[RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements

[RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements

[Ido Schimmel]

This patchset performs two changes in the bpf_fib_lookup() helper:

1. Patch #6: Aligns IPv6 with IPv4 with regards to output route lookups
(i.e., BPF_FIB_LOOKUP_OUTPUT) so that it always resolves a route whose
nexthop device matches the specified oif.

2. Patch #8: Allows output route lookups for IPv6 link-local addresses.

The rest of the patches perform small changes in the existing
bpf_fib_lookup() selftest (patches #1-#4) and add tests for the new
functionality (patches #5, #7 and #9).

I believe the patches stand on their own, but below is the motivating
use case:

We are researching the possibility of offloading the data plane of the
Bidirectional Forwarding Detection (BFD) protocol [1][2][3] from user
space (i.e., FRR) to the kernel using BPF. FRR already supports the
delegation of the data plane logic to a different daemon via the
"Distributed BFD" protocol [4].

When used in asynchronous mode, the per-session Tx logic of the protocol
boils down to periodically sending a packet to the BFD peer according to
the negotiated Tx interval. The simplified diagram below explains how
this can be implemented in the kernel using BPF:

         bpf_redirect()
     +--------------------+
     |                    |
     |                    ▼
     |           +-----------------+    bpf_fib_lookup() +
     |           |                 |  bpf_clone_redirect()
     |           |    BPF clsact   +-------------------------► swpX
     |           |                 |
     |           +--------+--------+
     |                    |  skb->tstamp set according
     |                    |  to per-session Tx interval
     |                    |
     |                    ▼
     |           +-----------------+
     |           |                 |
     |           |    fq qdisc     |
     |           |                 |
     |           +--------+--------+
     |                    |  skb dequeued according to
     |          veth      |  skb->tstamp
     |         bfd_tx     |
     |       -------------|-------------
     |          veth      |
     |         bfd_rx     |
     |                    |
     |                    ▼
     |           +-----------------+
     |           |                 |
     |           |    BPF clsact   |
     |           |                 |
     |           +--------+--------+
     |                    |
     +--------------------+

Missing from the diagram are RPS on bfd_rx and XPS + mq + fqs on bfd_tx
in order to spread the BFD sessions (can be thousands with milliseconds
Tx intervals) across all available CPUs. Also missing is the handling of
neighbour resolution (i.e., upon BPF_FIB_LKUP_RET_NO_NEIGH) which is
deferred to user space.

The per-session BFD packet will be injected into this loop by user space
when the BFD session is first created.

The above loops works well, but we have identified two gaps with respect
to the bpf_fib_lookup() helper:

1. Forcing a lookup via a specific interface. User space can ask to form
a BFD session over a specific interface. In this case, we need the
bpf_fib_lookup() to resolve the destination MAC for us. This works well
with IPv4 when the BPF_FIB_LOOKUP_OUTPUT flag is specified, but IPv6
does not honor the oif and simply resolves the most specific route. This
is handled in patch #6.

2. Lookup for an IPv6 link-local address. Related to the previous gap,
user space can ask to form a single-hop BFD session over a specific
interface and specify an IPv6 link-local address as the remote peer
address. The bpf_fib_lookup() helper currently forbids lookups towards
such addresses. This is handled in patch #8.

[1] https://datatracker.ietf.org/doc/html/rfc5880
[2] https://datatracker.ietf.org/doc/html/rfc5881
[3] https://datatracker.ietf.org/doc/html/rfc5883
[4] https://docs.frrouting.org/en/latest/bfd.html#distributed-bfd

Ido Schimmel (9):
  selftests/bpf: fib_lookup: Force specific interface indexes
  selftests/bpf: fib_lookup: Enable forwarding on second net device
  selftests/bpf: fib_lookup: Allow parametrizing ifindex
  selftests/bpf: fib_lookup: Allow testing for expected ifindex
  selftests/bpf: fib_lookup: Add IPv4 output route tests
  bpf: fib_lookup: Honor oif in IPv6 output route lookups
  selftests/bpf: fib_lookup: Add IPv6 output route tests
  bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses
  selftests/bpf: fib_lookup: Add IPv6 link-local tests

 net/core/filter.c                             |  12 +-
 .../selftests/bpf/prog_tests/fib_lookup.c     | 117 ++++++++++++++++--
 2 files changed, 118 insertions(+), 11 deletions(-)

