* [RFC PATCH bpf-next 1/9] selftests/bpf: fib_lookup: Force specific interface indexes
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
@ 2026-02-26 7:59 ` Ido Schimmel
2026-02-26 7:59 ` [RFC PATCH bpf-next 2/9] selftests/bpf: fib_lookup: Enable forwarding on second net device Ido Schimmel
` (8 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 7:59 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
Subsequent patches will add tests for output routes (i.e.,
BPF_FIB_LOOKUP_OUTPUT). In these tests, the bpf_fib_lookup() helper will
be called with different interface indexes to make sure it is resolving
the correct route. Make it easier to add such tests by predetermining
the interface indexes.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index bd7658958004..77f65ff7784a 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -41,6 +41,8 @@
#define DMAC_INIT { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, }
#define DMAC2 "01:01:01:01:01:01"
#define DMAC_INIT2 { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, }
+#define IFINDEX_VETH1 10010
+#define IFINDEX_VETH2 10020
struct fib_lookup_test {
const char *desc;
@@ -148,7 +150,8 @@ static int setup_netns(void)
{
int err;
- SYS(fail, "ip link add veth1 type veth peer name veth2");
+ SYS(fail, "ip link add veth1 index %d type veth peer name veth2 index %d",
+ IFINDEX_VETH1, IFINDEX_VETH2);
SYS(fail, "ip link set dev veth1 up");
SYS(fail, "ip link set dev veth2 up");
@@ -324,10 +327,7 @@ void test_fib_lookup(void)
if (setup_netns())
goto fail;
- skb.ifindex = if_nametoindex("veth1");
- if (!ASSERT_NEQ(skb.ifindex, 0, "if_nametoindex(veth1)"))
- goto fail;
-
+ skb.ifindex = IFINDEX_VETH1;
fib_params = &skel->bss->fib_params;
for (i = 0; i < ARRAY_SIZE(tests); i++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [RFC PATCH bpf-next 2/9] selftests/bpf: fib_lookup: Enable forwarding on second net device
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
2026-02-26 7:59 ` [RFC PATCH bpf-next 1/9] selftests/bpf: fib_lookup: Force specific interface indexes Ido Schimmel
@ 2026-02-26 7:59 ` Ido Schimmel
2026-02-26 7:59 ` [RFC PATCH bpf-next 3/9] selftests/bpf: fib_lookup: Allow parametrizing ifindex Ido Schimmel
` (7 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 7:59 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
Currently, the bpf_fib_lookup() helper is only called with the ifindex
of veth1. In preparation for calling the bpf_fib_lookup() helper with
the ifindex of veth2, enable forwarding on this device.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 77f65ff7784a..14a6515a453d 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -193,10 +193,18 @@ static int setup_netns(void)
if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf.veth1.forwarding)"))
goto fail;
+ err = write_sysctl("/proc/sys/net/ipv4/conf/veth2/forwarding", "1");
+ if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf.veth2.forwarding)"))
+ goto fail;
+
err = write_sysctl("/proc/sys/net/ipv6/conf/veth1/forwarding", "1");
if (!ASSERT_OK(err, "write_sysctl(net.ipv6.conf.veth1.forwarding)"))
goto fail;
+ err = write_sysctl("/proc/sys/net/ipv6/conf/veth2/forwarding", "1");
+ if (!ASSERT_OK(err, "write_sysctl(net.ipv6.conf.veth2.forwarding)"))
+ goto fail;
+
/* Setup for policy routing tests */
SYS(fail, "ip addr add %s/24 dev veth1", IPV4_LOCAL);
SYS(fail, "ip addr add %s/64 dev veth1 nodad", IPV6_LOCAL);
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [RFC PATCH bpf-next 3/9] selftests/bpf: fib_lookup: Allow parametrizing ifindex
