1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 // Copyright (c) 2020 Cloudflare
3 /*
4  * Test BPF attach point for INET socket lookup (BPF_SK_LOOKUP).
5  *
6  * Tests exercise:
7  *  - attaching/detaching/querying programs to BPF_SK_LOOKUP hook,
8  *  - redirecting socket lookup to a socket selected by BPF program,
9  *  - failing a socket lookup on BPF program's request,
10  *  - error scenarios for selecting a socket from BPF program,
11  *  - accessing BPF program context,
12  *  - attaching and running multiple BPF programs.
13  *
14  * Tests run in a dedicated network namespace.
15  */
16 
17 #define _GNU_SOURCE
18 #include <arpa/inet.h>
19 #include <assert.h>
20 #include <errno.h>
21 #include <error.h>
22 #include <fcntl.h>
23 #include <sched.h>
24 #include <stdio.h>
25 #include <sys/types.h>
26 #include <sys/stat.h>
27 #include <unistd.h>
28 
29 #include <bpf/libbpf.h>
30 #include <bpf/bpf.h>
31 
32 #include "test_progs.h"
33 #include "bpf_util.h"
34 #include "cgroup_helpers.h"
35 #include "network_helpers.h"
36 #include "testing_helpers.h"
37 #include "test_sk_lookup.skel.h"
38 
39 /* External (address, port) pairs the client sends packets to. */
40 #define EXT_IP4		"127.0.0.1"
41 #define EXT_IP6		"fd00::1"
42 #define EXT_PORT	7007
43 
44 /* Internal (address, port) pairs the server listens/receives at. */
45 #define INT_IP4		"127.0.0.2"
46 #define INT_IP4_V6	"::ffff:127.0.0.2"
47 #define INT_IP6		"fd00::2"
48 #define INT_PORT	8008
49 
50 #define IO_TIMEOUT_SEC	3
51 
52 enum server {
53 	SERVER_A = 0,
54 	SERVER_B = 1,
55 	MAX_SERVERS,
56 };
57 
58 enum {
59 	PROG1 = 0,
60 	PROG2,
61 };
62 
63 struct inet_addr {
64 	const char *ip;
65 	unsigned short port;
66 };
67 
68 struct test {
69 	const char *desc;
70 	struct bpf_program *lookup_prog;
71 	struct bpf_program *reuseport_prog;
72 	struct bpf_map *sock_map;
73 	int sotype;
74 	struct inet_addr connect_to;
75 	struct inet_addr listen_at;
76 	enum server accept_on;
77 	bool reuseport_has_conns; /* Add a connected socket to reuseport group */
78 };
79 
80 static __u32 duration;		/* for CHECK macro */
81 
82 static bool is_ipv6(const char *ip)
83 {
84 	return !!strchr(ip, ':');
85 }
86 
87 static int attach_reuseport(int sock_fd, struct bpf_program *reuseport_prog)
88 {
89 	int err, prog_fd;
90 
91 	prog_fd = bpf_program__fd(reuseport_prog);
92 	if (prog_fd < 0) {
93 		errno = -prog_fd;
94 		return -1;
95 	}
96 
97 	err = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF,
98 			 &prog_fd, sizeof(prog_fd));
99 	if (err)
100 		return -1;
101 
102 	return 0;
103 }
104 
105 static socklen_t inetaddr_len(const struct sockaddr_storage *addr)
106 {
107 	return (addr->ss_family == AF_INET ? sizeof(struct sockaddr_in) :
108 		addr->ss_family == AF_INET6 ? sizeof(struct sockaddr_in6) : 0);
109 }
110 
111 static int make_socket(int sotype, const char *ip, int port,
112 		       struct sockaddr_storage *addr)
113 {
114 	struct timeval timeo = { .tv_sec = IO_TIMEOUT_SEC };
115 	int err, family, fd;
116 
117 	family = is_ipv6(ip) ? AF_INET6 : AF_INET;
118 	err = make_sockaddr(family, ip, port, addr, NULL);
119 	if (CHECK(err, "make_address", "failed\n"))
120 		return -1;
121 
122 	fd = socket(addr->ss_family, sotype, 0);
123 	if (CHECK(fd < 0, "socket", "failed\n")) {
124 		log_err("failed to make socket");
125 		return -1;
126 	}
127 
128 	err = setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
129 	if (CHECK(err, "setsockopt(SO_SNDTIMEO)", "failed\n")) {
130 		log_err("failed to set SNDTIMEO");
131 		close(fd);
132 		return -1;
133 	}
134 
135 	err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
136 	if (CHECK(err, "setsockopt(SO_RCVTIMEO)", "failed\n")) {
137 		log_err("failed to set RCVTIMEO");
138 		close(fd);
139 		return -1;
140 	}
141 
142 	return fd;
143 }
144 
145 static int make_server(int sotype, const char *ip, int port,
146 		       struct bpf_program *reuseport_prog)
147 {
148 	struct sockaddr_storage addr = {0};
149 	const int one = 1;
150 	int err, fd = -1;
151 
152 	fd = make_socket(sotype, ip, port, &addr);
153 	if (fd < 0)
154 		return -1;
155 
156 	/* Enabled for UDPv6 sockets for IPv4-mapped IPv6 to work. */
157 	if (sotype == SOCK_DGRAM) {
158 		err = setsockopt(fd, SOL_IP, IP_RECVORIGDSTADDR, &one,
159 				 sizeof(one));
160 		if (CHECK(err, "setsockopt(IP_RECVORIGDSTADDR)", "failed\n")) {
161 			log_err("failed to enable IP_RECVORIGDSTADDR");
162 			goto fail;
163 		}
164 	}
165 
166 	if (sotype == SOCK_DGRAM && addr.ss_family == AF_INET6) {
167 		err = setsockopt(fd, SOL_IPV6, IPV6_RECVORIGDSTADDR, &one,
168 				 sizeof(one));
169 		if (CHECK(err, "setsockopt(IPV6_RECVORIGDSTADDR)", "failed\n")) {
170 			log_err("failed to enable IPV6_RECVORIGDSTADDR");
171 			goto fail;
172 		}
173 	}
174 
175 	if (sotype == SOCK_STREAM) {
176 		err = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
177 				 sizeof(one));
178 		if (CHECK(err, "setsockopt(SO_REUSEADDR)", "failed\n")) {
179 			log_err("failed to enable SO_REUSEADDR");
180 			goto fail;
181 		}
182 	}
183 
184 	if (reuseport_prog) {
185 		err = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one,
186 				 sizeof(one));
187 		if (CHECK(err, "setsockopt(SO_REUSEPORT)", "failed\n")) {
188 			log_err("failed to enable SO_REUSEPORT");
189 			goto fail;
190 		}
191 	}
192 
193 	err = bind(fd, (void *)&addr, inetaddr_len(&addr));
194 	if (CHECK(err, "bind", "failed\n")) {
195 		log_err("failed to bind listen socket");
196 		goto fail;
197 	}
198 
199 	if (sotype == SOCK_STREAM) {
200 		err = listen(fd, SOMAXCONN);
201 		if (CHECK(err, "make_server", "listen")) {
202 			log_err("failed to listen on port %d", port);
203 			goto fail;
204 		}
205 	}
206 
207 	/* Late attach reuseport prog so we can have one init path */
208 	if (reuseport_prog) {
