| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/06/24 03:25 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"VLAN_8021Q"
],
"FocusSymbols": [
"bpf_ipv4_fib_lookup",
"bpf_ipv6_fib_lookup",
"bpf_xdp_fib_lookup",
"bpf_skb_fib_lookup",
"bpf_fib_set_fwd_params",
"bpf_fib_vlan_input_dev"
],
"Reasoning": "The patch introduces functional changes to the BPF FIB lookup helper (`bpf_fib_lookup`), adding support for VLANs via `BPF_FIB_LOOKUP_VLAN` and `BPF_FIB_LOOKUP_VLAN_INPUT` flags. This modifies core routing lookup logic within BPF programs, which is reachable from userspace by loading and executing BPF programs (XDP or TC). Fuzzing is required to ensure the new VLAN resolution logic and its interaction with the networking stack is robust.",
"WorthFuzzing": true
} |
| 1/1 | 2026/06/24 03:25 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 353371cda9b7e9c727e88a0b9f7df15d50feeb8e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Jun 24 03:25:51 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h\nindex 89b36de5fdbb6d..d4218954c50f53 100644\n--- a/include/uapi/linux/bpf.h\n+++ b/include/uapi/linux/bpf.h\n@@ -3532,6 +3532,45 @@ union bpf_attr {\n *\t\t\tUse the mark present in *params*-\u003emark for the fib lookup.\n *\t\t\tThis option should not be used with BPF_FIB_LOOKUP_DIRECT,\n *\t\t\tas it only has meaning for full lookups.\n+ *\t\t**BPF_FIB_LOOKUP_VLAN**\n+ *\t\t\tIf the fib lookup resolves to a VLAN device whose\n+ *\t\t\tparent is a real (non-VLAN) device, set\n+ *\t\t\t*params*-\u003eh_vlan_proto and *params*-\u003eh_vlan_TCI from\n+ *\t\t\tthe VLAN device and replace *params*-\u003eifindex with the\n+ *\t\t\tparent's ifindex. *params*-\u003eh_vlan_TCI carries the VID\n+ *\t\t\tonly, with PCP and DEI bits zero; a consumer wanting to\n+ *\t\t\tset egress priority writes PCP itself. *params*-\u003esmac is\n+ *\t\t\tthe VLAN device's own address, which can differ from the\n+ *\t\t\tparent's. Only the immediate parent is resolved; if it\n+ *\t\t\tis itself a VLAN device (QinQ) or in another namespace,\n+ *\t\t\tthe egress cannot be reduced to a physical device plus\n+ *\t\t\tone tag and the lookup returns\n+ *\t\t\t**BPF_FIB_LKUP_RET_VLAN_FAILURE** with *params*-\u003eifindex\n+ *\t\t\tleft at the input. Re-issue without\n+ *\t\t\t**BPF_FIB_LOOKUP_VLAN** to obtain the VLAN device's own\n+ *\t\t\tifindex. The swap and the vlan fields\n+ *\t\t\tare written only on success; other output fields keep\n+ *\t\t\tthe helper's existing behaviour, so a frag-needed result\n+ *\t\t\tstill reports the route mtu in *params*-\u003emtu_result.\n+ *\t\t\tThis flag is only valid for XDP programs; tc programs\n+ *\t\t\treceive -EINVAL since they can redirect to the VLAN\n+ *\t\t\tdevice directly.\n+ *\t\t**BPF_FIB_LOOKUP_VLAN_INPUT**\n+ *\t\t\tTreat *params*-\u003eh_vlan_proto and *params*-\u003eh_vlan_TCI\n+ *\t\t\tas an input VLAN tag and run the lookup as if ingress\n+ *\t\t\thad happened on the VLAN subinterface carrying that tag\n+ *\t\t\ton *params*-\u003eifindex. The VID is the low 12 bits of\n+ *\t\t\t*params*-\u003eh_vlan_TCI; *params*-\u003eh_vlan_proto must be\n+ *\t\t\tETH_P_8021Q or ETH_P_8021AD in network byte order, else\n+ *\t\t\t**-EINVAL**. If *params*-\u003eifindex is itself a VLAN\n+ *\t\t\tdevice, its inner (QinQ) subinterface is matched; for a\n+ *\t\t\tbond or team, pass the master's ifindex. An unmatched\n+ *\t\t\ttag, a down device, or one in another namespace returns\n+ *\t\t\t**BPF_FIB_LKUP_RET_NOT_FWDED**, mirroring real ingress.\n+ *\t\t\tA VID of 0 is looked up literally, so do not set this\n+ *\t\t\tflag for priority-tagged frames. Cannot be combined with\n+ *\t\t\t**BPF_FIB_LOOKUP_TBID** or **BPF_FIB_LOOKUP_OUTPUT**\n+ *\t\t\t(returns **-EINVAL**).\n *\n *\t\t*ctx* is either **struct xdp_md** for XDP programs or\n *\t\t**struct sk_buff** tc cls_act programs.\n@@ -7327,6 +7366,8 @@ enum {\n \tBPF_FIB_LOOKUP_TBID = (1U \u003c\u003c 3),\n \tBPF_FIB_LOOKUP_SRC = (1U \u003c\u003c 4),\n \tBPF_FIB_LOOKUP_MARK = (1U \u003c\u003c 5),\n+\tBPF_FIB_LOOKUP_VLAN = (1U \u003c\u003c 6),\n+\tBPF_FIB_LOOKUP_VLAN_INPUT = (1U \u003c\u003c 7),\n };\n \n enum {\n@@ -7340,6 +7381,7 @@ enum {\n \tBPF_FIB_LKUP_RET_NO_NEIGH, /* no neighbor entry for nh */\n \tBPF_FIB_LKUP_RET_FRAG_NEEDED, /* fragmentation required to fwd */\n \tBPF_FIB_LKUP_RET_NO_SRC_ADDR, /* failed to derive IP src addr */\n+\tBPF_FIB_LKUP_RET_VLAN_FAILURE, /* VLAN egress, parent unresolvable */\n };\n \n struct bpf_fib_lookup {\n@@ -7393,7 +7435,13 @@ struct bpf_fib_lookup {\n \n \tunion {\n \t\tstruct {\n-\t\t\t/* output */\n+\t\t\t/*\n+\t\t\t * output with BPF_FIB_LOOKUP_VLAN: set from the\n+\t\t\t * resolved egress VLAN device (see the flag); zeroed\n+\t\t\t * on other successful lookups. input with\n+\t\t\t * BPF_FIB_LOOKUP_VLAN_INPUT: the VLAN tag to scope\n+\t\t\t * the lookup by.\n+\t\t\t */\n \t\t\t__be16\th_vlan_proto;\n \t\t\t__be16\th_vlan_TCI;\n \t\t};\ndiff --git a/net/core/filter.c b/net/core/filter.c\nindex 2e96b4b847ce12..0ea362fa4287e3 100644\n--- a/net/core/filter.c\n+++ b/net/core/filter.c\n@@ -6201,21 +6201,60 @@ static const struct bpf_func_proto bpf_skb_get_xfrm_state_proto = {\n #endif\n \n #if IS_ENABLED(CONFIG_INET) || IS_ENABLED(CONFIG_IPV6)\n-static int bpf_fib_set_fwd_params(struct bpf_fib_lookup *params, u32 mtu)\n+static int bpf_fib_set_fwd_params(struct net_device *dev,\n+\t\t\t\t struct bpf_fib_lookup *params,\n+\t\t\t\t u32 flags, u32 mtu, u32 in_ifindex)\n {\n \tparams-\u003eh_vlan_TCI = 0;\n \tparams-\u003eh_vlan_proto = 0;\n+\n+#if IS_ENABLED(CONFIG_VLAN_8021Q)\n+\tif ((flags \u0026 BPF_FIB_LOOKUP_VLAN) \u0026\u0026 is_vlan_dev(dev)) {\n+\t\tstruct net_device *real_dev = vlan_dev_priv(dev)-\u003ereal_dev;\n+\n+\t\tif (!is_vlan_dev(real_dev) \u0026\u0026\n+\t\t net_eq(dev_net(real_dev), dev_net(dev))) {\n+\t\t\tparams-\u003eh_vlan_proto = vlan_dev_vlan_proto(dev);\n+\t\t\tparams-\u003eh_vlan_TCI = htons(vlan_dev_vlan_id(dev));\n+\t\t\tparams-\u003eifindex = real_dev-\u003eifindex;\n+\t\t} else {\n+\t\t\tparams-\u003eifindex = in_ifindex;\n+\t\t\treturn BPF_FIB_LKUP_RET_VLAN_FAILURE;\n+\t\t}\n+\t}\n+#endif\n+\n \tif (mtu)\n \t\tparams-\u003emtu_result = mtu; /* union with tot_len */\n \n \treturn 0;\n }\n+\n+static struct net_device *bpf_fib_vlan_input_dev(struct net_device *dev,\n+\t\t\t\t\t\t const struct bpf_fib_lookup *params)\n+{\n+\t__be16 proto = params-\u003eh_vlan_proto;\n+\tstruct net_device *vlan_dev;\n+\tu16 vid;\n+\n+\tif (proto != htons(ETH_P_8021Q) \u0026\u0026 proto != htons(ETH_P_8021AD))\n+\t\treturn ERR_PTR(-EINVAL);\n+\n+\tvid = ntohs(params-\u003eh_vlan_TCI) \u0026 VLAN_VID_MASK;\n+\tvlan_dev = __vlan_find_dev_deep_rcu(dev, proto, vid);\n+\tif (!vlan_dev || !(vlan_dev-\u003eflags \u0026 IFF_UP) ||\n+\t !net_eq(dev_net(vlan_dev), dev_net(dev)))\n+\t\treturn NULL;\n+\n+\treturn vlan_dev;\n+}\n #endif\n \n #if IS_ENABLED(CONFIG_INET)\n static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n \t\t\t u32 flags, bool check_mtu)\n {\n+\tu32 in_ifindex = params-\u003eifindex;\n \tstruct neighbour *neigh = NULL;\n \tstruct fib_nh_common *nhc;\n \tstruct in_device *in_dev;\n@@ -6229,6 +6268,14 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n \tif (unlikely(!dev))\n \t\treturn -ENODEV;\n \n+\tif (flags \u0026 BPF_FIB_LOOKUP_VLAN_INPUT) {\n+\t\tdev = bpf_fib_vlan_input_dev(dev, params);\n+\t\tif (IS_ERR(dev))\n+\t\t\treturn PTR_ERR(dev);\n+\t\tif (!dev)\n+\t\t\treturn BPF_FIB_LKUP_RET_NOT_FWDED;\n+\t}\n+\n \t/* verify forwarding is enabled on this interface */\n \tin_dev = __in_dev_get_rcu(dev);\n \tif (unlikely(!in_dev || !IN_DEV_FORWARD(in_dev)))\n@@ -6238,7 +6285,11 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n \t\tfl4.flowi4_iif = 1;\n \t\tfl4.flowi4_oif = params-\u003eifindex;\n \t} else {\n-\t\tfl4.flowi4_iif = params-\u003eifindex;\n+\t\t/*\n+\t\t * dev-\u003eifindex, not params-\u003eifindex: VLAN_INPUT may have\n+\t\t * resolved dev to a subinterface above.\n+\t\t */\n+\t\tfl4.flowi4_iif = dev-\u003eifindex;\n \t\tfl4.flowi4_oif = 0;\n \t}\n \tfl4.flowi4_dscp = inet_dsfield_to_dscp(params-\u003etos);\n@@ -6347,7 +6398,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n \tmemcpy(params-\u003esmac, dev-\u003edev_addr, ETH_ALEN);\n \n set_fwd_params:\n-\treturn bpf_fib_set_fwd_params(params, mtu);\n+\treturn bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);\n }\n #endif\n \n@@ -6357,6 +6408,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n {\n \tstruct in6_addr *src = (struct in6_addr *) params-\u003eipv6_src;\n \tstruct in6_addr *dst = (struct in6_addr *) params-\u003eipv6_dst;\n+\tu32 in_ifindex = params-\u003eifindex;\n \tstruct fib6_result res = {};\n \tstruct neighbour *neigh;\n \tstruct net_device *dev;\n@@ -6374,6 +6426,14 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n \tif (unlikely(!dev))\n \t\treturn -ENODEV;\n \n+\tif (flags \u0026 BPF_FIB_LOOKUP_VLAN_INPUT) {\n+\t\tdev = bpf_fib_vlan_input_dev(dev, params);\n+\t\tif (IS_ERR(dev))\n+\t\t\treturn PTR_ERR(dev);\n+\t\tif (!dev)\n+\t\t\treturn BPF_FIB_LKUP_RET_NOT_FWDED;\n+\t}\n+\n \tidev = __in6_dev_get_safely(dev);\n \tif (unlikely(!idev || !READ_ONCE(idev-\u003ecnf.forwarding)))\n \t\treturn BPF_FIB_LKUP_RET_FWD_DISABLED;\n@@ -6382,7 +6442,12 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n \t\tfl6.flowi6_iif = 1;\n \t\toif = fl6.flowi6_oif = params-\u003eifindex;\n \t} else {\n-\t\toif = fl6.flowi6_iif = params-\u003eifindex;\n+\t\t/*\n+\t\t * dev-\u003eifindex, not params-\u003eifindex: VLAN_INPUT may have\n+\t\t * resolved dev to a subinterface above.\n+\t\t */\n+\t\toif = dev-\u003eifindex;\n+\t\tfl6.flowi6_iif = oif;\n \t\tfl6.flowi6_oif = 0;\n \t\tstrict = RT6_LOOKUP_F_HAS_SADDR;\n \t}\n@@ -6486,13 +6551,26 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n \tmemcpy(params-\u003esmac, dev-\u003edev_addr, ETH_ALEN);\n \n set_fwd_params:\n-\treturn bpf_fib_set_fwd_params(params, mtu);\n+\treturn bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);\n }\n #endif\n \n #define BPF_FIB_LOOKUP_MASK (BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT | \\\n \t\t\t BPF_FIB_LOOKUP_SKIP_NEIGH | BPF_FIB_LOOKUP_TBID | \\\n-\t\t\t BPF_FIB_LOOKUP_SRC | BPF_FIB_LOOKUP_MARK)\n+\t\t\t BPF_FIB_LOOKUP_SRC | BPF_FIB_LOOKUP_MARK | \\\n+\t\t\t BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_VLAN_INPUT)\n+\n+static bool bpf_fib_lookup_flags_ok(u32 flags)\n+{\n+\tif (flags \u0026 ~BPF_FIB_LOOKUP_MASK)\n+\t\treturn false;\n+\n+\tif ((flags \u0026 BPF_FIB_LOOKUP_VLAN_INPUT) \u0026\u0026\n+\t (flags \u0026 (BPF_FIB_LOOKUP_TBID | BPF_FIB_LOOKUP_OUTPUT)))\n+\t\treturn false;\n+\n+\treturn true;\n+}\n \n BPF_CALL_4(bpf_xdp_fib_lookup, struct xdp_buff *, ctx,\n \t struct bpf_fib_lookup *, params, int, plen, u32, flags)\n@@ -6500,7 +6578,7 @@ BPF_CALL_4(bpf_xdp_fib_lookup, struct xdp_buff *, ctx,\n \tif (plen \u003c sizeof(*params))\n \t\treturn -EINVAL;\n \n-\tif (flags \u0026 ~BPF_FIB_LOOKUP_MASK)\n+\tif (!bpf_fib_lookup_flags_ok(flags))\n \t\treturn -EINVAL;\n \n \tswitch (params-\u003efamily) {\n@@ -6538,7 +6616,10 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,\n \tif (plen \u003c sizeof(*params))\n \t\treturn -EINVAL;\n \n-\tif (flags \u0026 ~BPF_FIB_LOOKUP_MASK)\n+\tif (!bpf_fib_lookup_flags_ok(flags))\n+\t\treturn -EINVAL;\n+\n+\tif (flags \u0026 BPF_FIB_LOOKUP_VLAN)\n \t\treturn -EINVAL;\n \n \tif (params-\u003etot_len)\ndiff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h\nindex 89b36de5fdbb6d..d4218954c50f53 100644\n--- a/tools/include/uapi/linux/bpf.h\n+++ b/tools/include/uapi/linux/bpf.h\n@@ -3532,6 +3532,45 @@ union bpf_attr {\n *\t\t\tUse the mark present in *params*-\u003emark for the fib lookup.\n *\t\t\tThis option should not be used with BPF_FIB_LOOKUP_DIRECT,\n *\t\t\tas it only has meaning for full lookups.\n+ *\t\t**BPF_FIB_LOOKUP_VLAN**\n+ *\t\t\tIf the fib lookup resolves to a VLAN device whose\n+ *\t\t\tparent is a real (non-VLAN) device, set\n+ *\t\t\t*params*-\u003eh_vlan_proto and *params*-\u003eh_vlan_TCI from\n+ *\t\t\tthe VLAN device and replace *params*-\u003eifindex with the\n+ *\t\t\tparent's ifindex. *params*-\u003eh_vlan_TCI carries the VID\n+ *\t\t\tonly, with PCP and DEI bits zero; a consumer wanting to\n+ *\t\t\tset egress priority writes PCP itself. *params*-\u003esmac is\n+ *\t\t\tthe VLAN device's own address, which can differ from the\n+ *\t\t\tparent's. Only the immediate parent is resolved; if it\n+ *\t\t\tis itself a VLAN device (QinQ) or in another namespace,\n+ *\t\t\tthe egress cannot be reduced to a physical device plus\n+ *\t\t\tone tag and the lookup returns\n+ *\t\t\t**BPF_FIB_LKUP_RET_VLAN_FAILURE** with *params*-\u003eifindex\n+ *\t\t\tleft at the input. Re-issue without\n+ *\t\t\t**BPF_FIB_LOOKUP_VLAN** to obtain the VLAN device's own\n+ *\t\t\tifindex. The swap and the vlan fields\n+ *\t\t\tare written only on success; other output fields keep\n+ *\t\t\tthe helper's existing behaviour, so a frag-needed result\n+ *\t\t\tstill reports the route mtu in *params*-\u003emtu_result.