In a follow up to these patches,
- commit 0bdf399342c5("net: Avoid address overwrite in kernel_connect") - commit 86a7e0b69bd5("net: prevent rewrite of msg_name in sock_sendmsg()") - commit c889a99a21bf("net: prevent address rewrite in kernel_bind()") - commit 01b2885d9415("net: Save and restore msg_namelen in sock_sendmsg")
this patch series introduces BPF selftests that test the interaction between BPF sockaddr hooks and socket operations in kernel space. It focuses on regression test coverage to ensure that these operations do not overwrite their address parameter and also provides some sanity checks around kernel_getpeername() and kernel_getsockname().
It introduces two new components: a kernel module called sock_addr_testmod and a new test program called sock_addr_kern which is loosely modeled after and adapted from the old-style bpf/test_sock_addr.c selftest. When loaded, the kernel module will perform some socket operation in kernel space. The kernel module accepts five parameters controlling which socket operation will be performed and its inputs:
MODULE_PARM_DESC(ip, "IPv4/IPv6/Unix address to use for socket operation"); MODULE_PARM_DESC(port, "Port number to use for socket operation"); MODULE_PARM_DESC(af, "Address family (AF_INET, AF_INET6, or AF_UNIX)"); MODULE_PARM_DESC(type, "Socket type (SOCK_STREAM or SOCK_DGRAM)"); MODULE_PARM_DESC(op, "Socket operation (BIND=0, CONNECT=1, SENDMSG=2)");
On module init, the socket operation is performed and results of are exposed through debugfs.
- /sys/kernel/debug/sock_addr_testmod/success Indicates success or failure of the operation. - /sys/kernel/debug/sock_addr_testmod/addr The value of the address parameter after the operation. - /sys/kernel/debug/sock_addr_testmod/sock_name The value of kernel_getsockname() after the socket operation (if relevant). - /sys/kernel/debug/sock_addr_testmod/peer_name The value of kernel_getpeername(() after the socket operation (if relevant).
The sock_addr_kern test program loads and unloads the kernel module to drive kernel socket operations, reads the results from debugfs, makes sure that the operation did not overwrite the address, and any result from kernel_getpeername() or kernel_getsockname() were as expected.
== Patches ==
- Patch 1 introduces sock_addr_testmod and functions necessary for the test program to load and unload the module. - Patches 2-6 transform existing test helpers and introduce new test helpers to enable the sock_addr_kern test program. - Patch 7 implements the sock_addr_kern test program. - Patch 8 fixes the sock_addr bind test program to work for big endian architectures such as s390x.
Jordan Rife (8): selftests/bpf: Introduce sock_addr_testmod selftests/bpf: Add module load helpers selftests/bpf: Factor out cmp_addr selftests/bpf: Add recv_msg_from_client to network helpers selftests/bpf: Factor out load_path and defines from test_sock_addr selftests/bpf: Add setup/cleanup subcommands selftests/bpf: Add sock_addr_kern prog_test selftests/bpf: Fix bind program for big endian systems
tools/testing/selftests/bpf/Makefile | 46 +- tools/testing/selftests/bpf/network_helpers.c | 65 ++ tools/testing/selftests/bpf/network_helpers.h | 5 + .../selftests/bpf/prog_tests/sock_addr.c | 34 - .../selftests/bpf/prog_tests/sock_addr_kern.c | 631 ++++++++++++++++++ .../testing/selftests/bpf/progs/bind4_prog.c | 18 +- .../testing/selftests/bpf/progs/bind6_prog.c | 18 +- tools/testing/selftests/bpf/progs/bind_prog.h | 19 + .../testing/selftests/bpf/sock_addr_helpers.c | 46 ++ .../testing/selftests/bpf/sock_addr_helpers.h | 44 ++ .../bpf/sock_addr_testmod/.gitignore | 6 + .../selftests/bpf/sock_addr_testmod/Makefile | 20 + .../bpf/sock_addr_testmod/sock_addr_testmod.c | 256 +++++++ tools/testing/selftests/bpf/test_sock_addr.c | 76 +-- tools/testing/selftests/bpf/test_sock_addr.sh | 10 +- tools/testing/selftests/bpf/testing_helpers.c | 44 +- tools/testing/selftests/bpf/testing_helpers.h | 2 + 17 files changed, 1196 insertions(+), 144 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/sock_addr_kern.c create mode 100644 tools/testing/selftests/bpf/progs/bind_prog.h create mode 100644 tools/testing/selftests/bpf/sock_addr_helpers.c create mode 100644 tools/testing/selftests/bpf/sock_addr_helpers.h create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/.gitignore create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/Makefile create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/sock_addr_testmod.c
sock_addr_testmod provides a mechanism for the sock_addr_kern prog_test to drive socket operations in kernel space. On init, one of the following socket operations is performed based on the module parameters: kernel_bind(), kernel_connect(), or sock_sendmsg()/kernel_sendmsg() and results are exposed through debugfs.
Signed-off-by: Jordan Rife jrife@google.com --- tools/testing/selftests/bpf/Makefile | 11 +- .../bpf/sock_addr_testmod/.gitignore | 6 + .../selftests/bpf/sock_addr_testmod/Makefile | 20 ++ .../bpf/sock_addr_testmod/sock_addr_testmod.c | 256 ++++++++++++++++++ 4 files changed, 292 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/.gitignore create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/Makefile create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/sock_addr_testmod.c
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 3b9eb40d63436..b5d02ff724957 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -132,7 +132,7 @@ TEST_GEN_PROGS_EXTENDED = test_sock_addr test_skb_cgroup_id_user \ flow_dissector_load test_flow_dissector test_tcp_check_syncookie_user \ test_lirc_mode2_user xdping test_cpp runqslower bench bpf_testmod.ko \ xskxceiver xdp_redirect_multi xdp_synproxy veristat xdp_hw_metadata \ - xdp_features bpf_test_no_cfi.ko + xdp_features bpf_test_no_cfi.ko sock_addr_testmod.ko
TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
@@ -160,6 +160,7 @@ override define CLEAN $(Q)$(RM) -r $(TEST_GEN_FILES) $(Q)$(RM) -r $(EXTRA_CLEAN) $(Q)$(MAKE) -C bpf_testmod clean + $(Q)$(MAKE) -C sock_addr_testmod clean $(Q)$(MAKE) docs-clean endef
@@ -260,6 +261,12 @@ $(OUTPUT)/bpf_test_no_cfi.ko: $(VMLINUX_BTF) $(RESOLVE_BTFIDS) $(wildcard bpf_te $(Q)$(MAKE) $(submake_extras) RESOLVE_BTFIDS=$(RESOLVE_BTFIDS) -C bpf_test_no_cfi $(Q)cp bpf_test_no_cfi/bpf_test_no_cfi.ko $@
+$(OUTPUT)/sock_addr_testmod.ko: $(VMLINUX_BTF) $(RESOLVE_BTFIDS) $(wildcard sock_addr_testmod/Makefile sock_addr_testmod/*.[ch]) + $(call msg,MOD,,$@) + $(Q)$(RM) sock_addr_testmod/sock_addr_testmod.ko # force re-compilation + $(Q)$(MAKE) $(submake_extras) RESOLVE_BTFIDS=$(RESOLVE_BTFIDS) -C sock_addr_testmod + $(Q)cp sock_addr_testmod/sock_addr_testmod.ko $@ + DEFAULT_BPFTOOL := $(HOST_SCRATCH_DIR)/sbin/bpftool ifneq ($(CROSS_COMPILE),) CROSS_BPFTOOL := $(SCRATCH_DIR)/sbin/bpftool @@ -638,6 +645,7 @@ TRUNNER_EXTRA_SOURCES := test_progs.c \ ip_check_defrag_frags.h TRUNNER_EXTRA_FILES := $(OUTPUT)/urandom_read $(OUTPUT)/bpf_testmod.ko \ $(OUTPUT)/bpf_test_no_cfi.ko \ + $(OUTPUT)/sock_addr_testmod.ko \ $(OUTPUT)/liburandom_read.so \ $(OUTPUT)/xdp_synproxy \ $(OUTPUT)/sign-file \ @@ -767,6 +775,7 @@ EXTRA_CLEAN := $(SCRATCH_DIR) $(HOST_SCRATCH_DIR) \ $(addprefix $(OUTPUT)/,*.o *.skel.h *.lskel.h *.subskel.h \ no_alu32 cpuv4 bpf_gcc bpf_testmod.ko \ bpf_test_no_cfi.ko \ + sock_addr_testmod.ko \ liburandom_read.so)
