bpf/progs/test_bpf_nf.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 #include <vmlinux.h>
0003 #include <bpf/bpf_helpers.h>
0004
0005 #define EAFNOSUPPORT 97
0006 #define EPROTO 71
0007 #define ENONET 64
0008 #define EINVAL 22
0009 #define ENOENT 2
0010
0011 extern unsigned long CONFIG_HZ __kconfig;
0012
0013 int test_einval_bpf_tuple = 0;
0014 int test_einval_reserved = 0;
0015 int test_einval_netns_id = 0;
0016 int test_einval_len_opts = 0;
0017 int test_eproto_l4proto = 0;
0018 int test_enonet_netns_id = 0;
0019 int test_enoent_lookup = 0;
0020 int test_eafnosupport = 0;
0021 int test_alloc_entry = -EINVAL;
0022 int test_insert_entry = -EAFNOSUPPORT;
0023 int test_succ_lookup = -ENOENT;
0024 u32 test_delta_timeout = 0;
0025 u32 test_status = 0;
0026
0027 struct nf_conn;
0028
0029 struct bpf_ct_opts___local {
0030     s32 netns_id;
0031     s32 error;
0032     u8 l4proto;
0033     u8 reserved[3];
0034 } __attribute__((preserve_access_index));
0035
0036 struct nf_conn *bpf_xdp_ct_alloc(struct xdp_md *, struct bpf_sock_tuple *, u32,
0037                  struct bpf_ct_opts___local *, u32) __ksym;
0038 struct nf_conn *bpf_xdp_ct_lookup(struct xdp_md *, struct bpf_sock_tuple *, u32,
0039                   struct bpf_ct_opts___local *, u32) __ksym;
0040 struct nf_conn *bpf_skb_ct_alloc(struct __sk_buff *, struct bpf_sock_tuple *, u32,
0041                  struct bpf_ct_opts___local *, u32) __ksym;
0042 struct nf_conn *bpf_skb_ct_lookup(struct __sk_buff *, struct bpf_sock_tuple *, u32,
0043                   struct bpf_ct_opts___local *, u32) __ksym;
0044 struct nf_conn *bpf_ct_insert_entry(struct nf_conn *) __ksym;
0045 void bpf_ct_release(struct nf_conn *) __ksym;
0046 void bpf_ct_set_timeout(struct nf_conn *, u32) __ksym;
0047 int bpf_ct_change_timeout(struct nf_conn *, u32) __ksym;
0048 int bpf_ct_set_status(struct nf_conn *, u32) __ksym;
0049 int bpf_ct_change_status(struct nf_conn *, u32) __ksym;
0050
0051 static __always_inline void
0052 nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
0053                     struct bpf_ct_opts___local *, u32),
0054        struct nf_conn *(*alloc_fn)(void *, struct bpf_sock_tuple *, u32,
0055                        struct bpf_ct_opts___local *, u32),
0056        void *ctx)
0057 {
0058     struct bpf_ct_opts___local opts_def = { .l4proto = IPPROTO_TCP, .netns_id = -1 };
0059     struct bpf_sock_tuple bpf_tuple;
0060     struct nf_conn *ct;
0061     int err;
0062
0063     __builtin_memset(&bpf_tuple, 0, sizeof(bpf_tuple.ipv4));
0064
0065     ct = lookup_fn(ctx, NULL, 0, &opts_def, sizeof(opts_def));
0066     if (ct)
0067         bpf_ct_release(ct);
0068     else
0069         test_einval_bpf_tuple = opts_def.error;
0070
0071     opts_def.reserved[0] = 1;
0072     ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
0073                sizeof(opts_def));
0074     opts_def.reserved[0] = 0;
0075     opts_def.l4proto = IPPROTO_TCP;
0076     if (ct)
0077         bpf_ct_release(ct);
0078     else
0079         test_einval_reserved = opts_def.error;
0080
0081     opts_def.netns_id = -2;
0082     ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
0083                sizeof(opts_def));
0084     opts_def.netns_id = -1;
0085     if (ct)
0086         bpf_ct_release(ct);
0087     else
0088         test_einval_netns_id = opts_def.error;
0089
0090     ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
0091                sizeof(opts_def) - 1);
0092     if (ct)
0093         bpf_ct_release(ct);
0094     else
0095         test_einval_len_opts = opts_def.error;
0096
0097     opts_def.l4proto = IPPROTO_ICMP;
0098     ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
0099                sizeof(opts_def));
0100     opts_def.l4proto = IPPROTO_TCP;
0101     if (ct)
0102         bpf_ct_release(ct);
0103     else
0104         test_eproto_l4proto = opts_def.error;
0105
0106     opts_def.netns_id = 0xf00f;
0107     ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
0108                sizeof(opts_def));
0109     opts_def.netns_id = -1;
0110     if (ct)
0111         bpf_ct_release(ct);
0112     else
0113         test_enonet_netns_id = opts_def.error;
0114
0115     ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
0116                sizeof(opts_def));
0117     if (ct)
0118         bpf_ct_release(ct);
0119     else
0120         test_enoent_lookup = opts_def.error;
0121
0122     ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4) - 1, &opts_def,
0123                sizeof(opts_def));
0124     if (ct)
0125         bpf_ct_release(ct);
0126     else
0127         test_eafnosupport = opts_def.error;
0128
0129     bpf_tuple.ipv4.saddr = bpf_get_prandom_u32(); /* src IP */
0130     bpf_tuple.ipv4.daddr = bpf_get_prandom_u32(); /* dst IP */
0131     bpf_tuple.ipv4.sport = bpf_get_prandom_u32(); /* src port */
0132     bpf_tuple.ipv4.dport = bpf_get_prandom_u32(); /* dst port */
0133
0134     ct = alloc_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
0135               sizeof(opts_def));
0136     if (ct) {
0137         struct nf_conn *ct_ins;
0138
0139         bpf_ct_set_timeout(ct, 10000);
0140         bpf_ct_set_status(ct, IPS_CONFIRMED);
0141
0142         ct_ins = bpf_ct_insert_entry(ct);
0143         if (ct_ins) {
0144             struct nf_conn *ct_lk;
0145
0146             ct_lk = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4),
0147                       &opts_def, sizeof(opts_def));
0148             if (ct_lk) {
0149                 /* update ct entry timeout */
0150                 bpf_ct_change_timeout(ct_lk, 10000);
0151                 test_delta_timeout = ct_lk->timeout - bpf_jiffies64();
0152                 test_delta_timeout /= CONFIG_HZ;
0153                 test_status = IPS_SEEN_REPLY;
0154                 bpf_ct_change_status(ct_lk, IPS_SEEN_REPLY);
0155                 bpf_ct_release(ct_lk);
0156                 test_succ_lookup = 0;
0157             }
0158             bpf_ct_release(ct_ins);
0159             test_insert_entry = 0;
0160         }
0161         test_alloc_entry = 0;
0162     }
0163 }
0164
0165 SEC("xdp")
0166 int nf_xdp_ct_test(struct xdp_md *ctx)
0167 {
0168     nf_ct_test((void *)bpf_xdp_ct_lookup, (void *)bpf_xdp_ct_alloc, ctx);
0169     return 0;
0170 }
0171
0172 SEC("tc")
0173 int nf_skb_ct_test(struct __sk_buff *ctx)
0174 {
0175     nf_ct_test((void *)bpf_skb_ct_lookup, (void *)bpf_skb_ct_alloc, ctx);
0176     return 0;
0177 }
0178
0179 char _license[] SEC("license") = "GPL";