\n+ *\t\t\tThis flag is only valid for XDP programs; tc programs\n+ *\t\t\treceive -EINVAL since they can redirect to the VLAN\n+ *\t\t\tdevice directly.\n+ *\t\t**BPF_FIB_LOOKUP_VLAN_INPUT**\n+ *\t\t\tTreat *params*-\u003eh_vlan_proto and *params*-\u003eh_vlan_TCI\n+ *\t\t\tas an input VLAN tag and run the lookup as if ingress\n+ *\t\t\thad happened on the VLAN subinterface carrying that tag\n+ *\t\t\ton *params*-\u003eifindex. The VID is the low 12 bits of\n+ *\t\t\t*params*-\u003eh_vlan_TCI; *params*-\u003eh_vlan_proto must be\n+ *\t\t\tETH_P_8021Q or ETH_P_8021AD in network byte order, else\n+ *\t\t\t**-EINVAL**. If *params*-\u003eifindex is itself a VLAN\n+ *\t\t\tdevice, its inner (QinQ) subinterface is matched; for a\n+ *\t\t\tbond or team, pass the master's ifindex. An unmatched\n+ *\t\t\ttag, a down device, or one in another namespace returns\n+ *\t\t\t**BPF_FIB_LKUP_RET_NOT_FWDED**, mirroring real ingress.\n+ *\t\t\tA VID of 0 is looked up literally, so do not set this\n+ *\t\t\tflag for priority-tagged frames. Cannot be combined with\n+ *\t\t\t**BPF_FIB_LOOKUP_TBID** or **BPF_FIB_LOOKUP_OUTPUT**\n+ *\t\t\t(returns **-EINVAL**).\n *\n *\t\t*ctx* is either **struct xdp_md** for XDP programs or\n *\t\t**struct sk_buff** tc cls_act programs.\n@@ -7327,6 +7366,8 @@ enum {\n \tBPF_FIB_LOOKUP_TBID = (1U \u003c\u003c 3),\n \tBPF_FIB_LOOKUP_SRC = (1U \u003c\u003c 4),\n \tBPF_FIB_LOOKUP_MARK = (1U \u003c\u003c 5),\n+\tBPF_FIB_LOOKUP_VLAN = (1U \u003c\u003c 6),\n+\tBPF_FIB_LOOKUP_VLAN_INPUT = (1U \u003c\u003c 7),\n };\n \n enum {\n@@ -7340,6 +7381,7 @@ enum {\n \tBPF_FIB_LKUP_RET_NO_NEIGH, /* no neighbor entry for nh */\n \tBPF_FIB_LKUP_RET_FRAG_NEEDED, /* fragmentation required to fwd */\n \tBPF_FIB_LKUP_RET_NO_SRC_ADDR, /* failed to derive IP src addr */\n+\tBPF_FIB_LKUP_RET_VLAN_FAILURE, /* VLAN egress, parent unresolvable */\n };\n \n struct bpf_fib_lookup {\n@@ -7393,7 +7435,13 @@ struct bpf_fib_lookup {\n \n \tunion {\n \t\tstruct {\n-\t\t\t/* output */\n+\t\t\t/*\n+\t\t\t * output with BPF_FIB_LOOKUP_VLAN: set from the\n+\t\t\t * resolved egress VLAN device (see the flag); zeroed\n+\t\t\t * on other successful lookups. input with\n+\t\t\t * BPF_FIB_LOOKUP_VLAN_INPUT: the VLAN tag to scope\n+\t\t\t * the lookup by.\n+\t\t\t */\n \t\t\t__be16\th_vlan_proto;\n \t\t\t__be16\th_vlan_TCI;\n \t\t};\ndiff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c\nindex bd76589580041f..8caed9d43b9811 100644\n--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c\n+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c\n@@ -2,6 +2,7 @@\n /* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */\n \n #include \u003clinux/rtnetlink.h\u003e\n+#include \u003clinux/if_ether.h\u003e\n #include \u003csys/types.h\u003e\n #include \u003cnet/if.h\u003e\n \n@@ -23,6 +24,7 @@\n #define IPV4_TBID_ADDR\t\t\"172.0.0.254\"\n #define IPV4_TBID_NET\t\t\"172.0.0.0\"\n #define IPV4_TBID_DST\t\t\"172.0.0.2\"\n+#define IPV4_TBID_NONEIGH_DST\t\"172.0.0.5\"\n #define IPV6_TBID_ADDR\t\t\"fd00::FFFF\"\n #define IPV6_TBID_NET\t\t\"fd00::\"\n #define IPV6_TBID_DST\t\t\"fd00::2\"\n@@ -37,6 +39,41 @@\n #define IPV6_LOCAL\t\t\"fd01::3\"\n #define IPV6_GW1\t\t\"fd01::1\"\n #define IPV6_GW2\t\t\"fd01::2\"\n+#define VLAN_ID\t\t\t100\n+#define VLAN_IFACE\t\t\"veth1.100\"\n+#define VLAN_ID_DOWN\t\t102\n+#define VLAN_IFACE_DOWN\t\t\"veth1.102\"\n+#define QINQ_OUTER_IFACE\t\"veth1.200\"\n+#define QINQ_INNER_IFACE\t\"veth1.200.300\"\n+#define VLAN_TABLE\t\t\"300\"\n+#define IPV4_VLAN_IFACE_ADDR\t\"10.5.0.254\"\n+#define IPV4_VLAN_EGRESS_DST\t\"10.5.0.2\"\n+#define IPV4_QINQ_DST\t\t\"10.7.0.2\"\n+#define IPV4_VLAN_DST\t\t\"10.6.0.2\"\n+#define IPV4_VLAN_GW\t\t\"10.5.0.1\"\n+#define IPV6_VLAN_IFACE_ADDR\t\"fd02::254\"\n+#define IPV6_VLAN_EGRESS_DST\t\"fd02::2\"\n+#define IPV6_VLAN_DST\t\t\"fd03::2\"\n+#define IPV6_VLAN_GW\t\t\"fd02::1\"\n+#define VLAN_VID_UNUSED\t\t999\n+#define VRF_IFACE\t\t\"vrf-blue\"\n+#define VRF_TABLE\t\t\"1000\"\n+#define VRF_VLAN_ID\t\t101\n+#define VRF_VLAN_IFACE\t\t\"veth1.101\"\n+#define IPV4_VRF_IFACE_ADDR\t\"10.8.0.254\"\n+#define IPV4_VRF_GW\t\t\"10.8.0.1\"\n+#define IPV4_VRF_DST\t\t\"10.9.0.2\"\n+#define TBID_VLAN_ID\t\t50\n+#define TBID_VLAN_IFACE\t\t\"veth2.50\"\n+#define IPV4_TBID_VLAN_DST\t\"172.2.0.2\"\n+#define IPV4_BOND_VLAN_DST\t\"10.11.0.2\"\n+#define IPV4_VLAN_MTU_DST\t\"10.5.9.2\"\n+#define QINQ_AD_VLAN_ID\t\t200\n+#define QINQ_INNER_VLAN_ID\t300\n+#define BOND_IFACE\t\t\"bond99\"\n+#define BOND_PORT\t\t\"veth3\"\n+#define BOND_PORT_PEER\t\t\"veth4\"\n+#define BOND_VLAN_ID\t\t500\n #define DMAC\t\t\t\"11:11:11:11:11:11\"\n #define DMAC_INIT { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, }\n #define DMAC2\t\t\t\"01:01:01:01:01:01\"\n@@ -52,6 +89,17 @@ struct fib_lookup_test {\n \t__u32 tbid;\n \t__u8 dmac[6];\n \t__u32 mark;\n+\t/*\n+\t * input tag with BPF_FIB_LOOKUP_VLAN_INPUT; expected output tag\n+\t * with BPF_FIB_LOOKUP_VLAN (checked when check_vlan is set)\n+\t */\n+\t__u16 vlan_proto;\n+\t__u16 vlan_id;\n+\tbool check_vlan;\n+\tconst char *expected_dev; /* expected params-\u003eifindex after lookup */\n+\tconst char *iif;\t /* override the default veth1 input device */\n+\t__u16 tot_len;\t\t /* triggers the in-lookup mtu check when set */\n+\t__u16 expected_mtu;\t /* expected mtu_result (union with tot_len) */\n };\n \n static const struct fib_lookup_test tests[] = {\n@@ -79,6 +127,17 @@ static const struct fib_lookup_test tests[] = {\n \t .daddr = IPV4_TBID_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n \t .lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID, .tbid = 100,\n \t .dmac = DMAC_INIT2, },\n+\t/*\n+\t * An error that returns after the egress device is resolved must\n+\t * report the egress ifindex, not the input. This routes from input\n+\t * veth1 via veth2 (table 100) to a dst with no neighbour, so\n+\t * input != egress, pinning NO_NEIGH to the egress device.\n+\t */\n+\t{ .desc = \"IPv4 NO_NEIGH reports the egress ifindex, not the input\",\n+\t .daddr = IPV4_TBID_NONEIGH_DST,\n+\t .expected_ret = BPF_FIB_LKUP_RET_NO_NEIGH,\n+\t .lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID, .tbid = 100,\n+\t .expected_dev = \"veth2\", },\n \t{ .desc = \"IPv6 TBID lookup failure\",\n \t .daddr = IPV6_TBID_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,\n \t .lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID,\n@@ -142,6 +201,218 @@ static const struct fib_lookup_test tests[] = {\n \t .expected_dst = IPV6_GW1,\n \t .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,\n \t .mark = MARK, },\n+\t/* vlan egress resolution */\n+\t/*\n+\t * Invariant the VLAN-egress arms jointly enforce: a\n+\t * BPF_FIB_LOOKUP_VLAN SUCCESS always carries a physical,\n+\t * xmit-capable ifindex -- no SUCCESS ever returns a VLAN-device\n+\t * ifindex. Reducible arms pin ifindex == the physical parent; the\n+\t * QinQ and foreign-netns arms pin VLAN_FAILURE with params-\u003eifindex\n+\t * left at the input, so a regression to best-effort (SUCCESS + the\n+\t * VLAN ifindex) fails one.\n+\t */\n+\t{ .desc = \"IPv4 VLAN egress, no flag\",\n+\t .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = VLAN_IFACE, .check_vlan = true, },\n+\t{ .desc = \"IPv4 VLAN egress, single VLAN\",\n+\t .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t/*\n+\t * skb path without tot_len: mtu_result is the VLAN device's mtu\n+\t * (1400), not the parent's (1500)\n+\t */\n+\t{ .desc = \"IPv4 VLAN egress, skb-path mtu is the VLAN device's without the flag\",\n+\t .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = VLAN_IFACE, .check_vlan = true, .expected_mtu = 1400, },\n+\t{ .desc = \"IPv4 VLAN egress, flag set but egress is not a VLAN\",\n+\t .daddr = IPV4_NUD_FAILED_ADDR, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = \"veth1\", .check_vlan = true, },\n+\t{ .desc = \"IPv4 VLAN egress, QinQ not reducible (VLAN_FAILURE)\",\n+\t .daddr = IPV4_QINQ_DST,\n+\t .expected_ret = BPF_FIB_LKUP_RET_VLAN_FAILURE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = \"veth1\", .check_vlan = true, },\n+\t{ .desc = \"IPv4 QinQ egress without the flag (escape hatch)\",\n+\t .daddr = IPV4_QINQ_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = QINQ_INNER_IFACE, },\n+\t{ .desc = \"IPv6 VLAN egress, single VLAN\",\n+\t .daddr = IPV6_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN egress, neighbour on the VLAN device\",\n+\t .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, .dmac = DMAC_INIT, },\n+\t{ .desc = \"IPv4 VLAN egress in OUTPUT mode\",\n+\t .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .iif = VLAN_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_VLAN |\n+\t\t\t BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN egress over a bond\",\n+\t .daddr = IPV4_BOND_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = BOND_IFACE, .check_vlan = true,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN egress via TBID table\",\n+\t .daddr = IPV4_TBID_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID |\n+\t\t\t BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .tbid = 100,\n+\t .expected_dev = \"veth2\", .check_vlan = true,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = TBID_VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN egress, success writes mtu_result with the swap\",\n+\t .daddr = IPV4_VLAN_MTU_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .tot_len = 500, .expected_mtu = 1000,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN egress, FRAG_NEEDED reports mtu, swap unwritten\",\n+\t .daddr = IPV4_VLAN_MTU_DST, .expected_ret = BPF_FIB_LKUP_RET_FRAG_NEEDED,\n+\t .tot_len = 1400, .expected_mtu = 1000,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .expected_dev = \"veth1\", .check_vlan = true, },\n+\t/* vlan tag as lookup input */\n+\t{ .desc = \"IPv4 VLAN input, no flag\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_GW1,\n+\t .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH, },\n+\t{ .desc = \"IPv4 VLAN input, tag selects subinterface route\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_VLAN_GW, .expected_dev = VLAN_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv6 VLAN input, tag selects subinterface route\",\n+\t .daddr = IPV6_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV6_VLAN_GW, .expected_dev = VLAN_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input and egress combined\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_VLAN_GW, .expected_dev = \"veth1\",\n+\t .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_VLAN |\n+\t\t\t BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input, neighbour resolved on the route\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_VLAN_GW, .expected_dev = VLAN_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, .dmac = DMAC_INIT2, },\n+\t{ .desc = \"IPv4 VLAN input, source address from the subinterface\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_src = IPV4_VLAN_IFACE_ADDR,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SRC |\n+\t\t\t BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t/*\n+\t * VRF: the resolved subinterface is enslaved, so the l3mdev rule\n+\t * (full lookup) and l3mdev_fib_table_rcu() (DIRECT) must select\n+\t * the VRF table from the resolved ingress\n+\t */\n+\t{ .desc = \"IPv4 VLAN input, VRF subinterface, no flag\",\n+\t .daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_GW1,\n+\t .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH, },\n+\t{ .desc = \"IPv4 VLAN input, tag selects VRF table\",\n+\t .daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_VRF_GW, .expected_dev = VRF_VLAN_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VRF_VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input, DIRECT uses VRF table from resolved ingress\",\n+\t .daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_VRF_GW, .expected_dev = VRF_VLAN_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_DIRECT |\n+\t\t\t BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VRF_VLAN_ID, },\n+\t/*\n+\t * failure arms also assert params is left untouched: ifindex still\n+\t * names the physical device and the input tag bytes survive\n+\t */\n+\t{ .desc = \"IPv4 VLAN input, invalid proto\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = 0x1234, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input, unmatched VID\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_VID_UNUSED, },\n+\t{ .desc = \"IPv4 VLAN input, subinterface down\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID_DOWN, },\n+\t/*\n+\t * the resolver runs before the forwarding check, so on devices\n+\t * with forwarding off FWD_DISABLED (not NOT_FWDED) proves the tag\n+\t * resolved to that device and the lookup used it as ingress\n+\t */\n+\t{ .desc = \"IPv4 VLAN input, 802.1ad tag\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021AD, .vlan_id = QINQ_AD_VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input, PCP and DEI bits ignored in TCI\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,\n+\t .expected_dst = IPV4_VLAN_GW,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = 0xe000 | VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input, inner QinQ device from VLAN ifindex\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,\n+\t .iif = QINQ_OUTER_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = QINQ_INNER_VLAN_ID, },\n+\t/*\n+\t * bonding: the VLANs live on the master, as on receive, where the\n+\t * frame is steered to the master before VLAN processing; a port\n+\t * ifindex does not match (ports carry vid state but no VLAN devs)\n+\t */\n+\t{ .desc = \"IPv4 VLAN input, tag on bond master resolves\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,\n+\t .iif = BOND_IFACE,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input, tag on bond port does not match\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,\n+\t .iif = BOND_PORT, .expected_dev = BOND_PORT, .