On Tue, 12 Dec 2023 at 20:52, Daniel Xu dxu@dxuuu.xyz wrote:
cc Kumar
On Tue, Dec 12, 2023 at 09:17:02AM -0700, Daniel Xu wrote:
On Mon, Dec 11, 2023 at 04:25:06PM -0800, Eyal Birger wrote:
On Mon, Dec 11, 2023 at 3:49 PM Daniel Xu dxu@dxuuu.xyz wrote:
On Mon, Dec 11, 2023 at 03:13:07PM -0800, Eyal Birger wrote:
On Mon, Dec 11, 2023 at 2:31 PM Daniel Xu dxu@dxuuu.xyz wrote:
On Mon, Dec 11, 2023 at 01:39:25PM -0800, Eyal Birger wrote: > Hi Daniel, > > Tiny nits below in case you respin this for other reasons: > > On Mon, Dec 11, 2023 at 12:20 PM Daniel Xu dxu@dxuuu.xyz wrote: > > > > This commit extends test_tunnel selftest to test the new XDP xfrm state > > lookup kfunc. > > > > Co-developed-by: Antony Antony antony.antony@secunet.com > > Signed-off-by: Antony Antony antony.antony@secunet.com > > Signed-off-by: Daniel Xu dxu@dxuuu.xyz > > --- > > .../selftests/bpf/prog_tests/test_tunnel.c | 20 ++++++-- > > .../selftests/bpf/progs/test_tunnel_kern.c | 51 +++++++++++++++++++ > > 2 files changed, 67 insertions(+), 4 deletions(-) > > > > diff --git a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c > > index 2d7f8fa82ebd..fc804095d578 100644 > > --- a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c > > +++ b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c > > @@ -278,7 +278,7 @@ static int add_xfrm_tunnel(void) > > SYS(fail, > > "ip netns exec at_ns0 " > > "ip xfrm state add src %s dst %s proto esp " > > - "spi %d reqid 1 mode tunnel " > > + "spi %d reqid 1 mode tunnel replay-window 42 " > > "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s", > > IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC); > > SYS(fail, > > @@ -292,7 +292,7 @@ static int add_xfrm_tunnel(void) > > SYS(fail, > > "ip netns exec at_ns0 " > > "ip xfrm state add src %s dst %s proto esp " > > - "spi %d reqid 2 mode tunnel " > > + "spi %d reqid 2 mode tunnel replay-window 42 " > > nit: why do you need to set the replay-window in both directions?
No reason - probably just careless here.
> > > "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s", > > IP4_ADDR1_VETH1, IP4_ADDR_VETH0, XFRM_SPI_OUT_TO_IN, XFRM_AUTH, XFRM_ENC); > > SYS(fail, > > @@ -313,7 +313,7 @@ static int add_xfrm_tunnel(void) > > */ > > SYS(fail, > > "ip xfrm state add src %s dst %s proto esp " > > - "spi %d reqid 1 mode tunnel " > > + "spi %d reqid 1 mode tunnel replay-window 42 " > > "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s", > > IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC); > > SYS(fail, > > @@ -325,7 +325,7 @@ static int add_xfrm_tunnel(void) > > /* root -> at_ns0 */ > > SYS(fail, > > "ip xfrm state add src %s dst %s proto esp " > > - "spi %d reqid 2 mode tunnel " > > + "spi %d reqid 2 mode tunnel replay-window 42 " > > "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s", > > IP4_ADDR1_VETH1, IP4_ADDR_VETH0, XFRM_SPI_OUT_TO_IN, XFRM_AUTH, XFRM_ENC); > > SYS(fail, > > @@ -628,8 +628,10 @@ static void test_xfrm_tunnel(void) > > { > > DECLARE_LIBBPF_OPTS(bpf_tc_hook, tc_hook, > > .attach_point = BPF_TC_INGRESS); > > + LIBBPF_OPTS(bpf_xdp_attach_opts, opts); > > struct test_tunnel_kern *skel = NULL; > > struct nstoken *nstoken; > > + int xdp_prog_fd; > > int tc_prog_fd; > > int ifindex; > > int err; > > @@ -654,6 +656,14 @@ static void test_xfrm_tunnel(void) > > if (attach_tc_prog(&tc_hook, tc_prog_fd, -1)) > > goto done; > > > > + /* attach xdp prog to tunnel dev */ > > + xdp_prog_fd = bpf_program__fd(skel->progs.xfrm_get_state_xdp); > > + if (!ASSERT_GE(xdp_prog_fd, 0, "bpf_program__fd")) > > + goto done; > > + err = bpf_xdp_attach(ifindex, xdp_prog_fd, XDP_FLAGS_REPLACE, &opts); > > + if (!ASSERT_OK(err, "bpf_xdp_attach")) > > + goto done; > > + > > /* ping from at_ns0 namespace test */ > > nstoken = open_netns("at_ns0"); > > err = test_ping(AF_INET, IP4_ADDR_TUNL_DEV1); > > @@ -667,6 +677,8 @@ static void test_xfrm_tunnel(void) > > goto done; > > if (!ASSERT_EQ(skel->bss->xfrm_remote_ip, 0xac100164, "remote_ip")) > > goto done; > > + if (!ASSERT_EQ(skel->bss->xfrm_replay_window, 42, "replay_window")) > > + goto done; > > > > done: > > delete_xfrm_tunnel(); > > diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > > index 3a59eb9c34de..c0dd38616562 100644 > > --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > > +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c > > @@ -30,6 +30,10 @@ int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx, > > struct bpf_fou_encap *encap, int