209 		err = attach_reuseport(fd, reuseport_prog);
210 		if (CHECK(err, "attach_reuseport", "failed\n")) {
211 			log_err("failed to attach reuseport prog");
212 			goto fail;
213 		}
214 	}
215 
216 	return fd;
217 fail:
218 	close(fd);
219 	return -1;
220 }
221 
222 static int make_client(int sotype, const char *ip, int port)
223 {
224 	struct sockaddr_storage addr = {0};
225 	int err, fd;
226 
227 	fd = make_socket(sotype, ip, port, &addr);
228 	if (fd < 0)
229 		return -1;
230 
231 	err = connect(fd, (void *)&addr, inetaddr_len(&addr));
232 	if (CHECK(err, "make_client", "connect")) {
233 		log_err("failed to connect client socket");
234 		goto fail;
235 	}
236 
237 	return fd;
238 fail:
239 	close(fd);
240 	return -1;
241 }
242 
243 static __u64 socket_cookie(int fd)
244 {
245 	__u64 cookie;
246 	socklen_t cookie_len = sizeof(cookie);
247 
248 	if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0,
249 		  "getsockopt(SO_COOKIE)", "%s\n", strerror(errno)))
250 		return 0;
251 	return cookie;
252 }
253 
254 static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port,
255 			      const char *remote_ip, __u16 remote_port)
256 {
257 	void *local, *remote;
258 	int err;
259 
260 	memset(ctx, 0, sizeof(*ctx));
261 	ctx->local_port = local_port;
262 	ctx->remote_port = htons(remote_port);
263 
264 	if (is_ipv6(local_ip)) {
265 		ctx->family = AF_INET6;
266 		local = &ctx->local_ip6[0];
267 		remote = &ctx->remote_ip6[0];
268 	} else {
269 		ctx->family = AF_INET;
270 		local = &ctx->local_ip4;
271 		remote = &ctx->remote_ip4;
272 	}
273 
274 	err = inet_pton(ctx->family, local_ip, local);
275 	if (CHECK(err != 1, "inet_pton", "local_ip failed\n"))
276 		return 1;
277 
278 	err = inet_pton(ctx->family, remote_ip, remote);
279 	if (CHECK(err != 1, "inet_pton", "remote_ip failed\n"))
280 		return 1;
281 
282 	return 0;
283 }
284 
285 static int send_byte(int fd)
286 {
287 	ssize_t n;
288 
289 	errno = 0;
290 	n = send(fd, "a", 1, 0);
291 	if (CHECK(n <= 0, "send_byte", "send")) {
292 		log_err("failed/partial send");
293 		return -1;
294 	}
295 	return 0;
296 }
297 
298 static int recv_byte(int fd)
299 {
300 	char buf[1];
301 	ssize_t n;
302 
303 	n = recv(fd, buf, sizeof(buf), 0);
304 	if (CHECK(n <= 0, "recv_byte", "recv")) {
305 		log_err("failed/partial recv");
306 		return -1;
307 	}
308 	return 0;
309 }
310 
311 static int tcp_recv_send(int server_fd)
312 {
313 	char buf[1];
314 	int ret, fd;
315 	ssize_t n;
316 
317 	fd = accept(server_fd, NULL, NULL);
318 	if (CHECK(fd < 0, "accept", "failed\n")) {
319 		log_err("failed to accept");
320 		return -1;
321 	}
322 
323 	n = recv(fd, buf, sizeof(buf), 0);
324 	if (CHECK(n <= 0, "recv", "failed\n")) {
325 		log_err("failed/partial recv");
326 		ret = -1;
327 		goto close;
328 	}
329 
330 	n = send(fd, buf, n, 0);
331 	if (CHECK(n <= 0, "send", "failed\n")) {
332 		log_err("failed/partial send");
333 		ret = -1;
334 		goto close;
335 	}
336 
337 	ret = 0;
338 close:
339 	close(fd);
340 	return ret;
341 }
342 
343 static void v4_to_v6(struct sockaddr_storage *ss)
344 {
345 	struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)ss;
346 	struct sockaddr_in v4 = *(struct sockaddr_in *)ss;
347 
348 	v6->sin6_family = AF_INET6;
349 	v6->sin6_port = v4.sin_port;
350 	v6->sin6_addr.s6_addr[10] = 0xff;
351 	v6->sin6_addr.s6_addr[11] = 0xff;
352 	memcpy(&v6->sin6_addr.s6_addr[12], &v4.sin_addr.s_addr, 4);
353 	memset(&v6->sin6_addr.s6_addr[0], 0, 10);
354 }
355 
356 static int udp_recv_send(int server_fd)
357 {
358 	char cmsg_buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
359 	struct sockaddr_storage _src_addr = { 0 };
360 	struct sockaddr_storage *src_addr = &_src_addr;
361 	struct sockaddr_storage *dst_addr = NULL;
362 	struct msghdr msg = { 0 };
363 	struct iovec iov = { 0 };
364 	struct cmsghdr *cm;
365 	char buf[1];
366 	int ret, fd;
367 	ssize_t n;
368 
369 	iov.iov_base = buf;
370 	iov.iov_len = sizeof(buf);
371 
372 	msg.msg_name = src_addr;
373 	msg.msg_namelen = sizeof(*src_addr);
374 	msg.msg_iov = &iov;
375 	msg.msg_iovlen = 1;
376 	msg.msg_control = cmsg_buf;
377 	msg.msg_controllen = sizeof(cmsg_buf);
378 
379 	errno = 0;
380 	n = recvmsg(server_fd, &msg, 0);
381 	if (CHECK(n <= 0, "recvmsg", "failed\n")) {
382 		log_err("failed to receive");
383 		return -1;
384 	}
385 	if (CHECK(msg.msg_flags & MSG_CTRUNC, "recvmsg", "truncated cmsg\n"))
386 		return -1;
387 
388 	for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) {
389 		if ((cm->cmsg_level == SOL_IP &&
390 		     cm->cmsg_type == IP_ORIGDSTADDR) ||
391 		    (cm->cmsg_level == SOL_IPV6 &&
392 		     cm->cmsg_type == IPV6_ORIGDSTADDR)) {
393 			dst_addr = (struct sockaddr_storage *)CMSG_DATA(cm);
394 			break;
395 		}
396 		log_err("warning: ignored cmsg at level %d type %d",
397 			cm->cmsg_level, cm->cmsg_type);
398 	}
399 	if (CHECK(!dst_addr, "recvmsg", "missing ORIGDSTADDR\n"))
400 		return -1;
401 
402 	/* Server socket bound to IPv4-mapped IPv6 address */
403 	if (src_addr->ss_family == AF_INET6 &&
404 	    dst_addr->ss_family == AF_INET) {
405 		v4_to_v6(dst_addr);
406 	}
407 
408 	/* Reply from original destination address. */
409 	fd = socket(dst_addr->ss_family, SOCK_DGRAM, 0);
410 	if (CHECK(fd < 0, "socket", "failed\n")) {
411 		log_err("failed to create tx socket");
412 		return -1;
413 	}
414 
415 	ret = bind(fd, (struct sockaddr *)dst_addr, sizeof(*dst_addr));
416 	if (CHECK(ret, "bind", "failed\n")) {
417 		log_err("failed to bind tx socket");
418 		goto out;
419 	}
420 
421 	msg.msg_control = NULL;
422 	msg.msg_controllen = 0;
423 	n = sendmsg(fd, &msg, 0);
424 	if (CHECK(n <= 0, "sendmsg", "failed\n")) {
425 		log_err("failed to send echo reply");
426 		ret = -1;
427 		goto out;
428 	}
429 
430 	ret = 0;
431 out:
432 	close(fd);
433 	return ret;
