From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org
Cc: "Martin KaFai Lau" <kafai@fb.com>,
"Song Liu" <songliubraving@fb.com>, "Yonghong Song" <yhs@fb.com>,
"John Fastabend" <john.fastabend@gmail.com>,
"Maxim Mikityanskiy" <maximmi@nvidia.com>,
"Pablo Neira Ayuso" <pablo@netfilter.org>,
"Florian Westphal" <fw@strlen.de>,
"Jesper Dangaard Brouer" <brouer@redhat.com>,
"Toke Høiland-Jørgensen" <toke@redhat.com>
Subject: [PATCH bpf-next v6 08/11] selftests/bpf: Add test for unstable CT lookup API
Date: Sun, 2 Jan 2022 21:51:12 +0530 [thread overview]
Message-ID: <20220102162115.1506833-9-memxor@gmail.com> (raw)
In-Reply-To: <20220102162115.1506833-1-memxor@gmail.com>
This tests that we return errors as documented, and also that the kfunc
calls work from both XDP and TC hooks.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
tools/testing/selftests/bpf/config | 4 +
.../testing/selftests/bpf/prog_tests/bpf_nf.c | 48 ++++++++
.../testing/selftests/bpf/progs/test_bpf_nf.c | 105 ++++++++++++++++++
3 files changed, 157 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/bpf_nf.c
create mode 100644 tools/testing/selftests/bpf/progs/test_bpf_nf.c
diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config
index f6287132fa89..32d80e77e910 100644
--- a/tools/testing/selftests/bpf/config
+++ b/tools/testing/selftests/bpf/config
@@ -48,3 +48,7 @@ CONFIG_IMA_READ_POLICY=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_FUNCTION_TRACER=y
CONFIG_DYNAMIC_FTRACE=y
+CONFIG_NETFILTER=y
+CONFIG_NF_DEFRAG_IPV4=y
+CONFIG_NF_DEFRAG_IPV6=y
+CONFIG_NF_CONNTRACK=y
diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
new file mode 100644
index 000000000000..e3166a81e989
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include <network_helpers.h>
+#include "test_bpf_nf.skel.h"
+
+enum {
+ TEST_XDP,
+ TEST_TC_BPF,
+};
+
+void test_bpf_nf_ct(int mode)
+{
+ struct test_bpf_nf *skel;
+ int prog_fd, err, retval;
+
+ skel = test_bpf_nf__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "test_bpf_nf__open_and_load"))
+ return;
+
+ if (mode == TEST_XDP)
+ prog_fd = bpf_program__fd(skel->progs.nf_xdp_ct_test);
+ else
+ prog_fd = bpf_program__fd(skel->progs.nf_skb_ct_test);
+
+ err = bpf_prog_test_run(prog_fd, 1, &pkt_v4, sizeof(pkt_v4), NULL, NULL,
+ (__u32 *)&retval, NULL);
+ if (!ASSERT_OK(err, "bpf_prog_test_run"))
+ goto end;
+
+ ASSERT_EQ(skel->bss->test_einval_bpf_tuple, -EINVAL, "Test EINVAL for NULL bpf_tuple");
+ ASSERT_EQ(skel->bss->test_einval_reserved, -EINVAL, "Test EINVAL for reserved not set to 0");
+ ASSERT_EQ(skel->bss->test_einval_netns_id, -EINVAL, "Test EINVAL for netns_id < -1");
+ ASSERT_EQ(skel->bss->test_einval_len_opts, -EINVAL, "Test EINVAL for len__opts != NF_BPF_CT_OPTS_SZ");
+ ASSERT_EQ(skel->bss->test_eproto_l4proto, -EPROTO, "Test EPROTO for l4proto != TCP or UDP");
+ ASSERT_EQ(skel->bss->test_enonet_netns_id, -ENONET, "Test ENONET for bad but valid netns_id");
+ ASSERT_EQ(skel->bss->test_enoent_lookup, -ENOENT, "Test ENOENT for failed lookup");
+ ASSERT_EQ(skel->bss->test_eafnosupport, -EAFNOSUPPORT, "Test EAFNOSUPPORT for invalid len__tuple");
+end:
+ test_bpf_nf__destroy(skel);
+}
+
+void test_bpf_nf(void)
+{
+ if (test__start_subtest("xdp-ct"))
+ test_bpf_nf_ct(TEST_XDP);
+ if (test__start_subtest("tc-bpf-ct"))
+ test_bpf_nf_ct(TEST_TC_BPF);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c b/tools/testing/selftests/bpf/progs/test_bpf_nf.c
new file mode 100644
index 000000000000..d6d4002ad69c
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c
@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+
+#define EAFNOSUPPORT 97
+#define EPROTO 71
+#define ENONET 64
+#define EINVAL 22
+#define ENOENT 2
+
+int test_einval_bpf_tuple = 0;
+int test_einval_reserved = 0;
+int test_einval_netns_id = 0;
+int test_einval_len_opts = 0;
+int test_eproto_l4proto = 0;
+int test_enonet_netns_id = 0;
+int test_enoent_lookup = 0;
+int test_eafnosupport = 0;
+
+struct nf_conn *bpf_xdp_ct_lookup(struct xdp_md *, struct bpf_sock_tuple *, u32,
+ struct bpf_ct_opts *, u32) __ksym;
+struct nf_conn *bpf_skb_ct_lookup(struct __sk_buff *, struct bpf_sock_tuple *, u32,
+ struct bpf_ct_opts *, u32) __ksym;
+void bpf_ct_release(struct nf_conn *) __ksym;
+
+#define nf_ct_test(func, ctx) \
+ ({ \
+ struct bpf_ct_opts opts_def = { .l4proto = IPPROTO_TCP, \
+ .netns_id = -1 }; \
+ struct bpf_sock_tuple bpf_tuple; \
