[PATCH bpf 0/5] bpf: Allow any source IP in bpf_skb_set_tunnel_key

[PATCH bpf 0/5] bpf: Allow any source IP in bpf_skb_set_tunnel_key

[Paul Chaignon]

Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
added support for getting and setting the outer source IP of encapsulated
packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
allows BPF programs to set any IP address as the source, including for
example the IP address of a container running on the same host.

In that last case, however, the encapsulated packets are dropped when
looking up the route because the source IP address isn't assigned to any
interface on the host. To avoid this, we need to set the
FLOWI_FLAG_ANYSRC flag.

Paul Chaignon (5):
  ip_tunnels: Add new flow flags field to ip_tunnel_key
  vxlan: Use ip_tunnel_key flow flags in route lookups
  geneve: Use ip_tunnel_key flow flags in route lookups
  bpf: Set flow flag to allow any source IP in bpf_tunnel_key
  selftests/bpf: Don't assign outer source IP to host

 drivers/net/geneve.c                           |  2 ++
 drivers/net/vxlan/vxlan_core.c                 | 18 ++++++++++++------
 include/net/ip_tunnels.h                       |  1 +
 net/core/filter.c                              |  1 +
 .../selftests/bpf/prog_tests/test_tunnel.c     |  1 -
 5 files changed, 16 insertions(+), 7 deletions(-)

-- 
2.25.1

[PATCH bpf 1/5] ip_tunnels: Add new flow flags field to ip_tunnel_key

[Paul Chaignon]

This commit extends the ip_tunnel_key struct with a new field for the
flow flags, to pass them to the route lookups. This new field will be
populated and used in subsequent commits.

Signed-off-by: Paul Chaignon <paul@isovalent.com>
---
 include/net/ip_tunnels.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index c24fa934221d..20f60d9da741 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -54,6 +54,7 @@ struct ip_tunnel_key {
 	__be32			label;		/* Flow Label for IPv6 */
 	__be16			tp_src;
 	__be16			tp_dst;
+	__u8			flow_flags;
 };
 
 /* Flags for ip_tunnel_info mode. */
-- 
2.25.1

[PATCH bpf 2/5] vxlan: Use ip_tunnel_key flow flags in route lookups

[Paul Chaignon]

Use the new ip_tunnel_key field with the flow flags in the route lookups
for the encapsulated packet. This will be used by the
bpf_skb_set_tunnel_key helper in a subsequent commit.

Signed-off-by: Paul Chaignon <paul@isovalent.com>
---
 drivers/net/vxlan/vxlan_core.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 265d4a0245e7..3c93cf5683be 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2243,7 +2243,7 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan, struct net_device
 				      struct vxlan_sock *sock4,
 				      struct sk_buff *skb, int oif, u8 tos,
 				      __be32 daddr, __be32 *saddr, __be16 dport, __be16 sport,
-				      struct dst_cache *dst_cache,
+				      __u8 flow_flags, struct dst_cache *dst_cache,
 				      const struct ip_tunnel_info *info)
 {
 	bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
@@ -2270,6 +2270,7 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan, struct net_device
 	fl4.saddr = *saddr;
 	fl4.fl4_dport = dport;
 	fl4.fl4_sport = sport;
+	fl4.flowi4_flags = flow_flags;
 
 	rt = ip_route_output_key(vxlan->net, &fl4);
 	if (!IS_ERR(rt)) {
@@ -2298,6 +2299,7 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
 					  const struct in6_addr *daddr,
 					  struct in6_addr *saddr,
 					  __be16 dport, __be16 sport,
+					  __u8 flow_flags,
 					  struct dst_cache *dst_cache,
 					  const struct ip_tunnel_info *info)
 {
@@ -2325,6 +2327,7 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
 	fl6.flowi6_proto = IPPROTO_UDP;
 	fl6.fl6_dport = dport;
 	fl6.fl6_sport = sport;
+	fl6.flowi6_flags = flow_flags;
 