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
2026-02-26 7:59 ` [RFC PATCH bpf-next 1/9] selftests/bpf: fib_lookup: Force specific interface indexes Ido Schimmel
2026-02-26 7:59 ` [RFC PATCH bpf-next 2/9] selftests/bpf: fib_lookup: Enable forwarding on second net device Ido Schimmel
@ 2026-02-26 7:59 ` Ido Schimmel
2026-02-26 7:59 ` [RFC PATCH bpf-next 4/9] selftests/bpf: fib_lookup: Allow testing for expected ifindex Ido Schimmel
` (6 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 7:59 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
Currently, the ifindex passed to the bpf_fib_lookup() helper is always
that of veth1. In preparation for output route tests, allow test cases
to specify an alternative ifindex. Default to that of veth1 when ifindex
is not specified.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 14a6515a453d..cd306bd4819a 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -54,6 +54,7 @@ struct fib_lookup_test {
__u32 tbid;
__u8 dmac[6];
__u32 mark;
+ int ifindex;
};
static const struct fib_lookup_test tests[] = {
@@ -221,15 +222,14 @@ static int setup_netns(void)
}
static int set_lookup_params(struct bpf_fib_lookup *params,
- const struct fib_lookup_test *test,
- int ifindex)
+ const struct fib_lookup_test *test)
{
int ret;
memset(params, 0, sizeof(*params));
params->l4_protocol = IPPROTO_TCP;
- params->ifindex = ifindex;
+ params->ifindex = test->ifindex ? : IFINDEX_VETH1;
params->tbid = test->tbid;
params->mark = test->mark;
@@ -335,13 +335,12 @@ void test_fib_lookup(void)
if (setup_netns())
goto fail;
- skb.ifindex = IFINDEX_VETH1;
fib_params = &skel->bss->fib_params;
for (i = 0; i < ARRAY_SIZE(tests); i++) {
printf("Testing %s ", tests[i].desc);
- if (set_lookup_params(fib_params, &tests[i], skb.ifindex))
+ if (set_lookup_params(fib_params, &tests[i]))
continue;
skel->bss->fib_lookup_ret = -1;
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [RFC PATCH bpf-next 4/9] selftests/bpf: fib_lookup: Allow testing for expected ifindex
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
` (2 preceding siblings ...)
2026-02-26 7:59 ` [RFC PATCH bpf-next 3/9] selftests/bpf: fib_lookup: Allow parametrizing ifindex Ido Schimmel
@ 2026-02-26 7:59 ` Ido Schimmel
2026-02-26 7:59 ` [RFC PATCH bpf-next 5/9] selftests/bpf: fib_lookup: Add IPv4 output route tests Ido Schimmel
` (5 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 7:59 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
In preparation for output route tests, allow test cases to specify an
expected ifindex and verify that it matches the ifindex of the nexthop
device. Default to not verifying the ifindex.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index cd306bd4819a..0541fd982e63 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -55,6 +55,7 @@ struct fib_lookup_test {
__u8 dmac[6];
__u32 mark;
int ifindex;
+ int expected_ifindex;
};
static const struct fib_lookup_test tests[] = {
@@ -359,6 +360,10 @@ void test_fib_lookup(void)
if (tests[i].expected_dst)
assert_dst_ip(fib_params, tests[i].expected_dst);
+ if (tests[i].expected_ifindex)
+ ASSERT_EQ(fib_params->ifindex, tests[i].expected_ifindex,
+ "ifindex does not match");
+
ret = memcmp(tests[i].dmac, fib_params->dmac, sizeof(tests[i].dmac));
if (!ASSERT_EQ(ret, 0, "dmac not match")) {
char expected[18], actual[18];
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [RFC PATCH bpf-next 5/9] selftests/bpf: fib_lookup: Add IPv4 output route tests
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
` (3 preceding siblings ...)
