| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <bba86a91-e945-4ab2-825e-b915216ba3c7@linux.dev>
Date: Fri, 31 Jan 2025 17:33:58 -0800
From: Martin KaFai Lau <martin.lau@...ux.dev>
To: "Bastien Curutchet (eBPF Foundation)" <bastien.curutchet@...tlin.com>
Cc: Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>, "David S. Miller"
<davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
Jesper Dangaard Brouer <hawk@...nel.org>,
John Fastabend <john.fastabend@...il.com>,
Andrii Nakryiko <andrii@...nel.org>, Eduard Zingerman <eddyz87@...il.com>,
Song Liu <song@...nel.org>, Yonghong Song <yonghong.song@...ux.dev>,
KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>,
Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
Mykola Lysenko <mykolal@...com>, Shuah Khan <shuah@...nel.org>,
Alexis Lothore <alexis.lothore@...tlin.com>,
Thomas Petazzoni <thomas.petazzoni@...tlin.com>, netdev@...r.kernel.org,
bpf@...r.kernel.org, linux-kselftest@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next v4 12/14] selftests/bpf: test_xdp_veth: Add XDP
broadcast redirection tests
On 1/30/25 11:21 PM, Bastien Curutchet (eBPF Foundation) wrote:
> +#define BROADCAST_REDIRECT_SKEL_NB 2
> +static void xdp_veth_broadcast_redirect(u32 attach_flags, u64 redirect_flags)
> +{
> + struct prog_configuration prog_cfg[VETH_PAIRS_COUNT] = {
> + {
> + .local_name = "xdp_redirect_map_multi_prog",
> + .remote_name = "xdp_count_0",
> + .local_flags = attach_flags,
> + .remote_flags = attach_flags,
> + },
> + {
> + .local_name = "xdp_redirect_map_multi_prog",
> + .remote_name = "xdp_count_1",
> + .local_flags = attach_flags,
> + .remote_flags = attach_flags,
> + },
> + {
> + .local_name = "xdp_redirect_map_multi_prog",
> + .remote_name = "xdp_count_2",
> + .local_flags = attach_flags,
> + .remote_flags = attach_flags,
> + }
> + };
> + struct bpf_object *bpf_objs[BROADCAST_REDIRECT_SKEL_NB];
> + struct xdp_redirect_multi_kern *xdp_redirect_multi_kern;
> + struct veth_configuration net_config[VETH_PAIRS_COUNT];
> + struct xdp_redirect_map *xdp_redirect_map;
> + struct bpf_devmap_val devmap_val = {};
> + u16 protocol = ETH_P_IP;
> + int group_map;
> + int flags_map;
> + int cnt_map;
> + u64 cnt = 0;
> + int i, err;
> +
> + xdp_redirect_multi_kern = xdp_redirect_multi_kern__open_and_load();
> + if (!ASSERT_OK_PTR(xdp_redirect_multi_kern, "xdp_redirect_multi_kern__open_and_load"))
> + return;
> +
> + xdp_redirect_map = xdp_redirect_map__open_and_load();
> + if (!ASSERT_OK_PTR(xdp_redirect_map, "xdp_redirect_map__open_and_load"))
> + goto destroy_xdp_redirect_multi_kern;
> +
> + if (!ASSERT_OK(create_network(net_config), "create network"))
> + goto destroy_xdp_redirect_map;
> +
> + group_map = bpf_map__fd(xdp_redirect_multi_kern->maps.map_all);
> + if (!ASSERT_OK_FD(group_map, "open map_all"))
> + goto destroy_xdp_redirect_map;
> +
> + flags_map = bpf_map__fd(xdp_redirect_multi_kern->maps.redirect_flags);
> + if (!ASSERT_OK_FD(group_map, "open map_all"))
> + goto destroy_xdp_redirect_map;
> +
> + err = bpf_map_update_elem(flags_map, &protocol, &redirect_flags, BPF_NOEXIST);
> + if (!ASSERT_OK(err, "init IP count"))
> + goto destroy_xdp_redirect_map;
> +
> + cnt_map = bpf_map__fd(xdp_redirect_map->maps.rxcnt);
> + if (!ASSERT_OK_FD(cnt_map, "open rxcnt map"))
> + goto destroy_xdp_redirect_map;
> +
> + bpf_objs[0] = xdp_redirect_multi_kern->obj;
> + bpf_objs[1] = xdp_redirect_map->obj;
> + for (i = 0; i < VETH_PAIRS_COUNT; i++) {
> + int ifindex = if_nametoindex(net_config[i].local_veth);
> +
> + if (attach_programs_to_veth_pair(bpf_objs, BROADCAST_REDIRECT_SKEL_NB,
> + net_config, prog_cfg, i))
> + goto destroy_xdp_redirect_map;
> +
> + SYS(destroy_xdp_redirect_map,
> + "ip -n %s neigh add %s lladdr 00:00:00:00:00:01 dev %s",
> + net_config[i].namespace, IP_NEIGH, net_config[i].remote_veth);
> +
> + devmap_val.ifindex = ifindex;
> + err = bpf_map_update_elem(group_map, &ifindex, &devmap_val, 0);
I ran this test in a loop and failed at this line permanently (errno E2BIG -7)
after enough iterations. I believe the problem is the group_map (aka "map_all"
in the BPF program) has a max_entries 1024 and ifindex can go beyond 1024 after
some "./test_progs" iterations. Understood that it is likely an existing
assumption in the "map_all" definition but it needs to be addressed first before
moving to test_progs.
