Message ID | 20220319130538.55741-4-fankaixi.li@bytedance.com (mailing list archive) |
---|---|
State | Superseded |
Delegated to: | BPF |
Headers | show |
Series | bpf: Add support to set and get tunnel source ip | expand |
On Sat, Mar 19, 2022 at 09:05:38PM +0800, fankaixi.li@bytedance.com wrote: > From: "kaixi.fan" <fankaixi.li@bytedance.com> > > Add two ipv6 address on underlay nic interface, and use bpf code to > configure the secondary ipv6 address as the vxlan tunnel source ip. > Then check ping6 result and log contains the correct tunnel source > ip. > > Signed-off-by: kaixi.fan <fankaixi.li@bytedance.com> > --- > .../selftests/bpf/progs/test_tunnel_kern.c | 46 ++++++++++++ > tools/testing/selftests/bpf/test_tunnel.sh | 71 +++++++++++++++---- > 2 files changed, 105 insertions(+), 12 deletions(-) > > diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > index 4a39556ef609..67cb7ca3e083 100644 > --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > @@ -736,4 +736,50 @@ int _vxlan_get_tunnel_src(struct __sk_buff *skb) > return TC_ACT_OK; > } > > +SEC("ip6vxlan_set_tunnel_src") > +int _ip6vxlan_set_tunnel_src(struct __sk_buff *skb) > +{ > + struct bpf_tunnel_key key; > + int ret; > + > + __builtin_memset(&key, 0x0, sizeof(key)); > + key.local_ipv6[3] = bpf_htonl(0xbb); /* ::bb */ > + key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */ > + key.tunnel_id = 22; > + key.tunnel_tos = 0; > + key.tunnel_ttl = 64; > + > + ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), > + BPF_F_TUNINFO_IPV6); > + if (ret < 0) { > + ERROR(ret); > + return TC_ACT_SHOT; > + } > + > + return TC_ACT_OK; > +} > + > +SEC("ip6vxlan_get_tunnel_src") > +int _ip6vxlan_get_tunnel_src(struct __sk_buff *skb) > +{ > + char fmt[] = "key %d remote ip6 ::%x source ip6 ::%x\n"; > + char fmt2[] = "label %x\n"; > + struct bpf_tunnel_key key; > + int ret; > + > + ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), > + BPF_F_TUNINFO_IPV6); > + if (ret < 0) { > + ERROR(ret); > + return TC_ACT_SHOT; > + } > + > + bpf_trace_printk(fmt, sizeof(fmt), > + key.tunnel_id, key.remote_ipv6[3], key.local_ipv6[3]); > + bpf_trace_printk(fmt2, sizeof(fmt2), > + key.tunnel_label); How is the printk output used? Is the output text verified in the test_tunnel.sh? Can the values be checked in the bpf prog itself to avoid the printk? The same goes for the patch 2. > + > + return TC_ACT_OK; > +} > + > char _license[] SEC("license") = "GPL"; > diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh > index 62ef5c998b6a..a0f9a5c5e0a5 100755 > --- a/tools/testing/selftests/bpf/test_tunnel.sh > +++ b/tools/testing/selftests/bpf/test_tunnel.sh > @@ -67,6 +67,11 @@ add_second_ip() > ip addr add dev veth1 172.16.1.20/24 > } > > +add_second_ip6() > +{ > + ip addr add dev veth1 ::bb/96 > +} > + > add_gre_tunnel() > { > # at_ns0 namespace > @@ -94,7 +99,7 @@ add_ip6gretap_tunnel() > # at_ns0 namespace > ip netns exec at_ns0 \ > ip link add dev $DEV_NS type $TYPE seq flowlabel 0xbcdef key 2 \ > - local ::11 remote ::22 > + local ::11 remote $REMOTE_IP6 > > ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 > ip netns exec at_ns0 ip addr add dev $DEV_NS fc80::100/96 > @@ -143,7 +148,7 @@ add_ip6erspan_tunnel() > if [ "$1" == "v1" ]; then > ip netns exec at_ns0 \ > ip link add dev $DEV_NS type $TYPE seq key 2 \ > - local ::11 remote ::22 \ > + local ::11 remote $REMOTE_IP6 \ afaict, only add_ip6vxlan_tunnel