Commit d1ba1204 authored by Jakub Sitnicki's avatar Jakub Sitnicki Committed by Daniel Borkmann
Browse files

selftests/bpf: Test unhashing kTLS socket after removing from map 



When a TCP socket gets inserted into a sockmap, its sk_prot callbacks get
replaced with tcp_bpf callbacks built from regular tcp callbacks. If TLS
gets enabled on the same socket, sk_prot callbacks get replaced once again,
this time with kTLS callbacks built from tcp_bpf callbacks.

Now, we allow removing a socket from a sockmap that has kTLS enabled. After
removal, socket remains with kTLS configured. This is where things things
get tricky.

Since the socket has a set of sk_prot callbacks that are a mix of kTLS and
tcp_bpf callbacks, we need to restore just the tcp_bpf callbacks to the
original ones. At the moment, it comes down to the the unhash operation.

We had a regression recently because tcp_bpf callbacks were not cleared in
this particular scenario of removing a kTLS socket from a sockmap. It got
fixed in commit 4da6a196 ("bpf: Sockmap/tls, during free we may call
tcp_bpf_unhash() in loop").

Add a test that triggers the regression so that we don't reintroduce it in
the future.

Signed-off-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20200217121530.754315-4-jakub@cloudflare.com
parent a178b458

tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c

0 → 100644
+123 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

// Copyright (c) 2020 Cloudflare

/*

 * Tests for sockmap/sockhash holding kTLS sockets.

 */



#include "test_progs.h"



#define MAX_TEST_NAME 80



static int tcp_server(int family)

{

	int err, s;



	s = socket(family, SOCK_STREAM, 0);

	if (CHECK_FAIL(s == -1)) {

		perror("socket");

		return -1;

	}



	err = listen(s, SOMAXCONN);

	if (CHECK_FAIL(err)) {

		perror("listen");

		return -1;

	}



	return s;

}



static int disconnect(int fd)

{

	struct sockaddr unspec = { AF_UNSPEC };



	return connect(fd, &unspec, sizeof(unspec));

}



/* Disconnect (unhash) a kTLS socket after removing it from sockmap. */

static void test_sockmap_ktls_disconnect_after_delete(int family, int map)

{

	struct sockaddr_storage addr = {0};

	socklen_t len = sizeof(addr);

	int err, cli, srv, zero = 0;



	srv = tcp_server(family);

	if (srv == -1)

		return;



	err = getsockname(srv, (struct sockaddr *)&addr, &len);

	if (CHECK_FAIL(err)) {

		perror("getsockopt");

		goto close_srv;

	}



	cli = socket(family, SOCK_STREAM, 0);

	if (CHECK_FAIL(cli == -1)) {

		perror("socket");

		goto close_srv;

	}



	err = connect(cli, (struct sockaddr *)&addr, len);

	if (CHECK_FAIL(err)) {

		perror("connect");

		goto close_cli;

	}



	err = bpf_map_update_elem(map, &zero, &cli, 0);

	if (CHECK_FAIL(err)) {

		perror("bpf_map_update_elem");

		goto close_cli;

	}



	err = setsockopt(cli, IPPROTO_TCP, TCP_ULP, "tls", strlen("tls"));

	if (CHECK_FAIL(err)) {

		perror("setsockopt(TCP_ULP)");

		goto close_cli;

	}



	err = bpf_map_delete_elem(map, &zero);

	if (CHECK_FAIL(err)) {

		perror("bpf_map_delete_elem");

		goto close_cli;

	}



	err = disconnect(cli);

	if (CHECK_FAIL(err))

		perror("disconnect");



close_cli:

	close(cli);

close_srv:

	close(srv);

}



static void run_tests(int family, enum bpf_map_type map_type)

{

	char test_name[MAX_TEST_NAME];

	int map;



	map = bpf_create_map(map_type, sizeof(int), sizeof(int), 1, 0);

	if (CHECK_FAIL(map == -1)) {

		perror("bpf_map_create");

		return;

	}



	snprintf(test_name, MAX_TEST_NAME,

		 "sockmap_ktls disconnect_after_delete %s %s",

		 family == AF_INET ? "IPv4" : "IPv6",

		 map_type == BPF_MAP_TYPE_SOCKMAP ? "SOCKMAP" : "SOCKHASH");

	if (!test__start_subtest(test_name))

		return;



	test_sockmap_ktls_disconnect_after_delete(family, map);



	close(map);

}



void test_sockmap_ktls(void)

{

	run_tests(AF_INET, BPF_MAP_TYPE_SOCKMAP);

	run_tests(AF_INET, BPF_MAP_TYPE_SOCKHASH);

	run_tests(AF_INET6, BPF_MAP_TYPE_SOCKMAP);

	run_tests(AF_INET6, BPF_MAP_TYPE_SOCKHASH);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE