Commit f6ad6acc authored by Willem de Bruijn's avatar Willem de Bruijn Committed by Daniel Borkmann
Browse files

selftests/bpf: expand test_tc_tunnel with SIT encap 



So far, all BPF tc tunnel testcases encapsulate in the same network
protocol. Add an encap testcase that requires updating skb->protocol.

The 6in4 tunnel encapsulates an IPv6 packet inside an IPv4 tunnel.
Verify that bpf_skb_net_grow correctly updates skb->protocol to
select the right protocol handler in __netif_receive_skb_core.

The BPF program should also manually update the link layer header to
encode the right network protocol.

Changes v1->v2
  - improve documentation of non-obvious logic

Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Tested-by: default avatarAlan Maguire <alan.maguire@oracle.com>
Acked-by: default avatarYonghong Song <yhs@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 1b00e0df

tools/testing/selftests/bpf/config

+1 −0
Original line number Diff line number Diff line
@@ -33,3 +33,4 @@ CONFIG_MPLS=y 
CONFIG_NET_MPLS_GSO=m

CONFIG_MPLS_ROUTING=m

CONFIG_MPLS_IPTUNNEL=m

CONFIG_IPV6_SIT=m

tools/testing/selftests/bpf/progs/test_tc_tunnel.c

+60 −4
Original line number Diff line number Diff line
@@ -77,17 +77,52 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto, 
	struct v4hdr h_outer;

	struct tcphdr tcph;

	int olen, l2_len;

	int tcp_off;

	__u64 flags;



	/* Most tests encapsulate a packet into a tunnel with the same

	 * network protocol, and derive the outer header fields from

	 * the inner header.

	 *

	 * The 6in4 case tests different inner and outer protocols. As

	 * the inner is ipv6, but the outer expects an ipv4 header as

	 * input, manually build a struct iphdr based on the ipv6hdr.

	 */

	if (encap_proto == IPPROTO_IPV6) {

		const __u32 saddr = (192 << 24) | (168 << 16) | (1 << 8) | 1;

		const __u32 daddr = (192 << 24) | (168 << 16) | (1 << 8) | 2;

		struct ipv6hdr iph6_inner;



		/* Read the IPv6 header */

		if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph6_inner,

				       sizeof(iph6_inner)) < 0)

			return TC_ACT_OK;



		/* Derive the IPv4 header fields from the IPv6 header */

		memset(&iph_inner, 0, sizeof(iph_inner));

		iph_inner.version = 4;

		iph_inner.ihl = 5;

		iph_inner.tot_len = bpf_htons(sizeof(iph6_inner) +

				    bpf_ntohs(iph6_inner.payload_len));

		iph_inner.ttl = iph6_inner.hop_limit - 1;

		iph_inner.protocol = iph6_inner.nexthdr;

		iph_inner.saddr = __bpf_constant_htonl(saddr);

		iph_inner.daddr = __bpf_constant_htonl(daddr);



		tcp_off = sizeof(iph6_inner);

	} else {

		if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,

				       sizeof(iph_inner)) < 0)

			return TC_ACT_OK;



		tcp_off = sizeof(iph_inner);

	}



	/* filter only packets we want */

	if (iph_inner.ihl != 5 || iph_inner.protocol != IPPROTO_TCP)

		return TC_ACT_OK;



	if (bpf_skb_load_bytes(skb, ETH_HLEN + sizeof(iph_inner),

	if (bpf_skb_load_bytes(skb, ETH_HLEN + tcp_off,

			       &tcph, sizeof(tcph)) < 0)

		return TC_ACT_OK;
@@ -129,6 +164,7 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto, 
						  l2_len);

		break;

	case IPPROTO_IPIP:

	case IPPROTO_IPV6:

		break;

	default:

		return TC_ACT_OK;
@@ -164,6 +200,17 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto, 
				BPF_F_INVALIDATE_HASH) < 0)

		return TC_ACT_SHOT;



	/* if changing outer proto type, update eth->h_proto */

	if (encap_proto == IPPROTO_IPV6) {

		struct ethhdr eth;



		if (bpf_skb_load_bytes(skb, 0, &eth, sizeof(eth)) < 0)

			return TC_ACT_SHOT;

		eth.h_proto = bpf_htons(ETH_P_IP);

		if (bpf_skb_store_bytes(skb, 0, &eth, sizeof(eth), 0) < 0)

			return TC_ACT_SHOT;

	}



	return TC_ACT_OK;

}
@@ -325,6 +372,15 @@ int __encap_udp_eth(struct __sk_buff *skb) 
		return TC_ACT_OK;

}



SEC("encap_sit_none")

int __encap_sit_none(struct __sk_buff *skb)

{

	if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))

		return encap_ipv4(skb, IPPROTO_IPV6, ETH_P_IP);

	else

		return TC_ACT_OK;

}



SEC("encap_ip6tnl_none")

int __encap_ip6tnl_none(struct __sk_buff *skb)

{

tools/testing/selftests/bpf/test_tc_tunnel.sh

+19 −1
Original line number Diff line number Diff line
@@ -97,6 +97,9 @@ if [[ "$#" -eq "0" ]]; then 
	echo "ip6ip6"

	$0 ipv6 ip6tnl none 100



	echo "sit"

	$0 ipv6 sit none 100



	for mac in none mpls eth ; do

		echo "ip gre $mac"

		$0 ipv4 gre $mac 100
@@ -211,11 +214,20 @@ else 
	targs=""

fi



# tunnel address family differs from inner for SIT

if [[ "${tuntype}" == "sit" ]]; then

	link_addr1="${ns1_v4}"

	link_addr2="${ns2_v4}"

else

	link_addr1="${addr1}"

	link_addr2="${addr2}"

fi



# serverside, insert decap module

# server is still running

# client can connect again

ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \

	${tmode} remote "${addr1}" local "${addr2}" $targs

	${tmode} remote "${link_addr1}" local "${link_addr2}" $targs



expect_tun_fail=0
@@ -260,6 +272,12 @@ else 
	server_listen

fi



# bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3.

if [[ "${tuntype}" == "sit" ]]; then

	echo OK

	exit 0

fi



# serverside, use BPF for decap

ip netns exec "${ns2}" ip link del dev testtun0

ip netns exec "${ns2}" tc qdisc add dev veth2 clsact

CRA Git | Maintained and supported by SUSTech CRA and CCSE