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },\n+\t{ .desc = \"IPv6 VLAN input, invalid proto\",\n+\t .daddr = IPV6_VLAN_DST, .expected_ret = -EINVAL,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = 0x1234, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input, VID 0 priority tag fails closed\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = 0, },\n+\t{ .desc = \"IPv6 VLAN input, unmatched VID\",\n+\t .daddr = IPV6_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,\n+\t .expected_dev = \"veth1\", .check_vlan = true,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_VID_UNUSED, },\n+\t{ .desc = \"unknown flag bit rejected\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,\n+\t .lookup_flags = (1 \u003c\u003c 14) | BPF_FIB_LOOKUP_SKIP_NEIGH, },\n+\t{ .desc = \"IPv4 VLAN input rejected with TBID\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_TBID,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n+\t{ .desc = \"IPv4 VLAN input rejected with OUTPUT\",\n+\t .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,\n+\t .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_OUTPUT,\n+\t .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },\n };\n \n static int setup_netns(void)\n@@ -204,6 +475,110 @@ static int setup_netns(void)\n \tSYS(fail, \"ip rule add prio 2 fwmark %d lookup %s\", MARK, MARK_TABLE);\n \tSYS(fail, \"ip -6 rule add prio 2 fwmark %d lookup %s\", MARK, MARK_TABLE);\n \n+\t/*\n+\t * Setup for vlan tests: a subinterface for egress resolution and\n+\t * tag-as-input, a QinQ stack, and an iif rule so the input tests\n+\t * observe which device the lookup used as ingress.\n+\t */\n+\tSYS(fail, \"ip link add link veth1 name %s type vlan id %d\",\n+\t VLAN_IFACE, VLAN_ID);\n+\tSYS(fail, \"ip link set dev %s up\", VLAN_IFACE);\n+\t/*\n+\t * lower than the veth1 parent (1500): the skb-path mtu check uses the\n+\t * FIB result (VLAN) device, so mtu_result is this value with or\n+\t * without the egress swap, which two arms below pin\n+\t */\n+\tSYS(fail, \"ip link set dev %s mtu 1400\", VLAN_IFACE);\n+\tSYS(fail, \"ip addr add %s/24 dev %s\", IPV4_VLAN_IFACE_ADDR, VLAN_IFACE);\n+\tSYS(fail, \"ip addr add %s/64 dev %s nodad\", IPV6_VLAN_IFACE_ADDR, VLAN_IFACE);\n+\n+\t/*\n+\t * stays down: the input flag must treat its tag the way real\n+\t * ingress treats a frame arriving on a down VLAN device (drop)\n+\t */\n+\tSYS(fail, \"ip link add link veth1 name %s type vlan id %d\",\n+\t VLAN_IFACE_DOWN, VLAN_ID_DOWN);\n+\n+\terr = write_sysctl(\"/proc/sys/net/ipv4/conf/\" VLAN_IFACE \"/forwarding\", \"1\");\n+\tif (!ASSERT_OK(err, \"write_sysctl(net.ipv4.conf.\" VLAN_IFACE \".forwarding)\"))\n+\t\tgoto fail;\n+\n+\terr = write_sysctl(\"/proc/sys/net/ipv6/conf/\" VLAN_IFACE \"/forwarding\", \"1\");\n+\tif (!ASSERT_OK(err, \"write_sysctl(net.ipv6.conf.\" VLAN_IFACE \".forwarding)\"))\n+\t\tgoto fail;\n+\n+\tSYS(fail, \"ip link add link veth1 name %s type vlan proto 802.1ad id 200\",\n+\t QINQ_OUTER_IFACE);\n+\tSYS(fail, \"ip link add link %s name %s type vlan id 300\",\n+\t QINQ_OUTER_IFACE, QINQ_INNER_IFACE);\n+\tSYS(fail, \"ip link set dev %s up\", QINQ_OUTER_IFACE);\n+\tSYS(fail, \"ip link set dev %s up\", QINQ_INNER_IFACE);\n+\tSYS(fail, \"ip route add %s/32 dev %s\", IPV4_QINQ_DST, QINQ_INNER_IFACE);\n+\n+\tSYS(fail, \"ip route add %s/32 via %s\", IPV4_VLAN_DST, IPV4_GW1);\n+\tSYS(fail, \"ip route add table %s %s/32 via %s\",\n+\t VLAN_TABLE, IPV4_VLAN_DST, IPV4_VLAN_GW);\n+\tSYS(fail, \"ip rule add prio 3 iif %s lookup %s\", VLAN_IFACE, VLAN_TABLE);\n+\tSYS(fail, \"ip -6 route add %s/128 via %s\", IPV6_VLAN_DST, IPV6_GW1);\n+\tSYS(fail, \"ip -6 route add table %s %s/128 via %s\",\n+\t VLAN_TABLE, IPV6_VLAN_DST, IPV6_VLAN_GW);\n+\tSYS(fail, \"ip -6 rule add prio 3 iif %s lookup %s\", VLAN_IFACE, VLAN_TABLE);\n+\n+\t/*\n+\t * a bond with one port and a VLAN on the bond: VLANs on a bond\n+\t * live on the master, so resolution succeeds for the master's\n+\t * ifindex and fails closed for a port's, matching receive, which\n+\t * steers the frame to the master before VLAN processing\n+\t */\n+\tSYS(fail, \"ip link add %s type bond\", BOND_IFACE);\n+\tSYS(fail, \"ip link add %s type veth peer name %s\", BOND_PORT, BOND_PORT_PEER);\n+\tSYS(fail, \"ip link set %s master %s\", BOND_PORT, BOND_IFACE);\n+\tSYS(fail, \"ip link set dev %s up\", BOND_IFACE);\n+\tSYS(fail, \"ip link set dev %s up\", BOND_PORT);\n+\tSYS(fail, \"ip link add link %s name %s.%d type vlan id %d\",\n+\t BOND_IFACE, BOND_IFACE, BOND_VLAN_ID, BOND_VLAN_ID);\n+\tSYS(fail, \"ip link set dev %s.%d up\", BOND_IFACE, BOND_VLAN_ID);\n+\tSYS(fail, \"ip route add %s/32 dev %s.%d\",\n+\t IPV4_BOND_VLAN_DST, BOND_IFACE, BOND_VLAN_ID);\n+\n+\t/*\n+\t * a VRF with its own dedicated subinterface (the iif rules above\n+\t * must not see it), for the table-selection-by-ingress cases\n+\t */\n+\tSYS(fail, \"ip link add %s type vrf table %s\", VRF_IFACE, VRF_TABLE);\n+\tSYS(fail, \"ip link set dev %s up\", VRF_IFACE);\n+\tSYS(fail, \"ip link add link veth1 name %s type vlan id %d\",\n+\t VRF_VLAN_IFACE, VRF_VLAN_ID);\n+\tSYS(fail, \"ip link set %s master %s\", VRF_VLAN_IFACE, VRF_IFACE);\n+\tSYS(fail, \"ip link set dev %s up\", VRF_VLAN_IFACE);\n+\tSYS(fail, \"ip addr add %s/24 dev %s\", IPV4_VRF_IFACE_ADDR, VRF_VLAN_IFACE);\n+\terr = write_sysctl(\"/proc/sys/net/ipv4/conf/\" VRF_VLAN_IFACE \"/forwarding\", \"1\");\n+\tif (!ASSERT_OK(err, \"write_sysctl(net.ipv4.conf.\" VRF_VLAN_IFACE \".forwarding)\"))\n+\t\tgoto fail;\n+\tSYS(fail, \"ip route add %s/32 via %s\", IPV4_VRF_DST, IPV4_GW1);\n+\tSYS(fail, \"ip route add table %s %s/32 via %s\",\n+\t VRF_TABLE, IPV4_VRF_DST, IPV4_VRF_GW);\n+\n+\t/* neighbours on the VLAN subinterface for the non-SKIP_NEIGH cases */\n+\terr = write_sysctl(\"/proc/sys/net/ipv4/neigh/\" VLAN_IFACE \"/gc_stale_time\", \"900\");\n+\tif (!ASSERT_OK(err, \"write_sysctl(net.ipv4.neigh.\" VLAN_IFACE \".gc_stale_time)\"))\n+\t\tgoto fail;\n+\tSYS(fail, \"ip neigh add %s dev %s lladdr %s nud stale\",\n+\t IPV4_VLAN_EGRESS_DST, VLAN_IFACE, DMAC);\n+\tSYS(fail, \"ip neigh add %s dev %s lladdr %s nud stale\",\n+\t IPV4_VLAN_GW, VLAN_IFACE, DMAC2);\n+\n+\t/* a VLAN on veth2 with a route in the tbid test table */\n+\tSYS(fail, \"ip link add link veth2 name %s type vlan id %d\",\n+\t TBID_VLAN_IFACE, TBID_VLAN_ID);\n+\tSYS(fail, \"ip link set dev %s up\", TBID_VLAN_IFACE);\n+\tSYS(fail, \"ip route add table 100 %s/32 dev %s\",\n+\t IPV4_TBID_VLAN_DST, TBID_VLAN_IFACE);\n+\n+\t/* a locked-mtu route via the subinterface for the FRAG_NEEDED case */\n+\tSYS(fail, \"ip route add %s/32 dev %s mtu lock 1000\",\n+\t IPV4_VLAN_MTU_DST, VLAN_IFACE);\n+\n \treturn 0;\n fail:\n \treturn -1;\n@@ -218,9 +593,16 @@ static int set_lookup_params(struct bpf_fib_lookup *params,\n \tmemset(params, 0, sizeof(*params));\n \n \tparams-\u003el4_protocol = IPPROTO_TCP;\n-\tparams-\u003eifindex = ifindex;\n+\tparams-\u003eifindex = test-\u003eiif ? if_nametoindex(test-\u003eiif) : ifindex;\n \tparams-\u003etbid = test-\u003etbid;\n \tparams-\u003emark = test-\u003emark;\n+\tparams-\u003etot_len = test-\u003etot_len;\n+\n+\t/* h_vlan_proto/h_vlan_TCI union with tbid */\n+\tif (test-\u003elookup_flags \u0026 BPF_FIB_LOOKUP_VLAN_INPUT) {\n+\t\tparams-\u003eh_vlan_proto = htons(test-\u003evlan_proto);\n+\t\tparams-\u003eh_vlan_TCI = htons(test-\u003evlan_id);\n+\t}\n \n \tif (inet_pton(AF_INET6, test-\u003edaddr, params-\u003eipv6_dst) == 1) {\n \t\tparams-\u003efamily = AF_INET6;\n@@ -298,7 +680,7 @@ void test_fib_lookup(void)\n \tstruct nstoken *nstoken = NULL;\n \tstruct __sk_buff skb = { };\n \tstruct fib_lookup *skel;\n-\tint prog_fd, err, ret, i;\n+\tint prog_fd, xdp_fd, err, ret, i;\n \n \t/* The test does not use the skb-\u003edata, so\n \t * use pkt_v6 for both v6 and v4 test.\n@@ -309,11 +691,16 @@ void test_fib_lookup(void)\n \t\t .ctx_in = \u0026skb,\n \t\t .ctx_size_in = sizeof(skb),\n \t);\n+\tLIBBPF_OPTS(bpf_test_run_opts, xdp_opts,\n+\t\t .data_in = \u0026pkt_v6,\n+\t\t .data_size_in = sizeof(pkt_v6),\n+\t);\n \n \tskel = fib_lookup__open_and_load();\n \tif (!ASSERT_OK_PTR(skel, \"skel open_and_load\"))\n \t\treturn;\n \tprog_fd = bpf_program__fd(skel-\u003eprogs.fib_lookup);\n+\txdp_fd = bpf_program__fd(skel-\u003eprogs.fib_lookup_xdp);\n \n \tSYS(fail, \"ip netns add %s\", NS_TEST);\n \n@@ -343,6 +730,15 @@ void test_fib_lookup(void)\n \t\tif (!ASSERT_OK(err, \"bpf_prog_test_run_opts\"))\n \t\t\tcontinue;\n \n+\t\t/* BPF_FIB_LOOKUP_VLAN is XDP-only; the tc helper rejects it.\n+\t\t * These cases are exercised on the XDP path below.\n+\t\t */\n+\t\tif (tests[i].lookup_flags \u0026 BPF_FIB_LOOKUP_VLAN) {\n+\t\t\tASSERT_EQ(skel-\u003ebss-\u003efib_lookup_ret, -EINVAL,\n+\t\t\t\t \"tc rejects BPF_FIB_LOOKUP_VLAN\");\n+\t\t\tcontinue;\n+\t\t}\n+\n \t\tASSERT_EQ(skel-\u003ebss-\u003efib_lookup_ret, tests[i].expected_ret,\n \t\t\t \"fib_lookup_ret\");\n \n@@ -352,6 +748,21 @@ void test_fib_lookup(void)\n \t\tif (tests[i].expected_dst)\n \t\t\tassert_dst_ip(fib_params, tests[i].expected_dst);\n \n+\t\tif (tests[i].expected_dev)\n+\t\t\tASSERT_EQ(fib_params-\u003eifindex,\n+\t\t\t\t if_nametoindex(tests[i].expected_dev), \"ifindex\");\n+\n+\t\tif (tests[i].expected_mtu)\n+\t\t\tASSERT_EQ(fib_params-\u003emtu_result, tests[i].expected_mtu,\n+\t\t\t\t \"mtu_result\");\n+\n+\t\tif (tests[i].check_vlan) {\n+\t\t\tASSERT_EQ(fib_params-\u003eh_vlan_proto,\n+\t\t\t\t htons(tests[i].vlan_proto), \"h_vlan_proto\");\n+\t\t\tASSERT_EQ(fib_params-\u003eh_vlan_TCI,\n+\t\t\t\t htons(tests[i].vlan_id), \"h_vlan_TCI\");\n+\t\t}\n+\n \t\tret = memcmp(tests[i].dmac, fib_params-\u003edmac, sizeof(tests[i].dmac));\n \t\tif (!ASSERT_EQ(ret, 0, \"dmac not match\")) {\n \t\t\tchar expected[18], actual[18];\n@@ -361,15 +772,313 @@ void test_fib_lookup(void)\n \t\t\tprintf(\"dmac expected %s actual %s \", expected, actual);\n \t\t}\n \n-\t\t// ensure tbid is zero'd out after fib lookup.\n-\t\tif (tests[i].lookup_flags \u0026 BPF_FIB_LOOKUP_DIRECT) {\n+\t\t/*\n+\t\t * ensure tbid is zero'd out after fib lookup. With\n+\t\t * BPF_FIB_LOOKUP_VLAN the union holds the packed vlan\n+\t\t * fields instead, so skip the check for those.\n+\t\t */\n+\t\tif ((tests[i].lookup_flags \u0026 BPF_FIB_LOOKUP_DIRECT) \u0026\u0026\n+\t\t !(tests[i].lookup_flags \u0026 BPF_FIB_LOOKUP_VLAN)) {\n \t\t\tif (!ASSERT_EQ(skel-\u003ebss-\u003efib_params.tbid, 0,\n \t\t\t\t\t\"expected fib_params.tbid to be zero\"))\n \t\t\t\tgoto fail;\n \t\t}\n \t}\n \n+\t/*\n+\t * Re-run the cases through bpf_xdp_fib_lookup(). test_run uses the\n+\t * current netns' loopback for ctx-\u003erxq-\u003edev, so dev_net() is NS_TEST\n+\t * and the lookup runs against its FIB. The path-independent results\n+\t * (return code, swapped ifindex, vlan tag, gateway) must match the skb\n+\t * path; the no-tot_len mtu_result is skb-specific and not rechecked.