* [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
To: willemb, ast, daniel, davem, shuah, kafai, songliubraving, yhs,
quentin.monnet, john.fastabend, rdna, linux-kselftest, netdev,
bpf
Cc: Alan Maguire
Extend bpf_skb_adjust_room growth to mark inner MAC header so that
L2 encapsulation can be used for tc tunnels.
Patch #1 extends the existing test_tc_tunnel to support UDP
encapsulation; later we want to be able to test MPLS over UDP and
MPLS over GRE encapsulation.
Patch #2 adds the BPF_F_ADJ_ROOM_ENCAP_L2(len) macro, which
allows specification of inner mac length. Other approaches were
explored prior to taking this approach. Specifically, I tried
automatically computing the inner mac length on the basis of the
specified flags (so inner maclen for GRE/IPv4 encap is the len_diff
specified to bpf_skb_adjust_room minus GRE + IPv4 header length
for example). Problem with this is that we don't know for sure
what form of GRE/UDP header we have; is it a full GRE header,
or is it a FOU UDP header or generic UDP encap header? My fear
here was we'd end up with an explosion of flags. The other approach
tried was to support inner L2 header marking as a separate room
adjustment, i.e. adjust for L3/L4 encap, then call
bpf_skb_adjust_room for L2 encap. This can be made to work but
because it imposed an order on operations, felt a bit clunky.
Patch #3 syncs tools/ bpf.h.
Patch #4 extends the tests again to support MPLSoverGRE,
MPLSoverUDP, and transparent ethernet bridging (TEB) where
the inner L2 header is an ethernet header. Testing of BPF
encap against tunnels is done for cases where configuration
of such tunnels is possible (MPLSoverGRE[6], MPLSoverUDP,
gre[6]tap), and skipped otherwise. Testing of BPF encap/decap
is always carried out.
Changes since v1:
- fixed formatting of commit references.
- BPF_F_ADJ_ROOM_FIXED_GSO flag enabled on all variants (patch 1)
- fixed fou6 options for UDP encap; checksum errors observed were
due to the fact fou6 tunnel was not set up with correct ipproto
options (41 -6). 0 checksums work fine (patch 1)
- added definitions for mask and shift used in setting L2 length
(patch 2)
- allow udp encap with fixed GSO (patch 2)
- changed "elen" to "l2_len" to be more descriptive (patch 4)
- added support for ethernet L2 encap to tests; testing against
gre[6]tap tunnels (patch 4).
Alan Maguire (4):
selftests_bpf: add UDP encap to test_tc_tunnel
bpf: add layer 2 encap support to bpf_skb_adjust_room
bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
selftests_bpf: add L2 encap to test_tc_tunnel
include/uapi/linux/bpf.h | 10 +
net/core/filter.c | 15 +-
tools/include/uapi/linux/bpf.h | 10 +
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 335 +++++++++++++++++----
tools/testing/selftests/bpf/test_tc_tunnel.sh | 147 +++++++--
5 files changed, 427 insertions(+), 90 deletions(-)
--
1.8.3.1
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: alan.maguire @ 2019-04-08 16:57 UTC (permalink / raw)
Extend bpf_skb_adjust_room growth to mark inner MAC header so that
L2 encapsulation can be used for tc tunnels.
Patch #1 extends the existing test_tc_tunnel to support UDP
encapsulation; later we want to be able to test MPLS over UDP and
MPLS over GRE encapsulation.
Patch #2 adds the BPF_F_ADJ_ROOM_ENCAP_L2(len) macro, which
allows specification of inner mac length. Other approaches were
explored prior to taking this approach. Specifically, I tried
automatically computing the inner mac length on the basis of the
specified flags (so inner maclen for GRE/IPv4 encap is the len_diff
specified to bpf_skb_adjust_room minus GRE + IPv4 header length
for example). Problem with this is that we don't know for sure
what form of GRE/UDP header we have; is it a full GRE header,
or is it a FOU UDP header or generic UDP encap header? My fear
here was we'd end up with an explosion of flags. The other approach
tried was to support inner L2 header marking as a separate room
adjustment, i.e. adjust for L3/L4 encap, then call
bpf_skb_adjust_room for L2 encap. This can be made to work but
because it imposed an order on operations, felt a bit clunky.
Patch #3 syncs tools/ bpf.h.
Patch #4 extends the tests again to support MPLSoverGRE,
MPLSoverUDP, and transparent ethernet bridging (TEB) where
the inner L2 header is an ethernet header. Testing of BPF
encap against tunnels is done for cases where configuration
of such tunnels is possible (MPLSoverGRE[6], MPLSoverUDP,
gre[6]tap), and skipped otherwise. Testing of BPF encap/decap
is always carried out.
Changes since v1:
- fixed formatting of commit references.
- BPF_F_ADJ_ROOM_FIXED_GSO flag enabled on all variants (patch 1)
- fixed fou6 options for UDP encap; checksum errors observed were
due to the fact fou6 tunnel was not set up with correct ipproto
options (41 -6). 0 checksums work fine (patch 1)
- added definitions for mask and shift used in setting L2 length
(patch 2)
- allow udp encap with fixed GSO (patch 2)
- changed "elen" to "l2_len" to be more descriptive (patch 4)
- added support for ethernet L2 encap to tests; testing against
gre[6]tap tunnels (patch 4).
Alan Maguire (4):
selftests_bpf: add UDP encap to test_tc_tunnel
bpf: add layer 2 encap support to bpf_skb_adjust_room
bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
selftests_bpf: add L2 encap to test_tc_tunnel
include/uapi/linux/bpf.h | 10 +
net/core/filter.c | 15 +-
tools/include/uapi/linux/bpf.h | 10 +
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 335 +++++++++++++++++----
tools/testing/selftests/bpf/test_tc_tunnel.sh | 147 +++++++--
5 files changed, 427 insertions(+), 90 deletions(-)
--
1.8.3.1
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
Extend bpf_skb_adjust_room growth to mark inner MAC header so that
L2 encapsulation can be used for tc tunnels.
Patch #1 extends the existing test_tc_tunnel to support UDP
encapsulation; later we want to be able to test MPLS over UDP and
MPLS over GRE encapsulation.
Patch #2 adds the BPF_F_ADJ_ROOM_ENCAP_L2(len) macro, which
allows specification of inner mac length. Other approaches were
explored prior to taking this approach. Specifically, I tried
automatically computing the inner mac length on the basis of the
specified flags (so inner maclen for GRE/IPv4 encap is the len_diff
specified to bpf_skb_adjust_room minus GRE + IPv4 header length
for example). Problem with this is that we don't know for sure
what form of GRE/UDP header we have; is it a full GRE header,
or is it a FOU UDP header or generic UDP encap header? My fear
here was we'd end up with an explosion of flags. The other approach
tried was to support inner L2 header marking as a separate room
adjustment, i.e. adjust for L3/L4 encap, then call
bpf_skb_adjust_room for L2 encap. This can be made to work but
because it imposed an order on operations, felt a bit clunky.
Patch #3 syncs tools/ bpf.h.
Patch #4 extends the tests again to support MPLSoverGRE,
MPLSoverUDP, and transparent ethernet bridging (TEB) where
the inner L2 header is an ethernet header. Testing of BPF
encap against tunnels is done for cases where configuration
of such tunnels is possible (MPLSoverGRE[6], MPLSoverUDP,
gre[6]tap), and skipped otherwise. Testing of BPF encap/decap
is always carried out.
Changes since v1:
- fixed formatting of commit references.
- BPF_F_ADJ_ROOM_FIXED_GSO flag enabled on all variants (patch 1)
- fixed fou6 options for UDP encap; checksum errors observed were
due to the fact fou6 tunnel was not set up with correct ipproto
options (41 -6). 0 checksums work fine (patch 1)
- added definitions for mask and shift used in setting L2 length
(patch 2)
- allow udp encap with fixed GSO (patch 2)
- changed "elen" to "l2_len" to be more descriptive (patch 4)
- added support for ethernet L2 encap to tests; testing against
gre[6]tap tunnels (patch 4).
Alan Maguire (4):
selftests_bpf: add UDP encap to test_tc_tunnel
bpf: add layer 2 encap support to bpf_skb_adjust_room
bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
selftests_bpf: add L2 encap to test_tc_tunnel
include/uapi/linux/bpf.h | 10 +
net/core/filter.c | 15 +-
tools/include/uapi/linux/bpf.h | 10 +
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 335 +++++++++++++++++----
tools/testing/selftests/bpf/test_tc_tunnel.sh | 147 +++++++--
5 files changed, 427 insertions(+), 90 deletions(-)
--
1.8.3.1
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 1/4] selftests_bpf: add UDP encap to test_tc_tunnel
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 16:57 ` alan.maguire
-1 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
To: willemb, ast, daniel, davem, shuah, kafai, songliubraving, yhs,
quentin.monnet, john.fastabend, rdna, linux-kselftest, netdev,
bpf
Cc: Alan Maguire
commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
introduced support to bpf_skb_adjust_room for GSO-friendly GRE
and UDP encapsulation and later introduced associated test_tc_tunnel
tests. Here those tests are extended to cover UDP encapsulation also.
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 141 +++++++++++++++------
tools/testing/selftests/bpf/test_tc_tunnel.sh | 60 +++++++--
2 files changed, 147 insertions(+), 54 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
index f541c2d..7745a12 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
@@ -12,6 +12,7 @@
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
+#include <linux/udp.h>
#include <linux/pkt_cls.h>
#include <linux/types.h>
@@ -20,16 +21,27 @@
static const int cfg_port = 8000;
-struct grev4hdr {
- struct iphdr ip;
+static const int cfg_udp_src = 20000;
+static const int cfg_udp_dst = 5555;
+
+struct gre_hdr {
__be16 flags;
__be16 protocol;
} __attribute__((packed));
-struct grev6hdr {
+union l4hdr {
+ struct udphdr udp;
+ struct gre_hdr gre;
+};
+
+struct v4hdr {
+ struct iphdr ip;
+ union l4hdr l4hdr;
+} __attribute__((packed));
+
+struct v6hdr {
struct ipv6hdr ip;
- __be16 flags;
- __be16 protocol;
+ union l4hdr l4hdr;
} __attribute__((packed));
static __always_inline void set_ipv4_csum(struct iphdr *iph)
@@ -47,10 +59,11 @@ static __always_inline void set_ipv4_csum(struct iphdr *iph)
iph->check = ~((csum & 0xffff) + (csum >> 16));
}
-static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
+static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
{
- struct grev4hdr h_outer;
struct iphdr iph_inner;
+ struct v4hdr h_outer;
+ struct udphdr *udph;
struct tcphdr tcph;
__u64 flags;
int olen;
@@ -70,12 +83,29 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
if (tcph.dest != __bpf_constant_htons(cfg_port))
return TC_ACT_OK;
+ olen = sizeof(h_outer.ip);
+
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
- if (with_gre) {
+ switch (encap_proto) {
+ case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
- olen = sizeof(h_outer);
- } else {
- olen = sizeof(h_outer.ip);
+ olen += sizeof(h_outer.l4hdr.gre);
+ h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IP);
+ h_outer.l4hdr.gre.flags = 0;
+ break;
+ case IPPROTO_UDP:
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
+ olen += sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
+ h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.check = 0;
+ h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
+ sizeof(h_outer.l4hdr.udp));
+ break;
+ case IPPROTO_IPIP:
+ break;
+ default:
+ return TC_ACT_OK;
}
/* add room between mac and network header */
@@ -85,16 +115,10 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.tot_len = bpf_htons(olen +
- bpf_htons(h_outer.ip.tot_len));
- if (with_gre) {
- h_outer.ip.protocol = IPPROTO_GRE;
- h_outer.protocol = bpf_htons(ETH_P_IP);
- h_outer.flags = 0;
- } else {
- h_outer.ip.protocol = IPPROTO_IPIP;
- }
+ bpf_htons(h_outer.ip.tot_len));
+ h_outer.ip.protocol = encap_proto;
- set_ipv4_csum((void *)&h_outer.ip);
+ set_ipv4_csum(&h_outer.ip);
/* store new outer network header */
if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
@@ -104,11 +128,12 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
return TC_ACT_OK;
}
-static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
+static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
{
struct ipv6hdr iph_inner;
- struct grev6hdr h_outer;
+ struct v6hdr h_outer;
struct tcphdr tcph;
+ __u16 tot_len;
__u64 flags;
int olen;
@@ -124,15 +149,32 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
if (tcph.dest != __bpf_constant_htons(cfg_port))
return TC_ACT_OK;
+ olen = sizeof(h_outer.ip);
+
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
- if (with_gre) {
+ switch (encap_proto) {
+ case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
- olen = sizeof(h_outer);
- } else {
- olen = sizeof(h_outer.ip);
+ olen += sizeof(h_outer.l4hdr.gre);
+ h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IPV6);
+ h_outer.l4hdr.gre.flags = 0;
+ break;
+ case IPPROTO_UDP:
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
+ olen += sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
+ h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
+ sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.check = 0;
+ h_outer.l4hdr.udp.len = bpf_htons(tot_len);
+ break;
+ case IPPROTO_IPV6:
+ break;
+ default:
+ return TC_ACT_OK;
}
-
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -141,13 +183,8 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
h_outer.ip = iph_inner;
h_outer.ip.payload_len = bpf_htons(olen +
bpf_ntohs(h_outer.ip.payload_len));
- if (with_gre) {
- h_outer.ip.nexthdr = IPPROTO_GRE;
- h_outer.protocol = bpf_htons(ETH_P_IPV6);
- h_outer.flags = 0;
- } else {
- h_outer.ip.nexthdr = IPPROTO_IPV6;
- }
+
+ h_outer.ip.nexthdr = encap_proto;
/* store new outer network header */
if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
@@ -161,7 +198,7 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
int __encap_ipip(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, false);
+ return encap_ipv4(skb, IPPROTO_IPIP);
else
return TC_ACT_OK;
}
@@ -170,7 +207,16 @@ int __encap_ipip(struct __sk_buff *skb)
int __encap_gre(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, true);
+ return encap_ipv4(skb, IPPROTO_GRE);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp")
+int __encap_udp(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP);
else
return TC_ACT_OK;
}
@@ -179,7 +225,7 @@ int __encap_gre(struct __sk_buff *skb)
int __encap_ip6tnl(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, false);
+ return encap_ipv6(skb, IPPROTO_IPV6);
else
return TC_ACT_OK;
}
@@ -188,23 +234,34 @@ int __encap_ip6tnl(struct __sk_buff *skb)
int __encap_ip6gre(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, true);
+ return encap_ipv6(skb, IPPROTO_GRE);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6udp")
+int __encap_ip6udp(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_UDP);
else
return TC_ACT_OK;
}
static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
{
- char buf[sizeof(struct grev6hdr)];
- int olen;
+ char buf[sizeof(struct v6hdr)];
+ int olen = len;
switch (proto) {
case IPPROTO_IPIP:
case IPPROTO_IPV6:
- olen = len;
break;
case IPPROTO_GRE:
- olen = len + 4 /* gre hdr */;
+ olen += sizeof(struct gre_hdr);
+ break;
+ case IPPROTO_UDP:
+ olen += sizeof(struct udphdr);
break;
default:
return TC_ACT_OK;
diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
index c805adb..f87d645 100755
--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
@@ -15,6 +15,9 @@ readonly ns2_v4=192.168.1.2
readonly ns1_v6=fd::1
readonly ns2_v6=fd::2
+# Must match port used by bpf program
+readonly udpport=5555
+
readonly infile="$(mktemp)"
readonly outfile="$(mktemp)"
@@ -38,8 +41,8 @@ setup() {
# clamp route to reserve room for tunnel headers
ip -netns "${ns1}" -4 route flush table main
ip -netns "${ns1}" -6 route flush table main
- ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1476 dev veth1
- ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1456 dev veth1
+ ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1472 dev veth1
+ ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1452 dev veth1
sleep 1
@@ -103,6 +106,18 @@ if [[ "$#" -eq "0" ]]; then
echo "ip6 gre gso"
$0 ipv6 ip6gre 2000
+ echo "ip udp"
+ $0 ipv4 udp 100
+
+ echo "ip6 udp"
+ $0 ipv6 ip6udp 100
+
+ echo "ip udp gso"
+ $0 ipv4 udp 2000
+
+ echo "ip6 udp gso"
+ $0 ipv6 ip6udp 2000
+
echo "OK. All tests passed"
exit 0
fi
@@ -117,12 +132,20 @@ case "$1" in
"ipv4")
readonly addr1="${ns1_v4}"
readonly addr2="${ns2_v4}"
- readonly netcat_opt=-4
+ readonly ipproto=4
+ readonly netcat_opt=-${ipproto}
+ readonly foumod=fou
+ readonly foutype=ipip
+ readonly fouproto=4
;;
"ipv6")
readonly addr1="${ns1_v6}"
readonly addr2="${ns2_v6}"
- readonly netcat_opt=-6
+ readonly ipproto=6
+ readonly netcat_opt=-${ipproto}
+ readonly foumod=fou6
+ readonly foutype=ip6tnl
+ readonly fouproto="41 -6"
;;
*)
echo "unknown arg: $1"
@@ -158,12 +181,25 @@ server_listen
# serverside, insert decap module
# server is still running
# client can connect again
-ip netns exec "${ns2}" ip link add dev testtun0 type "${tuntype}" \
- remote "${addr1}" local "${addr2}"
-# Because packets are decapped by the tunnel they arrive on testtun0 from
-# the IP stack perspective. Ensure reverse path filtering is disabled
-# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
-# expected veth2 (veth2 is where 192.168.1.2 is configured).
+
+if [[ "$tuntype" =~ "udp" ]]; then
+ # Set up fou tunnel.
