[PATCH bpf-next] selftests/bpf: Fix fib_lookup VLAN tests on hosts with forwarding on

[Avinash Duduskar <avinash.duduskar@gmail.com>]

The VLAN tests assume the test namespace starts with IPv4 forwarding off,
but a new netns copies conf/all and conf/default from init_net
(devinet_init_net(), with net.core.devconf_inherit_init_net at its
default), so on a host with net.ipv4.conf.all.forwarding=1 the devices in
the netns come up with forwarding already enabled. IPv6 uses compiled
defaults at the same sysctl value, so only the IPv4 arms are affected.

Two arms break as a result.

The arms that expect BPF_FIB_LKUP_RET_FWD_DISABLED see the lookup pass the
forwarding check and return SUCCESS instead, so fib_lookup fails:

  test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 0 != expected 5

Pin forwarding off in setup_netns() before the devices are created; the
existing per-device writes still enable it where the tests need it.

The netns arm has the opposite problem. It checks that a VLAN device in
another netns is not resolved and expects NOT_FWDED. The lookup runs
against the caller's FIB, which had no route to the destination, so a
kernel that resolved the moved device anyway also returned NOT_FWDED and
the arm passed regardless of the namespace check. On a forwarding-on host,
where the resolved device clears the forwarding gate, this makes the arm a
tautology. Add a route so a resolved device returns SUCCESS and the arm
can tell the two apart.

Verified by deleting the netns check from bpf_fib_vlan_input_dev(): with
the fix the arm fails on both a forwarding-off host (actual 5) and a
forwarding-on host (actual 0), where before it passed on the latter. The
real kernel passes the full suite on both.

Fixes: e54a87872e34 ("selftests/bpf: Add bpf_fib_lookup() VLAN flag tests")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260713163826.D70201F000E9@smtp.kernel.org/
Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com>
---
 .../selftests/bpf/prog_tests/fib_lookup.c     | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index f7361f9a3459..8f4779dd802e 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -419,6 +419,19 @@ static int setup_netns(void)
 {
 	int err;
 
+	/*
+	 * a new netns copies the IPv4 conf from init_net, so on a host with
+	 * forwarding enabled the arms that expect FWD_DISABLED would see the
+	 * lookup succeed instead; pin it off here and enable it per device
+	 */
+	err = write_sysctl("/proc/sys/net/ipv4/conf/all/forwarding", "0");
+	if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf.all.forwarding)"))
+		goto fail;
+
+	err = write_sysctl("/proc/sys/net/ipv4/conf/default/forwarding", "0");
+	if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf.default.forwarding)"))
+		goto fail;
+
 	SYS(fail, "ip link add veth1 type veth peer name veth2");
 	SYS(fail, "ip link set dev veth1 up");
 	SYS(fail, "ip link set dev veth2 up");
@@ -897,6 +910,14 @@ void test_fib_lookup_vlan_netns(void)
 	if (!ASSERT_NEQ(parent_idx, 0, "if_nametoindex(veth7)"))
 		goto fail;
 
+	/*
+	 * give this netns a route to the destination: the lookup below runs
+	 * against this FIB, so without the route a kernel that resolved the
+	 * moved device anyway would still return NOT_FWDED and the arm would
+	 * pass for the wrong reason
+	 */
+	SYS(fail, "ip route add %s/32 dev veth7", IPV4_VLAN_NETNS_DST);
+
 	/*
 	 * input: the moved device is still in veth7's VLAN group, but it
 	 * lives in another netns, so the lookup must fail closed

base-commit: c314bcaa9d5dc34b0c643eac85f675fb8c8bfbaa
-- 
2.54.0