| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <87o8e7gypg.fsf@toke.dk>
Date: Wed, 21 Apr 2021 22:38:35 +0200
From: Toke Høiland-Jørgensen <toke@...hat.com>
To: Kumar Kartikeya Dwivedi <memxor@...il.com>,
Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc: bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>,
"David S. Miller" <davem@...emloft.net>,
Jakub Kicinski <kuba@...nel.org>,
Jesper Dangaard Brouer <brouer@...hat.com>,
Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH bpf-next v3 3/3] libbpf: add selftests for TC-BPF API
Kumar Kartikeya Dwivedi <memxor@...il.com> writes:
> On Wed, Apr 21, 2021 at 11:54:18PM IST, Andrii Nakryiko wrote:
>> On Tue, Apr 20, 2021 at 12:37 PM Kumar Kartikeya Dwivedi
>> <memxor@...il.com> wrote:
>> >
>> > This adds some basic tests for the low level bpf_tc_* API.
>> >
>> > Reviewed-by: Toke Høiland-Jørgensen <toke@...hat.com>
>> > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@...il.com>
>> > ---
>> > .../selftests/bpf/prog_tests/test_tc_bpf.c | 169 ++++++++++++++++++
>> > .../selftests/bpf/progs/test_tc_bpf_kern.c | 12 ++
>> > 2 files changed, 181 insertions(+)
>> > create mode 100644 tools/testing/selftests/bpf/prog_tests/test_tc_bpf.c
>>
>> we normally don't call prog_test's files with "test_" prefix, it can
>> be just tc_bpf.c (or just tc.c)
>>
>
> Ok, will rename.
>
>> > create mode 100644 tools/testing/selftests/bpf/progs/test_tc_bpf_kern.c
>>
>> we also don't typically call BPF source code files with _kern suffix,
>> just test_tc_bpf.c would be more in line with most common case
>>
>
> Will rename.
>
>> >
>> > diff --git a/tools/testing/selftests/bpf/prog_tests/test_tc_bpf.c b/tools/testing/selftests/bpf/prog_tests/test_tc_bpf.c
>> > new file mode 100644
>> > index 000000000000..563a3944553c
>> > --- /dev/null
>> > +++ b/tools/testing/selftests/bpf/prog_tests/test_tc_bpf.c
>> > @@ -0,0 +1,169 @@
>> > +// SPDX-License-Identifier: GPL-2.0
>> > +
>> > +#include <linux/bpf.h>
>> > +#include <linux/err.h>
>> > +#include <linux/limits.h>
>> > +#include <bpf/libbpf.h>
>> > +#include <errno.h>
>> > +#include <stdio.h>
>> > +#include <stdlib.h>
>> > +#include <test_progs.h>
>> > +#include <linux/if_ether.h>
>> > +
>> > +#define LO_IFINDEX 1
>> > +
>> > +static int test_tc_internal(int fd, __u32 parent_id)
>> > +{
>> > + DECLARE_LIBBPF_OPTS(bpf_tc_opts, opts, .handle = 1, .priority = 10,
>> > + .class_id = TC_H_MAKE(1UL << 16, 1));
>> > + struct bpf_tc_attach_id id = {};
>> > + struct bpf_tc_info info = {};
>> > + int ret;
>> > +
>> > + ret = bpf_tc_attach(fd, LO_IFINDEX, parent_id, &opts, &id);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_attach"))
>> > + return ret;
>> > +
>> > + ret = bpf_tc_get_info(LO_IFINDEX, parent_id, &id, &info);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_get_info"))
>> > + goto end;
>> > +
>> > + if (!ASSERT_EQ(info.id.handle, id.handle, "handle mismatch") ||
>> > + !ASSERT_EQ(info.id.priority, id.priority, "priority mismatch") ||
>> > + !ASSERT_EQ(info.id.handle, 1, "handle incorrect") ||
>> > + !ASSERT_EQ(info.chain_index, 0, "chain_index incorrect") ||
>> > + !ASSERT_EQ(info.id.priority, 10, "priority incorrect") ||
>> > + !ASSERT_EQ(info.class_id, TC_H_MAKE(1UL << 16, 1),
>> > + "class_id incorrect") ||
>> > + !ASSERT_EQ(info.protocol, ETH_P_ALL, "protocol incorrect"))
>> > + goto end;
>> > +
>> > + opts.replace = true;
>> > + ret = bpf_tc_attach(fd, LO_IFINDEX, parent_id, &opts, &id);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_attach in replace mode"))
>> > + return ret;
>> > +
>> > + /* Demonstrate changing attributes */
>> > + opts.class_id = TC_H_MAKE(1UL << 16, 2);
>> > +
>> > + ret = bpf_tc_attach(fd, LO_IFINDEX, parent_id, &opts, &id);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc attach in replace mode"))
>> > + goto end;
>> > +
>> > + ret = bpf_tc_get_info(LO_IFINDEX, parent_id, &id, &info);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_get_info"))
>> > + goto end;
>> > +
>> > + if (!ASSERT_EQ(info.class_id, TC_H_MAKE(1UL << 16, 2),
>> > + "class_id incorrect after replace"))
>> > + goto end;
>> > + if (!ASSERT_EQ(info.bpf_flags & TCA_BPF_FLAG_ACT_DIRECT, 1,
>> > + "direct action mode not set"))
>> > + goto end;
>> > +
>> > +end:
>> > + ret = bpf_tc_detach(LO_IFINDEX, parent_id, &id);
>> > + ASSERT_EQ(ret, 0, "detach failed");
>> > + return ret;
>> > +}
>> > +
>> > +int test_tc_info(int fd)
