 redir port",
712 .lookup_prog = skel->progs.redir_port,
713 .sock_map = skel->maps.redir_map,
714 .sotype = SOCK_STREAM,
715 .connect_to = { EXT_IP6, EXT_PORT },
716 .listen_at = { EXT_IP6, INT_PORT },
717 },
718 {
719 .desc = "TCP IPv6 redir addr",
720 .lookup_prog = skel->progs.redir_ip6,
721 .sock_map = skel->maps.redir_map,
722 .sotype = SOCK_STREAM,
723 .connect_to = { EXT_IP6, EXT_PORT },
724 .listen_at = { INT_IP6, EXT_PORT },
725 },
726 {
727 .desc = "TCP IPv4->IPv6 redir port",
728 .lookup_prog = skel->progs.redir_port,
729 .sock_map = skel->maps.redir_map,
730 .sotype = SOCK_STREAM,
731 .connect_to = { EXT_IP4, EXT_PORT },
732 .listen_at = { INT_IP4_V6, INT_PORT },
733 },
734 {
735 .desc = "TCP IPv6 redir with reuseport",
736 .lookup_prog = skel->progs.select_sock_a,
737 .reuseport_prog = skel->progs.select_sock_b,
738 .sock_map = skel->maps.redir_map,
739 .sotype = SOCK_STREAM,
740 .connect_to = { EXT_IP6, EXT_PORT },
741 .listen_at = { INT_IP6, INT_PORT },
742 .accept_on = SERVER_B,
743 },
744 {
745 .desc = "TCP IPv6 redir skip reuseport",
746 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
747 .reuseport_prog = skel->progs.select_sock_b,
748 .sock_map = skel->maps.redir_map,
749 .sotype = SOCK_STREAM,
750 .connect_to = { EXT_IP6, EXT_PORT },
751 .listen_at = { INT_IP6, INT_PORT },
752 .accept_on = SERVER_A,
753 },
754 {
755 .desc = "UDP IPv4 redir port",
756 .lookup_prog = skel->progs.redir_port,
757 .sock_map = skel->maps.redir_map,
758 .sotype = SOCK_DGRAM,
759 .connect_to = { EXT_IP4, EXT_PORT },
760 .listen_at = { EXT_IP4, INT_PORT },
761 },
762 {
763 .desc = "UDP IPv4 redir addr",
764 .lookup_prog = skel->progs.redir_ip4,
765 .sock_map = skel->maps.redir_map,
766 .sotype = SOCK_DGRAM,
767 .connect_to = { EXT_IP4, EXT_PORT },
768 .listen_at = { INT_IP4, EXT_PORT },
769 },
770 {
771 .desc = "UDP IPv4 redir with reuseport",
772 .lookup_prog = skel->progs.select_sock_a,
773 .reuseport_prog = skel->progs.select_sock_b,
774 .sock_map = skel->maps.redir_map,
775 .sotype = SOCK_DGRAM,
776 .connect_to = { EXT_IP4, EXT_PORT },
777 .listen_at = { INT_IP4, INT_PORT },
778 .accept_on = SERVER_B,
779 },
780 {
781 .desc = "UDP IPv4 redir and reuseport with conns",
782 .lookup_prog = skel->progs.select_sock_a,
783 .reuseport_prog = skel->progs.select_sock_b,
784 .sock_map = skel->maps.redir_map,
785 .sotype = SOCK_DGRAM,
786 .connect_to = { EXT_IP4, EXT_PORT },
787 .listen_at = { INT_IP4, INT_PORT },
788 .accept_on = SERVER_B,
789 .reuseport_has_conns = true,
790 },
791 {
792 .desc = "UDP IPv4 redir skip reuseport",
793 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
794 .reuseport_prog = skel->progs.select_sock_b,
795 .sock_map = skel->maps.redir_map,
796 .sotype = SOCK_DGRAM,
797 .connect_to = { EXT_IP4, EXT_PORT },
798 .listen_at = { INT_IP4, INT_PORT },
799 .accept_on = SERVER_A,
800 },
801 {
802 .desc = "UDP IPv6 redir port",
803 .lookup_prog = skel->progs.redir_port,
804 .sock_map = skel->maps.redir_map,
805 .sotype = SOCK_DGRAM,
806 .connect_to = { EXT_IP6, EXT_PORT },
807 .listen_at = { EXT_IP6, INT_PORT },
808 },
809 {
810 .desc = "UDP IPv6 redir addr",
811 .lookup_prog = skel->progs.redir_ip6,
812 .sock_map = skel->maps.redir_map,
813 .sotype = SOCK_DGRAM,
814 .connect_to = { EXT_IP6, EXT_PORT },
815 .listen_at = { INT_IP6, EXT_PORT },
816 },
817 {
818 .desc = "UDP IPv4->IPv6 redir port",
819 .lookup_prog = skel->progs.redir_port,
820 .sock_map = skel->maps.redir_map,
821 .sotype = SOCK_DGRAM,
822 .listen_at = { INT_IP4_V6, INT_PORT },
823 .connect_to = { EXT_IP4, EXT_PORT },
824 },
825 {
826 .desc = "UDP IPv6 redir and reuseport",
827 .lookup_prog = skel->progs.select_sock_a,
828 .reuseport_prog = skel->progs.select_sock_b,
829 .sock_map = skel->maps.redir_map,
830 .sotype = SOCK_DGRAM,
831 .connect_to = { EXT_IP6, EXT_PORT },
832 .listen_at = { INT_IP6, INT_PORT },
833 .accept_on = SERVER_B,
834 },
835 {
836 .desc = "UDP IPv6 redir and reuseport with conns",
837 .lookup_prog = skel->progs.select_sock_a,
838 .reuseport_prog = skel->progs.select_sock_b,
839 .sock_map = skel->maps.redir_map,
840 .sotype = SOCK_DGRAM,
841 .connect_to = { EXT_IP6, EXT_PORT },
842 .listen_at = { INT_IP6, INT_PORT },
843 .accept_on = SERVER_B,
844 .reuseport_has_conns = true,
845 },
846 {
847 .desc = "UDP IPv6 redir skip reuseport",
848 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
849 .reuseport_prog = skel->progs.select_sock_b,
850 .sock_map = skel->maps.redir_map,
851 .sotype = SOCK_DGRAM,
852 .connect_to = { EXT_IP6, EXT_PORT },
853 .listen_at = { INT_IP6, INT_PORT },
854 .accept_on = SERVER_A,
855 },
856 };
857 const struct test *t;
858
859 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
860 if (test__start_subtest(t->desc))
861 run_lookup_prog(t);
862 }
863}
864
865static void drop_on_lookup(const struct test *t)
866{
867 struct sockaddr_storage dst = {};
868 int client_fd, server_fd, err;
869 struct bpf_link *lookup_link;
870 ssize_t n;
871
872 lookup_link = attach_lookup_prog(t->lookup_prog);
873 if (!lookup_link)
874 return;
875
876 server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
877 t->reuseport_prog);
878 if (server_fd < 0)
879 goto detach;
880
881 client_fd = make_socket(t->sotype, t->connect_to.ip,
882 t->connect_to.port, &dst);
883 if (client_fd < 0)
884 goto close_srv;
885
886 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
887 if (t->sotype == SOCK_DGRAM) {
888 err = send_byte(client_fd);
889 if (err)
890 goto close_all;
891
892 /* Read out asynchronous error */
893 n = recv(client_fd, NULL, 0, 0);
894 err = n == -1;
895 }
896 if (CHECK(!err || errno != ECONNREFUSED, "connect",
897 "unexpected success or error\n"))
898 log_err("expected ECONNREFUSED on connect");
899
900close_all:
901 close(client_fd);
902close_srv:
903 close(server_fd);
904detach:
905 bpf_link__destroy(lookup_link);
906}
907
908static void test_drop_on_lookup(struct test_sk_lookup *skel)
909{
910 const struct test tests[] = {
911 {
912 .desc = "TCP IPv4 drop on lookup",
913 .lookup_prog = skel->progs.lookup_drop,
914 .sotype = SOCK_STREAM,
915 .connect_to = { EXT_IP4, EXT_PORT },
916 .listen_at = { EXT_IP4, EXT_PORT },
917 },
918 {
919 .desc = "TCP IPv6 drop on lookup",
920 .lookup_prog = skel->progs.lookup_drop,
921 .sotype = SOCK_STREAM,
922 .connect_to = { EXT_IP6, EXT_PORT },
923 .listen_at = { EXT_IP6, EXT_PORT },
924 },
925 {
926 .desc = "UDP IPv4 drop on lookup",
927 .lookup_prog = skel->progs.lookup_drop,
928 .sotype = SOCK_DGRAM,
929 .connect_to = { EXT_IP4, EXT_PORT },
930 .listen_at = { EXT_IP4, EXT_PORT },
931 },
932 {
933 .desc = "UDP IPv6 drop on lookup",
934 .lookup_prog = skel->progs.lookup_drop,
935 .sotype = SOCK_DGRAM,
936 .connect_to = { EXT_IP6, EXT_PORT },
937 .listen_at = { EXT_IP6, INT_PORT },
938 },
939 /* The program will drop on success, meaning that the ifindex
940 * was 1.
