Skip to content

Commit 7fed7a5

Browse files
tohojoNobody
tohojo
authored and
Nobody
committed
selftests/bpf: Add selftest for XDP_REDIRECT in BPF_PROG_RUN
This adds a selftest for the XDP_REDIRECT facility in BPF_PROG_RUN, that redirects packets into a veth and counts them using an XDP program on the other side of the veth pair and a TC program on the local side of the veth. Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
1 parent 8d6b676 commit 7fed7a5

File tree

2 files changed

+277
-0
lines changed

2 files changed

+277
-0
lines changed

‎tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
#include <test_progs.h>
3+
#include <network_helpers.h>
4+
#include <net/if.h>
5+
#include <linux/if_ether.h>
6+
#include <linux/if_packet.h>
7+
#include <linux/ipv6.h>
8+
#include <linux/in6.h>
9+
#include <linux/udp.h>
10+
#include <bpf/bpf_endian.h>
11+
#include "test_xdp_do_redirect.skel.h"
12+
13+
#define SYS(fmt, ...) \
14+
({ \
15+
char cmd[1024]; \
16+
snprintf(cmd, sizeof(cmd), fmt, ##__VA_ARGS__); \
17+
if (!ASSERT_OK(system(cmd), cmd)) \
18+
goto out; \
19+
})
20+
21+
struct udp_packet {
22+
struct ethhdr eth;
23+
struct ipv6hdr iph;
24+
struct udphdr udp;
25+
__u8 payload[64 - sizeof(struct udphdr)
26+
- sizeof(struct ethhdr) - sizeof(struct ipv6hdr)];
27+
} __packed;
28+
29+
static struct udp_packet pkt_udp = {
30+
.eth.h_proto = __bpf_constant_htons(ETH_P_IPV6),
31+
.eth.h_dest = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55},
32+
.eth.h_source = {0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb},
33+
.iph.version = 6,
34+
.iph.nexthdr = IPPROTO_UDP,
35+
.iph.payload_len = bpf_htons(sizeof(struct udp_packet)
36+
- offsetof(struct udp_packet, udp)),
37+
.iph.hop_limit = 2,
38+
.iph.saddr.s6_addr16 = {bpf_htons(0xfc00), 0, 0, 0, 0, 0, 0, bpf_htons(1)},
39+
.iph.daddr.s6_addr16 = {bpf_htons(0xfc00), 0, 0, 0, 0, 0, 0, bpf_htons(2)},
40+
.udp.source = bpf_htons(1),
41+
.udp.dest = bpf_htons(1),
42+
.udp.len = bpf_htons(sizeof(struct udp_packet)
43+
- offsetof(struct udp_packet, udp)),
44+
.payload = {0x42}, /* receiver XDP program matches on this */
45+
};
46+
47+
static int attach_tc_prog(struct bpf_tc_hook *hook, int fd)
48+
{
49+
DECLARE_LIBBPF_OPTS(bpf_tc_opts, opts, .handle = 1, .priority = 1, .prog_fd = fd);
50+
int ret;
51+
52+
ret = bpf_tc_hook_create(hook);
53+
if (!ASSERT_OK(ret, "create tc hook"))
54+
return ret;
55+
56+
ret = bpf_tc_attach(hook, &opts);
57+
if (!ASSERT_OK(ret, "bpf_tc_attach")) {
58+
bpf_tc_hook_destroy(hook);
59+
return ret;
60+
}
61+
62+
return 0;
63+
}
64+
65+
#define NUM_PKTS 10000
66+
void test_xdp_do_redirect(void)
67+
{
68+
int err, xdp_prog_fd, tc_prog_fd, ifindex_src, ifindex_dst;
69+
char data[sizeof(pkt_udp) + sizeof(__u32)];
70+
struct test_xdp_do_redirect *skel = NULL;
71+
struct nstoken *nstoken = NULL;
72+
struct bpf_link *link;
73+
74+
struct xdp_md ctx_in = { .data = sizeof(__u32),
75+
.data_end = sizeof(data) };
76+
DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
77+
.data_in = &data,
78+
.data_size_in = sizeof(data),
79+
.ctx_in = &ctx_in,
80+
.ctx_size_in = sizeof(ctx_in),
81+
.flags = BPF_F_TEST_XDP_LIVE_FRAMES,
82+
.repeat = NUM_PKTS,
83+
.batch_size = 64,
84+
);
85+
DECLARE_LIBBPF_OPTS(bpf_tc_hook, tc_hook,
86+
.attach_point = BPF_TC_INGRESS);
87+
88+
memcpy(&data[sizeof(__u32)], &pkt_udp, sizeof(pkt_udp));
89+
*((__u32 *)data) = 0x42; /* metadata test value */
90+
91+
skel = test_xdp_do_redirect__open();
92+
if (!ASSERT_OK_PTR(skel, "skel"))
93+
return;
94+
95+
