1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 // Copyright (c) 2020 Cloudflare 3 /* 4 * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP). 5 * 6 * Tests exercise: 7 * - attaching/detaching/querying programs to BPF_SK_LOOKUP hook, 8 * - redirecting socket lookup to a socket selected by BPF program, 9 * - failing a socket lookup on BPF program's request, 10 * - error scenarios for selecting a socket from BPF program, 11 * - accessing BPF program context, 12 * - attaching and running multiple BPF programs. 13 * 14 * Tests run in a dedicated network namespace. 15 */ 16 17 #define _GNU_SOURCE 18 #include <arpa/inet.h> 19 #include <assert.h> 20 #include <errno.h> 21 #include <error.h> 22 #include <fcntl.h> 23 #include <sched.h> 24 #include <stdio.h> 25 #include <sys/types.h> 26 #include <sys/stat.h> 27 #include <unistd.h> 28 29 #include <bpf/libbpf.h> 30 #include <bpf/bpf.h> 31 32 #include "test_progs.h" 33 #include "bpf_rlimit.h" 34 #include "bpf_util.h" 35 #include "cgroup_helpers.h" 36 #include "network_helpers.h" 37 #include "testing_helpers.h" 38 #include "test_sk_lookup.skel.h" 39 40 /* External (address, port) pairs the client sends packets to. */ 41 #define EXT_IP4 "127.0.0.1" 42 #define EXT_IP6 "fd00::1" 43 #define EXT_PORT 7007 44 45 /* Internal (address, port) pairs the server listens/receives at. */ 46 #define INT_IP4 "127.0.0.2" 47 #define INT_IP4_V6 "::ffff:127.0.0.2" 48 #define INT_IP6 "fd00::2" 49 #define INT_PORT 8008 50 51 #define IO_TIMEOUT_SEC 3 52 53 enum server { 54 SERVER_A = 0, 55 SERVER_B = 1, 56 MAX_SERVERS, 57 }; 58 59 enum { 60 PROG1 = 0, 61 PROG2, 62 }; 63 64 struct inet_addr { 65 const char *ip; 66 unsigned short port; 67 }; 68 69 struct test { 70 const char *desc; 71 struct bpf_program *lookup_prog; 72 struct bpf_program *reuseport_prog; 73 struct bpf_map *sock_map; 74 int sotype; 75 struct inet_addr connect_to; 76 struct inet_addr listen_at; 77 enum server accept_on; 78 bool reuseport_has_conns; /* Add a connected socket to reuseport group */ 79 }; 80 81 static __u32 duration; /* for CHECK macro */ 82 83 static bool is_ipv6(const char *ip) 84 { 85 return !!strchr(ip, ':'); 86 } 87 88 static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog) 89 { 90 int err, prog_fd; 91 92 prog_fd = bpf_program__fd(reuseport_prog); 93 if (prog_fd < 0) { 94 errno = -prog_fd; 95 return -1; 96 } 97 98 err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF, 99 &prog_fd, sizeof(prog_fd)); 100 if (err) 101 return -1; 102 103 return 0; 104 } 105 106 static socklen_t inetaddr_len(const struct sockaddr_storage *addr) 107 { 108 return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) : 109 addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0); 110 } 111 112 static int make_socket(int sotype, const char *ip, int port, 113 struct sockaddr_storage *addr) 114 { 115 struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC }; 116 int err, family, fd; 117 118 family = is_ipv6(ip) ? AF_INET6 : AF_INET; 119 err = make_sockaddr(family, ip, port, addr, NULL); 120 if (CHECK(err, "make_address", "failed\n")) 121 return -1; 122 123 fd = socket(addr->ss_family, sotype, 0); 124 if (CHECK(fd < 0, "socket", "failed\n")) { 125 log_err("failed to make socket"); 126 return -1; 127 } 128 129 err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo)); 130 if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) { 131 log_err("failed to set SNDTIMEO"); 132 close(fd); 133 return -1; 134 } 135 136 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo)); 137 if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) { 138 log_err("failed to set RCVTIMEO"); 139 close(fd); 140 return -1; 141 } 142 143 return fd; 144 } 145 146 static int make_server(int sotype, const char *ip, int port, 147 struct bpf_program *reuseport_prog) 148 { 149 struct sockaddr_storage addr = {0}; 150 const int one = 1; 151 int err, fd = -1; 152 153 fd = make_socket(sotype, ip, port, &addr); 154 if (fd < 0) 155 return -1; 156 157 /* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */ 158 if (sotype == SOCK_DGRAM) { 159 err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one, 160 sizeof(one)); 161 if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) { 162 log_err("failed to enable IP_RECVORIGDSTADDR"); 163 goto fail; 164 } 165 } 166 167 if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) { 168 err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one, 169 sizeof(one)); 170 if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) { 171 log_err("failed to enable IPV6_RECVORIGDSTADDR"); 172 goto fail; 173 } 174 } 175 176 if (sotype == SOCK_STREAM) { 177 err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, 178 sizeof(one)); 179 if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) { 180 log_err("failed to enable SO_REUSEADDR"); 181 goto fail; 182 } 183 } 184 185 