Commit 716fa7da authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Martin KaFai Lau
Browse files

selftests/bpf: Extend netkit tests to validate skb meta data 



Add a small netkit test to validate skb mark and priority under the
default scrubbing as well as with mark and priority scrubbing off.

  # ./vmtest.sh -- ./test_progs -t netkit
  [...]
  ./test_progs -t netkit
  [    1.419662] tsc: Refined TSC clocksource calibration: 3407.993 MHz
  [    1.420151] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fcd52370, max_idle_ns: 440795242006 ns
  [    1.420897] clocksource: Switched to clocksource tsc
  [    1.447996] bpf_testmod: loading out-of-tree module taints kernel.
  [    1.448447] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
  #357     tc_netkit_basic:OK
  #358     tc_netkit_device:OK
  #359     tc_netkit_multi_links:OK
  #360     tc_netkit_multi_opts:OK
  #361     tc_netkit_neigh_links:OK
  #362     tc_netkit_pkt_type:OK
  #363     tc_netkit_scrub:OK
  Summary: 7/0 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Acked-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20241004101335.117711-5-daniel@iogearbox.net


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parent 10752583

tools/testing/selftests/bpf/prog_tests/tc_netkit.c

+85 −9
Original line number Diff line number Diff line
@@ -14,6 +14,8 @@ 
#include "netlink_helpers.h"

#include "tc_helpers.h"



#define MARK		42

#define PRIO		0xeb9f

#define ICMP_ECHO	8



struct icmphdr {
@@ -33,7 +35,7 @@ struct iplink_req { 
};



static int create_netkit(int mode, int policy, int peer_policy, int *ifindex,

			 bool same_netns)

			 bool same_netns, int scrub, int peer_scrub)

{

	struct rtnl_handle rth = { .fd = -1 };

	struct iplink_req req = {};
@@ -58,6 +60,8 @@ static int create_netkit(int mode, int policy, int peer_policy, int *ifindex, 
	data = addattr_nest(&req.n, sizeof(req), IFLA_INFO_DATA);

	addattr32(&req.n, sizeof(req), IFLA_NETKIT_POLICY, policy);

	addattr32(&req.n, sizeof(req), IFLA_NETKIT_PEER_POLICY, peer_policy);

	addattr32(&req.n, sizeof(req), IFLA_NETKIT_SCRUB, scrub);

	addattr32(&req.n, sizeof(req), IFLA_NETKIT_PEER_SCRUB, peer_scrub);

	addattr32(&req.n, sizeof(req), IFLA_NETKIT_MODE, mode);

	addattr_nest_end(&req.n, data);

	addattr_nest_end(&req.n, linkinfo);
@@ -118,9 +122,9 @@ static void destroy_netkit(void) 


static int __send_icmp(__u32 dest)

{

	int sock, ret, mark = MARK, prio = PRIO;

	struct sockaddr_in addr;

	struct icmphdr icmp;

	int sock, ret;



	ret = write_sysctl("/proc/sys/net/ipv4/ping_group_range", "0 0");

	if (!ASSERT_OK(ret, "write_sysctl(net.ipv4.ping_group_range)"))
@@ -135,6 +139,15 @@ static int __send_icmp(__u32 dest) 
	if (!ASSERT_OK(ret, "setsockopt(SO_BINDTODEVICE)"))

		goto out;



	ret = setsockopt(sock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark));

	if (!ASSERT_OK(ret, "setsockopt(SO_MARK)"))

		goto out;



	ret = setsockopt(sock, SOL_SOCKET, SO_PRIORITY,

			 &prio, sizeof(prio));

	if (!ASSERT_OK(ret, "setsockopt(SO_PRIORITY)"))

		goto out;



	memset(&addr, 0, sizeof(addr));

	addr.sin_family = AF_INET;

	addr.sin_addr.s_addr = htonl(dest);
@@ -171,7 +184,8 @@ void serial_test_tc_netkit_basic(void) 
	int err, ifindex;



	err = create_netkit(NETKIT_L2, NETKIT_PASS, NETKIT_PASS,

			    &ifindex, false);

			    &ifindex, false, NETKIT_SCRUB_DEFAULT,

			    NETKIT_SCRUB_DEFAULT);

	if (err)

		return;
@@ -285,7 +299,8 @@ static void serial_test_tc_netkit_multi_links_target(int mode, int target) 
	int err, ifindex;



	err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,

			    &ifindex, false);

			    &ifindex, false, NETKIT_SCRUB_DEFAULT,

			    NETKIT_SCRUB_DEFAULT);

	if (err)

		return;
@@ -413,7 +428,8 @@ static void serial_test_tc_netkit_multi_opts_target(int mode, int target) 
	int err, ifindex;



	err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,

			    &ifindex, false);

