| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 14 Nov 2022 19:02:07 -0800
From: Stanislav Fomichev <sdf@...gle.com>
To: bpf@...r.kernel.org
Cc: ast@...nel.org, daniel@...earbox.net, andrii@...nel.org,
martin.lau@...ux.dev, song@...nel.org, yhs@...com,
john.fastabend@...il.com, kpsingh@...nel.org, sdf@...gle.com,
haoluo@...gle.com, jolsa@...nel.org,
David Ahern <dsahern@...il.com>,
Jakub Kicinski <kuba@...nel.org>,
Willem de Bruijn <willemb@...gle.com>,
Jesper Dangaard Brouer <brouer@...hat.com>,
Anatoly Burakov <anatoly.burakov@...el.com>,
Alexander Lobakin <alexandr.lobakin@...el.com>,
Magnus Karlsson <magnus.karlsson@...il.com>,
Maryam Tahhan <mtahhan@...hat.com>, xdp-hints@...-project.net,
netdev@...r.kernel.org
Subject: [PATCH bpf-next 08/11] selftests/bpf: Verify xdp_metadata xdp->skb path
- divert 9081 UDP traffic to the kernel
- call bpf_xdp_metadata_export_to_skb for such packets
- the kernel should fill in hwtstamp
- verify that the received packet has non-zero hwtstamp
Cc: John Fastabend <john.fastabend@...il.com>
Cc: David Ahern <dsahern@...il.com>
Cc: Martin KaFai Lau <martin.lau@...ux.dev>
Cc: Jakub Kicinski <kuba@...nel.org>
Cc: Willem de Bruijn <willemb@...gle.com>
Cc: Jesper Dangaard Brouer <brouer@...hat.com>
Cc: Anatoly Burakov <anatoly.burakov@...el.com>
Cc: Alexander Lobakin <alexandr.lobakin@...el.com>
Cc: Magnus Karlsson <magnus.karlsson@...il.com>
Cc: Maryam Tahhan <mtahhan@...hat.com>
Cc: xdp-hints@...-project.net
Cc: netdev@...r.kernel.org
Signed-off-by: Stanislav Fomichev <sdf@...gle.com>
---
tools/testing/selftests/bpf/DENYLIST.s390x | 1 +
.../selftests/bpf/prog_tests/xdp_metadata.c | 81 +++++++++++++++++++
.../selftests/bpf/progs/xdp_metadata.c | 64 +++++++++++++++
3 files changed, 146 insertions(+)
diff --git a/tools/testing/selftests/bpf/DENYLIST.s390x b/tools/testing/selftests/bpf/DENYLIST.s390x
index be4e3d47ea3e..2fa350c8ab42 100644
--- a/tools/testing/selftests/bpf/DENYLIST.s390x
+++ b/tools/testing/selftests/bpf/DENYLIST.s390x
@@ -78,4 +78,5 @@ xdp_adjust_tail # case-128 err 0 errno 28 retval 1 size
xdp_bonding # failed to auto-attach program 'trace_on_entry': -524 (trampoline)
xdp_bpf2bpf # failed to auto-attach program 'trace_on_entry': -524 (trampoline)
xdp_do_redirect # prog_run_max_size unexpected error: -22 (errno 22)
+xdp_metadata # JIT does not support push/pop opcodes (jit)
xdp_synproxy # JIT does not support calling kernel function (kfunc)
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
index c3321d8c7cd4..b67a4dcfca6e 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
@@ -19,6 +19,7 @@
#define AF_XDP_SOURCE_PORT 1234
#define AF_XDP_CONSUMER_PORT 8080
+#define SOCKET_CONSUMER_PORT 9081
