From patchwork Tue Jul 25 04:13:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yan Zhai X-Patchwork-Id: 125329 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9010:0:b0:3e4:2afc:c1 with SMTP id l16csp2253100vqg; Mon, 24 Jul 2023 22:40:58 -0700 (PDT) X-Google-Smtp-Source: APBJJlGZ4WcfmC413k3k2T76hKbSq+5aVbWzkQdvKplfebGpbZj3bTfr/yRbBf+ce+6amIT0G38l X-Received: by 2002:a17:90b:3907:b0:263:5c6a:1956 with SMTP id ob7-20020a17090b390700b002635c6a1956mr8246042pjb.25.1690263658449; Mon, 24 Jul 2023 22:40:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690263658; cv=none; d=google.com; s=arc-20160816; b=Lm2SLuzfl3HdmLy9IhYRseE5b92J3UH4Teof5H/6nkwyX7OS7Iw/vAK4VoSMZptY0b oCb657IUpU9yfCzIem9F9qizXBh6ajhgY7tnceecQdQhO9x092zGAFft429YHpRF7ZpG LBfYNq1kd2gUotWQyBFHzvOZfEIkQGoIgNmBF1+EtK3MFwZ9KaRnd9kIW6NqsffzpY/m Yl2lKmrtuEw2BvnAKCT1XIstVStlRsKhRnGVdNd2o7HIedERZ1/jTmdylSfcp2ZWeTgl g+WNC9EHA9lwzzS/wt6J16JNaf6GCoulsTvUjpF89eY/+LMJuc3O2udMf1tdMkhjIRuA V/jw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=dExAqqjX2sAceHiZkTjWc7ytvlJ4THivNCeY471el6A=; fh=HzHPdbt9AGkswnXXoAPFoSS2pL3/HPGqiE7o+b7+qyY=; b=bw6B9igm+UUGCDvfcByP94La0d6czfYtztV+5wqS4Z45x0fjnlnFzywk6VaDroDxNw 31sDKUIhFc8oWD7nA6sE7S12KZSdLAXwYLROeCn6vCWLxTs5u5Ze3PU8+xDtjmaplhUH +YidSRojVviBmpEFTsPEznC0bXC0y9xvIP5zabiNinRZpLDfYQjF3qrp/sTi3EHWuxzb fkGJPeZYiOZ84qbRziddNkrvm6tlk0vdGvvQWuWCLSojSlmUAFnJQBhy/2JH5AzmmWrv XgLYxTkVFRylDnCgCaFMwlLS811g/nuvxUtFXW0lUf8aidDAgpwuElP8vxdgA5iM3Tho uJsg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@cloudflare.com header.s=google header.b=a7JHbgZ4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=cloudflare.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k191-20020a6384c8000000b0055c87771a7asi10803926pgd.149.2023.07.24.22.40.45; Mon, 24 Jul 2023 22:40:58 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@cloudflare.com header.s=google header.b=a7JHbgZ4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=cloudflare.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230438AbjGYENR (ORCPT + 99 others); Tue, 25 Jul 2023 00:13:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230207AbjGYENQ (ORCPT ); Tue, 25 Jul 2023 00:13:16 -0400 Received: from mail-qv1-xf30.google.com (mail-qv1-xf30.google.com [IPv6:2607:f8b0:4864:20::f30]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3E9BE66 for ; Mon, 24 Jul 2023 21:13:14 -0700 (PDT) Received: by mail-qv1-xf30.google.com with SMTP id 6a1803df08f44-63cf40716ffso19475016d6.2 for ; Mon, 24 Jul 2023 21:13:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; t=1690258394; x=1690863194; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=dExAqqjX2sAceHiZkTjWc7ytvlJ4THivNCeY471el6A=; b=a7JHbgZ44jJD9d5BBzwGMElBDFTGmE6VPiSm37KRstnL6yyrYlU04Jyxj8DJlTLI0k 1GmawVpW5PeKff+kV0qUwqnxLNbVXOXAJSJ/D7TPQnkWacQb7Z1ntVAdH+WW/s/Wxgkv Gz1dvEr/HcdiSu3pizPxhZC03nzUjhgq5jOHg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1690258394; x=1690863194; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=dExAqqjX2sAceHiZkTjWc7ytvlJ4THivNCeY471el6A=; b=i6Rmm9OJ+z76IWCkzWb/0Bvu2r0sA+P8fCBdDcLDrGrfOZ7URBncmyZgK3KqDDzIEV lq9SyJf9bAwXqOvm1c9IEfs8J8N83oCHRZ4aRX9kUELBLBmmSEkONY/o3LDjm2PF9Y9a x3E8gA6kNIGvWh2UfY1T7ZLLxxmnmLAQVZmA42abu6EHIqjB5MyyiFL8oBqAx32OSlam 3vq5+lMLIEvAUM6OILy8mnFgE4ssR/Lpn0QTW+SIOI0Pj36gOR40s60OTdm6u6S8W/9m FeG3O1ojAp5ZYW6E5h87IwNrIBbmGzwugt/AxLs1DFl+THOMz0RAwy4RMgeZCv7i+udT Z2FQ== X-Gm-Message-State: ABy/qLYwVhtGGh7jXS+UfOjGY8Ua6zoDg2UqS87KMA8a+jc7r2Hp2YVA E5747ubl82GSb8jxy7WUpH39kQ== X-Received: by 2002:a05:6214:184d:b0:63d:a05:256a with SMTP id d13-20020a056214184d00b0063d0a05256amr1596951qvy.8.1690258393862; Mon, 24 Jul 2023 21:13:13 -0700 (PDT) Received: from debian.debian ([140.141.197.139]) by smtp.gmail.com with ESMTPSA id j8-20020a0cf308000000b0063cdbe73a05sm833186qvl.97.2023.07.24.21.13.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Jul 2023 21:13:13 -0700 (PDT) Date: Mon, 24 Jul 2023 21:13:10 -0700 From: Yan Zhai To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Mykola Lysenko , Shuah Khan , Yan Zhai , linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-team@cloudflare.com, Jordan Griege Subject: [PATCH v3 bpf 1/2] bpf: fix skb_do_redirect return values Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1772369905963881324 X-GMAIL-MSGID: 1772369905963881324 skb_do_redirect returns various of values: error code (negative), 0 (success), and some positive status code, e.g. NET_XMIT_CN, NET_RX_DROP. Such code are not handled at lwt xmit hook in function ip_finish_output2 and ip6_finish_output, which can cause unexpected problems. This change converts the positive status code to proper error code. Suggested-by: Stanislav Fomichev Reported-by: Jordan Griege Signed-off-by: Yan Zhai --- v3: converts also RX side return value in addition to TX values v2: code style change suggested by Stanislav Fomichev --- net/core/filter.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 06ba0e56e369..3e232ce11ca0 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2095,7 +2095,12 @@ static const struct bpf_func_proto bpf_csum_level_proto = { static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb) { - return dev_forward_skb_nomtu(dev, skb); + int ret = dev_forward_skb_nomtu(dev, skb); + + if (unlikely(ret > 0)) + return -ENETDOWN; + + return 0; } static inline int __bpf_rx_skb_no_mac(struct net_device *dev, @@ -2106,6 +2111,8 @@ static inline int __bpf_rx_skb_no_mac(struct net_device *dev, if (likely(!ret)) { skb->dev = dev; ret = netif_rx(skb); + } else if (ret > 0) { + return -ENETDOWN; } return ret; @@ -2129,6 +2136,9 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb) ret = dev_queue_xmit(skb); dev_xmit_recursion_dec(); + if (unlikely(ret > 0)) + ret = net_xmit_errno(ret); + return ret; } From patchwork Tue Jul 25 04:14:12 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yan Zhai X-Patchwork-Id: 125324 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9010:0:b0:3e4:2afc:c1 