Commit 2cd07b0e authored by Daniel Xu's avatar Daniel Xu Committed by Alexei Starovoitov
Browse files

bpf: xfrm: Add selftest for bpf_xdp_get_xfrm_state() 



This commit extends test_tunnel selftest to test the new XDP xfrm state
lookup kfunc.

Co-developed-by: default avatarAntony Antony <antony.antony@secunet.com>
Signed-off-by: default avatarAntony Antony <antony.antony@secunet.com>
Signed-off-by: default avatarDaniel Xu <dxu@dxuuu.xyz>
Link: https://lore.kernel.org/r/e704e9a4332e3eac7b458e4bfdec8fcc6984cdb6.1702593901.git.dxu@dxuuu.xyz


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent e7adc829

tools/testing/selftests/bpf/prog_tests/test_tunnel.c

+14 −2
Original line number Diff line number Diff line
@@ -278,7 +278,7 @@ static int add_xfrm_tunnel(void) 
	SYS(fail,

	    "ip netns exec at_ns0 "

		"ip xfrm state add src %s dst %s proto esp "

			"spi %d reqid 1 mode tunnel "

			"spi %d reqid 1 mode tunnel replay-window 42 "

			"auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s",

	    IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC);

	SYS(fail,
@@ -313,7 +313,7 @@ static int add_xfrm_tunnel(void) 
	 */

	SYS(fail,

	    "ip xfrm state add src %s dst %s proto esp "

		    "spi %d reqid 1 mode tunnel "

		    "spi %d reqid 1 mode tunnel replay-window 42 "

		    "auth-trunc 'hmac(sha1)' %s 96  enc 'cbc(aes)' %s",

	    IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC);

	SYS(fail,
@@ -628,8 +628,10 @@ static void test_xfrm_tunnel(void) 
{

	DECLARE_LIBBPF_OPTS(bpf_tc_hook, tc_hook,

			    .attach_point = BPF_TC_INGRESS);

	LIBBPF_OPTS(bpf_xdp_attach_opts, opts);

	struct test_tunnel_kern *skel = NULL;

	struct nstoken *nstoken;

	int xdp_prog_fd;

	int tc_prog_fd;

	int ifindex;

	int err;
@@ -654,6 +656,14 @@ static void test_xfrm_tunnel(void) 
	if (attach_tc_prog(&tc_hook, tc_prog_fd, -1))

		goto done;



	/* attach xdp prog to tunnel dev */

	xdp_prog_fd = bpf_program__fd(skel->progs.xfrm_get_state_xdp);

	if (!ASSERT_GE(xdp_prog_fd, 0, "bpf_program__fd"))

		goto done;

	err = bpf_xdp_attach(ifindex, xdp_prog_fd, XDP_FLAGS_REPLACE, &opts);

	if (!ASSERT_OK(err, "bpf_xdp_attach"))

		goto done;



	/* ping from at_ns0 namespace test */

	nstoken = open_netns("at_ns0");

	err = test_ping(AF_INET, IP4_ADDR_TUNL_DEV1);
@@ -667,6 +677,8 @@ static void test_xfrm_tunnel(void) 
		goto done;

	if (!ASSERT_EQ(skel->bss->xfrm_remote_ip, 0xac100164, "remote_ip"))

		goto done;

	if (!ASSERT_EQ(skel->bss->xfrm_replay_window, 42, "replay_window"))

		goto done;



done:

	delete_xfrm_tunnel();

tools/testing/selftests/bpf/progs/test_tunnel_kern.c

+51 −0
Original line number Diff line number Diff line
@@ -30,6 +30,10 @@ int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx, 
			  struct bpf_fou_encap *encap, int type) __ksym;

int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx,

			  struct bpf_fou_encap *encap) __ksym;

struct xfrm_state *

bpf_xdp_get_xfrm_state(struct xdp_md *ctx, struct bpf_xfrm_state_opts *opts,

		       u32 opts__sz) __ksym;

void bpf_xdp_xfrm_state_release(struct xfrm_state *x) __ksym;



struct {

	__uint(type, BPF_MAP_TYPE_ARRAY);
@@ -950,4 +954,51 @@ int xfrm_get_state(struct __sk_buff *skb) 
	return TC_ACT_OK;

}



volatile int xfrm_replay_window = 0;



SEC("xdp")

int xfrm_get_state_xdp(struct xdp_md *xdp)

{

	struct bpf_xfrm_state_opts opts = {};

	struct xfrm_state *x = NULL;

	struct ip_esp_hdr *esph;

	struct bpf_dynptr ptr;

	u8 esph_buf[8] = {};

	u8 iph_buf[20] = {};

	struct iphdr *iph;

	u32 off;



	if (bpf_dynptr_from_xdp(xdp, 0, &ptr))

		goto out;



	off = sizeof(struct ethhdr);

	iph = bpf_dynptr_slice(&ptr, off, iph_buf, sizeof(iph_buf));

	if (!iph || iph->protocol != IPPROTO_ESP)

		goto out;



	off += sizeof(struct iphdr);

	esph = bpf_dynptr_slice(&ptr, off, esph_buf, sizeof(esph_buf));

	if (!esph)

		goto out;



	opts.netns_id = BPF_F_CURRENT_NETNS;

	opts.daddr.a4 = iph->daddr;

	opts.spi = esph->spi;

	opts.proto = IPPROTO_ESP;

	opts.family = AF_INET;



	x = bpf_xdp_get_xfrm_state(xdp, &opts, sizeof(opts));

	if (!x)

		goto out;



	if (!x->replay_esn)

		goto out;



	xfrm_replay_window = x->replay_esn->replay_window;

out:

	if (x)

		bpf_xdp_xfrm_state_release(x);

	return XDP_PASS;

}



char _license[] SEC("license") = "GPL";