434 }
435 
436 static int tcp_echo_test(int client_fd, int server_fd)
437 {
438 	int err;
439 
440 	err = send_byte(client_fd);
441 	if (err)
442 		return -1;
443 	err = tcp_recv_send(server_fd);
444 	if (err)
445 		return -1;
446 	err = recv_byte(client_fd);
447 	if (err)
448 		return -1;
449 
450 	return 0;
451 }
452 
453 static int udp_echo_test(int client_fd, int server_fd)
454 {
455 	int err;
456 
457 	err = send_byte(client_fd);
458 	if (err)
459 		return -1;
460 	err = udp_recv_send(server_fd);
461 	if (err)
462 		return -1;
463 	err = recv_byte(client_fd);
464 	if (err)
465 		return -1;
466 
467 	return 0;
468 }
469 
470 static struct bpf_link *attach_lookup_prog(struct bpf_program *prog)
471 {
472 	struct bpf_link *link;
473 	int net_fd;
474 
475 	net_fd = open("/proc/self/ns/net", O_RDONLY);
476 	if (CHECK(net_fd < 0, "open", "failed\n")) {
477 		log_err("failed to open /proc/self/ns/net");
478 		return NULL;
479 	}
480 
481 	link = bpf_program__attach_netns(prog, net_fd);
482 	if (!ASSERT_OK_PTR(link, "bpf_program__attach_netns")) {
483 		errno = -PTR_ERR(link);
484 		log_err("failed to attach program '%s' to netns",
485 			bpf_program__name(prog));
486 		link = NULL;
487 	}
488 
489 	close(net_fd);
490 	return link;
491 }
492 
493 static int update_lookup_map(struct bpf_map *map, int index, int sock_fd)
494 {
495 	int err, map_fd;
496 	uint64_t value;
497 
498 	map_fd = bpf_map__fd(map);
499 	if (CHECK(map_fd < 0, "bpf_map__fd", "failed\n")) {
500 		errno = -map_fd;
501 		log_err("failed to get map FD");
502 		return -1;
503 	}
504 
505 	value = (uint64_t)sock_fd;
506 	err = bpf_map_update_elem(map_fd, &index, &value, BPF_NOEXIST);
507 	if (CHECK(err, "bpf_map_update_elem", "failed\n")) {
508 		log_err("failed to update redir_map @ %d", index);
509 		return -1;
510 	}
511 
512 	return 0;
513 }
514 
515 static void query_lookup_prog(struct test_sk_lookup *skel)
516 {
517 	struct bpf_link *link[3] = {};
518 	struct bpf_link_info info;
519 	__u32 attach_flags = 0;
520 	__u32 prog_ids[3] = {};
521 	__u32 prog_cnt = 3;
522 	__u32 prog_id;
523 	int net_fd;
524 	int err;
525 
526 	net_fd = open("/proc/self/ns/net", O_RDONLY);
527 	if (CHECK(net_fd < 0, "open", "failed\n")) {
528 		log_err("failed to open /proc/self/ns/net");
529 		return;
530 	}
531 
532 	link[0] = attach_lookup_prog(skel->progs.lookup_pass);
533 	if (!link[0])
534 		goto close;
535 	link[1] = attach_lookup_prog(skel->progs.lookup_pass);
536 	if (!link[1])
537 		goto detach;
538 	link[2] = attach_lookup_prog(skel->progs.lookup_drop);
539 	if (!link[2])
540 		goto detach;
541 
542 	err = bpf_prog_query(net_fd, BPF_SK_LOOKUP, 0 /* query flags */,
543 			     &attach_flags, prog_ids, &prog_cnt);
544 	if (CHECK(err, "bpf_prog_query", "failed\n")) {
545 		log_err("failed to query lookup prog");
546 		goto detach;
547 	}
548 
549 	errno = 0;
550 	if (CHECK(attach_flags != 0, "bpf_prog_query",
551 		  "wrong attach_flags on query: %u", attach_flags))
552 		goto detach;
553 	if (CHECK(prog_cnt != 3, "bpf_prog_query",
554 		  "wrong program count on query: %u", prog_cnt))
555 		goto detach;
556 	prog_id = link_info_prog_id(link[0], &info);
557 	CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
558 	      "invalid program #0 id on query: %u != %u\n",
559 	      prog_ids[0], prog_id);
560 	CHECK(info.netns.netns_ino == 0, "netns_ino",
561 	      "unexpected netns_ino: %u\n", info.netns.netns_ino);
562 	prog_id = link_info_prog_id(link[1], &info);
563 	CHECK(prog_ids[1] != prog_id, "bpf_prog_query",
564 	      "invalid program #1 id on query: %u != %u\n",
565 	      prog_ids[1], prog_id);
566 	CHECK(info.netns.netns_ino == 0, "netns_ino",
567 	      "unexpected netns_ino: %u\n", info.netns.netns_ino);
568 	prog_id = link_info_prog_id(link[2], &info);
569 	CHECK(prog_ids[2] != prog_id, "bpf_prog_query",
570 	      "invalid program #2 id on query: %u != %u\n",
571 	      prog_ids[2], prog_id);
572 	CHECK(info.netns.netns_ino == 0, "netns_ino",
573 	      "unexpected netns_ino: %u\n", info.netns.netns_ino);
574 
575 	err = bpf_link__detach(link[0]);
576 	if (CHECK(err, "link_detach", "failed %d\n", err))
577 		goto detach;
578 
579 	/* prog id is still there, but netns_ino is zeroed out */
580 	prog_id = link_info_prog_id(link[0], &info);
581 	CHECK(prog_ids[0] != prog_id, "bpf_prog_query",
582 	      "invalid program #0 id on query: %u != %u\n",
583 	      prog_ids[0], prog_id);
584 	CHECK(info.netns.netns_ino != 0, "netns_ino",
585 	      "unexpected netns_ino: %u\n", info.netns.netns_ino);
586 
587 detach:
588 	if (link[2])
589 		bpf_link__destroy(link[2]);
590 	if (link[1])
591 		bpf_link__destroy(link[1]);
592 	if (link[0])
593 		bpf_link__destroy(link[0]);
594 close:
595 	close(net_fd);
596 }
597 
598 static void run_lookup_prog(const struct test *t)
599 {
600 	int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 };
601 	int client_fd, reuse_conn_fd = -1;
602 	struct bpf_link *lookup_link;
603 	int i, err;
604 
605 	lookup_link = attach_lookup_prog(t->lookup_prog);
606 	if (!lookup_link)
607 		return;
608 
609 	for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
610 		server_fds[i] = make_server(t->sotype, t->listen_at.ip,
611 					    t->listen_at.port,
612 					    t->reuseport_prog);
613 		if (server_fds[i] < 0)
614 			goto close;
615 
616 		err = update_lookup_map(t->sock_map, i, server_fds[i]);
617 		if (err)
618 			goto close;
619 
620 		/* want just one server for non-reuseport test */
621 		if (!t->reuseport_prog)
622 			break;
623 	}
624 
625 	/* Regular UDP socket lookup with reuseport behaves
626 	 * differently when reuseport group contains connected
627 	 * sockets. Check that adding a connected UDP socket to the
628 	 * reuseport group does not affect how reuseport works with
629 	 * BPF socket lookup.