+ ttype="${foutype}"
+ targs="encap fou encap-sport auto encap-dport $udpport"
+ # fou may be a module; allow this to fail.
+ modprobe "${foumod}" ||true
+ ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
+else
+ ttype=$tuntype
+ targs=""
+fi
+ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
+ remote "${addr1}" local "${addr2}" $targs
+# Because packets are decapped by the tunnel they arrive on testtun0
+# from the IP stack perspective. Ensure reverse path filtering is
+# disabled otherwise we drop the TCP SYN as arriving on testtun0
+# instead of the expected veth2 (veth2 is where 192.168.1.2 is
+# configured).
ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
# rp needs to be disabled for both all and testtun0 as the rp value is
# selected as the max of the "all" and device-specific values.
@@ -172,13 +208,13 @@ ip netns exec "${ns2}" ip link set dev testtun0 up
echo "test bpf encap with tunnel device decap"
client_connect
verify_data
+ip netns exec "${ns2}" ip link del dev testtun0
+server_listen
# serverside, use BPF for decap
-ip netns exec "${ns2}" ip link del dev testtun0
ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
ip netns exec "${ns2}" tc filter add dev veth2 ingress \
bpf direct-action object-file ./test_tc_tunnel.o section decap
-server_listen
echo "test bpf encap with bpf decap"
client_connect
verify_data
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 1/4] selftests_bpf: add UDP encap to test_tc_tunnel
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: alan.maguire @ 2019-04-08 16:57 UTC (permalink / raw)
commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
introduced support to bpf_skb_adjust_room for GSO-friendly GRE
and UDP encapsulation and later introduced associated test_tc_tunnel
tests. Here those tests are extended to cover UDP encapsulation also.
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 141 +++++++++++++++------
tools/testing/selftests/bpf/test_tc_tunnel.sh | 60 +++++++--
2 files changed, 147 insertions(+), 54 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
index f541c2d..7745a12 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
@@ -12,6 +12,7 @@
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
+#include <linux/udp.h>
#include <linux/pkt_cls.h>
#include <linux/types.h>
@@ -20,16 +21,27 @@
static const int cfg_port = 8000;
-struct grev4hdr {
- struct iphdr ip;
+static const int cfg_udp_src = 20000;
+static const int cfg_udp_dst = 5555;
+
+struct gre_hdr {
__be16 flags;
__be16 protocol;
} __attribute__((packed));
-struct grev6hdr {
+union l4hdr {
+ struct udphdr udp;
+ struct gre_hdr gre;
+};
+
+struct v4hdr {
+ struct iphdr ip;
+ union l4hdr l4hdr;
+} __attribute__((packed));
+
+struct v6hdr {
struct ipv6hdr ip;
- __be16 flags;
- __be16 protocol;
+ union l4hdr l4hdr;
} __attribute__((packed));
static __always_inline void set_ipv4_csum(struct iphdr *iph)
@@ -47,10 +59,11 @@ static __always_inline void set_ipv4_csum(struct iphdr *iph)
iph->check = ~((csum & 0xffff) + (csum >> 16));
}
-static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
+static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
{
- struct grev4hdr h_outer;
struct iphdr iph_inner;
+ struct v4hdr h_outer;
+ struct udphdr *udph;
struct tcphdr tcph;
__u64 flags;
int olen;
@@ -70,12 +83,29 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
if (tcph.dest != __bpf_constant_htons(cfg_port))
return TC_ACT_OK;
+ olen = sizeof(h_outer.ip);
+
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
- if (with_gre) {
+ switch (encap_proto) {
+ case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
- olen = sizeof(h_outer);
- } else {
- olen = sizeof(h_outer.ip);
+ olen += sizeof(h_outer.l4hdr.gre);
+ h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IP);
+ h_outer.l4hdr.gre.flags = 0;
+ break;
+ case IPPROTO_UDP:
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
+ olen += sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
+ h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.check = 0;
+ h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
+ sizeof(h_outer.l4hdr.udp));
+ break;
+ case IPPROTO_IPIP:
+ break;
+ default:
+ return TC_ACT_OK;
}
/* add room between mac and network header */
@@ -85,16 +115,10 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.tot_len = bpf_htons(olen +
- bpf_htons(h_outer.ip.tot_len));
- if (with_gre) {
- h_outer.ip.protocol = IPPROTO_GRE;
- h_outer.protocol = bpf_htons(ETH_P_IP);
- h_outer.flags = 0;
- } else {
- h_outer.ip.protocol = IPPROTO_IPIP;
- }
+ bpf_htons(h_outer.ip.tot_len));
+ h_outer.ip.protocol = encap_proto;
- set_ipv4_csum((void *)&h_outer.ip);
+ set_ipv4_csum(&h_outer.ip);
/* store new outer network header */
if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
@@ -104,11 +128,12 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
return TC_ACT_OK;
}
-static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
+static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
{
struct ipv6hdr iph_inner;
- struct grev6hdr h_outer;
+ struct v6hdr h_outer;
struct tcphdr tcph;
+ __u16 tot_len;
__u64 flags;
int olen;
@@ -124,15 +149,32 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
if (tcph.dest != __bpf_constant_htons(cfg_port))
return TC_ACT_OK;
+ olen = sizeof(h_outer.ip);
+
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
- if (with_gre) {
+ switch (encap_proto) {
+ case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
- olen = sizeof(h_outer);
- } else {
- olen = sizeof(h_outer.ip);
+ olen += sizeof(h_outer.l4hdr.gre);
+ h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IPV6);
+ h_outer.l4hdr.gre.flags = 0;
+ break;
+ case IPPROTO_UDP:
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
+ olen += sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
+ h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
+ sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.check = 0;
+ h_outer.l4hdr.udp.len = bpf_htons(tot_len);
+ break;
+ case IPPROTO_IPV6:
+ break;
+ default:
+ return TC_ACT_OK;
}
-
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -141,13 +183,8 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
h_outer.ip = iph_inner;
h_outer.ip.payload_len = bpf_htons(olen +
bpf_ntohs(h_outer.ip.payload_len));
- if (with_gre) {
- h_outer.ip.nexthdr = IPPROTO_GRE;
- h_outer.protocol = bpf_htons(ETH_P_IPV6);
- h_outer.flags = 0;
- } else {
- h_outer.ip.nexthdr = IPPROTO_IPV6;
- }
+
+ h_outer.ip.nexthdr = encap_proto;
/* store new outer network header */
if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
@@ -161,7 +198,7 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
int __encap_ipip(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, false);
+ return encap_ipv4(skb, IPPROTO_IPIP);
else
return TC_ACT_OK;
}
@@ -170,7 +207,16 @@ int __encap_ipip(struct __sk_buff *skb)
int __encap_gre(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, true);
+ return encap_ipv4(skb, IPPROTO_GRE);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp")
+int __encap_udp(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP);
else
return TC_ACT_OK;
}
@@ -179,7 +225,7 @@ int __encap_gre(struct __sk_buff *skb)
int __encap_ip6tnl(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, false);
+ return encap_ipv6(skb, IPPROTO_IPV6);
else
return TC_ACT_OK;
}
@@ -188,23 +234,34 @@ int __encap_ip6tnl(struct __sk_buff *skb)
int __encap_ip6gre(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, true);
+ return encap_ipv6(skb, IPPROTO_GRE);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6udp")
+int __encap_ip6udp(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_UDP);
else
return TC_ACT_OK;
}
static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
{
- char buf[sizeof(struct grev6hdr)];
- int olen;
+ char buf[sizeof(struct v6hdr)];
+ int olen = len;
switch (proto) {
case IPPROTO_IPIP:
case IPPROTO_IPV6:
- olen = len;
break;
case IPPROTO_GRE:
- olen = len + 4 /* gre hdr */;
+ olen += sizeof(struct gre_hdr);
+ break;
+ case IPPROTO_UDP:
+ olen += sizeof(struct udphdr);
break;
default:
return TC_ACT_OK;
diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
index c805adb..f87d645 100755
--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
@@ -15,6 +15,9 @@ readonly ns2_v4=192.168.1.2
readonly ns1_v6=fd::1
readonly ns2_v6=fd::2
+# Must match port used by bpf program
+readonly udpport=5555
+
readonly infile="$(mktemp)"
readonly outfile="$(mktemp)"
@@ -38,8 +41,8 @@ setup() {
# clamp route to reserve room for tunnel headers
ip -netns "${ns1}" -4 route flush table main
ip -netns "${ns1}" -6 route flush table main
- ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1476 dev veth1
- ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1456 dev veth1
+ ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1472 dev veth1
+ ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1452 dev veth1
sleep 1
@@ -103,6 +106,18 @@ if [[ "$#" -eq "0" ]]; then
echo "ip6 gre gso"
$0 ipv6 ip6gre 2000
+ echo "ip udp"
+ $0 ipv4 udp 100
+
+ echo "ip6 udp"
+ $0 ipv6 ip6udp 100
+
+ echo "ip udp gso"
+ $0 ipv4 udp 2000
+
+ echo "ip6 udp gso"
+ $0 ipv6 ip6udp 2000
+
echo "OK. All tests passed"
exit 0
fi
@@ -117,12 +132,20 @@ case "$1" in
"ipv4")
readonly addr1="${ns1_v4}"
readonly addr2="${ns2_v4}"
- readonly netcat_opt=-4
+ readonly ipproto=4
+ readonly netcat_opt=-${ipproto}
+ readonly foumod=fou
+ readonly foutype=ipip
+ readonly fouproto=4
;;
"ipv6")
readonly addr1="${ns1_v6}"
readonly addr2="${ns2_v6}"
- readonly netcat_opt=-6
+ readonly ipproto=6
+ readonly netcat_opt=-${ipproto}
+ readonly foumod=fou6
+ readonly foutype=ip6tnl
+ readonly fouproto="41 -6"
;;
*)
echo "unknown arg: $1"
@@ -158,12 +181,25 @@ server_listen
# serverside, insert decap module
# server is still running
# client can connect again
-ip netns exec "${ns2}" ip link add dev testtun0 type "${tuntype}" \
- remote "${addr1}" local "${addr2}"
-# Because packets are decapped by the tunnel they arrive on testtun0 from
-# the IP stack perspective. Ensure reverse path filtering is disabled
-# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
-# expected veth2 (veth2 is where 192.168.1.2 is configured).
+
+if [[ "$tuntype" =~ "udp" ]]; then
+ # Set up fou tunnel.
+ ttype="${foutype}"
+ targs="encap fou encap-sport auto encap-dport $udpport"
+ # fou may be a module; allow this to fail.
+ modprobe "${foumod}" ||true
+ ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
+else
+ ttype=$tuntype
+ targs=""
+fi
+ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
+ remote "${addr1}" local "${addr2}" $targs
+# Because packets are decapped by the tunnel they arrive on testtun0
+# from the IP stack perspective. Ensure reverse path filtering is
+# disabled otherwise we drop the TCP SYN as arriving on testtun0
+# instead of the expected veth2 (veth2 is where 192.168.1.2 is
+# configured).
ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
# rp needs to be disabled for both all and testtun0 as the rp value is
# selected as the max of the "all" and device-specific values.
@@ -172,13 +208,13 @@ ip netns exec "${ns2}" ip link set dev testtun0 up
echo "test bpf encap with tunnel device decap"
client_connect
verify_data
+ip netns exec "${ns2}" ip link del dev testtun0
+server_listen
# serverside, use BPF for decap
-ip netns exec "${ns2}" ip link del dev testtun0
ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
ip netns exec "${ns2}" tc filter add dev veth2 ingress \
bpf direct-action object-file ./test_tc_tunnel.o section decap
-server_listen
echo "test bpf encap with bpf decap"
client_connect
verify_data
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 1/4] selftests_bpf: add UDP encap to test_tc_tunnel
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
introduced support to bpf_skb_adjust_room for GSO-friendly GRE
and UDP encapsulation and later introduced associated test_tc_tunnel
tests. Here those tests are extended to cover UDP encapsulation also.
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 141 +++++++++++++++------
tools/testing/selftests/bpf/test_tc_tunnel.sh | 60 +++++++--
2 files changed, 147 insertions(+), 54 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
index f541c2d..7745a12 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
@@ -12,6 +12,7 @@
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
+#include <linux/udp.h>
#include <linux/pkt_cls.h>
#include <linux/types.h>
@@ -20,16 +21,27 @@
static const int cfg_port = 8000;
-struct grev4hdr {
- struct iphdr ip;
+static const int cfg_udp_src = 20000;
+static const int cfg_udp_dst = 5555;
+
+struct gre_hdr {
__be16 flags;
__be16 protocol;
} __attribute__((packed));
-struct grev6hdr {
+union l4hdr {
+ struct udphdr udp;
+ struct gre_hdr gre;
+};
+
+struct v4hdr {
+ struct iphdr ip;
+ union l4hdr l4hdr;
+} __attribute__((packed));
+
+struct v6hdr {
struct ipv6hdr ip;
- __be16 flags;
- __be16 protocol;
+ union l4hdr l4hdr;
} __attribute__((packed));
static __always_inline void set_ipv4_csum(struct iphdr *iph)
@@ -47,10 +59,11 @@ static __always_inline void set_ipv4_csum(struct iphdr *iph)
iph->check = ~((csum & 0xffff) + (csum >> 16));
}
-static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
+static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
{
- struct grev4hdr h_outer;
struct iphdr iph_inner;
+ struct v4hdr h_outer;
+ struct udphdr *udph;
struct tcphdr tcph;
__u64 flags;
int olen;
@@ -70,12 +83,29 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
if (tcph.dest != __bpf_constant_htons(cfg_port))
return TC_ACT_OK;
+ olen = sizeof(h_outer.ip);
+
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
- if (with_gre) {
+ switch (encap_proto) {
+ case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
- olen = sizeof(h_outer);
- } else {
- olen = sizeof(h_outer.ip);
+ olen += sizeof(h_outer.l4hdr.gre);
+ h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IP);
+ h_outer.l4hdr.gre.flags = 0;
+ break;
+ case IPPROTO_UDP:
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
+ olen += sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
+ h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.check = 0;
+ h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
+ sizeof(h_outer.l4hdr.udp));
+ break;
+ case IPPROTO_IPIP:
+ break;
+ default:
+ return TC_ACT_OK;
}
/* add room between mac and network header */
@@ -85,16 +115,10 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.tot_len = bpf_htons(olen +
- bpf_htons(h_outer.ip.tot_len));
- if (with_gre) {
- h_outer.ip.protocol = IPPROTO_GRE;
- h_outer.protocol = bpf_htons(ETH_P_IP);
- h_outer.flags = 0;
- } else {
- h_outer.ip.protocol = IPPROTO_IPIP;
- }
+ bpf_htons(h_outer.ip.tot_len));
+ h_outer.ip.protocol = encap_proto;
- set_ipv4_csum((void *)&h_outer.ip);
+ set_ipv4_csum(&h_outer.ip);
/* store new outer network header */
if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
@@ -104,11 +128,12 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, bool with_gre)
return TC_ACT_OK;
}
-static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
+static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
{
struct ipv6hdr iph_inner;
- struct grev6hdr h_outer;
+ struct v6hdr h_outer;
struct tcphdr tcph;
+ __u16 tot_len;
__u64 flags;
int olen;
@@ -124,15 +149,32 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
if (tcph.dest != __bpf_constant_htons(cfg_port))
return TC_ACT_OK;
+ olen = sizeof(h_outer.ip);
+
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
- if (with_gre) {
+ switch (encap_proto) {
+ case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
- olen = sizeof(h_outer);
- } else {
- olen = sizeof(h_outer.ip);
+ olen += sizeof(h_outer.l4hdr.gre);
+ h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IPV6);
+ h_outer.l4hdr.gre.flags = 0;
+ break;
+ case IPPROTO_UDP:
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
+ olen += sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
+ h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
+ sizeof(h_outer.l4hdr.udp);
+ h_outer.l4hdr.udp.check = 0;
+ h_outer.l4hdr.udp.len = bpf_htons(tot_len);
+ break;
+ case IPPROTO_IPV6:
+ break;
+ default:
+ return TC_ACT_OK;
}
-
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -141,13 +183,8 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
h_outer.ip = iph_inner;
h_outer.ip.payload_len = bpf_htons(olen +
bpf_ntohs(h_outer.ip.payload_len));
- if (with_gre) {
- h_outer.ip.nexthdr = IPPROTO_GRE;
- h_outer.protocol = bpf_htons(ETH_P_IPV6);
- h_outer.flags = 0;
- } else {
- h_outer.ip.nexthdr = IPPROTO_IPV6;
- }
+
+ h_outer.ip.nexthdr = encap_proto;
/* store new outer network header */
if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
@@ -161,7 +198,7 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, bool with_gre)
int __encap_ipip(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, false);
+ return encap_ipv4(skb, IPPROTO_IPIP);
else
return TC_ACT_OK;
}
@@ -170,7 +207,16 @@ int __encap_ipip(struct __sk_buff *skb)
int __encap_gre(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, true);
+ return encap_ipv4(skb, IPPROTO_GRE);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp")
+int __encap_udp(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP);
else
return TC_ACT_OK;
}
@@ -179,7 +225,7 @@ int __encap_gre(struct __sk_buff *skb)
int __encap_ip6tnl(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, false);
+ return encap_ipv6(skb, IPPROTO_IPV6);
else
return TC_ACT_OK;
}
@@ -188,23 +234,34 @@ int __encap_ip6tnl(struct __sk_buff *skb)
int __encap_ip6gre(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, true);
+ return encap_ipv6(skb, IPPROTO_GRE);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6udp")
+int __encap_ip6udp(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_UDP);
else
return TC_ACT_OK;
}
static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
{
- char buf[sizeof(struct grev6hdr)];
- int olen;
+ char buf[sizeof(struct v6hdr)];
+ int olen = len;
switch (proto) {
case IPPROTO_IPIP:
case IPPROTO_IPV6:
- olen = len;
break;
case IPPROTO_GRE:
- olen = len + 4 /* gre hdr */;
+ olen += sizeof(struct gre_hdr);
+ break;
+ case IPPROTO_UDP:
+ olen += sizeof(struct udphdr);
break;
default:
return TC_ACT_OK;
diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
index c805adb..f87d645 100755
--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
@@ -15,6 +15,9 @@ readonly ns2_v4=192.168.1.2
readonly ns1_v6=fd::1
readonly ns2_v6=fd::2
+# Must match port used by bpf program
+readonly udpport=5555
+
readonly infile="$(mktemp)"
readonly outfile="$(mktemp)"
@@ -38,8 +41,8 @@ setup() {
# clamp route to reserve room for tunnel headers
ip -netns "${ns1}" -4 route flush table main
ip -netns "${ns1}" -6 route flush table main
- ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1476 dev veth1
- ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1456 dev veth1
+ ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1472 dev veth1
+ ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1452 dev veth1
sleep 1
@@ -103,6 +106,18 @@ if [[ "$#" -eq "0" ]]; then
echo "ip6 gre gso"
$0 ipv6 ip6gre 2000
+ echo "ip udp"
+ $0 ipv4 udp 100
+
+ echo "ip6 udp"
+ $0 ipv6 ip6udp 100
+
+ echo "ip udp gso"
+ $0 ipv4 udp 2000
+
+ echo "ip6 udp gso"
+ $0 ipv6 ip6udp 2000
+
echo "OK. All tests passed"
exit 0
fi
@@ -117,12 +132,20 @@ case "$1" in
"ipv4")
readonly addr1="${ns1_v4}"
readonly addr2="${ns2_v4}"
- readonly netcat_opt=-4
+ readonly ipproto=4
+ readonly netcat_opt=-${ipproto}
+ readonly foumod=fou
+ readonly foutype=ipip
+ readonly fouproto=4
;;
"ipv6")
readonly addr1="${ns1_v6}"
readonly addr2="${ns2_v6}"
- readonly netcat_opt=-6
+ readonly ipproto=6
+ readonly netcat_opt=-${ipproto}
+ readonly foumod=fou6
+ readonly foutype=ip6tnl
+ readonly fouproto="41 -6"
;;
*)
echo "unknown arg: $1"
@@ -158,12 +181,25 @@ server_listen
# serverside, insert decap module
# server is still running
# client can connect again
-ip netns exec "${ns2}" ip link add dev testtun0 type "${tuntype}" \
- remote "${addr1}" local "${addr2}"
-# Because packets are decapped by the tunnel they arrive on testtun0 from
-# the IP stack perspective. Ensure reverse path filtering is disabled
-# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
-# expected veth2 (veth2 is where 192.168.1.2 is configured).