941 */
942 {
943 .desc = "TCP IPv4 drop on valid ifindex",
944 .lookup_prog = skel->progs.check_ifindex,
945 .sotype = SOCK_STREAM,
946 .connect_to = { EXT_IP4, EXT_PORT },
947 .listen_at = { EXT_IP4, EXT_PORT },
948 },
949 {
950 .desc = "TCP IPv6 drop on valid ifindex",
951 .lookup_prog = skel->progs.check_ifindex,
952 .sotype = SOCK_STREAM,
953 .connect_to = { EXT_IP6, EXT_PORT },
954 .listen_at = { EXT_IP6, EXT_PORT },
955 },
956 {
957 .desc = "UDP IPv4 drop on valid ifindex",
958 .lookup_prog = skel->progs.check_ifindex,
959 .sotype = SOCK_DGRAM,
960 .connect_to = { EXT_IP4, EXT_PORT },
961 .listen_at = { EXT_IP4, EXT_PORT },
962 },
963 {
964 .desc = "UDP IPv6 drop on valid ifindex",
965 .lookup_prog = skel->progs.check_ifindex,
966 .sotype = SOCK_DGRAM,
967 .connect_to = { EXT_IP6, EXT_PORT },
968 .listen_at = { EXT_IP6, EXT_PORT },
969 },
970 };
971 const struct test *t;
972
973 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
974 if (test__start_subtest(t->desc))
975 drop_on_lookup(t);
976 }
977}
978
979static void drop_on_reuseport(const struct test *t)
980{
981 struct sockaddr_storage dst = { 0 };
982 int client, server1, server2, err;
983 struct bpf_link *lookup_link;
984 ssize_t n;
985
986 lookup_link = attach_lookup_prog(t->lookup_prog);
987 if (!lookup_link)
988 return;
989
990 server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
991 t->reuseport_prog);
992 if (server1 < 0)
993 goto detach;
994
995 err = update_lookup_map(t->sock_map, SERVER_A, server1);
996 if (err)
997 goto detach;
998
999 /* second server on destination address we should never reach */
1000 server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
1001 NULL /* reuseport prog */);
1002 if (server2 < 0)
1003 goto close_srv1;
1004
1005 client = make_socket(t->sotype, t->connect_to.ip,
1006 t->connect_to.port, &dst);
1007 if (client < 0)
1008 goto close_srv2;
1009
1010 err = connect(client, (void *)&dst, inetaddr_len(&dst));
1011 if (t->sotype == SOCK_DGRAM) {
1012 err = send_byte(client);
1013 if (err)
1014 goto close_all;
1015
1016 /* Read out asynchronous error */
1017 n = recv(client, NULL, 0, 0);
1018 err = n == -1;
1019 }
1020 if (CHECK(!err || errno != ECONNREFUSED, "connect",
1021 "unexpected success or error\n"))
1022 log_err("expected ECONNREFUSED on connect");
1023
1024close_all:
1025 close(client);
1026close_srv2:
1027 close(server2);
1028close_srv1:
1029 close(server1);
1030detach:
1031 bpf_link__destroy(lookup_link);
1032}
1033
1034static void test_drop_on_reuseport(struct test_sk_lookup *skel)
1035{
1036 const struct test tests[] = {
1037 {
1038 .desc = "TCP IPv4 drop on reuseport",
1039 .lookup_prog = skel->progs.select_sock_a,
1040 .reuseport_prog = skel->progs.reuseport_drop,
1041 .sock_map = skel->maps.redir_map,
1042 .sotype = SOCK_STREAM,
1043 .connect_to = { EXT_IP4, EXT_PORT },
1044 .listen_at = { INT_IP4, INT_PORT },
1045 },
1046 {
1047 .desc = "TCP IPv6 drop on reuseport",
1048 .lookup_prog = skel->progs.select_sock_a,
1049 .reuseport_prog = skel->progs.reuseport_drop,
1050 .sock_map = skel->maps.redir_map,
1051 .sotype = SOCK_STREAM,
1052 .connect_to = { EXT_IP6, EXT_PORT },
1053 .listen_at = { INT_IP6, INT_PORT },
1054 },
1055 {
1056 .desc = "UDP IPv4 drop on reuseport",
1057 .lookup_prog = skel->progs.select_sock_a,
1058 .reuseport_prog = skel->progs.reuseport_drop,
1059 .sock_map = skel->maps.redir_map,
1060 .sotype = SOCK_DGRAM,
1061 .connect_to = { EXT_IP4, EXT_PORT },
1062 .listen_at = { INT_IP4, INT_PORT },
1063 },
1064 {
1065 .desc = "TCP IPv6 drop on reuseport",
1066 .lookup_prog = skel->progs.select_sock_a,
1067 .reuseport_prog = skel->progs.reuseport_drop,
1068 .sock_map = skel->maps.redir_map,
1069 .sotype = SOCK_STREAM,
1070 .connect_to = { EXT_IP6, EXT_PORT },
1071 .listen_at = { INT_IP6, INT_PORT },
1072 },
1073 };
1074 const struct test *t;
1075
1076 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1077 if (test__start_subtest(t->desc))
1078 drop_on_reuseport(t);
1079 }
1080}
1081
1082static void run_sk_assign(struct test_sk_lookup *skel,
1083 struct bpf_program *lookup_prog,
1084 const char *remote_ip, const char *local_ip)
1085{
1086 int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 };
1087 struct bpf_sk_lookup ctx;
1088 __u64 server_cookie;
1089 int i, err;
1090
1091 DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
1092 .ctx_in = &ctx,
1093 .ctx_size_in = sizeof(ctx),
1094 .ctx_out = &ctx,
1095 .ctx_size_out = sizeof(ctx),
1096 );
1097
1098 if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT))
1099 return;
1100
1101 ctx.protocol = IPPROTO_TCP;
1102
1103 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1104 server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL);
1105 if (server_fds[i] < 0)
1106 goto close_servers;
1107
1108 err = update_lookup_map(skel->maps.redir_map, i,
1109 server_fds[i]);
1110 if (err)
1111 goto close_servers;
1112 }
1113
1114 server_cookie = socket_cookie(server_fds[SERVER_B]);
1115 if (!server_cookie)
1116 return;
1117
1118 err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts);
1119 if (CHECK(err, "test_run", "failed with error %d\n", errno))
1120 goto close_servers;
1121
1122 if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n"))
1123 goto close_servers;
1124
1125 CHECK(ctx.cookie != server_cookie, "ctx.cookie",
1126 "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie);
1127
1128close_servers:
1129 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1130 if (server_fds[i] != -1)
1131 close(server_fds[i]);
1132 }
1133}
1134
1135static void run_sk_assign_v4(struct test_sk_lookup *skel,
1136 struct bpf_program *lookup_prog)
1137{
1138 run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4);
1139}
1140
1141static void run_sk_assign_v6(struct test_sk_lookup *skel,
1142 struct bpf_program *lookup_prog)
1143{
1144 run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6);
1145}
1146
1147static void run_sk_assign_connected(struct test_sk_lookup *skel,
1148 int sotype)
1149{
1150 int err, client_fd, connected_fd, server_fd;
1151 struct bpf_link *lookup_link;
1152
1153 server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL);
1154 if (server_fd < 0)
1155 return;
1156
1157 connected_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1158 if (connected_fd < 0)
1159 goto out_close_server;
1160
1161 /* Put a connected socket in redirect map */
1162 err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd);
1163 if (err)
1164 goto out_close_connected;
1165
1166 lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport);
1167 if (!lookup_link)
1168 goto out_close_connected;
1169
1170 /* Try to redirect TCP SYN / UDP packet to a connected socket */
1171 client_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1172 if (client_fd < 0)
1173 goto out_unlink_prog;
1174 if (sotype == SOCK_DGRAM) {
1175 send_byte(client_fd);
1176 recv_byte(server_fd);
1177 }
1178
1179 close(client_fd);
1180out_unlink_prog:
1181 bpf_link__destroy(lookup_link);
1182out_close_connected:
1183 close(connected_fd);
1184out_close_server:
1185 close(server_fd);
1186}
1187
1188static void test_sk_assign_helper(struct test_sk_lookup *skel)
1189{
1190 if (test__start_subtest("sk_assign returns EEXIST"))