>> > +{
>> > + DECLARE_LIBBPF_OPTS(bpf_tc_opts, opts, .handle = 1, .priority = 10,
>> > + .class_id = TC_H_MAKE(1UL << 16, 1));
>> > + struct bpf_tc_attach_id id = {}, old;
>> > + struct bpf_tc_info info = {};
>> > + int ret;
>> > +
>> > + ret = bpf_tc_attach(fd, LO_IFINDEX, BPF_TC_CLSACT_INGRESS, &opts, &id);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_attach"))
>> > + return ret;
>> > + old = id;
>> > +
>> > + ret = bpf_tc_get_info(LO_IFINDEX, BPF_TC_CLSACT_INGRESS, &id, &info);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_get_info"))
>> > + goto end_old;
>> > +
>> > + if (!ASSERT_EQ(info.id.handle, id.handle, "handle mismatch") ||
>> > + !ASSERT_EQ(info.id.priority, id.priority, "priority mismatch") ||
>> > + !ASSERT_EQ(info.id.handle, 1, "handle incorrect") ||
>> > + !ASSERT_EQ(info.chain_index, 0, "chain_index incorrect") ||
>> > + !ASSERT_EQ(info.id.priority, 10, "priority incorrect") ||
>> > + !ASSERT_EQ(info.class_id, TC_H_MAKE(1UL << 16, 1),
>> > + "class_id incorrect") ||
>> > + !ASSERT_EQ(info.protocol, ETH_P_ALL, "protocol incorrect"))
>> > + goto end_old;
>> > +
>> > + /* choose a priority */
>> > + opts.priority = 0;
>> > + ret = bpf_tc_attach(fd, LO_IFINDEX, BPF_TC_CLSACT_INGRESS, &opts, &id);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_attach"))
>> > + goto end_old;
>> > +
>> > + ret = bpf_tc_get_info(LO_IFINDEX, BPF_TC_CLSACT_INGRESS, &id, &info);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_tc_get_info"))
>> > + goto end;
>> > +
>> > + if (!ASSERT_NEQ(id.priority, old.priority, "filter priority mismatch"))
>> > + goto end;
>> > + if (!ASSERT_EQ(info.id.priority, id.priority, "priority mismatch"))
>> > + goto end;
>> > +
>> > +end:
>> > + ret = bpf_tc_detach(LO_IFINDEX, BPF_TC_CLSACT_INGRESS, &id);
>> > + ASSERT_EQ(ret, 0, "detach failed");
>> > +end_old:
>> > + ret = bpf_tc_detach(LO_IFINDEX, BPF_TC_CLSACT_INGRESS, &old);
>> > + ASSERT_EQ(ret, 0, "detach failed");
>> > + return ret;
>> > +}
>> > +
>> > +void test_test_tc_bpf(void)
>>
>> test_test_ tautology, drop one test?
>>
>
> Ok.
>
>> > +{
>> > + const char *file = "./test_tc_bpf_kern.o";
>>
>> please use BPF skeleton instead, see lots of other selftests doing
>> that already. You won't even need find_program_by_{name,title}, among
>> other things.
>>
>
> Sounds good, will change.
>
>> > + struct bpf_program *clsp;
>> > + struct bpf_object *obj;
>> > + int cls_fd, ret;
>> > +
>> > + obj = bpf_object__open(file);
>> > + if (!ASSERT_OK_PTR(obj, "bpf_object__open"))
>> > + return;
>> > +
>> > + clsp = bpf_object__find_program_by_title(obj, "classifier");
>> > + if (!ASSERT_OK_PTR(clsp, "bpf_object__find_program_by_title"))
>> > + goto end;
>> > +
>> > + ret = bpf_object__load(obj);
>> > + if (!ASSERT_EQ(ret, 0, "bpf_object__load"))
>> > + goto end;
>> > +
>> > + cls_fd = bpf_program__fd(clsp);
>> > +
>> > + system("tc qdisc del dev lo clsact");
>>
>> can this fail? also why is this necessary? it's still not possible to
>
> This is just removing any existing clsact qdisc since it will be setup by the
> attach call, which is again removed later (where we do check if it fails, if it
> does clsact qdisc was not setup, and something was wrong in that it returned 0
> when the attach point was one of the clsact hooks).
>
> We don't care about failure initially, since if it isn't present we'd just move
> on to running the test.
>
>> do anything with only libbpf APIs?
>>
>
> I don't think so, I can do the qdisc teardown using netlink in the selftest,
> but that would mean duplicating a lot of code. I think expecting tc to be
> present on the system is a reasonable assumption for this test.
So this stems from the fact that bpf_tc_detach() doesn't clean up the
clsact qdisc that is added by bpf_tc_attach(). I think we should fix
this.
Andrii, Kumar and I discussed this, and concluded that the best we can
do from userspace right now is query the number of filters before remove
and if there's only one, also remove the clsact qdisc. This is racy in
that a new filter can be attached between the check and the remove, but
to fix that we need a way for the filter to take the ref on the qdisc.
Since something like this will be needed for a bpf_link attach mode as
well, we figured that can be added as part of such a series, and we'll
just do the best-effort thing now. WDYT?
-Toke
Powered by blists - more mailing lists