selftests/bpf: Add test for freplace program with write access

This adds a selftest that tests the behavior when a freplace target program
attempts to make a write access on a packet. The expectation is that the read or write
access is granted based on the program type of the linked program and
not itself (which is of type, for e.g., BPF_PROG_TYPE_EXT).

This test fails without the associated patch on the verifier.

Signed-off-by: Udip Pant <udippant@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200825232003.2877030-3-udippant@fb.com

diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c b/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c
index 197d0d217b56be50db470fb237930a2d22a3b61b..7c7168963d52f9572681106e3f503037ab24355d 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c
+++ b/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c
@@ -123,6 +123,7 @@ static void test_func_replace(void)
                "freplace/get_skb_len",
                "freplace/get_skb_ifindex",
                "freplace/get_constant",
+               "freplace/test_pkt_write_access_subprog",
        };
        test_fexit_bpf2bpf_common("./fexit_bpf2bpf.o",
                                  "./test_pkt_access.o",

diff --git a/tools/testing/selftests/bpf/progs/fexit_bpf2bpf.c b/tools/testing/selftests/bpf/progs/fexit_bpf2bpf.c
index 98e1efe1454965f7556ac808cad0bde829ab812e..49a84a3a2306203060fdb3cf0def0fa1177bc1a6 100644 (file)
--- a/tools/testing/selftests/bpf/progs/fexit_bpf2bpf.c
+++ b/tools/testing/selftests/bpf/progs/fexit_bpf2bpf.c
@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright (c) 2019 Facebook */
 #include <linux/stddef.h>
+#include <linux/if_ether.h>
 #include <linux/ipv6.h>
 #include <linux/bpf.h>
+#include <linux/tcp.h>
 #include <bpf/bpf_helpers.h>
 #include <bpf/bpf_endian.h>
 #include <bpf/bpf_tracing.h>
@@ -151,4 +153,29 @@ int new_get_constant(long val)
        test_get_constant = 1;
        return test_get_constant; /* original get_constant() returns val - 122 */
 }
+
+__u64 test_pkt_write_access_subprog = 0;
+SEC("freplace/test_pkt_write_access_subprog")
+int new_test_pkt_write_access_subprog(struct __sk_buff *skb, __u32 off)
+{
+
+       void *data = (void *)(long)skb->data;
+       void *data_end = (void *)(long)skb->data_end;
+       struct tcphdr *tcp;
+
+       if (off > sizeof(struct ethhdr) + sizeof(struct ipv6hdr))
+               return -1;
+
+       tcp = data + off;
+       if (tcp + 1 > data_end)
+               return -1;
+
+       /* make modifications to the packet data */
+       tcp->check++;
+       tcp->syn = 0;
+
+       test_pkt_write_access_subprog = 1;
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";

diff --git a/tools/testing/selftests/bpf/progs/test_pkt_access.c b/tools/testing/selftests/bpf/progs/test_pkt_access.c
index e72eba4a93d21fc44481e364f236c585380fdefe..852051064507d02ace5403b55ded28851161303e 100644 (file)
--- a/tools/testing/selftests/bpf/progs/test_pkt_access.c
+++ b/tools/testing/selftests/bpf/progs/test_pkt_access.c
@@ -79,6 +79,24 @@ int get_skb_ifindex(int val, struct __sk_buff *skb, int var)
        return skb->ifindex * val * var;
 }
 
+__attribute__ ((noinline))
+int test_pkt_write_access_subprog(struct __sk_buff *skb, __u32 off)
+{
+       void *data = (void *)(long)skb->data;
+       void *data_end = (void *)(long)skb->data_end;
+       struct tcphdr *tcp = NULL;
+
+       if (off > sizeof(struct ethhdr) + sizeof(struct ipv6hdr))
+               return -1;
+
+       tcp = data + off;
+       if (tcp + 1 > data_end)
+               return -1;
+       /* make modification to the packet data */
+       tcp->check++;
+       return 0;
+}
+
 SEC("classifier/test_pkt_access")
 int test_pkt_access(struct __sk_buff *skb)
 {
@@ -117,6 +135,8 @@ int test_pkt_access(struct __sk_buff *skb)
        if (test_pkt_access_subprog3(3, skb) != skb->len * 3 * skb->ifindex)
                return TC_ACT_SHOT;
        if (tcp) {
+               if (test_pkt_write_access_subprog(skb, (void *)tcp - data))
+                       return TC_ACT_SHOT;
                if (((void *)(tcp) + 20) > data_end || proto != 6)
                        return TC_ACT_SHOT;
                barrier(); /* to force ordering of checks */