Skip to content

Commit 173ca26

Browse files
4astdavem330
4ast
authored and
davem330
committed
samples/bpf: add comprehensive ipip, ipip6, ip6ip6 test
the test creates 3 namespaces with veth connected via bridge. First two namespaces simulate two different hosts with the same IPv4 and IPv6 addresses configured on the tunnel interface and they communicate with outside world via standard tunnels. Third namespace creates collect_md tunnel that is driven by BPF program which selects different remote host (either first or second namespace) based on tcp dest port number while tcp dst ip is the same. This scenario is rough approximation of load balancer use case. The tests check both traditional tunnel configuration and collect_md mode. Signed-off-by: Alexei Starovoitov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent a1c8270 commit 173ca26

File tree

2 files changed

+310
-0
lines changed

2 files changed

+310
-0
lines changed

‎samples/bpf/tcbpf2_kern.c

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,15 @@
99
#include <uapi/linux/if_ether.h>
1010
#include <uapi/linux/if_packet.h>
1111
#include <uapi/linux/ip.h>
12+
#include <uapi/linux/ipv6.h>
1213
#include <uapi/linux/in.h>
1314
#include <uapi/linux/tcp.h>
1415
#include <uapi/linux/filter.h>
1516
#include <uapi/linux/pkt_cls.h>
17+
#include <net/ipv6.h>
1618
#include "bpf_helpers.h"
1719

20+
#define _htonl __builtin_bswap32
1821
#define ERROR(ret) do {\
1922
char fmt[] = "ERROR line:%d ret:%d\n";\
2023
bpf_trace_printk(fmt, sizeof(fmt), __LINE__, ret); \
@@ -246,4 +249,133 @@ int _ipip_get_tunnel(struct __sk_buff *skb)
246249
return TC_ACT_OK;
247250
}
248251

