aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorWilliam Tu <u9012063@gmail.com>2018-04-26 17:01:40 -0400
committerDaniel Borkmann <daniel@iogearbox.net>2018-04-26 18:11:15 -0400
commitb05cd74043236e7427a71fc7c59deee4588a7c91 (patch)
tree25452421c187400bbf655d09425bd64e1f5a739f
parent933a741e3b8295b9192a07367ebc15cbb4bdf957 (diff)
samples/bpf: remove the bpf tunnel testsuite.
Move the testsuite to selftests/bpf/{test_tunnel_kern.c, test_tunnel.sh} Signed-off-by: William Tu <u9012063@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat
-rw-r--r--samples/bpf/Makefile1
-rw-r--r--samples/bpf/tcbpf2_kern.c612
-rwxr-xr-xsamples/bpf/test_tunnel_bpf.sh390
3 files changed, 0 insertions, 1003 deletions
diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index aa8c392e2e52..b853581592fd 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -114,7 +114,6 @@ always += sock_flags_kern.o
114always += test_probe_write_user_kern.o 114always += test_probe_write_user_kern.o
115always += trace_output_kern.o 115always += trace_output_kern.o
116always += tcbpf1_kern.o 116always += tcbpf1_kern.o
117always += tcbpf2_kern.o
118always += tc_l2_redirect_kern.o 117always += tc_l2_redirect_kern.o
119always += lathist_kern.o 118always += lathist_kern.o
120always += offwaketime_kern.o 119always += offwaketime_kern.o
diff --git a/samples/bpf/tcbpf2_kern.c b/samples/bpf/tcbpf2_kern.c
deleted file mode 100644
index fa260c750fb1..000000000000
--- a/samples/bpf/tcbpf2_kern.c
+++ /dev/null
@@ -1,612 +0,0 @@
1/* Copyright (c) 2016 VMware
2 * Copyright (c) 2016 Facebook
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of version 2 of the GNU General Public
6 * License as published by the Free Software Foundation.
7 */
8#define KBUILD_MODNAME "foo"
9#include <uapi/linux/bpf.h>
10#include <uapi/linux/if_ether.h>
11#include <uapi/linux/if_packet.h>
12#include <uapi/linux/ip.h>
13#include <uapi/linux/ipv6.h>
14#include <uapi/linux/in.h>
15#include <uapi/linux/tcp.h>
16#include <uapi/linux/filter.h>
17#include <uapi/linux/pkt_cls.h>
18#include <uapi/linux/erspan.h>
19#include <net/ipv6.h>
20#include "bpf_helpers.h"
21#include "bpf_endian.h"
22
23#define _htonl __builtin_bswap32
24#define ERROR(ret) do {\
25 char fmt[] = "ERROR line:%d ret:%d\n";\
26 bpf_trace_printk(fmt, sizeof(fmt), __LINE__, ret); \
27 } while(0)
28
29struct geneve_opt {
30 __be16 opt_class;
31 u8 type;
32 u8 length:5;
33 u8 r3:1;
34 u8 r2:1;
35 u8 r1:1;
36 u8 opt_data[8]; /* hard-coded to 8 byte */
37};
38
39struct vxlan_metadata {
40 u32 gbp;
41};
42
43SEC("gre_set_tunnel")
44int _gre_set_tunnel(struct __sk_buff *skb)
45{
46 int ret;
47 struct bpf_tunnel_key key;
48
49 __builtin_memset(&key, 0x0, sizeof(key));
50 key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
51 key.tunnel_id = 2;
52 key.tunnel_tos = 0;
53 key.tunnel_ttl = 64;
54
55 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
56 BPF_F_ZERO_CSUM_TX | BPF_F_SEQ_NUMBER);
57 if (ret < 0) {
58 ERROR(ret);
59 return TC_ACT_SHOT;
60 }
61
62 return TC_ACT_OK;
63}
64
65SEC("gre_get_tunnel")
66int _gre_get_tunnel(struct __sk_buff *skb)
67{
68 int ret;
69 struct bpf_tunnel_key key;
70 char fmt[] = "key %d remote ip 0x%x\n";
71
72 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);
73 if (ret < 0) {
74 ERROR(ret);
75 return TC_ACT_SHOT;
76 }
77
78 bpf_trace_printk(fmt, sizeof(fmt), key.tunnel_id, key.remote_ipv4);
79 return TC_ACT_OK;
80}
81
82SEC("ip6gretap_set_tunnel")
83int _ip6gretap_set_tunnel(struct __sk_buff *skb)