630 	 */
631 	if (t->reuseport_has_conns) {
632 		struct sockaddr_storage addr = {};
633 		socklen_t len = sizeof(addr);
634 
635 		/* Add an extra socket to reuseport group */
636 		reuse_conn_fd = make_server(t->sotype, t->listen_at.ip,
637 					    t->listen_at.port,
638 					    t->reuseport_prog);
639 		if (reuse_conn_fd < 0)
640 			goto close;
641 
642 		/* Connect the extra socket to itself */
643 		err = getsockname(reuse_conn_fd, (void *)&addr, &len);
644 		if (CHECK(err, "getsockname", "errno %d\n", errno))
645 			goto close;
646 		err = connect(reuse_conn_fd, (void *)&addr, len);
647 		if (CHECK(err, "connect", "errno %d\n", errno))
648 			goto close;
649 	}
650 
651 	client_fd = make_client(t->sotype, t->connect_to.ip, t->connect_to.port);
652 	if (client_fd < 0)
653 		goto close;
654 
655 	if (t->sotype == SOCK_STREAM)
656 		tcp_echo_test(client_fd, server_fds[t->accept_on]);
657 	else
658 		udp_echo_test(client_fd, server_fds[t->accept_on]);
659 
660 	close(client_fd);
661 close:
662 	if (reuse_conn_fd != -1)
663 		close(reuse_conn_fd);
664 	for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
665 		if (server_fds[i] != -1)
666 			close(server_fds[i]);
667 	}
668 	bpf_link__destroy(lookup_link);
669 }
670 
671 static void test_redirect_lookup(struct test_sk_lookup *skel)
672 {
673 	const struct test tests[] = {
674 		{
675 			.desc		= "TCP IPv4 redir port",
676 			.lookup_prog	= skel->progs.redir_port,
677 			.sock_map	= skel->maps.redir_map,
678 			.sotype		= SOCK_STREAM,
679 			.connect_to	= { EXT_IP4, EXT_PORT },
680 			.listen_at	= { EXT_IP4, INT_PORT },
681 		},
682 		{
683 			.desc		= "TCP IPv4 redir addr",
684 			.lookup_prog	= skel->progs.redir_ip4,
685 			.sock_map	= skel->maps.redir_map,
686 			.sotype		= SOCK_STREAM,
687 			.connect_to	= { EXT_IP4, EXT_PORT },
688 			.listen_at	= { INT_IP4, EXT_PORT },
689 		},
690 		{
691 			.desc		= "TCP IPv4 redir with reuseport",
692 			.lookup_prog	= skel->progs.select_sock_a,
693 			.reuseport_prog	= skel->progs.select_sock_b,
694 			.sock_map	= skel->maps.redir_map,
695 			.sotype		= SOCK_STREAM,
696 			.connect_to	= { EXT_IP4, EXT_PORT },
697 			.listen_at	= { INT_IP4, INT_PORT },
698 			.accept_on	= SERVER_B,
699 		},
700 		{
701 			.desc		= "TCP IPv4 redir skip reuseport",
702 			.lookup_prog	= skel->progs.select_sock_a_no_reuseport,
703 			.reuseport_prog	= skel->progs.select_sock_b,
704 			.sock_map	= skel->maps.redir_map,
705 			.sotype		= SOCK_STREAM,
706 			.connect_to	= { EXT_IP4, EXT_PORT },
707 			.listen_at	= { INT_IP4, INT_PORT },
708 			.accept_on	= SERVER_A,
709 		},
710 		{
711 			.desc		= "TCP IPv6 redir port",
712 			.lookup_prog	= skel->progs.redir_port,
713 			.sock_map	= skel->maps.redir_map,
714 			.sotype		= SOCK_STREAM,
715 			.connect_to	= { EXT_IP6, EXT_PORT },
716 			.listen_at	= { EXT_IP6, INT_PORT },
717 		},
718 		{
719 			.desc		= "TCP IPv6 redir addr",
720 			.lookup_prog	= skel->progs.redir_ip6,
721 			.sock_map	= skel->maps.redir_map,
722 			.sotype		= SOCK_STREAM,
723 			.connect_to	= { EXT_IP6, EXT_PORT },
724 			.listen_at	= { INT_IP6, EXT_PORT },
725 		},
726 		{
727 			.desc		= "TCP IPv4->IPv6 redir port",
728 			.lookup_prog	= skel->progs.redir_port,
729 			.sock_map	= skel->maps.redir_map,
730 			.sotype		= SOCK_STREAM,
731 			.connect_to	= { EXT_IP4, EXT_PORT },
732 			.listen_at	= { INT_IP4_V6, INT_PORT },
733 		},
734 		{
735 			.desc		= "TCP IPv6 redir with reuseport",
736 			.lookup_prog	= skel->progs.select_sock_a,
737 			.reuseport_prog	= skel->progs.select_sock_b,
738 			.sock_map	= skel->maps.redir_map,
739 			.sotype		= SOCK_STREAM,
740 			.connect_to	= { EXT_IP6, EXT_PORT },
741 			.listen_at	= { INT_IP6, INT_PORT },
742 			.accept_on	= SERVER_B,
743 		},
744 		{
745 			.desc		= "TCP IPv6 redir skip reuseport",
746 			.lookup_prog	= skel->progs.select_sock_a_no_reuseport,
747 			.reuseport_prog	= skel->progs.select_sock_b,
748 			.sock_map	= skel->maps.redir_map,
749 			.sotype		= SOCK_STREAM,
750 			.connect_to	= { EXT_IP6, EXT_PORT },
751 			.listen_at	= { INT_IP6, INT_PORT },
752 			.accept_on	= SERVER_A,
753 		},
754 		{
755 			.desc		= "UDP IPv4 redir port",
756 			.lookup_prog	= skel->progs.redir_port,
757 			.sock_map	= skel->maps.redir_map,
758 			.sotype		= SOCK_DGRAM,
759 			.connect_to	= { EXT_IP4, EXT_PORT },
760 			.listen_at	= { EXT_IP4, INT_PORT },
761 		},
762 		{
763 			.desc		= "UDP IPv4 redir addr",
764 			.lookup_prog	= skel->progs.redir_ip4,
765 			.sock_map	= skel->maps.redir_map,
766 			.sotype		= SOCK_DGRAM,
767 			.connect_to	= { EXT_IP4, EXT_PORT },
768 			.listen_at	= { INT_IP4, EXT_PORT },
769 		},
770 		{
771 			.desc		= "UDP IPv4 redir with reuseport",
772 			.lookup_prog	= skel->progs.select_sock_a,
773 			.reuseport_prog	= skel->progs.select_sock_b,
774 			.sock_map	= skel->maps.redir_map,
775 			.sotype		= SOCK_DGRAM,
776 			.connect_to	= { EXT_IP4, EXT_PORT },
777 			.listen_at	= { INT_IP4, INT_PORT },
778 			.accept_on	= SERVER_B,
779 		},
780 		{
781 			.desc		= "UDP IPv4 redir and reuseport with conns",