-- 
2.53.0

[RFC PATCH bpf-next 1/9] selftests/bpf: fib_lookup: Force specific interface indexes

[Ido Schimmel]

Subsequent patches will add tests for output routes (i.e.,
BPF_FIB_LOOKUP_OUTPUT). In these tests, the bpf_fib_lookup() helper will
be called with different interface indexes to make sure it is resolving
the correct route. Make it easier to add such tests by predetermining
the interface indexes.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index bd7658958004..77f65ff7784a 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -41,6 +41,8 @@
 #define DMAC_INIT { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, }
 #define DMAC2			"01:01:01:01:01:01"
 #define DMAC_INIT2 { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, }
+#define IFINDEX_VETH1		10010
+#define IFINDEX_VETH2		10020
 
 struct fib_lookup_test {
 	const char *desc;
@@ -148,7 +150,8 @@ static int setup_netns(void)
 {
 	int err;
 
-	SYS(fail, "ip link add veth1 type veth peer name veth2");
+	SYS(fail, "ip link add veth1 index %d type veth peer name veth2 index %d",
+	    IFINDEX_VETH1, IFINDEX_VETH2);
 	SYS(fail, "ip link set dev veth1 up");
 	SYS(fail, "ip link set dev veth2 up");
 
@@ -324,10 +327,7 @@ void test_fib_lookup(void)
 	if (setup_netns())
 		goto fail;
 
-	skb.ifindex = if_nametoindex("veth1");
-	if (!ASSERT_NEQ(skb.ifindex, 0, "if_nametoindex(veth1)"))
-		goto fail;
-
+	skb.ifindex = IFINDEX_VETH1;
 	fib_params = &skel->bss->fib_params;
 
 	for (i = 0; i < ARRAY_SIZE(tests); i++) {
-- 
2.53.0

[RFC PATCH bpf-next 2/9] selftests/bpf: fib_lookup: Enable forwarding on second net device

[Ido Schimmel]

Currently, the bpf_fib_lookup() helper is only called with the ifindex
of veth1. In preparation for calling the bpf_fib_lookup() helper with
the ifindex of veth2, enable forwarding on this device.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 77f65ff7784a..14a6515a453d 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -193,10 +193,18 @@ static int setup_netns(void)
 	if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf.veth1.forwarding)"))
 		goto fail;
 
+	err = write_sysctl("/proc/sys/net/ipv4/conf/veth2/forwarding", "1");
+	if (!ASSERT_OK(err, "write_sysctl(net.ipv4.conf.veth2.forwarding)"))
+		goto fail;
+
 	err = write_sysctl("/proc/sys/net/ipv6/conf/veth1/forwarding", "1");
 	if (!ASSERT_OK(err, "write_sysctl(net.ipv6.conf.veth1.forwarding)"))
 		goto fail;
 
+	err = write_sysctl("/proc/sys/net/ipv6/conf/veth2/forwarding", "1");
+	if (!ASSERT_OK(err, "write_sysctl(net.ipv6.conf.veth2.forwarding)"))
+		goto fail;
+
 	/* Setup for policy routing tests */
 	SYS(fail, "ip addr add %s/24 dev veth1", IPV4_LOCAL);
 	SYS(fail, "ip addr add %s/64 dev veth1 nodad", IPV6_LOCAL);
-- 
2.53.0

[RFC PATCH bpf-next 3/9] selftests/bpf: fib_lookup: Allow parametrizing ifindex

[Ido Schimmel]