2026-02-26 7:59 ` [RFC PATCH bpf-next 4/9] selftests/bpf: fib_lookup: Allow testing for expected ifindex Ido Schimmel
@ 2026-02-26 7:59 ` Ido Schimmel
2026-02-26 8:00 ` [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups Ido Schimmel
` (4 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 7:59 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
When the BPF_FIB_LOOKUP_OUTPUT flag is passed to the bpf_fib_lookup()
helper the expectation is that the helper will resolve the most specific
route whose nexthop device matches the specified ifindex. This is useful
when we already know the nexthop device, but need the helper to resolve
the destination MAC.
Add test cases to test this behavior. To that end, configure two
identical routes that differ in their metric and nexthop device and test
that the correct route is resolved each time.
Also test the scenario where a matching route for the destination
address exists, but with the wrong nexthop device. Expect the helper to
return an error.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
.../selftests/bpf/prog_tests/fib_lookup.c | 37 +++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 0541fd982e63..6ceeecbdca43 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -43,6 +43,8 @@
#define DMAC_INIT2 { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, }
#define IFINDEX_VETH1 10010
#define IFINDEX_VETH2 10020
+#define IPV4_OUTPUT_NET "192.0.2.0"
+#define IPV4_OUTPUT_DST "192.0.2.1"
struct fib_lookup_test {
const char *desc;
@@ -146,6 +148,35 @@ static const struct fib_lookup_test tests[] = {
.expected_dst = IPV6_GW1,
.lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
.mark = MARK, },
+ /* output routes */
+ { .desc = "IPv4 output route, without source, via first device",
+ .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+ .dmac = DMAC_INIT, .ifindex = IFINDEX_VETH1,
+ .expected_ifindex = IFINDEX_VETH1, },
+ { .desc = "IPv4 output route, without source, via second device",
+ .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+ .dmac = DMAC_INIT2, .ifindex = IFINDEX_VETH2,
+ .expected_ifindex = IFINDEX_VETH2, },
+ { .desc = "IPv4 output route, with source, via first device",
+ .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT,
+ .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+ { .desc = "IPv4 output route, with source, via second device",
+ .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT2,
+ .ifindex = IFINDEX_VETH2, .expected_ifindex = IFINDEX_VETH2, },
+ { .desc = "IPv4 output route, oif match",
+ .daddr = IPV4_NUD_STALE_ADDR,
+ .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+ { .desc = "IPv4 output route, oif mismatch",
+ .daddr = IPV4_NUD_STALE_ADDR,
+ .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .ifindex = IFINDEX_VETH2, },
};
static int setup_netns(void)
@@ -217,6 +248,12 @@ static int setup_netns(void)
SYS(fail, "ip rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
SYS(fail, "ip -6 rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
+ /* Setup for output route tests */
+ SYS(fail, "ip route add %s/24 dev veth1 metric 100", IPV4_OUTPUT_NET);
+ SYS(fail, "ip route add %s/24 dev veth2 metric 200", IPV4_OUTPUT_NET);
+ SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC);
+ SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC2);
+
return 0;
fail:
return -1;
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
` (4 preceding siblings ...)
2026-02-26 7:59 ` [RFC PATCH bpf-next 5/9] selftests/bpf: fib_lookup: Add IPv4 output route tests Ido Schimmel
@ 2026-02-26 8:00 ` Ido Schimmel
2026-02-26 8:41 ` bot+bpf-ci
2026-02-26 8:00 ` [RFC PATCH bpf-next 7/9] selftests/bpf: fib_lookup: Add IPv6 output route tests Ido Schimmel
` (3 subsequent siblings)
9 siblings, 1 reply; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 8:00 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
Currently, output route lookups behave differently between IPv4 and IPv6
when performed via the bpf_fib_lookup() helper with the
BPF_FIB_LOOKUP_OUTPUT flag.
IPv4 honors the oif and resolves the most specific route whose nexthop
device matches the oif. If no such route exists, an error is returned.
On the other hand, IPv6 simply resolves the most specific route, even if
its nexthop device does not match the specified oif.