> + if (!ASSERT_OK(err, "bpf_map_update_elem"))
> + goto destroy_xdp_redirect_map;
> +
> + }
> +
> + SYS_NOFAIL("ip netns exec %s ping %s -i 0.1 -c 4 -W1 > /dev/null ",
> + net_config[0].namespace, IP_NEIGH);
> +
> + for (i = 0; i < VETH_PAIRS_COUNT; i++) {
> + err = bpf_map_lookup_elem(cnt_map, &i, &cnt);
> + if (!ASSERT_OK(err, "get IP cnt"))
> + goto destroy_xdp_redirect_map;
> +
> + if (redirect_flags & BPF_F_EXCLUDE_INGRESS)
> + /* veth11 shouldn't receive the ICMP requests;
> + * others should
> + */
> + ASSERT_EQ(cnt, i ? 4 : 0, "compare IP cnt");
> + else
> + /* All remote veth should receive the ICMP requests */
> + ASSERT_EQ(cnt, 4, "compare IP cnt");
> + }
> +
> +destroy_xdp_redirect_map:
> + xdp_redirect_map__destroy(xdp_redirect_map);
> +destroy_xdp_redirect_multi_kern:
> + xdp_redirect_multi_kern__destroy(xdp_redirect_multi_kern);
> +
> + cleanup_network(net_config);
> +}
> +
> void test_xdp_veth_redirect(void)
> {
> if (test__start_subtest("0"))
> @@ -284,3 +411,26 @@ void test_xdp_veth_redirect(void)
> if (test__start_subtest("SKB_MODE"))
> xdp_veth_redirect(XDP_FLAGS_SKB_MODE);
> }
> +
> +void test_xdp_veth_broadcast_redirect(void)
> +{
> + if (test__start_subtest("0/BROADCAST"))
> + xdp_veth_broadcast_redirect(0, BPF_F_BROADCAST);
> +
> + if (test__start_subtest("0/(BROADCAST | EXCLUDE_INGRESS)"))
> + xdp_veth_broadcast_redirect(0, BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS);
> +
> + if (test__start_subtest("DRV_MODE/BROADCAST"))
> + xdp_veth_broadcast_redirect(XDP_FLAGS_DRV_MODE, BPF_F_BROADCAST);
> +
> + if (test__start_subtest("DRV_MODE/(BROADCAST | EXCLUDE_INGRESS)"))
> + xdp_veth_broadcast_redirect(XDP_FLAGS_DRV_MODE,
> + BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS);
> +
> + if (test__start_subtest("SKB_MODE/BROADCAST"))
> + xdp_veth_broadcast_redirect(XDP_FLAGS_SKB_MODE, BPF_F_BROADCAST);
> +
> + if (test__start_subtest("SKB_MODE/(BROADCAST | EXCLUDE_INGRESS)"))
> + xdp_veth_broadcast_redirect(XDP_FLAGS_SKB_MODE,
> + BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/xdp_redirect_map.c b/tools/testing/selftests/bpf/progs/xdp_redirect_map.c
> index 682dda8dabbc9abbb5d1b0b22dd5f81124142e79..14385df71d7fc40c3b0ee5c6ea0760d0e7336d71 100644
> --- a/tools/testing/selftests/bpf/progs/xdp_redirect_map.c
> +++ b/tools/testing/selftests/bpf/progs/xdp_redirect_map.c
> @@ -1,7 +1,11 @@
> // SPDX-License-Identifier: GPL-2.0
>
> +#include <linux/if_ether.h>
> +#include <linux/ip.h>
I have compiler error complaining about __always_inline not defined. Likely
ordering issue and environment specific. Regardless, I believe the ip.h is
unnecessary, so better clean it up.
I am going to land the patch 1-10 and change the cover letter a little to
reflect the fact that patch 11-14 will be a followup. Please post the remaining
patches after fixing the bpf_map_update_elem issue. Thanks.
> +
> #include <linux/bpf.h>
> #include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_endian.h>
>
> struct {
> __uint(type, BPF_MAP_TYPE_DEVMAP);
> @@ -28,4 +32,49 @@ int xdp_redirect_map_2(struct xdp_md *xdp)
> return bpf_redirect_map(&tx_port, 2, 0);
> }
>
> +struct {
> + __uint(type, BPF_MAP_TYPE_ARRAY);
> + __uint(max_entries, 3);
> + __type(key, __u32);
> + __type(value, __u64);
> +} rxcnt SEC(".maps");
> +
> +static int xdp_count(struct xdp_md *xdp, __u32 key)
> +{
> + void *data_end = (void *)(long)xdp->data_end;
> + void *data = (void *)(long)xdp->data;
> + struct ethhdr *eth = data;
> + __u64 *count;
> +
> + if (data + sizeof(*eth) > data_end)
> + return XDP_DROP;
> +
> + if (bpf_htons(eth->h_proto) == ETH_P_IP) {
> + /* We only count IPv4 packets */
> + count = bpf_map_lookup_elem(&rxcnt, &key);
> + if (count)
> + *count += 1;
> + }
> +
> + return XDP_PASS;
> +}
> +
> +SEC("xdp")
> +int xdp_count_0(struct xdp_md *xdp)
> +{
> + return xdp_count(xdp, 0);
> +}
> +
> +SEC("xdp")
> +int xdp_count_1(struct xdp_md *xdp)
> +{
> + return xdp_count(xdp, 1);
> +}
> +
> +SEC("xdp")
> +int xdp_count_2(struct xdp_md *xdp)
> +{
> + return xdp_count(xdp, 2);
> +}
> +
> char _license[] SEC("license") = "GPL";
>
Powered by blists - more mailing lists