Currently, the ifindex passed to the bpf_fib_lookup() helper is always
that of veth1. In preparation for output route tests, allow test cases
to specify an alternative ifindex. Default to that of veth1 when ifindex
is not specified.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 14a6515a453d..cd306bd4819a 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -54,6 +54,7 @@ struct fib_lookup_test {
 	__u32 tbid;
 	__u8 dmac[6];
 	__u32 mark;
+	int ifindex;
 };
 
 static const struct fib_lookup_test tests[] = {
@@ -221,15 +222,14 @@ static int setup_netns(void)
 }
 
 static int set_lookup_params(struct bpf_fib_lookup *params,
-			     const struct fib_lookup_test *test,
-			     int ifindex)
+			     const struct fib_lookup_test *test)
 {
 	int ret;
 
 	memset(params, 0, sizeof(*params));
 
 	params->l4_protocol = IPPROTO_TCP;
-	params->ifindex = ifindex;
+	params->ifindex = test->ifindex ? : IFINDEX_VETH1;
 	params->tbid = test->tbid;
 	params->mark = test->mark;
 
@@ -335,13 +335,12 @@ void test_fib_lookup(void)
 	if (setup_netns())
 		goto fail;
 
-	skb.ifindex = IFINDEX_VETH1;
 	fib_params = &skel->bss->fib_params;
 
 	for (i = 0; i < ARRAY_SIZE(tests); i++) {
 		printf("Testing %s ", tests[i].desc);
 
-		if (set_lookup_params(fib_params, &tests[i], skb.ifindex))
+		if (set_lookup_params(fib_params, &tests[i]))
 			continue;
 
 		skel->bss->fib_lookup_ret = -1;
-- 
2.53.0

[RFC PATCH bpf-next 4/9] selftests/bpf: fib_lookup: Allow testing for expected ifindex

[Ido Schimmel]

In preparation for output route tests, allow test cases to specify an
expected ifindex and verify that it matches the ifindex of the nexthop
device. Default to not verifying the ifindex.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 tools/testing/selftests/bpf/prog_tests/fib_lookup.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index cd306bd4819a..0541fd982e63 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -55,6 +55,7 @@ struct fib_lookup_test {
 	__u8 dmac[6];
 	__u32 mark;
 	int ifindex;
+	int expected_ifindex;
 };
 
 static const struct fib_lookup_test tests[] = {
@@ -359,6 +360,10 @@ void test_fib_lookup(void)
 		if (tests[i].expected_dst)
 			assert_dst_ip(fib_params, tests[i].expected_dst);
 
+		if (tests[i].expected_ifindex)
+			ASSERT_EQ(fib_params->ifindex, tests[i].expected_ifindex,
+				  "ifindex does not match");
+
 		ret = memcmp(tests[i].dmac, fib_params->dmac, sizeof(tests[i].dmac));
 		if (!ASSERT_EQ(ret, 0, "dmac not match")) {
 			char expected[18], actual[18];
-- 
2.53.0

[RFC PATCH bpf-next 5/9] selftests/bpf: fib_lookup: Add IPv4 output route tests

[Ido Schimmel]

When the BPF_FIB_LOOKUP_OUTPUT flag is passed to the bpf_fib_lookup()
helper the expectation is that the helper will resolve the most specific
route whose nexthop device matches the specified ifindex. This is useful
when we already know the nexthop device, but need the helper to resolve
the destination MAC.

Add test cases to test this behavior. To that end, configure two
identical routes that differ in their metric and nexthop device and test
that the correct route is resolved each time.

Also test the scenario where a matching route for the destination
address exists, but with the wrong nexthop device. Expect the helper to
return an error.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 .../selftests/bpf/prog_tests/fib_lookup.c     | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 0541fd982e63..6ceeecbdca43 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -43,6 +43,8 @@
 #define DMAC_INIT2 { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, }
 #define IFINDEX_VETH1		10010
 #define IFINDEX_VETH2		10020
+#define IPV4_OUTPUT_NET		"192.0.2.0"
+#define IPV4_OUTPUT_DST		"192.0.2.1"
 
