Add FOU support for externally controlled ipip devices
Subsystems (6)
v3 cover Add FOU support for externally controlled ipip devices
This patch set adds support for using FOU or GUE encapsulation with an ipip device operating in collect-metadata mode and a set of kfuncs for controlling encap parameters exposed to a BPF tc-hook.
BPF tc-hooks allow us to read tunnel metadata (like remote IP addresses) in the ingress path of an externally controlled tunnel interface via the bpf_skb_get_tunnel_{key,opt} bpf-helpers. Packets can then be redirected to the same or a different externally controlled tunnel interface by overwriting metadata via the bpf_skb_set_tunnel_{key,opt} helpers and a call to bpf_redirect. This enables us to redirect packets between tunnel interfaces - and potentially change the encapsulation type - using only a single BPF program.
Today this approach works fine for a couple of tunnel combinations. For example: redirecting packets between Geneve and GRE interfaces or GRE and plain ipip interfaces. However, redirecting using FOU or GUE is not supported today. The ip_tunnel module does not allow us to egress packets using additional UDP encapsulation from an ipip device in collect-metadata mode.
Patch 1 lifts this restriction by adding a struct ip_tunnel_encap to the tunnel metadata. It can be filled by a new BPF kfunc introduced in Patch 2 and evaluated by the ip_tunnel egress path. This will allow us to use FOU and GUE encap with externally controlled ipip devices.
Patch 2 introduces two new BPF kfuncs: bpf_skb_{set,get}_fou_encap. These helpers can be used to set and get UDP encap parameters from the BPF tc-hook doing the packet redirect.
Patch 3 adds BPF tunnel selftests using the two kfuncs.
---
v3:
- Integrate selftest into test_progs (Alexei)
v2:
- Fixes for checkpatch.pl
- Fixes for kernel test robot
Christian Ehrig (3):
ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip
devices
bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs selftests/bpf: Test FOU kfuncs for externally controlled ipip devices
include/net/fou.h | 2 + include/net/ip_tunnels.h | 28 ++-- net/ipv4/Makefile | 2 +- net/ipv4/fou_bpf.c | 119 ++++++++++++++ net/ipv4/fou_core.c | 5 + net/ipv4/ip_tunnel.c | 22 ++- net/ipv4/ipip.c | 1 + net/ipv6/sit.c | 2 +- .../selftests/bpf/prog_tests/test_tunnel.c | 153 +++++++++++++++++- .../selftests/bpf/progs/test_tunnel_kern.c | 117 ++++++++++++++ 10 files changed, 432 insertions(+), 19 deletions(-) create mode 100644 net/ipv4/fou_bpf.c
Signature · 1 line
2.39.2
PATCH v3 1/3 ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices
Today ipip devices in collect-metadata mode don't allow for sending FOU or GUE encapsulated packets. This patch lifts the restriction by adding a struct ip_tunnel_encap to the tunnel metadata.
On the egress path, the members of this struct can be set by the bpf_skb_set_fou_encap kfunc via a BPF tc-hook. Instead of dropping packets wishing to use additional UDP encapsulation, ip_md_tunnel_xmit now evaluates the contents of this struct and adds the corresponding FOU or GUE header. Furthermore, it is making sure that additional header bytes are taken into account for PMTU discovery.
On the ingress path, an ipip device in collect-metadata mode will fill this struct and a BPF tc-hook can obtain the information via a call to the bpf_skb_get_fou_encap kfunc.
The minor change to ip_tunnel_encap, which now takes a pointer to struct ip_tunnel_encap instead of struct ip_tunnel, allows us to control FOU encap type and parameters on a per packet-level.