782 			.lookup_prog	= skel->progs.select_sock_a,
783 			.reuseport_prog	= skel->progs.select_sock_b,
784 			.sock_map	= skel->maps.redir_map,
785 			.sotype		= SOCK_DGRAM,
786 			.connect_to	= { EXT_IP4, EXT_PORT },
787 			.listen_at	= { INT_IP4, INT_PORT },
788 			.accept_on	= SERVER_B,
789 			.reuseport_has_conns = true,
790 		},
791 		{
792 			.desc		= "UDP IPv4 redir skip reuseport",
793 			.lookup_prog	= skel->progs.select_sock_a_no_reuseport,
794 			.reuseport_prog	= skel->progs.select_sock_b,
795 			.sock_map	= skel->maps.redir_map,
796 			.sotype		= SOCK_DGRAM,
797 			.connect_to	= { EXT_IP4, EXT_PORT },
798 			.listen_at	= { INT_IP4, INT_PORT },
799 			.accept_on	= SERVER_A,
800 		},
801 		{
802 			.desc		= "UDP IPv6 redir port",
803 			.lookup_prog	= skel->progs.redir_port,
804 			.sock_map	= skel->maps.redir_map,
805 			.sotype		= SOCK_DGRAM,
806 			.connect_to	= { EXT_IP6, EXT_PORT },
807 			.listen_at	= { EXT_IP6, INT_PORT },
808 		},
809 		{
810 			.desc		= "UDP IPv6 redir addr",
811 			.lookup_prog	= skel->progs.redir_ip6,
812 			.sock_map	= skel->maps.redir_map,
813 			.sotype		= SOCK_DGRAM,
814 			.connect_to	= { EXT_IP6, EXT_PORT },
815 			.listen_at	= { INT_IP6, EXT_PORT },
816 		},
817 		{
818 			.desc		= "UDP IPv4->IPv6 redir port",
819 			.lookup_prog	= skel->progs.redir_port,
820 			.sock_map	= skel->maps.redir_map,
821 			.sotype		= SOCK_DGRAM,
822 			.listen_at	= { INT_IP4_V6, INT_PORT },
823 			.connect_to	= { EXT_IP4, EXT_PORT },
824 		},
825 		{
826 			.desc		= "UDP IPv6 redir and reuseport",
827 			.lookup_prog	= skel->progs.select_sock_a,
828 			.reuseport_prog	= skel->progs.select_sock_b,
829 			.sock_map	= skel->maps.redir_map,
830 			.sotype		= SOCK_DGRAM,
831 			.connect_to	= { EXT_IP6, EXT_PORT },
832 			.listen_at	= { INT_IP6, INT_PORT },
833 			.accept_on	= SERVER_B,
834 		},
835 		{
836 			.desc		= "UDP IPv6 redir and reuseport with conns",
837 			.lookup_prog	= skel->progs.select_sock_a,
838 			.reuseport_prog	= skel->progs.select_sock_b,
839 			.sock_map	= skel->maps.redir_map,
840 			.sotype		= SOCK_DGRAM,
841 			.connect_to	= { EXT_IP6, EXT_PORT },
842 			.listen_at	= { INT_IP6, INT_PORT },
843 			.accept_on	= SERVER_B,
844 			.reuseport_has_conns = true,
845 		},
846 		{
847 			.desc		= "UDP IPv6 redir skip reuseport",
848 			.lookup_prog	= skel->progs.select_sock_a_no_reuseport,
849 			.reuseport_prog	= skel->progs.select_sock_b,
850 			.sock_map	= skel->maps.redir_map,
851 			.sotype		= SOCK_DGRAM,
852 			.connect_to	= { EXT_IP6, EXT_PORT },
853 			.listen_at	= { INT_IP6, INT_PORT },
854 			.accept_on	= SERVER_A,
855 		},
856 	};
857 	const struct test *t;
858 
859 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
860 		if (test__start_subtest(t->desc))
861 			run_lookup_prog(t);
862 	}
863 }
864 
865 static void drop_on_lookup(const struct test *t)
866 {
867 	struct sockaddr_storage dst = {};
868 	int client_fd, server_fd, err;
869 	struct bpf_link *lookup_link;
870 	ssize_t n;
871 
872 	lookup_link = attach_lookup_prog(t->lookup_prog);
873 	if (!lookup_link)
874 		return;
875 
876 	server_fd = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
877 				t->reuseport_prog);
878 	if (server_fd < 0)
879 		goto detach;
880 
881 	client_fd = make_socket(t->sotype, t->connect_to.ip,
882 				t->connect_to.port, &dst);
883 	if (client_fd < 0)
884 		goto close_srv;
885 
886 	err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
887 	if (t->sotype == SOCK_DGRAM) {
888 		err = send_byte(client_fd);
889 		if (err)
890 			goto close_all;
891 
892 		/* Read out asynchronous error */
893 		n = recv(client_fd, NULL, 0, 0);
894 		err = n == -1;
895 	}
896 	if (CHECK(!err || errno != ECONNREFUSED, "connect",
897 		  "unexpected success or error\n"))
898 		log_err("expected ECONNREFUSED on connect");
899 
900 close_all:
901 	close(client_fd);
902 close_srv:
903 	close(server_fd);
904 detach:
905 	bpf_link__destroy(lookup_link);
906 }
907 
908 static void test_drop_on_lookup(struct test_sk_lookup *skel)
909 {
910 	const struct test tests[] = {
911 		{
912 			.desc		= "TCP IPv4 drop on lookup",
913 			.lookup_prog	= skel->progs.lookup_drop,
914 			.sotype		= SOCK_STREAM,
915 			.connect_to	= { EXT_IP4, EXT_PORT },
916 			.listen_at	= { EXT_IP4, EXT_PORT },
917 		},
918 		{
919 			.desc		= "TCP IPv6 drop on lookup",
920 			.lookup_prog	= skel->progs.lookup_drop,
921 			.sotype		= SOCK_STREAM,
922 			.connect_to	= { EXT_IP6, EXT_PORT },
923 			.listen_at	= { EXT_IP6, EXT_PORT },
924 		},
925 		{
926 			.desc		= "UDP IPv4 drop on lookup",
927 			.lookup_prog	= skel->progs.lookup_drop,
928 			.sotype		= SOCK_DGRAM,
929 			.connect_to	= { EXT_IP4, EXT_PORT },
930 			.listen_at	= { EXT_IP4, EXT_PORT },
931 		},
932 		{
933 			.desc		= "UDP IPv6 drop on lookup",
934 			.lookup_prog	= skel->progs.lookup_drop,
935 			.sotype		= SOCK_DGRAM,
936 			.connect_to	= { EXT_IP6, EXT_PORT },
937 			.listen_at	= { EXT_IP6, INT_PORT },
938 		},
939 		/* The program will drop on success, meaning that the ifindex
940 		 * was 1.