+
+if [[ "$tuntype" =~ "udp" ]]; then
+ # Set up fou tunnel.
+ ttype="${foutype}"
+ targs="encap fou encap-sport auto encap-dport $udpport"
+ # fou may be a module; allow this to fail.
+ modprobe "${foumod}" ||true
+ ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
+else
+ ttype=$tuntype
+ targs=""
+fi
+ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
+ remote "${addr1}" local "${addr2}" $targs
+# Because packets are decapped by the tunnel they arrive on testtun0
+# from the IP stack perspective. Ensure reverse path filtering is
+# disabled otherwise we drop the TCP SYN as arriving on testtun0
+# instead of the expected veth2 (veth2 is where 192.168.1.2 is
+# configured).
ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
# rp needs to be disabled for both all and testtun0 as the rp value is
# selected as the max of the "all" and device-specific values.
@@ -172,13 +208,13 @@ ip netns exec "${ns2}" ip link set dev testtun0 up
echo "test bpf encap with tunnel device decap"
client_connect
verify_data
+ip netns exec "${ns2}" ip link del dev testtun0
+server_listen
# serverside, use BPF for decap
-ip netns exec "${ns2}" ip link del dev testtun0
ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
ip netns exec "${ns2}" tc filter add dev veth2 ingress \
bpf direct-action object-file ./test_tc_tunnel.o section decap
-server_listen
echo "test bpf encap with bpf decap"
client_connect
verify_data
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 2/4] bpf: add layer 2 encap support to bpf_skb_adjust_room
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 16:57 ` alan.maguire
-1 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
To: willemb, ast, daniel, davem, shuah, kafai, songliubraving, yhs,
quentin.monnet, john.fastabend, rdna, linux-kselftest, netdev,
bpf
Cc: Alan Maguire
commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
introduced support to bpf_skb_adjust_room for GSO-friendly GRE
and UDP encapsulation.
For GSO to work for skbs, the inner headers (mac and network) need to
be marked. For L3 encapsulation using bpf_skb_adjust_room, the mac
and network headers are identical. Here we provide a way of specifying
the inner mac header length for cases where L2 encap is desired. Such
an approach can support encapsulated ethernet headers, MPLS headers etc.
For example to convert from a packet of form [eth][ip][tcp] to
[eth][ip][udp][inner mac][ip][tcp], something like the following could
be done:
headroom = sizeof(iph) + sizeof(struct udphdr) + inner_maclen;
ret = bpf_skb_adjust_room(skb, headroom, BPF_ADJ_ROOM_MAC,
BPF_F_ADJ_ROOM_ENCAP_L4_UDP |
BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 |
BPF_F_ADJ_ROOM_ENCAP_L2(inner_maclen));
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
include/uapi/linux/bpf.h | 10 ++++++++++
net/core/filter.c | 15 ++++++++++-----
2 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 8370245..912391c 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1500,6 +1500,10 @@ struct bpf_stack_build_id {
* * **BPF_F_ADJ_ROOM_ENCAP_L4_UDP **:
* Use with ENCAP_L3 flags to further specify the tunnel type.
*
+ * * **BPF_F_ADJ_ROOM_ENCAP_L2(len) **:
+ * Use with ENCAP_L3/L4 flags to further specify the tunnel
+ * type; **len** is the length of the inner MAC header.
+ *
* A call to this helper is susceptible to change the underlaying
* packet buffer. Therefore, at load time, all checks on pointers
* previously done by the verifier are invalidated and must be
@@ -2641,10 +2645,16 @@ enum bpf_func_id {
/* BPF_FUNC_skb_adjust_room flags. */
#define BPF_F_ADJ_ROOM_FIXED_GSO (1ULL << 0)
+#define BPF_ADJ_ROOM_ENCAP_L2_MASK 0xff
+#define BPF_ADJ_ROOM_ENCAP_L2_SHIFT 56
+
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 (1ULL << 1)
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV6 (1ULL << 2)
#define BPF_F_ADJ_ROOM_ENCAP_L4_GRE (1ULL << 3)
#define BPF_F_ADJ_ROOM_ENCAP_L4_UDP (1ULL << 4)
+#define BPF_F_ADJ_ROOM_ENCAP_L2(len) (((__u64)len & \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK) \
+ << BPF_ADJ_ROOM_ENCAP_L2_SHIFT)
/* Mode for BPF_FUNC_skb_adjust_room helper. */
enum bpf_adj_room_mode {
diff --git a/net/core/filter.c b/net/core/filter.c
index 22eb2ed..d6a2bf2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2969,14 +2969,17 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
#define BPF_F_ADJ_ROOM_MASK (BPF_F_ADJ_ROOM_FIXED_GSO | \
BPF_F_ADJ_ROOM_ENCAP_L3_MASK | \
BPF_F_ADJ_ROOM_ENCAP_L4_GRE | \
- BPF_F_ADJ_ROOM_ENCAP_L4_UDP)
+ BPF_F_ADJ_ROOM_ENCAP_L4_UDP | \
+ BPF_F_ADJ_ROOM_ENCAP_L2( \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK))
static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
u64 flags)
{
+ u16 mac_len = 0, inner_mac = 0, inner_net = 0, inner_trans = 0;
bool encap = flags & BPF_F_ADJ_ROOM_ENCAP_L3_MASK;
- u16 mac_len = 0, inner_net = 0, inner_trans = 0;
unsigned int gso_type = SKB_GSO_DODGY;
+ u8 inner_mac_len = flags >> BPF_ADJ_ROOM_ENCAP_L2_SHIFT;
int ret;
if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
@@ -3008,6 +3011,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
mac_len = skb->network_header - skb->mac_header;
inner_net = skb->network_header;
+ if (inner_mac_len > len_diff)
+ return -EINVAL;
+ inner_mac = inner_net - inner_mac_len;
inner_trans = skb->transport_header;
}
@@ -3016,8 +3022,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
return ret;
if (encap) {
- /* inner mac == inner_net on l3 encap */
- skb->inner_mac_header = inner_net;
+ skb->inner_mac_header = inner_mac;
skb->inner_network_header = inner_net;
skb->inner_transport_header = inner_trans;
skb_set_inner_protocol(skb, skb->protocol);
@@ -3031,7 +3036,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
gso_type |= SKB_GSO_GRE;
else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
gso_type |= SKB_GSO_IPXIP6;
- else
+ else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
gso_type |= SKB_GSO_IPXIP4;
if (flags & BPF_F_ADJ_ROOM_ENCAP_L4_GRE ||
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 2/4] bpf: add layer 2 encap support to bpf_skb_adjust_room
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: alan.maguire @ 2019-04-08 16:57 UTC (permalink / raw)
commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
introduced support to bpf_skb_adjust_room for GSO-friendly GRE
and UDP encapsulation.
For GSO to work for skbs, the inner headers (mac and network) need to
be marked. For L3 encapsulation using bpf_skb_adjust_room, the mac
and network headers are identical. Here we provide a way of specifying
the inner mac header length for cases where L2 encap is desired. Such
an approach can support encapsulated ethernet headers, MPLS headers etc.
For example to convert from a packet of form [eth][ip][tcp] to
[eth][ip][udp][inner mac][ip][tcp], something like the following could
be done:
headroom = sizeof(iph) + sizeof(struct udphdr) + inner_maclen;
ret = bpf_skb_adjust_room(skb, headroom, BPF_ADJ_ROOM_MAC,
BPF_F_ADJ_ROOM_ENCAP_L4_UDP |
BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 |
BPF_F_ADJ_ROOM_ENCAP_L2(inner_maclen));
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
include/uapi/linux/bpf.h | 10 ++++++++++
net/core/filter.c | 15 ++++++++++-----
2 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 8370245..912391c 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1500,6 +1500,10 @@ struct bpf_stack_build_id {
* * **BPF_F_ADJ_ROOM_ENCAP_L4_UDP **:
* Use with ENCAP_L3 flags to further specify the tunnel type.
*
+ * * **BPF_F_ADJ_ROOM_ENCAP_L2(len) **:
+ * Use with ENCAP_L3/L4 flags to further specify the tunnel
+ * type; **len** is the length of the inner MAC header.
+ *
* A call to this helper is susceptible to change the underlaying
* packet buffer. Therefore, at load time, all checks on pointers
* previously done by the verifier are invalidated and must be
@@ -2641,10 +2645,16 @@ enum bpf_func_id {
/* BPF_FUNC_skb_adjust_room flags. */
#define BPF_F_ADJ_ROOM_FIXED_GSO (1ULL << 0)
+#define BPF_ADJ_ROOM_ENCAP_L2_MASK 0xff
+#define BPF_ADJ_ROOM_ENCAP_L2_SHIFT 56
+
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 (1ULL << 1)
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV6 (1ULL << 2)
#define BPF_F_ADJ_ROOM_ENCAP_L4_GRE (1ULL << 3)
#define BPF_F_ADJ_ROOM_ENCAP_L4_UDP (1ULL << 4)
+#define BPF_F_ADJ_ROOM_ENCAP_L2(len) (((__u64)len & \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK) \
+ << BPF_ADJ_ROOM_ENCAP_L2_SHIFT)
/* Mode for BPF_FUNC_skb_adjust_room helper. */
enum bpf_adj_room_mode {
diff --git a/net/core/filter.c b/net/core/filter.c
index 22eb2ed..d6a2bf2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2969,14 +2969,17 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
#define BPF_F_ADJ_ROOM_MASK (BPF_F_ADJ_ROOM_FIXED_GSO | \
BPF_F_ADJ_ROOM_ENCAP_L3_MASK | \
BPF_F_ADJ_ROOM_ENCAP_L4_GRE | \
- BPF_F_ADJ_ROOM_ENCAP_L4_UDP)
+ BPF_F_ADJ_ROOM_ENCAP_L4_UDP | \
+ BPF_F_ADJ_ROOM_ENCAP_L2( \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK))
static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
u64 flags)
{
+ u16 mac_len = 0, inner_mac = 0, inner_net = 0, inner_trans = 0;
bool encap = flags & BPF_F_ADJ_ROOM_ENCAP_L3_MASK;
- u16 mac_len = 0, inner_net = 0, inner_trans = 0;
unsigned int gso_type = SKB_GSO_DODGY;
+ u8 inner_mac_len = flags >> BPF_ADJ_ROOM_ENCAP_L2_SHIFT;
int ret;
if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
@@ -3008,6 +3011,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
mac_len = skb->network_header - skb->mac_header;
inner_net = skb->network_header;
+ if (inner_mac_len > len_diff)
+ return -EINVAL;
+ inner_mac = inner_net - inner_mac_len;
inner_trans = skb->transport_header;
}
@@ -3016,8 +3022,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
return ret;
if (encap) {
- /* inner mac == inner_net on l3 encap */
- skb->inner_mac_header = inner_net;
+ skb->inner_mac_header = inner_mac;
skb->inner_network_header = inner_net;
skb->inner_transport_header = inner_trans;
skb_set_inner_protocol(skb, skb->protocol);
@@ -3031,7 +3036,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
gso_type |= SKB_GSO_GRE;
else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
gso_type |= SKB_GSO_IPXIP6;
- else
+ else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
gso_type |= SKB_GSO_IPXIP4;
if (flags & BPF_F_ADJ_ROOM_ENCAP_L4_GRE ||
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 2/4] bpf: add layer 2 encap support to bpf_skb_adjust_room
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
introduced support to bpf_skb_adjust_room for GSO-friendly GRE
and UDP encapsulation.
For GSO to work for skbs, the inner headers (mac and network) need to
be marked. For L3 encapsulation using bpf_skb_adjust_room, the mac
and network headers are identical. Here we provide a way of specifying
the inner mac header length for cases where L2 encap is desired. Such
an approach can support encapsulated ethernet headers, MPLS headers etc.
For example to convert from a packet of form [eth][ip][tcp] to
[eth][ip][udp][inner mac][ip][tcp], something like the following could
be done:
headroom = sizeof(iph) + sizeof(struct udphdr) + inner_maclen;
ret = bpf_skb_adjust_room(skb, headroom, BPF_ADJ_ROOM_MAC,
BPF_F_ADJ_ROOM_ENCAP_L4_UDP |
BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 |
BPF_F_ADJ_ROOM_ENCAP_L2(inner_maclen));
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
include/uapi/linux/bpf.h | 10 ++++++++++
net/core/filter.c | 15 ++++++++++-----
2 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 8370245..912391c 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1500,6 +1500,10 @@ struct bpf_stack_build_id {
* * **BPF_F_ADJ_ROOM_ENCAP_L4_UDP **:
* Use with ENCAP_L3 flags to further specify the tunnel type.
*
+ * * **BPF_F_ADJ_ROOM_ENCAP_L2(len) **:
+ * Use with ENCAP_L3/L4 flags to further specify the tunnel
+ * type; **len** is the length of the inner MAC header.
+ *
* A call to this helper is susceptible to change the underlaying
* packet buffer. Therefore, at load time, all checks on pointers
* previously done by the verifier are invalidated and must be
@@ -2641,10 +2645,16 @@ enum bpf_func_id {
/* BPF_FUNC_skb_adjust_room flags. */
#define BPF_F_ADJ_ROOM_FIXED_GSO (1ULL << 0)
+#define BPF_ADJ_ROOM_ENCAP_L2_MASK 0xff
+#define BPF_ADJ_ROOM_ENCAP_L2_SHIFT 56
+
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 (1ULL << 1)
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV6 (1ULL << 2)
#define BPF_F_ADJ_ROOM_ENCAP_L4_GRE (1ULL << 3)
#define BPF_F_ADJ_ROOM_ENCAP_L4_UDP (1ULL << 4)
+#define BPF_F_ADJ_ROOM_ENCAP_L2(len) (((__u64)len & \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK) \
+ << BPF_ADJ_ROOM_ENCAP_L2_SHIFT)
/* Mode for BPF_FUNC_skb_adjust_room helper. */
enum bpf_adj_room_mode {
diff --git a/net/core/filter.c b/net/core/filter.c
index 22eb2ed..d6a2bf2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2969,14 +2969,17 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
#define BPF_F_ADJ_ROOM_MASK (BPF_F_ADJ_ROOM_FIXED_GSO | \
BPF_F_ADJ_ROOM_ENCAP_L3_MASK | \
BPF_F_ADJ_ROOM_ENCAP_L4_GRE | \
- BPF_F_ADJ_ROOM_ENCAP_L4_UDP)
+ BPF_F_ADJ_ROOM_ENCAP_L4_UDP | \
+ BPF_F_ADJ_ROOM_ENCAP_L2( \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK))
static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
u64 flags)
{
+ u16 mac_len = 0, inner_mac = 0, inner_net = 0, inner_trans = 0;
bool encap = flags & BPF_F_ADJ_ROOM_ENCAP_L3_MASK;
- u16 mac_len = 0, inner_net = 0, inner_trans = 0;
unsigned int gso_type = SKB_GSO_DODGY;
+ u8 inner_mac_len = flags >> BPF_ADJ_ROOM_ENCAP_L2_SHIFT;
int ret;
if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
@@ -3008,6 +3011,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
mac_len = skb->network_header - skb->mac_header;
inner_net = skb->network_header;
+ if (inner_mac_len > len_diff)
+ return -EINVAL;
+ inner_mac = inner_net - inner_mac_len;
inner_trans = skb->transport_header;
}
@@ -3016,8 +3022,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
return ret;
if (encap) {
- /* inner mac == inner_net on l3 encap */
- skb->inner_mac_header = inner_net;
+ skb->inner_mac_header = inner_mac;
skb->inner_network_header = inner_net;
skb->inner_transport_header = inner_trans;
skb_set_inner_protocol(skb, skb->protocol);
@@ -3031,7 +3036,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
gso_type |= SKB_GSO_GRE;
else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
gso_type |= SKB_GSO_IPXIP6;
- else
+ else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
gso_type |= SKB_GSO_IPXIP4;
if (flags & BPF_F_ADJ_ROOM_ENCAP_L4_GRE ||
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 3/4] bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 16:57 ` alan.maguire
-1 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
To: willemb, ast, daniel, davem, shuah, kafai, songliubraving, yhs,
quentin.monnet, john.fastabend, rdna, linux-kselftest, netdev,
bpf
Cc: Alan Maguire
Sync include/uapi/linux/bpf.h with tools/ equivalent to add
BPF_F_ADJ_ROOM_ENCAP_L2(len) macro.
