OSDN Git Service

selftests/bpf: expand test_tc_tunnel with SIT encap
authorWillem de Bruijn <willemb@google.com>
Tue, 23 Apr 2019 18:43:49 +0000 (14:43 -0400)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 23 Apr 2019 23:32:26 +0000 (01:32 +0200)
So far, all BPF tc tunnel testcases encapsulate in the same network
protocol. Add an encap testcase that requires updating skb->protocol.

The 6in4 tunnel encapsulates an IPv6 packet inside an IPv4 tunnel.
Verify that bpf_skb_net_grow correctly updates skb->protocol to
select the right protocol handler in __netif_receive_skb_core.

The BPF program should also manually update the link layer header to
encode the right network protocol.

Changes v1->v2
  - improve documentation of non-obvious logic

Signed-off-by: Willem de Bruijn <willemb@google.com>
Tested-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
tools/testing/selftests/bpf/config
tools/testing/selftests/bpf/progs/test_tc_tunnel.c
tools/testing/selftests/bpf/test_tc_tunnel.sh

index 8c97647..f7a0744 100644 (file)
@@ -33,3 +33,4 @@ CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
+CONFIG_IPV6_SIT=m
index ab56a6a..74370e7 100644 (file)
@@ -77,17 +77,52 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
        struct v4hdr h_outer;
        struct tcphdr tcph;
        int olen, l2_len;
+       int tcp_off;
        __u64 flags;
 
-       if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
-                              sizeof(iph_inner)) < 0)
-               return TC_ACT_OK;
+       /* Most tests encapsulate a packet into a tunnel with the same
+        * network protocol, and derive the outer header fields from
+        * the inner header.
+        *
+        * The 6in4 case tests different inner and outer protocols. As
+        * the inner is ipv6, but the outer expects an ipv4 header as
+        * input, manually build a struct iphdr based on the ipv6hdr.
+        */
+       if (encap_proto == IPPROTO_IPV6) {
+               const __u32 saddr = (192 << 24) | (168 << 16) | (1 << 8) | 1;
+               const __u32 daddr = (192 << 24) | (168 << 16) | (1 << 8) | 2;
+               struct ipv6hdr iph6_inner;
+
+               /* Read the IPv6 header */
+               if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph6_inner,
+                                      sizeof(iph6_inner)) < 0)
+                       return TC_ACT_OK;
+
+               /* Derive the IPv4 header fields from the IPv6 header */
+               memset(&iph_inner, 0, sizeof(iph_inner));
+               iph_inner.version = 4;
+               iph_inner.ihl = 5;
+               iph_inner.tot_len = bpf_htons(sizeof(iph6_inner) +
+                                   bpf_ntohs(iph6_inner.payload_len));
+               iph_inner.ttl = iph6_inner.hop_limit - 1;
+               iph_inner.protocol = iph6_inner.nexthdr;
+               iph_inner.saddr = __bpf_constant_htonl(saddr);
+               iph_inner.daddr = __bpf_constant_htonl(daddr);
+
+               tcp_off = sizeof(iph6_inner);
+       } else {
+               if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
+                                      sizeof(iph_inner)) < 0)
+                       return TC_ACT_OK;
+
+               tcp_off = sizeof(iph_inner);
+       }
 
        /* filter only packets we want */
        if (iph_inner.ihl != 5 || iph_inner.protocol != IPPROTO_TCP)
                return TC_ACT_OK;
 
-       if (bpf_skb_load_bytes(skb, ETH_HLEN + sizeof(iph_inner),
+       if (bpf_skb_load_bytes(skb, ETH_HLEN + tcp_off,
                               &tcph, sizeof(tcph)) < 0)
                return TC_ACT_OK;
 
@@ -129,6 +164,7 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
                                                  l2_len);
                break;
        case IPPROTO_IPIP:
+       case IPPROTO_IPV6:
                break;
        default:
                return TC_ACT_OK;
@@ -164,6 +200,17 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
                                BPF_F_INVALIDATE_HASH) < 0)
                return TC_ACT_SHOT;
 
+       /* if changing outer proto type, update eth->h_proto */
+       if (encap_proto == IPPROTO_IPV6) {
+               struct ethhdr eth;
+
+               if (bpf_skb_load_bytes(skb, 0, &eth, sizeof(eth)) < 0)
+                       return TC_ACT_SHOT;
+               eth.h_proto = bpf_htons(ETH_P_IP);
+               if (bpf_skb_store_bytes(skb, 0, &eth, sizeof(eth), 0) < 0)
+                       return TC_ACT_SHOT;
+       }
+
        return TC_ACT_OK;
 }
 
@@ -325,6 +372,15 @@ int __encap_udp_eth(struct __sk_buff *skb)
                return TC_ACT_OK;
 }
 
+SEC("encap_sit_none")
+int __encap_sit_none(struct __sk_buff *skb)
+{
+       if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+               return encap_ipv4(skb, IPPROTO_IPV6, ETH_P_IP);
+       else
+               return TC_ACT_OK;
+}
+
 SEC("encap_ip6tnl_none")
 int __encap_ip6tnl_none(struct __sk_buff *skb)
 {
index d4d8d5d..ff0d31d 100755 (executable)
@@ -97,6 +97,9 @@ if [[ "$#" -eq "0" ]]; then
        echo "ip6ip6"
        $0 ipv6 ip6tnl none 100
 
+       echo "sit"
+       $0 ipv6 sit none 100
+
        for mac in none mpls eth ; do
                echo "ip gre $mac"
                $0 ipv4 gre $mac 100
@@ -211,11 +214,20 @@ else
        targs=""
 fi
 
+# tunnel address family differs from inner for SIT
+if [[ "${tuntype}" == "sit" ]]; then
+       link_addr1="${ns1_v4}"
+       link_addr2="${ns2_v4}"
+else
+       link_addr1="${addr1}"
+       link_addr2="${addr2}"
+fi
+
 # serverside, insert decap module
 # server is still running
 # client can connect again
 ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
-       ${tmode} remote "${addr1}" local "${addr2}" $targs
+       ${tmode} remote "${link_addr1}" local "${link_addr2}" $targs
 
 expect_tun_fail=0
 
@@ -260,6 +272,12 @@ else
        server_listen
 fi
 
+# bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3.
+if [[ "${tuntype}" == "sit" ]]; then
+       echo OK
+       exit 0
+fi
+
 # serverside, use BPF for decap
 ip netns exec "${ns2}" ip link del dev testtun0
 ip netns exec "${ns2}" tc qdisc add dev veth2 clsact