.PHONY: docs docs-clean diff --git a/tools/testing/selftests/bpf/sock_addr_testmod/.gitignore b/tools/testing/selftests/bpf/sock_addr_testmod/.gitignore new file mode 100644 index 0000000000000..ded5137772813 --- /dev/null +++ b/tools/testing/selftests/bpf/sock_addr_testmod/.gitignore @@ -0,0 +1,6 @@ +*.mod +*.mod.c +*.o +.ko +/Module.symvers +/modules.order diff --git a/tools/testing/selftests/bpf/sock_addr_testmod/Makefile b/tools/testing/selftests/bpf/sock_addr_testmod/Makefile new file mode 100644 index 0000000000000..47c92fb3a7748 --- /dev/null +++ b/tools/testing/selftests/bpf/sock_addr_testmod/Makefile @@ -0,0 +1,20 @@ +SOCK_ADDR_TEST_MOD_DIR := $(realpath $(dir $(abspath $(lastword $(MAKEFILE_LIST))))) +KDIR ?= $(abspath $(SOCK_ADDR_TEST_MOD_DIR)/../../../../..) + +ifeq ($(V),1) +Q = +else +Q = @ +endif + +MODULES = sock_addr_testmod.ko + +obj-m += sock_addr_testmod.o +CFLAGS_sock_addr_testmod.o = -I$(src) + +all: + +$(Q)make -C $(KDIR) M=$(SOCK_ADDR_TEST_MOD_DIR) modules + +clean: + +$(Q)make -C $(KDIR) M=$(SOCK_ADDR_TEST_MOD_DIR) clean + diff --git a/tools/testing/selftests/bpf/sock_addr_testmod/sock_addr_testmod.c b/tools/testing/selftests/bpf/sock_addr_testmod/sock_addr_testmod.c new file mode 100644 index 0000000000000..de0b2007f0829 --- /dev/null +++ b/tools/testing/selftests/bpf/sock_addr_testmod/sock_addr_testmod.c @@ -0,0 +1,256 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2024 Google LLC. */ +#include <linux/net.h> +#include <linux/socket.h> +#include <linux/nsproxy.h> +#include <linux/inet.h> +#include <linux/in.h> +#include <linux/in6.h> +#include <linux/un.h> +#include <linux/debugfs.h> +#include <net/sock.h> + +#define BIND 0 +#define CONNECT 1 +#define SENDMSG 2 + +#define CONNECT_TIMEOUT_SEC 1 + +static char ip[256]; +module_param_string(ip, ip, sizeof(ip), 0644); +MODULE_PARM_DESC(ip, "IPv4/IPv6/Unix address to use for socket operation"); +static char port[7]; +module_param_string(port, port, sizeof(port), 0644); +MODULE_PARM_DESC(port, "Port number to use for socket operation"); +static uint af; +module_param(af, uint, 0644); +MODULE_PARM_DESC(af, "Address family (AF_INET, AF_INET6, or AF_UNIX)"); +static int type; +module_param(type, int, 0644); +MODULE_PARM_DESC(type, "Socket type (SOCK_STREAM or SOCK_DGRAM)"); +static uint op; +module_param(op, uint, 0644); +MODULE_PARM_DESC(op, "Socket operation (BIND=0, CONNECT=1, SENDMSG=2)"); + +static struct debugfs_blob_wrapper sock_name_blob; +static struct debugfs_blob_wrapper peer_name_blob; +static struct debugfs_blob_wrapper addr_blob; +static struct dentry *debugfs_dentry; +static struct sockaddr_storage sock_name; +static struct sockaddr_storage peer_name; +static struct sockaddr_storage addr; +static bool success; + +static struct socket *sock; + +static int do_kernel_bind(struct sockaddr *addr, int addrlen) +{ + int err; + + err = kernel_bind(sock, (struct sockaddr *)addr, addrlen); + if (err) { + pr_err("kernel_bind() returned %d\n", err); + goto err; + } + + err = kernel_getsockname(sock, (struct sockaddr *)&sock_name); + if (err < 0) { + pr_err("kernel_getsockname() returned %d\n", err); + goto err; + } + + if (type == SOCK_STREAM) { + err = kernel_listen(sock, 128); + if (err == -1) { + pr_err("kernel_listen() returned %d\n", err); + goto err; + } + } + + err = 0; + goto out; +err: + err = -1; +out: + return err; +} + +static int do_kernel_connect(struct sockaddr *addr, int addrlen) +{ + int err; + + /* Set timeout for call to kernel_connect() to prevent it from hanging, + * and consider the connection attempt failed if it returns + * -EINPROGRESS. + */ + sock->sk->sk_sndtimeo = CONNECT_TIMEOUT_SEC * HZ; + + err = kernel_connect(sock, addr, addrlen, 0); + if (err) { + pr_err("kernel_connect() returned %d\n", err); + goto err; + } + + err = kernel_getsockname(sock, (struct sockaddr *)&sock_name); + if (err < 0) { + pr_err("kernel_getsockname() returned %d\n", err); + goto err; + } + + err = kernel_getpeername(sock, (struct sockaddr *)&peer_name); + if (err < 0) { + pr_err("kernel_getpeername() returned %d\n", err); + goto err; + } + + err = 0; + goto out; +err: + err = -1; +out: + return err; +} + +static int do_kernel_sendmsg(struct sockaddr *addr, int addrlen) +{ + struct msghdr msg = { + .msg_name = addr, + .msg_namelen = addrlen, + }; + struct kvec iov; + int err; + + iov.iov_base = "abc"; + iov.iov_len = sizeof("abc"); + + err = kernel_sendmsg(sock, &msg, &iov, 1, sizeof("abc")); + if (err < 0) { + pr_err("kernel_sendmsg() returned %d\n", err); + goto err; + } + + /* Unix socket sockaddr hooks may transform msg_namelen. Make sure it is + * unmodified after the call to kernel_sendmsg(). + */ + if (msg.msg_namelen != addrlen) { + pr_err("msg_namelen was modified (original=%d,current=%d)\n", addrlen, msg.msg_namelen); + goto err; + } + + /* kernel_sendmsg() and sock_sendmsg() are both used throughout the + * kernel. Neither of these functions should modify msg_name, so call + * both just to make sure. + */ + iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, sizeof("abc")); + err = sock_sendmsg(sock, &msg); + if (err < 0) { + pr_err("sock_sendmsg() returned %d\n", err); + goto err; + } + + /* Unix socket sockaddr hooks may transform msg_namelen. Make sure it is + * unmodified after the call to sock_sendmsg(). + */ + if (msg.msg_namelen != addrlen) { + pr_err("msg_namelen was modified (original=%d,current=%d)\n", addrlen, msg.msg_namelen); + goto err; + } + + err = 0; + goto out; +err: + err = -1; +out: + return err; +} + +static int do_sock_op(int op, struct sockaddr *addr, int addrlen) +{ + switch (op) { + case BIND: + return do_kernel_bind(addr, addrlen); + case CONNECT: + return do_kernel_connect(addr, addrlen); + case SENDMSG: + return do_kernel_sendmsg(addr, addrlen); + default: + return -EINVAL; + } +} + +static int kernel_sock_addr_testmod_init(void) +{ + int addr_len = sizeof(struct sockaddr_storage); + int proto; + int err; + + debugfs_dentry = debugfs_create_dir("sock_addr_testmod", NULL); + + addr_blob.data = &addr; + addr_blob.size = sizeof(addr); + sock_name_blob.data = &sock_name; + sock_name_blob.size = sizeof(sock_name); + peer_name_blob.data = &peer_name; + peer_name_blob.size = sizeof(peer_name); + + debugfs_create_blob("addr", 0444, debugfs_dentry, &addr_blob); + debugfs_create_blob("sock_name", 0444, debugfs_dentry, &sock_name_blob); + debugfs_create_blob("peer_name", 0444, debugfs_dentry, &peer_name_blob); + debugfs_create_bool("success", 0444, debugfs_dentry, &success); + + switch (af) { + case AF_INET: + case AF_INET6: + err = inet_pton_with_scope(&init_net, af, ip, port, &addr); + if (err) { + pr_err("inet_pton_with_scope() returned %d\n", err); + goto err; + } + + proto = type == SOCK_STREAM ? IPPROTO_TCP : IPPROTO_UDP; + break; + case AF_UNIX: + memset(&addr, 0, sizeof(addr)); + ((struct sockaddr_un *)&addr)->sun_family = AF_UNIX; + ((struct sockaddr_un *)&addr)->sun_path[0] = 0; // abstract + strcpy(((struct sockaddr_un *)&addr)->sun_path + 1, ip); + addr_len = offsetof(struct sockaddr_un, sun_path) + 1 + + strlen(ip); + proto = PF_UNIX; + break; + default: + pr_err("invalid address family %d\n", af); + goto err; + } + + err = sock_create_kern(&init_net, af, type, proto, &sock); + if (err) { + pr_err("sock_create_kern() returned %d\n", err); + goto err; + } + + if (do_sock_op(op, (struct sockaddr *)&addr, addr_len)) + goto err; + + success = true; + goto out; +err: + success = false; +out: + return 0; +} + +static void kernel_sock_addr_testmod_exit(void) +{ + if (sock) + sock_release(sock); + + debugfs_remove_recursive(debugfs_dentry); +} + +module_init(kernel_sock_addr_testmod_init); +module_exit(kernel_sock_addr_testmod_exit); + +MODULE_AUTHOR("Jordan Rife"); +MODULE_DESCRIPTION("BPF socket address selftests module"); +MODULE_LICENSE("Dual BSD/GPL");
On Fri, Mar 29, 2024 at 12:20 PM Jordan Rife jrife@google.com wrote:
sock_addr_testmod provides a mechanism for the sock_addr_kern prog_test to drive socket operations in kernel space. On init, one of the following socket operations is performed based on the module parameters: kernel_bind(), kernel_connect(), or sock_sendmsg()/kernel_sendmsg() and results are exposed through debugfs.
Signed-off-by: Jordan Rife jrife@google.com
tools/testing/selftests/bpf/Makefile | 11 +- .../bpf/sock_addr_testmod/.gitignore | 6 + .../selftests/bpf/sock_addr_testmod/Makefile | 20 ++ .../bpf/sock_addr_testmod/sock_addr_testmod.c | 256 ++++++++++++++++++ 4 files changed, 292 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/.gitignore create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/Makefile create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/sock_addr_testmod.c
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 3b9eb40d63436..b5d02ff724957 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -132,7 +132,7 @@ TEST_GEN_PROGS_EXTENDED = test_sock_addr test_skb_cgroup_id_user \ flow_dissector_load test_flow_dissector test_tcp_check_syncookie_user \ test_lirc_mode2_user xdping test_cpp runqslower bench bpf_testmod.ko \ xskxceiver xdp_redirect_multi xdp_synproxy veristat xdp_hw_metadata \
xdp_features bpf_test_no_cfi.ko
xdp_features bpf_test_no_cfi.ko sock_addr_testmod.ko
Do we need yet another kernel module? Can this be done as part of existing bpf_testmod module?
TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
@@ -160,6 +160,7 @@ override define CLEAN $(Q)$(RM) -r $(TEST_GEN_FILES) $(Q)$(RM) -r $(EXTRA_CLEAN) $(Q)$(MAKE) -C bpf_testmod clean
$(Q)$(MAKE) -C sock_addr_testmod clean $(Q)$(MAKE) docs-cleanendef
[...]
On 3/29/24 12:18 PM, Jordan Rife wrote:
+static int do_sock_op(int op, struct sockaddr *addr, int addrlen)
This function can be made as a new kfunc in bpf_testmod.c. The sock_create_kern() could be moved to here also. Take a look at the register_btf_kfunc_id_set() usage in bpf_testmod.c and how those registered kfunc(s) can be called by the bpf prog in progs/*.
If the do_kernel_{bind,connect,sendmsg} and the sock_create_kern need a sleepable context, it will need to mark the kfunc KF_SLEEPABLE. The kfunc can be registered to the BPF_PROG_TYPE_SYSCALL sleepable prog type. There are some examples in progs/kfunc_call_test.c and how the "syscall" bpf prog can be run by bpf_prog_test_run_opts().
The result (e.g. ensuring the addr and addrlen have not been changed) can be checked in the bpf prog itself. Then the new sock_addr_testmod is not needed.
+{
- switch (op) {
- case BIND:
return do_kernel_bind(addr, addrlen);- case CONNECT:
return do_kernel_connect(addr, addrlen);- case SENDMSG:
return do_kernel_sendmsg(addr, addrlen);- default:
return -EINVAL;- }
+}
Martin and Andrii,
This function can be made as a new kfunc in bpf_testmod.c. The sock_create_kern() could be moved to here also. Take a look at the register_btf_kfunc_id_set() usage in bpf_testmod.c and how those registered kfunc(s) can be called by the bpf prog in progs/*.
Thanks for the feedback. I will explore this approach and see if I can get rid of the additional test module.
-Jordan
This patch introduces a helpers used by the sock_addr_kern test program that allow it to load and unload sock_addr_testmod.
Signed-off-by: Jordan Rife jrife@google.com --- tools/testing/selftests/bpf/testing_helpers.c | 44 ++++++++++++++----- tools/testing/selftests/bpf/testing_helpers.h | 2 + 2 files changed, 34 insertions(+), 12 deletions(-)
diff --git a/tools/testing/selftests/bpf/testing_helpers.c b/tools/testing/selftests/bpf/testing_helpers.c index 28b6646662af6..16959a748d4b1 100644 --- a/tools/testing/selftests/bpf/testing_helpers.c +++ b/tools/testing/selftests/bpf/testing_helpers.c @@ -366,48 +366,68 @@ int delete_module(const char *name, int flags) return syscall(__NR_delete_module, name, flags); }
-int unload_bpf_testmod(bool verbose) +static int unload_mod(char name[], bool verbose) { if (kern_sync_rcu()) fprintf(stdout, "Failed to trigger kernel-side RCU sync!\n"); - if (delete_module("bpf_testmod", 0)) { + if (delete_module(name, 0)) { if (errno == ENOENT) { if (verbose) - fprintf(stdout, "bpf_testmod.ko is already unloaded.\n"); + fprintf(stdout, "%s is already unloaded.\n", name); return -1; } - fprintf(stdout, "Failed to unload bpf_testmod.ko from kernel: %d\n", -errno); + fprintf(stdout, "Failed to unload %so from kernel: %d\n", name, -errno); return -1; } if (verbose) - fprintf(stdout, "Successfully unloaded bpf_testmod.ko.\n"); + fprintf(stdout, "Successfully unloaded %s.\n", name); return 0; }
-int load_bpf_testmod(bool verbose) +int unload_bpf_testmod(bool verbose) +{ + return unload_mod("bpf_testmod", verbose); +} + +int unload_bpf_sock_addr_testmod(bool verbose) +{ + return unload_mod("sock_addr_testmod", verbose); +} + +static int load_mod(const char *name, const char *param_values, bool verbose) { int fd;
if (verbose) - fprintf(stdout, "Loading bpf_testmod.ko...\n"); + fprintf(stdout, "Loading %s...\n", name);
- fd = open("bpf_testmod.ko", O_RDONLY); + fd = open(name, O_RDONLY); if (fd < 0) { - fprintf(stdout, "Can't find bpf_testmod.ko kernel module: %d\n", -errno); + fprintf(stdout, "Can't find %s kernel module: %d\n", name, -errno); return -ENOENT; } - if (finit_module(fd, "", 0)) { - fprintf(stdout, "Failed to load bpf_testmod.ko into the kernel: %d\n", -errno); + if (finit_module(fd, param_values, 0)) { + fprintf(stdout, "Failed to load %s into the kernel: %d\n", name, -errno); close(fd); return -EINVAL; } close(fd);
if (verbose) - fprintf(stdout, "Successfully loaded bpf_testmod.ko.\n"); + fprintf(stdout, "Successfully loaded %s.\n", name); return 0; }
+int load_bpf_testmod(bool verbose) +{ + return load_mod("bpf_testmod.ko", "", verbose); +} + +int load_bpf_sock_addr_testmod(const char *param_values, bool verbose) +{ + return load_mod("sock_addr_testmod.ko", param_values, verbose); +} + /* * Trigger synchronize_rcu() in kernel. */ diff --git a/tools/testing/selftests/bpf/testing_helpers.h b/tools/testing/selftests/bpf/testing_helpers.h index d55f6ab124338..d553baa01d597 100644 --- a/tools/testing/selftests/bpf/testing_helpers.h +++ b/tools/testing/selftests/bpf/testing_helpers.h @@ -34,7 +34,9 @@ int parse_test_list_file(const char *path,
__u64 read_perf_max_sample_freq(void); int load_bpf_testmod(bool verbose); +int load_bpf_sock_addr_testmod(const char *param_values, bool verbose); int unload_bpf_testmod(bool verbose); +int unload_bpf_sock_addr_testmod(bool verbose); int kern_sync_rcu(void); int finit_module(int fd, const char *param_values, int flags); int delete_module(const char *name, int flags);
Factor out cmp_addr into network_helpers.c to so that it can be used by the sock_addr_kern test program.
Signed-off-by: Jordan Rife jrife@google.com --- tools/testing/selftests/bpf/network_helpers.c | 34 +++++++++++++++++++ tools/testing/selftests/bpf/network_helpers.h | 4 +++ .../selftests/bpf/prog_tests/sock_addr.c | 34 ------------------- 3 files changed, 38 insertions(+), 34 deletions(-)
diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c index 6db27a9088e97..8eae4afe3ec3d 100644 --- a/tools/testing/selftests/bpf/network_helpers.c +++ b/tools/testing/selftests/bpf/network_helpers.c @@ -497,3 +497,37 @@ int get_socket_local_port(int sock_fd)
return -1; } + +int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, + const struct sockaddr_storage *addr2, socklen_t addr2_len, + bool cmp_port) +{ + const struct sockaddr_in *four1, *four2; + const struct sockaddr_in6 *six1, *six2; + const struct sockaddr_un *un1, *un2; + + if (addr1->ss_family != addr2->ss_family) + return -1; + + if (addr1_len != addr2_len) + return -1; + + if (addr1->ss_family == AF_INET) { + four1 = (const struct sockaddr_in *)addr1; + four2 = (const struct sockaddr_in *)addr2; + return !((four1->sin_port == four2->sin_port || !cmp_port) && + four1->sin_addr.s_addr == four2->sin_addr.s_addr); + } else if (addr1->ss_family == AF_INET6) { + six1 = (const struct sockaddr_in6 *)addr1; + six2 = (const struct sockaddr_in6 *)addr2; + return !((six1->sin6_port == six2->sin6_port || !cmp_port) && + !memcmp(&six1->sin6_addr, &six2->sin6_addr, + sizeof(struct in6_addr))); + } else if (addr1->ss_family == AF_UNIX) { + un1 = (const struct sockaddr_un *)addr1; + un2 = (const struct sockaddr_un *)addr2; + return memcmp(un1, un2, addr1_len); + } + + return -1; +} diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/selftests/bpf/network_helpers.h index 94b9be24e39bc..a4a458c858d59 100644 --- a/tools/testing/selftests/bpf/network_helpers.h +++ b/tools/testing/selftests/bpf/network_helpers.h @@ -61,6 +61,10 @@ int make_sockaddr(int family, const char *addr_str, __u16 port, struct sockaddr_storage *addr, socklen_t *len); char *ping_command(int family); int get_socket_local_port(int sock_fd); +int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, + const struct sockaddr_storage *addr2, socklen_t addr2_len, + bool cmp_port); +
struct nstoken; /** diff --git a/tools/testing/selftests/bpf/prog_tests/sock_addr.c b/tools/testing/selftests/bpf/prog_tests/sock_addr.c index 5fd6177189915..c1db1d7e08b04 100644 --- a/tools/testing/selftests/bpf/prog_tests/sock_addr.c +++ b/tools/testing/selftests/bpf/prog_tests/sock_addr.c @@ -246,40 +246,6 @@ static struct sock_addr_test tests[] = {
typedef int (*info_fn)(int, struct sockaddr *, socklen_t *);
-static int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, - const struct sockaddr_storage *addr2, socklen_t addr2_len, - bool cmp_port) -{ - const struct sockaddr_in *four1, *four2; - const struct sockaddr_in6 *six1, *six2; - const struct sockaddr_un *un1, *un2; - - if (addr1->ss_family != addr2->ss_family) - return -1; - - if (addr1_len != addr2_len) - return -1; - - if (addr1->ss_family == AF_INET) { - four1 = (const struct sockaddr_in *)addr1; - four2 = (const struct sockaddr_in *)addr2; - return !((four1->sin_port == four2->sin_port || !cmp_port) && - four1->sin_addr.s_addr == four2->sin_addr.s_addr); - } else if (addr1->ss_family == AF_INET6) { - six1 = (const struct sockaddr_in6 *)addr1; - six2 = (const struct sockaddr_in6 *)addr2; - return !((six1->sin6_port == six2->sin6_port || !cmp_port) && - !memcmp(&six1->sin6_addr, &six2->sin6_addr, - sizeof(struct in6_addr))); - } else if (addr1->ss_family == AF_UNIX) { - un1 = (const struct sockaddr_un *)addr1; - un2 = (const struct sockaddr_un *)addr2; - return memcmp(un1, un2, addr1_len); - } - - return -1; -} - static int cmp_sock_addr(info_fn fn, int sock1, const struct sockaddr_storage *addr2, socklen_t addr2_len, bool cmp_port)
Copy recv_msg_from_client helper from test_sock_addr self test in order to use it in the sock_addr_kern test program.