 struct fib_lookup_test {
 	const char *desc;
@@ -146,6 +148,35 @@ static const struct fib_lookup_test tests[] = {
 	  .expected_dst = IPV6_GW1,
 	  .lookup_flags = BPF_FIB_LOOKUP_SKIP_NEIGH,
 	  .mark = MARK, },
+	/* output routes */
+	{ .desc = "IPv4 output route, without source, via first device",
+	  .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+	  .dmac = DMAC_INIT, .ifindex = IFINDEX_VETH1,
+	  .expected_ifindex = IFINDEX_VETH1, },
+	{ .desc = "IPv4 output route, without source, via second device",
+	  .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+	  .dmac = DMAC_INIT2, .ifindex = IFINDEX_VETH2,
+	  .expected_ifindex = IFINDEX_VETH2, },
+	{ .desc = "IPv4 output route, with source, via first device",
+	  .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT,
+	  .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+	{ .desc = "IPv4 output route, with source, via second device",
+	  .daddr = IPV4_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT2,
+	  .ifindex = IFINDEX_VETH2, .expected_ifindex = IFINDEX_VETH2, },
+	{ .desc = "IPv4 output route, oif match",
+	  .daddr = IPV4_NUD_STALE_ADDR,
+	  .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+	  .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+	{ .desc = "IPv4 output route, oif mismatch",
+	  .daddr = IPV4_NUD_STALE_ADDR,
+	  .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+	  .ifindex = IFINDEX_VETH2, },
 };
 
 static int setup_netns(void)
@@ -217,6 +248,12 @@ static int setup_netns(void)
 	SYS(fail, "ip rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
 	SYS(fail, "ip -6 rule add prio 2 fwmark %d lookup %s", MARK, MARK_TABLE);
 
+	/* Setup for output route tests */
+	SYS(fail, "ip route add %s/24 dev veth1 metric 100", IPV4_OUTPUT_NET);
+	SYS(fail, "ip route add %s/24 dev veth2 metric 200", IPV4_OUTPUT_NET);
+	SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC);
+	SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC2);
+
 	return 0;
 fail:
 	return -1;
-- 
2.53.0

[RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups

[Ido Schimmel]

Currently, output route lookups behave differently between IPv4 and IPv6
when performed via the bpf_fib_lookup() helper with the
BPF_FIB_LOOKUP_OUTPUT flag.

IPv4 honors the oif and resolves the most specific route whose nexthop
device matches the oif. If no such route exists, an error is returned.

On the other hand, IPv6 simply resolves the most specific route, even if
its nexthop device does not match the specified oif.

Fix this by setting the RT6_LOOKUP_F_IFACE flag when performing an
output route lookup, so that a device mismatch will be considered a
fatal error.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/core/filter.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 0d5d5a17acb2..e92552b139b1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6255,6 +6255,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
 		fl6.flowi6_iif = 1;
 		oif = fl6.flowi6_oif = params->ifindex;
+		strict = RT6_LOOKUP_F_IFACE;
 	} else {
 		oif = fl6.flowi6_iif = params->ifindex;
 		fl6.flowi6_oif = 0;
-- 
2.53.0

[RFC PATCH bpf-next 7/9] selftests/bpf: fib_lookup: Add IPv6 output route tests

[Ido Schimmel]

In a similar fashion to the IPv4 output route tests, add equivalent IPv6
tests.

Output without "bpf: fib_lookup: Honor oif in IPv6 output route
lookups":

 # ./test_progs -a fib_lookup
 [...]
 Testing IPv6 output route, without source, via second device test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
 test_fib_lookup:PASS:fib_lookup_ret 0 nsec
 test_fib_lookup:FAIL:ifindex does not match unexpected ifindex does not match: actual 10010 != expected 10020
 [...]
 Testing IPv6 output route, with source, via second device set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
 test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
 test_fib_lookup:PASS:fib_lookup_ret 0 nsec
 test_fib_lookup:FAIL:ifindex does not match unexpected ifindex does not match: actual 10010 != expected 10020
 [...]
 Testing IPv6 output route, oif mismatch set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
 test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
 test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 0 != expected 4
 [...]
 #119     fib_lookup:FAIL
 Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED

Output with "bpf: fib_lookup: Honor oif in IPv6 output route lookups":

