Commit 7c32e8f8 authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Alexei Starovoitov
Browse files

bpf: Add PROG_TEST_RUN support for sk_lookup programs 



Allow to pass sk_lookup programs to PROG_TEST_RUN. User space
provides the full bpf_sk_lookup struct as context. Since the
context includes a socket pointer that can't be exposed
to user space we define that PROG_TEST_RUN returns the cookie
of the selected socket or zero in place of the socket pointer.

We don't support testing programs that select a reuseport socket,
since this would mean running another (unrelated) BPF program
from the sk_lookup test handler.

Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210303101816.36774-3-lmb@cloudflare.com
parent 607b9cc9

include/linux/bpf.h

+10 −0
Original line number Diff line number Diff line
@@ -1491,6 +1491,9 @@ int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, 
int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,

			     const union bpf_attr *kattr,

			     union bpf_attr __user *uattr);

int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,

				const union bpf_attr *kattr,

				union bpf_attr __user *uattr);

bool btf_ctx_access(int off, int size, enum bpf_access_type type,

		    const struct bpf_prog *prog,

		    struct bpf_insn_access_aux *info);
@@ -1692,6 +1695,13 @@ static inline int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, 
	return -ENOTSUPP;

}



static inline int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,

					      const union bpf_attr *kattr,

					      union bpf_attr __user *uattr)

{

	return -ENOTSUPP;

}



static inline void bpf_map_put(struct bpf_map *map)

{

}

include/uapi/linux/bpf.h

+4 −1
Original line number Diff line number Diff line
@@ -5953,7 +5953,10 @@ struct bpf_pidns_info { 


/* User accessible data for SK_LOOKUP programs. Add new fields at the end. */

struct bpf_sk_lookup {

	union {

		__bpf_md_ptr(struct bpf_sock *, sk); /* Selected socket */

		__u64 cookie; /* Non-zero if socket was selected in PROG_TEST_RUN */

	};



	__u32 family;		/* Protocol family (AF_INET, AF_INET6) */

	__u32 protocol;		/* IP protocol (IPPROTO_TCP, IPPROTO_UDP) */

net/bpf/test_run.c

+105 −0
Original line number Diff line number Diff line
@@ -10,8 +10,10 @@ 
#include <net/bpf_sk_storage.h>

#include <net/sock.h>

#include <net/tcp.h>

#include <net/net_namespace.h>

#include <linux/error-injection.h>

#include <linux/smp.h>

#include <linux/sock_diag.h>



#define CREATE_TRACE_POINTS

#include <trace/events/bpf_test_run.h>
@@ -781,3 +783,106 @@ int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, 
	kfree(data);

	return ret;

}



int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog, const union bpf_attr *kattr,

				union bpf_attr __user *uattr)

{

	struct bpf_test_timer t = { NO_PREEMPT };

	struct bpf_prog_array *progs = NULL;

	struct bpf_sk_lookup_kern ctx = {};

	u32 repeat = kattr->test.repeat;

	struct bpf_sk_lookup *user_ctx;

	u32 retval, duration;

	int ret = -EINVAL;



	if (prog->type != BPF_PROG_TYPE_SK_LOOKUP)

		return -EINVAL;



	if (kattr->test.flags || kattr->test.cpu)

		return -EINVAL;



	if (kattr->test.data_in || kattr->test.data_size_in || kattr->test.data_out ||

	    kattr->test.data_size_out)

		return -EINVAL;



	if (!repeat)

		repeat = 1;



	user_ctx = bpf_ctx_init(kattr, sizeof(*user_ctx));

	if (IS_ERR(user_ctx))

		return PTR_ERR(user_ctx);



	if (!user_ctx)

		return -EINVAL;



	if (user_ctx->sk)

		goto out;



	if (!range_is_zero(user_ctx, offsetofend(typeof(*user_ctx), local_port), sizeof(*user_ctx)))

		goto out;



	if (user_ctx->local_port > U16_MAX || user_ctx->remote_port > U16_MAX) {

		ret = -ERANGE;

		goto out;

	}



	ctx.family = (u16)user_ctx->family;

	ctx.protocol = (u16)user_ctx->protocol;

	ctx.dport = (u16)user_ctx->local_port;

	ctx.sport = (__force __be16)user_ctx->remote_port;



	switch (ctx.family) {

	case AF_INET:

		ctx.v4.daddr = (__force __be32)user_ctx->local_ip4;

		ctx.v4.saddr = (__force __be32)user_ctx->remote_ip4;

		break;



#if IS_ENABLED(CONFIG_IPV6)

	case AF_INET6:

		ctx.v6.daddr = (struct in6_addr *)user_ctx->local_ip6;

		ctx.v6.saddr = (struct in6_addr *)user_ctx->remote_ip6;

		break;

#endif



	default:

		ret = -EAFNOSUPPORT;

		goto out;

	}



	progs = bpf_prog_array_alloc(1, GFP_KERNEL);

	if (!progs) {

		ret = -ENOMEM;

		goto out;

	}



	progs->items[0].prog = prog;



	bpf_test_timer_enter(&t);

	do {

		ctx.selected_sk = NULL;

		retval = BPF_PROG_SK_LOOKUP_RUN_ARRAY(progs, ctx, BPF_PROG_RUN);

	} while (bpf_test_timer_continue(&t, repeat, &ret, &duration));

	bpf_test_timer_leave(&t);



	if (ret < 0)

		goto out;



	user_ctx->cookie = 0;

	if (ctx.selected_sk) {

		if (ctx.selected_sk->sk_reuseport && !ctx.no_reuseport) {

			ret = -EOPNOTSUPP;

			goto out;

		}



		user_ctx->cookie = sock_gen_cookie(ctx.selected_sk);

	}



	ret = bpf_test_finish(kattr, uattr, NULL, 0, retval, duration);

	if (!ret)

		ret = bpf_ctx_finish(kattr, uattr, user_ctx, sizeof(*user_ctx));



out:

	bpf_prog_array_free(progs);

	kfree(user_ctx);

	return ret;

}

net/core/filter.c

+1 −0
Original line number Diff line number Diff line
@@ -10457,6 +10457,7 @@ static u32 sk_lookup_convert_ctx_access(enum bpf_access_type type, 
}



const struct bpf_prog_ops sk_lookup_prog_ops = {

	.test_run = bpf_prog_test_run_sk_lookup,

};



const struct bpf_verifier_ops sk_lookup_verifier_ops = {

tools/include/uapi/linux/bpf.h

+4 −1
Original line number Diff line number Diff line
@@ -5953,7 +5953,10 @@ struct bpf_pidns_info { 


/* User accessible data for SK_LOOKUP programs. Add new fields at the end. */

struct bpf_sk_lookup {

	union {

		__bpf_md_ptr(struct bpf_sock *, sk); /* Selected socket */

		__u64 cookie; /* Non-zero if socket was selected in PROG_TEST_RUN */

	};



	__u32 family;		/* Protocol family (AF_INET, AF_INET6) */

	__u32 protocol;		/* IP protocol (IPPROTO_TCP, IPPROTO_UDP) */