 	ndst = ipv6_stub->ipv6_dst_lookup_flow(vxlan->net, sock6->sock->sk,
 					       &fl6, NULL);
@@ -2459,7 +2462,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 	unsigned int pkt_len = skb->len;
 	__be16 src_port = 0, dst_port;
 	struct dst_entry *ndst = NULL;
-	__u8 tos, ttl;
+	__u8 tos, ttl, flow_flags = 0;
 	int ifindex;
 	int err;
 	u32 flags = vxlan->cfg.flags;
@@ -2525,6 +2528,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 		}
 		dst = &remote_ip;
 		dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port;
+		flow_flags = info->key.flow_flags;
 		vni = tunnel_id_to_key32(info->key.tun_id);
 		ifindex = 0;
 		dst_cache = &info->dst_cache;
@@ -2555,7 +2559,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 		rt = vxlan_get_route(vxlan, dev, sock4, skb, ifindex, tos,
 				     dst->sin.sin_addr.s_addr,
 				     &local_ip.sin.sin_addr.s_addr,
-				     dst_port, src_port,
+				     dst_port, src_port, flow_flags,
 				     dst_cache, info);
 		if (IS_ERR(rt)) {
 			err = PTR_ERR(rt);
@@ -2628,7 +2632,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 		ndst = vxlan6_get_route(vxlan, dev, sock6, skb, ifindex, tos,
 					label, &dst->sin6.sin6_addr,
 					&local_ip.sin6.sin6_addr,
-					dst_port, src_port,
+					dst_port, src_port, flow_flags,
 					dst_cache, info);
 		if (IS_ERR(ndst)) {
 			err = PTR_ERR(ndst);
@@ -3061,7 +3065,8 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 		rt = vxlan_get_route(vxlan, dev, sock4, skb, 0, info->key.tos,
 				     info->key.u.ipv4.dst,
 				     &info->key.u.ipv4.src, dport, sport,
-				     &info->dst_cache, info);
+				     info->key.flow_flags, &info->dst_cache,
+				     info);
 		if (IS_ERR(rt))
 			return PTR_ERR(rt);
 		ip_rt_put(rt);
@@ -3073,7 +3078,8 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 		ndst = vxlan6_get_route(vxlan, dev, sock6, skb, 0, info->key.tos,
 					info->key.label, &info->key.u.ipv6.dst,
 					&info->key.u.ipv6.src, dport, sport,
-					&info->dst_cache, info);
+					info->key.flow_flags, &info->dst_cache,
+					info);
 		if (IS_ERR(ndst))
 			return PTR_ERR(ndst);
 		dst_release(ndst);
-- 
2.25.1

[PATCH bpf 3/5] geneve: Use ip_tunnel_key flow flags in route lookups

[Paul Chaignon]

Use the new ip_tunnel_key field with the flow flags in the route lookups
for the encapsulated packet. This will be used by the
bpf_skb_set_tunnel_key helper in the subsequent commit.

Signed-off-by: Paul Chaignon <paul@isovalent.com>
---
 drivers/net/geneve.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 2495a5719e1c..efad129ca8fd 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -815,6 +815,7 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
 	fl4->saddr = info->key.u.ipv4.src;
 	fl4->fl4_dport = dport;
 	fl4->fl4_sport = sport;
+	fl4->flowi4_flags = info->key.flow_flags;
 
 	tos = info->key.tos;
 	if ((tos == 1) && !geneve->cfg.collect_md) {
@@ -868,6 +869,7 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
 	fl6->saddr = info->key.u.ipv6.src;
 	fl6->fl6_dport = dport;
 	fl6->fl6_sport = sport;
+	fl6->flowi6_flags = info->key.flow_flags;
 
 	prio = info->key.tos;
 	if ((prio == 1) && !geneve->cfg.collect_md) {
-- 
2.25.1

[PATCH bpf 4/5] bpf: Set flow flag to allow any source IP in bpf_tunnel_key

[Paul Chaignon]

Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
added support for getting and setting the outer source IP of encapsulated
packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
allows BPF programs to set any IP address as the source, including for
example the IP address of a container running on the same host.