#define UMEM_NUM 16
#define UMEM_FRAME_SIZE XSK_UMEM__DEFAULT_FRAME_SIZE
@@ -275,6 +276,61 @@ static int verify_xsk_metadata(struct xsk *xsk)
return 0;
}
+static void timestamping_enable(int fd, int val)
+{
+ int ret;
+
+ ret = setsockopt(fd, SOL_SOCKET, SO_TIMESTAMPING, &val, sizeof(val));
+ ASSERT_OK(ret, "setsockopt(SO_TIMESTAMPING)");
+}
+
+static int verify_skb_metadata(int fd)
+{
+ char cmsg_buf[1024];
+ char packet_buf[128];
+
+ struct scm_timestamping *ts;
+ struct iovec packet_iov;
+ struct cmsghdr *cmsg;
+ struct msghdr hdr;
+ bool found_hwtstamp = false;
+
+ memset(&hdr, 0, sizeof(hdr));
+ hdr.msg_iov = &packet_iov;
+ hdr.msg_iovlen = 1;
+ packet_iov.iov_base = packet_buf;
+ packet_iov.iov_len = sizeof(packet_buf);
+
+ hdr.msg_control = cmsg_buf;
+ hdr.msg_controllen = sizeof(cmsg_buf);
+
+ if (ASSERT_GE(recvmsg(fd, &hdr, 0), 0, "recvmsg")) {
+ for (cmsg = CMSG_FIRSTHDR(&hdr); cmsg != NULL;
+ cmsg = CMSG_NXTHDR(&hdr, cmsg)) {
+
+ if (cmsg->cmsg_level != SOL_SOCKET)
+ continue;
+
+ switch (cmsg->cmsg_type) {
+ case SCM_TIMESTAMPING:
+ ts = (struct scm_timestamping *)CMSG_DATA(cmsg);
+ if (ts->ts[2].tv_sec || ts->ts[2].tv_nsec) {
+ found_hwtstamp = true;
+ break;
+ }
+ break;
+ default:
+ break;
+ }
+ }
+ }
+
+ if (!ASSERT_EQ(found_hwtstamp, true, "no hwtstamp!"))
+ return -1;
+
+ return 0;
+}
+
void test_xdp_metadata(void)
{
struct xdp_metadata *bpf_obj = NULL;
@@ -283,6 +339,7 @@ void test_xdp_metadata(void)
struct bpf_program *prog;
struct xsk tx_xsk = {};
struct xsk rx_xsk = {};
+ int rx_udp_fd = -1;
int rx_ifindex;
int sock_fd;
int ret;
@@ -299,6 +356,8 @@ void test_xdp_metadata(void)
SYS("ip link set dev " RX_NAME " up");
SYS("ip addr add " TX_ADDR "/" PREFIX_LEN " dev " TX_NAME);
SYS("ip addr add " RX_ADDR "/" PREFIX_LEN " dev " RX_NAME);
+ SYS("sysctl -q net.ipv4.ip_forward=1");
+ SYS("sysctl -q net.ipv4.conf.all.accept_local=1");
rx_ifindex = if_nametoindex(RX_NAME);
@@ -312,6 +371,15 @@ void test_xdp_metadata(void)
if (!ASSERT_OK(ret, "open_xsk(RX_NAME)"))
goto out;
+ /* Setup UPD listener for RX interface. */
+
+ rx_udp_fd = start_server(FAMILY, SOCK_DGRAM, NULL, SOCKET_CONSUMER_PORT, 1000);
+ if (!ASSERT_GE(rx_udp_fd, 0, "start_server"))
+ goto out;
+ timestamping_enable(rx_udp_fd,
+ SOF_TIMESTAMPING_SOFTWARE |
+ SOF_TIMESTAMPING_RAW_HARDWARE);
+
/* Attach BPF program to RX interface. */
bpf_obj = xdp_metadata__open();
@@ -348,9 +416,22 @@ void test_xdp_metadata(void)
complete_tx(&tx_xsk);
+ /* Send packet destined to RX UDP socket. */
+ if (!ASSERT_GE(generate_packet(&tx_xsk, SOCKET_CONSUMER_PORT), 0,
+ "generate SOCKET_CONSUMER_PORT"))
+ goto out;
+
+ /* Verify SKB RX packet has proper metadata. */
+ if (!ASSERT_GE(verify_skb_metadata(rx_udp_fd), 0,