--- include/net/ip_tunnels.h | 28 +++++++++++++++------------- net/ipv4/ip_tunnel.c | 22 ++++++++++++++++++++-- net/ipv4/ipip.c | 1 + net/ipv6/sit.c | 2 +- 4 files changed, 37 insertions(+), 16 deletions(-)
include/net/ip_tunnels.h +15 -13
@@ -57,6 +57,13 @@ struct ip_tunnel_key {__u8 flow_flags; }; +struct ip_tunnel_encap { +u16 type; +u16 flags; +__be16 sport; +__be16 dport; +}; +/* Flags for ip_tunnel_info mode. */ #define IP_TUNNEL_INFO_TX 0x01/* represents tx tunnel parameters */ #define IP_TUNNEL_INFO_IPV6 0x02/* key contains IPv6 addresses */
@@ -66,9 +73,9 @@ struct ip_tunnel_key {#define IP_TUNNEL_OPTS_MAX \ GENMASK((sizeof_field(struct ip_tunnel_info, \ options_len) * BITS_PER_BYTE) - 1, 0) -struct ip_tunnel_info {struct ip_tunnel_key key; +struct ip_tunnel_encap encap;#ifdef CONFIG_DST_CACHE struct dst_cache dst_cache;#endif
@@ -86,13 +93,6 @@ struct ip_tunnel_6rd_parm { };#endif -struct ip_tunnel_encap { -u16 type; -u16 flags; -__be16 sport; -__be16 dport; -}; -struct ip_tunnel_prl_entry {struct ip_tunnel_prl_entry __rcu *next;__be32 addr;
@@ -293,6 +293,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, __be32 remote, __be32 local, __be32 key); +void ip_tunnel_md_udp_encap (struct sk_buff *skb,struct ip_tunnel_info *info);int ip_tunnel_rcv (struct ip_tunnel *tunnel,struct sk_buff *skb,const struct tnl_ptk_info *tpi,struct metadata_dst *tun_dst,bool log_ecn_error);
@@ -371,22 +372,23 @@ static inline int ip_encap_hlen(struct ip_tunnel_encap *e)return hlen; } -static inline int ip_tunnel_encap (struct sk_buff *skb,struct ip_tunnel *t, +static inline int ip_tunnel_encap (struct sk_buff *skb, +struct ip_tunnel_encap *e,u8 *protocol,struct flowi4 *fl4) {const struct ip_tunnel_encap_ops *ops;int ret = -EINVAL ; -if (t->encap.type ==TUNNEL_ENCAP_NONE ) +if (e->type ==TUNNEL_ENCAP_NONE )return 0 ; -if (t->encap.type >=MAX_IPTUN_ENCAP_OPS ) +if (e->type >=MAX_IPTUN_ENCAP_OPS )return -EINVAL ;rcu_read_lock (); - ops =rcu_dereference (iptun_encaps[t->encap.type]); + ops =rcu_dereference (iptun_encaps[e->type]);if (likely (ops && ops->build_header)) - ret = ops->build_header (skb, &t->encap, protocol, fl4); + ret = ops->build_header (skb, e, protocol, fl4);rcu_read_unlock ();return ret;
net/ipv4/ip_tunnel.c +20 -2
@@ -359,6 +359,20 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,return ERR_PTR (err); } +void ip_tunnel_md_udp_encap (struct sk_buff *skb,struct ip_tunnel_info *info) +{ +const struct iphdr *iph =ip_hdr (skb); +const struct udphdr *udph; + +if (iph->protocol !=IPPROTO_UDP ) +return ; + + udph = (struct udphdr *)((__u8 *)iph + (iph->ihl <<2 )); + info->encap.sport = udph->source; + info->encap.dport = udph->dest; +} +EXPORT_SYMBOL (ip_tunnel_md_udp_encap); +int ip_tunnel_rcv (struct ip_tunnel *tunnel,struct sk_buff *skb,const struct tnl_ptk_info *tpi,struct metadata_dst *tun_dst,bool log_ecn_error)
@@ -572,7 +586,11 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,tunnel_id_to_key32 (key->tun_id),RT_TOS (tos),dev_net (dev),0 , skb->mark,skb_get_hash (skb), key->flow_flags); -if (tunnel->encap.type !=TUNNEL_ENCAP_NONE ) + +if (!tunnel_hlen) + tunnel_hlen =ip_encap_hlen (&tun_info->encap); + +if (ip_tunnel_encap (skb, &tun_info->encap, &proto, &fl4) <0 ) goto tx_error; use_cache =ip_tunnel_dst_cache_usable (skb, tun_info);