Signed-off-by: Jordan Rife jrife@google.com --- tools/testing/selftests/bpf/network_helpers.c | 31 +++++++++++++++++++ tools/testing/selftests/bpf/network_helpers.h | 1 + 2 files changed, 32 insertions(+)
diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c index 8eae4afe3ec3d..ef0a94d9e9d5c 100644 --- a/tools/testing/selftests/bpf/network_helpers.c +++ b/tools/testing/selftests/bpf/network_helpers.c @@ -498,6 +498,37 @@ int get_socket_local_port(int sock_fd) return -1; }
+int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr) +{ + struct timeval tv; + struct msghdr hdr; + struct iovec iov; + char data[64]; + fd_set rfds; + + FD_ZERO(&rfds); + FD_SET(sockfd, &rfds); + + tv.tv_sec = 2; + tv.tv_usec = 0; + + if (select(sockfd + 1, &rfds, NULL, NULL, &tv) <= 0 || + !FD_ISSET(sockfd, &rfds)) + return -1; + + memset(&iov, 0, sizeof(iov)); + iov.iov_base = data; + iov.iov_len = sizeof(data); + + memset(&hdr, 0, sizeof(hdr)); + hdr.msg_name = src_addr; + hdr.msg_namelen = sizeof(struct sockaddr_storage); + hdr.msg_iov = &iov; + hdr.msg_iovlen = 1; + + return recvmsg(sockfd, &hdr, 0); +} + int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, const struct sockaddr_storage *addr2, socklen_t addr2_len, bool cmp_port) diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/selftests/bpf/network_helpers.h index a4a458c858d59..f88f2470e3fcb 100644 --- a/tools/testing/selftests/bpf/network_helpers.h +++ b/tools/testing/selftests/bpf/network_helpers.h @@ -61,6 +61,7 @@ int make_sockaddr(int family, const char *addr_str, __u16 port, struct sockaddr_storage *addr, socklen_t *len); char *ping_command(int family); int get_socket_local_port(int sock_fd); +int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr); int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, const struct sockaddr_storage *addr2, socklen_t addr2_len, bool cmp_port);
On 3/29/24 12:18 PM, Jordan Rife wrote:
+int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr) +{
- struct timeval tv;
- struct msghdr hdr;
- struct iovec iov;
- char data[64];
- fd_set rfds;
- FD_ZERO(&rfds);
- FD_SET(sockfd, &rfds);
- tv.tv_sec = 2;
- tv.tv_usec = 0;
- if (select(sockfd + 1, &rfds, NULL, NULL, &tv) <= 0 ||
The socket fd created by the helpers in network_helpers.c should be a blocking socket and has a 3s default delay. select should not be needed. Try to stay with the default. If the default turned out to be too flaky in the bpf CI in the future, one default change is easier.
!FD_ISSET(sockfd, &rfds))return -1;- memset(&iov, 0, sizeof(iov));
- iov.iov_base = data;
- iov.iov_len = sizeof(data);
- memset(&hdr, 0, sizeof(hdr));
- hdr.msg_name = src_addr;
- hdr.msg_namelen = sizeof(struct sockaddr_storage);
- hdr.msg_iov = &iov;
- hdr.msg_iovlen = 1;
- return recvmsg(sockfd, &hdr, 0);
+}
Factor out useful defines and load_path() from the test_sock_addr self test to use them in sock_addr_kern.
Signed-off-by: Jordan Rife jrife@google.com --- tools/testing/selftests/bpf/Makefile | 34 +++++---- .../testing/selftests/bpf/sock_addr_helpers.c | 46 +++++++++++ .../testing/selftests/bpf/sock_addr_helpers.h | 44 +++++++++++ tools/testing/selftests/bpf/test_sock_addr.c | 76 +++---------------- 4 files changed, 120 insertions(+), 80 deletions(-) create mode 100644 tools/testing/selftests/bpf/sock_addr_helpers.c create mode 100644 tools/testing/selftests/bpf/sock_addr_helpers.h
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index b5d02ff724957..ccc1c11559a45 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -291,6 +291,7 @@ TEST_GEN_PROGS_EXTENDED += $(TRUNNER_BPFTOOL)
$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED): $(BPFOBJ)
+SOCK_ADDR_HELPERS := $(OUTPUT)/sock_addr_helpers.o TESTING_HELPERS := $(OUTPUT)/testing_helpers.o CGROUP_HELPERS := $(OUTPUT)/cgroup_helpers.o UNPRIV_HELPERS := $(OUTPUT)/unpriv_helpers.o @@ -301,7 +302,7 @@ CAP_HELPERS := $(OUTPUT)/cap_helpers.o $(OUTPUT)/test_dev_cgroup: $(CGROUP_HELPERS) $(TESTING_HELPERS) $(OUTPUT)/test_skb_cgroup_id_user: $(CGROUP_HELPERS) $(TESTING_HELPERS) $(OUTPUT)/test_sock: $(CGROUP_HELPERS) $(TESTING_HELPERS) -$(OUTPUT)/test_sock_addr: $(CGROUP_HELPERS) $(TESTING_HELPERS) +$(OUTPUT)/test_sock_addr: $(CGROUP_HELPERS) $(TESTING_HELPERS) $(SOCK_ADDR_HELPERS) $(OUTPUT)/test_sockmap: $(CGROUP_HELPERS) $(TESTING_HELPERS) $(OUTPUT)/test_tcpnotify_user: $(CGROUP_HELPERS) $(TESTING_HELPERS) $(TRACE_HELPERS) $(OUTPUT)/get_cgroup_id_user: $(CGROUP_HELPERS) $(TESTING_HELPERS) @@ -628,21 +629,22 @@ endef # Define test_progs test runner. TRUNNER_TESTS_DIR := prog_tests TRUNNER_BPF_PROGS_DIR := progs -TRUNNER_EXTRA_SOURCES := test_progs.c \ - cgroup_helpers.c \ - trace_helpers.c \ - network_helpers.c \ - testing_helpers.c \ - btf_helpers.c \ - cap_helpers.c \ - unpriv_helpers.c \ - netlink_helpers.c \ - test_loader.c \ - xsk.c \ - disasm.c \ - json_writer.c \ - flow_dissector_load.h \ - ip_check_defrag_frags.h +TRUNNER_EXTRA_SOURCES := test_progs.c \ + cgroup_helpers.c \ + trace_helpers.c \ + network_helpers.c \ + testing_helpers.c \ + btf_helpers.c \ + cap_helpers.c \ + unpriv_helpers.c \ + netlink_helpers.c \ + test_loader.c \ + xsk.c \ + disasm.c \ + json_writer.c \ + flow_dissector_load.h \ + ip_check_defrag_frags.h \ + sock_addr_helpers.c TRUNNER_EXTRA_FILES := $(OUTPUT)/urandom_read $(OUTPUT)/bpf_testmod.ko \ $(OUTPUT)/bpf_test_no_cfi.ko \ $(OUTPUT)/sock_addr_testmod.ko \ diff --git a/tools/testing/selftests/bpf/sock_addr_helpers.c b/tools/testing/selftests/bpf/sock_addr_helpers.c new file mode 100644 index 0000000000000..ff2eb09870f16 --- /dev/null +++ b/tools/testing/selftests/bpf/sock_addr_helpers.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> + +#include <bpf/bpf.h> +#include <bpf/libbpf.h> + +#include "cgroup_helpers.h" +#include "sock_addr_helpers.h" +#include "testing_helpers.h" + +int load_path(const char *path, enum bpf_attach_type attach_type, + bool expect_reject) +{ + struct bpf_object *obj; + struct bpf_program *prog; + int err; + + obj = bpf_object__open_file(path, NULL); + err = libbpf_get_error(obj); + if (err) { + log_err(">>> Opening BPF object (%s) error.\n", path); + return -1; + } + + prog = bpf_object__next_program(obj, NULL); + if (!prog) + goto err_out; + + bpf_program__set_type(prog, BPF_PROG_TYPE_CGROUP_SOCK_ADDR); + bpf_program__set_expected_attach_type(prog, attach_type); + bpf_program__set_flags(prog, testing_prog_flags()); + + err = bpf_object__load(obj); + if (err) { + if (!expect_reject) + log_err(">>> Loading program (%s) error.