1191 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist);
1192 if (test__start_subtest("sk_assign honors F_REPLACE"))
1193 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag);
1194 if (test__start_subtest("sk_assign accepts NULL socket"))
1195 run_sk_assign_v4(skel, skel->progs.sk_assign_null);
1196 if (test__start_subtest("access ctx->sk"))
1197 run_sk_assign_v4(skel, skel->progs.access_ctx_sk);
1198 if (test__start_subtest("narrow access to ctx v4"))
1199 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access);
1200 if (test__start_subtest("narrow access to ctx v6"))
1201 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access);
1202 if (test__start_subtest("sk_assign rejects TCP established"))
1203 run_sk_assign_connected(skel, SOCK_STREAM);
1204 if (test__start_subtest("sk_assign rejects UDP connected"))
1205 run_sk_assign_connected(skel, SOCK_DGRAM);
1206}
1207
1208struct test_multi_prog {
1209 const char *desc;
1210 struct bpf_program *prog1;
1211 struct bpf_program *prog2;
1212 struct bpf_map *redir_map;
1213 struct bpf_map *run_map;
1214 int expect_errno;
1215 struct inet_addr listen_at;
1216};
1217
1218static void run_multi_prog_lookup(const struct test_multi_prog *t)
1219{
1220 struct sockaddr_storage dst = {};
1221 int map_fd, server_fd, client_fd;
1222 struct bpf_link *link1, *link2;
1223 int prog_idx, done, err;
1224
1225 map_fd = bpf_map__fd(t->run_map);
1226
1227 done = 0;
1228 prog_idx = PROG1;
1229 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1230 if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1231 return;
1232 prog_idx = PROG2;
1233 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1234 if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1235 return;
1236
1237 link1 = attach_lookup_prog(t->prog1);
1238 if (!link1)
1239 return;
1240 link2 = attach_lookup_prog(t->prog2);
1241 if (!link2)
1242 goto out_unlink1;
1243
1244 server_fd = make_server(SOCK_STREAM, t->listen_at.ip,
1245 t->listen_at.port, NULL);
1246 if (server_fd < 0)
1247 goto out_unlink2;
1248
1249 err = update_lookup_map(t->redir_map, SERVER_A, server_fd);
1250 if (err)
1251 goto out_close_server;
1252
1253 client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst);
1254 if (client_fd < 0)
1255 goto out_close_server;
1256
1257 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
1258 if (CHECK(err && !t->expect_errno, "connect",
1259 "unexpected error %d\n", errno))
1260 goto out_close_client;
1261 if (CHECK(err && t->expect_errno && errno != t->expect_errno,
1262 "connect", "unexpected error %d\n", errno))
1263 goto out_close_client;
1264
1265 done = 0;
1266 prog_idx = PROG1;
1267 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1268 CHECK(err, "bpf_map_lookup_elem", "failed\n");
1269 CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n");
1270
1271 done = 0;
1272 prog_idx = PROG2;
1273 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1274 CHECK(err, "bpf_map_lookup_elem", "failed\n");
1275 CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n");
1276
1277out_close_client:
1278 close(client_fd);
1279out_close_server:
1280 close(server_fd);
1281out_unlink2:
1282 bpf_link__destroy(link2);
1283out_unlink1:
1284 bpf_link__destroy(link1);
1285}
1286
1287static void test_multi_prog_lookup(struct test_sk_lookup *skel)
1288{
1289 struct test_multi_prog tests[] = {
1290 {
1291 .desc = "multi prog - pass, pass",
1292 .prog1 = skel->progs.multi_prog_pass1,
1293 .prog2 = skel->progs.multi_prog_pass2,
1294 .listen_at = { EXT_IP4, EXT_PORT },
1295 },
1296 {
1297 .desc = "multi prog - drop, drop",
1298 .prog1 = skel->progs.multi_prog_drop1,
1299 .prog2 = skel->progs.multi_prog_drop2,
1300 .listen_at = { EXT_IP4, EXT_PORT },
1301 .expect_errno = ECONNREFUSED,
1302 },
1303 {
1304 .desc = "multi prog - pass, drop",
1305 .prog1 = skel->progs.multi_prog_pass1,
1306 .prog2 = skel->progs.multi_prog_drop2,
1307 .listen_at = { EXT_IP4, EXT_PORT },
1308 .expect_errno = ECONNREFUSED,
1309 },
1310 {
1311 .desc = "multi prog - drop, pass",
1312 .prog1 = skel->progs.multi_prog_drop1,
1313 .prog2 = skel->progs.multi_prog_pass2,
1314 .listen_at = { EXT_IP4, EXT_PORT },
1315 .expect_errno = ECONNREFUSED,
1316 },
1317 {
1318 .desc = "multi prog - pass, redir",
1319 .prog1 = skel->progs.multi_prog_pass1,
1320 .prog2 = skel->progs.multi_prog_redir2,
1321 .listen_at = { INT_IP4, INT_PORT },
1322 },
1323 {
1324 .desc = "multi prog - redir, pass",
1325 .prog1 = skel->progs.multi_prog_redir1,
1326 .prog2 = skel->progs.multi_prog_pass2,
1327 .listen_at = { INT_IP4, INT_PORT },
1328 },
1329 {
1330 .desc = "multi prog - drop, redir",
1331 .prog1 = skel->progs.multi_prog_drop1,
1332 .prog2 = skel->progs.multi_prog_redir2,
1333 .listen_at = { INT_IP4, INT_PORT },
1334 },
1335 {
1336 .desc = "multi prog - redir, drop",
1337 .prog1 = skel->progs.multi_prog_redir1,
1338 .prog2 = skel->progs.multi_prog_drop2,
1339 .listen_at = { INT_IP4, INT_PORT },
1340 },
1341 {
1342 .desc = "multi prog - redir, redir",
1343 .prog1 = skel->progs.multi_prog_redir1,
1344 .prog2 = skel->progs.multi_prog_redir2,
1345 .listen_at = { INT_IP4, INT_PORT },
1346 },
1347 };
1348 struct test_multi_prog *t;
1349
1350 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1351 t->redir_map = skel->maps.redir_map;
1352 t->run_map = skel->maps.run_map;
1353 if (test__start_subtest(t->desc))
1354 run_multi_prog_lookup(t);
1355 }
1356}
1357
1358static void run_tests(struct test_sk_lookup *skel)
1359{
1360 if (test__start_subtest("query lookup prog"))
1361 query_lookup_prog(skel);
1362 test_redirect_lookup(skel);
1363 test_drop_on_lookup(skel);
1364 test_drop_on_reuseport(skel);
1365 test_sk_assign_helper(skel);
1366 test_multi_prog_lookup(skel);
1367}
1368
1369static int switch_netns(void)
1370{
1371 static const char * const setup_script[] = {
1372 "ip -6 addr add dev lo " EXT_IP6 "/128",
1373 "ip -6 addr add dev lo " INT_IP6 "/128",
1374 "ip link set dev lo up",
1375 NULL,
1376 };
1377 const char * const *cmd;
1378 int err;
1379
1380 err = unshare(CLONE_NEWNET);
1381 if (CHECK(err, "unshare", "failed\n")) {
1382 log_err("unshare(CLONE_NEWNET)");
1383 return -1;
1384 }
1385
1386 for (cmd = setup_script; *cmd; cmd++) {
1387 err = system(*cmd);
1388 if (CHECK(err, "system", "failed\n")) {
1389 log_err("system(%s)", *cmd);
1390 return -1;
1391 }
1392 }
1393
1394 return 0;
1395}
1396
1397void test_sk_lookup(void)
1398{
1399 struct test_sk_lookup *skel;
1400 int err;
1401
1402 err = switch_netns();
1403 if (err)
1404 return;
1405
1406 skel = test_sk_lookup__open_and_load();
1407 if (CHECK(!skel, "skel open_and_load", "failed\n"))
1408 return;
1409
1410 run_tests(skel);
1411
1412 test_sk_lookup__destroy(skel);
1413}
1// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2// Copyright (c) 2020 Cloudflare
3/*
4 * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP).
5 *
6 * Tests exercise:
7 * - attaching/detaching/querying programs to BPF_SK_LOOKUP hook,
8 * - redirecting socket lookup to a socket selected by BPF program,
9 * - failing a socket lookup on BPF program's request,
10 * - error scenarios for selecting a socket from BPF program,
11 * - accessing BPF program context,
12 * - attaching and running multiple BPF programs.
13 *
14 * Tests run in a dedicated network namespace.
15 */
16
17#define _GNU_SOURCE
18#include <arpa/inet.h>
19#include <assert.h>
20#include <errno.h>
21#include <error.h>
22#include <fcntl.h>
23#include <sched.h>
24#include <stdio.h>
25#include <sys/types.h>
26#include <sys/stat.h>
27#include <unistd.h>
28
29#include <bpf/libbpf.h>
30#include <bpf/bpf.h>
31
32#include "test_progs.h"
33#include "bpf_rlimit.h"
34#include "bpf_util.h"
35#include "cgroup_helpers.h"
36#include "network_helpers.h"
37#include "testing_helpers.h"
38#include "test_sk_lookup.skel.h"
39
40/* External (address, port) pairs the client sends packets to. */
41#define EXT_IP4 "127.0.0.1"
42#define EXT_IP6 "fd00::1"
43#define EXT_PORT 7007
44
45/* Internal (address, port) pairs the server listens/receives at. */
46#define INT_IP4 "127.0.0.2"
47#define INT_IP4_V6 "::ffff:127.0.0.2"
48#define INT_IP6 "fd00::2"
49#define INT_PORT 8008
50
51#define IO_TIMEOUT_SEC 3
52
53enum server {
54 SERVER_A = 0,
55 SERVER_B = 1,
56 MAX_SERVERS,
57};
58
59enum {
60 PROG1 = 0,
61 PROG2,
62};
63
64struct inet_addr {
65 const char *ip;
66 unsigned short port;
67};
68
69struct test {
70 const char *desc;
71 struct bpf_program *lookup_prog;
72 struct bpf_program *reuseport_prog;
73 struct bpf_map *sock_map;
74 int sotype;
75 struct inet_addr connect_to;
76 struct inet_addr listen_at;
77 enum server accept_on;
78 bool reuseport_has_conns; /* Add a connected socket to reuseport group */
79};
80
81static __u32 duration; /* for CHECK macro */
82
83static bool is_ipv6(const char *ip)
84{
85 return !!strchr(ip, ':');
86}
87
88static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog)
89{
90 int err, prog_fd;
91
92 prog_fd = bpf_program__fd(reuseport_prog);
93 if (prog_fd < 0) {
94 errno = -prog_fd;
95 return -1;
96 }
97
98 err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF,
99 &prog_fd, sizeof(prog_fd));
100 if (err)
101 return -1;
102
103 return 0;
104}
105
106static socklen_t inetaddr_len(const struct sockaddr_storage *addr)
107{
108 return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) :
109 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0);
110}
111
112static int make_socket(int sotype, const char *ip, int port,
113 struct sockaddr_storage *addr)
114{
115 struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC };
116 int err, family, fd;
117
118 family = is_ipv6(ip) ? AF_INET6 : AF_INET;
119 err = make_sockaddr(family, ip, port, addr, NULL);
120 if (CHECK(err, "make_address", "failed\n"))
121 return -1;
122
123 fd = socket(addr->ss_family, sotype, 0);
124 if (CHECK(fd < 0, "socket", "failed\n")) {
125 log_err("failed to make socket");
126 return -1;
127 }
128
129 err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
130 if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) {
131 log_err("failed to set SNDTIMEO");
132 close(fd);
133 return -1;
134 }
135
136 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
137 if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) {
138 log_err("failed to set RCVTIMEO");
139 close(fd);
140 return -1;
141 }
142
143 return fd;
144}
145
146static int make_server(int sotype, const char *ip, int port,
147 struct bpf_program *reuseport_prog)
148{
149 struct sockaddr_storage addr = {0};
150 const int one = 1;
151 int err, fd = -1;
152
153 fd = make_socket(sotype, ip, port, &addr);
154 if (fd < 0)
155 return -1;
156
157 /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */
158 if (sotype == SOCK_DGRAM) {
159 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one,
160 sizeof(one));
161 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) {
162 log_err("failed to enable IP_RECVORIGDSTADDR");
163 goto fail;
164 }
165 }
166
167 if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) {
168 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one,
169 sizeof(one));
170 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) {
171 log_err("failed to enable IPV6_RECVORIGDSTADDR");
172 goto fail;
173 }
174 }
175
176 if (sotype == SOCK_STREAM) {
177 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
178 sizeof(one));
179 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) {
180 log_err("failed to enable SO_REUSEADDR");
181 goto fail;
182 }
183 }
184
185 if (reuseport_prog) {
186 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one,
187 sizeof(one));
188 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) {
189 log_err("failed to enable SO_REUSEPORT");
190 goto fail;
191 }
192 }
193
194 err = bind(fd, (void *)&addr, inetaddr_len(&addr));
195 if (CHECK(err, "bind", "failed\n")) {
196 log_err("failed to bind listen socket");
197 goto fail;
198 }
199
200 if (sotype == SOCK_STREAM) {
201 err = listen(fd, SOMAXCONN);
202 if (CHECK(err, "make_server", "listen")) {
203 log_err("failed to listen on port %d", port);
204 goto fail;
205 }
206 }
207
208 /* Late attach reuseport prog so we can have one init path */
209 if (reuseport_prog) {
210 err = attach_reuseport(fd, reuseport_prog);
211 if (CHECK(err, "attach_reuseport", "failed\n")) {
212 log_err("failed to attach reuseport prog");
213 goto fail;
214 }
215 }
216
217 return fd;
218fail:
219 close(fd);
220 return -1;
221}
222
223static int make_client(int sotype, const char *ip, int port)
224{
225 struct sockaddr_storage addr = {0};
226 int err, fd;
227
228 fd = make_socket(sotype, ip, port, &addr);
229 if (fd < 0)
230 return -1;
231
232 err = connect(fd, (void *)&addr, inetaddr_len(&addr));
233 if (CHECK(err, "make_client", "connect")) {
234 log_err("failed to connect client socket");
235 goto fail;
236 }
237
238 return fd;
239fail:
240 close(fd);
241 return -1;
242}
243
244static __u64 socket_cookie(int fd)
245{
246 __u64 cookie;
247 socklen_t cookie_len = sizeof(cookie);
248
249 if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0,
250 "getsockopt(SO_COOKIE)", "%s\n", strerror(errno)))
251 return 0;
252 return cookie;
253}
254
255static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port,
256 const char *remote_ip, __u16 remote_port)
257{
258 void *local, *remote;
259 int err;
260
261 memset(ctx, 0, sizeof(*ctx));
262 ctx->local_port = local_port;
263 ctx->remote_port = htons(remote_port);
264
265 if (is_ipv6(local_ip)) {
266 ctx->family = AF_INET6;
267 local = &ctx->local_ip6[0];
268 remote = &ctx->remote_ip6[0];
269 } else {
270 ctx->family = AF_INET;
271 local = &ctx->local_ip4;
272 remote = &ctx->remote_ip4;
273 }
274
275 err = inet_pton(ctx->family, local_ip, local);
276 if (CHECK(err != 1, "inet_pton", "local_ip failed\n"))
277 return 1;
278
279 err = inet_pton(ctx->family, remote_ip, remote);
280 if (CHECK(err != 1, "inet_pton", "remote_ip failed\n"))
281 return 1;
282
283 return 0;
284}
285
286static int send_byte(int fd)
287{
288 ssize_t n;
289
290 errno = 0;
291 n = send(fd, "a", 1, 0);
292 if (CHECK(n <= 0, "send_byte", "send")) {
293 log_err("failed/partial send");
294 return -1;
295 }
296 return 0;
297}
298
299static int recv_byte(int fd)
300{
301 char buf[1];
302 ssize_t n;
303
304 n = recv(fd, buf, sizeof(buf), 0);
305 if (CHECK(n <= 0, "recv_byte", "recv")) {
306 log_err("failed/partial recv");
307 return -1;
308 }
309 return 0;
310}
311
312static int tcp_recv_send(int server_fd)
313{
314 char buf[1];
315 int ret, fd;
316 ssize_t n;
317
318 fd = accept(server_fd, NULL, NULL);
319 if (CHECK(fd < 0, "accept", "failed\n")) {
320 log_err("failed to accept");
321 return -1;
322 }
323
324 n = recv(fd, buf, sizeof(buf), 0);
325 if (CHECK(n <= 0, "recv", "failed\n")) {
326 log_err("failed/partial recv");
327 ret = -1;
328 goto close;
329 }
330
331 n = send(fd, buf, n, 0);
332 if (CHECK(n <= 0, "send", "failed\n")) {
333 log_err("failed/partial send");
334 ret = -1;
335 goto close;
336 }
337
338 ret = 0;
339close:
340 close(fd);
341 return ret;
342}
343
344static void v4_to_v6(struct sockaddr_storage *ss)
345{
346 struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss;
347 struct sockaddr_in v4 = *(struct sockaddr_in *)ss;
