Re: [PATCH bpf-next v2 2/2] selftests/bpf: test that dst is cleared on same-protocol encap

[Daniel Borkmann]

On 3/29/26 8:04 PM, Jakub Kicinski wrote:
Verify that bpf_skb_adjust_room() clears the routing dst even when
the encap L3 protocol matches the original packet (e.g. IPIP).
The dst selected for the inner packet is not valid for the
encapsulated result; a stale dst could lead to misrouting.
Signed-off-by: Jakub Kicinski <k...@kernel.org>

Acked-by: Daniel Borkmann <dan...@iogearbox.net>

For new tests we should ideally only be using tcx links and not the old
qdisc approach unless there is specifc reason to. Any objections if I
fold this in while applying?

 .../selftests/bpf/prog_tests/test_dst_clear.c | 23 ++++++-------------
 .../selftests/bpf/progs/test_dst_clear.c      |  2 +-
 2 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_dst_clear.c 
b/tools/testing/selftests/bpf/prog_tests/test_dst_clear.c
index 8190c56556fb..c8e9c6947a2c 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_dst_clear.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_dst_clear.c
@@ -15,11 +15,11 @@
 
 void test_dst_clear(void)
 {
-       LIBBPF_OPTS(bpf_tc_hook, qdisc_hook, .attach_point = BPF_TC_EGRESS);
-       LIBBPF_OPTS(bpf_tc_opts, tc_attach);
+       LIBBPF_OPTS(bpf_tcx_opts, tcx_opts);
        struct nstoken *nstoken = NULL;
        struct test_dst_clear *skel;
        struct sockaddr_in addr;
+       struct bpf_link *link;
        socklen_t addrlen;
        char buf[128] = {};
        int sockfd, err;
@@ -36,18 +36,11 @@ void test_dst_clear(void)
        if (!ASSERT_OK_PTR(nstoken, "open_netns"))
                goto fail;
 
-	qdisc_hook.ifindex = if_nametoindex("lo");
-       if (!ASSERT_GT(qdisc_hook.ifindex, 0, "if_nametoindex lo"))
-               goto fail;
-
-       err = bpf_tc_hook_create(&qdisc_hook);
-       if (!ASSERT_OK(err, "create qdisc hook"))
-               goto fail;
-
-       tc_attach.prog_fd = bpf_program__fd(skel->progs.dst_clear);
-       err = bpf_tc_attach(&qdisc_hook, &tc_attach);
-       if (!ASSERT_OK(err, "attach filter"))
+       link = bpf_program__attach_tcx(skel->progs.dst_clear,
+                                      if_nametoindex("lo"), &tcx_opts);
+       if (!ASSERT_OK_PTR(link, "attach_tcx"))
                goto fail;
+       skel->links.dst_clear = link;
 
 	addrlen = sizeof(addr);
        err = make_sockaddr(AF_INET, IPV4_IFACE_ADDR, UDP_TEST_PORT,
@@ -66,10 +59,8 @@ void test_dst_clear(void)
        ASSERT_TRUE(skel->bss->dst_cleared, "dst_cleared");
 
 fail:
-       if (nstoken) {
-               bpf_tc_hook_destroy(&qdisc_hook);
+       if (nstoken)
                close_netns(nstoken);
-       }
        SYS_NOFAIL("ip netns del " NS_TEST);
        test_dst_clear__destroy(skel);
 }
diff --git a/tools/testing/selftests/bpf/progs/test_dst_clear.c 
b/tools/testing/selftests/bpf/progs/test_dst_clear.c
index 7ac9604fd99c..c22a6eeb4798 100644
--- a/tools/testing/selftests/bpf/progs/test_dst_clear.c
+++ b/tools/testing/selftests/bpf/progs/test_dst_clear.c
@@ -13,7 +13,7 @@ void *bpf_cast_to_kern_ctx(void *) __ksym;
 bool had_dst = false;
 bool dst_cleared = false;
 
-SEC("tc")
+SEC("tc/egress")
 int dst_clear(struct __sk_buff *skb)
 {
        struct sk_buff *kskb;
--
2.43.0