+ "verify_skb_metadata"))
+ goto out;
+
+ complete_tx(&tx_xsk);
+
out:
close_xsk(&rx_xsk);
close_xsk(&tx_xsk);
+ close(rx_udp_fd);
if (bpf_obj)
xdp_metadata__destroy(bpf_obj);
system("ip netns del xdp_metadata");
diff --git a/tools/testing/selftests/bpf/progs/xdp_metadata.c b/tools/testing/selftests/bpf/progs/xdp_metadata.c
index bdde17961ab6..805178f55743 100644
--- a/tools/testing/selftests/bpf/progs/xdp_metadata.c
+++ b/tools/testing/selftests/bpf/progs/xdp_metadata.c
@@ -17,15 +17,79 @@ struct {
__type(value, __u32);
} xsk SEC(".maps");
+extern int bpf_xdp_metadata_export_to_skb(const struct xdp_md *ctx) __ksym;
extern int bpf_xdp_metadata_rx_timestamp_supported(const struct xdp_md *ctx) __ksym;
extern const __u64 bpf_xdp_metadata_rx_timestamp(const struct xdp_md *ctx) __ksym;
SEC("xdp")
int rx(struct xdp_md *ctx)
{
+ struct xdp_skb_metadata *skb_metadata;
void *data, *data_meta;
+ struct ethhdr *eth = NULL;
+ struct udphdr *udp = NULL;
+ struct iphdr *iph = NULL;
+ void *data_end;
int ret;
+ /* Exercise xdp -> skb metadata path by diverting some traffic
+ * into the kernel (UDP destination port 9081).
+ */
+
+ data = (void *)(long)ctx->data;
+ data_end = (void *)(long)ctx->data_end;
+ eth = data;
+ if (eth + 1 < data_end) {
+ if (eth->h_proto == bpf_htons(ETH_P_IP)) {
+ iph = (void *)(eth + 1);
+ if (iph + 1 < data_end && iph->protocol == IPPROTO_UDP)
+ udp = (void *)(iph + 1);
+ }
+ if (udp && udp + 1 > data_end)
+ udp = NULL;
+ }
+ if (udp && udp->dest == bpf_htons(9081)) {
+ bpf_printk("exporting metadata to skb for UDP port 9081");
+
+ if (bpf_xdp_metadata_export_to_skb(ctx) < 0) {
+ bpf_printk("bpf_xdp_metadata_export_to_skb failed");
+ return XDP_DROP;
+ }
+
+ /* Make sure metadata can't be adjusted after a call
+ * to bpf_xdp_metadata_export_to_skb().
+ */
+
+ ret = bpf_xdp_adjust_meta(ctx, -4);
+ if (ret == 0) {
+ bpf_printk("bpf_xdp_adjust_meta -4 after bpf_xdp_metadata_export_to_skb succeeded");
+ return XDP_DROP;
+ }
+
+ /* Make sure calling bpf_xdp_metadata_export_to_skb()
+ * second time is a no-op.
+ */
+
+ if (bpf_xdp_metadata_export_to_skb(ctx) == 0) {
+ bpf_printk("bpf_xdp_metadata_export_to_skb succeeded 2nd time");
+ return XDP_DROP;
+ }
+
+ skb_metadata = ctx->skb_metadata;
+ if (!skb_metadata) {
+ bpf_printk("no ctx->skb_metadata");
+ return XDP_DROP;
+ }
+
+ if (!skb_metadata->rx_timestamp) {
+ bpf_printk("no skb_metadata->rx_timestamp");
+ return XDP_DROP;
+ }
+
+ /*return bpf_redirect(ifindex, BPF_F_INGRESS);*/
+ return XDP_PASS;
+ }
+
if (bpf_xdp_metadata_rx_timestamp_supported(ctx)) {
__u64 rx_timestamp = bpf_xdp_metadata_rx_timestamp(ctx);
--
2.38.1.431.g37b22c650d-goog
Powered by blists - more mailing lists