348
349 v6->sin6_family = AF_INET6;
350 v6->sin6_port = v4.sin_port;
351 v6->sin6_addr.s6_addr[10] = 0xff;
352 v6->sin6_addr.s6_addr[11] = 0xff;
353 memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4);
354 memset(&v6->sin6_addr.s6_addr[0], 0, 10);
355}
356
357static int udp_recv_send(int server_fd)
358{
359 char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
360 struct sockaddr_storage _src_addr = { 0 };
361 struct sockaddr_storage *src_addr = &_src_addr;
362 struct sockaddr_storage *dst_addr = NULL;
363 struct msghdr msg = { 0 };
364 struct iovec iov = { 0 };
365 struct cmsghdr *cm;
366 char buf[1];
367 int ret, fd;
368 ssize_t n;
369
370 iov.iov_base = buf;
371 iov.iov_len = sizeof(buf);
372
373 msg.msg_name = src_addr;
374 msg.msg_namelen = sizeof(*src_addr);
375 msg.msg_iov = &iov;
376 msg.msg_iovlen = 1;
377 msg.msg_control = cmsg_buf;
378 msg.msg_controllen = sizeof(cmsg_buf);
379
380 errno = 0;
381 n = recvmsg(server_fd, &msg, 0);
382 if (CHECK(n <= 0, "recvmsg", "failed\n")) {
383 log_err("failed to receive");
384 return -1;
385 }
386 if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n"))
387 return -1;
388
389 for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) {
390 if ((cm->cmsg_level == SOL_IP &&
391 cm->cmsg_type == IP_ORIGDSTADDR) ||
392 (cm->cmsg_level == SOL_IPV6 &&
393 cm->cmsg_type == IPV6_ORIGDSTADDR)) {
394 dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm);
395 break;
396 }
397 log_err("warning: ignored cmsg at level %d type %d",
398 cm->cmsg_level, cm->cmsg_type);
399 }
400 if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n"))
401 return -1;
402
403 /* Server socket bound to IPv4-mapped IPv6 address */
404 if (src_addr->ss_family == AF_INET6 &&
405 dst_addr->ss_family == AF_INET) {
406 v4_to_v6(dst_addr);
407 }
408
409 /* Reply from original destination address. */
410 fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0);
411 if (CHECK(fd < 0, "socket", "failed\n")) {
412 log_err("failed to create tx socket");
413 return -1;
414 }
415
416 ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr));
417 if (CHECK(ret, "bind", "failed\n")) {
418 log_err("failed to bind tx socket");
419 goto out;
420 }
421
422 msg.msg_control = NULL;
423 msg.msg_controllen = 0;
424 n = sendmsg(fd, &msg, 0);
425 if (CHECK(n <= 0, "sendmsg", "failed\n")) {
426 log_err("failed to send echo reply");
427 ret = -1;
428 goto out;
429 }
430
431 ret = 0;
432out:
433 close(fd);
434 return ret;
435}
436
437static int tcp_echo_test(int client_fd, int server_fd)
438{
439 int err;
440
441 err = send_byte(client_fd);
442 if (err)
443 return -1;
444 err = tcp_recv_send(server_fd);
445 if (err)
446 return -1;
447 err = recv_byte(client_fd);
448 if (err)
449 return -1;
450
451 return 0;
452}
453
454static int udp_echo_test(int client_fd, int server_fd)
455{
456 int err;
457
458 err = send_byte(client_fd);
459 if (err)
460 return -1;
461 err = udp_recv_send(server_fd);
462 if (err)
463 return -1;
464 err = recv_byte(client_fd);
465 if (err)
466 return -1;
467
468 return 0;
469}
470
471static struct bpf_link *attach_lookup_prog(struct bpf_program *prog)
472{
473 struct bpf_link *link;
474 int net_fd;
475
476 net_fd = open("/proc/self/ns/net", O_RDONLY);
477 if (CHECK(net_fd < 0, "open", "failed\n")) {
478 log_err("failed to open /proc/self/ns/net");
479 return NULL;
480 }
481
482 link = bpf_program__attach_netns(prog, net_fd);
483 if (!ASSERT_OK_PTR(link, "bpf_program__attach_netns")) {
484 errno = -PTR_ERR(link);
485 log_err("failed to attach program '%s' to netns",
486 bpf_program__name(prog));
487 link = NULL;
488 }
489
490 close(net_fd);
491 return link;
492}
493
494static int update_lookup_map(struct bpf_map *map, int index, int sock_fd)
495{
496 int err, map_fd;
497 uint64_t value;
498
499 map_fd = bpf_map__fd(map);
500 if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) {
501 errno = -map_fd;
502 log_err("failed to get map FD");
503 return -1;
504 }
505
506 value = (uint64_t)sock_fd;
507 err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST);
508 if (CHECK(err, "bpf_map_update_elem", "failed\n")) {
509 log_err("failed to update redir_map @ %d", index);
510 return -1;
511 }
512
513 return 0;
514}
515
516static void query_lookup_prog(struct test_sk_lookup *skel)
517{
518 struct bpf_link *link[3] = {};
519 struct bpf_link_info info;
520 __u32 attach_flags = 0;
521 __u32 prog_ids[3] = {};
522 __u32 prog_cnt = 3;
523 __u32 prog_id;
524 int net_fd;
525 int err;
526
527 net_fd = open("/proc/self/ns/net", O_RDONLY);
528 if (CHECK(net_fd < 0, "open", "failed\n")) {
529 log_err("failed to open /proc/self/ns/net");
530 return;
531 }
532
533 link[0] = attach_lookup_prog(skel->progs.lookup_pass);
534 if (!link[0])
535 goto close;
536 link[1] = attach_lookup_prog(skel->progs.lookup_pass);
537 if (!link[1])
538 goto detach;
539 link[2] = attach_lookup_prog(skel->progs.lookup_drop);
540 if (!link[2])
541 goto detach;
542
543 err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */,
544 &attach_flags, prog_ids, &prog_cnt);
545 if (CHECK(err, "bpf_prog_query", "failed\n")) {
546 log_err("failed to query lookup prog");
547 goto detach;
548 }
549
550 errno = 0;
551 if (CHECK(attach_flags != 0, "bpf_prog_query",
552 "wrong attach_flags on query: %u", attach_flags))
553 goto detach;
554 if (CHECK(prog_cnt != 3, "bpf_prog_query",
555 "wrong program count on query: %u", prog_cnt))
556 goto detach;
557 prog_id = link_info_prog_id(link[0], &info);
558 CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
559 "invalid program #0 id on query: %u != %u\n",
560 prog_ids[0], prog_id);
561 CHECK(info.netns.netns_ino == 0, "netns_ino",
562 "unexpected netns_ino: %u\n", info.netns.netns_ino);
563 prog_id = link_info_prog_id(link[1], &info);
564 CHECK(prog_ids[1] != prog_id, "bpf_prog_query",
565 "invalid program #1 id on query: %u != %u\n",
566 prog_ids[1], prog_id);
567 CHECK(info.netns.netns_ino == 0, "netns_ino",
568 "unexpected netns_ino: %u\n", info.netns.netns_ino);
569 prog_id = link_info_prog_id(link[2], &info);
570 CHECK(prog_ids[2] != prog_id, "bpf_prog_query",
571 "invalid program #2 id on query: %u != %u\n",
572 prog_ids[2], prog_id);
573 CHECK(info.netns.netns_ino == 0, "netns_ino",
574 "unexpected netns_ino: %u\n", info.netns.netns_ino);
575
576 err = bpf_link__detach(link[0]);
577 if (CHECK(err, "link_detach", "failed %d\n", err))
578 goto detach;
579
580 /* prog id is still there, but netns_ino is zeroed out */
581 prog_id = link_info_prog_id(link[0], &info);
582 CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
583 "invalid program #0 id on query: %u != %u\n",
584 prog_ids[0], prog_id);
585 CHECK(info.netns.netns_ino != 0, "netns_ino",
586 "unexpected netns_ino: %u\n", info.netns.netns_ino);
587
588detach:
589 if (link[2])
590 bpf_link__destroy(link[2]);
591 if (link[1])
592 bpf_link__destroy(link[1]);
593 if (link[0])
594 bpf_link__destroy(link[0]);
595close:
596 close(net_fd);
597}
598
599static void run_lookup_prog(const struct test *t)
600{
601 int server_fds[MAX_SERVERS] = { -1 };
602 int client_fd, reuse_conn_fd = -1;
603 struct bpf_link *lookup_link;
604 int i, err;
605
606 lookup_link = attach_lookup_prog(t->lookup_prog);
607 if (!lookup_link)
608 return;
609
610 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
611 server_fds[i] = make_server(t->sotype, t->listen_at.ip,
612 t->listen_at.port,
613 t->reuseport_prog);
614 if (server_fds[i] < 0)
615 goto close;
616
617 err = update_lookup_map(t->sock_map, i, server_fds[i]);
618 if (err)
619 goto close;
620
621 /* want just one server for non-reuseport test */
622 if (!t->reuseport_prog)
623 break;
624 }
625
626 /* Regular UDP socket lookup with reuseport behaves
627 * differently when reuseport group contains connected
628 * sockets. Check that adding a connected UDP socket to the
629 * reuseport group does not affect how reuseport works with
630 * BPF socket lookup.