Fix this by setting the RT6_LOOKUP_F_IFACE flag when performing an
output route lookup, so that a device mismatch will be considered a
fatal error.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
net/core/filter.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 0d5d5a17acb2..e92552b139b1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6255,6 +6255,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
if (flags & BPF_FIB_LOOKUP_OUTPUT) {
fl6.flowi6_iif = 1;
oif = fl6.flowi6_oif = params->ifindex;
+ strict = RT6_LOOKUP_F_IFACE;
} else {
oif = fl6.flowi6_iif = params->ifindex;
fl6.flowi6_oif = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups
2026-02-26 8:00 ` [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups Ido Schimmel
@ 2026-02-26 8:41 ` bot+bpf-ci
2026-02-26 15:31 ` David Ahern
0 siblings, 1 reply; 14+ messages in thread
From: bot+bpf-ci @ 2026-02-26 8:41 UTC (permalink / raw)
To: idosch, netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, idosch, ast, andrii,
daniel, martin.lau, eddyz87, yonghong.song, clm, ihor.solodrai
[-- Attachment #1: Type: text/plain, Size: 1309 bytes --]
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 0d5d5a17acb2..e92552b139b1 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -6255,6 +6255,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
> if (flags & BPF_FIB_LOOKUP_OUTPUT) {
> fl6.flowi6_iif = 1;
> oif = fl6.flowi6_oif = params->ifindex;
> + strict = RT6_LOOKUP_F_IFACE;
> } else {
The fix itself looks correct. Since this addresses a bug that has been
present since the original bpf_fib_lookup helper was introduced, should
this carry a Fixes tag?
Fixes: 87f5fc7e48dd ("bpf: Provide helper to do forwarding lookups in kernel FIB table")
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22433453774
AI-authorship-score: low
AI-authorship-explanation: Precise one-line kernel networking fix by a known kernel maintainer with deep routing subsystem expertise, characteristic of experienced human developers.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: Missing Fixes tag for a bug present since the original bpf_fib_lookup helper introduction; the code fix itself is correct.
^ permalink raw reply [flat|nested] 14+ messages in thread* Re: [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups
2026-02-26 8:41 ` bot+bpf-ci
@ 2026-02-26 15:31 ` David Ahern
0 siblings, 0 replies; 14+ messages in thread
From: David Ahern @ 2026-02-26 15:31 UTC (permalink / raw)
To: bot+bpf-ci, idosch, netdev, bpf
Cc: davem, kuba, pabeni, edumazet, petrm, horms, ast, daniel, andrii,
martin.lau, john.fastabend, sdf, martin.lau, eddyz87,
yonghong.song, clm, ihor.solodrai
On 2/26/26 1:41 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/net/core/filter.c b/net/core/filter.c
>> index 0d5d5a17acb2..e92552b139b1 100644
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -6255,6 +6255,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>> if (flags & BPF_FIB_LOOKUP_OUTPUT) {
>> fl6.flowi6_iif = 1;
>> oif = fl6.flowi6_oif = params->ifindex;
>> + strict = RT6_LOOKUP_F_IFACE;
>> } else {
>
> The fix itself looks correct. Since this addresses a bug that has been
> present since the original bpf_fib_lookup helper was introduced, should
> this carry a Fixes tag?
>
> Fixes: 87f5fc7e48dd ("bpf: Provide helper to do forwarding lookups in kernel FIB table")
+1. I would consider this a bug fix.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [RFC PATCH bpf-next 7/9] selftests/bpf: fib_lookup: Add IPv6 output route tests
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
` (5 preceding siblings ...)
2026-02-26 8:00 ` [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups Ido Schimmel
@ 2026-02-26 8:00 ` Ido Schimmel
2026-02-26 8:00 ` [RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses Ido Schimmel
` (2 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 8:00 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
In a similar fashion to the IPv4 output route tests, add equivalent IPv6
tests.
Output without "bpf: fib_lookup: Honor oif in IPv6 output route
lookups":
# ./test_progs -a fib_lookup
[...]