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
tools/include/uapi/linux/bpf.h | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 8370245..912391c 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1500,6 +1500,10 @@ struct bpf_stack_build_id {
* * **BPF_F_ADJ_ROOM_ENCAP_L4_UDP **:
* Use with ENCAP_L3 flags to further specify the tunnel type.
*
+ * * **BPF_F_ADJ_ROOM_ENCAP_L2(len) **:
+ * Use with ENCAP_L3/L4 flags to further specify the tunnel
+ * type; **len** is the length of the inner MAC header.
+ *
* A call to this helper is susceptible to change the underlaying
* packet buffer. Therefore, at load time, all checks on pointers
* previously done by the verifier are invalidated and must be
@@ -2641,10 +2645,16 @@ enum bpf_func_id {
/* BPF_FUNC_skb_adjust_room flags. */
#define BPF_F_ADJ_ROOM_FIXED_GSO (1ULL << 0)
+#define BPF_ADJ_ROOM_ENCAP_L2_MASK 0xff
+#define BPF_ADJ_ROOM_ENCAP_L2_SHIFT 56
+
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 (1ULL << 1)
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV6 (1ULL << 2)
#define BPF_F_ADJ_ROOM_ENCAP_L4_GRE (1ULL << 3)
#define BPF_F_ADJ_ROOM_ENCAP_L4_UDP (1ULL << 4)
+#define BPF_F_ADJ_ROOM_ENCAP_L2(len) (((__u64)len & \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK) \
+ << BPF_ADJ_ROOM_ENCAP_L2_SHIFT)
/* Mode for BPF_FUNC_skb_adjust_room helper. */
enum bpf_adj_room_mode {
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 3/4] bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: alan.maguire @ 2019-04-08 16:57 UTC (permalink / raw)
Sync include/uapi/linux/bpf.h with tools/ equivalent to add
BPF_F_ADJ_ROOM_ENCAP_L2(len) macro.
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
tools/include/uapi/linux/bpf.h | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 8370245..912391c 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1500,6 +1500,10 @@ struct bpf_stack_build_id {
* * **BPF_F_ADJ_ROOM_ENCAP_L4_UDP **:
* Use with ENCAP_L3 flags to further specify the tunnel type.
*
+ * * **BPF_F_ADJ_ROOM_ENCAP_L2(len) **:
+ * Use with ENCAP_L3/L4 flags to further specify the tunnel
+ * type; **len** is the length of the inner MAC header.
+ *
* A call to this helper is susceptible to change the underlaying
* packet buffer. Therefore, at load time, all checks on pointers
* previously done by the verifier are invalidated and must be
@@ -2641,10 +2645,16 @@ enum bpf_func_id {
/* BPF_FUNC_skb_adjust_room flags. */
#define BPF_F_ADJ_ROOM_FIXED_GSO (1ULL << 0)
+#define BPF_ADJ_ROOM_ENCAP_L2_MASK 0xff
+#define BPF_ADJ_ROOM_ENCAP_L2_SHIFT 56
+
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 (1ULL << 1)
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV6 (1ULL << 2)
#define BPF_F_ADJ_ROOM_ENCAP_L4_GRE (1ULL << 3)
#define BPF_F_ADJ_ROOM_ENCAP_L4_UDP (1ULL << 4)
+#define BPF_F_ADJ_ROOM_ENCAP_L2(len) (((__u64)len & \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK) \
+ << BPF_ADJ_ROOM_ENCAP_L2_SHIFT)
/* Mode for BPF_FUNC_skb_adjust_room helper. */
enum bpf_adj_room_mode {
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 3/4] bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
Sync include/uapi/linux/bpf.h with tools/ equivalent to add
BPF_F_ADJ_ROOM_ENCAP_L2(len) macro.
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
tools/include/uapi/linux/bpf.h | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 8370245..912391c 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1500,6 +1500,10 @@ struct bpf_stack_build_id {
* * **BPF_F_ADJ_ROOM_ENCAP_L4_UDP **:
* Use with ENCAP_L3 flags to further specify the tunnel type.
*
+ * * **BPF_F_ADJ_ROOM_ENCAP_L2(len) **:
+ * Use with ENCAP_L3/L4 flags to further specify the tunnel
+ * type; **len** is the length of the inner MAC header.
+ *
* A call to this helper is susceptible to change the underlaying
* packet buffer. Therefore, at load time, all checks on pointers
* previously done by the verifier are invalidated and must be
@@ -2641,10 +2645,16 @@ enum bpf_func_id {
/* BPF_FUNC_skb_adjust_room flags. */
#define BPF_F_ADJ_ROOM_FIXED_GSO (1ULL << 0)
+#define BPF_ADJ_ROOM_ENCAP_L2_MASK 0xff
+#define BPF_ADJ_ROOM_ENCAP_L2_SHIFT 56
+
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 (1ULL << 1)
#define BPF_F_ADJ_ROOM_ENCAP_L3_IPV6 (1ULL << 2)
#define BPF_F_ADJ_ROOM_ENCAP_L4_GRE (1ULL << 3)
#define BPF_F_ADJ_ROOM_ENCAP_L4_UDP (1ULL << 4)
+#define BPF_F_ADJ_ROOM_ENCAP_L2(len) (((__u64)len & \
+ BPF_ADJ_ROOM_ENCAP_L2_MASK) \
+ << BPF_ADJ_ROOM_ENCAP_L2_SHIFT)
/* Mode for BPF_FUNC_skb_adjust_room helper. */
enum bpf_adj_room_mode {
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 4/4] selftests_bpf: add L2 encap to test_tc_tunnel
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 16:57 ` alan.maguire
-1 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
To: willemb, ast, daniel, davem, shuah, kafai, songliubraving, yhs,
quentin.monnet, john.fastabend, rdna, linux-kselftest, netdev,
bpf
Cc: Alan Maguire
Update test_tc_tunnel to verify adding inner L2 header
encapsulation (an MPLS label or ethernet header) works.
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 232 ++++++++++++++++++---
tools/testing/selftests/bpf/test_tc_tunnel.sh | 121 +++++++----
2 files changed, 286 insertions(+), 67 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
index 7745a12..86c5a4e 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
@@ -11,6 +11,7 @@
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
+#include <linux/mpls.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/pkt_cls.h>
@@ -23,6 +24,15 @@
static const int cfg_udp_src = 20000;
static const int cfg_udp_dst = 5555;
+/* MPLSoverUDP */
+#define MPLS_OVER_UDP_PORT 6635
+static const int cfg_mplsudp_dst = MPLS_OVER_UDP_PORT;
+#define ETH_OVER_UDP_PORT 7777
+static const int cfg_ethudp_dst = ETH_OVER_UDP_PORT;
+
+/* MPLS label 1000 with S bit (last label) set and ttl of 255. */
+static const __u32 mpls_label = __bpf_constant_htonl(1000 << 12 |
+ MPLS_LS_S_MASK | 0xff);
struct gre_hdr {
__be16 flags;
@@ -37,11 +47,13 @@ struct gre_hdr {
struct v4hdr {
struct iphdr ip;
union l4hdr l4hdr;
+ __u8 pad[16]; /* enough space for l2 header */
} __attribute__((packed));
struct v6hdr {
struct ipv6hdr ip;
union l4hdr l4hdr;
+ __u8 pad[16]; /* enough space for l2 header */
} __attribute__((packed));
static __always_inline void set_ipv4_csum(struct iphdr *iph)
@@ -59,14 +71,16 @@ static __always_inline void set_ipv4_csum(struct iphdr *iph)
iph->check = ~((csum & 0xffff) + (csum >> 16));
}
-static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
+static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
+ __u16 l2_proto)
{
+ __u32 udp_dst = cfg_udp_dst;
struct iphdr iph_inner;
struct v4hdr h_outer;
struct udphdr *udph;
struct tcphdr tcph;
+ int olen, l2_len;
__u64 flags;
- int olen;
if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
sizeof(iph_inner)) < 0)
@@ -84,23 +98,38 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
olen = sizeof(h_outer.ip);
+ l2_len = 0;
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
+
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ l2_len = sizeof(mpls_label);
+ udp_dst = cfg_mplsudp_dst;
+ break;
+ case ETH_P_TEB:
+ l2_len = ETH_HLEN;
+ udp_dst = cfg_ethudp_dst;
+ break;
+ }
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
+
switch (encap_proto) {
case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
olen += sizeof(h_outer.l4hdr.gre);
- h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IP);
+ h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
h_outer.l4hdr.gre.flags = 0;
break;
case IPPROTO_UDP:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
olen += sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
- h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
h_outer.l4hdr.udp.check = 0;
h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
- sizeof(h_outer.l4hdr.udp));
+ sizeof(h_outer.l4hdr.udp) +
+ l2_len);
break;
case IPPROTO_IPIP:
break;
@@ -108,6 +137,20 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
+ /* add L2 encap (if specified) */
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ *((__u32 *)((__u8 *)&h_outer + olen)) = mpls_label;
+ break;
+ case ETH_P_TEB:
+ if (bpf_skb_load_bytes(skb, 0, (__u8 *)&h_outer + olen,
+ ETH_HLEN))
+ return TC_ACT_SHOT;
+ break;
+ }
+
+ olen += l2_len;
+
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -115,7 +158,7 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.tot_len = bpf_htons(olen +
- bpf_htons(h_outer.ip.tot_len));
+ bpf_ntohs(h_outer.ip.tot_len));
h_outer.ip.protocol = encap_proto;
set_ipv4_csum(&h_outer.ip);
@@ -128,14 +171,16 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
-static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
+static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto,
+ __u16 l2_proto)
{
+ __u16 udp_dst = cfg_udp_dst;
struct ipv6hdr iph_inner;
struct v6hdr h_outer;
struct tcphdr tcph;
+ int olen, l2_len;
__u16 tot_len;
__u64 flags;
- int olen;
if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
sizeof(iph_inner)) < 0)
@@ -150,20 +195,34 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
olen = sizeof(h_outer.ip);
+ l2_len = 0;
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
+
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ l2_len = sizeof(mpls_label);
+ udp_dst = cfg_mplsudp_dst;
+ break;
+ case ETH_P_TEB:
+ l2_len = ETH_HLEN;
+ udp_dst = cfg_ethudp_dst;
+ break;
+ }
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
+
switch (encap_proto) {
case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
olen += sizeof(h_outer.l4hdr.gre);
- h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IPV6);
+ h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
h_outer.l4hdr.gre.flags = 0;
break;
case IPPROTO_UDP:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
olen += sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
- h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.check = 0;
@@ -175,6 +234,20 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
+ /* add L2 encap (if specified) */
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ *((__u32 *)((__u8 *)&h_outer + olen)) = mpls_label;
+ break;
+ case ETH_P_TEB:
+ if (bpf_skb_load_bytes(skb, 0, (__u8 *)&h_outer + olen,
+ ETH_HLEN))
+ return TC_ACT_SHOT;
+ break;
+ }
+
+ olen += l2_len;
+
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -182,7 +255,7 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.payload_len = bpf_htons(olen +
- bpf_ntohs(h_outer.ip.payload_len));
+ bpf_ntohs(iph_inner.payload_len));
h_outer.ip.nexthdr = encap_proto;
@@ -194,63 +267,138 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
-SEC("encap_ipip")
-int __encap_ipip(struct __sk_buff *skb)
+SEC("encap_ipip_none")
+int __encap_ipip_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_IPIP, ETH_P_IP);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_gre_none")
+int __encap_gre_none(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_IPIP);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_IP);
else
return TC_ACT_OK;
}
-SEC("encap_gre")
-int __encap_gre(struct __sk_buff *skb)
+SEC("encap_gre_mpls")
+int __encap_gre_mpls(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_GRE);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
else
return TC_ACT_OK;
}
-SEC("encap_udp")
-int __encap_udp(struct __sk_buff *skb)
+SEC("encap_gre_eth")
+int __encap_gre_eth(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_UDP);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_TEB);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_none")
+int __encap_udp_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_IP);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_mpls")
+int __encap_udp_mpls(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_eth")
+int __encap_udp_eth(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_TEB);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6tnl_none")
+int __encap_ip6tnl_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_IPV6, ETH_P_IPV6);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_none")
+int __encap_ip6gre_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_IPV6);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_mpls")
+int __encap_ip6gre_mpls(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_eth")
+int __encap_ip6gre_eth(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_TEB);
else
return TC_ACT_OK;
}
-SEC("encap_ip6tnl")
-int __encap_ip6tnl(struct __sk_buff *skb)
+SEC("encap_ip6udp_none")
+int __encap_ip6udp_none(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_IPV6);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_IPV6);
else
return TC_ACT_OK;
}
-SEC("encap_ip6gre")
-int __encap_ip6gre(struct __sk_buff *skb)
+SEC("encap_ip6udp_mpls")
+int __encap_ip6udp_mpls(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_GRE);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
else
return TC_ACT_OK;
}
-SEC("encap_ip6udp")
-int __encap_ip6udp(struct __sk_buff *skb)
+SEC("encap_ip6udp_eth")
+int __encap_ip6udp_eth(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_UDP);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_TEB);
else
return TC_ACT_OK;
}
-static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
+static __always_inline int decap_internal(struct __sk_buff *skb, int off,
+ int len, char proto)
{
char buf[sizeof(struct v6hdr)];
+ struct gre_hdr greh;
+ struct udphdr udph;
int olen = len;
switch (proto) {
@@ -259,9 +407,29 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
break;
case IPPROTO_GRE:
olen += sizeof(struct gre_hdr);
+ if (bpf_skb_load_bytes(skb, off + len, &greh, sizeof(greh)) < 0)
+ return TC_ACT_OK;
+ switch (bpf_ntohs(greh.protocol)) {
+ case ETH_P_MPLS_UC:
+ olen += sizeof(mpls_label);
+ break;
+ case ETH_P_TEB:
+ olen += ETH_HLEN;
+ break;
+ }
break;
case IPPROTO_UDP:
olen += sizeof(struct udphdr);
+ if (bpf_skb_load_bytes(skb, off + len, &udph, sizeof(udph)) < 0)
+ return TC_ACT_OK;
+ switch (bpf_ntohs(udph.dest)) {
+ case MPLS_OVER_UDP_PORT:
+ olen += sizeof(mpls_label);
+ break;
+ case ETH_OVER_UDP_PORT:
+ olen += ETH_HLEN;
+ break;
+ }
break;
default:
return TC_ACT_OK;
@@ -274,7 +442,7 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
return TC_ACT_OK;
}
-static int decap_ipv4(struct __sk_buff *skb)
+static __always_inline int decap_ipv4(struct __sk_buff *skb)
{
struct iphdr iph_outer;
@@ -289,7 +457,7 @@ static int decap_ipv4(struct __sk_buff *skb)
iph_outer.protocol);
}
-static int decap_ipv6(struct __sk_buff *skb)
+static __always_inline int decap_ipv6(struct __sk_buff *skb)
{
struct ipv6hdr iph_outer;
diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
index f87d645..385d16b 100755
--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
@@ -17,6 +17,9 @@ readonly ns2_v6=fd::2
# Must match port used by bpf program
readonly udpport=5555
+# MPLSoverUDP
+readonly mplsudpport=6635
+readonly mplsproto=137
readonly infile="$(mktemp)"
readonly outfile="$(mktemp)"
@@ -41,8 +44,8 @@ setup() {
# clamp route to reserve room for tunnel headers
ip -netns "${ns1}" -4 route flush table main
ip -netns "${ns1}" -6 route flush table main
- ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1472 dev veth1
- ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1452 dev veth1
+ ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1458 dev veth1
+ ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1438 dev veth1
sleep 1
@@ -89,42 +92,44 @@ set -e
# no arguments: automated test, run all
if [[ "$#" -eq "0" ]]; then
echo "ipip"
- $0 ipv4 ipip 100
+ $0 ipv4 ipip none 100
echo "ip6ip6"
- $0 ipv6 ip6tnl 100
+ $0 ipv6 ip6tnl none 100
- echo "ip gre"
- $0 ipv4 gre 100
+ for mac in none mpls eth ; do
+ echo "ip gre"
+ $0 ipv4 gre $mac 100
- echo "ip6 gre"
- $0 ipv6 ip6gre 100
+ echo "ip6 gre"
+ $0 ipv6 ip6gre $mac 100
- echo "ip gre gso"
- $0 ipv4 gre 2000
+ echo "ip gre $mac gso"
+ $0 ipv4 gre $mac 2000
- echo "ip6 gre gso"
- $0 ipv6 ip6gre 2000
+ echo "ip6 gre $mac gso"
+ $0 ipv6 ip6gre $mac 2000
- echo "ip udp"
- $0 ipv4 udp 100
+ echo "ip udp $mac"
+ $0 ipv4 udp $mac 100
- echo "ip6 udp"
- $0 ipv6 ip6udp 100
+ echo "ip6 udp $mac"
+ $0 ipv6 ip6udp $mac 100
- echo "ip udp gso"
- $0 ipv4 udp 2000
+ echo "ip udp $mac gso"
+ $0 ipv4 udp $mac 2000
- echo "ip6 udp gso"
- $0 ipv6 ip6udp 2000
+ echo "ip6 udp $mac gso"
+ $0 ipv6 ip6udp $mac 2000
+ done
echo "OK. All tests passed"
exit 0
fi
-if [[ "$#" -ne "3" ]]; then
+if [[ "$#" -ne "4" ]]; then
echo "Usage: $0"
- echo " or: $0 <ipv4|ipv6> <tuntype> <data_len>"
+ echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls> <data_len>"
exit 1
fi
@@ -137,6 +142,8 @@ case "$1" in
readonly foumod=fou
readonly foutype=ipip
readonly fouproto=4
+ readonly fouproto_mpls=${mplsproto}
+ readonly gretaptype=gretap
;;
"ipv6")
readonly addr1="${ns1_v6}"
@@ -146,6 +153,8 @@ case "$1" in
readonly foumod=fou6
readonly foutype=ip6tnl
readonly fouproto="41 -6"
+ readonly fouproto_mpls="${mplsproto} -6"
+ readonly gretaptype=ip6gretap
;;
*)
echo "unknown arg: $1"
@@ -154,9 +163,10 @@ case "$1" in
esac
readonly tuntype=$2
-readonly datalen=$3
+readonly mac=$3
+readonly datalen=$4
-echo "encap ${addr1} to ${addr2}, type ${tuntype}, len ${datalen}"
+echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
trap cleanup EXIT
@@ -173,7 +183,7 @@ verify_data
ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
ip netns exec "${ns1}" tc filter add dev veth1 egress \
bpf direct-action object-file ./test_tc_tunnel.o \
- section "encap_${tuntype}"
+ section "encap_${tuntype}_${mac}"
echo "test bpf encap without decap (expect failure)"
server_listen
! client_connect
@@ -182,19 +192,54 @@ server_listen
# server is still running
# client can connect again
+tmode=""
+targs=""
+
if [[ "$tuntype" =~ "udp" ]]; then
- # Set up fou tunnel.