\n+\t */\n+\tfor (i = 0; i \u003c ARRAY_SIZE(tests); i++) {\n+\t\tif (set_lookup_params(fib_params, \u0026tests[i], skb.ifindex))\n+\t\t\tcontinue;\n+\n+\t\tskel-\u003ebss-\u003efib_lookup_ret = -1;\n+\t\tskel-\u003ebss-\u003elookup_flags = tests[i].lookup_flags;\n+\n+\t\terr = bpf_prog_test_run_opts(xdp_fd, \u0026xdp_opts);\n+\t\tif (!ASSERT_OK(err, \"xdp test_run\"))\n+\t\t\tcontinue;\n+\n+\t\tif (!ASSERT_EQ(skel-\u003ebss-\u003efib_lookup_ret, tests[i].expected_ret,\n+\t\t\t \"xdp fib_lookup_ret\"))\n+\t\t\tprintf(\"(xdp) %s\\n\", tests[i].desc);\n+\n+\t\tif (tests[i].expected_dev)\n+\t\t\tASSERT_EQ(fib_params-\u003eifindex,\n+\t\t\t\t if_nametoindex(tests[i].expected_dev),\n+\t\t\t\t \"xdp ifindex\");\n+\n+\t\tif (tests[i].expected_dst)\n+\t\t\tassert_dst_ip(fib_params, tests[i].expected_dst);\n+\n+\t\tif (tests[i].check_vlan) {\n+\t\t\tASSERT_EQ(fib_params-\u003eh_vlan_proto,\n+\t\t\t\t htons(tests[i].vlan_proto), \"xdp h_vlan_proto\");\n+\t\t\tASSERT_EQ(fib_params-\u003eh_vlan_TCI,\n+\t\t\t\t htons(tests[i].vlan_id), \"xdp h_vlan_TCI\");\n+\t\t}\n+\n+\t\tret = memcmp(tests[i].dmac, fib_params-\u003edmac, sizeof(tests[i].dmac));\n+\t\tASSERT_EQ(ret, 0, \"xdp dmac\");\n+\n+\t\t/*\n+\t\t * mtu_result from a tot_len lookup is the route mtu and is\n+\t\t * path-independent; the no-tot_len arm reads dev-\u003emtu and is\n+\t\t * skb-only, so gate on tot_len\n+\t\t */\n+\t\tif (tests[i].expected_mtu \u0026\u0026 tests[i].tot_len)\n+\t\t\tASSERT_EQ(fib_params-\u003emtu_result, tests[i].expected_mtu,\n+\t\t\t\t \"xdp mtu_result\");\n+\t}\n+\n+fail:\n+\tif (nstoken)\n+\t\tclose_netns(nstoken);\n+\tSYS_NOFAIL(\"ip netns del \" NS_TEST);\n+\tfib_lookup__destroy(skel);\n+}\n+\n+#define NS_VLAN_A\t\"fib_lookup_vlan_ns_a\"\n+#define NS_VLAN_B\t\"fib_lookup_vlan_ns_b\"\n+\n+/*\n+ * A VLAN device can be moved to another netns while staying registered\n+ * on its parent. Neither direction may then cross the boundary: the\n+ * egress flag must not publish the foreign parent's ifindex, and the\n+ * input flag must fail closed rather than use a foreign ingress.\n+ */\n+void test_fib_lookup_vlan_netns(void)\n+{\n+\tstruct bpf_fib_lookup *fib_params;\n+\tstruct nstoken *nstoken = NULL;\n+\tstruct __sk_buff skb = { };\n+\tstruct fib_lookup *skel = NULL;\n+\tint prog_fd, xdp_fd, err, parent_idx, vlan_idx;\n+\n+\tLIBBPF_OPTS(bpf_test_run_opts, run_opts,\n+\t\t .data_in = \u0026pkt_v6,\n+\t\t .data_size_in = sizeof(pkt_v6),\n+\t\t .ctx_in = \u0026skb,\n+\t\t .ctx_size_in = sizeof(skb),\n+\t);\n+\tLIBBPF_OPTS(bpf_test_run_opts, xdp_opts,\n+\t\t .data_in = \u0026pkt_v6,\n+\t\t .data_size_in = sizeof(pkt_v6),\n+\t);\n+\n+\tskel = fib_lookup__open_and_load();\n+\tif (!ASSERT_OK_PTR(skel, \"skel open_and_load\"))\n+\t\treturn;\n+\tprog_fd = bpf_program__fd(skel-\u003eprogs.fib_lookup);\n+\txdp_fd = bpf_program__fd(skel-\u003eprogs.fib_lookup_xdp);\n+\tfib_params = \u0026skel-\u003ebss-\u003efib_params;\n+\n+\tSYS(fail, \"ip netns add %s\", NS_VLAN_A);\n+\tSYS(fail, \"ip netns add %s\", NS_VLAN_B);\n+\n+\tnstoken = open_netns(NS_VLAN_A);\n+\tif (!ASSERT_OK_PTR(nstoken, \"open_netns(a)\"))\n+\t\tgoto fail;\n+\n+\tSYS(fail, \"ip link add veth7 type veth peer name veth8\");\n+\tSYS(fail, \"ip link set dev veth7 up\");\n+\tSYS(fail, \"ip link add link veth7 name veth7.66 type vlan id 66\");\n+\tSYS(fail, \"ip link set veth7.66 netns %s\", NS_VLAN_B);\n+\n+\tparent_idx = if_nametoindex(\"veth7\");\n+\tif (!ASSERT_NEQ(parent_idx, 0, \"if_nametoindex(veth7)\"))\n+\t\tgoto fail;\n+\n+\t/*\n+\t * input: the moved device is still in veth7's VLAN group, but it\n+\t * lives in another netns, so the lookup must fail closed\n+\t */\n+\tskb.ifindex = parent_idx;\n+\tmemset(fib_params, 0, sizeof(*fib_params));\n+\tfib_params-\u003efamily = AF_INET;\n+\tfib_params-\u003el4_protocol = IPPROTO_TCP;\n+\tfib_params-\u003eifindex = parent_idx;\n+\tfib_params-\u003eh_vlan_proto = htons(ETH_P_8021Q);\n+\tfib_params-\u003eh_vlan_TCI = htons(66);\n+\tif (!ASSERT_EQ(inet_pton(AF_INET, \"10.66.0.2\", \u0026fib_params-\u003eipv4_dst),\n+\t\t 1, \"inet_pton(dst)\"))\n+\t\tgoto fail;\n+\n+\tskel-\u003ebss-\u003efib_lookup_ret = -1;\n+\tskel-\u003ebss-\u003elookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT |\n+\t\t\t\t BPF_FIB_LOOKUP_SKIP_NEIGH;\n+\terr = bpf_prog_test_run_opts(prog_fd, \u0026run_opts);\n+\tif (!ASSERT_OK(err, \"test_run(input)\"))\n+\t\tgoto fail;\n+\tASSERT_EQ(skel-\u003ebss-\u003efib_lookup_ret, BPF_FIB_LKUP_RET_NOT_FWDED,\n+\t\t \"input across netns fails closed\");\n+\tASSERT_EQ(fib_params-\u003eifindex, parent_idx, \"ifindex untouched\");\n+\tASSERT_EQ(fib_params-\u003eh_vlan_TCI, htons(66), \"tag untouched\");\n+\n+\tclose_netns(nstoken);\n+\tnstoken = open_netns(NS_VLAN_B);\n+\tif (!ASSERT_OK_PTR(nstoken, \"open_netns(b)\"))\n+\t\tgoto fail;\n+\n+\t/*\n+\t * egress: the fib result is the VLAN device here, but its parent\n+\t * is in the other netns, so the swap must not happen\n+\t */\n+\tSYS(fail, \"ip link set dev veth7.66 up\");\n+\tSYS(fail, \"ip addr add 10.66.0.1/24 dev veth7.66\");\n+\terr = write_sysctl(\"/proc/sys/net/ipv4/conf/veth7.66/forwarding\", \"1\");\n+\tif (!ASSERT_OK(err, \"write_sysctl(forwarding)\"))\n+\t\tgoto fail;\n+\n+\tvlan_idx = if_nametoindex(\"veth7.66\");\n+\tif (!ASSERT_NEQ(vlan_idx, 0, \"if_nametoindex(veth7.66)\"))\n+\t\tgoto fail;\n+\n+\tskb.ifindex = vlan_idx;\n+\tmemset(fib_params, 0, sizeof(*fib_params));\n+\tfib_params-\u003efamily = AF_INET;\n+\tfib_params-\u003el4_protocol = IPPROTO_TCP;\n+\tfib_params-\u003eifindex = vlan_idx;\n+\tif (!ASSERT_EQ(inet_pton(AF_INET, \"10.66.0.2\", \u0026fib_params-\u003eipv4_dst),\n+\t\t 1, \"inet_pton(dst)\") ||\n+\t !ASSERT_EQ(inet_pton(AF_INET, \"10.66.0.1\", \u0026fib_params-\u003eipv4_src),\n+\t\t 1, \"inet_pton(src)\"))\n+\t\tgoto fail;\n+\n+\tskel-\u003ebss-\u003efib_lookup_ret = -1;\n+\tskel-\u003ebss-\u003elookup_flags = BPF_FIB_LOOKUP_VLAN |\n+\t\t\t\t BPF_FIB_LOOKUP_SKIP_NEIGH;\n+\terr = bpf_prog_test_run_opts(xdp_fd, \u0026xdp_opts);\n+\tif (!ASSERT_OK(err, \"test_run(egress)\"))\n+\t\tgoto fail;\n+\tASSERT_EQ(skel-\u003ebss-\u003efib_lookup_ret, BPF_FIB_LKUP_RET_VLAN_FAILURE,\n+\t\t \"egress returns VLAN_FAILURE\");\n+\tASSERT_EQ(fib_params-\u003eifindex, vlan_idx,\n+\t\t \"foreign parent not published\");\n+\tASSERT_EQ(fib_params-\u003eh_vlan_TCI, 0, \"vlan fields zero\");\n+\n+fail:\n+\tif (nstoken)\n+\t\tclose_netns(nstoken);\n+\tSYS_NOFAIL(\"ip netns del \" NS_VLAN_A);\n+\tSYS_NOFAIL(\"ip netns del \" NS_VLAN_B);\n+\tfib_lookup__destroy(skel);\n+}\n+\n+#define REDIRECT_NPKTS 1000\n+\n+/*\n+ * The egress flag exists so an XDP program can redirect to the physical\n+ * parent. A redirect that lands on a VLAN device is dropped at\n+ * xdp_do_flush(), because a VLAN device has no ndo_xdp_xmit. Drive real\n+ * frames with BPF_F_TEST_XDP_LIVE_FRAMES, which runs the native\n+ * xdp_do_redirect() + xdp_do_flush() path: a reducible VLAN egress\n+ * resolves to veth1 and is delivered to its peer veth2, while a QinQ\n+ * egress returns VLAN_FAILURE and is passed to the stack instead of\n+ * redirected to a device that would silently drop it.\n+ */\n+void test_fib_lookup_vlan_redirect(void)\n+{\n+\tint redirect_fd, err, veth1_idx, veth2_idx = -1;\n+\tstruct bpf_fib_lookup *fib_params;\n+\tstruct nstoken *nstoken = NULL;\n+\tstruct fib_lookup *skel = NULL;\n+\tbool xdp_attached = false;\n+\n+\tLIBBPF_OPTS(bpf_test_run_opts, lf_opts,\n+\t\t .data_in = \u0026pkt_v4,\n+\t\t .data_size_in = sizeof(pkt_v4),\n+\t\t .flags = BPF_F_TEST_XDP_LIVE_FRAMES,\n+\t\t .repeat = REDIRECT_NPKTS,\n+\t);\n+\n+\tskel = fib_lookup__open_and_load();\n+\tif (!ASSERT_OK_PTR(skel, \"skel open_and_load\"))\n+\t\treturn;\n+\tredirect_fd = bpf_program__fd(skel-\u003eprogs.fib_lookup_redirect);\n+\tfib_params = \u0026skel-\u003ebss-\u003efib_params;\n+\n+\tSYS(fail, \"ip netns add %s\", NS_TEST);\n+\tnstoken = open_netns(NS_TEST);\n+\tif (!ASSERT_OK_PTR(nstoken, \"open_netns\"))\n+\t\tgoto fail;\n+\tif (setup_netns())\n+\t\tgoto fail;\n+\n+\tveth1_idx = if_nametoindex(\"veth1\");\n+\tveth2_idx = if_nametoindex(\"veth2\");\n+\tif (!ASSERT_NEQ(veth1_idx, 0, \"if_nametoindex(veth1)\") ||\n+\t !ASSERT_NEQ(veth2_idx, 0, \"if_nametoindex(veth2)\"))\n+\t\tgoto fail;\n+\n+\t/*\n+\t * A redirect to veth1 is delivered to its peer veth2. veth_xdp_xmit()\n+\t * only accepts the frame if veth2's NAPI is up, which on veth means\n+\t * veth2 carries an XDP program; xdp_count tallies what arrives.\n+\t */\n+\terr = bpf_xdp_attach(veth2_idx, bpf_program__fd(skel-\u003eprogs.xdp_count),\n+\t\t\t XDP_FLAGS_DRV_MODE, NULL);\n+\tif (!ASSERT_OK(err, \"attach xdp_count on veth2\"))\n+\t\tgoto fail;\n+\txdp_attached = true;\n+\n+\t/* reducible VLAN egress: resolves to the physical parent veth1 */\n+\tmemset(fib_params, 0, sizeof(*fib_params));\n+\tfib_params-\u003efamily = AF_INET;\n+\tfib_params-\u003el4_protocol = IPPROTO_TCP;\n+\tfib_params-\u003eifindex = veth1_idx;\n+\tif (!ASSERT_EQ(inet_pton(AF_INET, IPV4_IFACE_ADDR, \u0026fib_params-\u003eipv4_src),\n+\t\t 1, \"inet_pton(src)\") ||\n+\t !ASSERT_EQ(inet_pton(AF_INET, IPV4_VLAN_EGRESS_DST, \u0026fib_params-\u003eipv4_dst),\n+\t\t 1, \"inet_pton(reducible dst)\"))\n+\t\tgoto fail;\n+\tskel-\u003ebss-\u003elookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH;\n+\tskel-\u003ebss-\u003eredirected = 0;\n+\tskel-\u003ebss-\u003epassed = 0;\n+\tskel-\u003ebss-\u003edelivered = 0;\n+\n+\terr = bpf_prog_test_run_opts(redirect_fd, \u0026lf_opts);\n+\tif (!ASSERT_OK(err, \"test_run(reducible egress)\"))\n+\t\tgoto fail;\n+\tASSERT_EQ(skel-\u003ebss-\u003eredirected, REDIRECT_NPKTS, \"reducible egress redirected\");\n+\tASSERT_EQ(skel-\u003ebss-\u003epassed, 0, \"reducible egress not passed\");\n+\tASSERT_GT(skel-\u003ebss-\u003edelivered, 0, \"reducible egress delivered to veth2\");\n+\n+\t/*\n+\t * QinQ egress: not reducible, so the lookup returns VLAN_FAILURE and\n+\t * the program passes the frame instead of redirecting to the inner\n+\t * VLAN device. redirected == 0 is the assertion that matters: the\n+\t * program did not redirect to a device that would drop the frame at\n+\t * xdp_do_flush(). veth2's delivered count is not checked here, since\n+\t * a passed frame can still reach veth2 through the stack's forwarding\n+\t * path, which is unrelated to the redirect under test.\n+\t */\n+\tmemset(fib_params, 0, sizeof(*fib_params));\n+\tfib_params-\u003efamily = AF_INET;\n+\tfib_params-\u003el4_protocol = IPPROTO_TCP;\n+\tfib_params-\u003eifindex = veth1_idx;\n+\tif (!ASSERT_EQ(inet_pton(AF_INET, IPV4_IFACE_ADDR, \u0026fib_params-\u003eipv4_src),\n+\t\t 1, \"inet_pton(src)\") ||\n+\t !ASSERT_EQ(inet_pton(AF_INET, IPV4_QINQ_DST, \u0026fib_params-\u003eipv4_dst),\n+\t\t 1, \"inet_pton(qinq dst)\"))\n+\t\tgoto fail;\n+\tskel-\u003ebss-\u003elookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH;\n+\tskel-\u003ebss-\u003eredirected = 0;\n+\tskel-\u003ebss-\u003epassed = 0;\n+\n+\terr = bpf_prog_test_run_opts(redirect_fd, \u0026lf_opts);\n+\tif (!ASSERT_OK(err, \"test_run(qinq egress)\"))\n+\t\tgoto fail;\n+\tASSERT_EQ(skel-\u003ebss-\u003epassed, REDIRECT_NPKTS, \"qinq egress passed\");\n+\tASSERT_EQ(skel-\u003ebss-\u003eredirected, 0, \"qinq egress not redirected\");\n+\n fail:\n+\tif (xdp_attached)\n+\t\tbpf_xdp_detach(veth2_idx, XDP_FLAGS_DRV_MODE, NULL);\n \tif (nstoken)\n \t\tclose_netns(nstoken);\n \tSYS_NOFAIL(\"ip netns del \" NS_TEST);\ndiff --git a/tools/testing/selftests/bpf/progs/fib_lookup.c b/tools/testing/selftests/bpf/progs/fib_lookup.c\nindex 7b5dd2214ff46a..862a1e9457b4e0 100644\n--- a/tools/testing/selftests/bpf/progs/fib_lookup.c\n+++ b/tools/testing/selftests/bpf/progs/fib_lookup.c\n@@ -19,4 +19,40 @@ int fib_lookup(struct __sk_buff *skb)\n \treturn TC_ACT_SHOT;\n }\n \n+SEC(\"xdp\")\n+int fib_lookup_xdp(struct xdp_md *ctx)\n+{\n+\tfib_lookup_ret = bpf_fib_lookup(ctx, \u0026fib_params, sizeof(fib_params),\n+\t\t\t\t\tlookup_flags);\n+\n+\treturn XDP_DROP;\n+}\n+\n+int redirected = 0;\n+int passed = 0;\n+int delivered = 0;\n+\n+SEC(\"xdp\")\n+int fib_lookup_redirect(struct xdp_md *ctx)\n+{\n+\tstruct bpf_fib_lookup params = fib_params;\n+\tlong ret;\n+\n+\tret = bpf_fib_lookup(ctx, \u0026params, sizeof(params), lookup_flags);\n+\tif (ret == BPF_FIB_LKUP_RET_SUCCESS) {\n+\t\tredirected++;\n+\t\treturn bpf_redirect(params.ifindex, 0);\n+\t}\n+\n+\tpassed++;\n+\treturn XDP_PASS;\n+}\n+\n+SEC(\"xdp\")\n+int xdp_count(struct xdp_md *ctx)\n+{\n+\tdelivered++;\n+\treturn XDP_DROP;\n+}\n+\n char _license[] SEC(\"license\") = \"GPL\";\n"
} |
| 2/1 | 2026/06/24 03:25 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"VLAN_8021Q"
],
"FocusSymbols": [
"bpf_ipv4_fib_lookup",
"bpf_ipv6_fib_lookup",
"bpf_xdp_fib_lookup",
"bpf_skb_fib_lookup",
"bpf_fib_set_fwd_params",
"bpf_fib_vlan_input_dev"
],
"Reasoning": "The patch introduces functional changes to the BPF FIB lookup helper (`bpf_fib_lookup`), adding support for VLANs via `BPF_FIB_LOOKUP_VLAN` and `BPF_FIB_LOOKUP_VLAN_INPUT` flags. This modifies core routing lookup logic within BPF programs, which is reachable from userspace by loading and executing BPF programs (XDP or TC). Fuzzing is required to ensure the new VLAN resolution logic and its interaction with the networking stack is robust.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 353371cda9b7e9c727e88a0b9f7df15d50feeb8e
Author: syz-cluster <triage@syzkaller.com>
Date: Wed Jun 24 03:25:51 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 89b36de5fdbb6d..d4218954c50f53 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3532,6 +3532,45 @@ union bpf_attr {
* Use the mark present in *params*->mark for the fib lookup.