@@ -732,7 +750,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,dev_net (dev), tunnel->parms.link, tunnel->fwmark, skb_get_hash(skb), 0); -if (ip_tunnel_encap (skb, tunnel, &protocol, &fl4) <0 ) +if (ip_tunnel_encap (skb, &tunnel->encap, &protocol, &fl4) <0 ) goto tx_error;if (connected && md) {
net/ipv4/ipip.c +1 -0
@@ -241,6 +241,7 @@ static int ipip_tunnel_rcv(struct sk_buff *skb, u8 ipproto) tun_dst =ip_tun_rx_dst (skb,0 ,0 ,0 );if (!tun_dst)return 0 ; +ip_tunnel_md_udp_encap (skb, &tun_dst->u.tun_info); }skb_reset_mac_header (skb);
net/ipv6/sit.c +1 -1
@@ -1024,7 +1024,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, ttl = iph6->hop_limit; tos =INET_ECN_encapsulate (tos,ipv6_get_dsfield (iph6)); -if (ip_tunnel_encap (skb, tunnel, &protocol, &fl4) <0 ) { +if (ip_tunnel_encap (skb, &tunnel->encap, &protocol, &fl4) <0 ) {ip_rt_put (rt); goto tx_error; }
Signature · 1 line
2.39.2
PATCH v3 2/3 bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs
In reply to Christian EhrigAdd two new kfuncs that allow a BPF tc-hook, installed on an ipip device in collect-metadata mode, to control FOU encap parameters on a per-packet level. The set of kfuncs is registered with the fou module.
The bpf_skb_set_fou_encap kfunc is supposed to be used in tandem and after a successful call to the bpf_skb_set_tunnel_key bpf-helper. UDP source and destination ports can be controlled by passing a struct bpf_fou_encap. A source port of zero will auto-assign a source port. enum bpf_fou_encap_type is used to specify if the egress path should FOU or GUE encap the packet.
On the ingress path bpf_skb_get_fou_encap can be used to read UDP source and destination ports from the receiver's point of view and allows for packet multiplexing across different destination ports within a single BPF program and ipip device.
--- include/net/fou.h | 2 + net/ipv4/Makefile | 2 +- net/ipv4/fou_bpf.c | 119 ++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/fou_core.c | 5 ++ 4 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 net/ipv4/fou_bpf.c
include/net/fou.h +2 -0
@@ -17,4 +17,6 @@ int __fou_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,int __gue_build_header (struct sk_buff *skb,struct ip_tunnel_encap *e,u8 *protocol,__be16 *sport,int type); +int register_fou_bpf (void ); +#endif
net/ipv4/Makefile +1 -1
@@ -26,7 +26,7 @@ obj-$(CONFIG_IP_MROUTE) += ipmr.o obj-$(CONFIG_IP_MROUTE_COMMON) += ipmr_base.o obj-$(CONFIG_NET_IPIP) += ipip.o gre-y := gre_demux.o -fou-y := fou_core.o fou_nl.o +fou-y := fou_core.o fou_nl.o fou_bpf.o obj-$(CONFIG_NET_FOU) += fou.o obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o obj-$(CONFIG_NET_IPGRE) += ip_gre.o
net/ipv4/fou_bpf.c new file +119 -0
119 lines not on this page · raw message
net/ipv4/fou_core.c +5 -0
@@ -1236,10 +1236,15 @@ static int __init fou_init(void)if (ret <0 ) goto unregister; + ret =register_fou_bpf (); +if (ret <0 ) + goto kfunc_failed; + ret =ip_tunnel_encap_add_fou_ops ();if (ret ==0 )return 0 ; +kfunc_failed:genl_unregister_family (&fou_nl_family); unregister:unregister_pernet_device (&fou_net_ops);
Signature · 1 line
2.39.2
PATCH v3 3/3 selftests/bpf: Test FOU kfuncs for externally controlled ipip devices
In reply to Christian EhrigAdd tests for FOU and GUE encapsulation via the bpf_skb_{set,get}_fou_encap kfuncs, using ipip devices in collect-metadata mode.
These tests make sure that we can successfully set and obtain FOU and GUE encap parameters using ingress / egress BPF tc-hooks.