if (reuseport_prog) { 186 err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, 187 sizeof(one)); 188 if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) { 189 log_err("failed to enable SO_REUSEPORT"); 190 goto fail; 191 } 192 } 193 194 err = bind(fd, (void *)&addr, inetaddr_len(&addr)); 195 if (CHECK(err, "bind", "failed\n")) { 196 log_err("failed to bind listen socket"); 197 goto fail; 198 } 199 200 if (sotype == SOCK_STREAM) { 201 err = listen(fd, SOMAXCONN); 202 if (CHECK(err, "make_server", "listen")) { 203 log_err("failed to listen on port %d", port); 204 goto fail; 205 } 206 } 207 208 /* Late attach reuseport prog so we can have one init path */ 209 if (reuseport_prog) { 210 err = attach_reuseport(fd, reuseport_prog); 211 if (CHECK(err, "attach_reuseport", "failed\n")) { 212 log_err("failed to attach reuseport prog"); 213 goto fail; 214 } 215 } 216 217 return fd; 218 fail: 219 close(fd); 220 return -1; 221 } 222 223 static int make_client(int sotype, const char *ip, int port) 224 { 225 struct sockaddr_storage addr = {0}; 226 int err, fd; 227 228 fd = make_socket(sotype, ip, port, &addr); 229 if (fd < 0) 230 return -1; 231 232 err = connect(fd, (void *)&addr, inetaddr_len(&addr)); 233 if (CHECK(err, "make_client", "connect")) { 234 log_err("failed to connect client socket"); 235 goto fail; 236 } 237 238 return fd; 239 fail: 240 close(fd); 241 return -1; 242 } 243 244 static __u64 socket_cookie(int fd) 245 { 246 __u64 cookie; 247 socklen_t cookie_len = sizeof(cookie); 248 249 if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0, 250 "getsockopt(SO_COOKIE)", "%s\n", strerror(errno))) 251 return 0; 252 return cookie; 253 } 254 255 static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port, 256 const char *remote_ip, __u16 remote_port) 257 { 258 void *local, *remote; 259 int err; 260 261 memset(ctx, 0, sizeof(*ctx)); 262 ctx->local_port = local_port; 263 ctx->remote_port = htons(remote_port); 264 265 if (is_ipv6(local_ip)) { 266 ctx->family = AF_INET6; 267 local = &ctx->local_ip6[0]; 268 remote = &ctx->remote_ip6[0]; 269 } else { 270 ctx->family = AF_INET; 271 local = &ctx->local_ip4; 272 remote = &ctx->remote_ip4; 273 } 274 275 err = inet_pton(ctx->family, local_ip, local); 276 if (CHECK(err != 1, "inet_pton", "local_ip failed\n")) 277 return 1; 278 279 err = inet_pton(ctx->family, remote_ip, remote); 280 if (CHECK(err != 1, "inet_pton", "remote_ip failed\n")) 281 return 1; 282 283 return 0; 284 } 285 286 static int send_byte(int fd) 287 { 288 ssize_t n; 289 290 errno = 0; 291 n = send(fd, "a", 1, 0); 292 if (CHECK(n <= 0, "send_byte", "send")) { 293 log_err("failed/partial send"); 294 return -1; 295 } 296 return 0; 297 } 298 299 static int recv_byte(int fd) 300 { 301 char buf[1]; 302 ssize_t n; 303 304 n = recv(fd, buf, sizeof(buf), 0); 305 if (CHECK(n <= 0, "recv_byte", "recv")) { 306 log_err("failed/partial recv"); 307 return -1; 308 } 309 return 0; 310 } 311 312 static int tcp_recv_send(int server_fd) 313 { 314 char buf[1]; 315 int ret, fd; 316 ssize_t n; 317 318 fd = accept(server_fd, NULL, NULL); 319 if (CHECK(fd < 0, "accept", "failed\n")) { 320 log_err("failed to accept"); 321 return -1; 322 } 323 324 n = recv(fd, buf, sizeof(buf), 0); 325 if (CHECK(n <= 0, "recv", "failed\n")) { 326 log_err("failed/partial recv"); 327 ret = -1; 328 goto close; 329 } 330 331 n = send(fd, buf, n, 0); 332 if (CHECK(n <= 0, "send", "failed\n")) { 333 log_err("failed/partial send"); 334 ret = -1; 335 goto close; 336 } 337 338 ret = 0; 339 close: 340 close(fd); 341 return ret; 342 } 343 344 static void v4_to_v6(struct sockaddr_storage *ss) 345 { 346 struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss; 347 struct sockaddr_in v4 = *(struct sockaddr_in *)ss; 348 349 v6->sin6_family = AF_INET6; 350 v6->sin6_port = v4.sin_port; 351 v6->sin6_addr.s6_addr[10] = 0xff; 352 v6->sin6_addr.s6_addr[11] = 0xff; 353 memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4); 354 memset(&v6->sin6_addr.s6_addr[0], 0, 10); 355 } 356 357 static int udp_recv_send(int server_fd) 358 { 359 char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))]; 360 struct sockaddr_storage _src_addr = { 0 }; 361 struct sockaddr_storage *src_addr = &_src_addr; 362 struct sockaddr_storage *dst_addr = NULL; 363 struct msghdr msg = { 0 }; 364 struct iovec iov = { 0 }; 365 struct cmsghdr *cm; 366 char buf[1]; 367 int ret, fd; 368 ssize_t n; 369 370 iov.iov_base = buf; 371 iov.iov_len = sizeof(buf); 372 373 msg.msg_name = src_addr; 374 msg.msg_namelen = sizeof(*src_addr); 375 msg.msg_iov = &iov; 376 msg.msg_iovlen = 1; 377 msg.msg_control = cmsg_buf; 378 msg.msg_controllen = sizeof(cmsg_buf); 379 380 errno = 0; 381 n = recvmsg(server_fd, &msg, 0); 382 if (CHECK(n <= 0, "recvmsg", "failed\n")) { 383 log_err("failed to receive"); 384 return -1; 385 } 386 