 # ./test_progs -a fib_lookup
 #119     fib_lookup:OK
 Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED

That is, without the specified patch, unlike IPv4, IPv6 would always
resolve the most specific route with the lowest metric, even if its
nexthop device does not match the specified oif.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 .../selftests/bpf/prog_tests/fib_lookup.c     | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 6ceeecbdca43..9e933daf56d7 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -45,6 +45,8 @@
 #define IFINDEX_VETH2		10020
 #define IPV4_OUTPUT_NET		"192.0.2.0"
 #define IPV4_OUTPUT_DST		"192.0.2.1"
+#define IPV6_OUTPUT_NET		"2001:db8:1::"
+#define IPV6_OUTPUT_DST		"2001:db8:1::1"
 
 struct fib_lookup_test {
 	const char *desc;
@@ -177,6 +179,34 @@ static const struct fib_lookup_test tests[] = {
 	  .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
 	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
 	  .ifindex = IFINDEX_VETH2, },
+	{ .desc = "IPv6 output route, without source, via first device",
+	  .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+	  .dmac = DMAC_INIT, .ifindex = IFINDEX_VETH1,
+	  .expected_ifindex = IFINDEX_VETH1, },
+	{ .desc = "IPv6 output route, without source, via second device",
+	  .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SRC,
+	  .dmac = DMAC_INIT2, .ifindex = IFINDEX_VETH2,
+	  .expected_ifindex = IFINDEX_VETH2, },
+	{ .desc = "IPv6 output route, with source, via first device",
+	  .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT,
+	  .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+	{ .desc = "IPv6 output route, with source, via second device",
+	  .daddr = IPV6_OUTPUT_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT2,
+	  .ifindex = IFINDEX_VETH2, .expected_ifindex = IFINDEX_VETH2, },
+	{ .desc = "IPv6 output route, oif match",
+	  .daddr = IPV6_NUD_STALE_ADDR,
+	  .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+	  .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+	{ .desc = "IPv6 output route, oif mismatch",
+	  .daddr = IPV6_NUD_STALE_ADDR,
+	  .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
+	  .ifindex = IFINDEX_VETH2, },
 };
 
 static int setup_netns(void)
@@ -254,6 +284,11 @@ static int setup_netns(void)
 	SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC);
 	SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV4_OUTPUT_DST, DMAC2);
 
+	SYS(fail, "ip route add %s/64 dev veth1 metric 100", IPV6_OUTPUT_NET);
+	SYS(fail, "ip route add %s/64 dev veth2 metric 200", IPV6_OUTPUT_NET);
+	SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC);
+	SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC2);
+
 	return 0;
 fail:
 	return -1;
-- 
2.53.0

[RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses

[Ido Schimmel]

Currently, the bpf_fib_lookup() helper returns an error when IPv6
link-local addresses are used. This is the correct behavior from input
perspective as such packets should not be forwarded, but the helper can
also be used to perform a lookup from output perspective (i.e., with
BPF_FIB_LOOKUP_OUTPUT). In this case, passing IPv6 link-local addresses
should be allowed and one legitimate use case is having the helper
resolve the destination MAC for such packets.

Therefore, relax the limitation and allow IPv6 link-local addresses when
the BPF_FIB_LOOKUP_OUTPUT flag is used.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/core/filter.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index e92552b139b1..8f0d2aeffc3d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6241,8 +6241,15 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 	u32 mtu = 0;
 
 	/* link local addresses are never forwarded */
-	if (rt6_need_strict(dst) || rt6_need_strict(src))
-		return BPF_FIB_LKUP_RET_NOT_FWDED;
+	if (rt6_need_strict(dst) || rt6_need_strict(src)) {
+		int rej_type = IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK;
+
+		if (!(flags & BPF_FIB_LOOKUP_OUTPUT))
+			return BPF_FIB_LKUP_RET_NOT_FWDED;
+		if ((ipv6_addr_type(dst) & rej_type) ||
+		    (ipv6_addr_type(src) & rej_type))
+			return BPF_FIB_LKUP_RET_NOT_FWDED;
+	}
 
 	dev = dev_get_by_index_rcu(net, params->ifindex);
 	if (unlikely(!dev))
-- 
2.53.0

[RFC PATCH bpf-next 9/9] selftests/bpf: fib_lookup: Add IPv6 link-local tests

[Ido Schimmel]

Add tests that verify that bpf_fib_lookup() is able to resolve the
destination MAC for an IPv6 link-local address when specifying the
BPF_FIB_LOOKUP_OUTPUT flag.