\n", path); + goto err_out; + } + + return bpf_program__fd(prog); +err_out: + bpf_object__close(obj); + return -1; +} diff --git a/tools/testing/selftests/bpf/sock_addr_helpers.h b/tools/testing/selftests/bpf/sock_addr_helpers.h new file mode 100644 index 0000000000000..cb17579075143 --- /dev/null +++ b/tools/testing/selftests/bpf/sock_addr_helpers.h @@ -0,0 +1,44 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __SOCK_ADDR_HELPERS_H +#define __SOCK_ADDR_HELPERS_H + +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> + +#include <bpf/bpf.h> +#include <bpf/libbpf.h> + +#define CONNECT4_PROG_PATH "./connect4_prog.bpf.o" +#define CONNECT6_PROG_PATH "./connect6_prog.bpf.o" +#define CONNECTUN_PROG_PATH "./connect_unix_prog.bpf.o" +#define SENDMSG4_PROG_PATH "./sendmsg4_prog.bpf.o" +#define SENDMSG6_PROG_PATH "./sendmsg6_prog.bpf.o" +#define RECVMSG4_PROG_PATH "./recvmsg4_prog.bpf.o" +#define RECVMSG6_PROG_PATH "./recvmsg6_prog.bpf.o" +#define BIND4_PROG_PATH "./bind4_prog.bpf.o" +#define BIND6_PROG_PATH "./bind6_prog.bpf.o" + +#define SERV4_IP "192.168.1.254" +#define SERV4_REWRITE_IP "127.0.0.1" +#define SRC4_IP "172.16.0.1" +#define SRC4_REWRITE_IP "127.0.0.4" +#define SERV4_PORT 4040 +#define SERV4_REWRITE_PORT 4444 + +#define SERV6_IP "face:b00c:1234:5678::abcd" +#define SERV6_REWRITE_IP "::1" +#define SERV6_V4MAPPED_IP "::ffff:192.168.0.4" +#define SRC6_IP "::1" +#define SRC6_REWRITE_IP "::6" +#define WILDCARD6_IP "::" +#define SERV6_PORT 6060 +#define SERV6_REWRITE_PORT 6666 + +#define SERVUN_ADDRESS "bpf_cgroup_unix_test" +#define SERVUN_REWRITE_ADDRESS "bpf_cgroup_unix_test_rewrite" + +int load_path(const char *path, enum bpf_attach_type attach_type, + bool expected_reject); + +#endif diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c index 80c42583f5977..89c106832f9a4 100644 --- a/tools/testing/selftests/bpf/test_sock_addr.c +++ b/tools/testing/selftests/bpf/test_sock_addr.c @@ -21,37 +21,13 @@ #include "cgroup_helpers.h" #include "testing_helpers.h" #include "bpf_util.h" +#include "sock_addr_helpers.h"
#ifndef ENOTSUPP # define ENOTSUPP 524 #endif
#define CG_PATH "/foo" -#define CONNECT4_PROG_PATH "./connect4_prog.bpf.o" -#define CONNECT6_PROG_PATH "./connect6_prog.bpf.o" -#define SENDMSG4_PROG_PATH "./sendmsg4_prog.bpf.o" -#define SENDMSG6_PROG_PATH "./sendmsg6_prog.bpf.o" -#define RECVMSG4_PROG_PATH "./recvmsg4_prog.bpf.o" -#define RECVMSG6_PROG_PATH "./recvmsg6_prog.bpf.o" -#define BIND4_PROG_PATH "./bind4_prog.bpf.o" -#define BIND6_PROG_PATH "./bind6_prog.bpf.o" - -#define SERV4_IP "192.168.1.254" -#define SERV4_REWRITE_IP "127.0.0.1" -#define SRC4_IP "172.16.0.1" -#define SRC4_REWRITE_IP "127.0.0.4" -#define SERV4_PORT 4040 -#define SERV4_REWRITE_PORT 4444 - -#define SERV6_IP "face:b00c:1234:5678::abcd" -#define SERV6_REWRITE_IP "::1" -#define SERV6_V4MAPPED_IP "::ffff:192.168.0.4" -#define SRC6_IP "::1" -#define SRC6_REWRITE_IP "::6" -#define WILDCARD6_IP "::" -#define SERV6_PORT 6060 -#define SERV6_REWRITE_PORT 6666 - #define INET_NTOP_BUF 40
struct sock_addr_test; @@ -661,58 +637,30 @@ static int load_insns(const struct sock_addr_test *test, return ret; }
-static int load_path(const struct sock_addr_test *test, const char *path) +static int ld_path(const struct sock_addr_test *test, const char *path) { - struct bpf_object *obj; - struct bpf_program *prog; - int err; - - obj = bpf_object__open_file(path, NULL); - err = libbpf_get_error(obj); - if (err) { - log_err(">>> Opening BPF object (%s) error.\n", path); - return -1; - } - - prog = bpf_object__next_program(obj, NULL); - if (!prog) - goto err_out; - - bpf_program__set_type(prog, BPF_PROG_TYPE_CGROUP_SOCK_ADDR); - bpf_program__set_expected_attach_type(prog, test->expected_attach_type); - bpf_program__set_flags(prog, testing_prog_flags()); - - err = bpf_object__load(obj); - if (err) { - if (test->expected_result != LOAD_REJECT) - log_err(">>> Loading program (%s) error.\n", path); - goto err_out; - } - - return bpf_program__fd(prog); -err_out: - bpf_object__close(obj); - return -1; + return load_path(path, test->expected_attach_type, + test->expected_result == LOAD_REJECT); }
static int bind4_prog_load(const struct sock_addr_test *test) { - return load_path(test, BIND4_PROG_PATH); + return ld_path(test, BIND4_PROG_PATH); }
static int bind6_prog_load(const struct sock_addr_test *test) { - return load_path(test, BIND6_PROG_PATH); + return ld_path(test, BIND6_PROG_PATH); }
static int connect4_prog_load(const struct sock_addr_test *test) { - return load_path(test, CONNECT4_PROG_PATH); + return ld_path(test, CONNECT4_PROG_PATH); }
static int connect6_prog_load(const struct sock_addr_test *test) { - return load_path(test, CONNECT6_PROG_PATH); + return ld_path(test, CONNECT6_PROG_PATH); }
static int xmsg_ret_only_prog_load(const struct sock_addr_test *test, @@ -800,12 +748,12 @@ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test)
static int recvmsg4_rw_c_prog_load(const struct sock_addr_test *test) { - return load_path(test, RECVMSG4_PROG_PATH); + return ld_path(test, RECVMSG4_PROG_PATH); }
static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test) { - return load_path(test, SENDMSG4_PROG_PATH); + return ld_path(test, SENDMSG4_PROG_PATH); }
static int sendmsg6_rw_dst_asm_prog_load(const struct sock_addr_test *test, @@ -868,7 +816,7 @@ static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test)
static int recvmsg6_rw_c_prog_load(const struct sock_addr_test *test) { - return load_path(test, RECVMSG6_PROG_PATH); + return ld_path(test, RECVMSG6_PROG_PATH); }
static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test) @@ -883,7 +831,7 @@ static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test)
static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test) { - return load_path(test, SENDMSG6_PROG_PATH); + return ld_path(test, SENDMSG6_PROG_PATH); }
static int cmp_addr(const struct sockaddr_storage *addr1,
On 3/29/24 12:18 PM, Jordan Rife wrote:
diff --git a/tools/testing/selftests/bpf/sock_addr_helpers.c b/tools/testing/selftests/bpf/sock_addr_helpers.c new file mode 100644 index 0000000000000..ff2eb09870f16 --- /dev/null +++ b/tools/testing/selftests/bpf/sock_addr_helpers.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h>
+#include <bpf/bpf.h> +#include <bpf/libbpf.h>
+#include "cgroup_helpers.h" +#include "sock_addr_helpers.h" +#include "testing_helpers.h"
+int load_path(const char *path, enum bpf_attach_type attach_type,
bool expect_reject)+{
- struct bpf_object *obj;
- struct bpf_program *prog;
- int err;
- obj = bpf_object__open_file(path, NULL);
Although it works, it is heading to the opposite direction by reusing things from the older test_sock_addr.c.
test_sock_addr.c should have been moved to the test_progs. It is not run by bpf CI and bits get rotten [e.g. the bug fix in patch 8]. There is also old practice like bpf_object__open_file() should have been replaced with the skeleton __open_and_load() instead of refactoring it out to create new use cases.
The newer prog_tests/sock_addr.c was created when adding AF_UNIX support. It has a very similar setup as the older test_sock_addr.c and the intention was to finally retire test_sock_addr.c. e.g. It also has "load_fn loadfn" but is done with skeleton, the program is also attached to cgroup...etc.
Instead of adding a new sock_addr_kern.c in patch 7, it probably will be easier to add the kernel socket tests into the existing prog_tests/sock_addr.c.
Also setup the netns and veth in the prog_tests/sock_addr.c instead of calling out the test_sock_addr.sh (which should also go away eventually), there are examples in prog_tests/ (e.g. mptcp.c).
