Commit 2cb494a3 authored by Song Liu's avatar Song Liu Committed by Alexei Starovoitov
Browse files

bpf: add tests for direct packet access from CGROUP_SKB 



Tests are added to make sure CGROUP_SKB cannot access:
  tc_classid, data_meta, flow_keys

and can read and write:
  mark, prority, and cb[0-4]

and can read other fields.

To make selftest with skb->sk work, a dummy sk is added in
bpf_prog_test_run_skb().

Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent b39b5f41

net/bpf/test_run.c

+15 −0
Original line number Diff line number Diff line
@@ -10,6 +10,8 @@ 
#include <linux/etherdevice.h>

#include <linux/filter.h>

#include <linux/sched/signal.h>

#include <net/sock.h>

#include <net/tcp.h>



static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx,

		struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
@@ -115,6 +117,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 
	u32 retval, duration;

	int hh_len = ETH_HLEN;

	struct sk_buff *skb;

	struct sock *sk;

	void *data;

	int ret;
@@ -137,11 +140,21 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 
		break;

	}



	sk = kzalloc(sizeof(struct sock), GFP_USER);

	if (!sk) {

		kfree(data);

		return -ENOMEM;

	}

	sock_net_set(sk, current->nsproxy->net_ns);

	sock_init_data(NULL, sk);



	skb = build_skb(data, 0);

	if (!skb) {

		kfree(data);

		kfree(sk);

		return -ENOMEM;

	}

	skb->sk = sk;



	skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);

	__skb_put(skb, size);
@@ -159,6 +172,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 


			if (pskb_expand_head(skb, nhead, 0, GFP_USER)) {

				kfree_skb(skb);

				kfree(sk);

				return -ENOMEM;

			}

		}
@@ -171,6 +185,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 
		size = skb_headlen(skb);

	ret = bpf_test_finish(kattr, uattr, skb->data, size, retval, duration);

	kfree_skb(skb);

	kfree(sk);

	return ret;

}

tools/testing/selftests/bpf/test_verifier.c

+171 −0
Original line number Diff line number Diff line
@@ -4862,6 +4862,177 @@ static struct bpf_test tests[] = { 
		.result = REJECT,

		.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

	},

	{

		"direct packet read test#1 for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct __sk_buff, data)),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

				    offsetof(struct __sk_buff, data_end)),

			BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,

				    offsetof(struct __sk_buff, len)),

			BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,

				    offsetof(struct __sk_buff, pkt_type)),

			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,

				    offsetof(struct __sk_buff, mark)),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,

				    offsetof(struct __sk_buff, mark)),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,

				    offsetof(struct __sk_buff, queue_mapping)),

			BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,

				    offsetof(struct __sk_buff, protocol)),

			BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,

				    offsetof(struct __sk_buff, vlan_present)),

			BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),

			BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"direct packet read test#2 for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,

				    offsetof(struct __sk_buff, vlan_tci)),

			BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,

				    offsetof(struct __sk_buff, vlan_proto)),

			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,

				    offsetof(struct __sk_buff, priority)),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,

				    offsetof(struct __sk_buff, priority)),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,

				    offsetof(struct __sk_buff,

					     ingress_ifindex)),

			BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,

				    offsetof(struct __sk_buff, tc_index)),

			BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,

				    offsetof(struct __sk_buff, hash)),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"direct packet read test#3 for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,

				    offsetof(struct __sk_buff, cb[0])),

			BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,

				    offsetof(struct __sk_buff, cb[1])),

			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,

				    offsetof(struct __sk_buff, cb[2])),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,

				    offsetof(struct __sk_buff, cb[3])),

			BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,

				    offsetof(struct __sk_buff, cb[4])),

			BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,

				    offsetof(struct __sk_buff, napi_id)),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_4,

				    offsetof(struct __sk_buff, cb[0])),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_5,

				    offsetof(struct __sk_buff, cb[1])),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,

				    offsetof(struct __sk_buff, cb[2])),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_7,

				    offsetof(struct __sk_buff, cb[3])),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_8,

				    offsetof(struct __sk_buff, cb[4])),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"direct packet read test#4 for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct __sk_buff, family)),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

				    offsetof(struct __sk_buff, remote_ip4)),

			BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,

				    offsetof(struct __sk_buff, local_ip4)),

			BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,

				    offsetof(struct __sk_buff, remote_ip6[0])),

			BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,

				    offsetof(struct __sk_buff, remote_ip6[1])),

			BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,

				    offsetof(struct __sk_buff, remote_ip6[2])),

			BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,

				    offsetof(struct __sk_buff, remote_ip6[3])),

			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,

				    offsetof(struct __sk_buff, local_ip6[0])),

			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,

				    offsetof(struct __sk_buff, local_ip6[1])),

			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,

				    offsetof(struct __sk_buff, local_ip6[2])),

			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,

				    offsetof(struct __sk_buff, local_ip6[3])),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,

				    offsetof(struct __sk_buff, remote_port)),

			BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,

				    offsetof(struct __sk_buff, local_port)),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"invalid access of tc_classid for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,

				    offsetof(struct __sk_buff, tc_classid)),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "invalid bpf_context access",

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"invalid access of data_meta for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,

				    offsetof(struct __sk_buff, data_meta)),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "invalid bpf_context access",

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"invalid access of flow_keys for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,

				    offsetof(struct __sk_buff, flow_keys)),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "invalid bpf_context access",

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"invalid write access to napi_id for CGROUP_SKB",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,

				    offsetof(struct __sk_buff, napi_id)),

			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_9,

				    offsetof(struct __sk_buff, napi_id)),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "invalid bpf_context access",

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

	},

	{

		"valid cgroup storage access",

		.insns = {

CRA Git | Maintained and supported by SUSTech CRA and CCSE