Output without "bpf: fib_lookup: Allow output lookups for IPv6
link-local addresses":

 # ./test_progs -a fib_lookup
 [...]
 Testing IPv6 output route, link-local, via first device set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
 test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
 test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 4 != expected 0
 [...]
 Testing IPv6 output route, link-local, via second device set_lookup_params:PASS:inet_pton(IPV6_IFACE_ADDR) 0 nsec
 test_fib_lookup:PASS:bpf_prog_test_run_opts 0 nsec
 test_fib_lookup:FAIL:fib_lookup_ret unexpected fib_lookup_ret: actual 4 != expected 0
 [...]
 #119     fib_lookup:FAIL
 Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED

Output with "bpf: fib_lookup: Allow output lookups for IPv6 link-local
addresses":

 # ./test_progs -a fib_lookup
 #119     fib_lookup:OK
 Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 .../testing/selftests/bpf/prog_tests/fib_lookup.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
index 9e933daf56d7..3dca6fde249b 100644
--- a/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/fib_lookup.c
@@ -47,6 +47,8 @@
 #define IPV4_OUTPUT_DST		"192.0.2.1"
 #define IPV6_OUTPUT_NET		"2001:db8:1::"
 #define IPV6_OUTPUT_DST		"2001:db8:1::1"
+#define IPV6_LL_ADDR		"fe80::1"
+#define IPV6_LL_DST		"fe80::2"
 
 struct fib_lookup_test {
 	const char *desc;
@@ -207,6 +209,14 @@ static const struct fib_lookup_test tests[] = {
 	  .expected_ret = BPF_FIB_LKUP_RET_NOT_FWDED,
 	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT | BPF_FIB_LOOKUP_SKIP_NEIGH,
 	  .ifindex = IFINDEX_VETH2, },
+	{ .desc = "IPv6 output route, link-local, via first device",
+	  .daddr = IPV6_LL_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT,
+	  .ifindex = IFINDEX_VETH1, .expected_ifindex = IFINDEX_VETH1, },
+	{ .desc = "IPv6 output route, link-local, via second device",
+	  .daddr = IPV6_LL_DST, .expected_ret = BPF_FIB_LKUP_RET_SUCCESS,
+	  .lookup_flags = BPF_FIB_LOOKUP_OUTPUT, .dmac = DMAC_INIT2,
+	  .ifindex = IFINDEX_VETH2, .expected_ifindex = IFINDEX_VETH2, },
 };
 
 static int setup_netns(void)
@@ -289,6 +299,11 @@ static int setup_netns(void)
 	SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC);
 	SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV6_OUTPUT_DST, DMAC2);
 
+	SYS(fail, "ip addr add %s/64 dev veth1 nodad", IPV6_LL_ADDR);
+	SYS(fail, "ip addr add %s/64 dev veth2 nodad", IPV6_LL_ADDR);
+	SYS(fail, "ip neigh add %s dev veth1 lladdr %s nud perm", IPV6_LL_DST, DMAC);
+	SYS(fail, "ip neigh add %s dev veth2 lladdr %s nud perm", IPV6_LL_DST, DMAC2);
+
 	return 0;
 fail:
 	return -1;
-- 
2.53.0

Re: [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1309 bytes --]

> diff --git a/net/core/filter.c b/net/core/filter.c
> index 0d5d5a17acb2..e92552b139b1 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -6255,6 +6255,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>  	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
>  		fl6.flowi6_iif = 1;
>  		oif = fl6.flowi6_oif = params->ifindex;
> +		strict = RT6_LOOKUP_F_IFACE;
>  	} else {

The fix itself looks correct. Since this addresses a bug that has been
present since the original bpf_fib_lookup helper was introduced, should
this carry a Fixes tag?

