| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAHsH6GsdqBN638uqUm+8QkP1_45coucSTL7o=D2wFW-gYjPaBw@mail.gmail.com>
Date: Mon, 11 Dec 2023 13:39:25 -0800
From: Eyal Birger <eyal.birger@...il.com>
To: Daniel Xu <dxu@...uu.xyz>
Cc: daniel@...earbox.net, davem@...emloft.net, shuah@...nel.org,
ast@...nel.org, john.fastabend@...il.com, kuba@...nel.org, andrii@...nel.org,
hawk@...nel.org, steffen.klassert@...unet.com, antony.antony@...unet.com,
alexei.starovoitov@...il.com, yonghong.song@...ux.dev, eddyz87@...il.com,
mykolal@...com, martin.lau@...ux.dev, song@...nel.org, kpsingh@...nel.org,
sdf@...gle.com, haoluo@...gle.com, jolsa@...nel.org, bpf@...r.kernel.org,
linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org,
netdev@...r.kernel.org, devel@...ux-ipsec.org
Subject: Re: [PATCH bpf-next v5 9/9] bpf: xfrm: Add selftest for bpf_xdp_get_xfrm_state()
Hi Daniel,
Tiny nits below in case you respin this for other reasons:
On Mon, Dec 11, 2023 at 12:20 PM Daniel Xu <dxu@...uu.xyz> wrote:
>
> This commit extends test_tunnel selftest to test the new XDP xfrm state
> lookup kfunc.
>
> Co-developed-by: Antony Antony <antony.antony@...unet.com>
> Signed-off-by: Antony Antony <antony.antony@...unet.com>
> Signed-off-by: Daniel Xu <dxu@...uu.xyz>
> ---
> .../selftests/bpf/prog_tests/test_tunnel.c | 20 ++++++--
> .../selftests/bpf/progs/test_tunnel_kern.c | 51 +++++++++++++++++++
> 2 files changed, 67 insertions(+), 4 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
> index 2d7f8fa82ebd..fc804095d578 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c
> @@ -278,7 +278,7 @@ static int add_xfrm_tunnel(void)
> SYS(fail,
> "ip netns exec at_ns0 "
> "ip xfrm state add src %s dst %s proto esp "
> - "spi %d reqid 1 mode tunnel "
> + "spi %d reqid 1 mode tunnel replay-window 42 "
> "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s",
> IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC);
> SYS(fail,
> @@ -292,7 +292,7 @@ static int add_xfrm_tunnel(void)
> SYS(fail,
> "ip netns exec at_ns0 "
> "ip xfrm state add src %s dst %s proto esp "
> - "spi %d reqid 2 mode tunnel "
> + "spi %d reqid 2 mode tunnel replay-window 42 "
nit: why do you need to set the replay-window in both directions?
> "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s",
> IP4_ADDR1_VETH1, IP4_ADDR_VETH0, XFRM_SPI_OUT_TO_IN, XFRM_AUTH, XFRM_ENC);
> SYS(fail,
> @@ -313,7 +313,7 @@ static int add_xfrm_tunnel(void)
> */
> SYS(fail,
> "ip xfrm state add src %s dst %s proto esp "
> - "spi %d reqid 1 mode tunnel "
> + "spi %d reqid 1 mode tunnel replay-window 42 "
> "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s",
> IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC);
> SYS(fail,
> @@ -325,7 +325,7 @@ static int add_xfrm_tunnel(void)
> /* root -> at_ns0 */
> SYS(fail,
> "ip xfrm state add src %s dst %s proto esp "
> - "spi %d reqid 2 mode tunnel "
> + "spi %d reqid 2 mode tunnel replay-window 42 "
> "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s",
> IP4_ADDR1_VETH1, IP4_ADDR_VETH0, XFRM_SPI_OUT_TO_IN, XFRM_AUTH, XFRM_ENC);
> SYS(fail,
> @@ -628,8 +628,10 @@ static void test_xfrm_tunnel(void)
> {
