Commit 9a856cae authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Alexei Starovoitov
Browse files

bpf: selftest: Add test_btf_skc_cls_ingress 



This patch attaches a classifier prog to the ingress filter.
It exercises the following helpers with different socket pointer
types in different logical branches:
1. bpf_sk_release()
2. bpf_sk_assign()
3. bpf_skc_to_tcp_request_sock(), bpf_skc_to_tcp_sock()
4. bpf_tcp_gen_syncookie, bpf_tcp_check_syncookie

Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200925000458.3859627-1-kafai@fb.com
parent 0c402c6c

tools/testing/selftests/bpf/bpf_tcp_helpers.h

+5 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ BPF_PROG(name, args) 


struct sock_common {

	unsigned char	skc_state;

	__u16		skc_num;

} __attribute__((preserve_access_index));



enum sk_pacing {
@@ -45,6 +46,10 @@ struct inet_connection_sock { 
	__u64			  icsk_ca_priv[104 / sizeof(__u64)];

} __attribute__((preserve_access_index));



struct request_sock {

	struct sock_common		__req_common;

} __attribute__((preserve_access_index));



struct tcp_sock {

	struct inet_connection_sock	inet_conn;

tools/testing/selftests/bpf/prog_tests/btf_skc_cls_ingress.c

0 → 100644
+234 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2020 Facebook */



#define _GNU_SOURCE

#include <netinet/in.h>

#include <arpa/inet.h>

#include <unistd.h>

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#include <sched.h>

#include <linux/compiler.h>

#include <bpf/libbpf.h>



#include "network_helpers.h"

#include "test_progs.h"

#include "test_btf_skc_cls_ingress.skel.h"



struct test_btf_skc_cls_ingress *skel;

struct sockaddr_in6 srv_sa6;

static __u32 duration;



#define PROG_PIN_FILE "/sys/fs/bpf/btf_skc_cls_ingress"



static int write_sysctl(const char *sysctl, const char *value)

{

	int fd, err, len;



	fd = open(sysctl, O_WRONLY);

	if (CHECK(fd == -1, "open sysctl", "open(%s): %s (%d)\n",

		  sysctl, strerror(errno), errno))

		return -1;



	len = strlen(value);

	err = write(fd, value, len);

	close(fd);

	if (CHECK(err != len, "write sysctl",

		  "write(%s, %s, %d): err:%d %s (%d)\n",

		  sysctl, value, len, err, strerror(errno), errno))

		return -1;



	return 0;

}



static int prepare_netns(void)

{

	if (CHECK(unshare(CLONE_NEWNET), "create netns",

		  "unshare(CLONE_NEWNET): %s (%d)",

		  strerror(errno), errno))

		return -1;



	if (CHECK(system("ip link set dev lo up"),

		  "ip link set dev lo up", "failed\n"))

		return -1;



	if (CHECK(system("tc qdisc add dev lo clsact"),

		  "tc qdisc add dev lo clsact", "failed\n"))

		return -1;



	if (CHECK(system("tc filter add dev lo ingress bpf direct-action object-pinned " PROG_PIN_FILE),

		  "install tc cls-prog at ingress", "failed\n"))

		return -1;



	/* Ensure 20 bytes options (i.e. in total 40 bytes tcp header) for the

	 * bpf_tcp_gen_syncookie() helper.

	 */

	if (write_sysctl("/proc/sys/net/ipv4/tcp_window_scaling", "1") ||

	    write_sysctl("/proc/sys/net/ipv4/tcp_timestamps", "1") ||

	    write_sysctl("/proc/sys/net/ipv4/tcp_sack", "1"))

		return -1;



	return 0;

}



static void reset_test(void)

{

	memset(&skel->bss->srv_sa6, 0, sizeof(skel->bss->srv_sa6));

	skel->bss->listen_tp_sport = 0;

	skel->bss->req_sk_sport = 0;

	skel->bss->recv_cookie = 0;

	skel->bss->gen_cookie = 0;

	skel->bss->linum = 0;

}



static void print_err_line(void)

{

	if (skel->bss->linum)

		printf("bpf prog error at line %u\n", skel->bss->linum);

}



static void test_conn(void)