with SMTP id l16csp2248117vqg; Mon, 24 Jul 2023 22:26:29 -0700 (PDT) X-Google-Smtp-Source: APBJJlEKh0hRGR/y/0GrCBvnzrKQhm+aQzZNFhL6NOMtjExsiMAg886hWFoO9uyo9Q9n4sDSIIJm X-Received: by 2002:a05:6a20:7620:b0:133:215e:7230 with SMTP id m32-20020a056a20762000b00133215e7230mr7835576pze.55.1690262789468; Mon, 24 Jul 2023 22:26:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690262789; cv=none; d=google.com; s=arc-20160816; b=c1qtBxaxvXhCAzXSfv/UPpPdr2o0MdmknZw0QDJZ+uxmUGvWhSlRTiH/k4yu2JP1Ly JFBiB9ps8lPyZnpHYqCECoh1EvDd26nScMLUxIeKJvifOinMjgARScYSr+AcGYIOhldZ r8VL9oxIJEpCw+KOvGqe7qNltnP8t5M6pCwyDmdnhihhGKijvuccSyrXTwoxPTMz28JR Saq8Q+XJZ3rMEjgANgj5rMkyBN+wJuG9Mbc/r38lhDKfUbmD4qorQf0y5FKHFzaq4j40 X19VDw6oKDR+i/lJHuOBMNa0DSa9KaOEQWnJSDYLtvYfOd/UJQR0Fj3YpFHj40W4jaJ8 UVng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=H5Unmq6oikn4ADho9QqUfzK7Esqr6kPDSC3udHTdE3Y=; fh=HzHPdbt9AGkswnXXoAPFoSS2pL3/HPGqiE7o+b7+qyY=; b=uljJc9JWf+vUieF3bR6ML2IdFVu1toOd7IN5/9c63GKqvmSI53LzYdiFaO/ja1+gP9 Byvfiu2aHdFpUwbKbMVS1OhBXgKtWYjhhw4jM/815niD03aN8exHOpyXxkFK4tMjm4Cw 3Io+q6gqrrm0CF8fA7xJIHtjJAz+uB8yMkHvalYo/nBLAlw+WlP5ishwLw+LArLE9mg3 gzviLoDXsAOtSuRRceHQDkwee+NVqoxkpudIjLNuPTLcZVtNAstKX84jWB/2yz+o43iU s/6TkNXImmK6C12/SKhMrNrPivUZ6AOvHWPY8dK6JKH2gqRvwhuxc9VSQ7+N5wct2szi 8WaQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@cloudflare.com header.s=google header.b=NYN0m+yA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=cloudflare.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d8-20020a170903230800b001b885fbe17dsi11708971plh.532.2023.07.24.22.26.15; Mon, 24 Jul 2023 22:26:29 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@cloudflare.com header.s=google header.b=NYN0m+yA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=cloudflare.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229662AbjGYEOV (ORCPT + 99 others); Tue, 25 Jul 2023 00:14:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50298 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229553AbjGYEOS (ORCPT ); Tue, 25 Jul 2023 00:14:18 -0400 Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A7009E64 for ; Mon, 24 Jul 2023 21:14:16 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id af79cd13be357-768197bad1cso544856085a.1 for ; Mon, 24 Jul 2023 21:14:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; t=1690258456; x=1690863256; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=H5Unmq6oikn4ADho9QqUfzK7Esqr6kPDSC3udHTdE3Y=; b=NYN0m+yAt2wJGCDAMDqxtGwqkhER+qdoiasNFvcMRY6AJ9xHz+uNsWy7LHtHbxdhKD 7p0tNZHJLH7liKIqfK+uPjQLy+CuRMhGGDD24qWesU9Khtm29yuDaFiGOagASZ+AyVeq WY2OmMSy+9SEcr2SBwZSgXaoH1b7XHWmDoy7Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1690258456; x=1690863256; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=H5Unmq6oikn4ADho9QqUfzK7Esqr6kPDSC3udHTdE3Y=; b=kHvax7YW+1cDnkp6lnS/UrwJKtynLvMkoWCgaAI7YAsD9usLe8CIwjJ+xv1j2y43bC v8wdOXk2IKuUqYjOSyi3q2kGK6GukCnzcgG7RDGWJB014oKnJfRI9Ke8iDQKD3uTMkVt