> DECLARE_LIBBPF_OPTS(bpf_tc_hook, tc_hook,
> .attach_point = BPF_TC_INGRESS);
> + LIBBPF_OPTS(bpf_xdp_attach_opts, opts);
> struct test_tunnel_kern *skel = NULL;
> struct nstoken *nstoken;
> + int xdp_prog_fd;
> int tc_prog_fd;
> int ifindex;
> int err;
> @@ -654,6 +656,14 @@ static void test_xfrm_tunnel(void)
> if (attach_tc_prog(&tc_hook, tc_prog_fd, -1))
> goto done;
>
> + /* attach xdp prog to tunnel dev */
> + xdp_prog_fd = bpf_program__fd(skel->progs.xfrm_get_state_xdp);
> + if (!ASSERT_GE(xdp_prog_fd, 0, "bpf_program__fd"))
> + goto done;
> + err = bpf_xdp_attach(ifindex, xdp_prog_fd, XDP_FLAGS_REPLACE, &opts);
> + if (!ASSERT_OK(err, "bpf_xdp_attach"))
> + goto done;
> +
> /* ping from at_ns0 namespace test */
> nstoken = open_netns("at_ns0");
> err = test_ping(AF_INET, IP4_ADDR_TUNL_DEV1);
> @@ -667,6 +677,8 @@ static void test_xfrm_tunnel(void)
> goto done;
> if (!ASSERT_EQ(skel->bss->xfrm_remote_ip, 0xac100164, "remote_ip"))
> goto done;
> + if (!ASSERT_EQ(skel->bss->xfrm_replay_window, 42, "replay_window"))
> + goto done;
>
> done:
> delete_xfrm_tunnel();
> diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
> index 3a59eb9c34de..c0dd38616562 100644
> --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
> +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
> @@ -30,6 +30,10 @@ int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx,
> struct bpf_fou_encap *encap, int type) __ksym;
> int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx,
> struct bpf_fou_encap *encap) __ksym;
> +struct xfrm_state *
> +bpf_xdp_get_xfrm_state(struct xdp_md *ctx, struct bpf_xfrm_state_opts *opts,
> + u32 opts__sz) __ksym;
> +void bpf_xdp_xfrm_state_release(struct xfrm_state *x) __ksym;
>
> struct {
> __uint(type, BPF_MAP_TYPE_ARRAY);
> @@ -950,4 +954,51 @@ int xfrm_get_state(struct __sk_buff *skb)
> return TC_ACT_OK;
> }
>
> +volatile int xfrm_replay_window = 0;
> +
> +SEC("xdp")
> +int xfrm_get_state_xdp(struct xdp_md *xdp)
> +{
> + struct bpf_xfrm_state_opts opts = {};
> + struct xfrm_state *x = NULL;
> + struct ip_esp_hdr *esph;
> + struct bpf_dynptr ptr;
> + u8 esph_buf[8] = {};
> + u8 iph_buf[20] = {};
> + struct iphdr *iph;
> + u32 off;
> +
> + if (bpf_dynptr_from_xdp(xdp, 0, &ptr))
> + goto out;
> +
> + off = sizeof(struct ethhdr);
> + iph = bpf_dynptr_slice(&ptr, off, iph_buf, sizeof(iph_buf));
> + if (!iph || iph->protocol != IPPROTO_ESP)
> + goto out;
> +
> + off += sizeof(struct iphdr);
> + esph = bpf_dynptr_slice(&ptr, off, esph_buf, sizeof(esph_buf));
> + if (!esph)
> + goto out;
> +
> + opts.netns_id = BPF_F_CURRENT_NETNS;
> + opts.daddr.a4 = iph->daddr;
> + opts.spi = esph->spi;
> + opts.proto = IPPROTO_ESP;
> + opts.family = AF_INET;
> +
> + x = bpf_xdp_get_xfrm_state(xdp, &opts, sizeof(opts));
> + if (!x || opts.error)
nit: how can opts.error be non zero if x == NULL?
Eyal.
> + goto out;
> +
> + if (!x->replay_esn)
> + goto out;
> +
> + xfrm_replay_window = x->replay_esn->replay_window;
> +out:
> + if (x)
> + bpf_xdp_xfrm_state_release(x);
> + return XDP_PASS;
> +}
> +
> char _license[] SEC("license") = "GPL";
> --
> 2.42.1
>
Powered by blists - more mailing lists