| Message ID | cover.1680874078.git.cehrig@cloudflare.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Add FOU support for externally controlled ipip devices | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <ast@kernel.org>: On Fri, 7 Apr 2023 15:38:52 +0200 you wrote: > This patch set adds support for using FOU or GUE encapsulation with > an ipip device operating in collect-metadata mode and a set of kfuncs > for controlling encap parameters exposed to a BPF tc-hook. > > BPF tc-hooks allow us to read tunnel metadata (like remote IP addresses) > in the ingress path of an externally controlled tunnel interface via > the bpf_skb_get_tunnel_{key,opt} bpf-helpers. Packets can then be > redirected to the same or a different externally controlled tunnel > interface by overwriting metadata via the bpf_skb_set_tunnel_{key,opt} > helpers and a call to bpf_redirect. This enables us to redirect packets > between tunnel interfaces - and potentially change the encapsulation > type - using only a single BPF program. > > [...] Here is the summary with links: - [bpf-next,v3,1/3] ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices https://git.kernel.org/bpf/bpf-next/c/ac931d4cdec3 - [bpf-next,v3,2/3] bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs https://git.kernel.org/bpf/bpf-next/c/c50e96099edb - [bpf-next,v3,3/3] selftests/bpf: Test FOU kfuncs for externally controlled ipip devices https://git.kernel.org/bpf/bpf-next/c/d9688f898c08 You are awesome, thank you!
This patch set adds support for using FOU or GUE encapsulation with an ipip device operating in collect-metadata mode and a set of kfuncs for controlling encap parameters exposed to a BPF tc-hook. BPF tc-hooks allow us to read tunnel metadata (like remote IP addresses) in the ingress path of an externally controlled tunnel interface via the bpf_skb_get_tunnel_{key,opt} bpf-helpers. Packets can then be redirected to the same or a different externally controlled tunnel interface by overwriting metadata via the bpf_skb_set_tunnel_{key,opt} helpers and a call to bpf_redirect. This enables us to redirect packets between tunnel interfaces - and potentially change the encapsulation type - using only a single BPF program. Today this approach works fine for a couple of tunnel combinations. For example: redirecting packets between Geneve and GRE interfaces or GRE and plain ipip interfaces. However, redirecting using FOU or GUE is not supported today. The ip_tunnel module does not allow us to egress packets using additional UDP encapsulation from an ipip device in collect-metadata mode. Patch 1 lifts this restriction by adding a struct ip_tunnel_encap to the tunnel metadata. It can be filled by a new BPF kfunc introduced in Patch 2 and evaluated by the ip_tunnel egress path. This will allow us to use FOU and GUE encap with externally controlled ipip devices. Patch 2 introduces two new BPF kfuncs: bpf_skb_{set,get}_fou_encap. These helpers can be used to set and get UDP encap parameters from the BPF tc-hook doing the packet redirect. Patch 3 adds BPF tunnel selftests using the two kfuncs. --- v3: - Integrate selftest into test_progs (Alexei) v2: - Fixes for checkpatch.pl - Fixes for kernel test robot Christian Ehrig (3): ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs selftests/bpf: Test FOU kfuncs for externally controlled ipip devices include/net/fou.h | 2 + include/net/ip_tunnels.h | 28 ++-- net/ipv4/Makefile | 2 +- net/ipv4/fou_bpf.c | 119 ++++++++++++++ net/ipv4/fou_core.c | 5 + net/ipv4/ip_tunnel.c | 22 ++- net/ipv4/ipip.c | 1 + net/ipv6/sit.c | 2 +- .../selftests/bpf/prog_tests/test_tunnel.c | 153 +++++++++++++++++- .../selftests/bpf/progs/test_tunnel_kern.c | 117 ++++++++++++++ 10 files changed, 432 insertions(+), 19 deletions(-) create mode 100644 net/ipv4/fou_bpf.c