ellVDj0x2J7VU92vwa9yHMOOxBA/syVEi0DD/DN7KPwynBHwNYcyhS94cvSY1gNQKaqo bJF4wVs7o0b8ZpNODSOf7dmkUPyHnVt3Fk0mlPwPY7Uw0F/u7mk518AHdNvAB0Gm+m54 kYurS6vssMS8Q1E0Zj21SylcLlhAQ/SZ8kvqWV15aTr/sCisku+DJwHFm4F1HJVCZ5ii 7YYA== X-Gm-Message-State: ABy/qLbyWBpDBIgXku2szQjr8GCGDP9xlj45nHaddkgw9RAD//dta+yp lf4h3R1mK9ZO+guz1kxEkQIUZQ== X-Received: by 2002:a05:620a:3906:b0:765:a633:43f2 with SMTP id qr6-20020a05620a390600b00765a63343f2mr2162337qkn.12.1690258455789; Mon, 24 Jul 2023 21:14:15 -0700 (PDT) Received: from debian.debian ([140.141.197.139]) by smtp.gmail.com with ESMTPSA id u12-20020a0cb40c000000b0061a68b5a8c4sm4111455qve.134.2023.07.24.21.14.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Jul 2023 21:14:15 -0700 (PDT) Date: Mon, 24 Jul 2023 21:14:12 -0700 From: Yan Zhai To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Mykola Lysenko , Shuah Khan , Yan Zhai , linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-team@cloudflare.com, Jordan Griege Subject: [PATCH v3 bpf 2/2] selftests/bpf: test lwt redirect error handling Message-ID: <25c13cb89412b120616f4e31a31c3108e45bc6af.1690255889.git.yan@cloudflare.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1772368994553079782 X-GMAIL-MSGID: 1772368994553079782 Tests BPF redirect at the lwt xmit hook to ensure error handling are safe, i.e. won't panic the kernel. Suggested-by: Alexei Starovoitov Signed-off-by: Yan Zhai --- tools/testing/selftests/bpf/Makefile | 1 + .../selftests/bpf/progs/test_lwt_redirect.c | 67 +++++++ .../selftests/bpf/test_lwt_redirect.sh | 165 ++++++++++++++++++ 3 files changed, 233 insertions(+) create mode 100644 tools/testing/selftests/bpf/progs/test_lwt_redirect.c create mode 100755 tools/testing/selftests/bpf/test_lwt_redirect.sh diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 538df8fb8c42..e3a24d053793 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -66,6 +66,7 @@ TEST_PROGS := test_kmod.sh \ test_xdp_vlan_mode_generic.sh \ test_xdp_vlan_mode_native.sh \ test_lwt_ip_encap.sh \ + test_lwt_redirect.sh \ test_tcp_check_syncookie.sh \ test_tc_tunnel.sh \ test_tc_edt.sh \ diff --git a/tools/testing/selftests/bpf/progs/test_lwt_redirect.c b/tools/testing/selftests/bpf/progs/test_lwt_redirect.c new file mode 100644 index 000000000000..622c6b1e7128 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/test_lwt_redirect.c @@ -0,0 +1,67 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include + +#define ETH_LEN 14 + +/* We don't care about whether the packet can be received by network stack. + * Just care if the packet is sent to the correct device at correct direction + * and not panic the kernel. + */ +static __always_inline int prepend_dummy_mac(struct __sk_buff *skb) +{ + char mac[] = {0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0xf, + 0xe, 0xd, 0xc, 0xb, 0xa, 0x08, 0x00}; + + if (bpf_skb_change_head(skb, ETH_LEN, 0)) { + bpf_printk("%s: fail to change head", __func__); + return -1; + } + + if (bpf_skb_store_bytes(skb, 0, mac, sizeof(mac), 