netdev - Re: [PATCH bpf-next 2/2] selftest/bpf: remove unused bpf tunnel testing code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201106073035.w2x4szk7m6nkx5yj@kafai-mbp.dhcp.thefacebook.com>
Date:   Thu, 5 Nov 2020 23:30:35 -0800
From:   Martin KaFai Lau <kafai@...com>
To:     Hangbin Liu <liuhangbin@...il.com>
CC:     <netdev@...r.kernel.org>, William Tu <u9012063@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>, <bpf@...r.kernel.org>
Subject: Re: [PATCH bpf-next 2/2] selftest/bpf: remove unused bpf tunnel
 testing code

On Tue, Nov 03, 2020 at 12:29:08PM +0800, Hangbin Liu wrote:
> In comment 173ca26e9b51 ("samples/bpf: add comprehensive ipip, ipip6,
> ip6ip6 test") we added some bpf tunnel tests. In commit 933a741e3b82
> ("selftests/bpf: bpf tunnel test.") when we moved it to the current
> folder, we forgot to remove test_ipip.sh in sample folder.
> 
> Since we simplify the original ipip tests and removed iperf tests, there
> is not need for TCP checks. ip6ip6 and ipip6 are using the same underlay
> network, we can remove ip6ip6 section too.
> 
> Signed-off-by: Hangbin Liu <liuhangbin@...il.com>
[ ... ]

> @@ -585,12 +571,11 @@ int _ipip6_set_tunnel(struct __sk_buff *skb)
>  	struct bpf_tunnel_key key = {};
>  	void *data = (void *)(long)skb->data;
>  	struct iphdr *iph = data;
v4 hdr here.

> -	struct tcphdr *tcp = data + sizeof(*iph);
>  	void *data_end = (void *)(long)skb->data_end;
>  	int ret;
>  
>  	/* single length check */
> -	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
> +	if (data + sizeof(*iph) > data_end) {
>  		ERROR(1);
>  		return TC_ACT_SHOT;
>  	}
> @@ -628,72 +613,6 @@ int _ipip6_get_tunnel(struct __sk_buff *skb)
>  	return TC_ACT_OK;
>  }
>  
> -SEC("ip6ip6_set_tunnel")
> -int _ip6ip6_set_tunnel(struct __sk_buff *skb)
> -{
> -	struct bpf_tunnel_key key = {};
> -	void *data = (void *)(long)skb->data;
> -	struct ipv6hdr *iph = data;
IIUC, the patch is to replace _ip6ip6_set_tunnel with _ipip6_set_tunnel.

Are they testing the same thing?  At least, _ip6ip6_set_tunnel()
is expecting a v6 hdr here.

> -	struct tcphdr *tcp = data + sizeof(*iph);
> -	void *data_end = (void *)(long)skb->data_end;
> -	int ret;
> -
> -	/* single length check */
> -	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
> -		ERROR(1);
> -		return TC_ACT_SHOT;
> -	}
> -
> -	key.remote_ipv6[0] = bpf_htonl(0x2401db00);
> -	key.tunnel_ttl = 64;
> -
> -	if (iph->nexthdr == 58 /* NEXTHDR_ICMP */) {
> -		key.remote_ipv6[3] = bpf_htonl(1);
> -	} else {
> -		if (iph->nexthdr != 6 /* NEXTHDR_TCP */) {
> -			ERROR(iph->nexthdr);
> -			return TC_ACT_SHOT;
> -		}
> -
> -		if (tcp->dest == bpf_htons(5200)) {
> -			key.remote_ipv6[3] = bpf_htonl(1);
> -		} else if (tcp->dest == bpf_htons(5201)) {
> -			key.remote_ipv6[3] = bpf_htonl(2);
> -		} else {
> -			ERROR(tcp->dest);
> -			return TC_ACT_SHOT;
> -		}
> -	}
> -
> -	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
> -				     BPF_F_TUNINFO_IPV6);
> -	if (ret < 0) {
> -		ERROR(ret);
> -		return TC_ACT_SHOT;
> -	}
> -
> -	return TC_ACT_OK;
> -}