Testing IPv6 output route, without source, via second device test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
test_fib_lookup:PASS:fib_lookup_ret 0 nsec
test_fib_lookup:FAIL:ifindex does not match unexpected ifindex does not match: actual 10010 != expected 10020
[...]
Testing IPv6 output route, with source, via second device set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
test_fib_lookup:PASS:fib_lookup_ret 0 nsec
test_fib_lookup:FAIL:ifindex does not match unexpected ifindex does not match: actual 10010 != expected 10020
[...]
Testing IPv6 output route, oif mismatch set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 0 != expected 4
[...]
#119 fib_lookup:FAIL
Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
Output with "bpf: fib_lookup: Honor oif in IPv6 output route lookups":
# ./test_progs -a fib_lookup
#119 fib_lookup:OK
Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED
That is, without the specified patch, unlike IPv4, IPv6 would always
resolve the most specific route with the lowest metric, even if its
nexthop device does not match the specified oif.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
.../selftests/bpf/prog_tests/fib_lookup.c | 35 +++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 6ceeecbdca43..9e933daf56d7 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -45,6 +45,8 @@
#define IFINDEX_VETH2 10020
#define IPV4_OUTPUT_NET "192.0.2.0"
#define IPV4_OUTPUT_DST "192.0.2.1"
+#define IPV6_OUTPUT_NET "2001:db8:1::"
+#define IPV6_OUTPUT_DST "2001:db8:1::1"
struct fib_lookup_test {
const char *desc;
@@ -177,6 +179,34 @@ static const struct fib_lookup_test tests[] = {
.expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.ifindex = IFINDEX_VETH2, },
+ { .desc = "IPv6 output route, without source, via first device",
+ .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+ .dmac = DMAC_INIT, .ifindex = IFINDEX_VETH1,
+ .expected_ifindex = IFINDEX_VETH1, },
+ { .desc = "IPv6 output route, without source, via second device",
+ .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+ .dmac = DMAC_INIT2, .ifindex = IFINDEX_VETH2,
+ .expected_ifindex = IFINDEX_VETH2, },
+ { .desc = "IPv6 output route, with source, via first device",
+ .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT,
+ .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+ { .desc = "IPv6 output route, with source, via second device",
+ .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT2,
+ .ifindex = IFINDEX_VETH2, .expected_ifindex = IFINDEX_VETH2, },
+ { .desc = "IPv6 output route, oif match",
+ .daddr = IPV6_NUD_STALE_ADDR,
+ .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+ { .desc = "IPv6 output route, oif mismatch",
+ .daddr = IPV6_NUD_STALE_ADDR,
+ .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+ .ifindex = IFINDEX_VETH2, },
};
static int setup_netns(void)
@@ -254,6 +284,11 @@ static int setup_netns(void)
SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC);
SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC2);
+ SYS(fail, "ip route add %s/64 dev veth1 metric 100", IPV6_OUTPUT_NET);
+ SYS(fail, "ip route add %s/64 dev veth2 metric 200", IPV6_OUTPUT_NET);
+ SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC);
+ SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC2);
+
return 0;
fail:
return -1;
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
` (6 preceding siblings ...)
2026-02-26 8:00 ` [RFC PATCH bpf-next 7/9] selftests/bpf: fib_lookup: Add IPv6 output route tests Ido Schimmel
@ 2026-02-26 8:00 ` Ido Schimmel
2026-02-26 15:36 ` David Ahern
2026-02-26 8:00 ` [RFC PATCH bpf-next 9/9] selftests/bpf: fib_lookup: Add IPv6 link-local tests Ido Schimmel
2026-02-26 17:14 ` [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Alexei Starovoitov
9 siblings, 1 reply; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 8:00 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
Currently, the bpf_fib_lookup() helper returns an error when IPv6
link-local addresses are used. This is the correct behavior from input
perspective as such packets should not be forwarded, but the helper can
also be used to perform a lookup from output perspective (i.e., with
BPF_FIB_LOOKUP_OUTPUT). In this case, passing IPv6 link-local addresses
should be allowed and one legitimate use case is having the helper
resolve the destination MAC for such packets.