if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n")) 387 return -1; 388 389 for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) { 390 if ((cm->cmsg_level == SOL_IP && 391 cm->cmsg_type == IP_ORIGDSTADDR) || 392 (cm->cmsg_level == SOL_IPV6 && 393 cm->cmsg_type == IPV6_ORIGDSTADDR)) { 394 dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm); 395 break; 396 } 397 log_err("warning: ignored cmsg at level %d type %d", 398 cm->cmsg_level, cm->cmsg_type); 399 } 400 if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n")) 401 return -1; 402 403 /* Server socket bound to IPv4-mapped IPv6 address */ 404 if (src_addr->ss_family == AF_INET6 && 405 dst_addr->ss_family == AF_INET) { 406 v4_to_v6(dst_addr); 407 } 408 409 /* Reply from original destination address. */ 410 fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0); 411 if (CHECK(fd < 0, "socket", "failed\n")) { 412 log_err("failed to create tx socket"); 413 return -1; 414 } 415 416 ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr)); 417 if (CHECK(ret, "bind", "failed\n")) { 418 log_err("failed to bind tx socket"); 419 goto out; 420 } 421 422 msg.msg_control = NULL; 423 msg.msg_controllen = 0; 424 n = sendmsg(fd, &msg, 0); 425 if (CHECK(n <= 0, "sendmsg", "failed\n")) { 426 log_err("failed to send echo reply"); 427 ret = -1; 428 goto out; 429 } 430 431 ret = 0; 432 out: 433 close(fd); 434 return ret; 435 } 436 437 static int tcp_echo_test(int client_fd, int server_fd) 438 { 439 int err; 440 441 err = send_byte(client_fd); 442 if (err) 443 return -1; 444 err = tcp_recv_send(server_fd); 445 if (err) 446 return -1; 447 err = recv_byte(client_fd); 448 if (err) 449 return -1; 450 451 return 0; 452 } 453 454 static int udp_echo_test(int client_fd, int server_fd) 455 { 456 int err; 457 458 err = send_byte(client_fd); 459 if (err) 460 return -1; 461 err = udp_recv_send(server_fd); 462 if (err) 463 return -1; 464 err = recv_byte(client_fd); 465 if (err) 466 return -1; 467 468 return 0; 469 } 470 471 static struct bpf_link *attach_lookup_prog(struct bpf_program *prog) 472 { 473 struct bpf_link *link; 474 int net_fd; 475 476 net_fd = open("/proc/self/ns/net", O_RDONLY); 477 if (CHECK(net_fd < 0, "open", "failed\n")) { 478 log_err("failed to open /proc/self/ns/net"); 479 return NULL; 480 } 481 482 link = bpf_program__attach_netns(prog, net_fd); 483 if (CHECK(IS_ERR(link), "bpf_program__attach_netns", "failed\n")) { 484 errno = -PTR_ERR(link); 485 log_err("failed to attach program '%s' to netns", 486 bpf_program__name(prog)); 487 link = NULL; 488 } 489 490 close(net_fd); 491 return link; 492 } 493 494 static int update_lookup_map(struct bpf_map *map, int index, int sock_fd) 495 { 496 int err, map_fd; 497 uint64_t value; 498 499 map_fd = bpf_map__fd(map); 500 if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) { 501 errno = -map_fd; 502 log_err("failed to get map FD"); 503 return -1; 504 } 505 506 value = (uint64_t)sock_fd; 507 err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST); 508 if (CHECK(err, "bpf_map_update_elem", "failed\n")) { 509 log_err("failed to update redir_map @ %d", index); 510 return -1; 511 } 512 513 return 0; 514 } 515 516 static void query_lookup_prog(struct test_sk_lookup *skel) 517 { 518 struct bpf_link *link[3] = {}; 519 struct bpf_link_info info; 520 __u32 attach_flags = 0; 521 __u32 prog_ids[3] = {}; 522 __u32 prog_cnt = 3; 523 __u32 prog_id; 524 int net_fd; 525 int err; 526 527 net_fd = open("/proc/self/ns/net", O_RDONLY); 528 if (CHECK(net_fd < 0, "open", "failed\n")) { 529 log_err("failed to open /proc/self/ns/net"); 530 return; 531 } 532 533 link[0] = attach_lookup_prog(skel->progs.lookup_pass); 534 if (!link[0]) 535 goto close; 536 link[1] = attach_lookup_prog(skel->progs.lookup_pass); 537 if (!link[1]) 538 goto detach; 539 link[2] = attach_lookup_prog(skel->progs.lookup_drop); 540 if (!link[2]) 541 goto detach; 542 543 err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */, 544 &attach_flags, prog_ids, &prog_cnt); 545 if (CHECK(err, "bpf_prog_query", "failed\n")) { 546 log_err("failed to query lookup prog"); 547 goto detach; 548 } 549 550 errno = 0; 551 if (CHECK(attach_flags != 0, "bpf_prog_query", 552 "wrong attach_flags on query: %u", attach_flags)) 553 goto detach; 554 if (CHECK(prog_cnt != 3, "bpf_prog_query", 555 "wrong program count on query: %u", prog_cnt)) 556 goto detach; 557 prog_id = link_info_prog_id(link[0], &info); 558 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 559 "invalid program #0 id on query: %u != %u\n", 560 prog_ids[0], prog_id); 561 CHECK(info.netns.netns_ino == 0, "netns_ino", 562 "unexpected netns_ino: %u\n", info.netns.netns_ino); 563 prog_id = link_info_prog_id(link[1], &info); 564 CHECK(prog_ids[1] != prog_id, "bpf_prog_query", 565 "invalid program #1 id on query: %u != %u\n", 566 prog_ids[1], prog_id); 567 CHECK(info.netns.netns_ino == 