/* The XDP program we run with bpf_prog_run() will cycle through all
96+
* three xmit (PASS/TX/REDIRECT) return codes starting from above, and
97+
* ending up with PASS, so we should end up with two packets on the dst
98+
* iface and NUM_PKTS-2 in the TC hook. We match the packets on the UDP
99+
* payload.
100+
*/
101+
SYS("ip netns add testns");
102+
nstoken = open_netns("testns");
103+
if (!ASSERT_OK_PTR(nstoken, "setns"))
104+
goto out;
105+
106+
SYS("ip link add veth_src type veth peer name veth_dst");
107+
SYS("ip link set dev veth_src address 00:11:22:33:44:55");
108+
SYS("ip link set dev veth_dst address 66:77:88:99:aa:bb");
109+
SYS("ip link set dev veth_src up");
110+
SYS("ip link set dev veth_dst up");
111+
SYS("ip addr add dev veth_src fc00::1/64");
112+
SYS("ip addr add dev veth_dst fc00::2/64");
113+
SYS("ip neigh add fc00::2 dev veth_src lladdr 66:77:88:99:aa:bb");
114+
115+
/* We enable forwarding in the test namespace because that will cause
116+
* the packets that go through the kernel stack (with XDP_PASS) to be
117+
* forwarded back out the same interface (because of the packet dst
118+
* combined with the interface addresses). When this happens, the
119+
* regular forwarding path will end up going through the same
120+
* veth_xdp_xmit() call as the XDP_REDIRECT code, which can cause a
121+
* deadlock if it happens on the same CPU. There's a local_bh_disable()
122+
* in the test_run code to prevent this, but an earlier version of the
123+
* code didn't have this, so we keep the test behaviour to make sure the
124+
* bug doesn't resurface.
125+
*/
126+
SYS("sysctl -qw net.ipv6.conf.all.forwarding=1");
127+
128+
ifindex_src = if_nametoindex("veth_src");
129+
ifindex_dst = if_nametoindex("veth_dst");
130+
if (!ASSERT_NEQ(ifindex_src, 0, "ifindex_src") ||
131+
!ASSERT_NEQ(ifindex_dst, 0, "ifindex_dst"))
132+
goto out;
133+
134+
memcpy(skel->rodata->expect_dst, &pkt_udp.eth.h_dest, ETH_ALEN);
135+
skel->rodata->ifindex_out = ifindex_src; /* redirect back to the same iface */
136+
skel->rodata->ifindex_in = ifindex_src;
137+
ctx_in.ingress_ifindex = ifindex_src;
138+
tc_hook.ifindex = ifindex_src;
139+
140+
if (!ASSERT_OK(test_xdp_do_redirect__load(skel), "load"))
141+
goto out;
142+
143+
link = bpf_program__attach_xdp(skel->progs.xdp_count_pkts, ifindex_dst);
144+
if (!ASSERT_OK_PTR(link, "prog_attach"))
145+
goto out;
146+
skel->links.xdp_count_pkts = link;
147+
148+
tc_prog_fd = bpf_program__fd(skel->progs.tc_count_pkts);
149+
if (attach_tc_prog(&tc_hook, tc_prog_fd))
150+
goto out;
151+
152+
xdp_prog_fd = bpf_program__fd(skel->progs.xdp_redirect);
153+
err = bpf_prog_test_run_opts(xdp_prog_fd, &opts);
154+
if (!ASSERT_OK(err, "prog_run"))
155+
goto out_tc;
156+
157+
/* wait for the packets to be flushed */
158+
kern_sync_rcu();
159+
160+
/* There will be one packet sent through XDP_REDIRECT and one through
161+
* XDP_TX; these will show up on the XDP counting program, while the
162+
* rest will be counted at the TC ingress hook (and the counting program
163+
* resets the packet payload so they don't get counted twice even though
164+
* they are re-xmited out the veth device
165+
*/
166+
ASSERT_EQ(skel->bss->pkts_seen_xdp, 2, "pkt_count_xdp");
167+
ASSERT_EQ(skel->bss->pkts_seen_zero, 2, "pkt_count_zero");
168+
ASSERT_EQ(skel->bss->pkts_seen_tc, NUM_PKTS - 2, "pkt_count_tc");
169+
170+
out_tc:
171+
bpf_tc_hook_destroy(&tc_hook);
172+
out:
173+
if (nstoken)
174+
close_netns(nstoken);
175+
system("ip netns del testns");
176+
test_xdp_do_redirect__destroy(skel);
177+
}