In that last case, however, the encapsulated packets are dropped when
looking up the route because the source IP address isn't assigned to any
interface on the host. To avoid this, we need to set the
FLOWI_FLAG_ANYSRC flag.

Fixes: 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
Signed-off-by: Paul Chaignon <paul@isovalent.com>
---
 net/core/filter.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 5d16d66727fc..6d9c800cdab9 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4641,6 +4641,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
 	info->key.tun_id = cpu_to_be64(from->tunnel_id);
 	info->key.tos = from->tunnel_tos;
 	info->key.ttl = from->tunnel_ttl;
+	info->key.flow_flags = FLOWI_FLAG_ANYSRC;
 
 	if (flags & BPF_F_TUNINFO_IPV6) {
 		info->mode |= IP_TUNNEL_INFO_IPV6;
-- 
2.25.1

[PATCH bpf 5/5] selftests/bpf: Don't assign outer source IP to host

[Paul Chaignon]

The previous commit fixed a bug in the bpf_skb_set_tunnel_key helper to
avoid dropping packets whose outer source IP address isn't assigned to a
host interface. This commit changes the corresponding selftest to not
assign the outer source IP address to an interface.

With this change and without the bugfix, the ICMP echo packets sent as
part of the test are dropped.

Signed-off-by: Paul Chaignon <paul@isovalent.com>
---
 tools/testing/selftests/bpf/prog_tests/test_tunnel.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
index 3bba4a2a0530..14ccb41a9f59 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
@@ -111,7 +111,6 @@ static int config_device(void)
 	SYS("ip link add veth0 type veth peer name veth1");
 	SYS("ip link set veth0 netns at_ns0");
 	SYS("ip addr add " IP4_ADDR1_VETH1 "/24 dev veth1");
-	SYS("ip addr add " IP4_ADDR2_VETH1 "/24 dev veth1");
 	SYS("ip link set dev veth1 up mtu 1500");
 	SYS("ip netns exec at_ns0 ip addr add " IP4_ADDR_VETH0 "/24 dev veth0");
 	SYS("ip netns exec at_ns0 ip link set dev veth0 up mtu 1500");
-- 
2.25.1

Re: [PATCH bpf 4/5] bpf: Set flow flag to allow any source IP in bpf_tunnel_key

[Yonghong Song]

On 7/15/22 8:02 AM, Paul Chaignon wrote:
> Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> added support for getting and setting the outer source IP of encapsulated
> packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
> allows BPF programs to set any IP address as the source, including for
> example the IP address of a container running on the same host.
> 
> In that last case, however, the encapsulated packets are dropped when
> looking up the route because the source IP address isn't assigned to any
> interface on the host. To avoid this, we need to set the
> FLOWI_FLAG_ANYSRC flag.
> 
> Fixes: 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> Signed-off-by: Paul Chaignon <paul@isovalent.com>
> ---
>   net/core/filter.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 5d16d66727fc..6d9c800cdab9 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -4641,6 +4641,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
>   	info->key.tun_id = cpu_to_be64(from->tunnel_id);
>   	info->key.tos = from->tunnel_tos;
>   	info->key.ttl = from->tunnel_ttl;
> +	info->key.flow_flags = FLOWI_FLAG_ANYSRC;

Can we set FLOWI_FLAG_ANYSRC in all conditions?
In lwt_bpf.c, func bpf_lwt_xmit_reroute(), FLOWI_FLAG_ANYSRC
is set for ipv4 but not for ipv6. I am wondering whether
FLOWI_FLAG_ANYSRC needs to be set for ipv6 packet or not
in bpf_skb_set_tunnel_key().

