Commit 6dc03dc7 authored by Udip Pant's avatar Udip Pant Committed by Alexei Starovoitov
Browse files

selftests/bpf: Add test for freplace program with write access 



This adds a selftest that tests the behavior when a freplace target program
attempts to make a write access on a packet. The expectation is that the read or write
access is granted based on the program type of the linked program and
not itself (which is of type, for e.g., BPF_PROG_TYPE_EXT).

This test fails without the associated patch on the verifier.

Signed-off-by: default avatarUdip Pant <udippant@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200825232003.2877030-3-udippant@fb.com
parent 7e40781c

tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c

+1 −0
Original line number Diff line number Diff line
@@ -123,6 +123,7 @@ static void test_func_replace(void) 
		"freplace/get_skb_len",

		"freplace/get_skb_ifindex",

		"freplace/get_constant",

		"freplace/test_pkt_write_access_subprog",

	};

	test_fexit_bpf2bpf_common("./fexit_bpf2bpf.o",

				  "./test_pkt_access.o",

tools/testing/selftests/bpf/progs/fexit_bpf2bpf.c

+27 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2019 Facebook */

#include <linux/stddef.h>

#include <linux/if_ether.h>

#include <linux/ipv6.h>

#include <linux/bpf.h>

#include <linux/tcp.h>

#include <bpf/bpf_helpers.h>

#include <bpf/bpf_endian.h>

#include <bpf/bpf_tracing.h>
@@ -151,4 +153,29 @@ int new_get_constant(long val) 
	test_get_constant = 1;

	return test_get_constant; /* original get_constant() returns val - 122 */

}



__u64 test_pkt_write_access_subprog = 0;

SEC("freplace/test_pkt_write_access_subprog")

int new_test_pkt_write_access_subprog(struct __sk_buff *skb, __u32 off)

{



	void *data = (void *)(long)skb->data;

	void *data_end = (void *)(long)skb->data_end;

	struct tcphdr *tcp;



	if (off > sizeof(struct ethhdr) + sizeof(struct ipv6hdr))

		return -1;



	tcp = data + off;

	if (tcp + 1 > data_end)

		return -1;



	/* make modifications to the packet data */

	tcp->check++;

	tcp->syn = 0;



	test_pkt_write_access_subprog = 1;

	return 0;

}



char _license[] SEC("license") = "GPL";

tools/testing/selftests/bpf/progs/test_pkt_access.c

+20 −0
Original line number Diff line number Diff line
@@ -79,6 +79,24 @@ int get_skb_ifindex(int val, struct __sk_buff *skb, int var) 
	return skb->ifindex * val * var;

}



__attribute__ ((noinline))

int test_pkt_write_access_subprog(struct __sk_buff *skb, __u32 off)

{

	void *data = (void *)(long)skb->data;

	void *data_end = (void *)(long)skb->data_end;

	struct tcphdr *tcp = NULL;



	if (off > sizeof(struct ethhdr) + sizeof(struct ipv6hdr))

		return -1;



	tcp = data + off;

	if (tcp + 1 > data_end)

		return -1;

	/* make modification to the packet data */

	tcp->check++;

	return 0;

}



SEC("classifier/test_pkt_access")

int test_pkt_access(struct __sk_buff *skb)

{
@@ -117,6 +135,8 @@ int test_pkt_access(struct __sk_buff *skb) 
	if (test_pkt_access_subprog3(3, skb) != skb->len * 3 * skb->ifindex)

		return TC_ACT_SHOT;

	if (tcp) {

		if (test_pkt_write_access_subprog(skb, (void *)tcp - data))

			return TC_ACT_SHOT;

		if (((void *)(tcp) + 20) > data_end || proto != 6)

			return TC_ACT_SHOT;

		barrier(); /* to force ordering of checks */

CRA Git | Maintained and supported by SUSTech CRA and CCSE