84{
85 struct bpf_tunnel_key key;
86 int ret;
87
88 __builtin_memset(&key, 0x0, sizeof(key));
89 key.remote_ipv6[3] = _htonl(0x11); /* ::11 */
90 key.tunnel_id = 2;
91 key.tunnel_tos = 0;
92 key.tunnel_ttl = 64;
93 key.tunnel_label = 0xabcde;
94
95 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
96 BPF_F_TUNINFO_IPV6 | BPF_F_ZERO_CSUM_TX |
97 BPF_F_SEQ_NUMBER);
98 if (ret < 0) {
99 ERROR(ret);
100 return TC_ACT_SHOT;
101 }
102
103 return TC_ACT_OK;
104}
105
106SEC("ip6gretap_get_tunnel")
107int _ip6gretap_get_tunnel(struct __sk_buff *skb)
108{
109 char fmt[] = "key %d remote ip6 ::%x label %x\n";
110 struct bpf_tunnel_key key;
111 int ret;
112
113 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key),
114 BPF_F_TUNINFO_IPV6);
115 if (ret < 0) {
116 ERROR(ret);
117 return TC_ACT_SHOT;
118 }
119
120 bpf_trace_printk(fmt, sizeof(fmt),
121 key.tunnel_id, key.remote_ipv6[3], key.tunnel_label);
122
123 return TC_ACT_OK;
124}
125
126SEC("erspan_set_tunnel")
127int _erspan_set_tunnel(struct __sk_buff *skb)
128{
129 struct bpf_tunnel_key key;
130 struct erspan_metadata md;
131 int ret;
132
133 __builtin_memset(&key, 0x0, sizeof(key));
134 key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
135 key.tunnel_id = 2;
136 key.tunnel_tos = 0;
137 key.tunnel_ttl = 64;
138
139 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), BPF_F_ZERO_CSUM_TX);
140 if (ret < 0) {
141 ERROR(ret);
142 return TC_ACT_SHOT;
143 }
144
145 __builtin_memset(&md, 0, sizeof(md));
146#ifdef ERSPAN_V1
147 md.version = 1;
148 md.u.index = bpf_htonl(123);
149#else
150 u8 direction = 1;
151 u8 hwid = 7;
152
153 md.version = 2;
154 md.u.md2.dir = direction;
155 md.u.md2.hwid = hwid & 0xf;
156 md.u.md2.hwid_upper = (hwid >> 4) & 0x3;
157#endif
158
159 ret = bpf_skb_set_tunnel_opt(skb, &md, sizeof(md));
160 if (ret < 0) {
161 ERROR(ret);
162 return TC_ACT_SHOT;
163 }
164
165 return TC_ACT_OK;
166}
167
168SEC("erspan_get_tunnel")
169int _erspan_get_tunnel(struct __sk_buff *skb)
170{
171 char fmt[] = "key %d remote ip 0x%x erspan version %d\n";
172 struct bpf_tunnel_key key;
173 struct erspan_metadata md;
174 u32 index;
175 int ret;
176
177 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);
178 if (ret < 0) {
179 ERROR(ret);
180 return TC_ACT_SHOT;
181 }
182
183 ret = bpf_skb_get_tunnel_opt(skb, &md, sizeof(md));
184 if (ret < 0) {
185 ERROR(ret);
186 return TC_ACT_SHOT;
187 }
188
189 bpf_trace_printk(fmt, sizeof(fmt),
190 key.tunnel_id, key.remote_ipv4, md.version);
191
192#ifdef ERSPAN_V1
193 char fmt2[] = "\tindex %x\n";
194
195 index = bpf_ntohl(md.u.index);
196 bpf_trace_printk(fmt2, sizeof(fmt2), index);
197#else
198 char fmt2[] = "\tdirection %d hwid %x timestamp %u\n";
199
200 bpf_trace_printk(fmt2, sizeof(fmt2),
201 md.u.md2.dir,
202 (md.u.md2.hwid_upper << 4) + md.u.md2.hwid,
203 bpf_ntohl(md.u.md2.timestamp));
204#endif
205
206 return TC_ACT_OK;
207}
208
209SEC("ip4ip6erspan_set_tunnel")
210int _ip4ip6erspan_set_tunnel(struct __sk_buff *skb)
211{
212 struct bpf_tunnel_key key;
213 struct erspan_metadata md;
214 int ret;
215
216 __builtin_memset(&key, 0x0, sizeof(key));
217 key.remote_ipv6[3] = _htonl(0x11);
218 key.tunnel_id = 2;
219 key.tunnel_tos = 0;
220 key.tunnel_ttl = 64;
221
222 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
223 BPF_F_TUNINFO_IPV6);
224 if (ret < 0) {
225 ERROR(ret);
226 return TC_ACT_SHOT;
227 }
228
229 __builtin_memset(&md, 0, sizeof(md));
230
231#ifdef ERSPAN_V1
232 md.u.index = htonl(123);
233 md.version = 1;
234#else
235 u8 direction = 0;
236 u8 hwid = 17;
237
238 md.version = 2;
239 md.u.md2.dir = direction;
240 md.u.md2.hwid = hwid & 0xf;
241 md.u.md2.hwid_upper = (hwid >> 4) & 0x3;
242#endif
243
244 ret = bpf_skb_set_tunnel_opt(skb, &md, sizeof(md));
245 if (ret < 0) {
246 ERROR(ret);
247 return TC_ACT_SHOT;
248 }
249
250 return TC_ACT_OK;
251}
252
253SEC("ip4ip6erspan_get_tunnel")
254int _ip4ip6erspan_get_tunnel(struct __sk_buff *skb)
255{
256 char fmt[] = "ip6erspan get key %d remote ip6 ::%x erspan version %d\n";
257 struct bpf_tunnel_key key;
258 struct erspan_metadata md;
259 u32 index;
260 int ret;
261
262 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
263 if (ret < 0) {
264 ERROR(ret);
265 return TC_ACT_SHOT;
266 }
267
268 ret = bpf_skb_get_tunnel_opt(skb, &md, sizeof(md));
269 if (ret < 0) {
270 ERROR(ret);
271 return TC_ACT_SHOT;
272 }
273
274 bpf_trace_printk(fmt, sizeof(fmt),
275 key.tunnel_id, key.remote_ipv4, md.version);
276
277#ifdef ERSPAN_V1
278 char fmt2[] = "\tindex %x\n";
279
280 index = bpf_ntohl(md.u.index);
281 bpf_trace_printk(fmt2, sizeof(fmt2), index);
282#else
283 char fmt2[] = "\tdirection %d hwid %x timestamp %u\n";
284
285 bpf_trace_printk(fmt2, sizeof(fmt2),
286 md.u.md2.dir,
287 (md.u.md2.hwid_upper << 4) + md.u.md2.hwid,
288 bpf_ntohl(md.u.md2.timestamp));
289#endif
290
291 return TC_ACT_OK;
292}
293
294SEC("vxlan_set_tunnel")
295int _vxlan_set_tunnel(struct __sk_buff *skb)
296{
297 int ret;
298 struct bpf_tunnel_key key;
299 struct vxlan_metadata md;
300
301 __builtin_memset(&key, 0x0, sizeof(key));
302 key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
303 key.tunnel_id = 2;
304 key.tunnel_tos = 0;
305 key.tunnel_ttl = 64;
306
307 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), BPF_F_ZERO_CSUM_TX);
308 if (ret < 0) {
309 ERROR(ret);
310 return TC_ACT_SHOT;
311 }
312
313 md.gbp = 0x800FF; /* Set VXLAN Group Policy extension */
314 ret = bpf_skb_set_tunnel_opt(skb, &md, sizeof(md));
315 if (ret < 0) {
316 ERROR(ret);
317 return TC_ACT_SHOT;
318 }
319
320 return TC_ACT_OK;
321}
322
323SEC("vxlan_get_tunnel")
324int _vxlan_get_tunnel(struct __sk_buff *skb)
325{
326 int ret;
327 struct bpf_tunnel_key key;
328 struct vxlan_metadata md;
329 char fmt[] = "key %d remote ip 0x%x vxlan gbp 0x%x\n";
330
331 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);
332 if (ret < 0) {
333 ERROR(ret);
334 return TC_ACT_SHOT;
335 }
336
337 ret = bpf_skb_get_tunnel_opt(skb, &md, sizeof(md));
338 if (ret < 0) {
339 ERROR(ret);
340 return TC_ACT_SHOT;
341 }
342
343 bpf_trace_printk(fmt, sizeof(fmt),
344 key.tunnel_id, key.remote_ipv4, md.gbp);
345
346 return TC_ACT_OK;
347}
348
349SEC("geneve_set_tunnel")
350int _geneve_set_tunnel(struct __sk_buff *skb)
351{
352 int ret, ret2;
353 struct bpf_tunnel_key key;
354 struct geneve_opt gopt;
355
356 __builtin_memset(&key, 0x0, sizeof(key));
357 key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
358 key.tunnel_id = 2;
359 key.tunnel_tos = 0;
360 key.tunnel_ttl = 64;
361
362 __builtin_memset(&gopt, 0x0, sizeof(gopt));
363 gopt.opt_class = 0x102; /* Open Virtual Networking (OVN) */
364 gopt.type = 0x08;
365 gopt.r1 = 0;
366 gopt.r2 = 0;
367 gopt.r3 = 0;
368 gopt.length = 2; /* 4-byte multiple */
369 *(int *) &gopt.opt_data = 0xdeadbeef;
370
371 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), BPF_F_ZERO_CSUM_TX);
372 if (ret < 0) {
373 ERROR(ret);
374 return TC_ACT_SHOT;
375 }
376