- err = libbpf_get_error(obj);
- if (err) {
log_err(">>> Opening BPF object (%s) error.\n", path);return -1;- }
- prog = bpf_object__next_program(obj, NULL);
- if (!prog)
goto err_out;- bpf_program__set_type(prog, BPF_PROG_TYPE_CGROUP_SOCK_ADDR);
- bpf_program__set_expected_attach_type(prog, attach_type);
- bpf_program__set_flags(prog, testing_prog_flags());
- err = bpf_object__load(obj);
- if (err) {
if (!expect_reject)log_err(">>> Loading program (%s) error.\n", path);goto err_out;- }
- return bpf_program__fd(prog);
+err_out:
- bpf_object__close(obj);
- return -1;
+}
The newer prog_tests/sock_addr.c was created when adding AF_UNIX support. It has a very similar setup as the older test_sock_addr.c and the intention was to finally retire test_sock_addr.c. e.g. It also has "load_fn loadfn" but is done with skeleton, the program is also attached to cgroup...etc.
Thanks, I wasn't sure what the preferred direction would be here. I saw some discussion in the AF_UNIX support patch series about prog_tests being the preferred approach and there being plans to migrate the old test_sock_addr.c tests to the new format.
I suspect the changes mentioned here (load done with skeleton, etc.) and helpers needed to support the tests in my patch series may also be helpful in retiring test_sock_addr.c.
Instead of adding a new sock_addr_kern.c in patch 7, it probably will be easier to add the kernel socket tests into the existing prog_tests/sock_addr.c.
Originally it felt awkward to try to merge these tests with prog_tests/sock_addr.c, because while the goals are similar the flow is different with loading/unloading a kernel module to drive socket operations. I'll revisit this and see if I can merge everything into prog_tests/sock_addr.c. Switching to kfuncs as mentioned earlier might make this simpler as well.
Also setup the netns and veth in the prog_tests/sock_addr.c instead of calling out the test_sock_addr.sh (which should also go away eventually), there are examples in prog_tests/ (e.g. mptcp.c).
Ack. Sure thing.
-Jordan
Add optional setup/cleanup subcommands to test_sock_addr.sh to allow those phases to be driven externally by the sock_addr_kern test program.
Signed-off-by: Jordan Rife jrife@google.com --- tools/testing/selftests/bpf/test_sock_addr.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/test_sock_addr.sh b/tools/testing/selftests/bpf/test_sock_addr.sh index 3b9fdb8094aa2..dc0dff612b0d2 100755 --- a/tools/testing/selftests/bpf/test_sock_addr.sh +++ b/tools/testing/selftests/bpf/test_sock_addr.sh @@ -55,4 +55,12 @@ TEST_IPv4="127.0.0.4/8" TEST_IPv6="::6/128" MAX_PING_TRIES=5
-main +if [ $# = 0 ]; then + main +elif [ $1 = "setup" ]; then + setup +elif [ $1 = "cleanup" ]; then + cleanup +else + echo "invalid option: $1" +fi
The sock_addr_kern test program leverages the sock_addr_testmod kernel module to test the interaction between kernel socket operations and BPF sockaddr hooks. It focuses on operations that may modify an input address, namely connect, bind, and sendmsg to add regression test coverage for
- commit 0bdf399342c5("net: Avoid address overwrite in kernel_connect") - commit 86a7e0b69bd5("net: prevent rewrite of msg_name in sock_sendmsg()") - commit c889a99a21bf("net: prevent address rewrite in kernel_bind()")
with some additional sanity checks in place to make sure kernel_getpeername() and kernel_getsockname() work as expected. It provides coverage for IPv4, IPv6, and the recently added Unix sockaddr hooks.
Signed-off-by: Jordan Rife jrife@google.com --- tools/testing/selftests/bpf/Makefile | 1 + .../selftests/bpf/prog_tests/sock_addr_kern.c | 631 ++++++++++++++++++ 2 files changed, 632 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/sock_addr_kern.c
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index ccc1c11559a45..58c9ba6eb4e7f 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -654,6 +654,7 @@ TRUNNER_EXTRA_FILES := $(OUTPUT)/urandom_read $(OUTPUT)/bpf_testmod.ko \ $(OUTPUT)/uprobe_multi \ ima_setup.sh \ verify_sig_setup.sh \ + test_sock_addr.sh \ $(wildcard progs/btf_dump_test_case_*.c) \ $(wildcard progs/*.bpf.o) TRUNNER_BPF_BUILD_RULE := CLANG_BPF_BUILD_RULE diff --git a/tools/testing/selftests/bpf/prog_tests/sock_addr_kern.c b/tools/testing/selftests/bpf/prog_tests/sock_addr_kern.c new file mode 100644 index 0000000000000..50959b142c8eb --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/sock_addr_kern.c @@ -0,0 +1,631 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2023 Google LLC. */ +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> + +#include <arpa/inet.h> +#include <sys/socket.h> +#include <sys/un.h> + +#include <bpf/bpf.h> +#include <bpf/libbpf.h> + +#include "test_progs.h" + +#include "cgroup_helpers.h" +#include "testing_helpers.h" +#include "bpf_util.h" +#include "network_helpers.h" +#include "sock_addr_helpers.h" + +#define BIND 0 +#define CONNECT 1 +#define SENDMSG 2 + +struct sock_addr_kern_test; + +typedef int (*load_fn)(const struct sock_addr_kern_test *test); + +struct sock_addr_kern_test { + const char *descr; + /* BPF prog properties */ + load_fn loadfn; + enum bpf_attach_type attach_type; + /* Socket properties */ + int socket_family; + int socket_type; + /* IP:port pairs for BPF prog to override */ + const char *requested_ip; + unsigned short requested_port; + const char *expected_ip; + unsigned short expected_port; + const char *expected_src_ip; +}; + +static int ld_path(const struct sock_addr_kern_test *test, const char *path) +{ + return load_path(path, test->attach_type, false); +} + +static int bind4_prog_load(const struct sock_addr_kern_test *test) +{ + return ld_path(test, BIND4_PROG_PATH); +} + +static int bind6_prog_load(const struct sock_addr_kern_test *test) +{ + return ld_path(test, BIND6_PROG_PATH); +} + +static int connect4_prog_load(const struct sock_addr_kern_test *test) +{ + return ld_path(test, CONNECT4_PROG_PATH); +} + +static int connect6_prog_load(const struct sock_addr_kern_test *test) +{ + return ld_path(test, CONNECT6_PROG_PATH); +} + +static int connect_unix_prog_load(const struct sock_addr_kern_test *test) +{ + return ld_path(test, CONNECTUN_PROG_PATH); +} + +static int sendmsg4_rw_c_prog_load(const struct sock_addr_kern_test *test) +{ + return ld_path(test, SENDMSG4_PROG_PATH); +} + +static int sendmsg6_rw_c_prog_load(const struct sock_addr_kern_test *test) +{ + return ld_path(test, SENDMSG6_PROG_PATH); +} + +static struct sock_addr_kern_test tests[] = { + /* bind */ + { + "bind4: ensure that kernel_bind does not overwrite the address (TCP)", + bind4_prog_load, + BPF_CGROUP_INET4_BIND, + AF_INET, + SOCK_STREAM, + SERV4_IP, + SERV4_PORT, + SERV4_REWRITE_IP, + SERV4_REWRITE_PORT, + }, + { + "bind4: ensure that kernel_bind does not overwrite the address (UDP)", + bind4_prog_load, + BPF_CGROUP_INET4_BIND, + AF_INET, + SOCK_DGRAM, + SERV4_IP, + SERV4_PORT, + SERV4_REWRITE_IP, + SERV4_REWRITE_PORT, + }, + { + "bind6: ensure that kernel_bind does not overwrite the address (TCP)", + bind6_prog_load, + BPF_CGROUP_INET6_BIND, + AF_INET6, + SOCK_STREAM, + SERV6_IP, + SERV6_PORT, + SERV6_REWRITE_IP, + SERV6_REWRITE_PORT, + }, + { + "bind6: ensure that kernel_bind does not overwrite the address (UDP)", + bind6_prog_load, + BPF_CGROUP_INET6_BIND, + AF_INET6, + SOCK_DGRAM, + SERV6_IP, + SERV6_PORT, + SERV6_REWRITE_IP, + SERV6_REWRITE_PORT, + }, + + /* connect */ + { + "connect4: ensure that kernel_connect does not overwrite the address (TCP)", + connect4_prog_load, + BPF_CGROUP_INET4_CONNECT, + AF_INET, + SOCK_STREAM, + SERV4_IP, + SERV4_PORT, + SERV4_REWRITE_IP, + SERV4_REWRITE_PORT, + SRC4_REWRITE_IP, + }, + { + "connect4: ensure that kernel_connect does not overwrite the address (UDP)", + connect4_prog_load, + BPF_CGROUP_INET4_CONNECT, + AF_INET, + SOCK_DGRAM, + SERV4_IP, + SERV4_PORT, + SERV4_REWRITE_IP, + SERV4_REWRITE_PORT, + SRC4_REWRITE_IP, + }, + { + "connect6: ensure that kernel_connect does not overwrite the address (TCP)", + connect6_prog_load, + BPF_CGROUP_INET6_CONNECT, + AF_INET6, + SOCK_STREAM, + SERV6_IP, + SERV6_PORT, + SERV6_REWRITE_IP, + SERV6_REWRITE_PORT, + SRC6_REWRITE_IP, + }, + { + "connect6: ensure that kernel_connect does not overwrite the address (UDP)", + connect6_prog_load, + BPF_CGROUP_INET6_CONNECT, + AF_INET6, + SOCK_DGRAM, + SERV6_IP, + SERV6_PORT, + SERV6_REWRITE_IP, + SERV6_REWRITE_PORT, + SRC6_REWRITE_IP, + }, + { + "connect_unix: ensure that kernel_connect does not overwrite the address", + connect_unix_prog_load, + BPF_CGROUP_UNIX_CONNECT, + AF_UNIX, + SOCK_STREAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + }, + + /* sendmsg */ + { + "sendmsg4: ensure that kernel_sendmsg does not overwrite the address (UDP)", + sendmsg4_rw_c_prog_load, + BPF_CGROUP_UDP4_SENDMSG, + AF_INET, + SOCK_DGRAM, + SERV4_IP, + SERV4_PORT, + SERV4_REWRITE_IP, + SERV4_REWRITE_PORT, + SRC4_REWRITE_IP, + }, + { + "sendmsg6: ensure that kernel_sendmsg does not overwrite the address (UDP)", + sendmsg6_rw_c_prog_load, + BPF_CGROUP_UDP6_SENDMSG, + AF_INET6, + SOCK_DGRAM, + SERV6_IP, + SERV6_PORT, + SERV6_REWRITE_IP, + SERV6_REWRITE_PORT, + SRC6_REWRITE_IP, + }, + { + "sendmsg_unix: ensure that kernel_sendmsg does not overwrite the address", + connect_unix_prog_load, + BPF_CGROUP_UNIX_SENDMSG, + AF_UNIX, + SOCK_DGRAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + }, +}; + +struct sock_addr_testmod_results { + bool