941 		 */
942 		{
943 			.desc		= "TCP IPv4 drop on valid ifindex",
944 			.lookup_prog	= skel->progs.check_ifindex,
945 			.sotype		= SOCK_STREAM,
946 			.connect_to	= { EXT_IP4, EXT_PORT },
947 			.listen_at	= { EXT_IP4, EXT_PORT },
948 		},
949 		{
950 			.desc		= "TCP IPv6 drop on valid ifindex",
951 			.lookup_prog	= skel->progs.check_ifindex,
952 			.sotype		= SOCK_STREAM,
953 			.connect_to	= { EXT_IP6, EXT_PORT },
954 			.listen_at	= { EXT_IP6, EXT_PORT },
955 		},
956 		{
957 			.desc		= "UDP IPv4 drop on valid ifindex",
958 			.lookup_prog	= skel->progs.check_ifindex,
959 			.sotype		= SOCK_DGRAM,
960 			.connect_to	= { EXT_IP4, EXT_PORT },
961 			.listen_at	= { EXT_IP4, EXT_PORT },
962 		},
963 		{
964 			.desc		= "UDP IPv6 drop on valid ifindex",
965 			.lookup_prog	= skel->progs.check_ifindex,
966 			.sotype		= SOCK_DGRAM,
967 			.connect_to	= { EXT_IP6, EXT_PORT },
968 			.listen_at	= { EXT_IP6, EXT_PORT },
969 		},
970 	};
971 	const struct test *t;
972 
973 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
974 		if (test__start_subtest(t->desc))
975 			drop_on_lookup(t);
976 	}
977 }
978 
979 static void drop_on_reuseport(const struct test *t)
980 {
981 	struct sockaddr_storage dst = { 0 };
982 	int client, server1, server2, err;
983 	struct bpf_link *lookup_link;
984 	ssize_t n;
985 
986 	lookup_link = attach_lookup_prog(t->lookup_prog);
987 	if (!lookup_link)
988 		return;
989 
990 	server1 = make_server(t->sotype, t->listen_at.ip, t->listen_at.port,
991 			      t->reuseport_prog);
992 	if (server1 < 0)
993 		goto detach;
994 
995 	err = update_lookup_map(t->sock_map, SERVER_A, server1);
996 	if (err)
997 		goto detach;
998 
999 	/* second server on destination address we should never reach */
1000 	server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
1001 			      NULL /* reuseport prog */);
1002 	if (server2 < 0)
1003 		goto close_srv1;
1004 
1005 	client = make_socket(t->sotype, t->connect_to.ip,
1006 			     t->connect_to.port, &dst);
1007 	if (client < 0)
1008 		goto close_srv2;
1009 
1010 	err = connect(client, (void *)&dst, inetaddr_len(&dst));
1011 	if (t->sotype == SOCK_DGRAM) {
1012 		err = send_byte(client);
1013 		if (err)
1014 			goto close_all;
1015 
1016 		/* Read out asynchronous error */
1017 		n = recv(client, NULL, 0, 0);
1018 		err = n == -1;
1019 	}
1020 	if (CHECK(!err || errno != ECONNREFUSED, "connect",
1021 		  "unexpected success or error\n"))
1022 		log_err("expected ECONNREFUSED on connect");
1023 
1024 close_all:
1025 	close(client);
1026 close_srv2:
1027 	close(server2);
1028 close_srv1:
1029 	close(server1);
1030 detach:
1031 	bpf_link__destroy(lookup_link);
1032 }
1033 
1034 static void test_drop_on_reuseport(struct test_sk_lookup *skel)
1035 {
1036 	const struct test tests[] = {
1037 		{
1038 			.desc		= "TCP IPv4 drop on reuseport",
1039 			.lookup_prog	= skel->progs.select_sock_a,
1040 			.reuseport_prog	= skel->progs.reuseport_drop,
1041 			.sock_map	= skel->maps.redir_map,
1042 			.sotype		= SOCK_STREAM,
1043 			.connect_to	= { EXT_IP4, EXT_PORT },
1044 			.listen_at	= { INT_IP4, INT_PORT },
1045 		},
1046 		{
1047 			.desc		= "TCP IPv6 drop on reuseport",
1048 			.lookup_prog	= skel->progs.select_sock_a,
1049 			.reuseport_prog	= skel->progs.reuseport_drop,
1050 			.sock_map	= skel->maps.redir_map,
1051 			.sotype		= SOCK_STREAM,
1052 			.connect_to	= { EXT_IP6, EXT_PORT },
1053 			.listen_at	= { INT_IP6, INT_PORT },
1054 		},
1055 		{
1056 			.desc		= "UDP IPv4 drop on reuseport",
1057 			.lookup_prog	= skel->progs.select_sock_a,
1058 			.reuseport_prog	= skel->progs.reuseport_drop,
1059 			.sock_map	= skel->maps.redir_map,
1060 			.sotype		= SOCK_DGRAM,
1061 			.connect_to	= { EXT_IP4, EXT_PORT },
1062 			.listen_at	= { INT_IP4, INT_PORT },
1063 		},
1064 		{
1065 			.desc		= "TCP IPv6 drop on reuseport",
1066 			.lookup_prog	= skel->progs.select_sock_a,
1067 			.reuseport_prog	= skel->progs.reuseport_drop,
1068 			.sock_map	= skel->maps.redir_map,
1069 			.sotype		= SOCK_STREAM,
1070 			.connect_to	= { EXT_IP6, EXT_PORT },
1071 			.listen_at	= { INT_IP6, INT_PORT },
1072 		},
1073 	};
1074 	const struct test *t;
1075 
1076 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1077 		if (test__start_subtest(t->desc))
1078 			drop_on_reuseport(t);
1079 	}
1080 }
1081 
1082 static void run_sk_assign(struct test_sk_lookup *skel,
1083 			  struct bpf_program *lookup_prog,
1084 			  const char *remote_ip, const char *local_ip)
1085 {
1086 	int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 };
1087 	struct bpf_sk_lookup ctx;
1088 	__u64 server_cookie;
1089 	int i, err;
1090 
1091 	DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
1092 		.ctx_in = &ctx,
1093 		.ctx_size_in = sizeof(ctx),
1094 		.ctx_out = &ctx,
1095 		.ctx_size_out = sizeof(ctx),
1096 	);
1097 
1098 	if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT))
1099 		return;
1100 
1101 	ctx.protocol = IPPROTO_TCP;