needs something other than ::22, so this and other similar code churns is not necessary? > erspan_ver 1 erspan 123 > else > ip netns exec at_ns0 \ > @@ -196,7 +201,7 @@ add_ip6vxlan_tunnel() > # at_ns0 namespace > ip netns exec at_ns0 \ > ip link add dev $DEV_NS type $TYPE id 22 dstport 4789 \ > - local ::11 remote ::22 > + local ::11 remote $REMOTE_IP6 Can it be an optional argument instead and default to ::22 ? Also, using $1 is as good? [ ... ] > +test_ip6vxlan_tunsrc() > +{ > + TYPE=vxlan > + DEV_NS=ip6vxlan00 > + DEV=ip6vxlan11 > + REMOTE_IP6=::bb > + ret=0 > + > + check $TYPE > + config_device > + add_second_ip6 > + add_ip6vxlan_tunnel $REMOTE_IP6 here. It seems most of the patch needs is add_ip6vxlan_tunnel '::bb' > + ip link set dev veth1 mtu 1500 > + attach_bpf $DEV ip6vxlan_set_tunnel_src ip6vxlan_get_tunnel_src > + # underlay > + ping6 $PING_ARG ::11 > + # ip4 over ip6 > + ping $PING_ARG 10.1.1.100 > + check_err $? > + ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 > + check_err $? > + cleanup > + > + if [ $ret -ne 0 ]; then > + echo -e ${RED}"FAIL: ip6$TYPE"${NC} > + return 1 > + fi > + echo -e ${GREEN}"PASS: ip6$TYPE"${NC} > +} > + > attach_bpf() > { > DEV=$1 > @@ -818,6 +860,11 @@ bpf_tunnel_test() > test_vxlan_tunsrc > errors=$(( $errors + $? )) > > + > + echo "Testing IP6VXLAN tunnel source..." > + test_ip6vxlan_tunsrc > + errors=$(( $errors + $? )) > + > return $errors > } > > -- > 2.24.3 (Apple Git-128) >
Martin KaFai Lau <kafai@fb.com> 于2022年3月22日周二 08:33写道: > > On Sat, Mar 19, 2022 at 09:05:38PM +0800, fankaixi.li@bytedance.com wrote: > > From: "kaixi.fan" <fankaixi.li@bytedance.com> > > > > Add two ipv6 address on underlay nic interface, and use bpf code to > > configure the secondary ipv6 address as the vxlan tunnel source ip. > > Then check ping6 result and log contains the correct tunnel source > > ip. > > > > Signed-off-by: kaixi.fan <fankaixi.li@bytedance.com> > > --- > > .../selftests/bpf/progs/test_tunnel_kern.c | 46 ++++++++++++ > > tools/testing/selftests/bpf/test_tunnel.sh | 71 +++++++++++++++---- > > 2 files changed, 105 insertions(+), 12 deletions(-) > > > > diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > > index 4a39556ef609..67cb7ca3e083 100644 > > --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > > +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > > @@ -736,4 +736,50 @@ int _vxlan_get_tunnel_src(struct __sk_buff *skb) > > return TC_ACT_OK; > > } > > > > +SEC("ip6vxlan_set_tunnel_src") > > +int _ip6vxlan_set_tunnel_src(struct __sk_buff *skb) > > +{ > > + struct bpf_tunnel_key key; > > + int ret; > > + > > + __builtin_memset(&key, 0x0, sizeof(key)); > > + key.local_ipv6[3] = bpf_htonl(0xbb); /* ::bb */ > > + key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */ > > + key.tunnel_id = 22; > > + key.tunnel_tos = 0; > > + key.tunnel_ttl = 64; > > + > > + ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), > > + BPF_F_TUNINFO_IPV6); > > + if (ret < 0) { > > + ERROR(ret); > > + return TC_ACT_SHOT; > > + } > > + > > + return TC_ACT_OK; > > +} > > + > > +SEC("ip6vxlan_get_tunnel_src") > > +int _ip6vxlan_get_tunnel_src(struct __sk_buff *skb) > > +{ > > + char fmt[] = "key %d remote ip6 ::%x source ip6 ::%x\n"; > > + char fmt2[] = "label %x\n"; > > + struct bpf_tunnel_key key; > > + int ret; > > + > > + ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), > > + BPF_F_TUNINFO_IPV6); > > + if (ret < 0) { > > + ERROR(ret); > > + return TC_ACT_SHOT; > > + } > > + > > + bpf_trace_printk(fmt, sizeof(fmt), > > + key.tunnel_id, key.remote_ipv6[3], key.local_ipv6[3]); > > + bpf_trace_printk(fmt2, sizeof(fmt2), > > + key.tunnel_label); > How is the printk output used? Is the output text verified in the > test_tunnel.sh? > Can the values be checked in the bpf prog itself to avoid the printk? > > The same goes for the patch 2. > > > + > > + return TC_ACT_OK; > > +} > > + > > char _license[] SEC("license") = "GPL"; > > diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh > > index 62ef5c998b6a..a0f9a5c5e0a5 100755 > > --- a/tools/testing/selftests/bpf/test_tunnel.sh > > +++ b/tools/testing/selftests/bpf/test_tunnel.sh > > @@ -67,6 +67,11 @@ add_second_ip() > > ip addr add dev veth1 172.16.1.20/24 > > } > > > > +add_second_ip6() > > +{ > > + ip addr add dev veth1 ::bb/96 > > +} > > + > > add_gre_tunnel() > > { > > # at_ns0 namespace > > @@ -94,7 +99,7 @@ add_ip6gretap_tunnel() > > # at_ns0 namespace > > ip netns exec at_ns0 \ > > ip link add dev $DEV_NS type $TYPE seq flowlabel 0xbcdef key 2 \ > > - local ::11 remote ::22 > > + local ::11 remote $REMOTE_IP6 > > > > ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 > > ip netns exec at_ns0 ip addr add dev $DEV_NS fc80::100/96 > > @@ -143,7 +148,7 @@ add_ip6erspan_tunnel() > > if [ "$1" == "v1" ]; then > > ip netns exec at_ns0 \ > > ip link add dev $DEV_NS type $TYPE seq key 2 \ > > - local ::11 remote ::22 \ > > + local ::11 remote $REMOTE_IP6 \ > afaict, only add_ip6vxlan_tunnel needs something other than ::22, > so this and other similar code churns is not necessary? > > > erspan_ver 1 erspan 123 > > else > > ip netns exec at_ns0 \ > > @@ -196,7 +201,7 @@ add_ip6vxlan_tunnel() > > # at_ns0 namespace > > ip netns exec at_ns0 \ > > ip link add dev $DEV_NS type $TYPE id 22 dstport 4789 \ > > - local ::11 remote ::22 > > + local ::11 remote $REMOTE_IP6 > Can it be an optional argument instead and default to ::22 ? > > Also, using $1 is as good? > > [ ... ] > > > +test_ip6vxlan_tunsrc() > > +{ > > + TYPE=vxlan > > + DEV_NS=ip6vxlan00 > > + DEV=ip6vxlan11 > > + REMOTE_IP6=::bb > > + ret=0 > > + > > + check $TYPE > > + config_device > > + add_second_ip6 > > + add_ip6vxlan_tunnel $REMOTE_IP6 > here. It seems most of the patch needs is > add_ip6vxlan_tunnel '::bb' > > > + ip link set dev veth1 mtu 1500 > > + attach_bpf $DEV ip6vxlan_set_tunnel_src ip6vxlan_get_tunnel_src > > + # underlay > > + ping6 $PING_ARG ::11 > > + # ip4 over ip6 > > + ping $PING_ARG 10.1.1.100 > > + check_err $? > > + ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 > > + check_err $? > > + cleanup > > + > > + if [ $ret -ne 0 ]; then > > + echo -e ${RED}"FAIL: ip6$TYPE"${NC} > > + return 1 > > + fi > > + echo -e ${GREEN}"PASS: ip6$TYPE"${NC} > > +} > > + > > attach_bpf() > > { > > DEV=$1 > > @@ -818,6 +860,11 @@ bpf_tunnel_test() > > test_vxlan_tunsrc > > errors=$(( $errors + $? )) > > > > + > > + echo "Testing IP6VXLAN tunnel source..." > > + test_ip6vxlan_tunsrc > > + errors=$(( $errors + $? )) > > + > > return $errors > > } > > > > -- > > 2.24.3 (Apple Git-128) > > Thanks. Maybe it's better to attach a bpf prog to the ingress of tunnel device in namespace "at_ns0". This prog could be used to check the tunnel source ip. "add_ip6vxlan_tunnel" and "add_vxlan_tunnel" would be reflected to accept an argument as tunnel remote ip.
diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c index 4a39556ef609..67cb7ca3e083 100644 --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c @@ -736,4 +736,50 @@ int _vxlan_get_tunnel_src(struct __sk_buff *skb) return TC_ACT_OK; } +SEC("ip6vxlan_set_tunnel_src") +int _ip6vxlan_set_tunnel_src(struct __sk_buff *skb) +{ + struct bpf_tunnel_key key; + int ret; + + __builtin_memset(&key, 0x0, sizeof(key)); + key.local_ipv6[3] = bpf_htonl(0xbb); /* ::bb */ + key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */ + key.tunnel_id = 22; + key.tunnel_tos = 0; + key.tunnel_ttl = 64; + + ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), + BPF_F_TUNINFO_IPV6); + if (ret < 0) { + ERROR(ret); + return TC_ACT_SHOT; + } + + return TC_ACT_OK; +} + +SEC("ip6vxlan_get_tunnel_src") +int _ip6vxlan_get_tunnel_src(struct __sk_buff *skb) +{ + char fmt[] = "key %d remote ip6 ::%x source ip6 ::%x\n"; + char fmt2[] = "label %x\n"; + struct bpf_tunnel_key key; + int ret; + + ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), + BPF_F_TUNINFO_IPV6); + if (ret < 0) { + ERROR(ret); + return TC_ACT_SHOT; + } + + bpf_trace_printk(fmt, sizeof(fmt), + key.tunnel_id, key.remote_ipv6[3], key.local_ipv6[3]); + bpf_trace_printk(fmt2, sizeof(fmt2), + key.tunnel_label); + + return TC_ACT_OK; +} + char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh index 62ef5c998b6a..a0f9a5c5e0a5 100755 --- a/tools/testing/selftests/bpf/test_tunnel.sh +++ b/tools/testing/selftests/bpf/test_tunnel.sh @@ -67,6 +67,11 @@ add_second_ip() ip addr add dev veth1 172.16.1.20/24 } +add_second_ip6() +{ + ip addr add dev veth1 ::bb/96 +} + add_gre_tunnel() { # at_ns0 namespace @@ -94,7 +99,7 @@ add_ip6gretap_tunnel() # at_ns0 namespace ip netns exec at_ns0 \ ip link add dev $DEV_NS type $TYPE seq flowlabel 0xbcdef key 2 \ - local ::11 remote ::22 + local ::11 remote $REMOTE_IP6 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 ip netns exec at_ns0 ip addr add dev $DEV_NS fc80::100/96 @@ -143,7 +148,7 @@ add_ip6erspan_tunnel() if [ "$1" == "v1" ]; then ip netns exec at_ns0 \ ip link add dev $DEV_NS type $TYPE seq key 2 \ - local ::11 remote ::22 \ + local ::11 remote $REMOTE_IP6 \ erspan_ver 1 erspan 123 else ip netns exec at_ns0 \ @@ -196,7 +201,7 @@ add_ip6vxlan_tunnel() # at_ns0 namespace ip netns exec at_ns0 \ ip link add dev $DEV_NS type $TYPE id 22 dstport 4789 \ - local ::11 remote ::22 + local ::11 remote $REMOTE_IP6 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 ip netns exec at_ns0 ip link set dev $DEV_NS up @@ -231,7 +236,7 @@ add_ip6geneve_tunnel() # at_ns0 namespace ip netns exec at_ns0 \ ip link add dev $DEV_NS type $TYPE id 22 \ - remote ::22 # geneve has no local option + remote $REMOTE_IP6 # geneve has no local option ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 ip netns exec at_ns0 ip link set dev $DEV_NS up @@ -266,7 +271,7 @@ add_ip6tnl_tunnel() # at_ns0 namespace ip netns exec at_ns0 \ ip link add dev $DEV_NS type $TYPE \ - local ::11 remote ::22 + local ::11 remote $REMOTE_IP6 ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 