* This option should not be used with BPF_FIB_LOOKUP_DIRECT,
* as it only has meaning for full lookups.
+ * **BPF_FIB_LOOKUP_VLAN**
+ * If the fib lookup resolves to a VLAN device whose
+ * parent is a real (non-VLAN) device, set
+ * *params*->h_vlan_proto and *params*->h_vlan_TCI from
+ * the VLAN device and replace *params*->ifindex with the
+ * parent's ifindex. *params*->h_vlan_TCI carries the VID
+ * only, with PCP and DEI bits zero; a consumer wanting to
+ * set egress priority writes PCP itself. *params*->smac is
+ * the VLAN device's own address, which can differ from the
+ * parent's. Only the immediate parent is resolved; if it
+ * is itself a VLAN device (QinQ) or in another namespace,
+ * the egress cannot be reduced to a physical device plus
+ * one tag and the lookup returns
+ * **BPF_FIB_LKUP_RET_VLAN_FAILURE** with *params*->ifindex
+ * left at the input. Re-issue without
+ * **BPF_FIB_LOOKUP_VLAN** to obtain the VLAN device's own
+ * ifindex. The swap and the vlan fields
+ * are written only on success; other output fields keep
+ * the helper's existing behaviour, so a frag-needed result
+ * still reports the route mtu in *params*->mtu_result.
+ * This flag is only valid for XDP programs; tc programs
+ * receive -EINVAL since they can redirect to the VLAN
+ * device directly.
+ * **BPF_FIB_LOOKUP_VLAN_INPUT**
+ * Treat *params*->h_vlan_proto and *params*->h_vlan_TCI
+ * as an input VLAN tag and run the lookup as if ingress
+ * had happened on the VLAN subinterface carrying that tag
+ * on *params*->ifindex. The VID is the low 12 bits of
+ * *params*->h_vlan_TCI; *params*->h_vlan_proto must be
+ * ETH_P_8021Q or ETH_P_8021AD in network byte order, else
+ * **-EINVAL**. If *params*->ifindex is itself a VLAN
+ * device, its inner (QinQ) subinterface is matched; for a
+ * bond or team, pass the master's ifindex. An unmatched
+ * tag, a down device, or one in another namespace returns
+ * **BPF_FIB_LKUP_RET_NOT_FWDED**, mirroring real ingress.
+ * A VID of 0 is looked up literally, so do not set this
+ * flag for priority-tagged frames. Cannot be combined with
+ * **BPF_FIB_LOOKUP_TBID** or **BPF_FIB_LOOKUP_OUTPUT**
+ * (returns **-EINVAL**).
*
* *ctx* is either **struct xdp_md** for XDP programs or
* **struct sk_buff** tc cls_act programs.
@@ -7327,6 +7366,8 @@ enum {
BPF_FIB_LOOKUP_TBID = (1U << 3),
BPF_FIB_LOOKUP_SRC = (1U << 4),
BPF_FIB_LOOKUP_MARK = (1U << 5),
+ BPF_FIB_LOOKUP_VLAN = (1U << 6),
+ BPF_FIB_LOOKUP_VLAN_INPUT = (1U << 7),
};
enum {
@@ -7340,6 +7381,7 @@ enum {
BPF_FIB_LKUP_RET_NO_NEIGH, /* no neighbor entry for nh */
BPF_FIB_LKUP_RET_FRAG_NEEDED, /* fragmentation required to fwd */
BPF_FIB_LKUP_RET_NO_SRC_ADDR, /* failed to derive IP src addr */
+ BPF_FIB_LKUP_RET_VLAN_FAILURE, /* VLAN egress, parent unresolvable */
};
struct bpf_fib_lookup {
@@ -7393,7 +7435,13 @@ struct bpf_fib_lookup {
union {
struct {
- /* output */
+ /*
+ * output with BPF_FIB_LOOKUP_VLAN: set from the
+ * resolved egress VLAN device (see the flag); zeroed
+ * on other successful lookups. input with
+ * BPF_FIB_LOOKUP_VLAN_INPUT: the VLAN tag to scope
+ * the lookup by.
+ */
__be16 h_vlan_proto;
__be16 h_vlan_TCI;
};
diff --git a/net/core/filter.c b/net/core/filter.c
index 2e96b4b847ce12..0ea362fa4287e3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6201,21 +6201,60 @@ static const struct bpf_func_proto bpf_skb_get_xfrm_state_proto = {
#endif
#if IS_ENABLED(CONFIG_INET) || IS_ENABLED(CONFIG_IPV6)
-static int bpf_fib_set_fwd_params(struct bpf_fib_lookup *params, u32 mtu)
+static int bpf_fib_set_fwd_params(struct net_device *dev,
+ struct bpf_fib_lookup *params,
+ u32 flags, u32 mtu, u32 in_ifindex)
{
params->h_vlan_TCI = 0;
params->h_vlan_proto = 0;
+
+#if IS_ENABLED(CONFIG_VLAN_8021Q)
+ if ((flags & BPF_FIB_LOOKUP_VLAN) && is_vlan_dev(dev)) {
+ struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
+
+ if (!is_vlan_dev(real_dev) &&
+ net_eq(dev_net(real_dev), dev_net(dev))) {
+ params->h_vlan_proto = vlan_dev_vlan_proto(dev);
+ params->h_vlan_TCI = htons(vlan_dev_vlan_id(dev));
+ params->ifindex = real_dev->ifindex;
+ } else {
+ params->ifindex = in_ifindex;
+ return BPF_FIB_LKUP_RET_VLAN_FAILURE;
+ }
+ }
+#endif
+
if (mtu)
params->mtu_result = mtu; /* union with tot_len */
return 0;
}
+
+static struct net_device *bpf_fib_vlan_input_dev(struct net_device *dev,
+ const struct bpf_fib_lookup *params)
+{
+ __be16 proto = params->h_vlan_proto;
+ struct net_device *vlan_dev;
+ u16 vid;
+
+ if (proto != htons(ETH_P_8021Q) && proto != htons(ETH_P_8021AD))
+ return ERR_PTR(-EINVAL);
+
+ vid = ntohs(params->h_vlan_TCI) & VLAN_VID_MASK;
+ vlan_dev = __vlan_find_dev_deep_rcu(dev, proto, vid);
+ if (!vlan_dev || !(vlan_dev->flags & IFF_UP) ||
+ !net_eq(dev_net(vlan_dev), dev_net(dev)))
+ return NULL;
+
+ return vlan_dev;
+}
#endif
#if IS_ENABLED(CONFIG_INET)
static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
u32 flags, bool check_mtu)
{
+ u32 in_ifindex = params->ifindex;
struct neighbour *neigh = NULL;
struct fib_nh_common *nhc;
struct in_device *in_dev;
@@ -6229,6 +6268,14 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
if (unlikely(!dev))
return -ENODEV;
+ if (flags & BPF_FIB_LOOKUP_VLAN_INPUT) {
+ dev = bpf_fib_vlan_input_dev(dev, params);
+ if (IS_ERR(dev))
+ return PTR_ERR(dev);
+ if (!dev)
+ return BPF_FIB_LKUP_RET_NOT_FWDED;
+ }
+
/* verify forwarding is enabled on this interface */
in_dev = __in_dev_get_rcu(dev);
if (unlikely(!in_dev || !IN_DEV_FORWARD(in_dev)))
@@ -6238,7 +6285,11 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
fl4.flowi4_iif = 1;
fl4.flowi4_oif = params->ifindex;
} else {
- fl4.flowi4_iif = params->ifindex;
+ /*
+ * dev->ifindex, not params->ifindex: VLAN_INPUT may have
+ * resolved dev to a subinterface above.
+ */
+ fl4.flowi4_iif = dev->ifindex;
fl4.flowi4_oif = 0;
}
fl4.flowi4_dscp = inet_dsfield_to_dscp(params->tos);
@@ -6347,7 +6398,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
memcpy(params->smac, dev->dev_addr, ETH_ALEN);
set_fwd_params:
- return bpf_fib_set_fwd_params(params, mtu);
+ return bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);
}
#endif
@@ -6357,6 +6408,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
{
struct in6_addr *src = (struct in6_addr *) params->ipv6_src;
struct in6_addr *dst = (struct in6_addr *) params->ipv6_dst;
+ u32 in_ifindex = params->ifindex;
struct fib6_result res = {};
struct neighbour *neigh;
struct net_device *dev;
@@ -6374,6 +6426,14 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
if (unlikely(!dev))
return -ENODEV;
+ if (flags & BPF_FIB_LOOKUP_VLAN_INPUT) {
+ dev = bpf_fib_vlan_input_dev(dev, params);
+ if (IS_ERR(dev))
+ return PTR_ERR(dev);
+ if (!dev)
+ return BPF_FIB_LKUP_RET_NOT_FWDED;
+ }
+
idev = __in6_dev_get_safely(dev);
if (unlikely(!idev || !READ_ONCE(idev->cnf.forwarding)))
return BPF_FIB_LKUP_RET_FWD_DISABLED;
@@ -6382,7 +6442,12 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
fl6.flowi6_iif = 1;
oif = fl6.flowi6_oif = params->ifindex;
} else {
- oif = fl6.flowi6_iif = params->ifindex;
+ /*
+ * dev->ifindex, not params->ifindex: VLAN_INPUT may have
+ * resolved dev to a subinterface above.
+ */
+ oif = dev->ifindex;
+ fl6.flowi6_iif = oif;
fl6.flowi6_oif = 0;
strict = RT6_LOOKUP_F_HAS_SADDR;
}
@@ -6486,13 +6551,26 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
memcpy(params->smac, dev->dev_addr, ETH_ALEN);
set_fwd_params:
- return bpf_fib_set_fwd_params(params, mtu);
+ return bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);
}
#endif
#define BPF_FIB_LOOKUP_MASK (BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT | \
BPF_FIB_LOOKUP_SKIP_NEIGH | BPF_FIB_LOOKUP_TBID | \
- BPF_FIB_LOOKUP_SRC | BPF_FIB_LOOKUP_MARK)
+ BPF_FIB_LOOKUP_SRC | BPF_FIB_LOOKUP_MARK | \
+ BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_VLAN_INPUT)
+
+static bool bpf_fib_lookup_flags_ok(u32 flags)
+{
+ if (flags & ~BPF_FIB_LOOKUP_MASK)
+ return false;
+
+ if ((flags & BPF_FIB_LOOKUP_VLAN_INPUT) &&
+ (flags & (BPF_FIB_LOOKUP_TBID | BPF_FIB_LOOKUP_OUTPUT)))
+ return false;
+
+ return true;
+}
BPF_CALL_4(bpf_xdp_fib_lookup, struct xdp_buff *, ctx,
struct bpf_fib_lookup *, params, int, plen, u32, flags)
@@ -6500,7 +6578,7 @@ BPF_CALL_4(bpf_xdp_fib_lookup, struct xdp_buff *, ctx,
if (plen < sizeof(*params))
return -EINVAL;
- if (flags & ~BPF_FIB_LOOKUP_MASK)
+ if (!bpf_fib_lookup_flags_ok(flags))
return -EINVAL;
switch (params->family) {
@@ -6538,7 +6616,10 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
if (plen < sizeof(*params))
return -EINVAL;
- if (flags & ~BPF_FIB_LOOKUP_MASK)
+ if (!bpf_fib_lookup_flags_ok(flags))
+ return -EINVAL;
+
+ if (flags & BPF_FIB_LOOKUP_VLAN)
return -EINVAL;
if (params->tot_len)
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 89b36de5fdbb6d..d4218954c50f53 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3532,6 +3532,45 @@ union bpf_attr {
* Use the mark present in *params*->mark for the fib lookup.
* This option should not be used with BPF_FIB_LOOKUP_DIRECT,
* as it only has meaning for full lookups.
+ * **BPF_FIB_LOOKUP_VLAN**
+ * If the fib lookup resolves to a VLAN device whose
+ * parent is a real (non-VLAN) device, set
+ * *params*->h_vlan_proto and *params*->h_vlan_TCI from
+ * the VLAN device and replace *params*->ifindex with the
+ * parent's ifindex. *params*->h_vlan_TCI carries the VID
+ * only, with PCP and DEI bits zero; a consumer wanting to
+ * set egress priority writes PCP itself. *params*->smac is
+ * the VLAN device's own address, which can differ from the
+ * parent's. Only the immediate parent is resolved; if it
+ * is itself a VLAN device (QinQ) or in another namespace,
+ * the egress cannot be reduced to a physical device plus
+ * one tag and the lookup returns
+ * **BPF_FIB_LKUP_RET_VLAN_FAILURE** with *params*->ifindex
+ * left at the input. Re-issue without
+ * **BPF_FIB_LOOKUP_VLAN** to obtain the VLAN device's own
+ * ifindex. The swap and the vlan fields
+ * are written only on success; other output fields keep
+ * the helper's existing behaviour, so a frag-needed result
+ * still reports the route mtu in *params*->mtu_result.
+ * This flag is only valid for XDP programs; tc programs
+ * receive -EINVAL since they can redirect to the VLAN
+ * device directly.
+ * **BPF_FIB_LOOKUP_VLAN_INPUT**
+ * Treat *params*->h_vlan_proto and *params*->h_vlan_TCI
+ * as an input VLAN tag and run the lookup as if ingress
+ * had happened on the VLAN subinterface carrying that tag
+ * on *params*->ifindex. The VID is the low 12 bits of
+ * *params*->h_vlan_TCI; *params*->h_vlan_proto must be
+ * ETH_P_8021Q or ETH_P_8021AD in network byte order, else
+ * **-EINVAL**. If *params*->ifindex is itself a VLAN
+ * device, its inner (QinQ) subinterface is matched; for a
+ * bond or team, pass the master's ifindex. An unmatched
+ * tag, a down device, or one in another namespace returns
+ * **BPF_FIB_LKUP_RET_NOT_FWDED**, mirroring real ingress.
+ * A VID of 0 is looked up literally, so do not set this
+ * flag for priority-tagged frames. Cannot be combined with
+ * **BPF_FIB_LOOKUP_TBID** or **BPF_FIB_LOOKUP_OUTPUT**
+ * (returns **-EINVAL**).
*
* *ctx* is either **struct xdp_md** for XDP programs or
* **struct sk_buff** tc cls_act programs.