1102 
1103 	for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1104 		server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL);
1105 		if (server_fds[i] < 0)
1106 			goto close_servers;
1107 
1108 		err = update_lookup_map(skel->maps.redir_map, i,
1109 					server_fds[i]);
1110 		if (err)
1111 			goto close_servers;
1112 	}
1113 
1114 	server_cookie = socket_cookie(server_fds[SERVER_B]);
1115 	if (!server_cookie)
1116 		return;
1117 
1118 	err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts);
1119 	if (CHECK(err, "test_run", "failed with error %d\n", errno))
1120 		goto close_servers;
1121 
1122 	if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n"))
1123 		goto close_servers;
1124 
1125 	CHECK(ctx.cookie != server_cookie, "ctx.cookie",
1126 	      "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie);
1127 
1128 close_servers:
1129 	for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
1130 		if (server_fds[i] != -1)
1131 			close(server_fds[i]);
1132 	}
1133 }
1134 
1135 static void run_sk_assign_v4(struct test_sk_lookup *skel,
1136 			     struct bpf_program *lookup_prog)
1137 {
1138 	run_sk_assign(skel, lookup_prog, INT_IP4, EXT_IP4);
1139 }
1140 
1141 static void run_sk_assign_v6(struct test_sk_lookup *skel,
1142 			     struct bpf_program *lookup_prog)
1143 {
1144 	run_sk_assign(skel, lookup_prog, INT_IP6, EXT_IP6);
1145 }
1146 
1147 static void run_sk_assign_connected(struct test_sk_lookup *skel,
1148 				    int sotype)
1149 {
1150 	int err, client_fd, connected_fd, server_fd;
1151 	struct bpf_link *lookup_link;
1152 
1153 	server_fd = make_server(sotype, EXT_IP4, EXT_PORT, NULL);
1154 	if (server_fd < 0)
1155 		return;
1156 
1157 	connected_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1158 	if (connected_fd < 0)
1159 		goto out_close_server;
1160 
1161 	/* Put a connected socket in redirect map */
1162 	err = update_lookup_map(skel->maps.redir_map, SERVER_A, connected_fd);
1163 	if (err)
1164 		goto out_close_connected;
1165 
1166 	lookup_link = attach_lookup_prog(skel->progs.sk_assign_esocknosupport);
1167 	if (!lookup_link)
1168 		goto out_close_connected;
1169 
1170 	/* Try to redirect TCP SYN / UDP packet to a connected socket */
1171 	client_fd = make_client(sotype, EXT_IP4, EXT_PORT);
1172 	if (client_fd < 0)
1173 		goto out_unlink_prog;
1174 	if (sotype == SOCK_DGRAM) {
1175 		send_byte(client_fd);
1176 		recv_byte(server_fd);
1177 	}
1178 
1179 	close(client_fd);
1180 out_unlink_prog:
1181 	bpf_link__destroy(lookup_link);
1182 out_close_connected:
1183 	close(connected_fd);
1184 out_close_server:
1185 	close(server_fd);
1186 }
1187 
1188 static void test_sk_assign_helper(struct test_sk_lookup *skel)
1189 {
1190 	if (test__start_subtest("sk_assign returns EEXIST"))
1191 		run_sk_assign_v4(skel, skel->progs.sk_assign_eexist);
1192 	if (test__start_subtest("sk_assign honors F_REPLACE"))
1193 		run_sk_assign_v4(skel, skel->progs.sk_assign_replace_flag);
1194 	if (test__start_subtest("sk_assign accepts NULL socket"))
1195 		run_sk_assign_v4(skel, skel->progs.sk_assign_null);
1196 	if (test__start_subtest("access ctx->sk"))
1197 		run_sk_assign_v4(skel, skel->progs.access_ctx_sk);
1198 	if (test__start_subtest("narrow access to ctx v4"))
1199 		run_sk_assign_v4(skel, skel->progs.ctx_narrow_access);
1200 	if (test__start_subtest("narrow access to ctx v6"))
1201 		run_sk_assign_v6(skel, skel->progs.ctx_narrow_access);
1202 	if (test__start_subtest("sk_assign rejects TCP established"))
1203 		run_sk_assign_connected(skel, SOCK_STREAM);
1204 	if (test__start_subtest("sk_assign rejects UDP connected"))
1205 		run_sk_assign_connected(skel, SOCK_DGRAM);
1206 }
1207 
1208 struct test_multi_prog {
1209 	const char *desc;
1210 	struct bpf_program *prog1;
1211 	struct bpf_program *prog2;
1212 	struct bpf_map *redir_map;
1213 	struct bpf_map *run_map;
1214 	int expect_errno;
1215 	struct inet_addr listen_at;
1216 };
1217 
1218 static void run_multi_prog_lookup(const struct test_multi_prog *t)
1219 {
1220 	struct sockaddr_storage dst = {};
1221 	int map_fd, server_fd, client_fd;
1222 	struct bpf_link *link1, *link2;
1223 	int prog_idx, done, err;
1224 
1225 	map_fd = bpf_map__fd(t->run_map);
1226 
1227 	done = 0;
1228 	prog_idx = PROG1;
1229 	err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1230 	if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1231 		return;
1232 	prog_idx = PROG2;
1233 	err = bpf_map_update_elem(map_fd, &prog_idx, &done, BPF_ANY);
1234 	if (CHECK(err, "bpf_map_update_elem", "failed\n"))
1235 		return;
1236 
1237 	link1 = attach_lookup_prog(t->prog1);
1238 	if (!link1)
1239 		return;
1240 	link2 = attach_lookup_prog(t->prog2);
1241 	if (!link2)
1242 		goto out_unlink1;
1243 
1244 	server_fd = make_server(SOCK_STREAM, t->listen_at.ip,
1245 				t->listen_at.port, NULL);
1246 	if (server_fd < 0)
1247 		goto out_unlink2;
1248 
1249 	err = update_lookup_map(t->redir_map, SERVER_A, server_fd);