ip netns exec at_ns0 ip addr add dev $DEV_NS 1::11/96 ip netns exec at_ns0 ip link set dev $DEV_NS up @@ -307,12 +312,13 @@ test_ip6gre() TYPE=ip6gre DEV_NS=ip6gre00 DEV=ip6gre11 + REMOTE_IP6=::22 ret=0 check $TYPE config_device # reuse the ip6gretap function - add_ip6gretap_tunnel + add_ip6gretap_tunnel $REMOTE_IP6 attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel # underlay ping6 $PING_ARG ::11 @@ -337,11 +343,12 @@ test_ip6gretap() TYPE=ip6gretap DEV_NS=ip6gretap00 DEV=ip6gretap11 + REMOTE_IP6=::22 ret=0 check $TYPE config_device - add_ip6gretap_tunnel + add_ip6gretap_tunnel $REMOTE_IP6 attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel # underlay ping6 $PING_ARG ::11 @@ -390,11 +397,12 @@ test_ip6erspan() TYPE=ip6erspan DEV_NS=ip6erspan00 DEV=ip6erspan11 + REMOTE_IP6=::22 ret=0 check $TYPE config_device - add_ip6erspan_tunnel $1 + add_ip6erspan_tunnel $1 $REMOTE_IP6 attach_bpf $DEV ip4ip6erspan_set_tunnel ip4ip6erspan_get_tunnel ping6 $PING_ARG ::11 ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 @@ -438,11 +446,12 @@ test_ip6vxlan() TYPE=vxlan DEV_NS=ip6vxlan00 DEV=ip6vxlan11 + REMOTE_IP6=::22 ret=0 check $TYPE config_device - add_ip6vxlan_tunnel + add_ip6vxlan_tunnel $REMOTE_IP6 ip link set dev veth1 mtu 1500 attach_bpf $DEV ip6vxlan_set_tunnel ip6vxlan_get_tunnel # underlay @@ -490,11 +499,12 @@ test_ip6geneve() TYPE=geneve DEV_NS=ip6geneve00 DEV=ip6geneve11 + REMOTE_IP6=::22 ret=0 check $TYPE config_device - add_ip6geneve_tunnel + add_ip6geneve_tunnel $REMOTE_IP6 attach_bpf $DEV ip6geneve_set_tunnel ip6geneve_get_tunnel ping $PING_ARG 10.1.1.100 check_err $? @@ -539,11 +549,12 @@ test_ipip6() TYPE=ip6tnl DEV_NS=ipip6tnl00 DEV=ipip6tnl11 + REMOTE_IP6=::22 ret=0 check $TYPE config_device - add_ip6tnl_tunnel + add_ip6tnl_tunnel $REMOTE_IP6 ip link set dev veth1 mtu 1500 attach_bpf $DEV ipip6_set_tunnel ipip6_get_tunnel # underlay @@ -567,11 +578,12 @@ test_ip6ip6() TYPE=ip6tnl DEV_NS=ip6ip6tnl00 DEV=ip6ip6tnl11 + REMOTE_IP6=::22 ret=0 check $TYPE config_device - add_ip6tnl_tunnel + add_ip6tnl_tunnel $REMOTE_IP6 ip link set dev veth1 mtu 1500 attach_bpf $DEV ip6ip6_set_tunnel ip6ip6_get_tunnel # underlay @@ -693,6 +705,36 @@ test_vxlan_tunsrc() echo -e ${GREEN}"PASS: $TYPE"${NC} } +test_ip6vxlan_tunsrc() +{ + TYPE=vxlan + DEV_NS=ip6vxlan00 + DEV=ip6vxlan11 + REMOTE_IP6=::bb + ret=0 + + check $TYPE + config_device + add_second_ip6 + add_ip6vxlan_tunnel $REMOTE_IP6 + ip link set dev veth1 mtu 1500 + attach_bpf $DEV ip6vxlan_set_tunnel_src ip6vxlan_get_tunnel_src + # underlay + ping6 $PING_ARG ::11 + # ip4 over ip6 + ping $PING_ARG 10.1.1.100 + check_err $? + ip netns exec at_ns0 ping $PING_ARG 10.1.1.200 + check_err $? + cleanup + + if [ $ret -ne 0 ]; then + echo -e ${RED}"FAIL: ip6$TYPE"${NC} + return 1 + fi + echo -e ${GREEN}"PASS: ip6$TYPE"${NC} +} + attach_bpf() { DEV=$1 @@ -818,6 +860,11 @@ bpf_tunnel_test() test_vxlan_tunsrc errors=$(( $errors + $? )) + + echo "Testing IP6VXLAN tunnel source..." + test_ip6vxlan_tunsrc + errors=$(( $errors + $? )) + return $errors }