1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 // Copyright (c) 2020 Cloudflare 3 /* 4 * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP). 5 * 6 * Tests exercise: 7 * - attaching/detaching/querying programs to BPF_SK_LOOKUP hook, 8 * - redirecting socket lookup to a socket selected by BPF program, 9 * - failing a socket lookup on BPF program's request, 10 * - error scenarios for selecting a socket from BPF program, 11 * - accessing BPF program context, 12 * - attaching and running multiple BPF programs. 13 * 14 * Tests run in a dedicated network namespace. 15 */ 16 17 #define _GNU_SOURCE 18 #include <arpa/inet.h> 19 #include <assert.h> 20 #include <errno.h> 21 #include <error.h> 22 #include <fcntl.h> 23 #include <sched.h> 24 #include <stdio.h> 25 #include <sys/types.h> 26 #include <sys/stat.h> 27 #include <unistd.h> 28 29 #include <bpf/libbpf.h> 30 #include <bpf/bpf.h> 31 32 #include "test_progs.h" 33 #include "bpf_rlimit.h" 34 #include "bpf_util.h" 35 #include "cgroup_helpers.h" 36 #include "network_helpers.h" 37 #include "testing_helpers.h" 38 #include "test_sk_lookup.skel.h" 39 40 /* External (address, port) pairs the client sends packets to. */ 41 #define EXT_IP4 "127.0.0.1" 42 #define EXT_IP6 "fd00::1" 43 #define EXT_PORT 7007 44 45 /* Internal (address, port) pairs the server listens/receives at. */ 46 #define INT_IP4 "127.0.0.2" 47 #define INT_IP4_V6 "::ffff:127.0.0.2" 48 #define INT_IP6 "fd00::2" 49 #define INT_PORT 8008 50 51 #define IO_TIMEOUT_SEC 3 52 53 enum server { 54 SERVER_A = 0, 55 SERVER_B = 1, 56 MAX_SERVERS, 57 }; 58 59 enum { 60 PROG1 = 0, 61 PROG2, 62 }; 63 64 struct inet_addr { 65 const char *ip; 66 unsigned short port; 67 }; 68 69 struct test { 70 const char *desc; 71 struct bpf_program *lookup_prog; 72 struct bpf_program *reuseport_prog; 73 struct bpf_map *sock_map; 74 int sotype; 75 struct inet_addr connect_to; 76 struct inet_addr listen_at; 77 enum server accept_on; 78 bool reuseport_has_conns; /* Add a connected socket to reuseport group */ 79 }; 80 81 static __u32 duration; /* for CHECK macro */ 82 83 static bool is_ipv6(const char *ip) 84 { 85 return !!strchr(ip, ':'); 86 } 87 88 static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog) 89 { 90 int err, prog_fd; 91 92 prog_fd = bpf_program__fd(reuseport_prog); 93 if (prog_fd < 0) { 94 errno = -prog_fd; 95 return -1; 96 } 97 98 err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF, 99 &prog_fd, sizeof(prog_fd)); 100 if (err) 101 return -1; 102 103 return 0; 104 } 105 106 static socklen_t inetaddr_len(const struct sockaddr_storage *addr) 107 { 108 return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) : 109 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0); 110 } 111 112 static int make_socket(int sotype, const char *ip, int port, 113 struct sockaddr_storage *addr) 114 { 115 struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC }; 116 int err, family, fd; 117 118 family = is_ipv6(ip) ? AF_INET6 : AF_INET; 119 err = make_sockaddr(family, ip, port, addr, NULL); 120 if (CHECK(err, "make_address", "failed\n")) 121 return -1; 122 123 fd = socket(addr->ss_family, sotype, 0); 124 if (CHECK(fd < 0, "socket", "failed\n")) { 125 log_err("failed to make socket"); 126 return -1; 127 } 128 129 err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo)); 130 if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) { 131 log_err("failed to set SNDTIMEO"); 132 close(fd); 133 return -1; 134 } 135 136 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo)); 137 if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) { 138 log_err("failed to set RCVTIMEO"); 139 close(fd); 140 return -1; 141 } 142 143 return fd; 144 } 145 146 static int make_server(int sotype, const char *ip, int port, 147 struct bpf_program *reuseport_prog) 148 { 149 struct sockaddr_storage addr = {0}; 150 const int one = 1; 151 int err, fd = -1; 152 153 fd = make_socket(sotype, ip, port, &addr); 154 if (fd < 0) 155 return -1; 156 157 /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */ 158 if (sotype == SOCK_DGRAM) { 159 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one, 160 sizeof(one)); 161 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) { 162 log_err("failed to enable IP_RECVORIGDSTADDR"); 163 goto fail; 164 } 165 } 166 167 if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) { 168 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one, 169 sizeof(one)); 170 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) { 171 log_err("failed to enable IPV6_RECVORIGDSTADDR"); 172 goto fail; 173 } 174 } 175 176 if (sotype == SOCK_STREAM) { 177 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, 