- ttype="${foutype}"
- targs="encap fou encap-sport auto encap-dport $udpport"
# fou may be a module; allow this to fail.
modprobe "${foumod}" ||true
- ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
+ if [[ "$mac" == "mpls" ]]; then
+ dport=${mplsudpport}
+ dproto=${fouproto_mpls}
+ tmode="mode any ttl 255"
+ else
+ dport=${udpport}
+ dproto=${fouproto}
+ fi
+ ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
+ ttype="${foutype}"
+ targs="encap fou encap-sport auto encap-dport $dport"
+elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
+ ttype=$gretaptype
else
ttype=$tuntype
- targs=""
fi
ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
- remote "${addr1}" local "${addr2}" $targs
+ ${tmode} remote "${addr1}" local "${addr2}" $targs
+
+expect_tun_fail=0
+
+if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
+ # No support for MPLS IPv6 fou tunnel; expect failure.
+ expect_tun_fail=1
+elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
+ # No support for TEB fou tunnel; expect failure.
+ expect_tun_fail=1
+elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
+ # Share ethernet address between tunnel/veth2 so L2 decap works.
+ ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
+ awk '/ether/ { print $2 }')
+ ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
+elif [[ "$mac" == "mpls" ]]; then
+ modprobe mpls_iptunnel ||true
+ modprobe mpls_gso ||true
+ ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
+ ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
+ ip netns exec "${ns2}" ip link set lo up
+ ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
+ ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
+fi
+
# Because packets are decapped by the tunnel they arrive on testtun0
# from the IP stack perspective. Ensure reverse path filtering is
# disabled otherwise we drop the TCP SYN as arriving on testtun0
@@ -205,12 +250,18 @@ ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
# selected as the max of the "all" and device-specific values.
ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
ip netns exec "${ns2}" ip link set dev testtun0 up
-echo "test bpf encap with tunnel device decap"
-client_connect
-verify_data
+if [[ "$expect_tun_fail" == 1 ]]; then
+ # This tunnel mode is not supported, so we expect failure.
+ echo "test bpf encap with tunnel device decap (expect failure)"
+ ! client_connect
+else
+ echo "test bpf encap with tunnel device decap"
+ client_connect
+ verify_data
+ server_listen
+fi
ip netns exec "${ns2}" ip link del dev testtun0
-server_listen
# serverside, use BPF for decap
ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
ip netns exec "${ns2}" tc filter add dev veth2 ingress \
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 4/4] selftests_bpf: add L2 encap to test_tc_tunnel
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: alan.maguire @ 2019-04-08 16:57 UTC (permalink / raw)
Update test_tc_tunnel to verify adding inner L2 header
encapsulation (an MPLS label or ethernet header) works.
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 232 ++++++++++++++++++---
tools/testing/selftests/bpf/test_tc_tunnel.sh | 121 +++++++----
2 files changed, 286 insertions(+), 67 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
index 7745a12..86c5a4e 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
@@ -11,6 +11,7 @@
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
+#include <linux/mpls.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/pkt_cls.h>
@@ -23,6 +24,15 @@
static const int cfg_udp_src = 20000;
static const int cfg_udp_dst = 5555;
+/* MPLSoverUDP */
+#define MPLS_OVER_UDP_PORT 6635
+static const int cfg_mplsudp_dst = MPLS_OVER_UDP_PORT;
+#define ETH_OVER_UDP_PORT 7777
+static const int cfg_ethudp_dst = ETH_OVER_UDP_PORT;
+
+/* MPLS label 1000 with S bit (last label) set and ttl of 255. */
+static const __u32 mpls_label = __bpf_constant_htonl(1000 << 12 |
+ MPLS_LS_S_MASK | 0xff);
struct gre_hdr {
__be16 flags;
@@ -37,11 +47,13 @@ struct gre_hdr {
struct v4hdr {
struct iphdr ip;
union l4hdr l4hdr;
+ __u8 pad[16]; /* enough space for l2 header */
} __attribute__((packed));
struct v6hdr {
struct ipv6hdr ip;
union l4hdr l4hdr;
+ __u8 pad[16]; /* enough space for l2 header */
} __attribute__((packed));
static __always_inline void set_ipv4_csum(struct iphdr *iph)
@@ -59,14 +71,16 @@ static __always_inline void set_ipv4_csum(struct iphdr *iph)
iph->check = ~((csum & 0xffff) + (csum >> 16));
}
-static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
+static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
+ __u16 l2_proto)
{
+ __u32 udp_dst = cfg_udp_dst;
struct iphdr iph_inner;
struct v4hdr h_outer;
struct udphdr *udph;
struct tcphdr tcph;
+ int olen, l2_len;
__u64 flags;
- int olen;
if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
sizeof(iph_inner)) < 0)
@@ -84,23 +98,38 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
olen = sizeof(h_outer.ip);
+ l2_len = 0;
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
+
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ l2_len = sizeof(mpls_label);
+ udp_dst = cfg_mplsudp_dst;
+ break;
+ case ETH_P_TEB:
+ l2_len = ETH_HLEN;
+ udp_dst = cfg_ethudp_dst;
+ break;
+ }
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
+
switch (encap_proto) {
case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
olen += sizeof(h_outer.l4hdr.gre);
- h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IP);
+ h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
h_outer.l4hdr.gre.flags = 0;
break;
case IPPROTO_UDP:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
olen += sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
- h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
h_outer.l4hdr.udp.check = 0;
h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
- sizeof(h_outer.l4hdr.udp));
+ sizeof(h_outer.l4hdr.udp) +
+ l2_len);
break;
case IPPROTO_IPIP:
break;
@@ -108,6 +137,20 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
+ /* add L2 encap (if specified) */
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ *((__u32 *)((__u8 *)&h_outer + olen)) = mpls_label;
+ break;
+ case ETH_P_TEB:
+ if (bpf_skb_load_bytes(skb, 0, (__u8 *)&h_outer + olen,
+ ETH_HLEN))
+ return TC_ACT_SHOT;
+ break;
+ }
+
+ olen += l2_len;
+
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -115,7 +158,7 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.tot_len = bpf_htons(olen +
- bpf_htons(h_outer.ip.tot_len));
+ bpf_ntohs(h_outer.ip.tot_len));
h_outer.ip.protocol = encap_proto;
set_ipv4_csum(&h_outer.ip);
@@ -128,14 +171,16 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
-static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
+static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto,
+ __u16 l2_proto)
{
+ __u16 udp_dst = cfg_udp_dst;
struct ipv6hdr iph_inner;
struct v6hdr h_outer;
struct tcphdr tcph;
+ int olen, l2_len;
__u16 tot_len;
__u64 flags;
- int olen;
if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
sizeof(iph_inner)) < 0)
@@ -150,20 +195,34 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
olen = sizeof(h_outer.ip);
+ l2_len = 0;
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
+
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ l2_len = sizeof(mpls_label);
+ udp_dst = cfg_mplsudp_dst;
+ break;
+ case ETH_P_TEB:
+ l2_len = ETH_HLEN;
+ udp_dst = cfg_ethudp_dst;
+ break;
+ }
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
+
switch (encap_proto) {
case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
olen += sizeof(h_outer.l4hdr.gre);
- h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IPV6);
+ h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
h_outer.l4hdr.gre.flags = 0;
break;
case IPPROTO_UDP:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
olen += sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
- h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.check = 0;
@@ -175,6 +234,20 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
+ /* add L2 encap (if specified) */
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ *((__u32 *)((__u8 *)&h_outer + olen)) = mpls_label;
+ break;
+ case ETH_P_TEB:
+ if (bpf_skb_load_bytes(skb, 0, (__u8 *)&h_outer + olen,
+ ETH_HLEN))
+ return TC_ACT_SHOT;
+ break;
+ }
+
+ olen += l2_len;
+
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -182,7 +255,7 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.payload_len = bpf_htons(olen +
- bpf_ntohs(h_outer.ip.payload_len));
+ bpf_ntohs(iph_inner.payload_len));
h_outer.ip.nexthdr = encap_proto;
@@ -194,63 +267,138 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
-SEC("encap_ipip")
-int __encap_ipip(struct __sk_buff *skb)
+SEC("encap_ipip_none")
+int __encap_ipip_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_IPIP, ETH_P_IP);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_gre_none")
+int __encap_gre_none(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_IPIP);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_IP);
else
return TC_ACT_OK;
}
-SEC("encap_gre")
-int __encap_gre(struct __sk_buff *skb)
+SEC("encap_gre_mpls")
+int __encap_gre_mpls(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_GRE);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
else
return TC_ACT_OK;
}
-SEC("encap_udp")
-int __encap_udp(struct __sk_buff *skb)
+SEC("encap_gre_eth")
+int __encap_gre_eth(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_UDP);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_TEB);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_none")
+int __encap_udp_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_IP);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_mpls")
+int __encap_udp_mpls(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_eth")
+int __encap_udp_eth(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_TEB);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6tnl_none")
+int __encap_ip6tnl_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_IPV6, ETH_P_IPV6);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_none")
+int __encap_ip6gre_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_IPV6);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_mpls")
+int __encap_ip6gre_mpls(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_eth")
+int __encap_ip6gre_eth(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_TEB);
else
return TC_ACT_OK;
}
-SEC("encap_ip6tnl")
-int __encap_ip6tnl(struct __sk_buff *skb)
+SEC("encap_ip6udp_none")
+int __encap_ip6udp_none(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_IPV6);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_IPV6);
else
return TC_ACT_OK;
}
-SEC("encap_ip6gre")
-int __encap_ip6gre(struct __sk_buff *skb)
+SEC("encap_ip6udp_mpls")
+int __encap_ip6udp_mpls(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_GRE);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
else
return TC_ACT_OK;
}
-SEC("encap_ip6udp")
-int __encap_ip6udp(struct __sk_buff *skb)
+SEC("encap_ip6udp_eth")
+int __encap_ip6udp_eth(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_UDP);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_TEB);
else
return TC_ACT_OK;
}
-static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
+static __always_inline int decap_internal(struct __sk_buff *skb, int off,
+ int len, char proto)
{
char buf[sizeof(struct v6hdr)];
+ struct gre_hdr greh;
+ struct udphdr udph;
int olen = len;
switch (proto) {
@@ -259,9 +407,29 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
break;
case IPPROTO_GRE:
olen += sizeof(struct gre_hdr);
+ if (bpf_skb_load_bytes(skb, off + len, &greh, sizeof(greh)) < 0)
+ return TC_ACT_OK;
+ switch (bpf_ntohs(greh.protocol)) {
+ case ETH_P_MPLS_UC:
+ olen += sizeof(mpls_label);
+ break;
+ case ETH_P_TEB:
+ olen += ETH_HLEN;
+ break;
+ }
break;
case IPPROTO_UDP:
olen += sizeof(struct udphdr);
+ if (bpf_skb_load_bytes(skb, off + len, &udph, sizeof(udph)) < 0)
+ return TC_ACT_OK;
+ switch (bpf_ntohs(udph.dest)) {
+ case MPLS_OVER_UDP_PORT:
+ olen += sizeof(mpls_label);
+ break;
+ case ETH_OVER_UDP_PORT:
+ olen += ETH_HLEN;
+ break;
+ }
break;
default:
return TC_ACT_OK;
@@ -274,7 +442,7 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
return TC_ACT_OK;
}
-static int decap_ipv4(struct __sk_buff *skb)
+static __always_inline int decap_ipv4(struct __sk_buff *skb)
{
struct iphdr iph_outer;
@@ -289,7 +457,7 @@ static int decap_ipv4(struct __sk_buff *skb)
iph_outer.protocol);
}
-static int decap_ipv6(struct __sk_buff *skb)
+static __always_inline int decap_ipv6(struct __sk_buff *skb)
{
struct ipv6hdr iph_outer;
diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
index f87d645..385d16b 100755
--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
@@ -17,6 +17,9 @@ readonly ns2_v6=fd::2
# Must match port used by bpf program
readonly udpport=5555
+# MPLSoverUDP
+readonly mplsudpport=6635
+readonly mplsproto=137
readonly infile="$(mktemp)"
readonly outfile="$(mktemp)"
@@ -41,8 +44,8 @@ setup() {
# clamp route to reserve room for tunnel headers
ip -netns "${ns1}" -4 route flush table main
ip -netns "${ns1}" -6 route flush table main
- ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1472 dev veth1
- ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1452 dev veth1
+ ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1458 dev veth1
+ ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1438 dev veth1
sleep 1
@@ -89,42 +92,44 @@ set -e
# no arguments: automated test, run all
if [[ "$#" -eq "0" ]]; then
echo "ipip"
- $0 ipv4 ipip 100
+ $0 ipv4 ipip none 100
echo "ip6ip6"
- $0 ipv6 ip6tnl 100
+ $0 ipv6 ip6tnl none 100
- echo "ip gre"
- $0 ipv4 gre 100
+ for mac in none mpls eth ; do
+ echo "ip gre"
+ $0 ipv4 gre $mac 100
- echo "ip6 gre"
- $0 ipv6 ip6gre 100
+ echo "ip6 gre"
+ $0 ipv6 ip6gre $mac 100
- echo "ip gre gso"
- $0 ipv4 gre 2000
+ echo "ip gre $mac gso"
+ $0 ipv4 gre $mac 2000
- echo "ip6 gre gso"
- $0 ipv6 ip6gre 2000
+ echo "ip6 gre $mac gso"
+ $0 ipv6 ip6gre $mac 2000
- echo "ip udp"
- $0 ipv4 udp 100
+ echo "ip udp $mac"
+ $0 ipv4 udp $mac 100
- echo "ip6 udp"
- $0 ipv6 ip6udp 100
+ echo "ip6 udp $mac"
+ $0 ipv6 ip6udp $mac 100
- echo "ip udp gso"
- $0 ipv4 udp 2000
+ echo "ip udp $mac gso"
+ $0 ipv4 udp $mac 2000
- echo "ip6 udp gso"
- $0 ipv6 ip6udp 2000
+ echo "ip6 udp $mac gso"
+ $0 ipv6 ip6udp $mac 2000
+ done
echo "OK. All tests passed"
exit 0
fi
-if [[ "$#" -ne "3" ]]; then
+if [[ "$#" -ne "4" ]]; then
echo "Usage: $0"
- echo " or: $0 <ipv4|ipv6> <tuntype> <data_len>"
+ echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls> <data_len>"
exit 1
fi
@@ -137,6 +142,8 @@ case "$1" in
readonly foumod=fou
readonly foutype=ipip
readonly fouproto=4
+ readonly fouproto_mpls=${mplsproto}
+ readonly gretaptype=gretap
;;
"ipv6")
readonly addr1="${ns1_v6}"
@@ -146,6 +153,8 @@ case "$1" in
readonly foumod=fou6
readonly foutype=ip6tnl
readonly fouproto="41 -6"
+ readonly fouproto_mpls="${mplsproto} -6"
+ readonly gretaptype=ip6gretap
;;
*)
echo "unknown arg: $1"
@@ -154,9 +163,10 @@ case "$1" in
esac
readonly tuntype=$2
-readonly datalen=$3
+readonly mac=$3
+readonly datalen=$4
-echo "encap ${addr1} to ${addr2}, type ${tuntype}, len ${datalen}"
+echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
trap cleanup EXIT
@@ -173,7 +183,7 @@ verify_data
ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
ip netns exec "${ns1}" tc filter add dev veth1 egress \
bpf direct-action object-file ./test_tc_tunnel.o \
- section "encap_${tuntype}"
+ section "encap_${tuntype}_${mac}"
echo "test bpf encap without decap (expect failure)"
server_listen
! client_connect
@@ -182,19 +192,54 @@ server_listen
# server is still running
# client can connect again
+tmode=""
+targs=""
+
if [[ "$tuntype" =~ "udp" ]]; then
- # Set up fou tunnel.