1250 	if (err)
1251 		goto out_close_server;
1252 
1253 	client_fd = make_socket(SOCK_STREAM, EXT_IP4, EXT_PORT, &dst);
1254 	if (client_fd < 0)
1255 		goto out_close_server;
1256 
1257 	err = connect(client_fd, (void *)&dst, inetaddr_len(&dst));
1258 	if (CHECK(err && !t->expect_errno, "connect",
1259 		  "unexpected error %d\n", errno))
1260 		goto out_close_client;
1261 	if (CHECK(err && t->expect_errno && errno != t->expect_errno,
1262 		  "connect", "unexpected error %d\n", errno))
1263 		goto out_close_client;
1264 
1265 	done = 0;
1266 	prog_idx = PROG1;
1267 	err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1268 	CHECK(err, "bpf_map_lookup_elem", "failed\n");
1269 	CHECK(!done, "bpf_map_lookup_elem", "PROG1 !done\n");
1270 
1271 	done = 0;
1272 	prog_idx = PROG2;
1273 	err = bpf_map_lookup_elem(map_fd, &prog_idx, &done);
1274 	CHECK(err, "bpf_map_lookup_elem", "failed\n");
1275 	CHECK(!done, "bpf_map_lookup_elem", "PROG2 !done\n");
1276 
1277 out_close_client:
1278 	close(client_fd);
1279 out_close_server:
1280 	close(server_fd);
1281 out_unlink2:
1282 	bpf_link__destroy(link2);
1283 out_unlink1:
1284 	bpf_link__destroy(link1);
1285 }
1286 
1287 static void test_multi_prog_lookup(struct test_sk_lookup *skel)
1288 {
1289 	struct test_multi_prog tests[] = {
1290 		{
1291 			.desc		= "multi prog - pass, pass",
1292 			.prog1		= skel->progs.multi_prog_pass1,
1293 			.prog2		= skel->progs.multi_prog_pass2,
1294 			.listen_at	= { EXT_IP4, EXT_PORT },
1295 		},
1296 		{
1297 			.desc		= "multi prog - drop, drop",
1298 			.prog1		= skel->progs.multi_prog_drop1,
1299 			.prog2		= skel->progs.multi_prog_drop2,
1300 			.listen_at	= { EXT_IP4, EXT_PORT },
1301 			.expect_errno	= ECONNREFUSED,
1302 		},
1303 		{
1304 			.desc		= "multi prog - pass, drop",
1305 			.prog1		= skel->progs.multi_prog_pass1,
1306 			.prog2		= skel->progs.multi_prog_drop2,
1307 			.listen_at	= { EXT_IP4, EXT_PORT },
1308 			.expect_errno	= ECONNREFUSED,
1309 		},
1310 		{
1311 			.desc		= "multi prog - drop, pass",
1312 			.prog1		= skel->progs.multi_prog_drop1,
1313 			.prog2		= skel->progs.multi_prog_pass2,
1314 			.listen_at	= { EXT_IP4, EXT_PORT },
1315 			.expect_errno	= ECONNREFUSED,
1316 		},
1317 		{
1318 			.desc		= "multi prog - pass, redir",
1319 			.prog1		= skel->progs.multi_prog_pass1,
1320 			.prog2		= skel->progs.multi_prog_redir2,
1321 			.listen_at	= { INT_IP4, INT_PORT },
1322 		},
1323 		{
1324 			.desc		= "multi prog - redir, pass",
1325 			.prog1		= skel->progs.multi_prog_redir1,
1326 			.prog2		= skel->progs.multi_prog_pass2,
1327 			.listen_at	= { INT_IP4, INT_PORT },
1328 		},
1329 		{
1330 			.desc		= "multi prog - drop, redir",
1331 			.prog1		= skel->progs.multi_prog_drop1,
1332 			.prog2		= skel->progs.multi_prog_redir2,
1333 			.listen_at	= { INT_IP4, INT_PORT },
1334 		},
1335 		{
1336 			.desc		= "multi prog - redir, drop",
1337 			.prog1		= skel->progs.multi_prog_redir1,
1338 			.prog2		= skel->progs.multi_prog_drop2,
1339 			.listen_at	= { INT_IP4, INT_PORT },
1340 		},
1341 		{
1342 			.desc		= "multi prog - redir, redir",
1343 			.prog1		= skel->progs.multi_prog_redir1,
1344 			.prog2		= skel->progs.multi_prog_redir2,
1345 			.listen_at	= { INT_IP4, INT_PORT },
1346 		},
1347 	};
1348 	struct test_multi_prog *t;
1349 
1350 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
1351 		t->redir_map = skel->maps.redir_map;
1352 		t->run_map = skel->maps.run_map;
1353 		if (test__start_subtest(t->desc))
1354 			run_multi_prog_lookup(t);
1355 	}
1356 }
1357 
1358 static void run_tests(struct test_sk_lookup *skel)
1359 {
1360 	if (test__start_subtest("query lookup prog"))
1361 		query_lookup_prog(skel);
1362 	test_redirect_lookup(skel);
1363 	test_drop_on_lookup(skel);
1364 	test_drop_on_reuseport(skel);
1365 	test_sk_assign_helper(skel);
1366 	test_multi_prog_lookup(skel);
1367 }
1368 
1369 static int switch_netns(void)
1370 {
1371 	static const char * const setup_script[] = {
1372 		"ip -6 addr add dev lo " EXT_IP6 "/128",
1373 		"ip -6 addr add dev lo " INT_IP6 "/128",
1374 		"ip link set dev lo up",
1375 		NULL,
1376 	};
1377 	const char * const *cmd;
1378 	int err;
1379 
1380 	err = unshare(CLONE_NEWNET);
1381 	if (CHECK(err, "unshare", "failed\n")) {
1382 		log_err("unshare(CLONE_NEWNET)");
1383 		return -1;
1384 	}
1385 
1386 	for (cmd = setup_script; *cmd; cmd++) {
1387 		err = system(*cmd);
1388 		if (CHECK(err, "system", "failed\n")) {
1389 			log_err("system(%s)", *cmd);
1390 			return -1;
1391 		}
1392 	}
1393 
1394 	return 0;
1395 }
1396 
1397 void test_sk_lookup(void)
1398 {
1399 	struct test_sk_lookup *skel;
1400 	int err;
1401 
1402 	err = switch_netns();
1403 	if (err)
1404 		return;
1405 
1406 	skel = test_sk_lookup__open_and_load();
1407 	if (CHECK(!skel, "skel open_and_load", "failed\n"))
1408 		return;
1409 
1410 	run_tests(skel);
1411 
1412 	test_sk_lookup__destroy(skel);
1413 }
1414