0)) { + bpf_printk("%s: fail to update mac", __func__); + return -1; + } + + return 0; +} + +SEC("redir_ingress") +int test_lwt_redirect_in(struct __sk_buff *skb) +{ + if (prepend_dummy_mac(skb)) + return BPF_DROP; + + bpf_printk("Redirect skb to link %d ingress", skb->mark); + return bpf_redirect(skb->mark, BPF_F_INGRESS); +} + +SEC("redir_egress") +int test_lwt_redirect_out(struct __sk_buff *skb) +{ + if (prepend_dummy_mac(skb)) + return BPF_DROP; + + bpf_printk("Redirect skb to link %d egress", skb->mark); + return bpf_redirect(skb->mark, 0); +} + +SEC("redir_egress_nomac") +int test_lwt_redirect_out_nomac(struct __sk_buff *skb) +{ + int ret = bpf_redirect(skb->mark, 0); + + bpf_printk("Redirect skb to link %d egress nomac: %d", skb->mark, ret); + return ret; +} + +SEC("redir_ingress_nomac") +int test_lwt_redirect_in_nomac(struct __sk_buff *skb) +{ + int ret = bpf_redirect(skb->mark, BPF_F_INGRESS); + + bpf_printk("Redirect skb to link %d ingress nomac: %d", skb->mark, ret); + return ret; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/test_lwt_redirect.sh b/tools/testing/selftests/bpf/test_lwt_redirect.sh new file mode 100755 index 000000000000..fe97cbc40ee8 --- /dev/null +++ b/tools/testing/selftests/bpf/test_lwt_redirect.sh @@ -0,0 +1,165 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 +# +# This regression test checks basic lwt redirect functionality, +# making sure the kernel would not crash when redirecting packets +# to a device, regardless its administration state: +# +# 1. redirect to a device egress/ingress should work normally +# 2. redirect to a device egress/ingress should not panic when target is down +# 3. redirect to a device egress/ingress should not panic when target carrier is down +# +# All test setup are simple: redirect ping packet via lwt xmit to cover above +# situations. We do not worry about specific device type, except for the two +# categories of devices that require MAC header and not require MAC header. For +# carrier down situation, we use a vlan device as upper link, and bring down its +# lower device. +# +# Kselftest framework requirement - SKIP code is 4. +ksft_skip=4 +BPF_FILE="test_lwt_redirect.bpf.o" +INGRESS_REDIR_IP=2.2.2.2 +EGRESS_REDIR_IP=3.3.3.3 +INGRESS_REDIR_IP_NOMAC=4.4.4.4 +EGRESS_REDIR_IP_NOMAC=5.5.5.5 +PASS=0 +FAIL=0 + +readonly NS1="ns1-$(mktemp -u XXXXXX)" + +msg="skip all tests:" +if [ $UID != 0 ]; then + echo $msg please run this as root >&2 + exit $ksft_skip +fi + +get_ip_direction() { + case $1 in + $INGRESS_REDIR_IP|$INGRESS_REDIR_IP_NOMAC) + echo ingress + ;; + $EGRESS_REDIR_IP|$EGRESS_REDIR_IP_NOMAC) + echo egress + ;; + *) + echo bug + ;; + esac +} + +test_pass() +{ + local testname=$1 + local direction=`get_ip_direction $2` + shift 2 + echo "Pass: $testname $direction $@" + PASS=$((PASS + 1)) +} + +test_fail() +{ + local testname=$1 + local direction=`get_ip_direction $2` + shift 2 + echo "Fail: $testname $direction $@" + FAIL=$((FAIL + 1)) +} + +setup() { + ip