tools/testing/selftests/bpf/progs/test_bpf_nf.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <vmlinux.h>
   3 #include <bpf/bpf_helpers.h>
   4
   5 #define EAFNOSUPPORT 97
   6 #define EPROTO 71
   7 #define ENONET 64
   8 #define EINVAL 22
   9 #define ENOENT 2
  10
  11 extern unsigned long CONFIG_HZ __kconfig;
  12
  13 int test_einval_bpf_tuple = 0;
  14 int test_einval_reserved = 0;
  15 int test_einval_netns_id = 0;
  16 int test_einval_len_opts = 0;
  17 int test_eproto_l4proto = 0;
  18 int test_enonet_netns_id = 0;
  19 int test_enoent_lookup = 0;
  20 int test_eafnosupport = 0;
  21 int test_alloc_entry = -EINVAL;
  22 int test_insert_entry = -EAFNOSUPPORT;
  23 int test_succ_lookup = -ENOENT;
  24 u32 test_delta_timeout = 0;
  25 u32 test_status = 0;
  26
  27 struct nf_conn;
  28
  29 struct bpf_ct_opts___local {
  30         s32 netns_id;
  31         s32 error;
  32         u8 l4proto;
  33         u8 reserved[3];
  34 } __attribute__((preserve_access_index));
  35
  36 struct nf_conn *bpf_xdp_ct_alloc(struct xdp_md *, struct bpf_sock_tuple *, u32,
  37                                  struct bpf_ct_opts___local *, u32) __ksym;
  38 struct nf_conn *bpf_xdp_ct_lookup(struct xdp_md *, struct bpf_sock_tuple *, u32,
  39                                   struct bpf_ct_opts___local *, u32) __ksym;
  40 struct nf_conn *bpf_skb_ct_alloc(struct __sk_buff *, struct bpf_sock_tuple *, u32,
  41                                  struct bpf_ct_opts___local *, u32) __ksym;
  42 struct nf_conn *bpf_skb_ct_lookup(struct __sk_buff *, struct bpf_sock_tuple *, u32,
  43                                   struct bpf_ct_opts___local *, u32) __ksym;
  44 struct nf_conn *bpf_ct_insert_entry(struct nf_conn *) __ksym;
  45 void bpf_ct_release(struct nf_conn *) __ksym;
  46 void bpf_ct_set_timeout(struct nf_conn *, u32) __ksym;
  47 int bpf_ct_change_timeout(struct nf_conn *, u32) __ksym;
  48 int bpf_ct_set_status(struct nf_conn *, u32) __ksym;
  49 int bpf_ct_change_status(struct nf_conn *, u32) __ksym;
  50
  51 static __always_inline void
  52 nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
  53                                         struct bpf_ct_opts___local *, u32),
  54            struct nf_conn *(*alloc_fn)(void *, struct bpf_sock_tuple *, u32,
  55                                        struct bpf_ct_opts___local *, u32),
  56            void *ctx)
  57 {
  58         struct bpf_ct_opts___local opts_def = { .l4proto = IPPROTO_TCP, .netns_id = -1 };
  59         struct bpf_sock_tuple bpf_tuple;
  60         struct nf_conn *ct;
  61         int err;
  62
  63         __builtin_memset(&bpf_tuple, 0, sizeof(bpf_tuple.ipv4));
  64
  65         ct = lookup_fn(ctx, NULL, 0, &opts_def, sizeof(opts_def));
  66         if (ct)
  67                 bpf_ct_release(ct);
  68         else
  69                 test_einval_bpf_tuple = opts_def.error;
  70
  71         opts_def.reserved[0] = 1;
  72         ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
  73                        sizeof(opts_def));
  74         opts_def.reserved[0] = 0;
  75         opts_def.l4proto = IPPROTO_TCP;
  76         if (ct)
  77                 bpf_ct_release(ct);
  78         else
  79                 test_einval_reserved = opts_def.error;
  80
  81         opts_def.netns_id = -2;
  82         ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
  83                        sizeof(opts_def));
  84         opts_def.netns_id = -1;
  85         if (ct)
  86                 bpf_ct_release(ct);
  87         else
  88                 test_einval_netns_id = opts_def.error;
  89
