netdev - Re: [PATCH bpf-next v2 1/2] bpf: add CHECKSUM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <78a16fb9-dae7-900d-bbee-749da3990291@iogearbox.net>
Date: Fri, 24 May 2024 18:15:41 +0200
From: Daniel Borkmann <daniel@...earbox.net>
To: Vadim Fedorenko <vadfed@...a.com>,
 Vadim Fedorenko <vadim.fedorenko@...ux.dev>,
 Martin KaFai Lau <martin.lau@...ux.dev>, Andrii Nakryiko
 <andrii@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
 Mykola Lysenko <mykolal@...com>, Jakub Kicinski <kuba@...nel.org>
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH bpf-next v2 1/2] bpf: add CHECKSUM_COMPLETE to bpf test
 progs

On 5/24/24 1:06 PM, Vadim Fedorenko wrote:
> Add special flag to validate that TC BPF program properly updates
> checksum information in skb.
> 
> Signed-off-by: Vadim Fedorenko <vadfed@...a.com>
> ---
>   include/uapi/linux/bpf.h       |  2 ++
>   net/bpf/test_run.c             | 17 ++++++++++++++++-
>   tools/include/uapi/linux/bpf.h |  2 ++
>   3 files changed, 20 insertions(+), 1 deletion(-)
> 
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 90706a47f6ff..f7d458d88111 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -1425,6 +1425,8 @@ enum {
>   #define BPF_F_TEST_RUN_ON_CPU	(1U << 0)
>   /* If set, XDP frames will be transmitted after processing */
>   #define BPF_F_TEST_XDP_LIVE_FRAMES	(1U << 1)
> +/* If set, apply CHECKSUM_COMPLETE to skb and validate the checksum */
> +#define BPF_F_TEST_SKB_CHECKSUM_COMPLETE	(1U << 2)
>   
>   /* type for BPF_ENABLE_STATS */
>   enum bpf_stats_type {
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index f6aad4ed2ab2..c6189bb9bf67 100644
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -977,7 +977,8 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
>   	void *data;
>   	int ret;
>   
> -	if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size)
> +	if ((kattr->test.flags & ~BPF_F_TEST_SKB_CHECKSUM_COMPLETE) ||
> +	    kattr->test.cpu || kattr->test.batch_size)
>   		return -EINVAL;
>   
>   	data = bpf_test_init(kattr, kattr->test.data_size_in,
> @@ -1025,6 +1026,12 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
>   
>   	skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
>   	__skb_put(skb, size);
> +
> +	if (kattr->test.flags & BPF_F_TEST_SKB_CHECKSUM_COMPLETE) {
> +		skb->csum = skb_checksum(skb, 0, skb->len, 0);
> +		skb->ip_summed = CHECKSUM_COMPLETE;
> +	}
> +
>   	if (ctx && ctx->ifindex > 1) {
>   		dev = dev_get_by_index(net, ctx->ifindex);
>   		if (!dev) {
> @@ -1079,6 +1086,15 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
>   	}
>   	convert_skb_to___skb(skb, ctx);
>   
> +	if (kattr->test.flags & BPF_F_TEST_SKB_CHECKSUM_COMPLETE) {
> +		__wsum csum = skb_checksum(skb, 0, skb->len, 0);
> +
> +		if (skb->csum != csum) {
> +			ret = -EINVAL;

This is very useful. Maybe just a nit that EINVAL seems too generic and some more concrete
signal (e.g. EBADMSG) might be better. Do you also plan to add test infra for other types
like CHECKSUM_PARTIAL?

> +			goto out;
> +		}
> +	}
> +
>   	size = skb->len;
>   	/* bpf program can never convert linear skb to non-linear */
>   	if (WARN_ON_ONCE(skb_is_nonlinear(skb)))
> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index 90706a47f6ff..f7d458d88111 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -1425,6 +1425,8 @@ enum {
>   #define BPF_F_TEST_RUN_ON_CPU	(1U << 0)
>   /* If set, XDP frames will be transmitted after processing */
>   #define BPF_F_TEST_XDP_LIVE_FRAMES	(1U << 1)
> +/* If set, apply CHECKSUM_COMPLETE to skb and validate the checksum */
> +#define BPF_F_TEST_SKB_CHECKSUM_COMPLETE	BIT(2)
>   
>   /* type for BPF_ENABLE_STATS */
>   enum bpf_stats_type {
>