Therefore, relax the limitation and allow IPv6 link-local addresses when
the BPF_FIB_LOOKUP_OUTPUT flag is used.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
net/core/filter.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index e92552b139b1..8f0d2aeffc3d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6241,8 +6241,15 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
u32 mtu = 0;
/* link local addresses are never forwarded */
- if (rt6_need_strict(dst) || rt6_need_strict(src))
- return BPF_FIB_LKUP_RET_NOT_FWDED;
+ if (rt6_need_strict(dst) || rt6_need_strict(src)) {
+ int rej_type = IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK;
+
+ if (!(flags & BPF_FIB_LOOKUP_OUTPUT))
+ return BPF_FIB_LKUP_RET_NOT_FWDED;
+ if ((ipv6_addr_type(dst) & rej_type) ||
+ (ipv6_addr_type(src) & rej_type))
+ return BPF_FIB_LKUP_RET_NOT_FWDED;
+ }
dev = dev_get_by_index_rcu(net, params->ifindex);
if (unlikely(!dev))
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses
2026-02-26 8:00 ` [RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses Ido Schimmel
@ 2026-02-26 15:36 ` David Ahern
0 siblings, 0 replies; 14+ messages in thread
From: David Ahern @ 2026-02-26 15:36 UTC (permalink / raw)
To: Ido Schimmel, netdev, bpf
Cc: davem, kuba, pabeni, edumazet, petrm, horms, ast, daniel, andrii,
martin.lau, john.fastabend, sdf
On 2/26/26 1:00 AM, Ido Schimmel wrote:
> Currently, the bpf_fib_lookup() helper returns an error when IPv6
> link-local addresses are used. This is the correct behavior from input
> perspective as such packets should not be forwarded, but the helper can
> also be used to perform a lookup from output perspective (i.e., with
> BPF_FIB_LOOKUP_OUTPUT). In this case, passing IPv6 link-local addresses
> should be allowed and one legitimate use case is having the helper
> resolve the destination MAC for such packets.
>
> Therefore, relax the limitation and allow IPv6 link-local addresses when
> the BPF_FIB_LOOKUP_OUTPUT flag is used.
>
> Reviewed-by: Petr Machata <petrm@nvidia.com>
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
> net/core/filter.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/net/core/filter.c b/net/core/filter.c
> index e92552b139b1..8f0d2aeffc3d 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -6241,8 +6241,15 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
> u32 mtu = 0;
>
> /* link local addresses are never forwarded */
> - if (rt6_need_strict(dst) || rt6_need_strict(src))
> - return BPF_FIB_LKUP_RET_NOT_FWDED;
> + if (rt6_need_strict(dst) || rt6_need_strict(src)) {
> + int rej_type = IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK;
> +
> + if (!(flags & BPF_FIB_LOOKUP_OUTPUT))
> + return BPF_FIB_LKUP_RET_NOT_FWDED;
> + if ((ipv6_addr_type(dst) & rej_type) ||
> + (ipv6_addr_type(src) & rej_type))
> + return BPF_FIB_LKUP_RET_NOT_FWDED;
> + }
>
> dev = dev_get_by_index_rcu(net, params->ifindex);
> if (unlikely(!dev))
Reviewed-by: David Ahern <dsahern@kernel.org>
^ permalink raw reply [flat|nested] 14+ messages in thread
* [RFC PATCH bpf-next 9/9] selftests/bpf: fib_lookup: Add IPv6 link-local tests
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
` (7 preceding siblings ...)
2026-02-26 8:00 ` [RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses Ido Schimmel
@ 2026-02-26 8:00 ` Ido Schimmel
2026-02-26 17:14 ` [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Alexei Starovoitov
9 siblings, 0 replies; 14+ messages in thread
From: Ido Schimmel @ 2026-02-26 8:00 UTC (permalink / raw)
To: netdev, bpf
Cc: davem, kuba, pabeni, edumazet, dsahern, petrm, horms, ast, daniel,
andrii, martin.lau, john.fastabend, sdf, Ido Schimmel
Add tests that verify that bpf_fib_lookup() is able to resolve the
destination MAC for an IPv6 link-local address when specifying the
BPF_FIB_LOOKUP_OUTPUT flag.