377 ret = bpf_skb_set_tunnel_opt(skb, &gopt, sizeof(gopt));
378 if (ret < 0) {
379 ERROR(ret);
380 return TC_ACT_SHOT;
381 }
382
383 return TC_ACT_OK;
384}
385
386SEC("geneve_get_tunnel")
387int _geneve_get_tunnel(struct __sk_buff *skb)
388{
389 int ret;
390 struct bpf_tunnel_key key;
391 struct geneve_opt gopt;
392 char fmt[] = "key %d remote ip 0x%x geneve class 0x%x\n";
393
394 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);
395 if (ret < 0) {
396 ERROR(ret);
397 return TC_ACT_SHOT;
398 }
399
400 ret = bpf_skb_get_tunnel_opt(skb, &gopt, sizeof(gopt));
401 if (ret < 0) {
402 ERROR(ret);
403 return TC_ACT_SHOT;
404 }
405
406 bpf_trace_printk(fmt, sizeof(fmt),
407 key.tunnel_id, key.remote_ipv4, gopt.opt_class);
408 return TC_ACT_OK;
409}
410
411SEC("ipip_set_tunnel")
412int _ipip_set_tunnel(struct __sk_buff *skb)
413{
414 struct bpf_tunnel_key key = {};
415 void *data = (void *)(long)skb->data;
416 struct iphdr *iph = data;
417 struct tcphdr *tcp = data + sizeof(*iph);
418 void *data_end = (void *)(long)skb->data_end;
419 int ret;
420
421 /* single length check */
422 if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
423 ERROR(1);
424 return TC_ACT_SHOT;
425 }
426
427 key.tunnel_ttl = 64;
428 if (iph->protocol == IPPROTO_ICMP) {
429 key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
430 } else {
431 if (iph->protocol != IPPROTO_TCP || iph->ihl != 5)
432 return TC_ACT_SHOT;
433
434 if (tcp->dest == htons(5200))
435 key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
436 else if (tcp->dest == htons(5201))
437 key.remote_ipv4 = 0xac100165; /* 172.16.1.101 */
438 else
439 return TC_ACT_SHOT;
440 }
441
442 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0);
443 if (ret < 0) {
444 ERROR(ret);
445 return TC_ACT_SHOT;
446 }
447
448 return TC_ACT_OK;
449}
450
451SEC("ipip_get_tunnel")
452int _ipip_get_tunnel(struct __sk_buff *skb)
453{
454 int ret;
455 struct bpf_tunnel_key key;
456 char fmt[] = "remote ip 0x%x\n";
457
458 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);
459 if (ret < 0) {
460 ERROR(ret);
461 return TC_ACT_SHOT;
462 }
463
464 bpf_trace_printk(fmt, sizeof(fmt), key.remote_ipv4);
465 return TC_ACT_OK;
466}
467
468SEC("ipip6_set_tunnel")
469int _ipip6_set_tunnel(struct __sk_buff *skb)
470{
471 struct bpf_tunnel_key key = {};
472 void *data = (void *)(long)skb->data;
473 struct iphdr *iph = data;
474 struct tcphdr *tcp = data + sizeof(*iph);
475 void *data_end = (void *)(long)skb->data_end;
476 int ret;
477
478 /* single length check */
479 if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
480 ERROR(1);
481 return TC_ACT_SHOT;
482 }
483
484 key.remote_ipv6[0] = _htonl(0x2401db00);
485 key.tunnel_ttl = 64;
486
487 if (iph->protocol == IPPROTO_ICMP) {
488 key.remote_ipv6[3] = _htonl(1);
489 } else {
490 if (iph->protocol != IPPROTO_TCP || iph->ihl != 5) {
491 ERROR(iph->protocol);
492 return TC_ACT_SHOT;
493 }
494
495 if (tcp->dest == htons(5200)) {
496 key.remote_ipv6[3] = _htonl(1);
497 } else if (tcp->dest == htons(5201)) {
498 key.remote_ipv6[3] = _htonl(2);
499 } else {
500 ERROR(tcp->dest);
501 return TC_ACT_SHOT;
502 }
503 }
504
505 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
506 if (ret < 0) {
507 ERROR(ret);
508 return TC_ACT_SHOT;
509 }
510
511 return TC_ACT_OK;
512}
513
514SEC("ipip6_get_tunnel")
515int _ipip6_get_tunnel(struct __sk_buff *skb)
516{
517 int ret;
518 struct bpf_tunnel_key key;
519 char fmt[] = "remote ip6 %x::%x\n";
520
521 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
