| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20211129045503.20217-3-xiangxia.m.yue@gmail.com>
Date: Mon, 29 Nov 2021 12:55:03 +0800
From: xiangxia.m.yue@...il.com
To: netdev@...r.kernel.org
Cc: Tonghao Zhang <xiangxia.m.yue@...il.com>,
Willem de Bruijn <willemb@...gle.com>,
Cong Wang <xiyou.wangcong@...il.com>,
Jakub Kicinski <kuba@...nel.org>,
"David S. Miller" <davem@...emloft.net>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>,
Eric Dumazet <edumazet@...gle.com>,
Antoine Tenart <atenart@...nel.org>,
Alexander Lobakin <alexandr.lobakin@...el.com>,
Wei Wang <weiwan@...gle.com>,
Björn Töpel <bjorn@...nel.org>,
Arnd Bergmann <arnd@...db.de>
Subject: [net v3 3/3] selftests: bpf: add bpf_redirect to ifb
From: Tonghao Zhang <xiangxia.m.yue@...il.com>
ifb netdev is used for queueing incoming traffic for shaping.
we may run bpf progs in tc cls hook(ingress or egress), to
redirect the packets to ifb.
This patch adds this test, for bpf.
Cc: Willem de Bruijn <willemb@...gle.com>
Cc: Cong Wang <xiyou.wangcong@...il.com>
Cc: Jakub Kicinski <kuba@...nel.org>
Cc: "David S. Miller" <davem@...emloft.net>
Cc: Jakub Kicinski <kuba@...nel.org>
Cc: Alexei Starovoitov <ast@...nel.org>
Cc: Daniel Borkmann <daniel@...earbox.net>
Cc: Andrii Nakryiko <andrii@...nel.org>
Cc: Martin KaFai Lau <kafai@...com>
Cc: Song Liu <songliubraving@...com>
Cc: Yonghong Song <yhs@...com>
Cc: John Fastabend <john.fastabend@...il.com>
Cc: KP Singh <kpsingh@...nel.org>
Cc: Eric Dumazet <edumazet@...gle.com>
Cc: Antoine Tenart <atenart@...nel.org>
Cc: Alexander Lobakin <alexandr.lobakin@...el.com>
Cc: Wei Wang <weiwan@...gle.com>
Cc: "Björn Töpel" <bjorn@...nel.org>
Cc: Arnd Bergmann <arnd@...db.de>
Signed-off-by: Tonghao Zhang <xiangxia.m.yue@...il.com>
---
tools/testing/selftests/bpf/Makefile | 1 +
.../bpf/progs/test_bpf_redirect_ifb.c | 10 +++
.../selftests/bpf/test_bpf_redirect_ifb.sh | 73 +++++++++++++++++++
3 files changed, 84 insertions(+)
create mode 100644 tools/testing/selftests/bpf/progs/test_bpf_redirect_ifb.c
create mode 100755 tools/testing/selftests/bpf/test_bpf_redirect_ifb.sh
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 5d42db2e129a..6ec8b97af0ea 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -65,6 +65,7 @@ TEST_PROGS := test_kmod.sh \
test_xdp_vlan_mode_native.sh \
test_lwt_ip_encap.sh \
test_tcp_check_syncookie.sh \
+ test_bpf_redirect_ifb.sh \
test_tc_tunnel.sh \
test_tc_edt.sh \
test_xdping.sh \
diff --git a/tools/testing/selftests/bpf/progs/test_bpf_redirect_ifb.c b/tools/testing/selftests/bpf/progs/test_bpf_redirect_ifb.c
new file mode 100644
index 000000000000..d3205ad5e35a
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_bpf_redirect_ifb.c
@@ -0,0 +1,10 @@
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+
+SEC("redirect_ifb")
+int redirect(struct __sk_buff *skb)
+{
+ return bpf_redirect(skb->ifindex + 1 /* ifbX */, 0);
+}
+
+char __license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/test_bpf_redirect_ifb.sh b/tools/testing/selftests/bpf/test_bpf_redirect_ifb.sh
new file mode 100755
index 000000000000..0933439696ab
--- /dev/null
+++ b/tools/testing/selftests/bpf/test_bpf_redirect_ifb.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+
+# Topology:
+# ---------
+# n1 namespace | n2 namespace
+# |
+# ----------- | ----------------
+# | veth0 | --------- | veth1, ifb1 |
+# ----------- peer ----------------
+#
+
+readonly prefix="ns-$$-"
+readonly ns1="${prefix}1"
+readonly ns2="${prefix}2"
+readonly ns1_addr=192.168.1.1
+readonly ns2_addr=192.168.1.2
+
+setup() {
+ echo "Load ifb module"
+ if ! /sbin/modprobe -q -n ifb; then
+ echo "test_bpf_redirect ifb: module ifb is not found [SKIP]"
+ exit 4
+ fi
+
+ modprobe -q ifb numifbs=0
+
+ ip netns add "${ns1}"
+ ip netns add "${ns2}"
+
+ ip link add dev veth0 mtu 1500 netns "${ns1}" type veth \
+ peer name veth1 mtu 1500 netns "${ns2}"
+ # ifb1 created after veth1
+ ip link add dev ifb1 mtu 1500 netns "${ns2}" type ifb
+
+ ip -netns "${ns1}" link set veth0 up
+ ip -netns "${ns2}" link set veth1 up
+ ip -netns "${ns2}" link set ifb1 up
+ ip -netns "${ns1}" -4 addr add "${ns1_addr}/24" dev veth0
+ ip -netns "${ns2}" -4 addr add "${ns2_addr}/24" dev veth1
+
+ ip netns exec "${ns2}" tc qdisc add dev veth1 clsact
+}
+
+cleanup() {
+ ip netns del "${ns2}" &>/dev/null
+ ip netns del "${ns1}" &>/dev/null
+ modprobe -r ifb
+}
+
+trap cleanup EXIT
+
+setup
+
+ip netns exec "${ns2}" tc filter add dev veth1 \
+ ingress bpf direct-action obj test_bpf_redirect_ifb.o sec redirect_ifb
+ip netns exec "${ns1}" ping -W 2 -c 2 -i 0.2 -q "${ns2_addr}" &>/dev/null
+if [ $? -ne 0 ]; then
+ echo "bpf redirect to ifb on ingress path [FAILED]"
+ exit 1
+fi
+
+ip netns exec "${ns2}" tc filter del dev veth1 ingress
+ip netns exec "${ns2}" tc filter add dev veth1 \
+ egress bpf direct-action obj test_bpf_redirect_ifb.o sec redirect_ifb
+ip netns exec "${ns1}" ping -W 2 -c 2 -i 0.2 -q "${ns2_addr}" &>/dev/null
+if [ $? -ne 0 ]; then
+ echo "bpf redirect to ifb on egress path [FAILED]"
+ exit 1
+fi
+
+echo OK
--
2.27.0
Powered by blists - more mailing lists