- ttype="${foutype}"
- targs="encap fou encap-sport auto encap-dport $udpport"
# fou may be a module; allow this to fail.
modprobe "${foumod}" ||true
- ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
+ if [[ "$mac" == "mpls" ]]; then
+ dport=${mplsudpport}
+ dproto=${fouproto_mpls}
+ tmode="mode any ttl 255"
+ else
+ dport=${udpport}
+ dproto=${fouproto}
+ fi
+ ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
+ ttype="${foutype}"
+ targs="encap fou encap-sport auto encap-dport $dport"
+elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
+ ttype=$gretaptype
else
ttype=$tuntype
- targs=""
fi
ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
- remote "${addr1}" local "${addr2}" $targs
+ ${tmode} remote "${addr1}" local "${addr2}" $targs
+
+expect_tun_fail=0
+
+if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
+ # No support for MPLS IPv6 fou tunnel; expect failure.
+ expect_tun_fail=1
+elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
+ # No support for TEB fou tunnel; expect failure.
+ expect_tun_fail=1
+elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
+ # Share ethernet address between tunnel/veth2 so L2 decap works.
+ ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
+ awk '/ether/ { print $2 }')
+ ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
+elif [[ "$mac" == "mpls" ]]; then
+ modprobe mpls_iptunnel ||true
+ modprobe mpls_gso ||true
+ ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
+ ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
+ ip netns exec "${ns2}" ip link set lo up
+ ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
+ ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
+fi
+
# Because packets are decapped by the tunnel they arrive on testtun0
# from the IP stack perspective. Ensure reverse path filtering is
# disabled otherwise we drop the TCP SYN as arriving on testtun0
@@ -205,12 +250,18 @@ ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
# selected as the max of the "all" and device-specific values.
ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
ip netns exec "${ns2}" ip link set dev testtun0 up
-echo "test bpf encap with tunnel device decap"
-client_connect
-verify_data
+if [[ "$expect_tun_fail" == 1 ]]; then
+ # This tunnel mode is not supported, so we expect failure.
+ echo "test bpf encap with tunnel device decap (expect failure)"
+ ! client_connect
+else
+ echo "test bpf encap with tunnel device decap"
+ client_connect
+ verify_data
+ server_listen
+fi
ip netns exec "${ns2}" ip link del dev testtun0
-server_listen
# serverside, use BPF for decap
ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
ip netns exec "${ns2}" tc filter add dev veth2 ingress \
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 4/4] selftests_bpf: add L2 encap to test_tc_tunnel
@ 2019-04-08 16:57 ` alan.maguire
0 siblings, 0 replies; 27+ messages in thread
From: Alan Maguire @ 2019-04-08 16:57 UTC (permalink / raw)
Update test_tc_tunnel to verify adding inner L2 header
encapsulation (an MPLS label or ethernet header) works.
Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
---
tools/testing/selftests/bpf/progs/test_tc_tunnel.c | 232 ++++++++++++++++++---
tools/testing/selftests/bpf/test_tc_tunnel.sh | 121 +++++++----
2 files changed, 286 insertions(+), 67 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
index 7745a12..86c5a4e 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
@@ -11,6 +11,7 @@
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
+#include <linux/mpls.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/pkt_cls.h>
@@ -23,6 +24,15 @@
static const int cfg_udp_src = 20000;
static const int cfg_udp_dst = 5555;
+/* MPLSoverUDP */
+#define MPLS_OVER_UDP_PORT 6635
+static const int cfg_mplsudp_dst = MPLS_OVER_UDP_PORT;
+#define ETH_OVER_UDP_PORT 7777
+static const int cfg_ethudp_dst = ETH_OVER_UDP_PORT;
+
+/* MPLS label 1000 with S bit (last label) set and ttl of 255. */
+static const __u32 mpls_label = __bpf_constant_htonl(1000 << 12 |
+ MPLS_LS_S_MASK | 0xff);
struct gre_hdr {
__be16 flags;
@@ -37,11 +47,13 @@ struct gre_hdr {
struct v4hdr {
struct iphdr ip;
union l4hdr l4hdr;
+ __u8 pad[16]; /* enough space for l2 header */
} __attribute__((packed));
struct v6hdr {
struct ipv6hdr ip;
union l4hdr l4hdr;
+ __u8 pad[16]; /* enough space for l2 header */
} __attribute__((packed));
static __always_inline void set_ipv4_csum(struct iphdr *iph)
@@ -59,14 +71,16 @@ static __always_inline void set_ipv4_csum(struct iphdr *iph)
iph->check = ~((csum & 0xffff) + (csum >> 16));
}
-static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
+static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
+ __u16 l2_proto)
{
+ __u32 udp_dst = cfg_udp_dst;
struct iphdr iph_inner;
struct v4hdr h_outer;
struct udphdr *udph;
struct tcphdr tcph;
+ int olen, l2_len;
__u64 flags;
- int olen;
if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
sizeof(iph_inner)) < 0)
@@ -84,23 +98,38 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
olen = sizeof(h_outer.ip);
+ l2_len = 0;
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
+
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ l2_len = sizeof(mpls_label);
+ udp_dst = cfg_mplsudp_dst;
+ break;
+ case ETH_P_TEB:
+ l2_len = ETH_HLEN;
+ udp_dst = cfg_ethudp_dst;
+ break;
+ }
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
+
switch (encap_proto) {
case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
olen += sizeof(h_outer.l4hdr.gre);
- h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IP);
+ h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
h_outer.l4hdr.gre.flags = 0;
break;
case IPPROTO_UDP:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
olen += sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
- h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
h_outer.l4hdr.udp.check = 0;
h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
- sizeof(h_outer.l4hdr.udp));
+ sizeof(h_outer.l4hdr.udp) +
+ l2_len);
break;
case IPPROTO_IPIP:
break;
@@ -108,6 +137,20 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
+ /* add L2 encap (if specified) */
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ *((__u32 *)((__u8 *)&h_outer + olen)) = mpls_label;
+ break;
+ case ETH_P_TEB:
+ if (bpf_skb_load_bytes(skb, 0, (__u8 *)&h_outer + olen,
+ ETH_HLEN))
+ return TC_ACT_SHOT;
+ break;
+ }
+
+ olen += l2_len;
+
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -115,7 +158,7 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.tot_len = bpf_htons(olen +
- bpf_htons(h_outer.ip.tot_len));
+ bpf_ntohs(h_outer.ip.tot_len));
h_outer.ip.protocol = encap_proto;
set_ipv4_csum(&h_outer.ip);
@@ -128,14 +171,16 @@ static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
-static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
+static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto,
+ __u16 l2_proto)
{
+ __u16 udp_dst = cfg_udp_dst;
struct ipv6hdr iph_inner;
struct v6hdr h_outer;
struct tcphdr tcph;
+ int olen, l2_len;
__u16 tot_len;
__u64 flags;
- int olen;
if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
sizeof(iph_inner)) < 0)
@@ -150,20 +195,34 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
olen = sizeof(h_outer.ip);
+ l2_len = 0;
flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
+
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ l2_len = sizeof(mpls_label);
+ udp_dst = cfg_mplsudp_dst;
+ break;
+ case ETH_P_TEB:
+ l2_len = ETH_HLEN;
+ udp_dst = cfg_ethudp_dst;
+ break;
+ }
+ flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
+
switch (encap_proto) {
case IPPROTO_GRE:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
olen += sizeof(h_outer.l4hdr.gre);
- h_outer.l4hdr.gre.protocol = bpf_htons(ETH_P_IPV6);
+ h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
h_outer.l4hdr.gre.flags = 0;
break;
case IPPROTO_UDP:
flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
olen += sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
- h_outer.l4hdr.udp.dest = __bpf_constant_htons(cfg_udp_dst);
+ h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
sizeof(h_outer.l4hdr.udp);
h_outer.l4hdr.udp.check = 0;
@@ -175,6 +234,20 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
+ /* add L2 encap (if specified) */
+ switch (l2_proto) {
+ case ETH_P_MPLS_UC:
+ *((__u32 *)((__u8 *)&h_outer + olen)) = mpls_label;
+ break;
+ case ETH_P_TEB:
+ if (bpf_skb_load_bytes(skb, 0, (__u8 *)&h_outer + olen,
+ ETH_HLEN))
+ return TC_ACT_SHOT;
+ break;
+ }
+
+ olen += l2_len;
+
/* add room between mac and network header */
if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
@@ -182,7 +255,7 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
/* prepare new outer network header */
h_outer.ip = iph_inner;
h_outer.ip.payload_len = bpf_htons(olen +
- bpf_ntohs(h_outer.ip.payload_len));
+ bpf_ntohs(iph_inner.payload_len));
h_outer.ip.nexthdr = encap_proto;
@@ -194,63 +267,138 @@ static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto)
return TC_ACT_OK;
}
-SEC("encap_ipip")
-int __encap_ipip(struct __sk_buff *skb)
+SEC("encap_ipip_none")
+int __encap_ipip_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_IPIP, ETH_P_IP);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_gre_none")
+int __encap_gre_none(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_IPIP);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_IP);
else
return TC_ACT_OK;
}
-SEC("encap_gre")
-int __encap_gre(struct __sk_buff *skb)
+SEC("encap_gre_mpls")
+int __encap_gre_mpls(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_GRE);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
else
return TC_ACT_OK;
}
-SEC("encap_udp")
-int __encap_udp(struct __sk_buff *skb)
+SEC("encap_gre_eth")
+int __encap_gre_eth(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
- return encap_ipv4(skb, IPPROTO_UDP);
+ return encap_ipv4(skb, IPPROTO_GRE, ETH_P_TEB);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_none")
+int __encap_udp_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_IP);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_mpls")
+int __encap_udp_mpls(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_udp_eth")
+int __encap_udp_eth(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
+ return encap_ipv4(skb, IPPROTO_UDP, ETH_P_TEB);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6tnl_none")
+int __encap_ip6tnl_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_IPV6, ETH_P_IPV6);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_none")
+int __encap_ip6gre_none(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_IPV6);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_mpls")
+int __encap_ip6gre_mpls(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
+ else
+ return TC_ACT_OK;
+}
+
+SEC("encap_ip6gre_eth")
+int __encap_ip6gre_eth(struct __sk_buff *skb)
+{
+ if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
+ return encap_ipv6(skb, IPPROTO_GRE, ETH_P_TEB);
else
return TC_ACT_OK;
}
-SEC("encap_ip6tnl")
-int __encap_ip6tnl(struct __sk_buff *skb)
+SEC("encap_ip6udp_none")
+int __encap_ip6udp_none(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_IPV6);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_IPV6);
else
return TC_ACT_OK;
}
-SEC("encap_ip6gre")
-int __encap_ip6gre(struct __sk_buff *skb)
+SEC("encap_ip6udp_mpls")
+int __encap_ip6udp_mpls(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_GRE);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
else
return TC_ACT_OK;
}
-SEC("encap_ip6udp")
-int __encap_ip6udp(struct __sk_buff *skb)
+SEC("encap_ip6udp_eth")
+int __encap_ip6udp_eth(struct __sk_buff *skb)
{
if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
- return encap_ipv6(skb, IPPROTO_UDP);
+ return encap_ipv6(skb, IPPROTO_UDP, ETH_P_TEB);
else
return TC_ACT_OK;
}
-static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
+static __always_inline int decap_internal(struct __sk_buff *skb, int off,
+ int len, char proto)
{
char buf[sizeof(struct v6hdr)];
+ struct gre_hdr greh;
+ struct udphdr udph;
int olen = len;
switch (proto) {
@@ -259,9 +407,29 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
break;
case IPPROTO_GRE:
olen += sizeof(struct gre_hdr);
+ if (bpf_skb_load_bytes(skb, off + len, &greh, sizeof(greh)) < 0)
+ return TC_ACT_OK;
+ switch (bpf_ntohs(greh.protocol)) {
+ case ETH_P_MPLS_UC:
+ olen += sizeof(mpls_label);
+ break;
+ case ETH_P_TEB:
+ olen += ETH_HLEN;
+ break;
+ }
break;
case IPPROTO_UDP:
olen += sizeof(struct udphdr);
+ if (bpf_skb_load_bytes(skb, off + len, &udph, sizeof(udph)) < 0)
+ return TC_ACT_OK;
+ switch (bpf_ntohs(udph.dest)) {
+ case MPLS_OVER_UDP_PORT:
+ olen += sizeof(mpls_label);
+ break;
+ case ETH_OVER_UDP_PORT:
+ olen += ETH_HLEN;
+ break;
+ }
break;
default:
return TC_ACT_OK;
@@ -274,7 +442,7 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
return TC_ACT_OK;
}
-static int decap_ipv4(struct __sk_buff *skb)
+static __always_inline int decap_ipv4(struct __sk_buff *skb)
{
struct iphdr iph_outer;
@@ -289,7 +457,7 @@ static int decap_ipv4(struct __sk_buff *skb)
iph_outer.protocol);
}
-static int decap_ipv6(struct __sk_buff *skb)
+static __always_inline int decap_ipv6(struct __sk_buff *skb)
{
struct ipv6hdr iph_outer;
diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
index f87d645..385d16b 100755
--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
@@ -17,6 +17,9 @@ readonly ns2_v6=fd::2
# Must match port used by bpf program
readonly udpport=5555
+# MPLSoverUDP
+readonly mplsudpport=6635
+readonly mplsproto=137
readonly infile="$(mktemp)"
readonly outfile="$(mktemp)"
@@ -41,8 +44,8 @@ setup() {
# clamp route to reserve room for tunnel headers
ip -netns "${ns1}" -4 route flush table main
ip -netns "${ns1}" -6 route flush table main
- ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1472 dev veth1
- ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1452 dev veth1
+ ip -netns "${ns1}" -4 route add "${ns2_v4}" mtu 1458 dev veth1
+ ip -netns "${ns1}" -6 route add "${ns2_v6}" mtu 1438 dev veth1
sleep 1
@@ -89,42 +92,44 @@ set -e
# no arguments: automated test, run all
if [[ "$#" -eq "0" ]]; then
echo "ipip"
- $0 ipv4 ipip 100
+ $0 ipv4 ipip none 100
echo "ip6ip6"
- $0 ipv6 ip6tnl 100
+ $0 ipv6 ip6tnl none 100
- echo "ip gre"
- $0 ipv4 gre 100
+ for mac in none mpls eth ; do
+ echo "ip gre"
+ $0 ipv4 gre $mac 100
- echo "ip6 gre"
- $0 ipv6 ip6gre 100
+ echo "ip6 gre"
+ $0 ipv6 ip6gre $mac 100
- echo "ip gre gso"
- $0 ipv4 gre 2000
+ echo "ip gre $mac gso"
+ $0 ipv4 gre $mac 2000
- echo "ip6 gre gso"
- $0 ipv6 ip6gre 2000
+ echo "ip6 gre $mac gso"
+ $0 ipv6 ip6gre $mac 2000
- echo "ip udp"
- $0 ipv4 udp 100
+ echo "ip udp $mac"
+ $0 ipv4 udp $mac 100
- echo "ip6 udp"
- $0 ipv6 ip6udp 100
+ echo "ip6 udp $mac"
+ $0 ipv6 ip6udp $mac 100
- echo "ip udp gso"
- $0 ipv4 udp 2000
+ echo "ip udp $mac gso"
+ $0 ipv4 udp $mac 2000
- echo "ip6 udp gso"
- $0 ipv6 ip6udp 2000
+ echo "ip6 udp $mac gso"
+ $0 ipv6 ip6udp $mac 2000
+ done
echo "OK. All tests passed"
exit 0
fi
-if [[ "$#" -ne "3" ]]; then
+if [[ "$#" -ne "4" ]]; then
echo "Usage: $0"
- echo " or: $0 <ipv4|ipv6> <tuntype> <data_len>"
+ echo " or: $0 <ipv4|ipv6> <tuntype> <none|mpls> <data_len>"
exit 1
fi
@@ -137,6 +142,8 @@ case "$1" in
readonly foumod=fou
readonly foutype=ipip
readonly fouproto=4
+ readonly fouproto_mpls=${mplsproto}
+ readonly gretaptype=gretap
;;
"ipv6")
readonly addr1="${ns1_v6}"
@@ -146,6 +153,8 @@ case "$1" in
readonly foumod=fou6
readonly foutype=ip6tnl
readonly fouproto="41 -6"
+ readonly fouproto_mpls="${mplsproto} -6"
+ readonly gretaptype=ip6gretap
;;
*)
echo "unknown arg: $1"
@@ -154,9 +163,10 @@ case "$1" in
esac
readonly tuntype=$2
-readonly datalen=$3
+readonly mac=$3
+readonly datalen=$4
-echo "encap ${addr1} to ${addr2}, type ${tuntype}, len ${datalen}"
+echo "encap ${addr1} to ${addr2}, type ${tuntype}, mac ${mac} len ${datalen}"
trap cleanup EXIT
@@ -173,7 +183,7 @@ verify_data
ip netns exec "${ns1}" tc qdisc add dev veth1 clsact
ip netns exec "${ns1}" tc filter add dev veth1 egress \
bpf direct-action object-file ./test_tc_tunnel.o \
- section "encap_${tuntype}"
+ section "encap_${tuntype}_${mac}"
echo "test bpf encap without decap (expect failure)"
server_listen
! client_connect
@@ -182,19 +192,54 @@ server_listen
# server is still running
# client can connect again
+tmode=""
+targs=""
+
if [[ "$tuntype" =~ "udp" ]]; then
- # Set up fou tunnel.