‎tools/testing/selftests/bpf/progs/test_xdp_do_redirect.c‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
#include <vmlinux.h>
3+
#include <bpf/bpf_helpers.h>
4+
5+
#define ETH_ALEN 6
6+
#define HDR_SZ (sizeof(struct ethhdr) + sizeof(struct ipv6hdr) + sizeof(struct udphdr))
7+
const volatile int ifindex_out;
8+
const volatile int ifindex_in;
9+
const volatile __u8 expect_dst[ETH_ALEN];
10+
volatile int pkts_seen_xdp = 0;
11+
volatile int pkts_seen_zero = 0;
12+
volatile int pkts_seen_tc = 0;
13+
volatile int retcode = XDP_REDIRECT;
14+
15+
SEC("xdp")
16+
int xdp_redirect(struct xdp_md *xdp)
17+
{
18+
__u32 *metadata = (void *)(long)xdp->data_meta;
19+
void *data_end = (void *)(long)xdp->data_end;
20+
void *data = (void *)(long)xdp->data;
21+
22+
__u8 *payload = data + HDR_SZ;
23+
int ret = retcode;
24+
25+
if (payload + 1 > data_end)
26+
return XDP_ABORTED;
27+
28+
if (xdp->ingress_ifindex != ifindex_in)
29+
return XDP_ABORTED;
30+
31+
if (metadata + 1 > data)
32+
return XDP_ABORTED;
33+
34+
if (*metadata != 0x42)
35+
return XDP_ABORTED;
36+
37+
if (*payload == 0) {
38+
*payload = 0x42;
39+
pkts_seen_zero++;
40+
}
41+
42+
if (bpf_xdp_adjust_meta(xdp, 4))
43+
return XDP_ABORTED;
44+
45+
if (retcode > XDP_PASS)
46+
retcode--;
47+
48+
if (ret == XDP_REDIRECT)
49+
return bpf_redirect(ifindex_out, 0);
50+
51+
return ret;
52+
}
53+
54+
static bool check_pkt(void *data, void *data_end)
55+
{
56+
struct ipv6hdr *iph = data + sizeof(struct ethhdr);
57+
__u8 *payload = data + HDR_SZ;
58+
59+
if (payload + 1 > data_end)
60+
return false;
61+
62+
if (iph->nexthdr != IPPROTO_UDP || *payload != 0x42)
63+
return false;
64+
65+
/* reset the payload so the same packet doesn't get counted twice when
66+
* it cycles back through the kernel path and out the dst veth
67+
*/
68+
*payload = 0;
69+
return true;
70+
}
71+
72+
SEC("xdp")
73+
int xdp_count_pkts(struct xdp_md *xdp)
74+
{
75+
void *data = (void *)(long)xdp->data;
76+
void *data_end = (void *)(long)xdp->data_end;
77+
78+
if (check_pkt(data, data_end))
79+
pkts_seen_xdp++;
80+
81+
/* Return XDP_DROP to make sure the data page is recycled, like when it
82+
* exits a physical NIC. Recycled pages will be counted in the
83+
* pkts_seen_zero counter above.
84+
*/
85+
return XDP_DROP;
86+
}
87+
88+
SEC("tc")
89+
int tc_count_pkts(struct __sk_buff *skb)
90+
{
91+
void *data = (void *)(long)skb->data;
92+
void *data_end = (void *)(long)skb->data_end;
93+
94+
if (check_pkt(data, data_end))
95+
pkts_seen_tc++;
96+
97+
return 0;
98+
}
99+
100+
char _license[] SEC("license") = "GPL";

0 commit comments

Comments
 (0)