{

	int listen_fd = -1, cli_fd = -1, err;

	socklen_t addrlen = sizeof(srv_sa6);

	int srv_port;



	if (write_sysctl("/proc/sys/net/ipv4/tcp_syncookies", "1"))

		return;



	listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);

	if (CHECK_FAIL(listen_fd == -1))

		return;



	err = getsockname(listen_fd, (struct sockaddr *)&srv_sa6, &addrlen);

	if (CHECK(err, "getsockname(listen_fd)", "err:%d errno:%d\n", err,

		  errno))

		goto done;

	memcpy(&skel->bss->srv_sa6, &srv_sa6, sizeof(srv_sa6));

	srv_port = ntohs(srv_sa6.sin6_port);



	cli_fd = connect_to_fd(listen_fd, 0);

	if (CHECK_FAIL(cli_fd == -1))

		goto done;



	if (CHECK(skel->bss->listen_tp_sport != srv_port ||

		  skel->bss->req_sk_sport != srv_port,

		  "Unexpected sk src port",

		  "listen_tp_sport:%u req_sk_sport:%u expected:%u\n",

		  skel->bss->listen_tp_sport, skel->bss->req_sk_sport,

		  srv_port))

		goto done;



	if (CHECK(skel->bss->gen_cookie || skel->bss->recv_cookie,

		  "Unexpected syncookie states",

		  "gen_cookie:%u recv_cookie:%u\n",

		  skel->bss->gen_cookie, skel->bss->recv_cookie))

		goto done;



	CHECK(skel->bss->linum, "bpf prog detected error", "at line %u\n",

	      skel->bss->linum);



done:

	if (listen_fd != -1)

		close(listen_fd);

	if (cli_fd != -1)

		close(cli_fd);

}



static void test_syncookie(void)

{

	int listen_fd = -1, cli_fd = -1, err;

	socklen_t addrlen = sizeof(srv_sa6);

	int srv_port;



	/* Enforce syncookie mode */

	if (write_sysctl("/proc/sys/net/ipv4/tcp_syncookies", "2"))

		return;



	listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);

	if (CHECK_FAIL(listen_fd == -1))

		return;



	err = getsockname(listen_fd, (struct sockaddr *)&srv_sa6, &addrlen);

	if (CHECK(err, "getsockname(listen_fd)", "err:%d errno:%d\n", err,

		  errno))

		goto done;

	memcpy(&skel->bss->srv_sa6, &srv_sa6, sizeof(srv_sa6));

	srv_port = ntohs(srv_sa6.sin6_port);



	cli_fd = connect_to_fd(listen_fd, 0);

	if (CHECK_FAIL(cli_fd == -1))

		goto done;



	if (CHECK(skel->bss->listen_tp_sport != srv_port,

		  "Unexpected tp src port",

		  "listen_tp_sport:%u expected:%u\n",

		  skel->bss->listen_tp_sport, srv_port))

		goto done;



	if (CHECK(skel->bss->req_sk_sport,

		  "Unexpected req_sk src port",

		  "req_sk_sport:%u expected:0\n",

		   skel->bss->req_sk_sport))

		goto done;



	if (CHECK(!skel->bss->gen_cookie ||

		  skel->bss->gen_cookie != skel->bss->recv_cookie,

		  "Unexpected syncookie states",

		  "gen_cookie:%u recv_cookie:%u\n",

		  skel->bss->gen_cookie, skel->bss->recv_cookie))

		goto done;



	CHECK(skel->bss->linum, "bpf prog detected error", "at line %u\n",

	      skel->bss->linum);



done:

	if (listen_fd != -1)

		close(listen_fd);

	if (cli_fd != -1)

		close(cli_fd);

}



struct test {

	const char *desc;

	void (*run)(void);

};



#define DEF_TEST(name) { #name, test_##name }

static struct test tests[] = {

	DEF_TEST(conn),

	DEF_TEST(syncookie),

};



void test_btf_skc_cls_ingress(void)

{

	int i, err;



	skel = test_btf_skc_cls_ingress__open_and_load();

	if (CHECK(!skel, "test_btf_skc_cls_ingress__open_and_load", "failed\n"))

		return;



	err = bpf_program__pin(skel->progs.cls_ingress, PROG_PIN_FILE);

	if (CHECK(err, "bpf_program__pin",

		  "cannot pin bpf prog to %s. err:%d\n", PROG_PIN_FILE, err)) {

		test_btf_skc_cls_ingress__destroy(skel);

		return;

	}



	for (i = 0; i < ARRAY_SIZE(tests); i++) {

		if (!test__start_subtest(tests[i].desc))

			continue;



		if (prepare_netns())

			break;



		tests[i].run();



		print_err_line();

		reset_test();

	}



	bpf_program__unpin(skel->progs.cls_ingress, PROG_PIN_FILE);

	test_btf_skc_cls_ingress__destroy(skel);

}

tools/testing/selftests/bpf/progs/test_btf_skc_cls_ingress.c

0 → 100644
+174 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2020 Facebook */



#include <string.h>

#include <errno.h>

#include <netinet/in.h>

#include <linux/stddef.h>

#include <linux/bpf.h>

#include <linux/ipv6.h>

#include <linux/tcp.h>

#include <linux/if_ether.h>

#include <linux/pkt_cls.h>



#include <bpf/bpf_helpers.h>

#include <bpf/bpf_endian.h>

#include "bpf_tcp_helpers.h"



struct sockaddr_in6 srv_sa6 = {};