- ttype="${foutype}"
- targs="encap fou encap-sport auto encap-dport $udpport"
# fou may be a module; allow this to fail.
modprobe "${foumod}" ||true
- ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
+ if [[ "$mac" == "mpls" ]]; then
+ dport=${mplsudpport}
+ dproto=${fouproto_mpls}
+ tmode="mode any ttl 255"
+ else
+ dport=${udpport}
+ dproto=${fouproto}
+ fi
+ ip netns exec "${ns2}" ip fou add port $dport ipproto ${dproto}
+ ttype="${foutype}"
+ targs="encap fou encap-sport auto encap-dport $dport"
+elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
+ ttype=$gretaptype
else
ttype=$tuntype
- targs=""
fi
ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
- remote "${addr1}" local "${addr2}" $targs
+ ${tmode} remote "${addr1}" local "${addr2}" $targs
+
+expect_tun_fail=0
+
+if [[ "$tuntype" == "ip6udp" && "$mac" == "mpls" ]]; then
+ # No support for MPLS IPv6 fou tunnel; expect failure.
+ expect_tun_fail=1
+elif [[ "$tuntype" =~ "udp" && "$mac" == "eth" ]]; then
+ # No support for TEB fou tunnel; expect failure.
+ expect_tun_fail=1
+elif [[ "$tuntype" =~ "gre" && "$mac" == "eth" ]]; then
+ # Share ethernet address between tunnel/veth2 so L2 decap works.
+ ethaddr=$(ip netns exec "${ns2}" ip link show veth2 | \
+ awk '/ether/ { print $2 }')
+ ip netns exec "${ns2}" ip link set testtun0 address $ethaddr
+elif [[ "$mac" == "mpls" ]]; then
+ modprobe mpls_iptunnel ||true
+ modprobe mpls_gso ||true
+ ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
+ ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
+ ip netns exec "${ns2}" ip link set lo up
+ ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
+ ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
+fi
+
# Because packets are decapped by the tunnel they arrive on testtun0
# from the IP stack perspective. Ensure reverse path filtering is
# disabled otherwise we drop the TCP SYN as arriving on testtun0
@@ -205,12 +250,18 @@ ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
# selected as the max of the "all" and device-specific values.
ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.testtun0.rp_filter=0
ip netns exec "${ns2}" ip link set dev testtun0 up
-echo "test bpf encap with tunnel device decap"
-client_connect
-verify_data
+if [[ "$expect_tun_fail" == 1 ]]; then
+ # This tunnel mode is not supported, so we expect failure.
+ echo "test bpf encap with tunnel device decap (expect failure)"
+ ! client_connect
+else
+ echo "test bpf encap with tunnel device decap"
+ client_connect
+ verify_data
+ server_listen
+fi
ip netns exec "${ns2}" ip link del dev testtun0
-server_listen
# serverside, use BPF for decap
ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
ip netns exec "${ns2}" tc filter add dev veth2 ingress \
--
1.8.3.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* Re: [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 19:07 ` willemdebruijn.kernel
-1 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
To: Alan Maguire
Cc: Willem de Bruijn, Alexei Starovoitov, Daniel Borkmann,
David Miller, Shuah Khan, Martin KaFai Lau, songliubraving, yhs,
quentin.monnet, John Fastabend, rdna, linux-kselftest,
Network Development, bpf
On Mon, Apr 8, 2019 at 12:59 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> Extend bpf_skb_adjust_room growth to mark inner MAC header so that
> L2 encapsulation can be used for tc tunnels.
>
> Patch #1 extends the existing test_tc_tunnel to support UDP
> encapsulation; later we want to be able to test MPLS over UDP and
> MPLS over GRE encapsulation.
>
> Patch #2 adds the BPF_F_ADJ_ROOM_ENCAP_L2(len) macro, which
> allows specification of inner mac length. Other approaches were
> explored prior to taking this approach. Specifically, I tried
> automatically computing the inner mac length on the basis of the
> specified flags (so inner maclen for GRE/IPv4 encap is the len_diff
> specified to bpf_skb_adjust_room minus GRE + IPv4 header length
> for example). Problem with this is that we don't know for sure
> what form of GRE/UDP header we have; is it a full GRE header,
> or is it a FOU UDP header or generic UDP encap header? My fear
> here was we'd end up with an explosion of flags. The other approach
> tried was to support inner L2 header marking as a separate room
> adjustment, i.e. adjust for L3/L4 encap, then call
> bpf_skb_adjust_room for L2 encap. This can be made to work but
> because it imposed an order on operations, felt a bit clunky.
>
> Patch #3 syncs tools/ bpf.h.
>
> Patch #4 extends the tests again to support MPLSoverGRE,
> MPLSoverUDP, and transparent ethernet bridging (TEB) where
> the inner L2 header is an ethernet header. Testing of BPF
> encap against tunnels is done for cases where configuration
> of such tunnels is possible (MPLSoverGRE[6], MPLSoverUDP,
> gre[6]tap), and skipped otherwise. Testing of BPF encap/decap
> is always carried out.
>
> Changes since v1:
> - fixed formatting of commit references.
> - BPF_F_ADJ_ROOM_FIXED_GSO flag enabled on all variants (patch 1)
> - fixed fou6 options for UDP encap; checksum errors observed were
> due to the fact fou6 tunnel was not set up with correct ipproto
> options (41 -6). 0 checksums work fine (patch 1)
> - added definitions for mask and shift used in setting L2 length
> (patch 2)
> - allow udp encap with fixed GSO (patch 2)
> - changed "elen" to "l2_len" to be more descriptive (patch 4)
> - added support for ethernet L2 encap to tests; testing against
> gre[6]tap tunnels (patch 4).
>
> Alan Maguire (4):
> selftests_bpf: add UDP encap to test_tc_tunnel
> bpf: add layer 2 encap support to bpf_skb_adjust_room
> bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
> selftests_bpf: add L2 encap to test_tc_tunnel
A few small nits in the patches, but overall this looks great. Thanks
a lot for adding the detailed tests for UDP, TEB and MPLS!
The only change that may really be needed is adding mpls to the config
to avoid kselftest bot failures. Otherwise, I would not even have
bothered pointing out the nits.
With that change, for the series,
Acked-by: Willem de Bruijn <willemb@google.com>
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: willemdebruijn.kernel @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019 at 12:59 PM Alan Maguire <alan.maguire at oracle.com> wrote:
>
> Extend bpf_skb_adjust_room growth to mark inner MAC header so that
> L2 encapsulation can be used for tc tunnels.
>
> Patch #1 extends the existing test_tc_tunnel to support UDP
> encapsulation; later we want to be able to test MPLS over UDP and
> MPLS over GRE encapsulation.
>
> Patch #2 adds the BPF_F_ADJ_ROOM_ENCAP_L2(len) macro, which
> allows specification of inner mac length. Other approaches were
> explored prior to taking this approach. Specifically, I tried
> automatically computing the inner mac length on the basis of the
> specified flags (so inner maclen for GRE/IPv4 encap is the len_diff
> specified to bpf_skb_adjust_room minus GRE + IPv4 header length
> for example). Problem with this is that we don't know for sure
> what form of GRE/UDP header we have; is it a full GRE header,
> or is it a FOU UDP header or generic UDP encap header? My fear
> here was we'd end up with an explosion of flags. The other approach
> tried was to support inner L2 header marking as a separate room
> adjustment, i.e. adjust for L3/L4 encap, then call
> bpf_skb_adjust_room for L2 encap. This can be made to work but
> because it imposed an order on operations, felt a bit clunky.
>
> Patch #3 syncs tools/ bpf.h.
>
> Patch #4 extends the tests again to support MPLSoverGRE,
> MPLSoverUDP, and transparent ethernet bridging (TEB) where
> the inner L2 header is an ethernet header. Testing of BPF
> encap against tunnels is done for cases where configuration
> of such tunnels is possible (MPLSoverGRE[6], MPLSoverUDP,
> gre[6]tap), and skipped otherwise. Testing of BPF encap/decap
> is always carried out.
>
> Changes since v1:
> - fixed formatting of commit references.
> - BPF_F_ADJ_ROOM_FIXED_GSO flag enabled on all variants (patch 1)
> - fixed fou6 options for UDP encap; checksum errors observed were
> due to the fact fou6 tunnel was not set up with correct ipproto
> options (41 -6). 0 checksums work fine (patch 1)
> - added definitions for mask and shift used in setting L2 length
> (patch 2)
> - allow udp encap with fixed GSO (patch 2)
> - changed "elen" to "l2_len" to be more descriptive (patch 4)
> - added support for ethernet L2 encap to tests; testing against
> gre[6]tap tunnels (patch 4).
>
> Alan Maguire (4):
> selftests_bpf: add UDP encap to test_tc_tunnel
> bpf: add layer 2 encap support to bpf_skb_adjust_room
> bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
> selftests_bpf: add L2 encap to test_tc_tunnel
A few small nits in the patches, but overall this looks great. Thanks
a lot for adding the detailed tests for UDP, TEB and MPLS!
The only change that may really be needed is adding mpls to the config
to avoid kselftest bot failures. Otherwise, I would not even have
bothered pointing out the nits.
With that change, for the series,
Acked-by: Willem de Bruijn <willemb at google.com>
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019@12:59 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> Extend bpf_skb_adjust_room growth to mark inner MAC header so that
> L2 encapsulation can be used for tc tunnels.
>
> Patch #1 extends the existing test_tc_tunnel to support UDP
> encapsulation; later we want to be able to test MPLS over UDP and
> MPLS over GRE encapsulation.
>
> Patch #2 adds the BPF_F_ADJ_ROOM_ENCAP_L2(len) macro, which
> allows specification of inner mac length. Other approaches were
> explored prior to taking this approach. Specifically, I tried
> automatically computing the inner mac length on the basis of the
> specified flags (so inner maclen for GRE/IPv4 encap is the len_diff
> specified to bpf_skb_adjust_room minus GRE + IPv4 header length
> for example). Problem with this is that we don't know for sure
> what form of GRE/UDP header we have; is it a full GRE header,
> or is it a FOU UDP header or generic UDP encap header? My fear
> here was we'd end up with an explosion of flags. The other approach
> tried was to support inner L2 header marking as a separate room
> adjustment, i.e. adjust for L3/L4 encap, then call
> bpf_skb_adjust_room for L2 encap. This can be made to work but
> because it imposed an order on operations, felt a bit clunky.
>
> Patch #3 syncs tools/ bpf.h.
>
> Patch #4 extends the tests again to support MPLSoverGRE,
> MPLSoverUDP, and transparent ethernet bridging (TEB) where
> the inner L2 header is an ethernet header. Testing of BPF
> encap against tunnels is done for cases where configuration
> of such tunnels is possible (MPLSoverGRE[6], MPLSoverUDP,
> gre[6]tap), and skipped otherwise. Testing of BPF encap/decap
> is always carried out.
>
> Changes since v1:
> - fixed formatting of commit references.
> - BPF_F_ADJ_ROOM_FIXED_GSO flag enabled on all variants (patch 1)
> - fixed fou6 options for UDP encap; checksum errors observed were
> due to the fact fou6 tunnel was not set up with correct ipproto
> options (41 -6). 0 checksums work fine (patch 1)
> - added definitions for mask and shift used in setting L2 length
> (patch 2)
> - allow udp encap with fixed GSO (patch 2)
> - changed "elen" to "l2_len" to be more descriptive (patch 4)
> - added support for ethernet L2 encap to tests; testing against
> gre[6]tap tunnels (patch 4).
>
> Alan Maguire (4):
> selftests_bpf: add UDP encap to test_tc_tunnel
> bpf: add layer 2 encap support to bpf_skb_adjust_room
> bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2
> selftests_bpf: add L2 encap to test_tc_tunnel
A few small nits in the patches, but overall this looks great. Thanks
a lot for adding the detailed tests for UDP, TEB and MPLS!
The only change that may really be needed is adding mpls to the config
to avoid kselftest bot failures. Otherwise, I would not even have
bothered pointing out the nits.
With that change, for the series,
Acked-by: Willem de Bruijn <willemb at google.com>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v2 bpf-next 4/4] selftests_bpf: add L2 encap to test_tc_tunnel
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 19:07 ` willemdebruijn.kernel
-1 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
To: Alan Maguire
Cc: Willem de Bruijn, Alexei Starovoitov, Daniel Borkmann,
David Miller, Shuah Khan, Martin KaFai Lau, songliubraving, yhs,
quentin.monnet, John Fastabend, rdna, linux-kselftest,
Network Development, bpf
On Mon, Apr 8, 2019 at 12:59 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> Update test_tc_tunnel to verify adding inner L2 header
> encapsulation (an MPLS label or ethernet header) works.
>
> Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
> static const int cfg_udp_src = 20000;
> static const int cfg_udp_dst = 5555;
> +/* MPLSoverUDP */
> +#define MPLS_OVER_UDP_PORT 6635
> +static const int cfg_mplsudp_dst = MPLS_OVER_UDP_PORT;
> +#define ETH_OVER_UDP_PORT 7777
> +static const int cfg_ethudp_dst = ETH_OVER_UDP_PORT;
nit: static const variables not really needed if duplicating the macro.
> -static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
> +static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
> + __u16 l2_proto)
> {
> + __u32 udp_dst = cfg_udp_dst;
nit: __u16 (as in encap_ipv6)
> -static int decap_ipv4(struct __sk_buff *skb)
> +static __always_inline int decap_ipv4(struct __sk_buff *skb)
unnecessary change? also for decap_ipv6
> +elif [[ "$mac" == "mpls" ]]; then
> + modprobe mpls_iptunnel ||true
> + modprobe mpls_gso ||true
this requires adding CONFIG_MPLS and CONFIG_MPLS_IPTUNNEL to
tools/testing/selftests/bpf/config
> + ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
> + ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
> + ip netns exec "${ns2}" ip link set lo up
> + ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
> + ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
> +fi
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 4/4] selftests_bpf: add L2 encap to test_tc_tunnel
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: willemdebruijn.kernel @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019 at 12:59 PM Alan Maguire <alan.maguire at oracle.com> wrote:
>
> Update test_tc_tunnel to verify adding inner L2 header
> encapsulation (an MPLS label or ethernet header) works.
>
> Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
> static const int cfg_udp_src = 20000;
> static const int cfg_udp_dst = 5555;
> +/* MPLSoverUDP */
> +#define MPLS_OVER_UDP_PORT 6635
> +static const int cfg_mplsudp_dst = MPLS_OVER_UDP_PORT;
> +#define ETH_OVER_UDP_PORT 7777
> +static const int cfg_ethudp_dst = ETH_OVER_UDP_PORT;
nit: static const variables not really needed if duplicating the macro.
> -static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
> +static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
> + __u16 l2_proto)
> {
> + __u32 udp_dst = cfg_udp_dst;
nit: __u16 (as in encap_ipv6)
> -static int decap_ipv4(struct __sk_buff *skb)
> +static __always_inline int decap_ipv4(struct __sk_buff *skb)
unnecessary change? also for decap_ipv6
> +elif [[ "$mac" == "mpls" ]]; then
> + modprobe mpls_iptunnel ||true
> + modprobe mpls_gso ||true
this requires adding CONFIG_MPLS and CONFIG_MPLS_IPTUNNEL to
tools/testing/selftests/bpf/config
> + ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
> + ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
> + ip netns exec "${ns2}" ip link set lo up
> + ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
> + ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
> +fi
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 4/4] selftests_bpf: add L2 encap to test_tc_tunnel
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019@12:59 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> Update test_tc_tunnel to verify adding inner L2 header
> encapsulation (an MPLS label or ethernet header) works.
>
> Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
> static const int cfg_udp_src = 20000;
> static const int cfg_udp_dst = 5555;
> +/* MPLSoverUDP */
> +#define MPLS_OVER_UDP_PORT 6635
> +static const int cfg_mplsudp_dst = MPLS_OVER_UDP_PORT;
> +#define ETH_OVER_UDP_PORT 7777
> +static const int cfg_ethudp_dst = ETH_OVER_UDP_PORT;
nit: static const variables not really needed if duplicating the macro.
> -static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto)
> +static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
> + __u16 l2_proto)
> {
> + __u32 udp_dst = cfg_udp_dst;
nit: __u16 (as in encap_ipv6)
> -static int decap_ipv4(struct __sk_buff *skb)
> +static __always_inline int decap_ipv4(struct __sk_buff *skb)
unnecessary change? also for decap_ipv6
> +elif [[ "$mac" == "mpls" ]]; then
> + modprobe mpls_iptunnel ||true
> + modprobe mpls_gso ||true
this requires adding CONFIG_MPLS and CONFIG_MPLS_IPTUNNEL to
tools/testing/selftests/bpf/config
> + ip netns exec "${ns2}" sysctl -qw net.mpls.platform_labels=65536
> + ip netns exec "${ns2}" ip -f mpls route add 1000 dev lo
> + ip netns exec "${ns2}" ip link set lo up
> + ip netns exec "${ns2}" sysctl -qw net.mpls.conf.testtun0.input=1
> + ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.lo.rp_filter=0
> +fi
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v2 bpf-next 2/4] bpf: add layer 2 encap support to bpf_skb_adjust_room
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 19:07 ` willemdebruijn.kernel
-1 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
To: Alan Maguire
Cc: Willem de Bruijn, Alexei Starovoitov, Daniel Borkmann,
David Miller, Shuah Khan, Martin KaFai Lau, songliubraving, yhs,
quentin.monnet, John Fastabend, rdna, linux-kselftest,
Network Development, bpf
On Mon, Apr 8, 2019 at 12:59 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
> introduced support to bpf_skb_adjust_room for GSO-friendly GRE
> and UDP encapsulation.