Fixes: 87f5fc7e48dd ("bpf: Provide helper to do forwarding lookups in kernel FIB table")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22433453774

AI-authorship-score: low
AI-authorship-explanation: Precise one-line kernel networking fix by a known kernel maintainer with deep routing subsystem expertise, characteristic of experienced human developers.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: Missing Fixes tag for a bug present since the original bpf_fib_lookup helper introduction; the code fix itself is correct.

Re: [RFC PATCH bpf-next 6/9] bpf: fib_lookup: Honor oif in IPv6 output route lookups

[David Ahern]

On 2/26/26 1:41 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/net/core/filter.c b/net/core/filter.c
>> index 0d5d5a17acb2..e92552b139b1 100644
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -6255,6 +6255,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>>  	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
>>  		fl6.flowi6_iif = 1;
>>  		oif = fl6.flowi6_oif = params->ifindex;
>> +		strict = RT6_LOOKUP_F_IFACE;
>>  	} else {
> 
> The fix itself looks correct. Since this addresses a bug that has been
> present since the original bpf_fib_lookup helper was introduced, should
> this carry a Fixes tag?
> 
> Fixes: 87f5fc7e48dd ("bpf: Provide helper to do forwarding lookups in kernel FIB table")

+1. I would consider this a bug fix.

Re: [RFC PATCH bpf-next 8/9] bpf: fib_lookup: Allow output lookups for IPv6 link-local addresses

[David Ahern]

On 2/26/26 1:00 AM, Ido Schimmel wrote:
> Currently, the bpf_fib_lookup() helper returns an error when IPv6
> link-local addresses are used. This is the correct behavior from input
> perspective as such packets should not be forwarded, but the helper can
> also be used to perform a lookup from output perspective (i.e., with
> BPF_FIB_LOOKUP_OUTPUT). In this case, passing IPv6 link-local addresses
> should be allowed and one legitimate use case is having the helper
> resolve the destination MAC for such packets.
> 
> Therefore, relax the limitation and allow IPv6 link-local addresses when
> the BPF_FIB_LOOKUP_OUTPUT flag is used.
> 
> Reviewed-by: Petr Machata <petrm@nvidia.com>
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/core/filter.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index e92552b139b1..8f0d2aeffc3d 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -6241,8 +6241,15 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>  	u32 mtu = 0;
>  
>  	/* link local addresses are never forwarded */
> -	if (rt6_need_strict(dst) || rt6_need_strict(src))
> -		return BPF_FIB_LKUP_RET_NOT_FWDED;
> +	if (rt6_need_strict(dst) || rt6_need_strict(src)) {
> +		int rej_type = IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK;
> +
> +		if (!(flags & BPF_FIB_LOOKUP_OUTPUT))
> +			return BPF_FIB_LKUP_RET_NOT_FWDED;
> +		if ((ipv6_addr_type(dst) & rej_type) ||
> +		    (ipv6_addr_type(src) & rej_type))
> +			return BPF_FIB_LKUP_RET_NOT_FWDED;
> +	}
>  
>  	dev = dev_get_by_index_rcu(net, params->ifindex);
>  	if (unlikely(!dev))

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [RFC PATCH bpf-next 0/9] bpf: fib_lookup: IPv6 output routes enhancements

[Alexei Starovoitov]

On Thu, Feb 26, 2026 at 12:00 AM Ido Schimmel <idosch@nvidia.com> wrote:
>
> This patchset performs two changes in the bpf_fib_lookup() helper:
>
> 1. Patch #6: Aligns IPv6 with IPv4 with regards to output route lookups
> (i.e., BPF_FIB_LOOKUP_OUTPUT) so that it always resolves a route whose
> nexthop device matches the specified oif.
>
> 2. Patch #8: Allows output route lookups for IPv6 link-local addresses.
>
> The rest of the patches perform small changes in the existing
> bpf_fib_lookup() selftest (patches #1-#4) and add tests for the new
> functionality (patches #5, #7 and #9).

tbh I would send the whole thing through bpf or net trees.