--- .../selftests/bpf/prog_tests/test_tunnel.c | 153 +++++++++++++++++- .../selftests/bpf/progs/test_tunnel_kern.c | 117 ++++++++++++++ 2 files changed, 268 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/prog_tests/test_tunnel.c +151 -2
@@ -89,6 +89,9 @@#define IP6VXLAN_TUNL_DEV0 "ip6vxlan00"#define IP6VXLAN_TUNL_DEV1 "ip6vxlan11" +#define IPIP_TUNL_DEV0 "ipip00" +#define IPIP_TUNL_DEV1 "ipip11" +#define PING_ARGS "-i 0.01 -c 3 -w 10 -q"static int config_device (void )
@@ -188,6 +191,79 @@ static void delete_ip6vxlan_tunnel(void)SYS_NOFAIL ("ip link delete dev %s" ,IP6VXLAN_TUNL_DEV1 ); } +enum ipip_encap { +NONE =0 , +FOU =1 , +GUE =2 , +}; + +static int set_ipip_encap (const char *ipproto,const char *type) +{ +SYS (fail,"ip -n at_ns0 fou add port 5555 %s" , ipproto); +SYS (fail,"ip -n at_ns0 link set dev %s type ipip encap %s" , +IPIP_TUNL_DEV0 , type); +SYS (fail,"ip -n at_ns0 link set dev %s type ipip encap-dport 5555" , +IPIP_TUNL_DEV0 ); + +return 0 ; +fail: +return -1 ; +} + +static int add_ipip_tunnel (enum ipip_encap encap) +{ +int err; +const char *ipproto, *type; + +switch (encap) { +case FOU : + ipproto ="ipproto 4" ; + type ="fou" ; +break ; +case GUE : + ipproto ="gue" ; + type = ipproto; +break ; +default : + ipproto =NULL ; + type = ipproto; + } + +/* at_ns0 namespace */ +SYS (fail,"ip -n at_ns0 link add dev %s type ipip local %s remote %s" , +IPIP_TUNL_DEV0 ,IP4_ADDR_VETH0 ,IP4_ADDR1_VETH1 ); + +if (type && ipproto) { + err =set_ipip_encap (ipproto, type); +if (!ASSERT_OK (err,"set_ipip_encap" )) + goto fail; + } + +SYS (fail,"ip -n at_ns0 link set dev %s up" ,IPIP_TUNL_DEV0 ); +SYS (fail,"ip -n at_ns0 addr add dev %s %s/24" , +IPIP_TUNL_DEV0 ,IP4_ADDR_TUNL_DEV0 ); + +/* root namespace */ +if (type && ipproto) +SYS (fail,"ip fou add port 5555 %s" , ipproto); +SYS (fail,"ip link add dev %s type ipip external" ,IPIP_TUNL_DEV1 ); +SYS (fail,"ip link set dev %s up" ,IPIP_TUNL_DEV1 ); +SYS (fail,"ip addr add dev %s %s/24" ,IPIP_TUNL_DEV1 , +IP4_ADDR_TUNL_DEV1 ); + +return 0 ; +fail: +return -1 ; +} + +static void delete_ipip_tunnel (void ) +{ +SYS_NOFAIL ("ip -n at_ns0 link delete dev %s" ,IPIP_TUNL_DEV0 ); +SYS_NOFAIL ("ip -n at_ns0 fou del port 5555 2> /dev/null" ); +SYS_NOFAIL ("ip link delete dev %s" ,IPIP_TUNL_DEV1 ); +SYS_NOFAIL ("ip fou del port 5555 2> /dev/null" ); +} +static int test_ping (int family,const char *addr) {SYS (fail,"%s %s %s > /dev/null" ,ping_command (family),PING_ARGS , addr);
@@ -386,10 +462,80 @@ static void test_ip6vxlan_tunnel(void)test_tunnel_kern__destroy (skel); } -#define RUN_TEST (name) \ +static void test_ipip_tunnel (enum ipip_encap encap) +{ +struct test_tunnel_kern *skel =NULL ; +struct nstoken *nstoken; +int set_src_prog_fd, get_src_prog_fd; +int ifindex =-1 ; +int err; +DECLARE_LIBBPF_OPTS (bpf_tc_hook, tc_hook, + .attach_point = BPF_TC_INGRESS); + +/* add ipip tunnel */ + err =add_ipip_tunnel (encap); +if (!ASSERT_OK (err,"add_ipip_tunnel" )) + goto done; + +/* load and attach bpf prog to tunnel dev tc hook point */ + skel =test_tunnel_kern__open_and_load (); +if (!ASSERT_OK_PTR (skel,"test_tunnel_kern__open_and_load" )) + goto done; + ifindex =if_nametoindex (IPIP_TUNL_DEV1 ); +if (!ASSERT_NEQ (ifindex,0 ,"ipip11 ifindex" )) + goto done; + tc_hook.ifindex = ifindex; + +switch (encap) { +case FOU : + get_src_prog_fd =bpf_program__fd ( + skel->progs.ipip_encap_get_tunnel); + set_src_prog_fd =bpf_program__fd ( + skel->progs.ipip_fou_set_tunnel); +break ; +case GUE : + get_src_prog_fd =bpf_program__fd ( + skel->progs.ipip_encap_get_tunnel); + set_src_prog_fd =bpf_program__fd ( + skel->progs.ipip_gue_set_tunnel); +break ; +default : + get_src_prog_fd =bpf_program__fd ( + skel->progs.ipip_get_tunnel); + set_src_prog_fd =bpf_program__fd ( + skel->progs.ipip_set_tunnel); + } + +if (!ASSERT_GE (set_src_prog_fd,0 ,"bpf_program__fd" )) + goto done; +if (!ASSERT_GE (get_src_prog_fd,0 ,"bpf_program__fd" )) + goto done; +if (attach_tc_prog (&tc_hook, get_src_prog_fd, set_src_prog_fd)) + goto done; + +/* ping from root namespace test */ + err =test_ping (AF_INET ,IP4_ADDR_TUNL_DEV0 ); +if (!ASSERT_OK (err,"test_ping" )) + goto done; + +/* ping from at_ns0 namespace test */ + nstoken =open_netns ("at_ns0" ); + err =test_ping (AF_INET ,IP4_ADDR_TUNL_DEV1 ); +if (!ASSERT_OK (err,"test_ping" )) + goto done; +close_netns (nstoken); + +done: +/* delete ipip tunnel */ +delete_ipip_tunnel (); +if (skel) +test_tunnel_kern__destroy (skel); +} + +#define RUN_TEST (name, ...) \ ({ \ if (test__start_subtest(#name)) { \ - test_ ## name(); \ + test_ ## name(__VA_ARGS__); \ } \ })
@@ -400,6 +546,9 @@ static void *test_tunnel_run_tests(void *arg)RUN_TEST (vxlan_tunnel);RUN_TEST (ip6vxlan_tunnel); +RUN_TEST (ipip_tunnel,NONE ); +RUN_TEST (ipip_tunnel,FOU ); +RUN_TEST (ipip_tunnel,GUE );cleanup ();
tools/testing/selftests/bpf/progs/test_tunnel_kern.c +117 -0
129 lines not on this page · raw message
Signature · 1 line
2.39.2
This series was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <[email protected]>:
Hello:
This series was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <[email protected]>:
Quoted 13 lines · On Fri, 7 Apr 2023 15:38:52 +0200 you wrote:
This patch set adds support for using FOU or GUE encapsulation with an ipip device operating in collect-metadata mode and a set of kfuncs for controlling encap parameters exposed to a BPF tc-hook.
BPF tc-hooks allow us to read tunnel metadata (like remote IP addresses) in the ingress path of an externally controlled tunnel interface via the bpf_skb_get_tunnel_{key,opt} bpf-helpers. Packets can then be redirected to the same or a different externally controlled tunnel interface by overwriting metadata via the bpf_skb_set_tunnel_{key,opt} helpers and a call to
bpf_redirect. This enables us to redirect packets between tunnel interfaces - and potentially change the encapsulation type - using only a single BPF program.
Quoted 1 line
[...]
Here is the summary with links:
- [bpf-next,v3,1/3] ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices
https://git.kernel.org/bpf/bpf-next/c/ac931d4cdec3 - [bpf-next,v3,2/3] bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs https://git.kernel.org/bpf/bpf-next/c/c50e96099edb - [bpf-next,v3,3/3] selftests/bpf: Test FOU kfuncs for externally controlled ipip devices https://git.kernel.org/bpf/bpf-next/c/d9688f898c08
You are awesome, thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html