631 */
632 if (t->reuseport_has_conns) {
633 struct sockaddr_storage addr = {};
634 socklen_t len = sizeof(addr);
635
636 /* Add an extra socket to reuseport group */
637 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip,
638 t->listen_at.port,
639 t->reuseport_prog);
640 if (reuse_conn_fd < 0)
641 goto close;
642
643 /* Connect the extra socket to itself */
644 err = getsockname(reuse_conn_fd, (void *)&addr, &len);
645 if (CHECK(err, "getsockname", "errno %d\n", errno))
646 goto close;
647 err = connect(reuse_conn_fd, (void *)&addr, len);
648 if (CHECK(err, "connect", "errno %d\n", errno))
649 goto close;
650 }
651
652 client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port);
653 if (client_fd < 0)
654 goto close;
655
656 if (t->sotype == SOCK_STREAM)
657 tcp_echo_test(client_fd, server_fds[t->accept_on]);
658 else
659 udp_echo_test(client_fd, server_fds[t->accept_on]);
660
661 close(client_fd);
662close:
663 if (reuse_conn_fd != -1)
664 close(reuse_conn_fd);
665 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
666 if (server_fds[i] != -1)
667 close(server_fds[i]);
668 }
669 bpf_link__destroy(lookup_link);
670}
671
672static void test_redirect_lookup(struct test_sk_lookup *skel)
673{
674 const struct test tests[] = {
675 {
676 .desc = "TCP IPv4 redir port",
677 .lookup_prog = skel->progs.redir_port,
678 .sock_map = skel->maps.redir_map,
679 .sotype = SOCK_STREAM,
680 .connect_to = { EXT_IP4, EXT_PORT },
681 .listen_at = { EXT_IP4, INT_PORT },
682 },
683 {
684 .desc = "TCP IPv4 redir addr",
685 .lookup_prog = skel->progs.redir_ip4,
686 .sock_map = skel->maps.redir_map,
687 .sotype = SOCK_STREAM,
688 .connect_to = { EXT_IP4, EXT_PORT },
689 .listen_at = { INT_IP4, EXT_PORT },
690 },
691 {
692 .desc = "TCP IPv4 redir with reuseport",
693 .lookup_prog = skel->progs.select_sock_a,
694 .reuseport_prog = skel->progs.select_sock_b,
695 .sock_map = skel->maps.redir_map,
696 .sotype = SOCK_STREAM,
697 .connect_to = { EXT_IP4, EXT_PORT },
698 .listen_at = { INT_IP4, INT_PORT },
699 .accept_on = SERVER_B,
700 },
701 {
702 .desc = "TCP IPv4 redir skip reuseport",
703 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
704 .reuseport_prog = skel->progs.select_sock_b,
705 .sock_map = skel->maps.redir_map,
706 .sotype = SOCK_STREAM,
707 .connect_to = { EXT_IP4, EXT_PORT },
708 .listen_at = { INT_IP4, INT_PORT },
709 .accept_on = SERVER_A,
710 },
711 {
712 .desc = "TCP IPv6 redir port",
713 .lookup_prog = skel->progs.redir_port,
714 .sock_map = skel->maps.redir_map,
715 .sotype = SOCK_STREAM,
716 .connect_to = { EXT_IP6, EXT_PORT },
717 .listen_at = { EXT_IP6, INT_PORT },
718 },
719 {
720 .desc = "TCP IPv6 redir addr",
721 .lookup_prog = skel->progs.redir_ip6,
722 .sock_map = skel->maps.redir_map,
723 .sotype = SOCK_STREAM,
724 .connect_to = { EXT_IP6, EXT_PORT },
725 .listen_at = { INT_IP6, EXT_PORT },
726 },
727 {
728 .desc = "TCP IPv4->IPv6 redir port",
729 .lookup_prog = skel->progs.redir_port,
730 .sock_map = skel->maps.redir_map,
731 .sotype = SOCK_STREAM,
732 .connect_to = { EXT_IP4, EXT_PORT },
733 .listen_at = { INT_IP4_V6, INT_PORT },
734 },
735 {
736 .desc = "TCP IPv6 redir with reuseport",
737 .lookup_prog = skel->progs.select_sock_a,
738 .reuseport_prog = skel->progs.select_sock_b,
739 .sock_map = skel->maps.redir_map,
740 .sotype = SOCK_STREAM,
741 .connect_to = { EXT_IP6, EXT_PORT },
742 .listen_at = { INT_IP6, INT_PORT },
743 .accept_on = SERVER_B,
744 },
745 {
746 .desc = "TCP IPv6 redir skip reuseport",
747 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
748 .reuseport_prog = skel->progs.select_sock_b,
749 .sock_map = skel->maps.redir_map,
750 .sotype = SOCK_STREAM,
751 .connect_to = { EXT_IP6, EXT_PORT },
752 .listen_at = { INT_IP6, INT_PORT },
753 .accept_on = SERVER_A,
754 },
755 {
756 .desc = "UDP IPv4 redir port",
757 .lookup_prog = skel->progs.redir_port,
758 .sock_map = skel->maps.redir_map,
759 .sotype = SOCK_DGRAM,
760 .connect_to = { EXT_IP4, EXT_PORT },
761 .listen_at = { EXT_IP4, INT_PORT },
762 },
763 {
764 .desc = "UDP IPv4 redir addr",
765 .lookup_prog = skel->progs.redir_ip4,
766 .sock_map = skel->maps.redir_map,
767 .sotype = SOCK_DGRAM,
768 .connect_to = { EXT_IP4, EXT_PORT },
769 .listen_at = { INT_IP4, EXT_PORT },
770 },
771 {
772 .desc = "UDP IPv4 redir with reuseport",
773 .lookup_prog = skel->progs.select_sock_a,
774 .reuseport_prog = skel->progs.select_sock_b,
775 .sock_map = skel->maps.redir_map,
776 .sotype = SOCK_DGRAM,
777 .connect_to = { EXT_IP4, EXT_PORT },
778 .listen_at = { INT_IP4, INT_PORT },
779 .accept_on = SERVER_B,
780 },
781 {
782 .desc = "UDP IPv4 redir and reuseport with conns",
783 .lookup_prog = skel->progs.select_sock_a,
784 .reuseport_prog = skel->progs.select_sock_b,
785 .sock_map = skel->maps.redir_map,
786 .sotype = SOCK_DGRAM,
787 .connect_to = { EXT_IP4, EXT_PORT },
788 .listen_at = { INT_IP4, INT_PORT },
789 .accept_on = SERVER_B,
790 .reuseport_has_conns = true,
791 },
792 {
793 .desc = "UDP IPv4 redir skip reuseport",
794 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
795 .reuseport_prog = skel->progs.select_sock_b,
796 .sock_map = skel->maps.redir_map,
797 .sotype = SOCK_DGRAM,
798 .connect_to = { EXT_IP4, EXT_PORT },
799 .listen_at = { INT_IP4, INT_PORT },
800 .accept_on = SERVER_A,
801 },
802 {
803 .desc = "UDP IPv6 redir port",
804 .lookup_prog = skel->progs.redir_port,
805 .sock_map = skel->maps.redir_map,
806 .sotype = SOCK_DGRAM,
807 .connect_to = { EXT_IP6, EXT_PORT },
808 .listen_at = { EXT_IP6, INT_PORT },
809 },
810 {
811 .desc = "UDP IPv6 redir addr",
812 .lookup_prog = skel->progs.redir_ip6,
813 .sock_map = skel->maps.redir_map,
814 .sotype = SOCK_DGRAM,
815 .connect_to = { EXT_IP6, EXT_PORT },
816 .listen_at = { INT_IP6, EXT_PORT },
817 },
818 {
819 .desc = "UDP IPv4->IPv6 redir port",
820 .lookup_prog = skel->progs.redir_port,
821 .sock_map = skel->maps.redir_map,
822 .sotype = SOCK_DGRAM,
823 .listen_at = { INT_IP4_V6, INT_PORT },
824 .connect_to = { EXT_IP4, EXT_PORT },
825 },
826 {
827 .desc = "UDP IPv6 redir and reuseport",
828 .lookup_prog = skel->progs.select_sock_a,
829 .reuseport_prog = skel->progs.select_sock_b,
830 .sock_map = skel->maps.redir_map,
831 .sotype = SOCK_DGRAM,
832 .connect_to = { EXT_IP6, EXT_PORT },
833 .listen_at = { INT_IP6, INT_PORT },
834 .accept_on = SERVER_B,
835 },
836 {
837 .desc = "UDP IPv6 redir and reuseport with conns",
838 .lookup_prog = skel->progs.select_sock_a,
839 .reuseport_prog = skel->progs.select_sock_b,
840 .sock_map = skel->maps.redir_map,
841 .sotype = SOCK_DGRAM,
842 .connect_to = { EXT_IP6, EXT_PORT },
843 .listen_at = { INT_IP6, INT_PORT },
844 .accept_on = SERVER_B,
845 .reuseport_has_conns = true,
846 },
847 {
848 .desc = "UDP IPv6 redir skip reuseport",
849 .lookup_prog = skel->progs.select_sock_a_no_reuseport,
850 .reuseport_prog = skel->progs.select_sock_b,
851 .sock_map = skel->maps.redir_map,
852 .sotype = SOCK_DGRAM,
853 .connect_to = { EXT_IP6, EXT_PORT },
854 .listen_at = { INT_IP6, INT_PORT },
855 .accept_on = SERVER_A,
856 },
857 };
858 const struct test *t;
859
860 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
861 if (test__start_subtest(t->desc))
862 run_lookup_prog(t);
863 }
864}
865
866static void drop_on_lookup(const struct test *t)
867{
868 struct sockaddr_storage dst = {};
869 int client_fd, server_fd, err;
870 struct bpf_link *lookup_link;
871 ssize_t n;
872