@@ -7327,6 +7366,8 @@ enum {
BPF_FIB_LOOKUP_TBID = (1U << 3),
BPF_FIB_LOOKUP_SRC = (1U << 4),
BPF_FIB_LOOKUP_MARK = (1U << 5),
+ BPF_FIB_LOOKUP_VLAN = (1U << 6),
+ BPF_FIB_LOOKUP_VLAN_INPUT = (1U << 7),
};
enum {
@@ -7340,6 +7381,7 @@ enum {
BPF_FIB_LKUP_RET_NO_NEIGH, /* no neighbor entry for nh */
BPF_FIB_LKUP_RET_FRAG_NEEDED, /* fragmentation required to fwd */
BPF_FIB_LKUP_RET_NO_SRC_ADDR, /* failed to derive IP src addr */
+ BPF_FIB_LKUP_RET_VLAN_FAILURE, /* VLAN egress, parent unresolvable */
};
struct bpf_fib_lookup {
@@ -7393,7 +7435,13 @@ struct bpf_fib_lookup {
union {
struct {
- /* output */
+ /*
+ * output with BPF_FIB_LOOKUP_VLAN: set from the
+ * resolved egress VLAN device (see the flag); zeroed
+ * on other successful lookups. input with
+ * BPF_FIB_LOOKUP_VLAN_INPUT: the VLAN tag to scope
+ * the lookup by.
+ */
__be16 h_vlan_proto;
__be16 h_vlan_TCI;
};
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index bd76589580041f..8caed9d43b9811 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -2,6 +2,7 @@
/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
#include <linux/rtnetlink.h>
+#include <linux/if_ether.h>
#include <sys/types.h>
#include <net/if.h>
@@ -23,6 +24,7 @@
#define IPV4_TBID_ADDR "172.0.0.254"
#define IPV4_TBID_NET "172.0.0.0"
#define IPV4_TBID_DST "172.0.0.2"
+#define IPV4_TBID_NONEIGH_DST "172.0.0.5"
#define IPV6_TBID_ADDR "fd00::FFFF"
#define IPV6_TBID_NET "fd00::"
#define IPV6_TBID_DST "fd00::2"
@@ -37,6 +39,41 @@
#define IPV6_LOCAL "fd01::3"
#define IPV6_GW1 "fd01::1"
#define IPV6_GW2 "fd01::2"
+#define VLAN_ID 100
+#define VLAN_IFACE "veth1.100"
+#define VLAN_ID_DOWN 102
+#define VLAN_IFACE_DOWN "veth1.102"
+#define QINQ_OUTER_IFACE "veth1.200"
+#define QINQ_INNER_IFACE "veth1.200.300"
+#define VLAN_TABLE "300"
+#define IPV4_VLAN_IFACE_ADDR "10.5.0.254"
+#define IPV4_VLAN_EGRESS_DST "10.5.0.2"
+#define IPV4_QINQ_DST "10.7.0.2"
+#define IPV4_VLAN_DST "10.6.0.2"
+#define IPV4_VLAN_GW "10.5.0.1"
+#define IPV6_VLAN_IFACE_ADDR "fd02::254"
+#define IPV6_VLAN_EGRESS_DST "fd02::2"
+#define IPV6_VLAN_DST "fd03::2"
+#define IPV6_VLAN_GW "fd02::1"
+#define VLAN_VID_UNUSED 999
+#define VRF_IFACE "vrf-blue"
+#define VRF_TABLE "1000"
+#define VRF_VLAN_ID 101
+#define VRF_VLAN_IFACE "veth1.101"
+#define IPV4_VRF_IFACE_ADDR "10.8.0.254"
+#define IPV4_VRF_GW "10.8.0.1"
+#define IPV4_VRF_DST "10.9.0.2"
+#define TBID_VLAN_ID 50
+#define TBID_VLAN_IFACE "veth2.50"
+#define IPV4_TBID_VLAN_DST "172.2.0.2"
+#define IPV4_BOND_VLAN_DST "10.11.0.2"
+#define IPV4_VLAN_MTU_DST "10.5.9.2"
+#define QINQ_AD_VLAN_ID 200
+#define QINQ_INNER_VLAN_ID 300
+#define BOND_IFACE "bond99"
+#define BOND_PORT "veth3"
+#define BOND_PORT_PEER "veth4"
+#define BOND_VLAN_ID 500
#define DMAC "11:11:11:11:11:11"
#define DMAC_INIT { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, }
#define DMAC2 "01:01:01:01:01:01"
@@ -52,6 +89,17 @@ struct fib_lookup_test {
__u32 tbid;
__u8 dmac[6];
__u32 mark;
+ /*
+ * input tag with BPF_FIB_LOOKUP_VLAN_INPUT; expected output tag
+ * with BPF_FIB_LOOKUP_VLAN (checked when check_vlan is set)
+ */
+ __u16 vlan_proto;
+ __u16 vlan_id;
+ bool check_vlan;
+ const char *expected_dev; /* expected params->ifindex after lookup */
+ const char *iif; /* override the default veth1 input device */
+ __u16 tot_len; /* triggers the in-lookup mtu check when set */
+ __u16 expected_mtu; /* expected mtu_result (union with tot_len) */
};
static const struct fib_lookup_test tests[] = {
@@ -79,6 +127,17 @@ static const struct fib_lookup_test tests[] = {
.daddr = IPV4_TBID_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
.lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID, .tbid = 100,
.dmac = DMAC_INIT2, },
+ /*
+ * An error that returns after the egress device is resolved must
+ * report the egress ifindex, not the input. This routes from input
+ * veth1 via veth2 (table 100) to a dst with no neighbour, so
+ * input != egress, pinning NO_NEIGH to the egress device.
+ */
+ { .desc = "IPv4 NO_NEIGH reports the egress ifindex, not the input",
+ .daddr = IPV4_TBID_NONEIGH_DST,
+ .expected_ret = BPF_FIB_LKUP_RET_NO_NEIGH,
+ .lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID, .tbid = 100,
+ .expected_dev = "veth2", },
{ .desc = "IPv6 TBID lookup failure",
.daddr = IPV6_TBID_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID,
@@ -142,6 +201,218 @@ static const struct fib_lookup_test tests[] = {
.expected_dst = IPV6_GW1,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
.mark = MARK, },
+ /* vlan egress resolution */
+ /*
+ * Invariant the VLAN-egress arms jointly enforce: a
+ * BPF_FIB_LOOKUP_VLAN SUCCESS always carries a physical,
+ * xmit-capable ifindex -- no SUCCESS ever returns a VLAN-device
+ * ifindex. Reducible arms pin ifindex == the physical parent; the
+ * QinQ and foreign-netns arms pin VLAN_FAILURE with params->ifindex
+ * left at the input, so a regression to best-effort (SUCCESS + the
+ * VLAN ifindex) fails one.
+ */
+ { .desc = "IPv4 VLAN egress, no flag",
+ .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = VLAN_IFACE, .check_vlan = true, },
+ { .desc = "IPv4 VLAN egress, single VLAN",
+ .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = "veth1", .check_vlan = true,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ /*
+ * skb path without tot_len: mtu_result is the VLAN device's mtu
+ * (1400), not the parent's (1500)
+ */
+ { .desc = "IPv4 VLAN egress, skb-path mtu is the VLAN device's without the flag",
+ .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = VLAN_IFACE, .check_vlan = true, .expected_mtu = 1400, },
+ { .desc = "IPv4 VLAN egress, flag set but egress is not a VLAN",
+ .daddr = IPV4_NUD_FAILED_ADDR, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = "veth1", .check_vlan = true, },
+ { .desc = "IPv4 VLAN egress, QinQ not reducible (VLAN_FAILURE)",
+ .daddr = IPV4_QINQ_DST,
+ .expected_ret = BPF_FIB_LKUP_RET_VLAN_FAILURE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = "veth1", .check_vlan = true, },
+ { .desc = "IPv4 QinQ egress without the flag (escape hatch)",
+ .daddr = IPV4_QINQ_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = QINQ_INNER_IFACE, },
+ { .desc = "IPv6 VLAN egress, single VLAN",
+ .daddr = IPV6_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = "veth1", .check_vlan = true,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN egress, neighbour on the VLAN device",
+ .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN,
+ .expected_dev = "veth1", .check_vlan = true,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, .dmac = DMAC_INIT, },
+ { .desc = "IPv4 VLAN egress in OUTPUT mode",
+ .daddr = IPV4_VLAN_EGRESS_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .iif = VLAN_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_VLAN |
+ BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = "veth1", .check_vlan = true,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN egress over a bond",
+ .daddr = IPV4_BOND_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = BOND_IFACE, .check_vlan = true,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },
+ { .desc = "IPv4 VLAN egress via TBID table",
+ .daddr = IPV4_TBID_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_TBID |
+ BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .tbid = 100,
+ .expected_dev = "veth2", .check_vlan = true,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = TBID_VLAN_ID, },
+ { .desc = "IPv4 VLAN egress, success writes mtu_result with the swap",
+ .daddr = IPV4_VLAN_MTU_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .tot_len = 500, .expected_mtu = 1000,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = "veth1", .check_vlan = true,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN egress, FRAG_NEEDED reports mtu, swap unwritten",
+ .daddr = IPV4_VLAN_MTU_DST, .expected_ret = BPF_FIB_LKUP_RET_FRAG_NEEDED,
+ .tot_len = 1400, .expected_mtu = 1000,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .expected_dev = "veth1", .check_vlan = true, },
+ /* vlan tag as lookup input */
+ { .desc = "IPv4 VLAN input, no flag",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_GW1,
+ .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH, },
+ { .desc = "IPv4 VLAN input, tag selects subinterface route",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_VLAN_GW, .expected_dev = VLAN_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ { .desc = "IPv6 VLAN input, tag selects subinterface route",
+ .daddr = IPV6_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV6_VLAN_GW, .expected_dev = VLAN_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN input and egress combined",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_VLAN_GW, .expected_dev = "veth1",
+ .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_VLAN |
+ BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN input, neighbour resolved on the route",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_VLAN_GW, .expected_dev = VLAN_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, .dmac = DMAC_INIT2, },
+ { .desc = "IPv4 VLAN input, source address from the subinterface",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_src = IPV4_VLAN_IFACE_ADDR,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SRC |
+ BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ /*
+ * VRF: the resolved subinterface is enslaved, so the l3mdev rule
+ * (full lookup) and l3mdev_fib_table_rcu() (DIRECT) must select
+ * the VRF table from the resolved ingress
+ */
+ { .desc = "IPv4 VLAN input, VRF subinterface, no flag",
+ .daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_GW1,
+ .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH, },
+ { .desc = "IPv4 VLAN input, tag selects VRF table",
+ .daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_VRF_GW, .expected_dev = VRF_VLAN_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VRF_VLAN_ID, },
+ { .desc = "IPv4 VLAN input, DIRECT uses VRF table from resolved ingress",
+ .daddr = IPV4_VRF_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_VRF_GW, .expected_dev = VRF_VLAN_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_DIRECT |
+ BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VRF_VLAN_ID, },
+ /*
+ * failure arms also assert params is left untouched: ifindex still
+ * names the physical device and the input tag bytes survive
+ */
+ { .desc = "IPv4 VLAN input, invalid proto",
+ .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
+ .expected_dev = "veth1", .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = 0x1234, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN input, unmatched VID",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+ .expected_dev = "veth1", .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_VID_UNUSED, },
+ { .desc = "IPv4 VLAN input, subinterface down",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+ .expected_dev = "veth1", .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID_DOWN, },
+ /*
+ * the resolver runs before the forwarding check, so on devices
+ * with forwarding off FWD_DISABLED (not NOT_FWDED) proves the tag
+ * resolved to that device and the lookup used it as ingress
+ */
+ { .desc = "IPv4 VLAN input, 802.1ad tag",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021AD, .vlan_id = QINQ_AD_VLAN_ID, },
+ { .desc = "IPv4 VLAN input, PCP and DEI bits ignored in TCI",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .expected_dst = IPV4_VLAN_GW,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = 0xe000 | VLAN_ID, },
+ { .desc = "IPv4 VLAN input, inner QinQ device from VLAN ifindex",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,
+ .iif = QINQ_OUTER_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = QINQ_INNER_VLAN_ID, },
+ /*
+ * bonding: the VLANs live on the master, as on receive, where the
+ * frame is steered to the master before VLAN processing; a port
+ * ifindex does not match (ports carry vid state but no VLAN devs)
+ */
+ { .desc = "IPv4 VLAN input, tag on bond master resolves",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_FWD_DISABLED,
+ .iif = BOND_IFACE,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },
+ { .desc = "IPv4 VLAN input, tag on bond port does not match",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+ .iif = BOND_PORT, .expected_dev = BOND_PORT, .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = BOND_VLAN_ID, },
+ { .desc = "IPv6 VLAN input, invalid proto",
+ .daddr = IPV6_VLAN_DST, .expected_ret = -EINVAL,
+ .expected_dev = "veth1", .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = 0x1234, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN input, VID 0 priority tag fails closed",
+ .daddr = IPV4_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+ .expected_dev = "veth1", .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = 0, },
+ { .desc = "IPv6 VLAN input, unmatched VID",
+ .daddr = IPV6_VLAN_DST, .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+ .expected_dev = "veth1", .check_vlan = true,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_VID_UNUSED, },
+ { .desc = "unknown flag bit rejected",
+ .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
+ .lookup_flags = (1 << 14) | BPF_FIB_LOOKUP_SKIP_NEIGH, },
+ { .desc = "IPv4 VLAN input rejected with TBID",
+ .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_TBID,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
+ { .desc = "IPv4 VLAN input rejected with OUTPUT",
+ .daddr = IPV4_VLAN_DST, .expected_ret = -EINVAL,
+ .lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT | BPF_FIB_LOOKUP_OUTPUT,
+ .vlan_proto = ETH_P_8021Q, .vlan_id = VLAN_ID, },
};
static int setup_netns(void)
@@ -204,6 +475,110 @@ static int setup_netns(void)
SYS(fail, "ip rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
SYS(fail, "ip -6 rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
+ /*
+ * Setup for vlan tests: a subinterface for egress resolution and
+ * tag-as-input, a QinQ stack, and an iif rule so the input tests
+ * observe which device the lookup used as ingress.