522 if (ret < 0) {
523 ERROR(ret);
524 return TC_ACT_SHOT;
525 }
526
527 bpf_trace_printk(fmt, sizeof(fmt), _htonl(key.remote_ipv6[0]),
528 _htonl(key.remote_ipv6[3]));
529 return TC_ACT_OK;
530}
531
532SEC("ip6ip6_set_tunnel")
533int _ip6ip6_set_tunnel(struct __sk_buff *skb)
534{
535 struct bpf_tunnel_key key = {};
536 void *data = (void *)(long)skb->data;
537 struct ipv6hdr *iph = data;
538 struct tcphdr *tcp = data + sizeof(*iph);
539 void *data_end = (void *)(long)skb->data_end;
540 int ret;
541
542 /* single length check */
543 if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
544 ERROR(1);
545 return TC_ACT_SHOT;
546 }
547
548 key.remote_ipv6[0] = _htonl(0x2401db00);
549 key.tunnel_ttl = 64;
550
551 if (iph->nexthdr == NEXTHDR_ICMP) {
552 key.remote_ipv6[3] = _htonl(1);
553 } else {
554 if (iph->nexthdr != NEXTHDR_TCP) {
555 ERROR(iph->nexthdr);
556 return TC_ACT_SHOT;
557 }
558
559 if (tcp->dest == htons(5200)) {
560 key.remote_ipv6[3] = _htonl(1);
561 } else if (tcp->dest == htons(5201)) {
562 key.remote_ipv6[3] = _htonl(2);
563 } else {
564 ERROR(tcp->dest);
565 return TC_ACT_SHOT;
566 }
567 }
568
569 ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
570 if (ret < 0) {
571 ERROR(ret);
572 return TC_ACT_SHOT;
573 }
574
575 return TC_ACT_OK;
576}
577
578SEC("ip6ip6_get_tunnel")
579int _ip6ip6_get_tunnel(struct __sk_buff *skb)
580{
581 int ret;
582 struct bpf_tunnel_key key;
583 char fmt[] = "remote ip6 %x::%x\n";
584
585 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), BPF_F_TUNINFO_IPV6);
586 if (ret < 0) {
587 ERROR(ret);
588 return TC_ACT_SHOT;
589 }
590
591 bpf_trace_printk(fmt, sizeof(fmt), _htonl(key.remote_ipv6[0]),
592 _htonl(key.remote_ipv6[3]));
593 return TC_ACT_OK;
594}
595
596SEC("xfrm_get_state")
597int _xfrm_get_state(struct __sk_buff *skb)
598{
599 struct bpf_xfrm_state x;
600 char fmt[] = "reqid %d spi 0x%x remote ip 0x%x\n";
601 int ret;
602
603 ret = bpf_skb_get_xfrm_state(skb, 0, &x, sizeof(x), 0);
604 if (ret < 0)
605 return TC_ACT_OK;
606
607 bpf_trace_printk(fmt, sizeof(fmt), x.reqid, bpf_ntohl(x.spi),
608 bpf_ntohl(x.remote_ipv4));
609 return TC_ACT_OK;
610}
611
612char _license[] SEC("license") = "GPL";
diff --git a/samples/bpf/test_tunnel_bpf.sh b/samples/bpf/test_tunnel_bpf.sh
deleted file mode 100755
index 9c534dc07b36..000000000000
--- a/samples/bpf/test_tunnel_bpf.sh
+++ /dev/null
@@ -1,390 +0,0 @@
1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3# In Namespace 0 (at_ns0) using native tunnel
4# Overlay IP: 10.1.1.100
5# local 192.16.1.100 remote 192.16.1.200
6# veth0 IP: 172.16.1.100, tunnel dev <type>00
7
8# Out of Namespace using BPF set/get on lwtunnel
9# Overlay IP: 10.1.1.200
10# local 172.16.1.200 remote 172.16.1.100
11# veth1 IP: 172.16.1.200, tunnel dev <type>11
12
13function config_device {
14 ip netns add at_ns0
15 ip link add veth0 type veth peer name veth1
16 ip link set veth0 netns at_ns0
17 ip netns exec at_ns0 ip addr add 172.16.1.100/24 dev veth0
18 ip netns exec at_ns0 ip link set dev veth0 up
19 ip link set dev veth1 up mtu 1500
20 ip addr add dev veth1 172.16.1.200/24
21}
22
23function add_gre_tunnel {
24 # in namespace
25 ip netns exec at_ns0 \
26 ip link add dev $DEV_NS type $TYPE seq key 2 \
27 local 172.16.1.100 remote 172.16.1.200
28 ip netns exec at_ns0 ip link set dev $DEV_NS up
29 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
30
31 # out of namespace
32 ip link add dev $DEV type $TYPE key 2 external
