selftests/bpf: Add cgroup_skb/egress test for load_bytes_relative

When cgroup_skb/egress triggers the MAC header is not set. Added a
test that asserts reading MAC header is a -EFAULT but NET header
succeeds. The test result from within the eBPF program is stored in
an 1-element array map that the userspace then reads and asserts on.

Another assertion is added that reading from a large offset, past
the end of packet, returns -EFAULT.

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/9028ccbea4385a620e69c0a104f469ffd655c01e.1591812755.git.zhuyifei@google.com
This commit is contained in:
YiFei Zhu 2020-06-10 13:41:40 -05:00 committed by Daniel Borkmann
parent 0f5d82f187
commit bd6fecb9a9
2 changed files with 119 additions and 0 deletions

View File

@ -0,0 +1,71 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright 2020 Google LLC.
*/
#include <test_progs.h>
#include <network_helpers.h>
void test_load_bytes_relative(void)
{
int server_fd, cgroup_fd, prog_fd, map_fd, client_fd;
int err;
struct bpf_object *obj;
struct bpf_program *prog;
struct bpf_map *test_result;
__u32 duration = 0;
__u32 map_key = 0;
__u32 map_value = 0;
cgroup_fd = test__join_cgroup("/load_bytes_relative");
if (CHECK_FAIL(cgroup_fd < 0))
return;
server_fd = start_server(AF_INET, SOCK_STREAM);
if (CHECK_FAIL(server_fd < 0))
goto close_cgroup_fd;
err = bpf_prog_load("./load_bytes_relative.o", BPF_PROG_TYPE_CGROUP_SKB,
&obj, &prog_fd);
if (CHECK_FAIL(err))
goto close_server_fd;
test_result = bpf_object__find_map_by_name(obj, "test_result");
if (CHECK_FAIL(!test_result))
goto close_bpf_object;
map_fd = bpf_map__fd(test_result);
if (map_fd < 0)
goto close_bpf_object;
prog = bpf_object__find_program_by_name(obj, "load_bytes_relative");
if (CHECK_FAIL(!prog))
goto close_bpf_object;
err = bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_INET_EGRESS,
BPF_F_ALLOW_MULTI);
if (CHECK_FAIL(err))
goto close_bpf_object;
client_fd = connect_to_fd(AF_INET, SOCK_STREAM, server_fd);
if (CHECK_FAIL(client_fd < 0))
goto close_bpf_object;
close(client_fd);
err = bpf_map_lookup_elem(map_fd, &map_key, &map_value);
if (CHECK_FAIL(err))
goto close_bpf_object;
CHECK(map_value != 1, "bpf", "bpf program returned failure");
close_bpf_object:
bpf_object__close(obj);
close_server_fd:
close(server_fd);
close_cgroup_fd:
close(cgroup_fd);
}

View File

@ -0,0 +1,48 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright 2020 Google LLC.
*/
#include <errno.h>
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <bpf/bpf_helpers.h>
struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(max_entries, 1);
__type(key, __u32);
__type(value, __u32);
} test_result SEC(".maps");
SEC("cgroup_skb/egress")
int load_bytes_relative(struct __sk_buff *skb)
{
struct ethhdr eth;
struct iphdr iph;
__u32 map_key = 0;
__u32 test_passed = 0;
/* MAC header is not set by the time cgroup_skb/egress triggers */
if (bpf_skb_load_bytes_relative(skb, 0, &eth, sizeof(eth),
BPF_HDR_START_MAC) != -EFAULT)
goto fail;
if (bpf_skb_load_bytes_relative(skb, 0, &iph, sizeof(iph),
BPF_HDR_START_NET))
goto fail;
if (bpf_skb_load_bytes_relative(skb, 0xffff, &iph, sizeof(iph),
BPF_HDR_START_NET) != -EFAULT)
goto fail;
test_passed = 1;
fail:
bpf_map_update_elem(&test_result, &map_key, &test_passed, BPF_ANY);
return 1;
}