+ */
+ SYS(fail, "ip link add link veth1 name %s type vlan id %d",
+ VLAN_IFACE, VLAN_ID);
+ SYS(fail, "ip link set dev %s up", VLAN_IFACE);
+ /*
+ * lower than the veth1 parent (1500): the skb-path mtu check uses the
+ * FIB result (VLAN) device, so mtu_result is this value with or
+ * without the egress swap, which two arms below pin
+ */
+ SYS(fail, "ip link set dev %s mtu 1400", VLAN_IFACE);
+ SYS(fail, "ip addr add %s/24 dev %s", IPV4_VLAN_IFACE_ADDR, VLAN_IFACE);
+ SYS(fail, "ip addr add %s/64 dev %s nodad", IPV6_VLAN_IFACE_ADDR, VLAN_IFACE);
+
+ /*
+ * stays down: the input flag must treat its tag the way real
+ * ingress treats a frame arriving on a down VLAN device (drop)
+ */
+ SYS(fail, "ip link add link veth1 name %s type vlan id %d",
+ VLAN_IFACE_DOWN, VLAN_ID_DOWN);
+
+ err = write_sysctl("/proc/sys/net/ipv4/conf/" VLAN_IFACE "/forwarding", "1");
+ if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf." VLAN_IFACE ".forwarding)"))
+ goto fail;
+
+ err = write_sysctl("/proc/sys/net/ipv6/conf/" VLAN_IFACE "/forwarding", "1");
+ if (!ASSERT_OK(err, "write_sysctl(net.ipv6.conf." VLAN_IFACE ".forwarding)"))
+ goto fail;
+
+ SYS(fail, "ip link add link veth1 name %s type vlan proto 802.1ad id 200",
+ QINQ_OUTER_IFACE);
+ SYS(fail, "ip link add link %s name %s type vlan id 300",
+ QINQ_OUTER_IFACE, QINQ_INNER_IFACE);
+ SYS(fail, "ip link set dev %s up", QINQ_OUTER_IFACE);
+ SYS(fail, "ip link set dev %s up", QINQ_INNER_IFACE);
+ SYS(fail, "ip route add %s/32 dev %s", IPV4_QINQ_DST, QINQ_INNER_IFACE);
+
+ SYS(fail, "ip route add %s/32 via %s", IPV4_VLAN_DST, IPV4_GW1);
+ SYS(fail, "ip route add table %s %s/32 via %s",
+ VLAN_TABLE, IPV4_VLAN_DST, IPV4_VLAN_GW);
+ SYS(fail, "ip rule add prio 3 iif %s lookup %s", VLAN_IFACE, VLAN_TABLE);
+ SYS(fail, "ip -6 route add %s/128 via %s", IPV6_VLAN_DST, IPV6_GW1);
+ SYS(fail, "ip -6 route add table %s %s/128 via %s",
+ VLAN_TABLE, IPV6_VLAN_DST, IPV6_VLAN_GW);
+ SYS(fail, "ip -6 rule add prio 3 iif %s lookup %s", VLAN_IFACE, VLAN_TABLE);
+
+ /*
+ * a bond with one port and a VLAN on the bond: VLANs on a bond
+ * live on the master, so resolution succeeds for the master's
+ * ifindex and fails closed for a port's, matching receive, which
+ * steers the frame to the master before VLAN processing
+ */
+ SYS(fail, "ip link add %s type bond", BOND_IFACE);
+ SYS(fail, "ip link add %s type veth peer name %s", BOND_PORT, BOND_PORT_PEER);
+ SYS(fail, "ip link set %s master %s", BOND_PORT, BOND_IFACE);
+ SYS(fail, "ip link set dev %s up", BOND_IFACE);
+ SYS(fail, "ip link set dev %s up", BOND_PORT);
+ SYS(fail, "ip link add link %s name %s.%d type vlan id %d",
+ BOND_IFACE, BOND_IFACE, BOND_VLAN_ID, BOND_VLAN_ID);
+ SYS(fail, "ip link set dev %s.%d up", BOND_IFACE, BOND_VLAN_ID);
+ SYS(fail, "ip route add %s/32 dev %s.%d",
+ IPV4_BOND_VLAN_DST, BOND_IFACE, BOND_VLAN_ID);
+
+ /*
+ * a VRF with its own dedicated subinterface (the iif rules above
+ * must not see it), for the table-selection-by-ingress cases
+ */
+ SYS(fail, "ip link add %s type vrf table %s", VRF_IFACE, VRF_TABLE);
+ SYS(fail, "ip link set dev %s up", VRF_IFACE);
+ SYS(fail, "ip link add link veth1 name %s type vlan id %d",
+ VRF_VLAN_IFACE, VRF_VLAN_ID);
+ SYS(fail, "ip link set %s master %s", VRF_VLAN_IFACE, VRF_IFACE);
+ SYS(fail, "ip link set dev %s up", VRF_VLAN_IFACE);
+ SYS(fail, "ip addr add %s/24 dev %s", IPV4_VRF_IFACE_ADDR, VRF_VLAN_IFACE);
+ err = write_sysctl("/proc/sys/net/ipv4/conf/" VRF_VLAN_IFACE "/forwarding", "1");
+ if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf." VRF_VLAN_IFACE ".forwarding)"))
+ goto fail;
+ SYS(fail, "ip route add %s/32 via %s", IPV4_VRF_DST, IPV4_GW1);
+ SYS(fail, "ip route add table %s %s/32 via %s",
+ VRF_TABLE, IPV4_VRF_DST, IPV4_VRF_GW);
+
+ /* neighbours on the VLAN subinterface for the non-SKIP_NEIGH cases */
+ err = write_sysctl("/proc/sys/net/ipv4/neigh/" VLAN_IFACE "/gc_stale_time", "900");
+ if (!ASSERT_OK(err, "write_sysctl(net.ipv4.neigh." VLAN_IFACE ".gc_stale_time)"))
+ goto fail;
+ SYS(fail, "ip neigh add %s dev %s lladdr %s nud stale",
+ IPV4_VLAN_EGRESS_DST, VLAN_IFACE, DMAC);
+ SYS(fail, "ip neigh add %s dev %s lladdr %s nud stale",
+ IPV4_VLAN_GW, VLAN_IFACE, DMAC2);
+
+ /* a VLAN on veth2 with a route in the tbid test table */
+ SYS(fail, "ip link add link veth2 name %s type vlan id %d",
+ TBID_VLAN_IFACE, TBID_VLAN_ID);
+ SYS(fail, "ip link set dev %s up", TBID_VLAN_IFACE);
+ SYS(fail, "ip route add table 100 %s/32 dev %s",
+ IPV4_TBID_VLAN_DST, TBID_VLAN_IFACE);
+
+ /* a locked-mtu route via the subinterface for the FRAG_NEEDED case */
+ SYS(fail, "ip route add %s/32 dev %s mtu lock 1000",
+ IPV4_VLAN_MTU_DST, VLAN_IFACE);
+
return 0;
fail:
return -1;
@@ -218,9 +593,16 @@ static int set_lookup_params(struct bpf_fib_lookup *params,
memset(params, 0, sizeof(*params));
params->l4_protocol = IPPROTO_TCP;
- params->ifindex = ifindex;
+ params->ifindex = test->iif ? if_nametoindex(test->iif) : ifindex;
params->tbid = test->tbid;
params->mark = test->mark;
+ params->tot_len = test->tot_len;
+
+ /* h_vlan_proto/h_vlan_TCI union with tbid */
+ if (test->lookup_flags & BPF_FIB_LOOKUP_VLAN_INPUT) {
+ params->h_vlan_proto = htons(test->vlan_proto);
+ params->h_vlan_TCI = htons(test->vlan_id);
+ }
if (inet_pton(AF_INET6, test->daddr, params->ipv6_dst) == 1) {
params->family = AF_INET6;
@@ -298,7 +680,7 @@ void test_fib_lookup(void)
struct nstoken *nstoken = NULL;
struct __sk_buff skb = { };
struct fib_lookup *skel;
- int prog_fd, err, ret, i;
+ int prog_fd, xdp_fd, err, ret, i;
/* The test does not use the skb->data, so
* use pkt_v6 for both v6 and v4 test.
@@ -309,11 +691,16 @@ void test_fib_lookup(void)
.ctx_in = &skb,
.ctx_size_in = sizeof(skb),
);
+ LIBBPF_OPTS(bpf_test_run_opts, xdp_opts,
+ .data_in = &pkt_v6,
+ .data_size_in = sizeof(pkt_v6),
+ );
skel = fib_lookup__open_and_load();
if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
return;
prog_fd = bpf_program__fd(skel->progs.fib_lookup);
+ xdp_fd = bpf_program__fd(skel->progs.fib_lookup_xdp);
SYS(fail, "ip netns add %s", NS_TEST);
@@ -343,6 +730,15 @@ void test_fib_lookup(void)
if (!ASSERT_OK(err, "bpf_prog_test_run_opts"))
continue;
+ /* BPF_FIB_LOOKUP_VLAN is XDP-only; the tc helper rejects it.
+ * These cases are exercised on the XDP path below.
+ */
+ if (tests[i].lookup_flags & BPF_FIB_LOOKUP_VLAN) {
+ ASSERT_EQ(skel->bss->fib_lookup_ret, -EINVAL,
+ "tc rejects BPF_FIB_LOOKUP_VLAN");
+ continue;
+ }
+
ASSERT_EQ(skel->bss->fib_lookup_ret, tests[i].expected_ret,
"fib_lookup_ret");
@@ -352,6 +748,21 @@ void test_fib_lookup(void)
if (tests[i].expected_dst)
assert_dst_ip(fib_params, tests[i].expected_dst);
+ if (tests[i].expected_dev)
+ ASSERT_EQ(fib_params->ifindex,
+ if_nametoindex(tests[i].expected_dev), "ifindex");
+
+ if (tests[i].expected_mtu)
+ ASSERT_EQ(fib_params->mtu_result, tests[i].expected_mtu,
+ "mtu_result");
+
+ if (tests[i].check_vlan) {
+ ASSERT_EQ(fib_params->h_vlan_proto,
+ htons(tests[i].vlan_proto), "h_vlan_proto");
+ ASSERT_EQ(fib_params->h_vlan_TCI,
+ htons(tests[i].vlan_id), "h_vlan_TCI");
+ }
+
ret = memcmp(tests[i].dmac, fib_params->dmac, sizeof(tests[i].dmac));
if (!ASSERT_EQ(ret, 0, "dmac not match")) {
char expected[18], actual[18];
@@ -361,15 +772,313 @@ void test_fib_lookup(void)
printf("dmac expected %s actual %s ", expected, actual);
}
- // ensure tbid is zero'd out after fib lookup.
- if (tests[i].lookup_flags & BPF_FIB_LOOKUP_DIRECT) {
+ /*
+ * ensure tbid is zero'd out after fib lookup. With
+ * BPF_FIB_LOOKUP_VLAN the union holds the packed vlan
+ * fields instead, so skip the check for those.
+ */
+ if ((tests[i].lookup_flags & BPF_FIB_LOOKUP_DIRECT) &&
+ !(tests[i].lookup_flags & BPF_FIB_LOOKUP_VLAN)) {
if (!ASSERT_EQ(skel->bss->fib_params.tbid, 0,
"expected fib_params.tbid to be zero"))
goto fail;
}
}
+ /*
+ * Re-run the cases through bpf_xdp_fib_lookup(). test_run uses the
+ * current netns' loopback for ctx->rxq->dev, so dev_net() is NS_TEST
+ * and the lookup runs against its FIB. The path-independent results
+ * (return code, swapped ifindex, vlan tag, gateway) must match the skb
+ * path; the no-tot_len mtu_result is skb-specific and not rechecked.
+ */
+ for (i = 0; i < ARRAY_SIZE(tests); i++) {
+ if (set_lookup_params(fib_params, &tests[i], skb.ifindex))
+ continue;
+
+ skel->bss->fib_lookup_ret = -1;
+ skel->bss->lookup_flags = tests[i].lookup_flags;
+
+ err = bpf_prog_test_run_opts(xdp_fd, &xdp_opts);
+ if (!ASSERT_OK(err, "xdp test_run"))
+ continue;
+
+ if (!ASSERT_EQ(skel->bss->fib_lookup_ret, tests[i].expected_ret,
+ "xdp fib_lookup_ret"))
+ printf("(xdp) %s\n", tests[i].desc);
+
+ if (tests[i].expected_dev)
+ ASSERT_EQ(fib_params->ifindex,
+ if_nametoindex(tests[i].expected_dev),
+ "xdp ifindex");
+
+ if (tests[i].expected_dst)
+ assert_dst_ip(fib_params, tests[i].expected_dst);
+
+ if (tests[i].check_vlan) {
+ ASSERT_EQ(fib_params->h_vlan_proto,
+ htons(tests[i].vlan_proto), "xdp h_vlan_proto");
+ ASSERT_EQ(fib_params->h_vlan_TCI,
+ htons(tests[i].vlan_id), "xdp h_vlan_TCI");
+ }
+
+ ret = memcmp(tests[i].dmac, fib_params->dmac, sizeof(tests[i].dmac));
+ ASSERT_EQ(ret, 0, "xdp dmac");
+
+ /*
+ * mtu_result from a tot_len lookup is the route mtu and is
+ * path-independent; the no-tot_len arm reads dev->mtu and is
+ * skb-only, so gate on tot_len
+ */
+ if (tests[i].expected_mtu && tests[i].tot_len)
+ ASSERT_EQ(fib_params->mtu_result, tests[i].expected_mtu,
+ "xdp mtu_result");
+ }
+
+fail:
+ if (nstoken)
+ close_netns(nstoken);
+ SYS_NOFAIL("ip netns del " NS_TEST);
+ fib_lookup__destroy(skel);
+}
+
+#define NS_VLAN_A "fib_lookup_vlan_ns_a"
+#define NS_VLAN_B "fib_lookup_vlan_ns_b"
+
+/*
+ * A VLAN device can be moved to another netns while staying registered
+ * on its parent. Neither direction may then cross the boundary: the
+ * egress flag must not publish the foreign parent's ifindex, and the
+ * input flag must fail closed rather than use a foreign ingress.
+ */
+void test_fib_lookup_vlan_netns(void)
+{
+ struct bpf_fib_lookup *fib_params;
+ struct nstoken *nstoken = NULL;
+ struct __sk_buff skb = { };
+ struct fib_lookup *skel = NULL;
+ int prog_fd, xdp_fd, err, parent_idx, vlan_idx;
+
+ LIBBPF_OPTS(bpf_test_run_opts, run_opts,
+ .data_in = &pkt_v6,
+ .data_size_in = sizeof(pkt_v6),
+ .ctx_in = &skb,
+ .ctx_size_in = sizeof(skb),
+ );
+ LIBBPF_OPTS(bpf_test_run_opts, xdp_opts,
+ .data_in = &pkt_v6,
+ .data_size_in = sizeof(pkt_v6),
+ );
+
+ skel = fib_lookup__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
+ return;
+ prog_fd = bpf_program__fd(skel->progs.fib_lookup);
+ xdp_fd = bpf_program__fd(skel->progs.fib_lookup_xdp);
+ fib_params = &skel->bss->fib_params;
+
+ SYS(fail, "ip netns add %s", NS_VLAN_A);
+ SYS(fail, "ip netns add %s", NS_VLAN_B);
+
+ nstoken = open_netns(NS_VLAN_A);
+ if (!ASSERT_OK_PTR(nstoken, "open_netns(a)"))
+ goto fail;
+
+ SYS(fail, "ip link add veth7 type veth peer name veth8");
+ SYS(fail, "ip link set dev veth7 up");
+ SYS(fail, "ip link add link veth7 name veth7.66 type vlan id 66");
+ SYS(fail, "ip link set veth7.66 netns %s", NS_VLAN_B);
+
+ parent_idx = if_nametoindex("veth7");
+ if (!ASSERT_NEQ(parent_idx, 0, "if_nametoindex(veth7)"))
+ goto fail;
+
+ /*
+ * input: the moved device is still in veth7's VLAN group, but it
+ * lives in another netns, so the lookup must fail closed
+ */
+ skb.ifindex = parent_idx;
+ memset(fib_params, 0, sizeof(*fib_params));
+ fib_params->family = AF_INET;
+ fib_params->l4_protocol = IPPROTO_TCP;
+ fib_params->ifindex = parent_idx;
+ fib_params->h_vlan_proto = htons(ETH_P_8021Q);
+ fib_params->h_vlan_TCI = htons(66);
+ if (!ASSERT_EQ(inet_pton(AF_INET, "10.66.0.2", &fib_params->ipv4_dst),
+ 1, "inet_pton(dst)"))
+ goto fail;
+
+ skel->bss->fib_lookup_ret = -1;
+ skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN_INPUT |
+ BPF_FIB_LOOKUP_SKIP_NEIGH;
+ err = bpf_prog_test_run_opts(prog_fd, &run_opts);
+ if (!ASSERT_OK(err, "test_run(input)"))
+ goto fail;
+ ASSERT_EQ(skel->bss->fib_lookup_ret, BPF_FIB_LKUP_RET_NOT_FWDED,
+ "input across netns fails closed");
+ ASSERT_EQ(fib_params->ifindex, parent_idx, "ifindex untouched");
+ ASSERT_EQ(fib_params->h_vlan_TCI, htons(66), "tag untouched");
+
+ close_netns(nstoken);
+ nstoken = open_netns(NS_VLAN_B);
+ if (!ASSERT_OK_PTR(nstoken, "open_netns(b)"))
+ goto fail;
+
+ /*
+ * egress: the fib result is the VLAN device here, but its parent
+ * is in the other netns, so the swap must not happen
+ */
+ SYS(fail, "ip link set dev veth7.66 up");
+ SYS(fail, "ip addr add 10.66.0.1/24 dev veth7.66");
+ err = write_sysctl("/proc/sys/net/ipv4/conf/veth7.66/forwarding", "1");
+ if (!ASSERT_OK(err, "write_sysctl(forwarding)"))
+ goto fail;
+
+ vlan_idx = if_nametoindex("veth7.66");
+ if (!ASSERT_NEQ(vlan_idx, 0, "if_nametoindex(veth7.66)"))
+ goto fail;
+
+ skb.ifindex = vlan_idx;
+ memset(fib_params, 0, sizeof(*fib_params));
+ fib_params->family = AF_INET;
+ fib_params->l4_protocol = IPPROTO_TCP;
+ fib_params->ifindex = vlan_idx;
+ if (!ASSERT_EQ(inet_pton(AF_INET, "10.66.0.2", &fib_params->ipv4_dst),
+ 1, "inet_pton(dst)") ||
+ !ASSERT_EQ(inet_pton(AF_INET, "10.66.0.1", &fib_params->ipv4_src),
+ 1, "inet_pton(src)"))
+ goto fail;
+
+ skel->bss->fib_lookup_ret = -1;
+ skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN |
+ BPF_FIB_LOOKUP_SKIP_NEIGH;
+ err = bpf_prog_test_run_opts(xdp_fd, &xdp_opts);
+ if (!ASSERT_OK(err, "test_run(egress)"))
+ goto fail;
+ ASSERT_EQ(skel->bss->fib_lookup_ret, BPF_FIB_LKUP_RET_VLAN_FAILURE,
+ "egress returns VLAN_FAILURE");
+ ASSERT_EQ(fib_params->ifindex, vlan_idx,
+ "foreign parent not published");
+ ASSERT_EQ(fib_params->h_vlan_TCI, 0, "vlan fields zero");
+
+fail:
+ if (nstoken)
+ close_netns(nstoken);
+ SYS_NOFAIL("ip netns del " NS_VLAN_A);
+ SYS_NOFAIL("ip netns del " NS_VLAN_B);
+ fib_lookup__destroy(skel);
+}
+
+#define REDIRECT_NPKTS 1000
+
+/*
+ * The egress flag exists so an XDP program can redirect to the physical
+ * parent. A redirect that lands on a VLAN device is dropped at
+ * xdp_do_flush(), because a VLAN device has no ndo_xdp_xmit. Drive real
+ * frames with BPF_F_TEST_XDP_LIVE_FRAMES, which runs the native
+ * xdp_do_redirect() + xdp_do_flush() path: a reducible VLAN egress
+ * resolves to veth1 and is delivered to its peer veth2, while a QinQ
+ * egress returns VLAN_FAILURE and is passed to the stack instead of
+ * redirected to a device that would silently drop it.