178 sizeof(one)); 179 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) { 180 log_err("failed to enable SO_REUSEADDR"); 181 goto fail; 182 } 183 } 184 185 if (reuseport_prog) { 186 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, 187 sizeof(one)); 188 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) { 189 log_err("failed to enable SO_REUSEPORT"); 190 goto fail; 191 } 192 } 193 194 err = bind(fd, (void *)&addr, inetaddr_len(&addr)); 195 if (CHECK(err, "bind", "failed\n")) { 196 log_err("failed to bind listen socket"); 197 goto fail; 198 } 199 200 if (sotype == SOCK_STREAM) { 201 err = listen(fd, SOMAXCONN); 202 if (CHECK(err, "make_server", "listen")) { 203 log_err("failed to listen on port %d", port); 204 goto fail; 205 } 206 } 207 208 /* Late attach reuseport prog so we can have one init path */ 209 if (reuseport_prog) { 210 err = attach_reuseport(fd, reuseport_prog); 211 if (CHECK(err, "attach_reuseport", "failed\n")) { 212 log_err("failed to attach reuseport prog"); 213 goto fail; 214 } 215 } 216 217 return fd; 218 fail: 219 close(fd); 220 return -1; 221 } 222 223 static int make_client(int sotype, const char *ip, int port) 224 { 225 struct sockaddr_storage addr = {0}; 226 int err, fd; 227 228 fd = make_socket(sotype, ip, port, &addr); 229 if (fd < 0) 230 return -1; 231 232 err = connect(fd, (void *)&addr, inetaddr_len(&addr)); 233 if (CHECK(err, "make_client", "connect")) { 234 log_err("failed to connect client socket"); 235 goto fail; 236 } 237 238 return fd; 239 fail: 240 close(fd); 241 return -1; 242 } 243 244 static int send_byte(int fd) 245 { 246 ssize_t n; 247 248 errno = 0; 249 n = send(fd, "a", 1, 0); 250 if (CHECK(n <= 0, "send_byte", "send")) { 251 log_err("failed/partial send"); 252 return -1; 253 } 254 return 0; 255 } 256 257 static int recv_byte(int fd) 258 { 259 char buf[1]; 260 ssize_t n; 261 262 n = recv(fd, buf, sizeof(buf), 0); 263 if (CHECK(n <= 0, "recv_byte", "recv")) { 264 log_err("failed/partial recv"); 265 return -1; 266 } 267 return 0; 268 } 269 270 static int tcp_recv_send(int server_fd) 271 { 272 char buf[1]; 273 int ret, fd; 274 ssize_t n; 275 276 fd = accept(server_fd, NULL, NULL); 277 if (CHECK(fd < 0, "accept", "failed\n")) { 278 log_err("failed to accept"); 279 return -1; 280 } 281 282 n = recv(fd, buf, sizeof(buf), 0); 283 if (CHECK(n <= 0, "recv", "failed\n")) { 284 log_err("failed/partial recv"); 285 ret = -1; 286 goto close; 287 } 288 289 n = send(fd, buf, n, 0); 290 if (CHECK(n <= 0, "send", "failed\n")) { 291 log_err("failed/partial send"); 292 ret = -1; 293 goto close; 294 } 295 296 ret = 0; 297 close: 298 close(fd); 299 return ret; 300 } 301 302 static void v4_to_v6(struct sockaddr_storage *ss) 303 { 304 struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss; 305 struct sockaddr_in v4 = *(struct sockaddr_in *)ss; 306 307 v6->sin6_family = AF_INET6; 308 v6->sin6_port = v4.sin_port; 309 v6->sin6_addr.s6_addr[10] = 0xff; 310 v6->sin6_addr.s6_addr[11] = 0xff; 311 memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4); 312 } 313 314 static int udp_recv_send(int server_fd) 315 { 316 char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))]; 317 struct sockaddr_storage _src_addr = { 0 }; 318 struct sockaddr_storage *src_addr = &_src_addr; 319 struct sockaddr_storage *dst_addr = NULL; 320 struct msghdr msg = { 0 }; 321 struct iovec iov = { 0 }; 322 struct cmsghdr *cm; 323 char buf[1]; 324 int ret, fd; 325 ssize_t n; 326 327 iov.iov_base = buf; 328 iov.iov_len = sizeof(buf); 329 330 msg.msg_name = src_addr; 331 msg.msg_namelen = sizeof(*src_addr); 332 msg.msg_iov = &iov; 333 msg.msg_iovlen = 1; 334 msg.msg_control = cmsg_buf; 335 msg.msg_controllen = sizeof(cmsg_buf); 336 337 errno = 0; 338 n = recvmsg(server_fd, &msg, 0); 339 if (CHECK(n <= 0, "recvmsg", "failed\n")) { 340 log_err("failed to receive"); 341 return -1; 342 } 343 if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n")) 344 return -1; 345 346 for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) { 347 if ((cm->cmsg_level == SOL_IP && 348 cm->cmsg_type == IP_ORIGDSTADDR) || 349 (cm->cmsg_level == SOL_IPV6 && 350 cm->cmsg_type == IPV6_ORIGDSTADDR)) { 351 dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm); 352 break; 353 } 354 log_err("warning: ignored cmsg at level %d type %d", 355 cm->cmsg_level, cm->cmsg_type); 356 } 357 if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n")) 358 return -1; 359 360 /* Server socket bound to IPv4-mapped IPv6 address */ 361 if (src_addr->ss_family == AF_INET6 && 362 dst_addr->ss_family == AF_INET) { 363 v4_to_v6(dst_addr); 364 } 365 366 /* Reply from original destination address. */ 367 fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0); 368 if (CHECK(fd < 0, "socket", "failed\n")) { 369 log_err("failed to create tx socket"); 370 return -1; 371 } 372 373 ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr)); 374 if (CHECK(ret, "bind", "failed\n")) { 375 log_err("failed to bind tx socket"); 376 goto out; 377 } 378 379 msg.msg_control = NULL; 380 msg.msg_controllen = 0; 381 n = sendmsg(fd, &msg, 0); 382 if (CHECK(n <= 0, "sendmsg", "failed\n")) { 383 log_err("failed to send echo reply"); 384 ret = -1; 385 goto out; 386 } 387 388 ret = 0; 389 out: 390 close(fd); 391 return ret; 392 } 393 394 static int tcp_echo_test(int client_fd, int server_fd) 395 { 396 int err; 397 398 err = send_byte(client_fd); 399 if (err) 400 return -1; 401 err = tcp_recv_send(server_fd); 402 if (err) 403 return -1; 404 err = recv_byte(client_fd); 405 if (err) 406 return -1; 407 408 return 0; 409 } 410 411 static int udp_echo_test(int client_fd, int server_fd) 412 { 413 int err; 414 415 err = send_byte(client_fd); 416 if (err) 417 return -1; 418 err = udp_recv_send(server_fd); 419 if (err) 420 return -1; 421 err = recv_byte(client_fd); 422 if (err) 423 return -1; 424 425 return 0; 426 } 427 428 static struct bpf_link *attach_lookup_prog(struct bpf_program *prog) 429 { 430 struct bpf_link *link; 431 int net_fd; 432 433 net_fd = open("/proc/self/ns/net", O_RDONLY); 434 if (CHECK(net_fd < 0, "open", "failed\n")) { 435 log_err("failed to open /proc/self/ns/net"); 436 return NULL; 437 } 438 439 link = bpf_program__attach_netns(prog, net_fd); 440 if (CHECK(IS_ERR(link), "bpf_program__attach_netns", "failed\n")) { 441 errno = -PTR_ERR(link); 442 log_err("failed to attach program '%s' to netns", 443 bpf_program__name(prog)); 444 link = NULL; 445 } 446 447 close(net_fd); 448 return link; 449 } 450 451 static int update_lookup_map(struct bpf_map *map, int index, int sock_fd) 452 { 453 int err, map_fd; 454 uint64_t value; 455 456 map_fd = bpf_map__fd(map); 457 if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) { 458 errno = -map_fd; 459 log_err("failed to get map FD"); 460 return -1; 461 } 462 463 value = (uint64_t)sock_fd; 464 err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST); 465 if (CHECK(err, "bpf_map_update_elem", "failed\n")) { 466 log_err("failed to update redir_map @ %d", index); 467 return -1; 468 } 469 470 return 0; 471 } 472 473 static void query_lookup_prog(struct test_sk_lookup *skel) 474 { 475 struct bpf_link *link[3] = {}; 476 struct bpf_link_info info; 477 __u32 attach_flags = 0; 478 __u32 prog_ids[3] = {}; 479 __u32 prog_cnt = 3; 480 __u32 prog_id; 481 int net_fd; 482 int err; 483 484 net_fd = open("/proc/self/ns/net", O_RDONLY); 485 if (CHECK(net_fd < 0, "open", "failed\n")) { 486 log_err("failed to open /proc/self/ns/net"); 487 return; 488 } 489 490 link[0] = attach_lookup_prog(skel->progs.lookup_pass); 491 if (!link[0]) 492 goto close; 493 link[1] = attach_lookup_prog(skel->progs.lookup_pass); 494 if (!link[1]) 495 goto detach; 496 link[2] = attach_lookup_prog(skel->progs.lookup_drop); 497 if (!link[2]) 498 goto detach; 499 500 err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */, 501 &attach_flags, prog_ids, &prog_cnt); 502 if (CHECK(err, "bpf_prog_query", "failed\n")) { 503 log_err("failed to query lookup prog"); 504 goto detach; 505 } 506 507 errno = 0; 508 if (CHECK(attach_flags != 0, "bpf_prog_query", 509 "wrong attach_flags on query: %u", attach_flags)) 510 goto detach; 511 if (CHECK(prog_cnt != 3, "bpf_prog_query", 512 "wrong program count on query: %u", prog_cnt)) 513 goto detach; 514 prog_id = link_info_prog_id(link[0], &info); 515 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 516 "invalid program #0 id on query: %u != %u\n", 517 prog_ids[0], prog_id); 518 CHECK(info.netns.netns_ino == 0, "netns_ino", 519 "unexpected netns_ino: %u\n", info.netns.netns_ino); 520 prog_id = link_info_prog_id(link[1], &info); 521 CHECK(prog_ids[1] != prog_id, "bpf_prog_query", 522 "invalid program #1 id on query: %u != %u\n", 523 prog_ids[1], prog_id); 524 CHECK(info.netns.netns_ino == 0, "netns_ino", 525 "unexpected netns_ino: %u\n", info.netns.netns_ino); 526 prog_id = link_info_prog_id(link[2], &info); 527 CHECK(prog_ids[2] != prog_id, "bpf_prog_query", 528 "invalid program #2 id on query: %u != %u\n", 529 prog_ids[2], prog_id); 530 CHECK(info.netns.netns_ino == 0, "netns_ino", 531 "unexpected netns_ino: %u\n", info.netns.netns_ino); 532 533 err = bpf_link__detach(link[0]); 534 if (CHECK(err, "link_detach", "failed %d\n", err)) 535 goto detach; 536 537 /* prog id is still there, but netns_ino is zeroed out */ 538 prog_id = link_info_prog_id(link[0], &info); 