Commit d6513727 authored by Shmulik Ladkani's avatar Shmulik Ladkani Committed by Daniel Borkmann
Browse files

bpf, selftests: Test BPF_FLOW_DISSECTOR_CONTINUE 



The dissector program returns BPF_FLOW_DISSECTOR_CONTINUE (and avoids
setting skb->flow_keys or last_dissection map) in case it encounters
IP packets whose (outer) source address is 127.0.0.127.

Additional test is added to prog_tests/flow_dissector.c which sets
this address as test's pkk.iph.saddr, with the expected retval of
BPF_FLOW_DISSECTOR_CONTINUE.

Also, legacy test_flow_dissector.sh was similarly augmented.

Signed-off-by: default avatarShmulik Ladkani <shmulik.ladkani@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarStanislav Fomichev <sdf@google.com>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20220821113519.116765-5-shmulik.ladkani@gmail.com
parent 5deedfbe

tools/testing/selftests/bpf/prog_tests/flow_dissector.c

+21 −0
Original line number Diff line number Diff line
@@ -8,6 +8,8 @@ 


#include "bpf_flow.skel.h"



#define FLOW_CONTINUE_SADDR 0x7f00007f /* 127.0.0.127 */



#ifndef IP_MF

#define IP_MF 0x2000

#endif
@@ -400,6 +402,25 @@ struct test tests[] = { 
		.flags = BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP,

		.retval = BPF_OK,

	},

	{

		.name = "ipip-encap-dissector-continue",

		.pkt.ipip = {

			.eth.h_proto = __bpf_constant_htons(ETH_P_IP),

			.iph.ihl = 5,

			.iph.protocol = IPPROTO_IPIP,

			.iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),

			.iph.saddr = __bpf_constant_htonl(FLOW_CONTINUE_SADDR),

			.iph_inner.ihl = 5,

			.iph_inner.protocol = IPPROTO_TCP,

			.iph_inner.tot_len =

				__bpf_constant_htons(MAGIC_BYTES) -

				sizeof(struct iphdr),

			.tcp.doff = 5,

			.tcp.source = 99,

			.tcp.dest = 9090,

		},

		.retval = BPF_FLOW_DISSECTOR_CONTINUE,

	},

};



static int create_tap(const char *ifname)

tools/testing/selftests/bpf/progs/bpf_flow.c

+15 −0
Original line number Diff line number Diff line
@@ -22,6 +22,8 @@ 
#define PROG(F) PROG_(F, _##F)

#define PROG_(NUM, NAME) SEC("flow_dissector") int flow_dissector_##NUM



#define FLOW_CONTINUE_SADDR 0x7f00007f /* 127.0.0.127 */



/* These are the identifiers of the BPF programs that will be used in tail

 * calls. Name is limited to 16 characters, with the terminating character and

 * bpf_func_ above, we have only 6 to work with, anything after will be cropped.
@@ -143,6 +145,19 @@ int _dissect(struct __sk_buff *skb) 
{

	struct bpf_flow_keys *keys = skb->flow_keys;



	if (keys->n_proto == bpf_htons(ETH_P_IP)) {

		/* IP traffic from FLOW_CONTINUE_SADDR falls-back to

		 * standard dissector

		 */

		struct iphdr *iph, _iph;



		iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);

		if (iph && iph->ihl == 5 &&

		    iph->saddr == bpf_htonl(FLOW_CONTINUE_SADDR)) {

			return BPF_FLOW_DISSECTOR_CONTINUE;

		}

	}



	return parse_eth_proto(skb, keys->n_proto);

}

tools/testing/selftests/bpf/test_flow_dissector.sh

+8 −0
Original line number Diff line number Diff line
@@ -115,6 +115,14 @@ tc filter add dev lo parent ffff: protocol ip pref 1337 flower ip_proto \ 
# Send 10 IPv4/UDP packets from port 10. Filter should not drop any.

./test_flow_dissector -i 4 -f 10



echo "Testing IPv4 from 127.0.0.127 (fallback to generic dissector)..."

# Send 10 IPv4/UDP packets from port 8. Filter should not drop any.

./test_flow_dissector -i 4 -S 127.0.0.127 -f 8

# Send 10 IPv4/UDP packets from port 9. Filter should drop all.

./test_flow_dissector -i 4 -S 127.0.0.127 -f 9 -F

# Send 10 IPv4/UDP packets from port 10. Filter should not drop any.

./test_flow_dissector -i 4 -S 127.0.0.127 -f 10



echo "Testing IPIP..."

# Send 10 IPv4/IPv4/UDP packets from port 8. Filter should not drop any.

./with_addr.sh ./with_tunnels.sh ./test_flow_dissector -o 4 -e bare -i 4 \