>   
>   	if (flags & BPF_F_TUNINFO_IPV6) {
>   		info->mode |= IP_TUNNEL_INFO_IPV6;

Re: [PATCH bpf 4/5] bpf: Set flow flag to allow any source IP in bpf_tunnel_key

[Paul Chaignon]

On Fri, Jul 15, 2022 at 11:21:08AM -0700, Yonghong Song wrote:
> On 7/15/22 8:02 AM, Paul Chaignon wrote:
> > Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> > added support for getting and setting the outer source IP of encapsulated
> > packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
> > allows BPF programs to set any IP address as the source, including for
> > example the IP address of a container running on the same host.
> > 
> > In that last case, however, the encapsulated packets are dropped when
> > looking up the route because the source IP address isn't assigned to any
> > interface on the host. To avoid this, we need to set the
> > FLOWI_FLAG_ANYSRC flag.
> > 
> > Fixes: 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> > Signed-off-by: Paul Chaignon <paul@isovalent.com>
> > ---
> >   net/core/filter.c | 1 +
> >   1 file changed, 1 insertion(+)
> > 
> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index 5d16d66727fc..6d9c800cdab9 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -4641,6 +4641,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
> >   	info->key.tun_id = cpu_to_be64(from->tunnel_id);
> >   	info->key.tos = from->tunnel_tos;
> >   	info->key.ttl = from->tunnel_ttl;
> > +	info->key.flow_flags = FLOWI_FLAG_ANYSRC;
> 
> Can we set FLOWI_FLAG_ANYSRC in all conditions?
> In lwt_bpf.c, func bpf_lwt_xmit_reroute(), FLOWI_FLAG_ANYSRC
> is set for ipv4 but not for ipv6. I am wondering whether
> FLOWI_FLAG_ANYSRC needs to be set for ipv6 packet or not
> in bpf_skb_set_tunnel_key().

That's a good point; I didn't know about bpf_lwt_xmit_reroute. I set the
flag for IPv6 as the same check seemed to exist, but didn't test it.
I'll check if it's actually needed.

> 
> >   	if (flags & BPF_F_TUNINFO_IPV6) {
> >   		info->mode |= IP_TUNNEL_INFO_IPV6;

Re: [PATCH bpf 4/5] bpf: Set flow flag to allow any source IP in bpf_tunnel_key

[Paul Chaignon]

On Fri, Jul 15, 2022 at 11:21:08AM -0700, Yonghong Song wrote:
> On 7/15/22 8:02 AM, Paul Chaignon wrote:
> > Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> > added support for getting and setting the outer source IP of encapsulated
> > packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
> > allows BPF programs to set any IP address as the source, including for
> > example the IP address of a container running on the same host.
> > 
> > In that last case, however, the encapsulated packets are dropped when
> > looking up the route because the source IP address isn't assigned to any
> > interface on the host. To avoid this, we need to set the
> > FLOWI_FLAG_ANYSRC flag.
> > 
> > Fixes: 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> > Signed-off-by: Paul Chaignon <paul@isovalent.com>
> > ---
> >   net/core/filter.c | 1 +
> >   1 file changed, 1 insertion(+)
> > 
> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index 5d16d66727fc..6d9c800cdab9 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -4641,6 +4641,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
> >   	info->key.tun_id = cpu_to_be64(from->tunnel_id);
> >   	info->key.tos = from->tunnel_tos;
> >   	info->key.ttl = from->tunnel_ttl;
> > +	info->key.flow_flags = FLOWI_FLAG_ANYSRC;
> 
> Can we set FLOWI_FLAG_ANYSRC in all conditions?
> In lwt_bpf.c, func bpf_lwt_xmit_reroute(), FLOWI_FLAG_ANYSRC
> is set for ipv4 but not for ipv6. I am wondering whether
> FLOWI_FLAG_ANYSRC needs to be set for ipv6 packet or not
> in bpf_skb_set_tunnel_key().

I've confirmed that IPv6-encapsulated packets are not dropped even if
the flag is not set and the outer source IP address is not assigned to
the host. This is also expected given we never check for
FLOWI_FLAG_ANYSRC on the IPv6 path. I must have been confused by the
fact we sometimes still set FLOWI_FLAG_ANYSRC for IPv6.

I've sent a v2 without the changes to IPv6 code paths.

> 
> >   	if (flags & BPF_F_TUNINFO_IPV6) {
> >   		info->mode |= IP_TUNNEL_INFO_IPV6;