873 lookup_link = attach_lookup_prog(t->lookup_prog);
874 if (!lookup_link)
875 return;
876
877 server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
878 t->reuseport_prog);
879 if (server_fd < 0)
880 goto detach;
881
882 client_fd = make_socket(t->sotype, t->connect_to.ip,
883 t->connect_to.port, &dst);
884 if (client_fd < 0)
885 goto close_srv;
886
887 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
888 if (t->sotype == SOCK_DGRAM) {
889 err = send_byte(client_fd);
890 if (err)
891 goto close_all;
892
893 /* Read out asynchronous error */
894 n = recv(client_fd, NULL, 0, 0);
895 err = n == -1;
896 }
897 if (CHECK(!err || errno != ECONNREFUSED, "connect",
898 "unexpected success or error\n"))
899 log_err("expected ECONNREFUSED on connect");
900
901close_all:
902 close(client_fd);
903close_srv:
904 close(server_fd);
905detach:
906 bpf_link__destroy(lookup_link);
907}
908
909static void test_drop_on_lookup(struct test_sk_lookup *skel)
910{
911 const struct test tests[] = {
912 {
913 .desc = "TCP IPv4 drop on lookup",
914 .lookup_prog = skel->progs.lookup_drop,
915 .sotype = SOCK_STREAM,
916 .connect_to = { EXT_IP4, EXT_PORT },
917 .listen_at = { EXT_IP4, EXT_PORT },
918 },
919 {
920 .desc = "TCP IPv6 drop on lookup",
921 .lookup_prog = skel->progs.lookup_drop,
922 .sotype = SOCK_STREAM,
923 .connect_to = { EXT_IP6, EXT_PORT },
924 .listen_at = { EXT_IP6, EXT_PORT },
925 },
926 {
927 .desc = "UDP IPv4 drop on lookup",
928 .lookup_prog = skel->progs.lookup_drop,
929 .sotype = SOCK_DGRAM,
930 .connect_to = { EXT_IP4, EXT_PORT },
931 .listen_at = { EXT_IP4, EXT_PORT },
932 },
933 {
934 .desc = "UDP IPv6 drop on lookup",
935 .lookup_prog = skel->progs.lookup_drop,
936 .sotype = SOCK_DGRAM,
937 .connect_to = { EXT_IP6, EXT_PORT },
938 .listen_at = { EXT_IP6, INT_PORT },
939 },
940 };
941 const struct test *t;
942
943 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
944 if (test__start_subtest(t->desc))
945 drop_on_lookup(t);
946 }
947}
948
949static void drop_on_reuseport(const struct test *t)
950{
951 struct sockaddr_storage dst = { 0 };
952 int client, server1, server2, err;
953 struct bpf_link *lookup_link;
954 ssize_t n;
955
956 lookup_link = attach_lookup_prog(t->lookup_prog);
957 if (!lookup_link)
958 return;
959
960 server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
961 t->reuseport_prog);
962 if (server1 < 0)
963 goto detach;
964
965 err = update_lookup_map(t->sock_map, SERVER_A, server1);
966 if (err)
967 goto detach;
968
969 /* second server on destination address we should never reach */
970 server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
971 NULL /* reuseport prog */);
972 if (server2 < 0)
973 goto close_srv1;
974
975 client = make_socket(t->sotype, t->connect_to.ip,
976 t->connect_to.port, &dst);
977 if (client < 0)
978 goto close_srv2;
979
980 err = connect(client, (void *)&dst, inetaddr_len(&dst));
981 if (t->sotype == SOCK_DGRAM) {
982 err = send_byte(client);
983 if (err)
984 goto close_all;
985
986 /* Read out asynchronous error */
987 n = recv(client, NULL, 0, 0);
988 err = n == -1;
989 }
990 if (CHECK(!err || errno != ECONNREFUSED, "connect",
991 "unexpected success or error\n"))
992 log_err("expected ECONNREFUSED on connect");
993
994close_all:
995 close(client);
996close_srv2:
997 close(server2);
998close_srv1:
999 close(server1);
1000detach:
1001 bpf_link__destroy(lookup_link);
1002}
1003
1004static void test_drop_on_reuseport(struct test_sk_lookup *skel)
1005{
1006 const struct test tests[] = {
1007 {
1008 .desc = "TCP IPv4 drop on reuseport",
1009 .lookup_prog = skel->progs.select_sock_a,
1010 .reuseport_prog = skel->progs.reuseport_drop,
1011 .sock_map = skel->maps.redir_map,
1012 .sotype = SOCK_STREAM,
1013 .connect_to = { EXT_IP4, EXT_PORT },
1014 .listen_at = { INT_IP4, INT_PORT },
1015 },
1016 {
1017 .desc = "TCP IPv6 drop on reuseport",
1018 .lookup_prog = skel->progs.select_sock_a,
1019 .reuseport_prog = skel->progs.reuseport_drop,
1020 .sock_map = skel->maps.redir_map,
1021 .sotype = SOCK_STREAM,
1022 .connect_to = { EXT_IP6, EXT_PORT },
1023 .listen_at = { INT_IP6, INT_PORT },
1024 },
1025 {
1026 .desc = "UDP IPv4 drop on reuseport",
1027 .lookup_prog = skel->progs.select_sock_a,
1028 .reuseport_prog = skel->progs.reuseport_drop,
1029 .sock_map = skel->maps.redir_map,
1030 .sotype = SOCK_DGRAM,
1031 .connect_to = { EXT_IP4, EXT_PORT },
1032 .listen_at = { INT_IP4, INT_PORT },
1033 },
1034 {
1035 .desc = "TCP IPv6 drop on reuseport",
1036 .lookup_prog = skel->progs.select_sock_a,
1037 .reuseport_prog = skel->progs.reuseport_drop,
1038 .sock_map = skel->maps.redir_map,
1039 .sotype = SOCK_STREAM,
1040 .connect_to = { EXT_IP6, EXT_PORT },
1041 .listen_at = { INT_IP6, INT_PORT },
1042 },
1043 };
1044 const struct test *t;
1045
1046 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1047 if (test__start_subtest(t->desc))
1048 drop_on_reuseport(t);
1049 }
1050}
1051
1052static void run_sk_assign(struct test_sk_lookup *skel,
1053 struct bpf_program *lookup_prog,
1054 const char *remote_ip, const char *local_ip)
1055{
1056 int server_fds[MAX_SERVERS] = { -1 };
1057 struct bpf_sk_lookup ctx;
1058 __u64 server_cookie;
1059 int i, err;
1060
1061 DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
1062 .ctx_in = &ctx,
1063 .ctx_size_in = sizeof(ctx),
1064 .ctx_out = &ctx,
1065 .ctx_size_out = sizeof(ctx),
1066 );
1067
1068 if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT))
1069 return;
1070
1071 ctx.protocol = IPPROTO_TCP;
1072
1073 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1074 server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL);
1075 if (server_fds[i] < 0)
1076 goto close_servers;
1077
1078 err = update_lookup_map(skel->maps.redir_map, i,
1079 server_fds[i]);
1080 if (err)
1081 goto close_servers;
1082 }
1083
1084 server_cookie = socket_cookie(server_fds[SERVER_B]);
1085 if (!server_cookie)
1086 return;
1087
1088 err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts);
1089 if (CHECK(err, "test_run", "failed with error %d\n", errno))
1090 goto close_servers;
1091
1092 if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n"))
1093 goto close_servers;
1094
1095 CHECK(ctx.cookie != server_cookie, "ctx.cookie",
1096 "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie);
1097
1098close_servers:
1099 for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1100 if (server_fds[i] != -1)
1101 close(server_fds[i]);
1102 }
1103}
1104
1105static void run_sk_assign_v4(struct test_sk_lookup *skel,
1106 struct bpf_program *lookup_prog)
1107{
1108 run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4);
1109}
1110
1111static void run_sk_assign_v6(struct test_sk_lookup *skel,
1112 struct bpf_program *lookup_prog)
1113{
1114 run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6);
1115}
1116
1117static void run_sk_assign_connected(struct test_sk_lookup *skel,
1118 int sotype)
1119{
1120 int err, client_fd, connected_fd, server_fd;
1121 struct bpf_link *lookup_link;
1122
1123 server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL);
1124 if (server_fd < 0)
1125 return;
1126
1127 connected_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1128 if (connected_fd < 0)
1129 goto out_close_server;
1130
1131 /* Put a connected socket in redirect map */
1132 err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd);
1133 if (err)
1134 goto out_close_connected;
1135