__u16 listen_tp_sport = 0;

__u16 req_sk_sport = 0;

__u32 recv_cookie = 0;

__u32 gen_cookie = 0;

__u32 linum = 0;



#define LOG() ({ if (!linum) linum = __LINE__; })



static void test_syncookie_helper(struct ipv6hdr *ip6h, struct tcphdr *th,

				  struct tcp_sock *tp,

				  struct __sk_buff *skb)

{

	if (th->syn) {

		__s64 mss_cookie;

		void *data_end;



		data_end = (void *)(long)(skb->data_end);



		if (th->doff * 4 != 40) {

			LOG();

			return;

		}



		if ((void *)th + 40 > data_end) {

			LOG();

			return;

		}



		mss_cookie = bpf_tcp_gen_syncookie(tp, ip6h, sizeof(*ip6h),

						   th, 40);

		if (mss_cookie < 0) {

			if (mss_cookie != -ENOENT)

				LOG();

		} else {

			gen_cookie = (__u32)mss_cookie;

		}

	} else if (gen_cookie) {

		/* It was in cookie mode */

		int ret = bpf_tcp_check_syncookie(tp, ip6h, sizeof(*ip6h),

						  th, sizeof(*th));



		if (ret < 0) {

			if (ret != -ENOENT)

				LOG();

		} else {

			recv_cookie = bpf_ntohl(th->ack_seq) - 1;

		}

	}

}



static int handle_ip6_tcp(struct ipv6hdr *ip6h, struct __sk_buff *skb)

{

	struct bpf_sock_tuple *tuple;

	struct bpf_sock *bpf_skc;

	unsigned int tuple_len;

	struct tcphdr *th;

	void *data_end;



	data_end = (void *)(long)(skb->data_end);



	th = (struct tcphdr *)(ip6h + 1);

	if (th + 1 > data_end)

		return TC_ACT_OK;



	/* Is it the testing traffic? */

	if (th->dest != srv_sa6.sin6_port)

		return TC_ACT_OK;



	tuple_len = sizeof(tuple->ipv6);

	tuple = (struct bpf_sock_tuple *)&ip6h->saddr;

	if ((void *)tuple + tuple_len > data_end) {

		LOG();

		return TC_ACT_OK;

	}



	bpf_skc = bpf_skc_lookup_tcp(skb, tuple, tuple_len,

				     BPF_F_CURRENT_NETNS, 0);

	if (!bpf_skc) {

		LOG();

		return TC_ACT_OK;

	}



	if (bpf_skc->state == BPF_TCP_NEW_SYN_RECV) {

		struct request_sock *req_sk;



		req_sk = (struct request_sock *)bpf_skc_to_tcp_request_sock(bpf_skc);

		if (!req_sk) {

			LOG();

			goto release;

		}



		if (bpf_sk_assign(skb, req_sk, 0)) {

			LOG();

			goto release;

		}



		req_sk_sport = req_sk->__req_common.skc_num;



		bpf_sk_release(req_sk);

		return TC_ACT_OK;

	} else if (bpf_skc->state == BPF_TCP_LISTEN) {

		struct tcp_sock *tp;



		tp = bpf_skc_to_tcp_sock(bpf_skc);

		if (!tp) {

			LOG();

			goto release;

		}



		if (bpf_sk_assign(skb, tp, 0)) {

			LOG();

			goto release;

		}



		listen_tp_sport = tp->inet_conn.icsk_inet.sk.__sk_common.skc_num;



		test_syncookie_helper(ip6h, th, tp, skb);

		bpf_sk_release(tp);

		return TC_ACT_OK;

	}



	if (bpf_sk_assign(skb, bpf_skc, 0))

		LOG();



release:

	bpf_sk_release(bpf_skc);

	return TC_ACT_OK;

}



SEC("classifier/ingress")

int cls_ingress(struct __sk_buff *skb)

{

	struct ipv6hdr *ip6h;

	struct ethhdr *eth;

	void *data_end;



	data_end = (void *)(long)(skb->data_end);



	eth = (struct ethhdr *)(long)(skb->data);

	if (eth + 1 > data_end)

		return TC_ACT_OK;



	if (eth->h_proto != bpf_htons(ETH_P_IPV6))

		return TC_ACT_OK;



	ip6h = (struct ipv6hdr *)(eth + 1);

	if (ip6h + 1 > data_end)

		return TC_ACT_OK;



	if (ip6h->nexthdr == IPPROTO_TCP)

		return handle_ip6_tcp(ip6h, skb);



	return TC_ACT_OK;

}



char _license[] SEC("license") = "GPL";

CRA Git | Maintained and supported by SUSTech CRA and CCSE