			    &ifindex, false, NETKIT_SCRUB_DEFAULT,

			    NETKIT_SCRUB_DEFAULT);

	if (err)

		return;
@@ -527,7 +543,8 @@ void serial_test_tc_netkit_device(void) 
	int err, ifindex, ifindex2;



	err = create_netkit(NETKIT_L3, NETKIT_PASS, NETKIT_PASS,

			    &ifindex, true);

			    &ifindex, true, NETKIT_SCRUB_DEFAULT,

			    NETKIT_SCRUB_DEFAULT);

	if (err)

		return;
@@ -638,7 +655,8 @@ static void serial_test_tc_netkit_neigh_links_target(int mode, int target) 
	int err, ifindex;



	err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,

			    &ifindex, false);

			    &ifindex, false, NETKIT_SCRUB_DEFAULT,

			    NETKIT_SCRUB_DEFAULT);

	if (err)

		return;
@@ -715,7 +733,8 @@ static void serial_test_tc_netkit_pkt_type_mode(int mode) 
	struct bpf_link *link;



	err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,

			    &ifindex, true);

			    &ifindex, true, NETKIT_SCRUB_DEFAULT,

			    NETKIT_SCRUB_DEFAULT);

	if (err)

		return;
@@ -779,3 +798,60 @@ void serial_test_tc_netkit_pkt_type(void) 
	serial_test_tc_netkit_pkt_type_mode(NETKIT_L2);

	serial_test_tc_netkit_pkt_type_mode(NETKIT_L3);

}



static void serial_test_tc_netkit_scrub_type(int scrub)

{

	LIBBPF_OPTS(bpf_netkit_opts, optl);

	struct test_tc_link *skel;

	struct bpf_link *link;

	int err, ifindex;



	err = create_netkit(NETKIT_L2, NETKIT_PASS, NETKIT_PASS,

			    &ifindex, false, scrub, scrub);

	if (err)

		return;



	skel = test_tc_link__open();

	if (!ASSERT_OK_PTR(skel, "skel_open"))

		goto cleanup;



	ASSERT_EQ(bpf_program__set_expected_attach_type(skel->progs.tc8,

		  BPF_NETKIT_PRIMARY), 0, "tc8_attach_type");



	err = test_tc_link__load(skel);

	if (!ASSERT_OK(err, "skel_load"))

		goto cleanup;



	assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PRIMARY, 0);

	assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PEER, 0);



	ASSERT_EQ(skel->bss->seen_tc8, false, "seen_tc8");



	link = bpf_program__attach_netkit(skel->progs.tc8, ifindex, &optl);

	if (!ASSERT_OK_PTR(link, "link_attach"))

		goto cleanup;



	skel->links.tc8 = link;



	assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PRIMARY, 1);

	assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PEER, 0);



	tc_skel_reset_all_seen(skel);

	ASSERT_EQ(send_icmp(), 0, "icmp_pkt");



	ASSERT_EQ(skel->bss->seen_tc8, true, "seen_tc8");

	ASSERT_EQ(skel->bss->mark, scrub == NETKIT_SCRUB_NONE ? MARK : 0, "mark");

	ASSERT_EQ(skel->bss->prio, scrub == NETKIT_SCRUB_NONE ? PRIO : 0, "prio");

cleanup:

	test_tc_link__destroy(skel);



	assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PRIMARY, 0);

	assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PEER, 0);

	destroy_netkit();

}



void serial_test_tc_netkit_scrub(void)

{

	serial_test_tc_netkit_scrub_type(NETKIT_SCRUB_DEFAULT);

	serial_test_tc_netkit_scrub_type(NETKIT_SCRUB_NONE);

}

tools/testing/selftests/bpf/progs/test_tc_link.c

+12 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ bool seen_tc4; 
bool seen_tc5;

bool seen_tc6;

bool seen_tc7;

bool seen_tc8;



bool set_type;
@@ -25,6 +26,8 @@ bool seen_eth; 
bool seen_host;

bool seen_mcast;



int mark, prio;



SEC("tc/ingress")

int tc1(struct __sk_buff *skb)

{
@@ -100,3 +103,12 @@ int tc7(struct __sk_buff *skb) 
	seen_tc7 = true;

	return TCX_PASS;

}



SEC("tc/egress")

int tc8(struct __sk_buff *skb)

{

	seen_tc8 = true;

	mark = skb->mark;

	prio = skb->priority;

	return TCX_PASS;

}