33 ip link set dev $DEV up
34 ip addr add dev $DEV 10.1.1.200/24
35}
36
37function add_ip6gretap_tunnel {
38
39 # assign ipv6 address
40 ip netns exec at_ns0 ip addr add ::11/96 dev veth0
41 ip netns exec at_ns0 ip link set dev veth0 up
42 ip addr add dev veth1 ::22/96
43 ip link set dev veth1 up
44
45 # in namespace
46 ip netns exec at_ns0 \
47 ip link add dev $DEV_NS type $TYPE seq flowlabel 0xbcdef key 2 \
48 local ::11 remote ::22
49
50 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
51 ip netns exec at_ns0 ip addr add dev $DEV_NS fc80::100/96
52 ip netns exec at_ns0 ip link set dev $DEV_NS up
53
54 # out of namespace
55 ip link add dev $DEV type $TYPE external
56 ip addr add dev $DEV 10.1.1.200/24
57 ip addr add dev $DEV fc80::200/24
58 ip link set dev $DEV up
59}
60
61function add_erspan_tunnel {
62 # in namespace
63 if [ "$1" == "v1" ]; then
64 ip netns exec at_ns0 \
65 ip link add dev $DEV_NS type $TYPE seq key 2 \
66 local 172.16.1.100 remote 172.16.1.200 \
67 erspan_ver 1 erspan 123
68 else
69 ip netns exec at_ns0 \
70 ip link add dev $DEV_NS type $TYPE seq key 2 \
71 local 172.16.1.100 remote 172.16.1.200 \
72 erspan_ver 2 erspan_dir egress erspan_hwid 3
73 fi
74 ip netns exec at_ns0 ip link set dev $DEV_NS up
75 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
76
77 # out of namespace
78 ip link add dev $DEV type $TYPE external
79 ip link set dev $DEV up
80 ip addr add dev $DEV 10.1.1.200/24
81}
82
83function add_ip6erspan_tunnel {
84
85 # assign ipv6 address
86 ip netns exec at_ns0 ip addr add ::11/96 dev veth0
87 ip netns exec at_ns0 ip link set dev veth0 up
88 ip addr add dev veth1 ::22/96
89 ip link set dev veth1 up
90
91 # in namespace
92 if [ "$1" == "v1" ]; then
93 ip netns exec at_ns0 \
94 ip link add dev $DEV_NS type $TYPE seq key 2 \
95 local ::11 remote ::22 \
96 erspan_ver 1 erspan 123
97 else
98 ip netns exec at_ns0 \
99 ip link add dev $DEV_NS type $TYPE seq key 2 \
100 local ::11 remote ::22 \
101 erspan_ver 2 erspan_dir egress erspan_hwid 7
102 fi
103 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
104 ip netns exec at_ns0 ip link set dev $DEV_NS up
105
106 # out of namespace
107 ip link add dev $DEV type $TYPE external
108 ip addr add dev $DEV 10.1.1.200/24
109 ip link set dev $DEV up
110}
111
112function add_vxlan_tunnel {
113 # Set static ARP entry here because iptables set-mark works
114 # on L3 packet, as a result not applying to ARP packets,
115 # causing errors at get_tunnel_{key/opt}.
116
117 # in namespace
118 ip netns exec at_ns0 \
119 ip link add dev $DEV_NS type $TYPE id 2 dstport 4789 gbp remote 172.16.1.200
120 ip netns exec at_ns0 ip link set dev $DEV_NS address 52:54:00:d9:01:00 up
121 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
122 ip netns exec at_ns0 arp -s 10.1.1.200 52:54:00:d9:02:00
123 ip netns exec at_ns0 iptables -A OUTPUT -j MARK --set-mark 0x800FF
124
125 # out of namespace
126 ip link add dev $DEV type $TYPE external gbp dstport 4789
127 ip link set dev $DEV address 52:54:00:d9:02:00 up
128 ip addr add dev $DEV 10.1.1.200/24
129 arp -s 10.1.1.100 52:54:00:d9:01:00
130}
131
132function add_geneve_tunnel {
133 # in namespace
134 ip netns exec at_ns0 \
135 ip link add dev $DEV_NS type $TYPE id 2 dstport 6081 remote 172.16.1.200
136 ip netns exec at_ns0 ip link set dev $DEV_NS up
137 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
138
139 # out of namespace
140 ip link add dev $DEV type $TYPE dstport 6081 external