539 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 540 "invalid program #0 id on query: %u != %u\n", 541 prog_ids[0], prog_id); 542 CHECK(info.netns.netns_ino != 0, "netns_ino", 543 "unexpected netns_ino: %u\n", info.netns.netns_ino); 544 545 detach: 546 if (link[2]) 547 bpf_link__destroy(link[2]); 548 if (link[1]) 549 bpf_link__destroy(link[1]); 550 if (link[0]) 551 bpf_link__destroy(link[0]); 552 close: 553 close(net_fd); 554 } 555 556 static void run_lookup_prog(const struct test *t) 557 { 558 int server_fds[MAX_SERVERS] = { -1 }; 559 int client_fd, reuse_conn_fd = -1; 560 struct bpf_link *lookup_link; 561 int i, err; 562 563 lookup_link = attach_lookup_prog(t->lookup_prog); 564 if (!lookup_link) 565 return; 566 567 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 568 server_fds[i] = make_server(t->sotype, t->listen_at.ip, 569 t->listen_at.port, 570 t->reuseport_prog); 571 if (server_fds[i] < 0) 572 goto close; 573 574 err = update_lookup_map(t->sock_map, i, server_fds[i]); 575 if (err) 576 goto close; 577 578 /* want just one server for non-reuseport test */ 579 if (!t->reuseport_prog) 580 break; 581 } 582 583 /* Regular UDP socket lookup with reuseport behaves 584 * differently when reuseport group contains connected 585 * sockets. Check that adding a connected UDP socket to the 586 * reuseport group does not affect how reuseport works with 587 * BPF socket lookup. 588 */ 589 if (t->reuseport_has_conns) { 590 struct sockaddr_storage addr = {}; 591 socklen_t len = sizeof(addr); 592 593 /* Add an extra socket to reuseport group */ 594 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip, 595 t->listen_at.port, 596 t->reuseport_prog); 597 if (reuse_conn_fd < 0) 598 goto close; 599 600 /* Connect the extra socket to itself */ 601 err = getsockname(reuse_conn_fd, (void *)&addr, &len); 602 if (CHECK(err, "getsockname", "errno %d\n", errno)) 603 goto close; 604 err = connect(reuse_conn_fd, (void *)&addr, len); 605 if (CHECK(err, "connect", "errno %d\n", errno)) 606 goto close; 607 } 608 609 client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port); 610 if (client_fd < 0) 611 goto close; 612 613 if (t->sotype == SOCK_STREAM) 614 tcp_echo_test(client_fd, server_fds[t->accept_on]); 615 else 616 udp_echo_test(client_fd, server_fds[t->accept_on]); 617 618 close(client_fd); 619 close: 620 if (reuse_conn_fd != -1) 621 close(reuse_conn_fd); 622 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 623 if (server_fds[i] != -1) 624 close(server_fds[i]); 625 } 626 bpf_link__destroy(lookup_link); 627 } 628 629 static void test_redirect_lookup(struct test_sk_lookup *skel) 630 { 631 const struct test tests[] = { 632 { 633 .desc = "TCP IPv4 redir port", 634 .lookup_prog = skel->progs.redir_port, 635 .sock_map = skel->maps.redir_map, 636 .sotype = SOCK_STREAM, 637 .connect_to = { EXT_IP4, EXT_PORT }, 638 .listen_at = { EXT_IP4, INT_PORT }, 639 }, 640 { 641 .desc = "TCP IPv4 redir addr", 642 .lookup_prog = skel->progs.redir_ip4, 643 .sock_map = skel->maps.redir_map, 644 .sotype = SOCK_STREAM, 645 .connect_to = { EXT_IP4, EXT_PORT }, 646 .listen_at = { INT_IP4, EXT_PORT }, 647 }, 648 { 649 .desc = "TCP IPv4 redir with reuseport", 650 .lookup_prog = skel->progs.select_sock_a, 651 .reuseport_prog = skel->progs.select_sock_b, 652 .sock_map = skel->maps.redir_map, 653 .sotype = SOCK_STREAM, 654 .connect_to = { EXT_IP4, EXT_PORT }, 655 .listen_at = { INT_IP4, INT_PORT }, 656 .accept_on = SERVER_B, 657 }, 658 { 659 .desc = "TCP IPv4 redir skip reuseport", 660 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 661 .reuseport_prog = skel->progs.select_sock_b, 662 .sock_map = skel->maps.redir_map, 663 .sotype = SOCK_STREAM, 664 .connect_to = { EXT_IP4, EXT_PORT }, 665 .listen_at = { INT_IP4, INT_PORT }, 666 .accept_on = SERVER_A, 667 }, 668 { 669 .desc = "TCP IPv6 redir port", 670 .lookup_prog = skel->progs.redir_port, 671 .sock_map = skel->maps.redir_map, 672 .sotype = SOCK_STREAM, 673 .connect_to = { EXT_IP6, EXT_PORT }, 674 .listen_at = { EXT_IP6, INT_PORT }, 675 }, 676 { 677 .desc = "TCP IPv6 redir addr", 678 .lookup_prog = skel->progs.redir_ip6, 679 .sock_map = skel->maps.redir_map, 680 .sotype = SOCK_STREAM, 681 .connect_to = { EXT_IP6, EXT_PORT }, 682 .listen_at = { INT_IP6, EXT_PORT }, 683 }, 684 { 685 .desc = "TCP IPv4->IPv6 redir port", 686 .lookup_prog = skel->progs.redir_port, 687 .sock_map = skel->maps.redir_map, 688 .sotype = SOCK_STREAM, 689 .connect_to = { EXT_IP4, EXT_PORT }, 690 .listen_at = { INT_IP4_V6, INT_PORT }, 691 }, 692 { 693 .desc = "TCP IPv6 redir with reuseport", 694 .lookup_prog = skel->progs.select_sock_a, 695 .reuseport_prog = skel->progs.select_sock_b, 