success; + struct sockaddr_storage addr; + struct sockaddr_storage sock_name; + struct sockaddr_storage peer_name; +}; + +static int load_mod(const struct sock_addr_kern_test *test, int op) +{ + char params_str[512]; + + if (sprintf(params_str, "ip=%s port=%hu af=%d type=%d op=%d", + test->requested_ip, test->requested_port, + test->socket_family, test->socket_type, op) < 0) + return -1; + + if (load_bpf_sock_addr_testmod(params_str, false)) + return -1; + + return 0; +} + +static int unload_mod(void) +{ + return unload_bpf_sock_addr_testmod(false); +} + +static int read_result(const char *path, void *val, size_t len) +{ + FILE *f; + int err; + + f = fopen(path, "r"); + if (!f) + goto err; + + err = fread(val, 1, len, f); + if (err != len) + goto err; + + err = 0; + goto out; + +err: + err = -1; +out: + if (f) + fclose(f); + + return err; +} + +static int read_mod_results(struct sock_addr_testmod_results *results) +{ + char success[2]; + int err; + + if (read_result("/sys/kernel/debug/sock_addr_testmod/success", success, + sizeof(success))) + goto err; + + switch (success[0]) { + case 'N': + results->success = false; + break; + case 'Y': + results->success = true; + break; + default: + goto err; + } + + if (read_result("/sys/kernel/debug/sock_addr_testmod/addr", + &results->addr, sizeof(results->addr))) + goto err; + + if (read_result("/sys/kernel/debug/sock_addr_testmod/sock_name", + &results->sock_name, sizeof(results->sock_name))) + goto err; + + if (read_result("/sys/kernel/debug/sock_addr_testmod/peer_name", + &results->peer_name, sizeof(results->peer_name))) + goto err; + + err = 0; + goto out; +err: + err = -1; +out: + return err; +} + +static int run_mod_test(const struct sock_addr_kern_test *test, int op, + struct sock_addr_testmod_results *results) +{ + int err; + + if (!ASSERT_OK(load_mod(test, op), "load_mod")) + goto err; + + if (!ASSERT_OK(read_mod_results(results), "read_mod_results")) + goto err; + + err = 0; + goto out; +err: + err = -1; +out: + if (!ASSERT_OK(unload_mod(), "unload_mod")) + err = -1; + + return err; +} + +static const char *ntop(int af, const struct sockaddr_storage *addr, char *buf, + size_t buf_len) +{ + char ip_buf[256]; + struct sockaddr_in6 *sin6; + struct sockaddr_in *sin; + unsigned short port; + + switch (af) { + case AF_INET: + sin = (struct sockaddr_in *)addr; + port = ntohs(sin->sin_port); + + if (!inet_ntop(AF_INET, &sin->sin_addr, ip_buf, sizeof(ip_buf))) + goto err; + + break; + case AF_INET6: + sin6 = (struct sockaddr_in6 *)addr; + port = ntohs(sin6->sin6_port); + + if (!inet_ntop(AF_INET6, &sin6->sin6_addr, ip_buf, + sizeof(ip_buf))) + goto err; + + break; + case AF_UNIX: + strcpy(buf, ((struct sockaddr_un *)addr)->sun_path + 1); + goto out; + default: + goto err; + } + + sprintf(buf, "%s:%d", ip_buf, port); + + goto out; +err: + buf = NULL; +out: + return buf; +} + +static void assert_addr_eq(const char *name, int af, + const struct sockaddr_storage *expected, + const struct sockaddr_storage *got, int cmp_port) +{ + int ret = cmp_addr(expected, 0, got, 0, cmp_port); + char expected_buf[100]; + char got_buf[100]; + int duration = 0; + + CHECK(ret, name, "(expected=%s, got=%s)\n", + ntop(af, expected, expected_buf, sizeof(expected_buf)), + ntop(af, got, got_buf, sizeof(got_buf))); +} + +static void test_kernel_bind(const struct sock_addr_kern_test *test) +{ + struct sock_addr_testmod_results results; + struct sockaddr_storage requested_addr; + struct sockaddr_storage expected_addr; + socklen_t addr_len; + int clientfd = -1; + + if (!ASSERT_OK(make_sockaddr(test->socket_family, test->requested_ip, + test->requested_port, + &requested_addr, NULL), + "make_requested_addr")) + goto cleanup; + + if (!ASSERT_OK(make_sockaddr(test->socket_family, test->expected_ip, + test->expected_port, + &expected_addr, &addr_len), + "make_expected_addr")) + goto cleanup; + + if (!ASSERT_OK(load_mod(test, BIND), "load_mod")) + goto cleanup; + + /* Try to connect to server just in case */ + clientfd = connect_to_addr(&expected_addr, addr_len, test->socket_type); + if (!ASSERT_GT(clientfd, 0, "connect_to_addr")) + goto cleanup; + + if (!ASSERT_OK(read_mod_results(&results), "read_mod_results")) + goto cleanup; + + if (!ASSERT_TRUE(results.success, "results_success")) + goto cleanup; + + assert_addr_eq("addr", test->socket_family, &requested_addr, + &results.addr, 1); + assert_addr_eq("sock_name", test->socket_family, &expected_addr, + &results.sock_name, 1); + +cleanup: + ASSERT_OK(unload_mod(), "unload_mod"); +} + +static void test_kernel_connect(const struct sock_addr_kern_test *test) +{ + struct sockaddr_storage expected_src_addr; + struct sock_addr_testmod_results results; + struct sockaddr_storage requested_addr; + struct sockaddr_storage expected_addr; + int servfd = -1; + + if (!ASSERT_OK(make_sockaddr(test->socket_family, test->requested_ip, + test->requested_port, + &requested_addr, NULL), + "make_requested_addr")) + goto cleanup; + + if (!ASSERT_OK(make_sockaddr(test->socket_family, test->expected_ip, + test->expected_port, + &expected_addr, NULL), + "make_expected_addr")) + goto cleanup; + + if (test->expected_src_ip) + if (!ASSERT_OK(make_sockaddr(test->socket_family, + test->expected_src_ip, 0, + &expected_src_addr, NULL), + "make_expected_src_addr")) + goto cleanup; + + /* Prepare server to connect to */ + servfd = start_server(test->socket_family, test->socket_type, + test->expected_ip, test->expected_port, 0); + if (!ASSERT_GT(servfd, 0, "start_server")) + goto cleanup; + + if (!ASSERT_OK(run_mod_test(test, CONNECT, &results), "run_mod_test")) + goto cleanup; + + if (!ASSERT_TRUE(results.success, "results_success")) + goto cleanup; + + assert_addr_eq("addr", test->socket_family, &requested_addr, + &results.addr, 1); + if (test->expected_src_ip) + assert_addr_eq("source_addr", test->socket_family, &expected_src_addr, + &results.sock_name, 0); + assert_addr_eq("peer_name", test->socket_family, &expected_addr, + &results.peer_name, 1); + +cleanup: + if (servfd > 0) + close(servfd); +} + +static void test_kernel_sendmsg(const struct sock_addr_kern_test *test) +{ + struct sock_addr_testmod_results results; + struct sockaddr_storage expected_addr; + struct sockaddr_storage sendmsg_addr; + struct sockaddr_storage recvmsg_addr; + int servfd = -1; + + if (!ASSERT_OK(make_sockaddr(test->socket_family, test->requested_ip, + test->requested_port, + &sendmsg_addr, NULL), + "make_requested_addr")) + goto cleanup; + + if (test->expected_src_ip) + if (!ASSERT_OK(make_sockaddr(test->socket_family, test->expected_src_ip, + 0, &expected_addr, NULL), + "make_expected_src_addr")) + goto cleanup; + + /* Prepare server to sendmsg to */ + servfd = start_server(test->socket_family, test->socket_type, + test->expected_ip, test->expected_port, 0); + if (!ASSERT_GT(servfd, 0, "start_server")) + goto cleanup; + + if (!ASSERT_OK(run_mod_test(test, SENDMSG, &results), "run_mod_test")) + goto cleanup; + + if (!ASSERT_TRUE(results.success, "results_success")) + goto cleanup; + + assert_addr_eq("msg_name", test->socket_family, &sendmsg_addr, + &results.addr, 1); + + if (!ASSERT_GT(recvmsg_from_client(servfd, &recvmsg_addr), 0, + "recvmsg_from_client")) + goto cleanup; + + if (test->expected_src_ip) + assert_addr_eq("source_addr", test->socket_family, &recvmsg_addr, + &expected_addr, 0); + +cleanup: + if (servfd > 0) + close(servfd); +} + +static void run_test_case(int cgfd, const struct sock_addr_kern_test *test) +{ + int progfd = -1; + + progfd = test->loadfn(test); + if (!ASSERT_GE(progfd, 0, "loadfn")) + goto cleanup; + + if (!ASSERT_OK(bpf_prog_attach(progfd, cgfd, test->attach_type, + BPF_F_ALLOW_OVERRIDE), "bpf_prog_attach")) + goto cleanup; + + switch (test->attach_type) { + case BPF_CGROUP_INET4_BIND: + case BPF_CGROUP_INET6_BIND: + test_kernel_bind(test); + break; + case BPF_CGROUP_INET4_CONNECT: + case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: + test_kernel_connect(test); + break; + case BPF_CGROUP_UDP4_SENDMSG: + case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: + test_kernel_sendmsg(test); + break; + default: + ASSERT_FAIL("attach_type not valid: %d", test->attach_type); + } + +cleanup: + /* Detaching w/o checking return code: best effort attempt. */ + if (progfd != -1) { + bpf_prog_detach(cgfd, test->attach_type); + close(progfd); + } +} + +static void run_tests(int cgfd) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(tests); ++i) { + if (!test__start_subtest(tests[i].descr)) + continue; + + run_test_case(cgfd, &tests[i]); + } +} + +static int setup_test_env(void) +{ + return system("./test_sock_addr.sh setup"); +} + +static int cleanup_test_env(void) +{ + return system("./test_sock_addr.sh cleanup"); +} + +void test_sock_addr_kern(void) +{ + int cgfd = -1; + + if (!ASSERT_OK(setup_cgroup_environment(), "setup_cgroup_environment")) + goto cleanup; + + if (!ASSERT_OK(setup_test_env(), "setup_test_env")) + goto cleanup; + + /* Attach programs to root cgroup so they interact with kernel socket + * operations. + */ + cgfd = get_root_cgroup(); + if (!ASSERT_GE(cgfd, 0, "get_root_cgroup")) + goto cleanup; + + run_tests(cgfd); +cleanup: + if (cgfd >= 0) + close(cgfd); + cleanup_cgroup_environment(); + cleanup_test_env(); +}
Without this fix, the bind4 and bind6 programs will reject bind attempts on big endian systems. This patch ensures that CI tests pass for the s390x architecture.