0, "netns_ino", 568 "unexpected netns_ino: %u\n", info.netns.netns_ino); 569 prog_id = link_info_prog_id(link[2], &info); 570 CHECK(prog_ids[2] != prog_id, "bpf_prog_query", 571 "invalid program #2 id on query: %u != %u\n", 572 prog_ids[2], prog_id); 573 CHECK(info.netns.netns_ino == 0, "netns_ino", 574 "unexpected netns_ino: %u\n", info.netns.netns_ino); 575 576 err = bpf_link__detach(link[0]); 577 if (CHECK(err, "link_detach", "failed %d\n", err)) 578 goto detach; 579 580 /* prog id is still there, but netns_ino is zeroed out */ 581 prog_id = link_info_prog_id(link[0], &info); 582 CHECK(prog_ids[0] != prog_id, "bpf_prog_query", 583 "invalid program #0 id on query: %u != %u\n", 584 prog_ids[0], prog_id); 585 CHECK(info.netns.netns_ino != 0, "netns_ino", 586 "unexpected netns_ino: %u\n", info.netns.netns_ino); 587 588 detach: 589 if (link[2]) 590 bpf_link__destroy(link[2]); 591 if (link[1]) 592 bpf_link__destroy(link[1]); 593 if (link[0]) 594 bpf_link__destroy(link[0]); 595 close: 596 close(net_fd); 597 } 598 599 static void run_lookup_prog(const struct test *t) 600 { 601 int server_fds[MAX_SERVERS] = { -1 }; 602 int client_fd, reuse_conn_fd = -1; 603 struct bpf_link *lookup_link; 604 int i, err; 605 606 lookup_link = attach_lookup_prog(t->lookup_prog); 607 if (!lookup_link) 608 return; 609 610 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 611 server_fds[i] = make_server(t->sotype, t->listen_at.ip, 612 t->listen_at.port, 613 t->reuseport_prog); 614 if (server_fds[i] < 0) 615 goto close; 616 617 err = update_lookup_map(t->sock_map, i, server_fds[i]); 618 if (err) 619 goto close; 620 621 /* want just one server for non-reuseport test */ 622 if (!t->reuseport_prog) 623 break; 624 } 625 626 /* Regular UDP socket lookup with reuseport behaves 627 * differently when reuseport group contains connected 628 * sockets. Check that adding a connected UDP socket to the 629 * reuseport group does not affect how reuseport works with 630 * BPF socket lookup. 631 */ 632 if (t->reuseport_has_conns) { 633 struct sockaddr_storage addr = {}; 634 socklen_t len = sizeof(addr); 635 636 /* Add an extra socket to reuseport group */ 637 reuse_conn_fd = make_server(t->sotype, t->listen_at.ip, 638 t->listen_at.port, 639 t->reuseport_prog); 640 if (reuse_conn_fd < 0) 641 goto close; 642 643 /* Connect the extra socket to itself */ 644 err = getsockname(reuse_conn_fd, (void *)&addr, &len); 645 if (CHECK(err, "getsockname", "errno %d\n", errno)) 646 goto close; 647 err = connect(reuse_conn_fd, (void *)&addr, len); 648 if (CHECK(err, "connect", "errno %d\n", errno)) 649 goto close; 650 } 651 652 client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port); 653 if (client_fd < 0) 654 goto close; 655 656 if (t->sotype == SOCK_STREAM) 657 tcp_echo_test(client_fd, server_fds[t->accept_on]); 658 else 659 udp_echo_test(client_fd, server_fds[t->accept_on]); 660 661 close(client_fd); 662 close: 663 if (reuse_conn_fd != -1) 664 close(reuse_conn_fd); 665 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 666 if (server_fds[i] != -1) 667 close(server_fds[i]); 668 } 669 bpf_link__destroy(lookup_link); 670 } 671 672 static void test_redirect_lookup(struct test_sk_lookup *skel) 673 { 674 const struct test tests[] = { 675 { 676 .desc = "TCP IPv4 redir port", 677 .lookup_prog = skel->progs.redir_port, 678 .sock_map = skel->maps.redir_map, 679 .sotype = SOCK_STREAM, 680 .connect_to = { EXT_IP4, EXT_PORT }, 681 .listen_at = { EXT_IP4, INT_PORT }, 682 }, 683 { 684 .desc = "TCP IPv4 redir addr", 685 .lookup_prog = skel->progs.redir_ip4, 686 .sock_map = skel->maps.redir_map, 687 .sotype = SOCK_STREAM, 688 .connect_to = { EXT_IP4, EXT_PORT }, 689 .listen_at = { INT_IP4, EXT_PORT }, 690 }, 691 { 692 .desc = "TCP IPv4 redir with reuseport", 693 .lookup_prog = skel->progs.select_sock_a, 694 .reuseport_prog = skel->progs.select_sock_b, 695 .sock_map = skel->maps.redir_map, 696 .sotype = SOCK_STREAM, 697 .connect_to = { EXT_IP4, EXT_PORT }, 698 .listen_at = { INT_IP4, INT_PORT }, 699 .accept_on = SERVER_B, 700 }, 701 { 702 .desc = "TCP IPv4 redir skip reuseport", 703 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 704 .reuseport_prog = skel->progs.select_sock_b, 705 .sock_map = skel->maps.redir_map, 706 .sotype = SOCK_STREAM, 707 .connect_to = { EXT_IP4, EXT_PORT }, 708 .listen_at = { INT_IP4, INT_PORT }, 709 .accept_on = SERVER_A, 710 }, 711 { 712 .desc = "TCP IPv6 redir port", 713 .lookup_prog = skel->progs.redir_port, 714 .sock_map = skel->maps.redir_map, 715 .sotype = SOCK_STREAM, 716 .connect_to = { EXT_IP6, EXT_PORT }, 717 .listen_at = { EXT_IP6, INT_PORT }, 718 }, 719 { 720 .desc = "TCP IPv6 redir addr", 721 .lookup_prog = skel->progs.redir_ip6, 722 .sock_map = skel->maps.redir_map, 723 .sotype = SOCK_STREAM, 724 .connect_to = { EXT_IP6, EXT_PORT }, 725 .listen_at = { INT_IP6, EXT_PORT }, 726 }, 727 { 728 .desc = "TCP IPv4->IPv6 redir port", 729 .lookup_prog = skel->progs.redir_port, 730 .sock_map = skel->maps.redir_map, 731 .sotype = SOCK_STREAM, 732 .connect_to = { EXT_IP4, EXT_PORT }, 733 .listen_at = { INT_IP4_V6, INT_PORT }, 734 }, 735 { 736 .desc = "TCP IPv6 redir with reuseport", 737 .lookup_prog = skel->progs.select_sock_a, 738 .reuseport_prog = skel->progs.select_sock_b, 739 .sock_map = skel->maps.redir_map, 740 .sotype = SOCK_STREAM, 741 .connect_to = { EXT_IP6, EXT_PORT }, 742 .listen_at = { INT_IP6, INT_PORT }, 743 .accept_on = SERVER_B, 744 }, 745 { 746 .desc = "TCP IPv6 redir skip reuseport", 747 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 748 .reuseport_prog = skel->progs.select_sock_b, 749 .sock_map = skel->maps.redir_map, 750 .sotype = SOCK_STREAM, 751 .connect_to = { EXT_IP6, EXT_PORT }, 752 .listen_at = { INT_IP6, INT_PORT }, 753 .accept_on = SERVER_A, 754 }, 755 { 756 .desc = "UDP IPv4 redir port", 757 .lookup_prog = skel->progs.redir_port, 758 .sock_map = skel->maps.redir_map, 759 .sotype = SOCK_DGRAM, 760 .connect_to = { EXT_IP4, EXT_PORT }, 761 .listen_at = { EXT_IP4, INT_PORT }, 762 }, 763 { 764 .desc = "UDP IPv4 redir addr", 765 .lookup_prog = skel->progs.redir_ip4, 766 .sock_map = skel->maps.redir_map, 767 .sotype = SOCK_DGRAM, 768 .connect_to = { EXT_IP4, EXT_PORT }, 769 .listen_at = { INT_IP4, EXT_PORT }, 770 }, 771 { 772 .desc = "UDP IPv4 redir with reuseport", 773 .lookup_prog = skel->progs.select_sock_a, 774 .reuseport_prog = skel->progs.select_sock_b, 775 .sock_map = skel->maps.redir_map, 776 .sotype = SOCK_DGRAM, 777 .connect_to = { EXT_IP4, EXT_PORT }, 778 .listen_at = { INT_IP4, INT_PORT }, 779 .accept_on = SERVER_B, 780 }, 781 { 782 .desc = "UDP IPv4 redir and reuseport with conns", 783 .lookup_prog = skel->progs.select_sock_a, 784 .reuseport_prog = skel->progs.select_sock_b, 785 .sock_map = skel->maps.redir_map, 786 .sotype = SOCK_DGRAM, 787 .connect_to = { EXT_IP4, EXT_PORT }, 788 .listen_at = { INT_IP4, INT_PORT }, 789 .accept_on = SERVER_B, 790 .reuseport_has_conns = true, 791 }, 792 { 793 .desc = "UDP IPv4 redir skip reuseport", 794 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 795 .reuseport_prog = skel->progs.select_sock_b, 796 .sock_map = skel->maps.redir_map, 797 .sotype = SOCK_DGRAM, 798 .connect_to = { EXT_IP4, EXT_PORT }, 799 .listen_at = { INT_IP4, INT_PORT }, 800 .accept_on = SERVER_A, 801 }, 802 { 803 .desc = "UDP IPv6 redir port", 804 .lookup_prog = skel->progs.redir_port, 805 .sock_map = skel->maps.redir_map, 806 .sotype = SOCK_DGRAM, 807 .connect_to = { EXT_IP6, EXT_PORT }, 808 .listen_at = { EXT_IP6, INT_PORT }, 809 }, 810 { 811 .desc = "UDP IPv6 redir addr", 812 .lookup_prog = skel->progs.redir_ip6, 813 .sock_map = skel->maps.redir_map, 814 .sotype = SOCK_DGRAM, 815 .connect_to = { EXT_IP6, EXT_PORT }, 816 .listen_at = { INT_IP6, EXT_PORT }, 817 }, 818 { 819 .desc = "UDP IPv4->IPv6 redir port", 820 .lookup_prog = skel->progs.redir_port, 821 .sock_map = skel->maps.redir_map, 822 .sotype = SOCK_DGRAM, 823 .listen_at = { INT_IP4_V6, INT_PORT }, 824 .connect_to = { EXT_IP4, EXT_PORT }, 825 }, 826 { 827 .desc = "UDP IPv6 redir and reuseport", 828 .lookup_prog = skel->progs.select_sock_a, 829 .reuseport_prog = skel->progs.select_sock_b, 830 .sock_map = skel->maps.redir_map, 831 .sotype = SOCK_DGRAM, 832 .connect_to = { EXT_IP6, EXT_PORT }, 833 .listen_at = { INT_IP6, INT_PORT }, 834 .accept_on = SERVER_B, 835 }, 836 { 837 .desc = "UDP IPv6 redir and reuseport with conns", 838 .lookup_prog = skel->progs.select_sock_a, 839 .reuseport_prog = skel->progs.select_sock_b, 840 .sock_map = skel->maps.redir_map, 841 .sotype = SOCK_DGRAM, 842 .connect_to = { EXT_IP6, EXT_PORT }, 843 .listen_at = { INT_IP6, INT_PORT }, 844 .accept_on = SERVER_B, 845 .reuseport_has_conns = true, 846 }, 847 { 848 .desc = "UDP IPv6 redir skip reuseport", 849 .lookup_prog = skel->progs.select_sock_a_no_reuseport, 850 .reuseport_prog = skel->progs.select_sock_b, 851 .sock_map = skel->maps.redir_map, 852 .sotype = SOCK_DGRAM, 853 .connect_to = { EXT_IP6, EXT_PORT }, 854 .listen_at = { INT_IP6, INT_PORT }, 855 .accept_on = SERVER_A, 856 }, 857 }; 858 const struct test *t; 859 860 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 861 if (test__start_subtest(t->desc)) 862 run_lookup_prog(t); 863 } 864 } 865 866 static void drop_on_lookup(const struct test *t) 867 { 868 struct sockaddr_storage dst = {}; 869 int client_fd, server_fd, err; 870 struct bpf_link *lookup_link; 871 ssize_t n; 872 873 lookup_link = attach_lookup_prog(t->lookup_prog); 874 if (!lookup_link) 875 return; 876 877 server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 878 t->reuseport_prog); 879 if (server_fd < 0) 880 goto detach; 881 882 client_fd = make_socket(t->sotype, t->connect_to.ip, 883 t->connect_to.port, &dst); 884 if (client_fd < 0) 885 goto close_srv; 886 887 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 888 if (t->sotype == SOCK_DGRAM) { 889 err = send_byte(client_fd); 890 if (err) 891 goto close_all; 892 893 /* Read out asynchronous error */ 894 n = recv(client_fd, NULL, 0, 0); 895 err = n == -1; 896 } 897 if (CHECK(!err || errno != ECONNREFUSED, "connect", 898 "unexpected success or error\n")) 899 log_err("expected ECONNREFUSED on connect"); 900 901 close_all: 902 close(client_fd); 903 close_srv: 904 close(server_fd); 905 detach: 906 bpf_link__destroy(lookup_link); 907 } 908 909 static void test_drop_on_lookup(struct test_sk_lookup *skel) 910 { 911 const struct test tests[] = { 912 { 913 .desc = "TCP IPv4 drop on lookup", 914 .lookup_prog = skel->progs.lookup_drop, 915 .sotype = SOCK_STREAM, 916 .connect_to = { EXT_IP4, EXT_PORT }, 917 .listen_at = { EXT_IP4, EXT_PORT }, 918 }, 919 { 920 .desc = "TCP IPv6 drop on lookup", 921 .lookup_prog = skel->progs.lookup_drop, 922 .sotype = SOCK_STREAM, 923 .connect_to = { EXT_IP6, EXT_PORT }, 924 .listen_at = { EXT_IP6, EXT_PORT }, 925 }, 926 { 927 .desc = "UDP IPv4 drop on lookup", 928 .lookup_prog = skel->progs.lookup_drop, 929 .sotype = SOCK_DGRAM, 930 .connect_to = { EXT_IP4, EXT_PORT }, 931 .listen_at = { EXT_IP4, EXT_PORT }, 932 }, 933 { 934 .desc = "UDP IPv6 drop on lookup", 935 .lookup_prog = skel->progs.lookup_drop, 936 .sotype = SOCK_DGRAM, 937 .connect_to = { EXT_IP6, EXT_PORT }, 938 .listen_at = { EXT_IP6, INT_PORT }, 939 }, 940 }; 941 const struct test *t; 942 943 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 944 if (test__start_subtest(t->desc)) 945 drop_on_lookup(t); 946 } 947 } 948 949 static void drop_on_reuseport(const struct test *t) 950 { 951 struct sockaddr_storage dst = { 0 }; 952 int client, server1, server2, err; 953 struct bpf_link *lookup_link; 954 ssize_t n; 955 956 lookup_link = attach_lookup_prog(t->lookup_prog); 957 if (!lookup_link) 958 return; 959 960 server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port, 961 t->reuseport_prog); 962 if (server1 < 0) 963 goto detach; 964 965 err = update_lookup_map(t->sock_map, SERVER_A, server1); 966 if (err) 967 goto detach; 968 969 /* second server on destination address we should never reach */ 970 server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port, 971 NULL /* reuseport prog */); 972 if (server2 < 0) 973 goto close_srv1; 974 975 client = make_socket(t->sotype, t->connect_to.ip, 976 t->connect_to.port, &dst); 977 if (client < 0) 978 goto close_srv2; 979 980 err = connect(client, (void *)&dst, inetaddr_len(&dst)); 981 if (t->sotype == SOCK_DGRAM) { 982 err = send_byte(client); 983 if (err) 984 goto close_all; 985 986 /* Read out asynchronous error */ 987 n = recv(client, NULL, 0, 0); 988 err = n == -1; 989 } 990 if (CHECK(!err || errno != ECONNREFUSED, "connect", 991 "unexpected success or error\n")) 992 log_err("expected ECONNREFUSED on connect"); 993 994 close_all: 995 close(client); 996 close_srv2: 997 close(server2); 998 close_srv1: 999 close(server1); 1000 detach: 1001 bpf_link__destroy(lookup_link); 1002 } 1003 1004 static void test_drop_on_reuseport(struct test_sk_lookup *skel) 1005 { 1006 const struct test tests[] = { 1007 { 1008 .desc = "TCP IPv4 drop on reuseport", 1009 .lookup_prog = skel->progs.select_sock_a, 1010 .reuseport_prog = skel->progs.reuseport_drop, 1011 .sock_map = skel->maps.redir_map, 1012 .sotype = SOCK_STREAM, 1013 .connect_to = { EXT_IP4, EXT_PORT }, 1014 .listen_at = { INT_IP4, INT_PORT }, 1015 }, 1016 { 1017 .desc = "TCP IPv6 drop on reuseport", 1018 .lookup_prog = skel->progs.select_sock_a, 1019 .reuseport_prog = skel->progs.reuseport_drop, 1020 .sock_map = skel->maps.redir_map, 1021 .sotype = SOCK_STREAM, 1022 .connect_to = { EXT_IP6, EXT_PORT }, 1023 .listen_at = { INT_IP6, INT_PORT }, 1024 }, 1025 { 1026 .desc = "UDP IPv4 drop on reuseport", 1027 .lookup_prog = skel->progs.select_sock_a, 1028 .reuseport_prog = skel->progs.reuseport_drop, 1029 .sock_map = skel->maps.redir_map, 1030 .sotype = SOCK_DGRAM, 1031 .connect_to = { EXT_IP4, EXT_PORT }, 1032 .listen_at = { INT_IP4, INT_PORT }, 1033 }, 1034 { 1035 .desc = "TCP IPv6 drop on reuseport", 1036 .lookup_prog = skel->progs.select_sock_a, 1037 .reuseport_prog = skel->progs.reuseport_drop, 1038 .sock_map = skel->maps.redir_map, 1039 .sotype = SOCK_STREAM, 1040 .connect_to = { EXT_IP6, EXT_PORT }, 1041 .listen_at = { INT_IP6, INT_PORT }, 1042 }, 1043 }; 1044 const struct test *t; 1045 1046 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1047 if (test__start_subtest(t->desc)) 1048 drop_on_reuseport(t); 1049 } 1050 } 1051 1052 static void run_sk_assign(struct test_sk_lookup *skel, 1053 struct bpf_program *lookup_prog, 1054 const char *remote_ip, const char *local_ip) 1055 { 1056 int server_fds[MAX_SERVERS] = { -1 }; 1057 struct bpf_sk_lookup ctx; 1058 __u64 server_cookie; 1059 int i, err; 1060 1061 DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts, 1062 .ctx_in = &ctx, 1063 .ctx_size_in = sizeof(ctx), 1064 .ctx_out = &ctx, 1065 .ctx_size_out = sizeof(ctx), 1066 ); 1067 1068 if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT)) 1069 return; 1070 1071 ctx.protocol = IPPROTO_TCP; 1072 1073 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1074 server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL); 1075 if (server_fds[i] < 0) 1076 goto close_servers; 1077 1078 err = update_lookup_map(skel->maps.redir_map, i, 1079 server_fds[i]); 1080 if (err) 1081 goto close_servers; 1082 } 1083 1084 server_cookie = socket_cookie(server_fds[SERVER_B]); 1085 if (!server_cookie) 1086 return; 1087 1088 err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts); 1089 if (CHECK(err, "test_run", "failed with error %d\n", errno)) 1090 goto close_servers; 1091 1092 if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n")) 1093 goto close_servers; 1094 1095 CHECK(ctx.cookie != server_cookie, "ctx.cookie", 1096 "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie); 1097 1098 close_servers: 1099 for (i = 0; i < ARRAY_SIZE(server_fds); i++) { 1100 if (server_fds[i] != -1) 1101 close(server_fds[i]); 1102 } 1103 } 1104 1105 static void run_sk_assign_v4(struct test_sk_lookup *skel, 1106 struct bpf_program *lookup_prog) 1107 { 1108 run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4); 1109 } 1110 1111 static void run_sk_assign_v6(struct test_sk_lookup *skel, 1112 struct bpf_program *lookup_prog) 1113 { 1114 run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6); 1115 } 1116 1117 static void run_sk_assign_connected(struct test_sk_lookup *skel, 1118 int sotype) 1119 { 1120 int err, client_fd, connected_fd, server_fd; 1121 struct bpf_link *lookup_link; 1122 1123 server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL); 1124 if (server_fd < 0) 1125 return; 1126 1127 connected_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1128 if (connected_fd < 0) 1129 goto out_close_server; 1130 1131 /* Put a connected socket in redirect map */ 1132 err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd); 1133 if (err) 1134 goto out_close_connected; 1135 1136 lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport); 1137 if (!lookup_link) 1138 goto out_close_connected; 1139 1140 /* Try to redirect TCP SYN / UDP packet to a connected socket */ 1141 client_fd = make_client(sotype, EXT_IP4, EXT_PORT); 1142 if (client_fd < 0) 1143 goto out_unlink_prog; 1144 if (sotype == SOCK_DGRAM) { 1145 send_byte(client_fd); 1146 recv_byte(server_fd); 1147 } 1148 1149 close(client_fd); 1150 out_unlink_prog: 1151 bpf_link__destroy(lookup_link); 1152 out_close_connected: 1153 close(connected_fd); 1154 out_close_server: 1155 close(server_fd); 1156 } 1157 1158 static void test_sk_assign_helper(struct test_sk_lookup *skel) 1159 { 1160 if (test__start_subtest("sk_assign returns EEXIST")) 1161 run_sk_assign_v4(skel, skel->progs.sk_assign_eexist); 1162 if (test__start_subtest("sk_assign honors F_REPLACE")) 1163 run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag); 1164 if (test__start_subtest("sk_assign accepts NULL socket")) 1165 run_sk_assign_v4(skel, skel->progs.sk_assign_null); 1166 if (test__start_subtest("access ctx->sk")) 1167 run_sk_assign_v4(skel, skel->progs.access_ctx_sk); 1168 if (test__start_subtest("narrow access to ctx v4")) 1169 run_sk_assign_v4(skel, skel->progs.ctx_narrow_access); 1170 if (test__start_subtest("narrow access to ctx v6")) 1171 run_sk_assign_v6(skel, skel->progs.ctx_narrow_access); 1172 if (test__start_subtest("sk_assign rejects TCP established")) 1173 run_sk_assign_connected(skel, SOCK_STREAM); 1174 if (test__start_subtest("sk_assign rejects UDP connected")) 1175 run_sk_assign_connected(skel, SOCK_DGRAM); 1176 } 1177 1178 struct test_multi_prog { 1179 const char *desc; 1180 struct bpf_program *prog1; 1181 struct bpf_program *prog2; 1182 struct bpf_map *redir_map; 1183 struct bpf_map *run_map; 1184 int expect_errno; 1185 struct inet_addr listen_at; 1186 }; 1187 1188 static void run_multi_prog_lookup(const struct test_multi_prog *t) 1189 { 1190 struct sockaddr_storage dst = {}; 1191 int map_fd, server_fd, client_fd; 1192 struct bpf_link *link1, *link2; 1193 int prog_idx, done, err; 1194 1195 map_fd = bpf_map__fd(t->run_map); 1196 1197 done = 0; 1198 prog_idx = PROG1; 1199 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1200 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1201 return; 1202 prog_idx = PROG2; 1203 err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY); 1204 if (CHECK(err, "bpf_map_update_elem", "failed\n")) 1205 return; 1206 1207 link1 = attach_lookup_prog(t->prog1); 1208 if (!link1) 1209 return; 1210 link2 = attach_lookup_prog(t->prog2); 1211 if (!link2) 1212 