696 .sock_map = skel->maps.redir_map, 697 .sotype = SOCK_STREAM, 698 .connect_to = { EXT_IP6, EXT_PORT }, 699 .listen_at = { INT_IP6, INT_PORT }, 700 .accept_on = SERVER_B, 701 }, 702 { 703 .desc = "TCP IPv6 redir skip reuseport", 704 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 705 .reuseport_prog = skel->progs.select_sock_b, 706 .sock_map = skel->maps.redir_map, 707 .sotype = SOCK_STREAM, 708 .connect_to = { EXT_IP6, EXT_PORT }, 709 .listen_at = { INT_IP6, INT_PORT }, 710 .accept_on = SERVER_A, 711 }, 712 { 713 .desc = "UDP IPv4 redir port", 714 .lookup_prog = skel->progs.redir_port, 715 .sock_map = skel->maps.redir_map, 716 .sotype = SOCK_DGRAM, 717 .connect_to = { EXT_IP4, EXT_PORT }, 718 .listen_at = { EXT_IP4, INT_PORT }, 719 }, 720 { 721 .desc = "UDP IPv4 redir addr", 722 .lookup_prog = skel->progs.redir_ip4, 723 .sock_map = skel->maps.redir_map, 724 .sotype = SOCK_DGRAM, 725 .connect_to = { EXT_IP4, EXT_PORT }, 726 .listen_at = { INT_IP4, EXT_PORT }, 727 }, 728 { 729 .desc = "UDP IPv4 redir with reuseport", 730 .lookup_prog = skel->progs.select_sock_a, 731 .reuseport_prog = skel->progs.select_sock_b, 732 .sock_map = skel->maps.redir_map, 733 .sotype = SOCK_DGRAM, 734 .connect_to = { EXT_IP4, EXT_PORT }, 735 .listen_at = { INT_IP4, INT_PORT }, 736 .accept_on = SERVER_B, 737 }, 738 { 739 .desc = "UDP IPv4 redir and reuseport with conns", 740 .lookup_prog = skel->progs.select_sock_a, 741 .reuseport_prog = skel->progs.select_sock_b, 742 .sock_map = skel->maps.redir_map, 743 .sotype = SOCK_DGRAM, 744 .connect_to = { EXT_IP4, EXT_PORT }, 745 .listen_at = { INT_IP4, INT_PORT }, 746 .accept_on = SERVER_B, 747 .reuseport_has_conns = true, 748 }, 749 { 750 .desc = "UDP IPv4 redir skip reuseport", 751 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 752 .reuseport_prog = skel->progs.select_sock_b, 753 .sock_map = skel->maps.redir_map, 754 .sotype = SOCK_DGRAM, 755 .connect_to = { EXT_IP4, EXT_PORT }, 756 .listen_at = { INT_IP4, INT_PORT }, 757 .accept_on = SERVER_A, 758 }, 759 { 760 .desc = "UDP IPv6 redir port", 761 .lookup_prog = skel->progs.redir_port, 762 .sock_map = skel->maps.redir_map, 763 .sotype = SOCK_DGRAM, 764 .connect_to = { EXT_IP6, EXT_PORT }, 765 .listen_at = { EXT_IP6, INT_PORT }, 766 }, 767 { 768 .desc = "UDP IPv6 redir addr", 769 .lookup_prog = skel->progs.redir_ip6, 770 .sock_map = skel->maps.redir_map, 771 .sotype = SOCK_DGRAM, 772 .connect_to = { EXT_IP6, EXT_PORT }, 773 .listen_at = { INT_IP6, EXT_PORT }, 774 }, 775 { 776 .desc = "UDP IPv4->IPv6 redir port", 777 .lookup_prog = skel->progs.redir_port, 778 .sock_map = skel->maps.redir_map, 779 .sotype = SOCK_DGRAM, 780 .listen_at = { INT_IP4_V6, INT_PORT }, 781 .connect_to = { EXT_IP4, EXT_PORT }, 782 }, 783 { 784 .desc = "UDP IPv6 redir and reuseport", 785 .lookup_prog = skel->progs.select_sock_a, 786 .reuseport_prog = skel->progs.select_sock_b, 787 .sock_map = skel->maps.redir_map, 788 .sotype = SOCK_DGRAM, 789 .connect_to = { EXT_IP6, EXT_PORT }, 790 .listen_at = { INT_IP6, INT_PORT }, 791 .accept_on = SERVER_B, 792 }, 793 { 794 .desc = "UDP IPv6 redir and reuseport with conns", 795 .lookup_prog = skel->progs.select_sock_a, 796 .reuseport_prog = skel->progs.select_sock_b, 797 .sock_map = skel->maps.redir_map, 798 .sotype = SOCK_DGRAM, 799 .connect_to = { EXT_IP6, EXT_PORT }, 800 .listen_at = { INT_IP6, INT_PORT }, 801 .accept_on = SERVER_B, 802 .reuseport_has_conns = true, 803 }, 804 { 805 .desc = "UDP IPv6 redir skip reuseport", 806 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 807 .reuseport_prog = skel->progs.select_sock_b, 808 .sock_map = skel->maps.redir_map, 809 .sotype = SOCK_DGRAM, 810 .connect_to = { EXT_IP6, EXT_PORT }, 811 .listen_at = { INT_IP6, INT_PORT }, 812 .accept_on = SERVER_A, 813 }, 814 }; 815 const struct test *t; 816 817 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 818 if (test__start_subtest(t->desc)) 819 run_lookup_prog(t); 820 } 821 } 822 823 static void drop_on_lookup(const struct test *t) 824 { 825 struct sockaddr_storage dst = {}; 826 int client_fd, server_fd, err; 827 struct bpf_link *lookup_link; 828 ssize_t n; 829 830 lookup_link = attach_lookup_prog(t->lookup_prog); 831 if (!lookup_link) 832 return; 833 834 server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 835 t->reuseport_prog); 836 if (server_fd < 0) 837 goto detach; 838 839 client_fd = make_socket(t->sotype, t->connect_to.ip, 840 t->connect_to.port, &dst); 841 if (client_fd < 0) 842 goto close_srv; 843 844 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 845 if (t->sotype == SOCK_DGRAM) { 846 err = send_byte(client_fd); 847 if (err) 848 goto close_all; 849 850 /* Read out asynchronous error */ 851 n = recv(client_fd, NULL, 0, 0); 852 err = n == -1; 853 } 854 if (CHECK(!err || errno != ECONNREFUSED, "connect", 855 "unexpected success or error\n")) 856 log_err("expected ECONNREFUSED on connect"); 857 858 close_all: 859 close(client_fd); 860 close_srv: 861 close(server_fd); 862 detach: 863 bpf_link__destroy(lookup_link); 864 } 865 866 static void test_drop_on_lookup(struct test_sk_lookup *skel) 867 { 868 const struct test tests[] = { 869 { 870 .desc = "TCP IPv4 drop on lookup", 871 .lookup_prog = skel->progs.lookup_drop, 872 .sotype = SOCK_STREAM, 873 .connect_to = { EXT_IP4, EXT_PORT }, 874 .listen_at = { EXT_IP4, EXT_PORT }, 875 }, 876 { 877 .desc = "TCP IPv6 drop on lookup", 878 .lookup_prog = skel->progs.lookup_drop, 879 .sotype = SOCK_STREAM, 880 .connect_to = { EXT_IP6, EXT_PORT }, 881 .listen_at = { EXT_IP6, EXT_PORT }, 882 }, 883 { 884 .desc = "UDP IPv4 drop on lookup", 885 .lookup_prog = skel->progs.lookup_drop, 886 .sotype = SOCK_DGRAM, 887 .connect_to = { EXT_IP4, EXT_PORT }, 888 .listen_at = { EXT_IP4, EXT_PORT }, 889 }, 890 { 891 .desc = "UDP IPv6 drop on lookup", 892 .lookup_prog = skel->progs.lookup_drop, 893 .sotype = SOCK_DGRAM, 894 .connect_to = { EXT_IP6, EXT_PORT }, 895 .listen_at = { EXT_IP6, INT_PORT }, 896 }, 897 }; 898 const struct test *t; 899 900 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 901 if (test__start_subtest(t->desc)) 902 drop_on_lookup(t); 903 } 904 } 905 906 static void drop_on_reuseport(const struct test *t) 907 { 908 struct sockaddr_storage dst = { 0 }; 909 int client, server1, server2, err; 910 struct bpf_link *lookup_link; 911 ssize_t n; 912 913 lookup_link = attach_lookup_prog(t->lookup_prog); 914 if (!lookup_link) 915 return; 916 917 server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 918 t->reuseport_prog); 919 if (server1 < 0) 920 goto detach; 921 922 err = update_lookup_map(t->sock_map, SERVER_A, server1); 923 if (err) 924 goto detach; 925 926 /* second server on destination address we should never reach */ 927 server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port, 928 NULL /* reuseport prog */); 929 if (server2 < 0) 930 goto close_srv1; 931 932 client = make_socket(t->sotype, t->connect_to.ip, 933 t->connect_to.port, &dst); 934 if (client < 0) 935 goto close_srv2; 936 937 err = connect(client, (void *)&dst, inetaddr_len(&dst)); 938 if (t->sotype == SOCK_DGRAM) { 939 err = send_byte(client); 940 if (err) 941 goto close_all; 942 943 /* Read out asynchronous error */ 944 n = recv(client, NULL, 0, 0); 945 err = n == -1; 946 } 947 if (CHECK(!err || errno != ECONNREFUSED, "connect", 948 "unexpected success or error\n")) 949 log_err("expected ECONNREFUSED on connect"); 950 951 close_all: 952 close(client); 953 close_srv2: 954 close(server2); 955 close_srv1: 956 close(server1); 957 detach: 958 bpf_link__destroy(lookup_link); 959 } 960 961 static void test_drop_on_reuseport(struct test_sk_lookup *skel) 962 { 963 const struct test tests[] = { 964 { 965 .desc = "TCP IPv4 drop on reuseport", 966 .lookup_prog = skel->progs.select_sock_a, 967 .reuseport_prog = skel->progs.reuseport_drop, 968 .sock_map = skel->maps.redir_map, 969 .sotype = SOCK_STREAM, 970 .connect_to = { EXT_IP4, EXT_PORT }, 971 .listen_at = { INT_IP4, INT_PORT }, 972 }, 973 { 974 .desc = "TCP IPv6 drop on reuseport", 975 .lookup_prog = skel->progs.select_sock_a, 976 .reuseport_prog = skel->progs.reuseport_drop, 977 .sock_map = skel->maps.redir_map, 978 .sotype = SOCK_STREAM, 979 .connect_to = { EXT_IP6, EXT_PORT }, 980 .listen_at = { INT_IP6, INT_PORT }, 981 }, 982 { 983 .desc = "UDP IPv4 drop on reuseport", 984 .lookup_prog = skel->progs.select_sock_a, 985 .reuseport_prog = skel->progs.reuseport_drop, 986 .sock_map = skel->maps.redir_map, 987 .sotype = SOCK_DGRAM, 988 .connect_to = { EXT_IP4, EXT_PORT }, 989 .listen_at = { INT_IP4, INT_PORT }, 990 }, 991 { 992 .desc = "TCP IPv6 drop on reuseport", 993 .lookup_prog = skel->progs.select_sock_a, 994 .reuseport_prog = skel->progs.reuseport_drop, 995 .sock_map = skel->maps.redir_map, 996 .sotype = SOCK_STREAM, 997 .connect_to = { EXT_IP6, EXT_PORT }, 998 .listen_at = { INT_IP6, INT_PORT }, 999 }, 1000 }; 1001 const struct test *t; 1002 1003 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1004 if (test__start_subtest(t->desc)) 1005 drop_on_reuseport(t); 1006 } 1007 } 1008 1009 static void run_sk_assign(struct test_sk_lookup *skel, 1010 struct bpf_program *lookup_prog, 1011 const char *listen_ip, const char *connect_ip) 1012 { 1013 int client_fd, peer_fd, server_fds[MAX_SERVERS] = { -1 }; 1014 struct bpf_link *lookup_link; 1015 int i, err; 1016 1017 lookup_link = attach_lookup_prog(lookup_prog); 1018 if (!lookup_link) 1019 return; 1020 1021 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1022 server_fds[i] = make_server(SOCK_STREAM, listen_ip, 0, NULL); 1023 if (server_fds[i] < 0) 1024 goto close_servers; 1025 1026 err = update_lookup_map(skel->maps.redir_map, i, 1027 server_fds[i]); 1028 if (err) 1029 goto close_servers; 1030 } 1031 1032 client_fd = make_client(SOCK_STREAM, connect_ip, EXT_PORT); 1033 if (client_fd < 0) 1034 goto close_servers; 1035 1036 peer_fd = accept(server_fds[SERVER_B], NULL, NULL); 1037 if (CHECK(peer_fd < 0, "accept", "failed\n")) 1038 goto close_client; 1039 1040 close(peer_fd); 1041 close_client: 1042 close(client_fd); 1043 close_servers: 1044 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1045 if (server_fds[i] != -1) 1046 close(server_fds[i]); 1047 } 1048 bpf_link__destroy(lookup_link); 1049 } 1050 1051 static void run_sk_assign_v4(struct test_sk_lookup *skel, 1052 struct bpf_program *lookup_prog) 1053 { 1054 run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4); 1055 } 1056 1057 static void run_sk_assign_v6(struct test_sk_lookup *skel, 1058 struct bpf_program *lookup_prog) 1059 { 1060 run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6); 1061 } 1062 1063 static void run_sk_assign_connected(struct test_sk_lookup *skel, 1064 int sotype) 1065 { 1066 int err, client_fd, connected_fd, server_fd; 1067 struct bpf_link *lookup_link; 1068 1069 server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL); 1070 if (server_fd < 0) 1071 return; 1072 1073 connected_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1074 if (connected_fd < 0) 1075 goto out_close_server; 1076 1077 /* Put a connected socket in redirect map */ 1078 err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd); 1079 if (err) 1080 goto out_close_connected; 1081 1082 lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport); 1083 if (!lookup_link) 1084 goto out_close_connected; 1085 1086 /* Try to redirect TCP SYN / UDP packet to a connected socket */ 1087 client_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1088 if (client_fd < 0) 1089 goto out_unlink_prog; 1090 if (sotype == SOCK_DGRAM) { 1091 send_byte(client_fd); 1092 recv_byte(server_fd); 1093 } 1094 1095 close(client_fd); 1096 out_unlink_prog: 1097 bpf_link__destroy(lookup_link); 1098 out_close_connected: 1099 close(connected_fd); 1100 out_close_server: 1101 close(server_fd); 1102 } 1103 1104 static void test_sk_assign_helper(struct test_sk_lookup *skel) 1105 { 1106 if (test__start_subtest("sk_assign returns EEXIST")) 1107 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist); 1108 if (test__start_subtest("sk_assign honors F_REPLACE")) 1109 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag); 1110 if (test__start_subtest("sk_assign accepts NULL socket")) 1111 run_sk_assign_v4(skel, skel->progs.sk_assign_null); 1112 if (test__start_subtest("access ctx->sk")) 1113 run_sk_assign_v4(skel, skel->progs.access_ctx_sk); 1114 if (test__start_subtest("narrow access to ctx v4")) 1115 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access); 1116 if (test__start_subtest("narrow access to ctx v6")) 1117 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access); 1118 if (test__start_subtest("sk_assign rejects TCP established")) 1119 run_sk_assign_connected(skel, SOCK_STREAM); 1120 if (test__start_subtest("sk_assign rejects UDP connected")) 1121 run_sk_assign_connected(skel, SOCK_DGRAM); 1122 } 1123 1124 struct test_multi_prog { 1125 const char *desc; 1126 struct bpf_program *prog1; 1127 struct bpf_program *prog2; 1128 struct bpf_map *redir_map; 1129 struct bpf_map *run_map; 1130 int expect_errno; 1131 struct inet_addr listen_at; 1132 }; 1133 1134 static void run_multi_prog_lookup(const struct test_multi_prog *t) 1135 { 1136 struct sockaddr_storage dst = {}; 1137 int map_fd, server_fd, client_fd; 1138 struct bpf_link *link1, *link2; 1139 int prog_idx, done, err; 1140 1141 map_fd = bpf_map__fd(t->run_map); 1142 1143 done = 0; 1144 prog_idx = PROG1; 1145 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1146 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1147 return; 1148 prog_idx = PROG2; 1149 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1150 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1151 return; 1152 1153 link1 = attach_lookup_prog(t->prog1); 1154 if (!link1) 1155 return; 1156 link2 = attach_lookup_prog(t->prog2); 1157 if (!link2) 1158 goto out_unlink1; 1159 1160 server_fd = make_server(SOCK_STREAM, t->listen_at.ip, 1161 t->listen_at.port, NULL); 1162 if (server_fd < 0) 1163 goto out_unlink2; 1164 1165 err = update_lookup_map(t->redir_map, SERVER_A, server_fd); 1166 if (err) 1167 goto out_close_server; 1168 1169 client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst); 1170 if (client_fd < 0) 1171 goto out_close_server; 1172 1173 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 1174 if (CHECK(err && !t->expect_errno, "connect", 1175 "unexpected error %d\n", errno)) 1176 goto out_close_client; 1177 if (CHECK(err && t->expect_errno && errno != t->expect_errno, 1178 "connect", "unexpected error %d\n", errno)) 1179 goto out_close_client; 1180 1181 done = 0; 1182 prog_idx = PROG1; 1183 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1184 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1185 CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n"); 1186 1187 done = 0; 1188 prog_idx = PROG2; 1189 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1190 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1191 CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n"); 1192 1193 out_close_client: 1194 close(client_fd); 1195 out_close_server: 1196 close(server_fd); 1197 out_unlink2: 1198 bpf_link__destroy(link2); 1199 out_unlink1: 1200 bpf_link__destroy(link1); 1201 } 1202 1203 static void test_multi_prog_lookup(struct test_sk_lookup *skel) 1204 { 1205 struct test_multi_prog tests[] = { 1206 { 1207 .desc = "multi prog - pass, pass", 1208 .prog1 = skel->progs.multi_prog_pass1, 1209 .prog2 = skel->progs.multi_prog_pass2, 1210 .listen_at = { EXT_IP4, EXT_PORT }, 1211 }, 1212 { 1213 .desc = "multi prog - drop, drop", 1214 .prog1 = skel->progs.multi_prog_drop1, 1215 .prog2 = skel->progs.multi_prog_drop2, 1216 .listen_at = { EXT_IP4, EXT_PORT }, 1217 .expect_errno = ECONNREFUSED, 1218 }, 1219 { 1220 .desc = "multi prog - pass, drop", 1221 .prog1 = skel->progs.multi_prog_pass1, 1222 .prog2 = skel->progs.multi_prog_drop2, 1223 .listen_at = { EXT_IP4, EXT_PORT }, 1224 .expect_errno = ECONNREFUSED, 1225 }, 1226 { 1227 .desc = "multi prog - drop, pass", 1228 .prog1 = skel->progs.multi_prog_drop1, 1229 .prog2 = skel->progs.multi_prog_pass2, 1230 .listen_at = { EXT_IP4, EXT_PORT }, 1231 .expect_errno = ECONNREFUSED, 1232 }, 1233 { 1234 .desc = "multi prog - pass, redir", 1235 .prog1 = skel->progs.multi_prog_pass1, 1236 .prog2 = skel->progs.multi_prog_redir2, 1237 .listen_at = { INT_IP4, INT_PORT }, 1238 }, 1239 { 1240 .desc = "multi prog - redir, pass", 1241 .prog1 = skel->progs.multi_prog_redir1, 1242 .prog2 = skel->progs.multi_prog_pass2, 1243 .listen_at = { INT_IP4, INT_PORT }, 1244 }, 1245 { 1246 .desc = "multi prog - drop, redir", 1247 .prog1 = skel->progs.multi_prog_drop1, 1248 .prog2 = skel->progs.multi_prog_redir2, 1249 .listen_at = { INT_IP4, INT_PORT }, 1250 }, 1251 { 1252 .desc = "multi prog - redir, drop", 1253 .prog1 = skel->progs.multi_prog_redir1, 1254 .prog2 = skel->progs.multi_prog_drop2, 1255 .listen_at = { INT_IP4, INT_PORT }, 1256 }, 1257 { 1258 .desc = "multi prog - redir, redir", 1259 .prog1 = skel->progs.multi_prog_redir1, 1260 .prog2 = skel->progs.multi_prog_redir2, 1261 .listen_at = { INT_IP4, INT_PORT }, 1262 }, 1263 }; 1264 struct test_multi_prog *t; 1265 1266 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1267 t->redir_map = skel->maps.redir_map; 1268 t->run_map = skel->maps.run_map; 1269 if (test__start_subtest(t->desc)) 1270 run_multi_prog_lookup(t); 1271 } 1272 } 1273 1274 static void run_tests(struct test_sk_lookup *skel) 1275 { 1276 if (test__start_subtest("query lookup prog")) 1277 query_lookup_prog(skel); 1278 test_redirect_lookup(skel); 1279 test_drop_on_lookup(skel); 1280 test_drop_on_reuseport(skel); 1281 test_sk_assign_helper(skel); 1282 test_multi_prog_lookup(skel); 1283 } 1284 1285 static int switch_netns(void) 1286 { 1287 static const char * const setup_script[] = { 1288 "ip -6 addr add dev lo " EXT_IP6 "/128", 1289 "ip -6 addr add dev lo " INT_IP6 "/128", 1290 "ip link set dev lo up", 1291 NULL, 1292 }; 1293 const char * const *cmd; 1294 int err; 1295 1296 err = unshare(CLONE_NEWNET); 1297 if (CHECK(err, "unshare", "failed\n")) { 1298 log_err("unshare(CLONE_NEWNET)"); 1299 return -1; 1300 } 1301 1302 for (cmd = setup_script; *cmd; cmd++) { 1303 err = system(*cmd); 1304 if (CHECK(err, "system", "failed\n")) { 1305 log_err("system(%s)", *cmd); 1306 return -1; 1307 } 1308 } 1309 1310 return 0; 1311 } 1312 1313 void test_sk_lookup(void) 1314 { 1315 struct test_sk_lookup *skel; 1316 int err; 1317 1318 err = switch_netns(); 1319 if (err) 1320 return; 1321 1322 skel = test_sk_lookup__open_and_load(); 1323 if (CHECK(!skel, "skel open_and_load", "failed\n")) 1324 return; 1325 1326 run_tests(skel); 1327 1328 test_sk_lookup__destroy(skel); 1329 } 1330