Commit 2c3af7d9 authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Daniel Borkmann
Browse files

selftests/bpf: fix vlan handling in flow dissector program 



When we tail call PROG(VLAN) from parse_eth_proto we don't need to peek
back to handle vlan proto because we didn't adjust nhoff/thoff yet. Use
flow_keys->n_proto, that we set in parse_eth_proto instead and
properly increment nhoff as well.

Also, always use skb->protocol and don't look at skb->vlan_present.
skb->vlan_present indicates that vlan information is stored out-of-band
in skb->vlan_{tci,proto} and vlan header is already pulled from skb.
That means, skb->vlan_present == true is not relevant for BPF flow
dissector.

Add simple test cases with VLAN tagged frames:
  * single vlan for ipv4
  * double vlan for ipv6

Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent b2e54b09

tools/testing/selftests/bpf/prog_tests/flow_dissector.c

+68 −0
Original line number Diff line number Diff line
@@ -39,6 +39,58 @@ static struct bpf_flow_keys pkt_v6_flow_keys = { 
	.n_proto = __bpf_constant_htons(ETH_P_IPV6),

};



#define VLAN_HLEN	4



static struct {

	struct ethhdr eth;

	__u16 vlan_tci;

	__u16 vlan_proto;

	struct iphdr iph;

	struct tcphdr tcp;

} __packed pkt_vlan_v4 = {

	.eth.h_proto = __bpf_constant_htons(ETH_P_8021Q),

	.vlan_proto = __bpf_constant_htons(ETH_P_IP),

	.iph.ihl = 5,

	.iph.protocol = IPPROTO_TCP,

	.iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),

	.tcp.urg_ptr = 123,

	.tcp.doff = 5,

};



static struct bpf_flow_keys pkt_vlan_v4_flow_keys = {

	.nhoff = VLAN_HLEN,

	.thoff = VLAN_HLEN + sizeof(struct iphdr),

	.addr_proto = ETH_P_IP,

	.ip_proto = IPPROTO_TCP,

	.n_proto = __bpf_constant_htons(ETH_P_IP),

};



static struct {

	struct ethhdr eth;

	__u16 vlan_tci;

	__u16 vlan_proto;

	__u16 vlan_tci2;

	__u16 vlan_proto2;

	struct ipv6hdr iph;

	struct tcphdr tcp;

} __packed pkt_vlan_v6 = {

	.eth.h_proto = __bpf_constant_htons(ETH_P_8021AD),

	.vlan_proto = __bpf_constant_htons(ETH_P_8021Q),

	.vlan_proto2 = __bpf_constant_htons(ETH_P_IPV6),

	.iph.nexthdr = IPPROTO_TCP,

	.iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),

	.tcp.urg_ptr = 123,

	.tcp.doff = 5,

};



static struct bpf_flow_keys pkt_vlan_v6_flow_keys = {

	.nhoff = VLAN_HLEN * 2,

	.thoff = VLAN_HLEN * 2 + sizeof(struct ipv6hdr),

	.addr_proto = ETH_P_IPV6,

	.ip_proto = IPPROTO_TCP,

	.n_proto = __bpf_constant_htons(ETH_P_IPV6),

};



void test_flow_dissector(void)

{

	struct bpf_flow_keys flow_keys;
@@ -68,5 +120,21 @@ void test_flow_dissector(void) 
	      err, errno, retval, duration, size, sizeof(flow_keys));

	CHECK_FLOW_KEYS("ipv6_flow_keys", flow_keys, pkt_v6_flow_keys);



	err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v4, sizeof(pkt_vlan_v4),

				&flow_keys, &size, &retval, &duration);

	CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv4",

	      "err %d errno %d retval %d duration %d size %u/%lu\n",

	      err, errno, retval, duration, size, sizeof(flow_keys));

	CHECK_FLOW_KEYS("vlan_ipv4_flow_keys", flow_keys,

			pkt_vlan_v4_flow_keys);



	err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v6, sizeof(pkt_vlan_v6),

				&flow_keys, &size, &retval, &duration);

	CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv6",

	      "err %d errno %d retval %d duration %d size %u/%lu\n",

	      err, errno, retval, duration, size, sizeof(flow_keys));

	CHECK_FLOW_KEYS("vlan_ipv6_flow_keys", flow_keys,

			pkt_vlan_v6_flow_keys);



	bpf_object__close(obj);

}

tools/testing/selftests/bpf/progs/bpf_flow.c

+4 −11
Original line number Diff line number Diff line
@@ -119,10 +119,7 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto) 
SEC("flow_dissector")

int _dissect(struct __sk_buff *skb)

{

	if (!skb->vlan_present)

	return parse_eth_proto(skb, skb->protocol);

	else

		return parse_eth_proto(skb, skb->vlan_proto);

}



/* Parses on IPPROTO_* */
@@ -336,15 +333,9 @@ PROG(VLAN)(struct __sk_buff *skb) 
{

	struct bpf_flow_keys *keys = skb->flow_keys;

	struct vlan_hdr *vlan, _vlan;

	__be16 proto;



	/* Peek back to see if single or double-tagging */

	if (bpf_skb_load_bytes(skb, keys->thoff - sizeof(proto), &proto,

			       sizeof(proto)))

		return BPF_DROP;



	/* Account for double-tagging */

	if (proto == bpf_htons(ETH_P_8021AD)) {

	if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {

		vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);

		if (!vlan)

			return BPF_DROP;
@@ -352,6 +343,7 @@ PROG(VLAN)(struct __sk_buff *skb) 
		if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))

			return BPF_DROP;



		keys->nhoff += sizeof(*vlan);

		keys->thoff += sizeof(*vlan);

	}
@@ -359,6 +351,7 @@ PROG(VLAN)(struct __sk_buff *skb) 
	if (!vlan)

		return BPF_DROP;



	keys->nhoff += sizeof(*vlan);

	keys->thoff += sizeof(*vlan);

	/* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/

	if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||