141 ip link set dev $DEV up
142 ip addr add dev $DEV 10.1.1.200/24
143}
144
145function add_ipip_tunnel {
146 # in namespace
147 ip netns exec at_ns0 \
148 ip link add dev $DEV_NS type $TYPE local 172.16.1.100 remote 172.16.1.200
149 ip netns exec at_ns0 ip link set dev $DEV_NS up
150 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
151
152 # out of namespace
153 ip link add dev $DEV type $TYPE external
154 ip link set dev $DEV up
155 ip addr add dev $DEV 10.1.1.200/24
156}
157
158function setup_xfrm_tunnel {
159 auth=0x$(printf '1%.0s' {1..40})
160 enc=0x$(printf '2%.0s' {1..32})
161 spi_in_to_out=0x1
162 spi_out_to_in=0x2
163 # in namespace
164 # in -> out
165 ip netns exec at_ns0 \
166 ip xfrm state add src 172.16.1.100 dst 172.16.1.200 proto esp \
167 spi $spi_in_to_out reqid 1 mode tunnel \
168 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc
169 ip netns exec at_ns0 \
170 ip xfrm policy add src 10.1.1.100/32 dst 10.1.1.200/32 dir out \
171 tmpl src 172.16.1.100 dst 172.16.1.200 proto esp reqid 1 \
172 mode tunnel
173 # out -> in
174 ip netns exec at_ns0 \
175 ip xfrm state add src 172.16.1.200 dst 172.16.1.100 proto esp \
176 spi $spi_out_to_in reqid 2 mode tunnel \
177 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc
178 ip netns exec at_ns0 \
179 ip xfrm policy add src 10.1.1.200/32 dst 10.1.1.100/32 dir in \
180 tmpl src 172.16.1.200 dst 172.16.1.100 proto esp reqid 2 \
181 mode tunnel
182 # address & route
183 ip netns exec at_ns0 \
184 ip addr add dev veth0 10.1.1.100/32
185 ip netns exec at_ns0 \
186 ip route add 10.1.1.200 dev veth0 via 172.16.1.200 \
187 src 10.1.1.100
188
189 # out of namespace
190 # in -> out
191 ip xfrm state add src 172.16.1.100 dst 172.16.1.200 proto esp \
192 spi $spi_in_to_out reqid 1 mode tunnel \
193 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc
194 ip xfrm policy add src 10.1.1.100/32 dst 10.1.1.200/32 dir in \
195 tmpl src 172.16.1.100 dst 172.16.1.200 proto esp reqid 1 \
196 mode tunnel
197 # out -> in
198 ip xfrm state add src 172.16.1.200 dst 172.16.1.100 proto esp \
199 spi $spi_out_to_in reqid 2 mode tunnel \
200 auth-trunc 'hmac(sha1)' $auth 96 enc 'cbc(aes)' $enc
201 ip xfrm policy add src 10.1.1.200/32 dst 10.1.1.100/32 dir out \
202 tmpl src 172.16.1.200 dst 172.16.1.100 proto esp reqid 2 \
203 mode tunnel
204 # address & route
205 ip addr add dev veth1 10.1.1.200/32
206 ip route add 10.1.1.100 dev veth1 via 172.16.1.100 src 10.1.1.200
207}
208
209function attach_bpf {
210 DEV=$1
211 SET_TUNNEL=$2
212 GET_TUNNEL=$3
213 tc qdisc add dev $DEV clsact
214 tc filter add dev $DEV egress bpf da obj tcbpf2_kern.o sec $SET_TUNNEL
215 tc filter add dev $DEV ingress bpf da obj tcbpf2_kern.o sec $GET_TUNNEL
216}
217
218function test_gre {
219 TYPE=gretap
220 DEV_NS=gretap00
221 DEV=gretap11
222 config_device
223 add_gre_tunnel
224 attach_bpf $DEV gre_set_tunnel gre_get_tunnel
225 ping -c 1 10.1.1.100
226 ip netns exec at_ns0 ping -c 1 10.1.1.200
227 cleanup
228}
229
230function test_ip6gre {
231 TYPE=ip6gre
232 DEV_NS=ip6gre00
233 DEV=ip6gre11
234 config_device
235 # reuse the ip6gretap function
236 add_ip6gretap_tunnel
237 attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel
238 # underlay
239 ping6 -c 4 ::11
240 # overlay: ipv4 over ipv6
241 ip netns exec at_ns0 ping -c 1 10.1.1.200
242 ping -c 1 10.1.1.100
243 # overlay: ipv6 over ipv6
244 ip netns exec at_ns0 ping6 -c 1 fc80::200
245 cleanup
246}
247
248function test_ip6gretap {
249 TYPE=ip6gretap