  90         ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
  91                        sizeof(opts_def) - 1);
  92         if (ct)
  93                 bpf_ct_release(ct);
  94         else
  95                 test_einval_len_opts = opts_def.error;
  96
  97         opts_def.l4proto = IPPROTO_ICMP;
  98         ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
  99                        sizeof(opts_def));
 100         opts_def.l4proto = IPPROTO_TCP;
 101         if (ct)
 102                 bpf_ct_release(ct);
 103         else
 104                 test_eproto_l4proto = opts_def.error;
 105
 106         opts_def.netns_id = 0xf00f;
 107         ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
 108                        sizeof(opts_def));
 109         opts_def.netns_id = -1;
 110         if (ct)
 111                 bpf_ct_release(ct);
 112         else
 113                 test_enonet_netns_id = opts_def.error;
 114
 115         ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
 116                        sizeof(opts_def));
 117         if (ct)
 118                 bpf_ct_release(ct);
 119         else
 120                 test_enoent_lookup = opts_def.error;
 121
 122         ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4) - 1, &opts_def,
 123                        sizeof(opts_def));
 124         if (ct)
 125                 bpf_ct_release(ct);
 126         else
 127                 test_eafnosupport = opts_def.error;
 128
 129         bpf_tuple.ipv4.saddr = bpf_get_prandom_u32(); /* src IP */
 130         bpf_tuple.ipv4.daddr = bpf_get_prandom_u32(); /* dst IP */
 131         bpf_tuple.ipv4.sport = bpf_get_prandom_u32(); /* src port */
 132         bpf_tuple.ipv4.dport = bpf_get_prandom_u32(); /* dst port */
 133
 134         ct = alloc_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
 135                       sizeof(opts_def));
 136         if (ct) {
 137                 struct nf_conn *ct_ins;
 138
 139                 bpf_ct_set_timeout(ct, 10000);
 140                 bpf_ct_set_status(ct, IPS_CONFIRMED);
 141
 142                 ct_ins = bpf_ct_insert_entry(ct);
 143                 if (ct_ins) {
 144                         struct nf_conn *ct_lk;
 145
 146                         ct_lk = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4),
 147                                           &opts_def, sizeof(opts_def));
 148                         if (ct_lk) {
 149                                 /* update ct entry timeout */
 150                                 bpf_ct_change_timeout(ct_lk, 10000);
 151                                 test_delta_timeout = ct_lk->timeout - bpf_jiffies64();
 152                                 test_delta_timeout /= CONFIG_HZ;
 153                                 test_status = IPS_SEEN_REPLY;
 154                                 bpf_ct_change_status(ct_lk, IPS_SEEN_REPLY);
 155                                 bpf_ct_release(ct_lk);
 156                                 test_succ_lookup = 0;
 157                         }
 158                         bpf_ct_release(ct_ins);
 159                         test_insert_entry = 0;
 160                 }
 161                 test_alloc_entry = 0;
 162         }
 163 }
 164
 165 SEC("xdp")
 166 int nf_xdp_ct_test(struct xdp_md *ctx)
 167 {
 168         nf_ct_test((void *)bpf_xdp_ct_lookup, (void *)bpf_xdp_ct_alloc, ctx);
 169         return 0;
 170 }
 171
 172 SEC("tc")
 173 int nf_skb_ct_test(struct __sk_buff *ctx)
 174 {
 175         nf_ct_test((void *)bpf_skb_ct_lookup, (void *)bpf_skb_ct_alloc, ctx);
 176         return 0;
 177 }
 178
 179 char _license[] SEC("license") = "GPL";