Signed-off-by: Jordan Rife jrife@google.com --- .../testing/selftests/bpf/progs/bind4_prog.c | 18 ++++++++++-------- .../testing/selftests/bpf/progs/bind6_prog.c | 18 ++++++++++-------- tools/testing/selftests/bpf/progs/bind_prog.h | 19 +++++++++++++++++++ 3 files changed, 39 insertions(+), 16 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/bind_prog.h
diff --git a/tools/testing/selftests/bpf/progs/bind4_prog.c b/tools/testing/selftests/bpf/progs/bind4_prog.c index a487f60b73ac4..2bc052ecb6eef 100644 --- a/tools/testing/selftests/bpf/progs/bind4_prog.c +++ b/tools/testing/selftests/bpf/progs/bind4_prog.c @@ -12,6 +12,8 @@ #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h>
+#include "bind_prog.h" + #define SERV4_IP 0xc0a801feU /* 192.168.1.254 */ #define SERV4_PORT 4040 #define SERV4_REWRITE_IP 0x7f000001U /* 127.0.0.1 */ @@ -118,23 +120,23 @@ int bind_v4_prog(struct bpf_sock_addr *ctx)
// u8 narrow loads: user_ip4 = 0; - user_ip4 |= ((volatile __u8 *)&ctx->user_ip4)[0] << 0; - user_ip4 |= ((volatile __u8 *)&ctx->user_ip4)[1] << 8; - user_ip4 |= ((volatile __u8 *)&ctx->user_ip4)[2] << 16; - user_ip4 |= ((volatile __u8 *)&ctx->user_ip4)[3] << 24; + user_ip4 |= load_byte_ntoh(ctx->user_ip4, 0, sizeof(user_ip4)); + user_ip4 |= load_byte_ntoh(ctx->user_ip4, 1, sizeof(user_ip4)); + user_ip4 |= load_byte_ntoh(ctx->user_ip4, 2, sizeof(user_ip4)); + user_ip4 |= load_byte_ntoh(ctx->user_ip4, 3, sizeof(user_ip4)); if (ctx->user_ip4 != user_ip4) return 0;
user_port = 0; - user_port |= ((volatile __u8 *)&ctx->user_port)[0] << 0; - user_port |= ((volatile __u8 *)&ctx->user_port)[1] << 8; + user_port |= load_byte_ntoh(ctx->user_port, 0, sizeof(user_port)); + user_port |= load_byte_ntoh(ctx->user_port, 1, sizeof(user_port)); if (ctx->user_port != user_port) return 0;
// u16 narrow loads: user_ip4 = 0; - user_ip4 |= ((volatile __u16 *)&ctx->user_ip4)[0] << 0; - user_ip4 |= ((volatile __u16 *)&ctx->user_ip4)[1] << 16; + user_ip4 |= load_word_ntoh(ctx->user_ip4, 0, sizeof(user_ip4)); + user_ip4 |= load_word_ntoh(ctx->user_ip4, 1, sizeof(user_ip4)); if (ctx->user_ip4 != user_ip4) return 0;
diff --git a/tools/testing/selftests/bpf/progs/bind6_prog.c b/tools/testing/selftests/bpf/progs/bind6_prog.c index d62cd9e9cf0ea..194583e3375bf 100644 --- a/tools/testing/selftests/bpf/progs/bind6_prog.c +++ b/tools/testing/selftests/bpf/progs/bind6_prog.c @@ -12,6 +12,8 @@ #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h>
+#include "bind_prog.h" + #define SERV6_IP_0 0xfaceb00c /* face:b00c:1234:5678::abcd */ #define SERV6_IP_1 0x12345678 #define SERV6_IP_2 0x00000000 @@ -129,25 +131,25 @@ int bind_v6_prog(struct bpf_sock_addr *ctx) // u8 narrow loads: for (i = 0; i < 4; i++) { user_ip6 = 0; - user_ip6 |= ((volatile __u8 *)&ctx->user_ip6[i])[0] << 0; - user_ip6 |= ((volatile __u8 *)&ctx->user_ip6[i])[1] << 8; - user_ip6 |= ((volatile __u8 *)&ctx->user_ip6[i])[2] << 16; - user_ip6 |= ((volatile __u8 *)&ctx->user_ip6[i])[3] << 24; + user_ip6 |= load_byte_ntoh(ctx->user_ip6[i], 0, sizeof(user_ip6)); + user_ip6 |= load_byte_ntoh(ctx->user_ip6[i], 1, sizeof(user_ip6)); + user_ip6 |= load_byte_ntoh(ctx->user_ip6[i], 2, sizeof(user_ip6)); + user_ip6 |= load_byte_ntoh(ctx->user_ip6[i], 3, sizeof(user_ip6)); if (ctx->user_ip6[i] != user_ip6) return 0; }
user_port = 0; - user_port |= ((volatile __u8 *)&ctx->user_port)[0] << 0; - user_port |= ((volatile __u8 *)&ctx->user_port)[1] << 8; + user_port |= load_byte_ntoh(ctx->user_port, 0, sizeof(user_port)); + user_port |= load_byte_ntoh(ctx->user_port, 1, sizeof(user_port)); if (ctx->user_port != user_port) return 0;
// u16 narrow loads: for (i = 0; i < 4; i++) { user_ip6 = 0; - user_ip6 |= ((volatile __u16 *)&ctx->user_ip6[i])[0] << 0; - user_ip6 |= ((volatile __u16 *)&ctx->user_ip6[i])[1] << 16; + user_ip6 |= load_word_ntoh(ctx->user_ip6[i], 0, sizeof(user_ip6)); + user_ip6 |= load_word_ntoh(ctx->user_ip6[i], 1, sizeof(user_ip6)); if (ctx->user_ip6[i] != user_ip6) return 0; } diff --git a/tools/testing/selftests/bpf/progs/bind_prog.h b/tools/testing/selftests/bpf/progs/bind_prog.h new file mode 100644 index 0000000000000..0fdc466aec346 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/bind_prog.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __BIND_PROG_H__ +#define __BIND_PROG_H__ + +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ +#define load_byte_ntoh(src, b, s) \ + (((volatile __u8 *)&(src))[b] << 8 * b) +#define load_word_ntoh(src, w, s) \ + (((volatile __u16 *)&(src))[w] << 16 * w) +#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ +#define load_byte_ntoh(src, b, s) \ + (((volatile __u8 *)&(src))[(b) + (sizeof(src) - (s))] << 8 * ((s) - (b) - 1)) +#define load_word_ntoh(src, w, s) \ + (((volatile __u16 *)&(src))[w] << 16 * (((s) / 2) - (w) - 1)) +#else +# error "Fix your compiler's __BYTE_ORDER__?!" +#endif + +#endif
linux-kselftest-mirror@lists.linaro.org
-
Andrii Nakryiko -
Jordan Rife -
Martin KaFai Lau