250 DEV_NS=ip6gretap00
251 DEV=ip6gretap11
252 config_device
253 add_ip6gretap_tunnel
254 attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel
255 # underlay
256 ping6 -c 4 ::11
257 # overlay: ipv4 over ipv6
258 ip netns exec at_ns0 ping -i .2 -c 1 10.1.1.200
259 ping -c 1 10.1.1.100
260 # overlay: ipv6 over ipv6
261 ip netns exec at_ns0 ping6 -c 1 fc80::200
262 cleanup
263}
264
265function test_erspan {
266 TYPE=erspan
267 DEV_NS=erspan00
268 DEV=erspan11
269 config_device
270 add_erspan_tunnel $1
271 attach_bpf $DEV erspan_set_tunnel erspan_get_tunnel
272 ping -c 1 10.1.1.100
273 ip netns exec at_ns0 ping -c 1 10.1.1.200
274 cleanup
275}
276
277function test_ip6erspan {
278 TYPE=ip6erspan
279 DEV_NS=ip6erspan00
280 DEV=ip6erspan11
281 config_device
282 add_ip6erspan_tunnel $1
283 attach_bpf $DEV ip4ip6erspan_set_tunnel ip4ip6erspan_get_tunnel
284 ping6 -c 3 ::11
285 ip netns exec at_ns0 ping -c 1 10.1.1.200
286 cleanup
287}
288
289function test_vxlan {
290 TYPE=vxlan
291 DEV_NS=vxlan00
292 DEV=vxlan11
293 config_device
294 add_vxlan_tunnel
295 attach_bpf $DEV vxlan_set_tunnel vxlan_get_tunnel
296 ping -c 1 10.1.1.100
297 ip netns exec at_ns0 ping -c 1 10.1.1.200
298 cleanup
299}
300
301function test_geneve {
302 TYPE=geneve
303 DEV_NS=geneve00
304 DEV=geneve11
305 config_device
306 add_geneve_tunnel
307 attach_bpf $DEV geneve_set_tunnel geneve_get_tunnel
308 ping -c 1 10.1.1.100
309 ip netns exec at_ns0 ping -c 1 10.1.1.200
310 cleanup
311}
312
313function test_ipip {
314 TYPE=ipip
315 DEV_NS=ipip00
316 DEV=ipip11
317 config_device
318 tcpdump -nei veth1 &
319 cat /sys/kernel/debug/tracing/trace_pipe &
320 add_ipip_tunnel
321 ethtool -K veth1 gso off gro off rx off tx off
322 ip link set dev veth1 mtu 1500
323 attach_bpf $DEV ipip_set_tunnel ipip_get_tunnel
324 ping -c 1 10.1.1.100
325 ip netns exec at_ns0 ping -c 1 10.1.1.200
326 ip netns exec at_ns0 iperf -sD -p 5200 > /dev/null
327 sleep 0.2
328 iperf -c 10.1.1.100 -n 5k -p 5200
329 cleanup
330}
331
332function test_xfrm_tunnel {
333 config_device
334 tcpdump -nei veth1 ip &
335 output=$(mktemp)
336 cat /sys/kernel/debug/tracing/trace_pipe | tee $output &
337 setup_xfrm_tunnel
338 tc qdisc add dev veth1 clsact
339 tc filter add dev veth1 proto ip ingress bpf da obj tcbpf2_kern.o \
340 sec xfrm_get_state
341 ip netns exec at_ns0 ping -c 1 10.1.1.200
342 grep "reqid 1" $output
343 grep "spi 0x1" $output
344 grep "remote ip 0xac100164" $output
345 cleanup
346}
347
348function cleanup {
349 set +ex
350 pkill iperf
351 ip netns delete at_ns0
352 ip link del veth1
353 ip link del ipip11
354 ip link del gretap11
355 ip link del ip6gre11
356 ip link del ip6gretap11
357 ip link del vxlan11
358 ip link del geneve11
359 ip link del erspan11
360 ip link del ip6erspan11
361 ip x s flush
362 ip x p flush
363 pkill tcpdump
364 pkill cat
365 set -ex
366}
367
368trap cleanup 0 2 3 6 9
369cleanup
370echo "Testing GRE tunnel..."
371test_gre
372echo "Testing IP6GRE tunnel..."
373test_ip6gre
374echo "Testing IP6GRETAP tunnel..."
375test_ip6gretap
376echo "Testing ERSPAN tunnel..."
377test_erspan v1
378test_erspan v2
379echo "Testing IP6ERSPAN tunnel..."
380test_ip6erspan v1
381test_ip6erspan v2
382echo "Testing VXLAN tunnel..."
383test_vxlan
384echo "Testing GENEVE tunnel..."
385test_geneve
386echo "Testing IPIP tunnel..."
387test_ipip
388echo "Testing IPSec tunnel..."
389test_xfrm_tunnel
390echo "*** PASS ***"
generated by cgit v1.2.2 (git 2.25.0) at 2025-08-31 03:02:22 -0400