Skip to content

Commit

Permalink
selftests/bpf: Extend netkit tests to validate skb meta data
Browse files Browse the repository at this point in the history 
Add a small netkit test to validate skb mark and priority under the
default scrubbing as well as with mark and priority scrubbing off.

  # ./vmtest.sh -- ./test_progs -t netkit
  [...]
  ./test_progs -t netkit
  [    1.419662] tsc: Refined TSC clocksource calibration: 3407.993 MHz
  [    1.420151] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fcd52370, max_idle_ns: 440795242006 ns
  [    1.420897] clocksource: Switched to clocksource tsc
  [    1.447996] bpf_testmod: loading out-of-tree module taints kernel.
  [    1.448447] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
  torvalds#357     tc_netkit_basic:OK
  torvalds#358     tc_netkit_device:OK
  torvalds#359     tc_netkit_multi_links:OK
  torvalds#360     tc_netkit_multi_opts:OK
  torvalds#361     tc_netkit_neigh_links:OK
  torvalds#362     tc_netkit_pkt_type:OK
  torvalds#363     tc_netkit_scrub:OK
  Summary: 7/0 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
  • Loading branch information
@borkmann
borkmann committed Oct 3, 2024
1 parent fdb6592 commit b984e1c
Show file tree
Hide file tree
Showing 2 changed files with 97 additions and 9 deletions.
94 changes: 85 additions & 9 deletions tools/testing/selftests/bpf/prog_tests/tc_netkit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,9 @@
#include "netlink_helpers.h"
#include "tc_helpers.h"

#define ICMP_ECHO 8
#define MARK 42
#define PRIO 0xeb9f
#define ICMP_ECHO 8

struct icmphdr {
__u8 type;
Expand All @@ -33,7 +35,7 @@ struct iplink_req {
};

static int create_netkit(int mode, int policy, int peer_policy, int *ifindex,
bool same_netns)
bool same_netns, int scrub, int peer_scrub)
{
struct rtnl_handle rth = { .fd = -1 };
struct iplink_req req = {};
Expand All @@ -58,6 +60,8 @@ static int create_netkit(int mode, int policy, int peer_policy, int *ifindex,
data = addattr_nest(&req.n, sizeof(req), IFLA_INFO_DATA);
addattr32(&req.n, sizeof(req), IFLA_NETKIT_POLICY, policy);
addattr32(&req.n, sizeof(req), IFLA_NETKIT_PEER_POLICY, peer_policy);
addattr32(&req.n, sizeof(req), IFLA_NETKIT_SCRUB, scrub);
addattr32(&req.n, sizeof(req), IFLA_NETKIT_PEER_SCRUB, peer_scrub);
addattr32(&req.n, sizeof(req), IFLA_NETKIT_MODE, mode);
addattr_nest_end(&req.n, data);
addattr_nest_end(&req.n, linkinfo);
Expand Down Expand Up @@ -118,9 +122,9 @@ static void destroy_netkit(void)

static int __send_icmp(__u32 dest)
{
int sock, ret, mark = MARK, prio = PRIO;
struct sockaddr_in addr;
struct icmphdr icmp;
int sock, ret;

ret = write_sysctl("/proc/sys/net/ipv4/ping_group_range", "0 0");
if (!ASSERT_OK(ret, "write_sysctl(net.ipv4.ping_group_range)"))
Expand All @@ -135,6 +139,15 @@ static int __send_icmp(__u32 dest)
if (!ASSERT_OK(ret, "setsockopt(SO_BINDTODEVICE)"))
goto out;

ret = setsockopt(sock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark));
if (!ASSERT_OK(ret, "setsockopt(SO_MARK)"))
goto out;

ret = setsockopt(sock, SOL_SOCKET, SO_PRIORITY,
&prio, sizeof(prio));
if (!ASSERT_OK(ret, "setsockopt(SO_PRIORITY)"))
goto out;

memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_addr.s_addr = htonl(dest);
Expand Down Expand Up @@ -171,7 +184,8 @@ void serial_test_tc_netkit_basic(void)
int err, ifindex;

err = create_netkit(NETKIT_L2, NETKIT_PASS, NETKIT_PASS,
&ifindex, false);
&ifindex, false, NETKIT_SCRUB_DEFAULT,
NETKIT_SCRUB_DEFAULT);
if (err)
return;

Expand Down Expand Up @@ -285,7 +299,8 @@ static void serial_test_tc_netkit_multi_links_target(int mode, int target)
int err, ifindex;

err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,
&ifindex, false);
&ifindex, false, NETKIT_SCRUB_DEFAULT,
NETKIT_SCRUB_DEFAULT);
if (err)
return;

Expand Down Expand Up @@ -413,7 +428,8 @@ static void serial_test_tc_netkit_multi_opts_target(int mode, int target)
int err, ifindex;

err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,
&ifindex, false);
&ifindex, false, NETKIT_SCRUB_DEFAULT,
NETKIT_SCRUB_DEFAULT);
if (err)
return;

Expand Down Expand Up @@ -527,7 +543,8 @@ void serial_test_tc_netkit_device(void)
int err, ifindex, ifindex2;

err = create_netkit(NETKIT_L3, NETKIT_PASS, NETKIT_PASS,
&ifindex, true);
&ifindex, true, NETKIT_SCRUB_DEFAULT,
NETKIT_SCRUB_DEFAULT);
if (err)
return;

Expand Down Expand Up @@ -638,7 +655,8 @@ static void serial_test_tc_netkit_neigh_links_target(int mode, int target)
int err, ifindex;

err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,
&ifindex, false);
&ifindex, false, NETKIT_SCRUB_DEFAULT,
NETKIT_SCRUB_DEFAULT);
if (err)
return;

Expand Down Expand Up @@ -715,7 +733,8 @@ static void serial_test_tc_netkit_pkt_type_mode(int mode)
struct bpf_link *link;

err = create_netkit(mode, NETKIT_PASS, NETKIT_PASS,
&ifindex, true);
&ifindex, true, NETKIT_SCRUB_DEFAULT,
NETKIT_SCRUB_DEFAULT);
if (err)
return;

Expand Down Expand Up @@ -779,3 +798,60 @@ void serial_test_tc_netkit_pkt_type(void)
serial_test_tc_netkit_pkt_type_mode(NETKIT_L2);
serial_test_tc_netkit_pkt_type_mode(NETKIT_L3);
}

void serial_test_tc_netkit_scrub_type(int scrub)
{
LIBBPF_OPTS(bpf_netkit_opts, optl);
struct test_tc_link *skel;
struct bpf_link *link;
int err, ifindex;

err = create_netkit(NETKIT_L2, NETKIT_PASS, NETKIT_PASS,
&ifindex, false, scrub, scrub);
if (err)
return;

skel = test_tc_link__open();
if (!ASSERT_OK_PTR(skel, "skel_open"))
goto cleanup;

ASSERT_EQ(bpf_program__set_expected_attach_type(skel->progs.tc8,
BPF_NETKIT_PRIMARY), 0, "tc8_attach_type");

err = test_tc_link__load(skel);
if (!ASSERT_OK(err, "skel_load"))
goto cleanup;

assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PRIMARY, 0);
assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PEER, 0);

ASSERT_EQ(skel->bss->seen_tc8, false, "seen_tc8");

link = bpf_program__attach_netkit(skel->progs.tc8, ifindex, &optl);
if (!ASSERT_OK_PTR(link, "link_attach"))
goto cleanup;

skel->links.tc8 = link;

assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PRIMARY, 1);
assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PEER, 0);

tc_skel_reset_all_seen(skel);
ASSERT_EQ(send_icmp(), 0, "icmp_pkt");

ASSERT_EQ(skel->bss->seen_tc8, true, "seen_tc8");
ASSERT_EQ(skel->bss->mark, scrub == NETKIT_SCRUB_NONE ? MARK : 0, "mark");
ASSERT_EQ(skel->bss->prio, scrub == NETKIT_SCRUB_NONE ? PRIO : 0, "prio");
cleanup:
test_tc_link__destroy(skel);

assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PRIMARY, 0);
assert_mprog_count_ifindex(ifindex, BPF_NETKIT_PEER, 0);
destroy_netkit();
}

void serial_test_tc_netkit_scrub(void)
{
serial_test_tc_netkit_scrub_type(NETKIT_SCRUB_DEFAULT);
serial_test_tc_netkit_scrub_type(NETKIT_SCRUB_NONE);
}
12 changes: 12 additions & 0 deletions tools/testing/selftests/bpf/progs/test_tc_link.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,16 @@ bool seen_tc4;
bool seen_tc5;
bool seen_tc6;
bool seen_tc7;
bool seen_tc8;

bool set_type;

bool seen_eth;
bool seen_host;
bool seen_mcast;

int mark, prio;

SEC("tc/ingress")
int tc1(struct __sk_buff *skb)
{
Expand Down Expand Up @@ -100,3 +103,12 @@ int tc7(struct __sk_buff *skb)
seen_tc7 = true;
return TCX_PASS;
}

SEC("tc/egress")
int tc8(struct __sk_buff *skb)
{
seen_tc8 = true;
mark = skb->mark;
prio = skb->priority;
return TCX_PASS;
}

0 comments on commit b984e1c

Please sign in to comment.