linux-kernel - Re: [PATCH bpf-next v5 3/4] selftests/bpf: Integrate the socket_cookie test to test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Jan 2021 23:55:07 -0800
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Florent Revest <revest@...omium.org>
Cc:     bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        KP Singh <kpsingh@...omium.org>,
        Florent Revest <revest@...gle.com>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next v5 3/4] selftests/bpf: Integrate the
 socket_cookie test to test_progs

On Tue, Jan 19, 2021 at 8:00 AM Florent Revest <revest@...omium.org> wrote:
>
> Currently, the selftest for the BPF socket_cookie helpers is built and
> run independently from test_progs. It's easy to forget and hard to
> maintain.
>
> This patch moves the socket cookies test into prog_tests/ and vastly
> simplifies its logic by:
> - rewriting the loading code with BPF skeletons
> - rewriting the server/client code with network helpers
> - rewriting the cgroup code with test__join_cgroup
> - rewriting the error handling code with CHECKs
>
> Signed-off-by: Florent Revest <revest@...omium.org>
> ---

Few nits below regarding skeleton and ASSERT_xxx usage.

>  tools/testing/selftests/bpf/Makefile          |   3 +-
>  .../selftests/bpf/prog_tests/socket_cookie.c  |  82 +++++++
>  .../selftests/bpf/progs/socket_cookie_prog.c  |   2 -
>  .../selftests/bpf/test_socket_cookie.c        | 208 ------------------

please also update .gitignore

>  4 files changed, 83 insertions(+), 212 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/socket_cookie.c
>  delete mode 100644 tools/testing/selftests/bpf/test_socket_cookie.c
>

[...]

> +
> +       skel = socket_cookie_prog__open_and_load();
> +       if (CHECK(!skel, "socket_cookie_prog__open_and_load",
> +                 "skeleton open_and_load failed\n"))

nit: ASSERT_PTR_OK

> +               return;
> +
> +       cgroup_fd = test__join_cgroup("/socket_cookie");
> +       if (CHECK(cgroup_fd < 0, "join_cgroup", "cgroup creation failed\n"))
> +               goto destroy_skel;
> +
> +       set_link = bpf_program__attach_cgroup(skel->progs.set_cookie,
> +                                             cgroup_fd);

you can use skel->links->set_cookie here and it will be auto-destroyed
when the whole skeleton is destroyed. More simplification.

> +       if (CHECK(IS_ERR(set_link), "set-link-cg-attach", "err %ld\n",
> +                 PTR_ERR(set_link)))
> +               goto close_cgroup_fd;
> +
> +       update_link = bpf_program__attach_cgroup(skel->progs.update_cookie,
> +                                                cgroup_fd);

same as above, no need to maintain your link outside of skeleton


> +       if (CHECK(IS_ERR(update_link), "update-link-cg-attach", "err %ld\n",
> +                 PTR_ERR(update_link)))
> +               goto free_set_link;
> +
> +       server_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
> +       if (CHECK(server_fd < 0, "start_server", "errno %d\n", errno))
> +               goto free_update_link;
> +
> +       client_fd = connect_to_fd(server_fd, 0);
> +       if (CHECK(client_fd < 0, "connect_to_fd", "errno %d\n", errno))
> +               goto close_server_fd;

nit: ASSERT_OK is nicer (here and in few other places)

> +
> +       err = bpf_map_lookup_elem(bpf_map__fd(skel->maps.socket_cookies),
> +                                 &client_fd, &val);
> +       if (CHECK(err, "map_lookup", "err %d errno %d\n", err, errno))
> +               goto close_client_fd;
> +
> +       err = getsockname(client_fd, (struct sockaddr *)&addr, &addr_len);
> +       if (CHECK(err, "getsockname", "Can't get client local addr\n"))
> +               goto close_client_fd;
> +
> +       cookie_expected_value = (ntohs(addr.sin6_port) << 8) | 0xFF;
> +       CHECK(val.cookie_value != cookie_expected_value, "",
> +             "Unexpected value in map: %x != %x\n", val.cookie_value,
> +             cookie_expected_value);

nit: ASSERT_NEQ is nicer

> +
> +close_client_fd:
> +       close(client_fd);
> +close_server_fd:
> +       close(server_fd);
> +free_update_link:
> +       bpf_link__destroy(update_link);
> +free_set_link:
> +       bpf_link__destroy(set_link);
> +close_cgroup_fd:
> +       close(cgroup_fd);
> +destroy_skel:
> +       socket_cookie_prog__destroy(skel);
> +}

[...]