252+
SEC("ipip6_set_tunnel")
253+
int _ipip6_set_tunnel(struct __sk_buff *skb)
254+
{
255+
struct bpf_tunnel_key key = {};
256+
void *data = (void *)(long)skb->data;
257+
struct iphdr *iph = data;
258+
struct tcphdr *tcp = data + sizeof(*iph);
259+
void *data_end = (void *)(long)skb->data_end;
260+
int ret;
261+
262+
/* single length check */
263+
if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
264+
ERROR(1);
265+
return TC_ACT_SHOT;
266+
}
267+
268+
key.remote_ipv6[0] = _htonl(0x2401db00);
269+
key.tunnel_ttl = 64;
270+
271+
if (iph->protocol == IPPROTO_ICMP) {
272+
key.remote_ipv6[3] = _htonl(1);
273+
} else {
274+
if (iph->protocol != IPPROTO_TCP || iph->ihl != 5) {
275+
ERROR(iph->protocol);
276+
return TC_ACT_SHOT;
277+
}
278+
279+
if (tcp->dest == htons(5200)) {
280+
key.remote_ipv6[3] = _htonl(1);
281+
} else if (tcp->dest == htons(5201)) {
282+
key.remote_ipv6[3] = _htonl(2);
283+
} else {
284+
ERROR(tcp->dest);
285+
return TC_ACT_SHOT;
286+
}
287+
}
288+
289+
ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
290+
if (ret < 0) {
291+
ERROR(ret);
292+
return TC_ACT_SHOT;
293+
}
294+
295+
return TC_ACT_OK;
296+
}
297+
298+
SEC("ipip6_get_tunnel")
299+
int _ipip6_get_tunnel(struct __sk_buff *skb)
300+
{
301+
int ret;
302+
struct bpf_tunnel_key key;
303+
char fmt[] = "remote ip6 %x::%x\n";
304+
305+
ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
306+
if (ret < 0) {
307+
ERROR(ret);
308+
return TC_ACT_SHOT;
309+
}
310+
311+
bpf_trace_printk(fmt, sizeof(fmt), _htonl(key.remote_ipv6[0]),
312+
_htonl(key.remote_ipv6[3]));
313+
return TC_ACT_OK;
314+
}
315+
316+
SEC("ip6ip6_set_tunnel")
317+
int _ip6ip6_set_tunnel(struct __sk_buff *skb)
318+
{
319+
struct bpf_tunnel_key key = {};
320+
void *data = (void *)(long)skb->data;
321+
struct ipv6hdr *iph = data;
322+
struct tcphdr *tcp = data + sizeof(*iph);
323+
void *data_end = (void *)(long)skb->data_end;
324+
int ret;
325+
326+
/* single length check */
327+
if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
328+
ERROR(1);
329+
return TC_ACT_SHOT;
330+
}
331+
332+
key.remote_ipv6[0] = _htonl(0x2401db00);
333+
key.tunnel_ttl = 64;
334+
335+
if (iph->nexthdr == NEXTHDR_ICMP) {
336+
key.remote_ipv6[3] = _htonl(1);
337+
} else {
338+
if (iph->nexthdr != NEXTHDR_TCP) {
339+
ERROR(iph->nexthdr);
340+
return TC_ACT_SHOT;
341+
}
342+
343+
if (tcp->dest == htons(5200)) {
344+
key.remote_ipv6[3] = _htonl(1);
345+
} else if (tcp->dest == htons(5201)) {
346+
key.remote_ipv6[3] = _htonl(2);
347+
} else {
348+
ERROR(tcp->dest);
349+
return TC_ACT_SHOT;
350+
}
351+
}
352+
353+
ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
354+
if (ret < 0) {
355+
ERROR(ret);
356+
return TC_ACT_SHOT;
357+
}
358+
359+
return TC_ACT_OK;
360+
}
361+
362+
SEC("ip6ip6_get_tunnel")
363+
int _ip6ip6_get_tunnel(struct __sk_buff *skb)
364+
{
365+
int ret;
366+
struct bpf_tunnel_key key;
367+
char fmt[] = "remote ip6 %x::%x\n";
368+
369+
ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
370+
if (ret < 0) {
371+
ERROR(ret);
372+
return TC_ACT_SHOT;
373+
}
374+
375+
bpf_trace_printk(fmt, sizeof(fmt), _htonl(key.remote_ipv6[0]),
376+
_htonl(key.remote_ipv6[3]));
377+
return TC_ACT_OK;
378+
}
379+
380+
249381
char _license[] SEC("license") = "GPL";

‎samples/bpf/test_ipip.sh

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
#!/bin/bash
2+
3+
function config_device {
4+
ip netns add at_ns0
5+
ip netns add at_ns1
6+
ip netns add at_ns2
7+
ip link add veth0 type veth peer name veth0b
8+
ip link add veth1 type veth peer name veth1b
9+
ip link add veth2 type veth peer name veth2b
10+
ip link set veth0b up
11+
ip link set veth1b up
12+
ip link set veth2b up
13+
ip link set dev veth0b mtu 1500
14+
ip link set dev veth1b mtu 1500
15+
ip link set dev veth2b mtu 1500
16+
ip link set veth0 netns at_ns0
17+
ip link set veth1 netns at_ns1
18+
ip link set veth2 netns at_ns2
19+
ip netns exec at_ns0 ip addr add 172.16.1.100/24 dev veth0
20+
ip netns exec at_ns0 ip addr add 2401:db00::1/64 dev veth0 nodad
21+
ip netns exec at_ns0 ip link set dev veth0 up
22+
ip netns exec at_ns1 ip addr add 172.16.1.101/24 dev veth1
23+
ip netns exec at_ns1 ip addr add 2401:db00::2/64 dev veth1 nodad
24+
ip netns exec at_ns1 ip link set dev veth1 up
25+
ip netns exec at_ns2 ip addr add 172.16.1.200/24 dev veth2
26+
ip netns exec at_ns2 ip addr add 2401:db00::3/64 dev veth2 nodad
27+
ip netns exec at_ns2 ip link set dev veth2 up
28+
ip link add br0 type bridge
29+
ip link set br0 up
30+
ip link set dev br0 mtu 1500
31+
ip link set veth0b master br0
32+
ip link set veth1b master br0
33+
ip link set veth2b master br0
34+
}
35+
36+
function add_ipip_tunnel {
37+
ip netns exec at_ns0 \
38+
ip link add dev $DEV_NS type ipip local 172.16.1.100 remote 172.16.1.200
39+
ip netns exec at_ns0 ip link set dev $DEV_NS up
40+
ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
41+
ip netns exec at_ns1 \
42+
ip link add dev $DEV_NS type ipip local 172.16.1.101 remote 172.16.1.200
43+
ip netns exec at_ns1 ip link set dev $DEV_NS up
44+
# same inner IP address in at_ns0 and at_ns1
45+
ip netns exec at_ns1 ip addr add dev $DEV_NS 10.1.1.100/24
46+
47+
ip netns exec at_ns2 ip link add dev $DEV type ipip external
48+
ip netns exec at_ns2 ip link set dev $DEV up
49+
ip netns exec at_ns2 ip addr add dev $DEV 10.1.1.200/24
50+
}
51+
52+
function add_ipip6_tunnel {
53+
ip netns exec at_ns0 \
54+
ip link add dev $DEV_NS type ip6tnl mode ipip6 local 2401:db00::1/64 remote 2401:db00::3/64
55+
ip netns exec at_ns0 ip link set dev $DEV_NS up
56+
ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
57+
ip netns exec at_ns1 \
58+
ip link add dev $DEV_NS type ip6tnl mode ipip6 local 2401:db00::2/64 remote 2401:db00::3/64
59+
ip netns exec at_ns1 ip link set dev $DEV_NS up
60+
# same inner IP address in at_ns0 and at_ns1
61+
ip netns exec at_ns1 ip addr add dev $DEV_NS 10.1.1.100/24
62+
63+
ip netns exec at_ns2 ip link add dev $DEV type ip6tnl mode ipip6 external
64+
ip netns exec at_ns2 ip link set dev $DEV up
65+
ip netns exec at_ns2 ip addr add dev $DEV 10.1.1.200/24
66+
}
67+
68+
function add_ip6ip6_tunnel {
69+
ip netns exec at_ns0 \
70+
ip link add dev $DEV_NS type ip6tnl mode ip6ip6 local 2401:db00::1/64 remote 2401:db00::3/64
71+
ip netns exec at_ns0 ip link set dev $DEV_NS up
72+
ip netns exec at_ns0 ip addr add dev $DEV_NS 2601:646::1/64
73+
ip netns exec at_ns1 \
74+
ip link add dev $DEV_NS type ip6tnl mode ip6ip6 local 2401:db00::2/64 remote 2401:db00::3/64