type) __ksym; > > int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx, > > struct bpf_fou_encap *encap) __ksym; > > +struct xfrm_state * > > +bpf_xdp_get_xfrm_state(struct xdp_md *ctx, struct bpf_xfrm_state_opts *opts, > > + u32 opts__sz) __ksym; > > +void bpf_xdp_xfrm_state_release(struct xfrm_state *x) __ksym; > > > > struct { > > __uint(type, BPF_MAP_TYPE_ARRAY); > > @@ -950,4 +954,51 @@ int xfrm_get_state(struct __sk_buff *skb) > > return TC_ACT_OK; > > } > > > > +volatile int xfrm_replay_window = 0; > > + > > +SEC("xdp") > > +int xfrm_get_state_xdp(struct xdp_md *xdp) > > +{ > > + struct bpf_xfrm_state_opts opts = {}; > > + struct xfrm_state *x = NULL; > > + struct ip_esp_hdr *esph; > > + struct bpf_dynptr ptr; > > + u8 esph_buf[8] = {}; > > + u8 iph_buf[20] = {}; > > + struct iphdr *iph; > > + u32 off; > > + > > + if (bpf_dynptr_from_xdp(xdp, 0, &ptr)) > > + goto out; > > + > > + off = sizeof(struct ethhdr); > > + iph = bpf_dynptr_slice(&ptr, off, iph_buf, sizeof(iph_buf)); > > + if (!iph || iph->protocol != IPPROTO_ESP) > > + goto out; > > + > > + off += sizeof(struct iphdr); > > + esph = bpf_dynptr_slice(&ptr, off, esph_buf, sizeof(esph_buf)); > > + if (!esph) > > + goto out; > > + > > + opts.netns_id = BPF_F_CURRENT_NETNS; > > + opts.daddr.a4 = iph->daddr; > > + opts.spi = esph->spi; > > + opts.proto = IPPROTO_ESP; > > + opts.family = AF_INET; > > + > > + x = bpf_xdp_get_xfrm_state(xdp, &opts, sizeof(opts)); > > + if (!x || opts.error) > > nit: how can opts.error be non zero if x == NULL?
Ignoring the new -ENOENT case, it can't. Which is why I'm testing that behavior here.
I'm sorry, I don't understand.
AFAICT, regardless of the -ENOENT change, I don't see how (!x) is false and (opt.error) is true, and so "if (!x || opts.error)" is always equivalent to "if (!x)".
What am I missing? Eyal.
The selftests are tests so my intention was to check edge cases here. In normal operation it shouldn't be possible that bpf_xdp_get_xfrm_state() returns non-NULL and also an error. Maybe another way of writing this would be:
if (!x) goto out; assert(opts.error == 0);I think this would convey the "edge case testing" notion better.
If I'm trying to be too clever (or maybe just wrong) or it's pointless, I can remove the `opts.error` condition.
At least for me the tests also serve as references as to how the API is expected to be used, so I think it'd be clearer without signaling that opts.error could potentially be nonzero on success.
An assertion would indeed make that clear.
Sure, sounds good. I will check on the new bpf assert infra.
Couldn't quite get bpf_assert() working. The following diff:
diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c index c0dd38616562..f00dba85ac5d 100644 --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c @@ -8,8 +8,9 @@ */ #include "vmlinux.h" #include <bpf/bpf_core_read.h> -#include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> +#include <bpf/bpf_helpers.h> +#include "bpf_experimental.h" #include "bpf_kfuncs.h" #include "bpf_tracing_net.h"
@@ -988,8 +989,9 @@ int xfrm_get_state_xdp(struct xdp_md *xdp) opts.family = AF_INET;
x = bpf_xdp_get_xfrm_state(xdp, &opts, sizeof(opts));
if (!x || opts.error)
if (!x) goto out;bpf_assert_with(opts.error == 0, XDP_PASS); if (!x->replay_esn) goto out;results in:
57: (b7) r1 = 2 ; R1_w=2 refs=5 58: (85) call bpf_throw#115436 calling kernel function bpf_throw is not allowed
I think this might be because bpf_throw is not registered for use by BPF_PROG_TYPE_XDP. I would simply register the generic_kfunc_set for this program type as well, since it's already done for TC.
It looks like the above error comes from verifier.c:fetch_kfunc_meta, but I can run the exceptions selftests just fine with the same bzImage. So I'm thinking it's not a kfunc registration or BTF issue.
Maybe it's cuz I'm holding onto KFUNC_ACQUIRE'd `x`? Not sure.
Yes, even once you enable this, this will fail for now. I am sending out a series later this week that enables bpf_throw with acquired references, but until then may I suggest the following:
#define bpf_assert_if(cond) for (int ___i = 0, ___j = (cond); !(___j) \ && !___j; bpf_throw(), ___i++)
This will allow you to insert some cleanup code with an assertion. Then in my series, I will convert this temporary bpf_assert_if back to the normal bpf_assert.
It would look like: bpf_assert_if(opts.error == 0) { // Execute if assertion failed bpf_xdp_xfrm_state_release(x); }
Likewise for bpf_assert_with_if, you get the idea.
So for now I think I'll drop checking opts.error.
[...]