+ struct nf_conn *ct; \
+ __builtin_memset(&bpf_tuple, 0, sizeof(bpf_tuple.ipv4)); \
+ ct = func(ctx, NULL, 0, &opts_def, sizeof(opts_def)); \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_einval_bpf_tuple = opts_def.error; \
+ opts_def.reserved[0] = 1; \
+ ct = func(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, \
+ sizeof(opts_def)); \
+ opts_def.reserved[0] = 0; \
+ opts_def.l4proto = IPPROTO_TCP; \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_einval_reserved = opts_def.error; \
+ opts_def.netns_id = -2; \
+ ct = func(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, \
+ sizeof(opts_def)); \
+ opts_def.netns_id = -1; \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_einval_netns_id = opts_def.error; \
+ ct = func(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, \
+ sizeof(opts_def) - 1); \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_einval_len_opts = opts_def.error; \
+ opts_def.l4proto = IPPROTO_ICMP; \
+ ct = func(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, \
+ sizeof(opts_def)); \
+ opts_def.l4proto = IPPROTO_TCP; \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_eproto_l4proto = opts_def.error; \
+ opts_def.netns_id = 0xf00f; \
+ ct = func(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, \
+ sizeof(opts_def)); \
+ opts_def.netns_id = -1; \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_enonet_netns_id = opts_def.error; \
+ ct = func(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, \
+ sizeof(opts_def)); \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_enoent_lookup = opts_def.error; \
+ ct = func(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4) - 1, \
+ &opts_def, sizeof(opts_def)); \
+ if (ct) \
+ bpf_ct_release(ct); \
+ else \
+ test_eafnosupport = opts_def.error; \
+ })
+
+SEC("xdp")
+int nf_xdp_ct_test(struct xdp_md *ctx)
+{
+ nf_ct_test(bpf_xdp_ct_lookup, ctx);
+ return 0;
+}
+
+SEC("tc")
+int nf_skb_ct_test(struct __sk_buff *ctx)
+{
+ nf_ct_test(bpf_skb_ct_lookup, ctx);
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.34.1
next prev parent reply other threads:[~2022-01-02 16:21 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-02 16:21 [PATCH bpf-next v6 00/11] Introduce unstable CT lookup helpers Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 01/11] kernel: Implement try_module_get_live Kumar Kartikeya Dwivedi
2022-01-25 18:50 ` Luis Chamberlain
2022-01-02 16:21 ` [PATCH bpf-next v6 02/11] bpf: Fix UAF due to race between btf_try_get_module and load_module Kumar Kartikeya Dwivedi
2022-01-05 6:10 ` Alexei Starovoitov
2022-01-06 8:46 ` Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 03/11] bpf: Populate kfunc BTF ID sets in struct btf Kumar Kartikeya Dwivedi
2022-01-05 6:19 ` Alexei Starovoitov
2022-01-06 8:59 ` Kumar Kartikeya Dwivedi
2022-01-06 23:40 ` Alexei Starovoitov
2022-01-07 6:26 ` Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 04/11] bpf: Remove check_kfunc_call callback and old kfunc BTF ID API Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 05/11] bpf: Introduce mem, size argument pair support for kfunc Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 06/11] bpf: Add reference tracking support to kfunc Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 07/11] net/netfilter: Add unstable CT lookup helpers for XDP and TC-BPF Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` Kumar Kartikeya Dwivedi [this message]
2022-01-02 16:21 ` [PATCH bpf-next v6 09/11] selftests/bpf: Add test_verifier support to fixup kfunc call insns Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 10/11] selftests/bpf: Extend kfunc selftests Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 11/11] selftests/bpf: Add test for race in btf_try_get_module Kumar Kartikeya Dwivedi
2022-01-05 6:20 ` Alexei Starovoitov
2022-01-06 9:04 ` Kumar Kartikeya Dwivedi
2022-01-06 19:39 ` Andrii Nakryiko
2022-01-07 7:22 ` Kumar Kartikeya Dwivedi
2022-01-07 20:10 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220102162115.1506833-9-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brouer@redhat.com \
--cc=daniel@iogearbox.net \
--cc=fw@strlen.de \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=maximmi@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=songliubraving@fb.com \
--cc=toke@redhat.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.