netns add $NS1 + + ip -n $NS1 link set lo up + ip -n $NS1 link add link_err type dummy + ip -n $NS1 link add link_w_mac type dummy + ip -n $NS1 link add link link_w_mac link_upper type vlan id 1 + ip -n $NS1 link add link_wo_mac type gre remote 4.3.2.1 local 1.2.3.4 + ip -n $NS1 link set link_err up + ip -n $NS1 link set link_w_mac up + ip -n $NS1 link set link_upper up + ip -n $NS1 link set link_wo_mac up + + ip -n $NS1 addr add dev lo 1.1.1.1/32 + ip -n $NS1 route add $INGRESS_REDIR_IP encap bpf xmit \ + obj $BPF_FILE sec redir_ingress dev link_err + ip -n $NS1 route add $EGRESS_REDIR_IP encap bpf xmit \ + obj $BPF_FILE sec redir_egress dev link_err + ip -n $NS1 route add $INGRESS_REDIR_IP_NOMAC encap bpf xmit \ + obj $BPF_FILE sec redir_ingress_nomac dev link_err + ip -n $NS1 route add $EGRESS_REDIR_IP_NOMAC encap bpf xmit \ + obj $BPF_FILE sec redir_egress_nomac dev link_err +} + +cleanup_and_summary() { + ip netns del $NS1 + echo PASSED:$PASS FAILED:$FAIL + if [ $FAIL -ne 0 ]; then + exit 1 + else + exit 0 + fi +} + +test_redirect_normal() { + local test_name=${FUNCNAME[0]} + local link_name=$1 + local link_id=`ip netns exec $NS1 cat /sys/class/net/${link_name}/ifindex` + local dest=$2 + + ip netns exec $NS1 timeout 2 tcpdump -i ${link_name} -c 1 -n -p icmp >/dev/null 2>&1 & + local jobid=$! + sleep 1 + + # hack: mark indicates the link to redirect to + ip netns exec $NS1 ping -m $link_id $dest -c 1 -w 1 > /dev/null 2>&1 + wait $jobid + + if [ $? -ne 0 ]; then + test_fail $test_name $dest $link_name + else + test_pass $test_name $dest $link_name + fi +} + +test_redirect_no_panic_on_link_down() { + local test_name=${FUNCNAME[0]} + local link_name=$1 + local link_id=`ip netns exec $NS1 cat /sys/class/net/${link_name}/ifindex` + local dest=$2 + + ip -n $NS1 link set $link_name down + # hack: mark indicates the link to redirect to + ip netns exec $NS1 ping -m $link_id $dest -c 1 -w 1 >/dev/null 2>&1 + + test_pass $test_name $dest to $link_name + ip -n $NS1 link set $link_name up +} + +test_redirect_no_panic_on_link_carrier_down() { + local test_name=${FUNCNAME[0]} + local link_id=`ip netns exec $NS1 cat /sys/class/net/link_upper/ifindex` + local dest=$1 + + ip -n $NS1 link set link_w_mac down + # hack: mark indicates the link to redirect to + ip netns exec $NS1 ping -m $link_id $dest -c 1 -w 1 >/dev/null 2>&1 + + test_pass $test_name $dest to link_upper + ip -n $NS1 link set link_w_mac up +} + +setup + +echo "Testing lwt redirect to devices requiring MAC header" +for dest in $INGRESS_REDIR_IP $EGRESS_REDIR_IP; do + test_redirect_normal link_w_mac $dest + test_redirect_no_panic_on_link_down link_w_mac $dest + test_redirect_no_panic_on_link_carrier_down $dest +done + +echo "Testing lwt redirect to devices not requiring MAC header" +for dest in $INGRESS_REDIR_IP_NOMAC $EGRESS_REDIR_IP_NOMAC; do + test_redirect_normal link_wo_mac $dest + test_redirect_no_panic_on_link_down link_wo_mac $dest +done + +cleanup_and_summary