Output without "bpf: fib_lookup: Allow output lookups for IPv6
link-local addresses":
# ./test_progs -a fib_lookup
[...]
Testing IPv6 output route, link-local, via first device set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 4 != expected 0
[...]
Testing IPv6 output route, link-local, via second device set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 4 != expected 0
[...]
#119 fib_lookup:FAIL
Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
Output with "bpf: fib_lookup: Allow output lookups for IPv6 link-local
addresses":
# ./test_progs -a fib_lookup
#119 fib_lookup:OK
Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
.../testing/selftests/bpf/prog_tests/fib_lookup.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 9e933daf56d7..3dca6fde249b 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -47,6 +47,8 @@
#define IPV4_OUTPUT_DST "192.0.2.1"
#define IPV6_OUTPUT_NET "2001:db8:1::"
#define IPV6_OUTPUT_DST "2001:db8:1::1"
+#define IPV6_LL_ADDR "fe80::1"
+#define IPV6_LL_DST "fe80::2"
struct fib_lookup_test {
const char *desc;
@@ -207,6 +209,14 @@ static const struct fib_lookup_test tests[] = {
.expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
.lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
.ifindex = IFINDEX_VETH2, },
+ { .desc = "IPv6 output route, link-local, via first device",
+ .daddr = IPV6_LL_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT,
+ .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+ { .desc = "IPv6 output route, link-local, via second device",
+ .daddr = IPV6_LL_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+ .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT2,
+ .ifindex = IFINDEX_VETH2, .expected_ifindex = IFINDEX_VETH2, },
};
static int setup_netns(void)
@@ -289,6 +299,11 @@ static int setup_netns(void)
SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC);
SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC2);
+ SYS(fail, "ip addr add %s/64 dev veth1 nodad", IPV6_LL_ADDR);
+ SYS(fail, "ip addr add %s/64 dev veth2 nodad", IPV6_LL_ADDR);
+ SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV6_LL_DST, DMAC);
+ SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV6_LL_DST, DMAC2);
+
return 0;
fail:
return -1;
--
2.53.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements
2026-02-26 7:59 [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements Ido Schimmel
` (8 preceding siblings ...)
2026-02-26 8:00 ` [RFC PATCH bpf-next 9/9] selftests/bpf: fib_lookup: Add IPv6 link-local tests Ido Schimmel
@ 2026-02-26 17:14 ` Alexei Starovoitov
9 siblings, 0 replies; 14+ messages in thread
From: Alexei Starovoitov @ 2026-02-26 17:14 UTC (permalink / raw)
To: Ido Schimmel
Cc: Network Development, bpf, David S. Miller, Jakub Kicinski,
Paolo Abeni, Eric Dumazet, David Ahern, Petr Machata,
Simon Horman, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Martin KaFai Lau, John Fastabend,
Stanislav Fomichev
On Thu, Feb 26, 2026 at 12:00 AM Ido Schimmel <idosch@nvidia.com> wrote:
>
> This patchset performs two changes in the bpf_fib_lookup() helper:
>
> 1. Patch #6: Aligns IPv6 with IPv4 with regards to output route lookups
> (i.e., BPF_FIB_LOOKUP_OUTPUT) so that it always resolves a route whose
> nexthop device matches the specified oif.
>
> 2. Patch #8: Allows output route lookups for IPv6 link-local addresses.
>
> The rest of the patches perform small changes in the existing
> bpf_fib_lookup() selftest (patches #1-#4) and add tests for the new
> functionality (patches #5, #7 and #9).
tbh I would send the whole thing through bpf or net trees.
^ permalink raw reply [flat|nested] 14+ messages in thread