+ */
+void test_fib_lookup_vlan_redirect(void)
+{
+ int redirect_fd, err, veth1_idx, veth2_idx = -1;
+ struct bpf_fib_lookup *fib_params;
+ struct nstoken *nstoken = NULL;
+ struct fib_lookup *skel = NULL;
+ bool xdp_attached = false;
+
+ LIBBPF_OPTS(bpf_test_run_opts, lf_opts,
+ .data_in = &pkt_v4,
+ .data_size_in = sizeof(pkt_v4),
+ .flags = BPF_F_TEST_XDP_LIVE_FRAMES,
+ .repeat = REDIRECT_NPKTS,
+ );
+
+ skel = fib_lookup__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
+ return;
+ redirect_fd = bpf_program__fd(skel->progs.fib_lookup_redirect);
+ fib_params = &skel->bss->fib_params;
+
+ SYS(fail, "ip netns add %s", NS_TEST);
+ nstoken = open_netns(NS_TEST);
+ if (!ASSERT_OK_PTR(nstoken, "open_netns"))
+ goto fail;
+ if (setup_netns())
+ goto fail;
+
+ veth1_idx = if_nametoindex("veth1");
+ veth2_idx = if_nametoindex("veth2");
+ if (!ASSERT_NEQ(veth1_idx, 0, "if_nametoindex(veth1)") ||
+ !ASSERT_NEQ(veth2_idx, 0, "if_nametoindex(veth2)"))
+ goto fail;
+
+ /*
+ * A redirect to veth1 is delivered to its peer veth2. veth_xdp_xmit()
+ * only accepts the frame if veth2's NAPI is up, which on veth means
+ * veth2 carries an XDP program; xdp_count tallies what arrives.
+ */
+ err = bpf_xdp_attach(veth2_idx, bpf_program__fd(skel->progs.xdp_count),
+ XDP_FLAGS_DRV_MODE, NULL);
+ if (!ASSERT_OK(err, "attach xdp_count on veth2"))
+ goto fail;
+ xdp_attached = true;
+
+ /* reducible VLAN egress: resolves to the physical parent veth1 */
+ memset(fib_params, 0, sizeof(*fib_params));
+ fib_params->family = AF_INET;
+ fib_params->l4_protocol = IPPROTO_TCP;
+ fib_params->ifindex = veth1_idx;
+ if (!ASSERT_EQ(inet_pton(AF_INET, IPV4_IFACE_ADDR, &fib_params->ipv4_src),
+ 1, "inet_pton(src)") ||
+ !ASSERT_EQ(inet_pton(AF_INET, IPV4_VLAN_EGRESS_DST, &fib_params->ipv4_dst),
+ 1, "inet_pton(reducible dst)"))
+ goto fail;
+ skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH;
+ skel->bss->redirected = 0;
+ skel->bss->passed = 0;
+ skel->bss->delivered = 0;
+
+ err = bpf_prog_test_run_opts(redirect_fd, &lf_opts);
+ if (!ASSERT_OK(err, "test_run(reducible egress)"))
+ goto fail;
+ ASSERT_EQ(skel->bss->redirected, REDIRECT_NPKTS, "reducible egress redirected");
+ ASSERT_EQ(skel->bss->passed, 0, "reducible egress not passed");
+ ASSERT_GT(skel->bss->delivered, 0, "reducible egress delivered to veth2");
+
+ /*
+ * QinQ egress: not reducible, so the lookup returns VLAN_FAILURE and
+ * the program passes the frame instead of redirecting to the inner
+ * VLAN device. redirected == 0 is the assertion that matters: the
+ * program did not redirect to a device that would drop the frame at
+ * xdp_do_flush(). veth2's delivered count is not checked here, since
+ * a passed frame can still reach veth2 through the stack's forwarding
+ * path, which is unrelated to the redirect under test.
+ */
+ memset(fib_params, 0, sizeof(*fib_params));
+ fib_params->family = AF_INET;
+ fib_params->l4_protocol = IPPROTO_TCP;
+ fib_params->ifindex = veth1_idx;
+ if (!ASSERT_EQ(inet_pton(AF_INET, IPV4_IFACE_ADDR, &fib_params->ipv4_src),
+ 1, "inet_pton(src)") ||
+ !ASSERT_EQ(inet_pton(AF_INET, IPV4_QINQ_DST, &fib_params->ipv4_dst),
+ 1, "inet_pton(qinq dst)"))
+ goto fail;
+ skel->bss->lookup_flags = BPF_FIB_LOOKUP_VLAN | BPF_FIB_LOOKUP_SKIP_NEIGH;
+ skel->bss->redirected = 0;
+ skel->bss->passed = 0;
+
+ err = bpf_prog_test_run_opts(redirect_fd, &lf_opts);
+ if (!ASSERT_OK(err, "test_run(qinq egress)"))
+ goto fail;
+ ASSERT_EQ(skel->bss->passed, REDIRECT_NPKTS, "qinq egress passed");
+ ASSERT_EQ(skel->bss->redirected, 0, "qinq egress not redirected");
+
fail:
+ if (xdp_attached)
+ bpf_xdp_detach(veth2_idx, XDP_FLAGS_DRV_MODE, NULL);
if (nstoken)
close_netns(nstoken);
SYS_NOFAIL("ip netns del " NS_TEST);
diff --git a/tools/testing/selftests/bpf/progs/fib_lookup.c b/tools/testing/selftests/bpf/progs/fib_lookup.c
index 7b5dd2214ff46a..862a1e9457b4e0 100644
--- a/tools/testing/selftests/bpf/progs/fib_lookup.c
+++ b/tools/testing/selftests/bpf/progs/fib_lookup.c
@@ -19,4 +19,40 @@ int fib_lookup(struct __sk_buff *skb)
return TC_ACT_SHOT;
}
+SEC("xdp")
+int fib_lookup_xdp(struct xdp_md *ctx)
+{
+ fib_lookup_ret = bpf_fib_lookup(ctx, &fib_params, sizeof(fib_params),
+ lookup_flags);
+
+ return XDP_DROP;
+}
+
+int redirected = 0;
+int passed = 0;
+int delivered = 0;
+
+SEC("xdp")
+int fib_lookup_redirect(struct xdp_md *ctx)
+{
+ struct bpf_fib_lookup params = fib_params;
+ long ret;
+
+ ret = bpf_fib_lookup(ctx, ¶ms, sizeof(params), lookup_flags);
+ if (ret == BPF_FIB_LKUP_RET_SUCCESS) {
+ redirected++;
+ return bpf_redirect(params.ifindex, 0);
+ }
+
+ passed++;
+ return XDP_PASS;
+}
+
+SEC("xdp")
+int xdp_count(struct xdp_md *ctx)
+{
+ delivered++;
+ return XDP_DROP;
+}
+
char _license[] SEC("license") = "GPL";
|
| 3/2 | 2026/06/24 03:25 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 23212 output: 38 thoughts: 776 Thoughts: **BPF FIB Lookup VLAN Patch Analysis and Fuzzing Strategy**
Okay, so I'm looking at this patch that adds VLAN support to the `bpf_fib_lookup` functionality. My initial assessment is that this is a significant change, touching several key areas. Specifically, the patch has touched `include/uapi/linux/bpf.h`, `net/core/filter.c`, `tools/include/uapi/linux/bpf.h`, and the BPF selftests.
The core of this modification seems to reside in `net/core/filter.c`. I see new functions: `bpf_fib_set_fwd_params` and `bpf_fib_vlan_input_dev`. It also looks like the existing lookup functions, `bpf_ipv4_fib_lookup`, `bpf_ipv6_fib_lookup`, `bpf_xdp_fib_lookup`, and `bpf_skb_fib_lookup` have been updated. The update includes checks for `BPF_FIB_LOOKUP_VLAN` and `BPF_FIB_LOOKUP_VLAN_INPUT` flags, and that's the area I need to pay the most attention to when generating a fuzzing test plan.
I need to focus my fuzzing efforts on those core lookup functions: `bpf_ipv4_fib_lookup`, `bpf_ipv6_fib_lookup`, `bpf_xdp_fib_lookup`, and `bpf_skb_fib_lookup`. I'll consider the static functions `bpf_fib_set_fwd_params` and `bpf_fib_vlan_input_dev` to be covered as part of fuzzing the lookup functions, as I'm assuming there's no way to call them independently (unless I miss something during my review).
Let's look at the configuration dependencies. I see `CONFIG_VLAN_8021Q` is used within `bpf_fib_set_fwd_params` under a conditional.
```c
#if IS_ENABLED(CONFIG_VLAN_8021Q)
if ((flags & BPF_FIB_LOOKUP_VLAN) && is_vlan_dev(dev)) {
```
So, to fully exercise `BPF_FIB_LOOKUP_VLAN`, I'll *definitely* need to ensure `CONFIG_VLAN_8021Q` is enabled during testing. I'll also have to be careful when crafting the fuzzing input to correctly set the appropriate flags to hit that code path. The usual suspects, `CONFIG_INET` and `CONFIG_IPV6` are also in use.
I’ll double-check this again with a `grepper` pass to see if there are any other configuration dependencies. My fuzzing test plan will need to reflect the necessary configuration dependencies so I am as thorough as possible.
|
| 4/2 | 2026/06/24 03:26 | tool | grepper |
0mArgs:{
"Expression": "bpf_fib_set_fwd_params",
"PathPrefix": "net/core/filter.c"
}Results: {
"Output": "net/core/filter.c=6191=static const struct bpf_func_proto bpf_skb_get_xfrm_state_proto = {\n--\nnet/core/filter.c-6203-#if IS_ENABLED(CONFIG_INET) || IS_ENABLED(CONFIG_IPV6)\nnet/core/filter.c:6204:static int bpf_fib_set_fwd_params(struct net_device *dev,\nnet/core/filter.c-6205-\t\t\t\t struct bpf_fib_lookup *params,\n--\nnet/core/filter.c=6254=static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n--\nnet/core/filter.c-6400-set_fwd_params:\nnet/core/filter.c:6401:\treturn bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);\nnet/core/filter.c-6402-}\n--\nnet/core/filter.c=6406=static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n--\nnet/core/filter.c-6553-set_fwd_params:\nnet/core/filter.c:6554:\treturn bpf_fib_set_fwd_params(dev, params, flags, mtu, in_ifindex);\nnet/core/filter.c-6555-}\n"
} |
| 5/2 | 2026/06/24 03:26 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25063 output: 38 thoughts: 14 Thoughts: Okay, here's my interpretation of that thought process, summarized as you requested: **Deconstructing bpf_fib_vlan_input_dev: A Deep Dive** Alright, let's break this down. My mind immediately goes to the potential impact of `bpf_fib_vlan_input_dev`. We're talking about a BPF hook, presumably within the context of a forwarding Information Base (FIB) lookup, and it's specifically dealing with VLAN ingress processing. "Input dev" strongly suggests it's involved in handling the ingress interface or device. I'm starting to think about the implications for network performance. This BPF hook likely allows for in-kernel traffic steering based on VLAN information *before* the standard routing process. This is powerful. My immediate questions are: * How is this integrated with the underlying FIB structure? Is it pre-lookup filtering or something more complex? * What's the performance overhead? Does this add significant latency compared to pure hardware forwarding? * What's the interaction with other BPF programs? Could it be chained with existing eBPF filters for increased flexibility? * How is VLAN information extracted (e.g., from the header, specific metadata)? And, how does this interact with the network stack's handling of VLAN tagged frames? I also wonder about the use cases here. It probably enables VLAN-aware traffic engineering, policy enforcement, or even more advanced scenarios. I'm imagining scenarios involving specific VLANs, perhaps on a service provider edge, being routed differently based on some condition. This could be useful in virtualized environments with a lot of tenant networks. I'm intrigued. I'm going to have to dive into the kernel source and the relevant documentation to get a handle on the actual implementation details and explore how this fits into my overall network design strategies. |
| 6/2 | 2026/06/24 03:26 | tool | grepper |
0mArgs:{
"Expression": "bpf_fib_vlan_input_dev",
"PathPrefix": "net/core/filter.c"
}Results: {
"Output": "net/core/filter.c=6204=static int bpf_fib_set_fwd_params(struct net_device *dev,\n--\nnet/core/filter.c-6232-\nnet/core/filter.c:6233:static struct net_device *bpf_fib_vlan_input_dev(struct net_device *dev,\nnet/core/filter.c-6234-\t\t\t\t\t\t const struct bpf_fib_lookup *params)\n--\nnet/core/filter.c=6254=static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n--\nnet/core/filter.c-6271-\tif (flags \u0026 BPF_FIB_LOOKUP_VLAN_INPUT) {\nnet/core/filter.c:6272:\t\tdev = bpf_fib_vlan_input_dev(dev, params);\nnet/core/filter.c-6273-\t\tif (IS_ERR(dev))\n--\nnet/core/filter.c=6406=static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n--\nnet/core/filter.c-6429-\tif (flags \u0026 BPF_FIB_LOOKUP_VLAN_INPUT) {\nnet/core/filter.c:6430:\t\tdev = bpf_fib_vlan_input_dev(dev, params);\nnet/core/filter.c-6431-\t\tif (IS_ERR(dev))\n"
} |
| 7/2 | 2026/06/24 03:26 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25907 output: 225 thoughts: 455 Thoughts: **Fuzzing the BPF FIB Lookup Helper with VLAN Support** Okay, so this patch introduces some functional changes to the BPF FIB lookup helper, specifically adding VLAN handling. Right away, this screams "fuzzing target." The core of routing logic in BPF is being modified, and that's always a potential area for vulnerabilities, especially since userspace BPF programs can now influence the VLAN resolution process through XDP or TC. We need to be thorough. My initial focus needs to be on these functions: `bpf_ipv4_fib_lookup`, `bpf_ipv6_fib_lookup`, `bpf_xdp_fib_lookup`, `bpf_skb_fib_lookup`, `bpf_fib_set_fwd_params`, and `bpf_fib_vlan_input_dev`. These are the key entry points and supporting functions that likely contain the new VLAN-related logic. I need to make sure `VLAN_8021Q` is enabled in the configuration to exercise the changes, but let's quickly verify that the standard networking config options like `CONFIG_INET`, `CONFIG_IPV6`, `CONFIG_BPF_SYSCALL`, and `CONFIG_NET` are enabled. Good. I'm thinking about the rationale behind this patch. The patch is adding VLAN support through the `BPF_FIB_LOOKUP_VLAN` and `BPF_FIB_LOOKUP_VLAN_INPUT` flags to `bpf_fib_lookup`. This is core, so fuzzing is *essential* to make sure nothing goes wrong with this new resolution. And as I re-review my focus symbols, I'm just quickly confirming that `bpf_fib_vlan_input_dev` and `bpf_fib_set_fwd_params` are indeed included. They are static, but not inline, so they're valid targets. Right, I'm ready to set up the fuzzing environment and get to work. Let's start with the base configuration and build from there. |
| 8/2 | 2026/06/24 03:26 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"VLAN_8021Q"
],
"FocusSymbols": [
"bpf_ipv4_fib_lookup",
"bpf_ipv6_fib_lookup",
"bpf_xdp_fib_lookup",
"bpf_skb_fib_lookup",
"bpf_fib_set_fwd_params",
"bpf_fib_vlan_input_dev"
],
"Reasoning": "The patch introduces functional changes to the BPF FIB lookup helper (`bpf_fib_lookup`), adding support for VLANs via `BPF_FIB_LOOKUP_VLAN` and `BPF_FIB_LOOKUP_VLAN_INPUT` flags. This modifies core routing lookup logic within BPF programs, which is reachable from userspace by loading and executing BPF programs (XDP or TC). Fuzzing is required to ensure the new VLAN resolution logic and its interaction with the networking stack is robust.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"VLAN_8021Q"
],
"FocusSymbols": [
"bpf_ipv4_fib_lookup",
"bpf_ipv6_fib_lookup",
"bpf_xdp_fib_lookup",
"bpf_skb_fib_lookup",
"bpf_fib_set_fwd_params",
"bpf_fib_vlan_input_dev"
],
"Reasoning": "The patch introduces functional changes to the BPF FIB lookup helper (`bpf_fib_lookup`), adding support for VLANs via `BPF_FIB_LOOKUP_VLAN` and `BPF_FIB_LOOKUP_VLAN_INPUT` flags. This modifies core routing lookup logic within BPF programs, which is reachable from userspace by loading and executing BPF programs (XDP or TC). Fuzzing is required to ensure the new VLAN resolution logic and its interaction with the networking stack is robust.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|