75+
ip netns exec at_ns1 ip link set dev $DEV_NS up
76+
# same inner IP address in at_ns0 and at_ns1
77+
ip netns exec at_ns1 ip addr add dev $DEV_NS 2601:646::1/64
78+
79+
ip netns exec at_ns2 ip link add dev $DEV type ip6tnl mode ip6ip6 external
80+
ip netns exec at_ns2 ip link set dev $DEV up
81+
ip netns exec at_ns2 ip addr add dev $DEV 2601:646::2/64
82+
}
83+
84+
function attach_bpf {
85+
DEV=$1
86+
SET_TUNNEL=$2
87+
GET_TUNNEL=$3
88+
ip netns exec at_ns2 tc qdisc add dev $DEV clsact
89+
ip netns exec at_ns2 tc filter add dev $DEV egress bpf da obj tcbpf2_kern.o sec $SET_TUNNEL
90+
ip netns exec at_ns2 tc filter add dev $DEV ingress bpf da obj tcbpf2_kern.o sec $GET_TUNNEL
91+
}
92+
93+
function test_ipip {
94+
DEV_NS=ipip_std
95+
DEV=ipip_bpf
96+
config_device
97+
# tcpdump -nei br0 &
98+
cat /sys/kernel/debug/tracing/trace_pipe &
99+
100+
add_ipip_tunnel
101+
attach_bpf $DEV ipip_set_tunnel ipip_get_tunnel
102+
103+
ip netns exec at_ns0 ping -c 1 10.1.1.200
104+
ip netns exec at_ns2 ping -c 1 10.1.1.100
105+
ip netns exec at_ns0 iperf -sD -p 5200 > /dev/null
106+
ip netns exec at_ns1 iperf -sD -p 5201 > /dev/null
107+
sleep 0.2
108+
# tcp check _same_ IP over different tunnels
109+
ip netns exec at_ns2 iperf -c 10.1.1.100 -n 5k -p 5200
110+
ip netns exec at_ns2 iperf -c 10.1.1.100 -n 5k -p 5201
111+
cleanup
112+
}
113+
114+
# IPv4 over IPv6 tunnel
115+
function test_ipip6 {
116+
DEV_NS=ipip_std
117+
DEV=ipip_bpf
118+
config_device
119+
# tcpdump -nei br0 &
120+
cat /sys/kernel/debug/tracing/trace_pipe &
121+
122+
add_ipip6_tunnel
123+
attach_bpf $DEV ipip6_set_tunnel ipip6_get_tunnel
124+
125+
ip netns exec at_ns0 ping -c 1 10.1.1.200
126+
ip netns exec at_ns2 ping -c 1 10.1.1.100
127+
ip netns exec at_ns0 iperf -sD -p 5200 > /dev/null
128+
ip netns exec at_ns1 iperf -sD -p 5201 > /dev/null
129+
sleep 0.2
130+
# tcp check _same_ IP over different tunnels
131+
ip netns exec at_ns2 iperf -c 10.1.1.100 -n 5k -p 5200
132+
ip netns exec at_ns2 iperf -c 10.1.1.100 -n 5k -p 5201
133+
cleanup
134+
}
135+
136+
# IPv6 over IPv6 tunnel
137+
function test_ip6ip6 {
138+
DEV_NS=ipip_std
139+
DEV=ipip_bpf
140+
config_device
141+
# tcpdump -nei br0 &
142+
cat /sys/kernel/debug/tracing/trace_pipe &
143+
144+
add_ip6ip6_tunnel
145+
attach_bpf $DEV ip6ip6_set_tunnel ip6ip6_get_tunnel
146+
147+
ip netns exec at_ns0 ping -6 -c 1 2601:646::2
148+
ip netns exec at_ns2 ping -6 -c 1 2601:646::1
149+
ip netns exec at_ns0 iperf -6sD -p 5200 > /dev/null
150+
ip netns exec at_ns1 iperf -6sD -p 5201 > /dev/null
151+
sleep 0.2
152+
# tcp check _same_ IP over different tunnels
153+
ip netns exec at_ns2 iperf -6c 2601:646::1 -n 5k -p 5200
154+
ip netns exec at_ns2 iperf -6c 2601:646::1 -n 5k -p 5201
155+
cleanup
156+
}
157+
158+
function cleanup {
159+
set +ex
160+
pkill iperf
161+
ip netns delete at_ns0
162+
ip netns delete at_ns1
163+
ip netns delete at_ns2
164+
ip link del veth0
165+
ip link del veth1
166+
ip link del veth2
167+
ip link del br0
168+
pkill tcpdump
169+
pkill cat
170+
set -ex
171+
}
172+
173+
cleanup
174+
echo "Testing IP tunnels..."
175+
test_ipip
176+
test_ipip6
177+
test_ip6ip6
178+
echo "*** PASS ***"

0 commit comments

Comments
 (0)