1136 lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport);
1137 if (!lookup_link)
1138 goto out_close_connected;
1139
1140 /* Try to redirect TCP SYN / UDP packet to a connected socket */
1141 client_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1142 if (client_fd < 0)
1143 goto out_unlink_prog;
1144 if (sotype == SOCK_DGRAM) {
1145 send_byte(client_fd);
1146 recv_byte(server_fd);
1147 }
1148
1149 close(client_fd);
1150out_unlink_prog:
1151 bpf_link__destroy(lookup_link);
1152out_close_connected:
1153 close(connected_fd);
1154out_close_server:
1155 close(server_fd);
1156}
1157
1158static void test_sk_assign_helper(struct test_sk_lookup *skel)
1159{
1160 if (test__start_subtest("sk_assign returns EEXIST"))
1161 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist);
1162 if (test__start_subtest("sk_assign honors F_REPLACE"))
1163 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag);
1164 if (test__start_subtest("sk_assign accepts NULL socket"))
1165 run_sk_assign_v4(skel, skel->progs.sk_assign_null);
1166 if (test__start_subtest("access ctx->sk"))
1167 run_sk_assign_v4(skel, skel->progs.access_ctx_sk);
1168 if (test__start_subtest("narrow access to ctx v4"))
1169 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access);
1170 if (test__start_subtest("narrow access to ctx v6"))
1171 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access);
1172 if (test__start_subtest("sk_assign rejects TCP established"))
1173 run_sk_assign_connected(skel, SOCK_STREAM);
1174 if (test__start_subtest("sk_assign rejects UDP connected"))
1175 run_sk_assign_connected(skel, SOCK_DGRAM);
1176}
1177
1178struct test_multi_prog {
1179 const char *desc;
1180 struct bpf_program *prog1;
1181 struct bpf_program *prog2;
1182 struct bpf_map *redir_map;
1183 struct bpf_map *run_map;
1184 int expect_errno;
1185 struct inet_addr listen_at;
1186};
1187
1188static void run_multi_prog_lookup(const struct test_multi_prog *t)
1189{
1190 struct sockaddr_storage dst = {};
1191 int map_fd, server_fd, client_fd;
1192 struct bpf_link *link1, *link2;
1193 int prog_idx, done, err;
1194
1195 map_fd = bpf_map__fd(t->run_map);
1196
1197 done = 0;
1198 prog_idx = PROG1;
1199 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1200 if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1201 return;
1202 prog_idx = PROG2;
1203 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1204 if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1205 return;
1206
1207 link1 = attach_lookup_prog(t->prog1);
1208 if (!link1)
1209 return;
1210 link2 = attach_lookup_prog(t->prog2);
1211 if (!link2)
1212 goto out_unlink1;
1213
1214 server_fd = make_server(SOCK_STREAM, t->listen_at.ip,
1215 t->listen_at.port, NULL);
1216 if (server_fd < 0)
1217 goto out_unlink2;
1218
1219 err = update_lookup_map(t->redir_map, SERVER_A, server_fd);
1220 if (err)
1221 goto out_close_server;
1222
1223 client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst);
1224 if (client_fd < 0)
1225 goto out_close_server;
1226
1227 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
1228 if (CHECK(err && !t->expect_errno, "connect",
1229 "unexpected error %d\n", errno))
1230 goto out_close_client;
1231 if (CHECK(err && t->expect_errno && errno != t->expect_errno,
1232 "connect", "unexpected error %d\n", errno))
1233 goto out_close_client;
1234
1235 done = 0;
1236 prog_idx = PROG1;
1237 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1238 CHECK(err, "bpf_map_lookup_elem", "failed\n");
1239 CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n");
1240
1241 done = 0;
1242 prog_idx = PROG2;
1243 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1244 CHECK(err, "bpf_map_lookup_elem", "failed\n");
1245 CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n");
1246
1247out_close_client:
1248 close(client_fd);
1249out_close_server:
1250 close(server_fd);
1251out_unlink2:
1252 bpf_link__destroy(link2);
1253out_unlink1:
1254 bpf_link__destroy(link1);
1255}
1256
1257static void test_multi_prog_lookup(struct test_sk_lookup *skel)
1258{
1259 struct test_multi_prog tests[] = {
1260 {
1261 .desc = "multi prog - pass, pass",
1262 .prog1 = skel->progs.multi_prog_pass1,
1263 .prog2 = skel->progs.multi_prog_pass2,
1264 .listen_at = { EXT_IP4, EXT_PORT },
1265 },
1266 {
1267 .desc = "multi prog - drop, drop",
1268 .prog1 = skel->progs.multi_prog_drop1,
1269 .prog2 = skel->progs.multi_prog_drop2,
1270 .listen_at = { EXT_IP4, EXT_PORT },
1271 .expect_errno = ECONNREFUSED,
1272 },
1273 {
1274 .desc = "multi prog - pass, drop",
1275 .prog1 = skel->progs.multi_prog_pass1,
1276 .prog2 = skel->progs.multi_prog_drop2,
1277 .listen_at = { EXT_IP4, EXT_PORT },
1278 .expect_errno = ECONNREFUSED,
1279 },
1280 {
1281 .desc = "multi prog - drop, pass",
1282 .prog1 = skel->progs.multi_prog_drop1,
1283 .prog2 = skel->progs.multi_prog_pass2,
1284 .listen_at = { EXT_IP4, EXT_PORT },
1285 .expect_errno = ECONNREFUSED,
1286 },
1287 {
1288 .desc = "multi prog - pass, redir",
1289 .prog1 = skel->progs.multi_prog_pass1,
1290 .prog2 = skel->progs.multi_prog_redir2,
1291 .listen_at = { INT_IP4, INT_PORT },
1292 },
1293 {
1294 .desc = "multi prog - redir, pass",
1295 .prog1 = skel->progs.multi_prog_redir1,
1296 .prog2 = skel->progs.multi_prog_pass2,
1297 .listen_at = { INT_IP4, INT_PORT },
1298 },
1299 {
1300 .desc = "multi prog - drop, redir",
1301 .prog1 = skel->progs.multi_prog_drop1,
1302 .prog2 = skel->progs.multi_prog_redir2,
1303 .listen_at = { INT_IP4, INT_PORT },
1304 },
1305 {
1306 .desc = "multi prog - redir, drop",
1307 .prog1 = skel->progs.multi_prog_redir1,
1308 .prog2 = skel->progs.multi_prog_drop2,
1309 .listen_at = { INT_IP4, INT_PORT },
1310 },
1311 {
1312 .desc = "multi prog - redir, redir",
1313 .prog1 = skel->progs.multi_prog_redir1,
1314 .prog2 = skel->progs.multi_prog_redir2,
1315 .listen_at = { INT_IP4, INT_PORT },
1316 },
1317 };
1318 struct test_multi_prog *t;
1319
1320 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1321 t->redir_map = skel->maps.redir_map;
1322 t->run_map = skel->maps.run_map;
1323 if (test__start_subtest(t->desc))
1324 run_multi_prog_lookup(t);
1325 }
1326}
1327
1328static void run_tests(struct test_sk_lookup *skel)
1329{
1330 if (test__start_subtest("query lookup prog"))
1331 query_lookup_prog(skel);
1332 test_redirect_lookup(skel);
1333 test_drop_on_lookup(skel);
1334 test_drop_on_reuseport(skel);
1335 test_sk_assign_helper(skel);
1336 test_multi_prog_lookup(skel);
1337}
1338
1339static int switch_netns(void)
1340{
1341 static const char * const setup_script[] = {
1342 "ip -6 addr add dev lo " EXT_IP6 "/128",
1343 "ip -6 addr add dev lo " INT_IP6 "/128",
1344 "ip link set dev lo up",
1345 NULL,
1346 };
1347 const char * const *cmd;
1348 int err;
1349
1350 err = unshare(CLONE_NEWNET);
1351 if (CHECK(err, "unshare", "failed\n")) {
1352 log_err("unshare(CLONE_NEWNET)");
1353 return -1;
1354 }
1355
1356 for (cmd = setup_script; *cmd; cmd++) {
1357 err = system(*cmd);
1358 if (CHECK(err, "system", "failed\n")) {
1359 log_err("system(%s)", *cmd);
1360 return -1;
1361 }
1362 }
1363
1364 return 0;
1365}
1366
1367void test_sk_lookup(void)
1368{
1369 struct test_sk_lookup *skel;
1370 int err;
1371
1372 err = switch_netns();
1373 if (err)
1374 return;
1375
1376 skel = test_sk_lookup__open_and_load();
1377 if (CHECK(!skel, "skel open_and_load", "failed\n"))
1378 return;
1379
1380 run_tests(skel);
1381
1382 test_sk_lookup__destroy(skel);
1383}