>
> For GSO to work for skbs, the inner headers (mac and network) need to
> be marked. For L3 encapsulation using bpf_skb_adjust_room, the mac
> and network headers are identical. Here we provide a way of specifying
> the inner mac header length for cases where L2 encap is desired. Such
> an approach can support encapsulated ethernet headers, MPLS headers etc.
> For example to convert from a packet of form [eth][ip][tcp] to
> [eth][ip][udp][inner mac][ip][tcp], something like the following could
> be done:
>
> headroom = sizeof(iph) + sizeof(struct udphdr) + inner_maclen;
>
> ret = bpf_skb_adjust_room(skb, headroom, BPF_ADJ_ROOM_MAC,
> BPF_F_ADJ_ROOM_ENCAP_L4_UDP |
> BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 |
> BPF_F_ADJ_ROOM_ENCAP_L2(inner_maclen));
>
> Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
> static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
> u64 flags)
> {
> + u16 mac_len = 0, inner_mac = 0, inner_net = 0, inner_trans = 0;
> bool encap = flags & BPF_F_ADJ_ROOM_ENCAP_L3_MASK;
> - u16 mac_len = 0, inner_net = 0, inner_trans = 0;
> unsigned int gso_type = SKB_GSO_DODGY;
> + u8 inner_mac_len = flags >> BPF_ADJ_ROOM_ENCAP_L2_SHIFT;
> int ret;
>
> if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
> @@ -3008,6 +3011,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
>
> mac_len = skb->network_header - skb->mac_header;
> inner_net = skb->network_header;
> + if (inner_mac_len > len_diff)
> + return -EINVAL;
> + inner_mac = inner_net - inner_mac_len;
nit: variable inner_mac is not needed.
> @@ -3031,7 +3036,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
> gso_type |= SKB_GSO_GRE;
> else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
> gso_type |= SKB_GSO_IPXIP6;
> - else
> + else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
> gso_type |= SKB_GSO_IPXIP4;
Nice catch. L2 encap should also work without L3 encap.
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 2/4] bpf: add layer 2 encap support to bpf_skb_adjust_room
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: willemdebruijn.kernel @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019 at 12:59 PM Alan Maguire <alan.maguire at oracle.com> wrote:
>
> commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
> introduced support to bpf_skb_adjust_room for GSO-friendly GRE
> and UDP encapsulation.
>
> For GSO to work for skbs, the inner headers (mac and network) need to
> be marked. For L3 encapsulation using bpf_skb_adjust_room, the mac
> and network headers are identical. Here we provide a way of specifying
> the inner mac header length for cases where L2 encap is desired. Such
> an approach can support encapsulated ethernet headers, MPLS headers etc.
> For example to convert from a packet of form [eth][ip][tcp] to
> [eth][ip][udp][inner mac][ip][tcp], something like the following could
> be done:
>
> headroom = sizeof(iph) + sizeof(struct udphdr) + inner_maclen;
>
> ret = bpf_skb_adjust_room(skb, headroom, BPF_ADJ_ROOM_MAC,
> BPF_F_ADJ_ROOM_ENCAP_L4_UDP |
> BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 |
> BPF_F_ADJ_ROOM_ENCAP_L2(inner_maclen));
>
> Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
> static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
> u64 flags)
> {
> + u16 mac_len = 0, inner_mac = 0, inner_net = 0, inner_trans = 0;
> bool encap = flags & BPF_F_ADJ_ROOM_ENCAP_L3_MASK;
> - u16 mac_len = 0, inner_net = 0, inner_trans = 0;
> unsigned int gso_type = SKB_GSO_DODGY;
> + u8 inner_mac_len = flags >> BPF_ADJ_ROOM_ENCAP_L2_SHIFT;
> int ret;
>
> if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
> @@ -3008,6 +3011,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
>
> mac_len = skb->network_header - skb->mac_header;
> inner_net = skb->network_header;
> + if (inner_mac_len > len_diff)
> + return -EINVAL;
> + inner_mac = inner_net - inner_mac_len;
nit: variable inner_mac is not needed.
> @@ -3031,7 +3036,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
> gso_type |= SKB_GSO_GRE;
> else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
> gso_type |= SKB_GSO_IPXIP6;
> - else
> + else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
> gso_type |= SKB_GSO_IPXIP4;
Nice catch. L2 encap should also work without L3 encap.
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 2/4] bpf: add layer 2 encap support to bpf_skb_adjust_room
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019@12:59 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
> introduced support to bpf_skb_adjust_room for GSO-friendly GRE
> and UDP encapsulation.
>
> For GSO to work for skbs, the inner headers (mac and network) need to
> be marked. For L3 encapsulation using bpf_skb_adjust_room, the mac
> and network headers are identical. Here we provide a way of specifying
> the inner mac header length for cases where L2 encap is desired. Such
> an approach can support encapsulated ethernet headers, MPLS headers etc.
> For example to convert from a packet of form [eth][ip][tcp] to
> [eth][ip][udp][inner mac][ip][tcp], something like the following could
> be done:
>
> headroom = sizeof(iph) + sizeof(struct udphdr) + inner_maclen;
>
> ret = bpf_skb_adjust_room(skb, headroom, BPF_ADJ_ROOM_MAC,
> BPF_F_ADJ_ROOM_ENCAP_L4_UDP |
> BPF_F_ADJ_ROOM_ENCAP_L3_IPV4 |
> BPF_F_ADJ_ROOM_ENCAP_L2(inner_maclen));
>
> Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
> static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
> u64 flags)
> {
> + u16 mac_len = 0, inner_mac = 0, inner_net = 0, inner_trans = 0;
> bool encap = flags & BPF_F_ADJ_ROOM_ENCAP_L3_MASK;
> - u16 mac_len = 0, inner_net = 0, inner_trans = 0;
> unsigned int gso_type = SKB_GSO_DODGY;
> + u8 inner_mac_len = flags >> BPF_ADJ_ROOM_ENCAP_L2_SHIFT;
> int ret;
>
> if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
> @@ -3008,6 +3011,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
>
> mac_len = skb->network_header - skb->mac_header;
> inner_net = skb->network_header;
> + if (inner_mac_len > len_diff)
> + return -EINVAL;
> + inner_mac = inner_net - inner_mac_len;
nit: variable inner_mac is not needed.
> @@ -3031,7 +3036,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
> gso_type |= SKB_GSO_GRE;
> else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6)
> gso_type |= SKB_GSO_IPXIP6;
> - else
> + else if (flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4)
> gso_type |= SKB_GSO_IPXIP4;
Nice catch. L2 encap should also work without L3 encap.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v2 bpf-next 1/4] selftests_bpf: add UDP encap to test_tc_tunnel
2019-04-08 16:57 ` alan.maguire
(?)
@ 2019-04-08 19:07 ` willemdebruijn.kernel
-1 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
To: Alan Maguire
Cc: Willem de Bruijn, Alexei Starovoitov, Daniel Borkmann,
David Miller, Shuah Khan, Martin KaFai Lau, songliubraving, yhs,
quentin.monnet, John Fastabend, rdna, linux-kselftest,
Network Development, bpf
On Mon, Apr 8, 2019 at 1:01 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
> introduced support to bpf_skb_adjust_room for GSO-friendly GRE
> and UDP encapsulation and later introduced associated test_tc_tunnel
> tests. Here those tests are extended to cover UDP encapsulation also.
>
> Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
> + struct v4hdr h_outer;
> + struct udphdr *udph;
nit: unused?
> # serverside, insert decap module
> # server is still running
> # client can connect again
> -ip netns exec "${ns2}" ip link add dev testtun0 type "${tuntype}" \
> - remote "${addr1}" local "${addr2}"
> -# Because packets are decapped by the tunnel they arrive on testtun0 from
> -# the IP stack perspective. Ensure reverse path filtering is disabled
> -# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
> -# expected veth2 (veth2 is where 192.168.1.2 is configured).
> +
> +if [[ "$tuntype" =~ "udp" ]]; then
> + # Set up fou tunnel.
> + ttype="${foutype}"
> + targs="encap fou encap-sport auto encap-dport $udpport"
> + # fou may be a module; allow this to fail.
> + modprobe "${foumod}" ||true
> + ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
> +else
> + ttype=$tuntype
> + targs=""
> +fi
> +ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
> + remote "${addr1}" local "${addr2}" $targs
> +# Because packets are decapped by the tunnel they arrive on testtun0
> +# from the IP stack perspective. Ensure reverse path filtering is
> +# disabled otherwise we drop the TCP SYN as arriving on testtun0
> +# instead of the expected veth2 (veth2 is where 192.168.1.2 is
> +# configured).
nit: these lines are not really part of the change
> ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
> # rp needs to be disabled for both all and testtun0 as the rp value is
> # selected as the max of the "all" and device-specific values.
> @@ -172,13 +208,13 @@ ip netns exec "${ns2}" ip link set dev testtun0 up
> echo "test bpf encap with tunnel device decap"
> client_connect
> verify_data
> +ip netns exec "${ns2}" ip link del dev testtun0
>
> +server_listen
> # serverside, use BPF for decap
> -ip netns exec "${ns2}" ip link del dev testtun0
nit: not needed to move this outside of this block.
> ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
> ip netns exec "${ns2}" tc filter add dev veth2 ingress \
> bpf direct-action object-file ./test_tc_tunnel.o section decap
> -server_listen
> echo "test bpf encap with bpf decap"
> client_connect
> verify_data
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 1/4] selftests_bpf: add UDP encap to test_tc_tunnel
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: willemdebruijn.kernel @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019 at 1:01 PM Alan Maguire <alan.maguire at oracle.com> wrote:
>
> commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
> introduced support to bpf_skb_adjust_room for GSO-friendly GRE
> and UDP encapsulation and later introduced associated test_tc_tunnel
> tests. Here those tests are extended to cover UDP encapsulation also.
>
> Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
> + struct v4hdr h_outer;
> + struct udphdr *udph;
nit: unused?
> # serverside, insert decap module
> # server is still running
> # client can connect again
> -ip netns exec "${ns2}" ip link add dev testtun0 type "${tuntype}" \
> - remote "${addr1}" local "${addr2}"
> -# Because packets are decapped by the tunnel they arrive on testtun0 from
> -# the IP stack perspective. Ensure reverse path filtering is disabled
> -# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
> -# expected veth2 (veth2 is where 192.168.1.2 is configured).
> +
> +if [[ "$tuntype" =~ "udp" ]]; then
> + # Set up fou tunnel.
> + ttype="${foutype}"
> + targs="encap fou encap-sport auto encap-dport $udpport"
> + # fou may be a module; allow this to fail.
> + modprobe "${foumod}" ||true
> + ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
> +else
> + ttype=$tuntype
> + targs=""
> +fi
> +ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
> + remote "${addr1}" local "${addr2}" $targs
> +# Because packets are decapped by the tunnel they arrive on testtun0
> +# from the IP stack perspective. Ensure reverse path filtering is
> +# disabled otherwise we drop the TCP SYN as arriving on testtun0
> +# instead of the expected veth2 (veth2 is where 192.168.1.2 is
> +# configured).
nit: these lines are not really part of the change
> ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
> # rp needs to be disabled for both all and testtun0 as the rp value is
> # selected as the max of the "all" and device-specific values.
> @@ -172,13 +208,13 @@ ip netns exec "${ns2}" ip link set dev testtun0 up
> echo "test bpf encap with tunnel device decap"
> client_connect
> verify_data
> +ip netns exec "${ns2}" ip link del dev testtun0
>
> +server_listen
> # serverside, use BPF for decap
> -ip netns exec "${ns2}" ip link del dev testtun0
nit: not needed to move this outside of this block.
> ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
> ip netns exec "${ns2}" tc filter add dev veth2 ingress \
> bpf direct-action object-file ./test_tc_tunnel.o section decap
> -server_listen
> echo "test bpf encap with bpf decap"
> client_connect
> verify_data
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v2 bpf-next 1/4] selftests_bpf: add UDP encap to test_tc_tunnel
@ 2019-04-08 19:07 ` willemdebruijn.kernel
0 siblings, 0 replies; 27+ messages in thread
From: Willem de Bruijn @ 2019-04-08 19:07 UTC (permalink / raw)
On Mon, Apr 8, 2019@1:01 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> commit 868d523535c2 ("bpf: add bpf_skb_adjust_room encap flags")
> introduced support to bpf_skb_adjust_room for GSO-friendly GRE
> and UDP encapsulation and later introduced associated test_tc_tunnel
> tests. Here those tests are extended to cover UDP encapsulation also.
>
> Signed-off-by: Alan Maguire <alan.maguire at oracle.com>
> + struct v4hdr h_outer;
> + struct udphdr *udph;
nit: unused?
> # serverside, insert decap module
> # server is still running
> # client can connect again
> -ip netns exec "${ns2}" ip link add dev testtun0 type "${tuntype}" \
> - remote "${addr1}" local "${addr2}"
> -# Because packets are decapped by the tunnel they arrive on testtun0 from
> -# the IP stack perspective. Ensure reverse path filtering is disabled
> -# otherwise we drop the TCP SYN as arriving on testtun0 instead of the
> -# expected veth2 (veth2 is where 192.168.1.2 is configured).
> +
> +if [[ "$tuntype" =~ "udp" ]]; then
> + # Set up fou tunnel.
> + ttype="${foutype}"
> + targs="encap fou encap-sport auto encap-dport $udpport"
> + # fou may be a module; allow this to fail.
> + modprobe "${foumod}" ||true
> + ip netns exec "${ns2}" ip fou add port 5555 ipproto ${fouproto}
> +else
> + ttype=$tuntype
> + targs=""
> +fi
> +ip netns exec "${ns2}" ip link add name testtun0 type "${ttype}" \
> + remote "${addr1}" local "${addr2}" $targs
> +# Because packets are decapped by the tunnel they arrive on testtun0
> +# from the IP stack perspective. Ensure reverse path filtering is
> +# disabled otherwise we drop the TCP SYN as arriving on testtun0
> +# instead of the expected veth2 (veth2 is where 192.168.1.2 is
> +# configured).
nit: these lines are not really part of the change
> ip netns exec "${ns2}" sysctl -qw net.ipv4.conf.all.rp_filter=0
> # rp needs to be disabled for both all and testtun0 as the rp value is
> # selected as the max of the "all" and device-specific values.
> @@ -172,13 +208,13 @@ ip netns exec "${ns2}" ip link set dev testtun0 up
> echo "test bpf encap with tunnel device decap"
> client_connect
> verify_data
> +ip netns exec "${ns2}" ip link del dev testtun0
>
> +server_listen
> # serverside, use BPF for decap
> -ip netns exec "${ns2}" ip link del dev testtun0
nit: not needed to move this outside of this block.
> ip netns exec "${ns2}" tc qdisc add dev veth2 clsact
> ip netns exec "${ns2}" tc filter add dev veth2 ingress \
> bpf direct-action object-file ./test_tc_tunnel.o section decap
> -server_listen
> echo "test bpf encap with bpf decap"
> client_connect
> verify_data
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 27+ messages in thread
end of thread, other threads:[~2019-04-08 19:08 UTC | newest]
Thread overview: 27+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-08 16:57 [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room Alan Maguire
2019-04-08 16:57 ` Alan Maguire
2019-04-08 16:57 ` alan.maguire
2019-04-08 16:57 ` [PATCH v2 bpf-next 1/4] selftests_bpf: add UDP encap to test_tc_tunnel Alan Maguire
2019-04-08 16:57 ` Alan Maguire
2019-04-08 16:57 ` alan.maguire
2019-04-08 19:07 ` Willem de Bruijn
2019-04-08 19:07 ` Willem de Bruijn
2019-04-08 19:07 ` willemdebruijn.kernel
2019-04-08 16:57 ` [PATCH v2 bpf-next 2/4] bpf: add layer 2 encap support to bpf_skb_adjust_room Alan Maguire
2019-04-08 16:57 ` Alan Maguire
2019-04-08 16:57 ` alan.maguire
2019-04-08 19:07 ` Willem de Bruijn
2019-04-08 19:07 ` Willem de Bruijn
2019-04-08 19:07 ` willemdebruijn.kernel
2019-04-08 16:57 ` [PATCH v2 bpf-next 3/4] bpf: sync bpf.h to tools/ for BPF_F_ADJ_ROOM_ENCAP_L2 Alan Maguire
2019-04-08 16:57 ` Alan Maguire
2019-04-08 16:57 ` alan.maguire
2019-04-08 16:57 ` [PATCH v2 bpf-next 4/4] selftests_bpf: add L2 encap to test_tc_tunnel Alan Maguire
2019-04-08 16:57 ` Alan Maguire
2019-04-08 16:57 ` alan.maguire
2019-04-08 19:07 ` Willem de Bruijn
2019-04-08 19:07 ` Willem de Bruijn
2019-04-08 19:07 ` willemdebruijn.kernel
2019-04-08 19:07 ` [PATCH v2 bpf-next 0/4] L2 encap support for bpf_skb_adjust_room Willem de Bruijn
2019-04-08 19:07 ` Willem de Bruijn
2019-04-08 19:07 ` willemdebruijn.kernel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.