goto out_unlink1; 1213 1214 server_fd = make_server(SOCK_STREAM, t->listen_at.ip, 1215 t->listen_at.port, NULL); 1216 if (server_fd < 0) 1217 goto out_unlink2; 1218 1219 err = update_lookup_map(t->redir_map, SERVER_A, server_fd); 1220 if (err) 1221 goto out_close_server; 1222 1223 client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst); 1224 if (client_fd < 0) 1225 goto out_close_server; 1226 1227 err = connect(client_fd, (void *)&dst, inetaddr_len(&dst)); 1228 if (CHECK(err && !t->expect_errno, "connect", 1229 "unexpected error %d\n", errno)) 1230 goto out_close_client; 1231 if (CHECK(err && t->expect_errno && errno != t->expect_errno, 1232 "connect", "unexpected error %d\n", errno)) 1233 goto out_close_client; 1234 1235 done = 0; 1236 prog_idx = PROG1; 1237 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1238 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1239 CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n"); 1240 1241 done = 0; 1242 prog_idx = PROG2; 1243 err = bpf_map_lookup_elem(map_fd, &prog_idx, &done); 1244 CHECK(err, "bpf_map_lookup_elem", "failed\n"); 1245 CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n"); 1246 1247 out_close_client: 1248 close(client_fd); 1249 out_close_server: 1250 close(server_fd); 1251 out_unlink2: 1252 bpf_link__destroy(link2); 1253 out_unlink1: 1254 bpf_link__destroy(link1); 1255 } 1256 1257 static void test_multi_prog_lookup(struct test_sk_lookup *skel) 1258 { 1259 struct test_multi_prog tests[] = { 1260 { 1261 .desc = "multi prog - pass, pass", 1262 .prog1 = skel->progs.multi_prog_pass1, 1263 .prog2 = skel->progs.multi_prog_pass2, 1264 .listen_at = { EXT_IP4, EXT_PORT }, 1265 }, 1266 { 1267 .desc = "multi prog - drop, drop", 1268 .prog1 = skel->progs.multi_prog_drop1, 1269 .prog2 = skel->progs.multi_prog_drop2, 1270 .listen_at = { EXT_IP4, EXT_PORT }, 1271 .expect_errno = ECONNREFUSED, 1272 }, 1273 { 1274 .desc = "multi prog - pass, drop", 1275 .prog1 = skel->progs.multi_prog_pass1, 1276 .prog2 = skel->progs.multi_prog_drop2, 1277 .listen_at = { EXT_IP4, EXT_PORT }, 1278 .expect_errno = ECONNREFUSED, 1279 }, 1280 { 1281 .desc = "multi prog - drop, pass", 1282 .prog1 = skel->progs.multi_prog_drop1, 1283 .prog2 = skel->progs.multi_prog_pass2, 1284 .listen_at = { EXT_IP4, EXT_PORT }, 1285 .expect_errno = ECONNREFUSED, 1286 }, 1287 { 1288 .desc = "multi prog - pass, redir", 1289 .prog1 = skel->progs.multi_prog_pass1, 1290 .prog2 = skel->progs.multi_prog_redir2, 1291 .listen_at = { INT_IP4, INT_PORT }, 1292 }, 1293 { 1294 .desc = "multi prog - redir, pass", 1295 .prog1 = skel->progs.multi_prog_redir1, 1296 .prog2 = skel->progs.multi_prog_pass2, 1297 .listen_at = { INT_IP4, INT_PORT }, 1298 }, 1299 { 1300 .desc = "multi prog - drop, redir", 1301 .prog1 = skel->progs.multi_prog_drop1, 1302 .prog2 = skel->progs.multi_prog_redir2, 1303 .listen_at = { INT_IP4, INT_PORT }, 1304 }, 1305 { 1306 .desc = "multi prog - redir, drop", 1307 .prog1 = skel->progs.multi_prog_redir1, 1308 .prog2 = skel->progs.multi_prog_drop2, 1309 .listen_at = { INT_IP4, INT_PORT }, 1310 }, 1311 { 1312 .desc = "multi prog - redir, redir", 1313 .prog1 = skel->progs.multi_prog_redir1, 1314 .prog2 = skel->progs.multi_prog_redir2, 1315 .listen_at = { INT_IP4, INT_PORT }, 1316 }, 1317 }; 1318 struct test_multi_prog *t; 1319 1320 for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 1321 t->redir_map = skel->maps.redir_map; 1322 t->run_map = skel->maps.run_map; 1323 if (test__start_subtest(t->desc)) 1324 run_multi_prog_lookup(t); 1325 } 1326 } 1327 1328 static void run_tests(struct test_sk_lookup *skel) 1329 { 1330 if (test__start_subtest("query lookup prog")) 1331 query_lookup_prog(skel); 1332 test_redirect_lookup(skel); 1333 test_drop_on_lookup(skel); 1334 test_drop_on_reuseport(skel); 1335 test_sk_assign_helper(skel); 1336 test_multi_prog_lookup(skel); 1337 } 1338 1339 static int switch_netns(void) 1340 { 1341 static const char * const setup_script[] = { 1342 "ip -6 addr add dev lo " EXT_IP6 "/128", 1343 "ip -6 addr add dev lo " INT_IP6 "/128", 1344 "ip link set dev lo up", 1345 NULL, 1346 }; 1347 const char * const *cmd; 1348 int err; 1349 1350 err = unshare(CLONE_NEWNET); 1351 if (CHECK(err, "unshare", "failed\n")) { 1352 log_err("unshare(CLONE_NEWNET)"); 1353 return -1; 1354 } 1355 1356 for (cmd = setup_script; *cmd; cmd++) { 1357 err = system(*cmd); 1358 if (CHECK(err, "system", "failed\n")) { 1359 log_err("system(%s)", *cmd); 1360 return -1; 1361 } 1362 } 1363 1364 return 0; 1365 } 1366 1367 void test_sk_lookup(void) 1368 { 1369 struct test_sk_lookup *skel; 1370 int err; 1371 1372 err = switch_netns(); 1373 if (err) 1374 return; 1375 1376 skel = test_sk_lookup__open_and_load(); 1377 if (CHECK(!skel, "skel open_and_load", "failed\n")) 1378 return; 1379 1380 run_tests(skel); 1381 1382 test_sk_lookup__destroy(skel); 1383 } 1384