bpf: Add PROG_TEST_RUN support for sk_lookup programs

Allow to pass sk_lookup programs to PROG_TEST_RUN. User space
provides the full bpf_sk_lookup struct as context. Since the
context includes a socket pointer that can't be exposed
to user space we define that PROG_TEST_RUN returns the cookie
of the selected socket or zero in place of the socket pointer.

We don't support testing programs that select a reuseport socket,
since this would mean running another (unrelated) BPF program
from the sk_lookup test handler.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210303101816.36774-3-lmb@cloudflare.com

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 4c73086..c931bc9 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1491,6 +1491,9 @@ int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
                             const union bpf_attr *kattr,
                             union bpf_attr __user *uattr);
+int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,
+                               const union bpf_attr *kattr,
+                               union bpf_attr __user *uattr);
 bool btf_ctx_access(int off, int size, enum bpf_access_type type,
                    const struct bpf_prog *prog,
                    struct bpf_insn_access_aux *info);
@@ -1692,6 +1695,13 @@ static inline int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
        return -ENOTSUPP;
 }
 
+static inline int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,
+                                             const union bpf_attr *kattr,
+                                             union bpf_attr __user *uattr)
+{
+       return -ENOTSUPP;
+}
+
 static inline void bpf_map_put(struct bpf_map *map)
 {
 }

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 63a56ed..7f530e3 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -5953,7 +5953,10 @@ struct bpf_pidns_info {
 
 /* User accessible data for SK_LOOKUP programs. Add new fields at the end. */
 struct bpf_sk_lookup {
-       __bpf_md_ptr(struct bpf_sock *, sk); /* Selected socket */
+       union {
+               __bpf_md_ptr(struct bpf_sock *, sk); /* Selected socket */
+               __u64 cookie; /* Non-zero if socket was selected in PROG_TEST_RUN */
+       };
 
        __u32 family;           /* Protocol family (AF_INET, AF_INET6) */
        __u32 protocol;         /* IP protocol (IPPROTO_TCP, IPPROTO_UDP) */

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index eb3c78c..0abdd67 100644 (file)
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -10,8 +10,10 @@
 #include <net/bpf_sk_storage.h>
 #include <net/sock.h>
 #include <net/tcp.h>
+#include <net/net_namespace.h>
 #include <linux/error-injection.h>
 #include <linux/smp.h>
+#include <linux/sock_diag.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/bpf_test_run.h>
@@ -781,3 +783,106 @@ out:
        kfree(data);
        return ret;
 }
+
+int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog, const union bpf_attr *kattr,
+                               union bpf_attr __user *uattr)
+{
+       struct bpf_test_timer t = { NO_PREEMPT };
+       struct bpf_prog_array *progs = NULL;
+       struct bpf_sk_lookup_kern ctx = {};
+       u32 repeat = kattr->test.repeat;
+       struct bpf_sk_lookup *user_ctx;
+       u32 retval, duration;
+       int ret = -EINVAL;
+
+       if (prog->type != BPF_PROG_TYPE_SK_LOOKUP)
+               return -EINVAL;
+
+       if (kattr->test.flags || kattr->test.cpu)
+               return -EINVAL;
+
+       if (kattr->test.data_in || kattr->test.data_size_in || kattr->test.data_out ||
+           kattr->test.data_size_out)
+               return -EINVAL;
+
+       if (!repeat)
+               repeat = 1;
+
+       user_ctx = bpf_ctx_init(kattr, sizeof(*user_ctx));
+       if (IS_ERR(user_ctx))
+               return PTR_ERR(user_ctx);
+
+       if (!user_ctx)
+               return -EINVAL;
+
+       if (user_ctx->sk)
+               goto out;
+
+       if (!range_is_zero(user_ctx, offsetofend(typeof(*user_ctx), local_port), sizeof(*user_ctx)))
+               goto out;
+
+       if (user_ctx->local_port > U16_MAX || user_ctx->remote_port > U16_MAX) {
+               ret = -ERANGE;
+               goto out;
+       }
+
+       ctx.family = (u16)user_ctx->family;
+       ctx.protocol = (u16)user_ctx->protocol;
+       ctx.dport = (u16)user_ctx->local_port;
+       ctx.sport = (__force __be16)user_ctx->remote_port;
+
+       switch (ctx.family) {
+       case AF_INET:
+               ctx.v4.daddr = (__force __be32)user_ctx->local_ip4;
+               ctx.v4.saddr = (__force __be32)user_ctx->remote_ip4;
+               break;
+
+#if IS_ENABLED(CONFIG_IPV6)
+       case AF_INET6:
+               ctx.v6.daddr = (struct in6_addr *)user_ctx->local_ip6;
+               ctx.v6.saddr = (struct in6_addr *)user_ctx->remote_ip6;
+               break;
+#endif
+
+       default:
+               ret = -EAFNOSUPPORT;
+               goto out;
+       }
+
+       progs = bpf_prog_array_alloc(1, GFP_KERNEL);
+       if (!progs) {
+               ret = -ENOMEM;
+               goto out;
+       }
+
+       progs->items[0].prog = prog;
+
+       bpf_test_timer_enter(&t);
+       do {
+               ctx.selected_sk = NULL;
+               retval = BPF_PROG_SK_LOOKUP_RUN_ARRAY(progs, ctx, BPF_PROG_RUN);
+       } while (bpf_test_timer_continue(&t, repeat, &ret, &duration));
+       bpf_test_timer_leave(&t);
+
+       if (ret < 0)
+               goto out;
+
+       user_ctx->cookie = 0;
+       if (ctx.selected_sk) {
+               if (ctx.selected_sk->sk_reuseport && !ctx.no_reuseport) {
+                       ret = -EOPNOTSUPP;
+                       goto out;
+               }
+
+               user_ctx->cookie = sock_gen_cookie(ctx.selected_sk);
+       }
+
+       ret = bpf_test_finish(kattr, uattr, NULL, 0, retval, duration);
+       if (!ret)
+               ret = bpf_ctx_finish(kattr, uattr, user_ctx, sizeof(*user_ctx));
+
+out:
+       bpf_prog_array_free(progs);
+       kfree(user_ctx);
+       return ret;
+}

diff --git a/net/core/filter.c b/net/core/filter.c
index 13bcf24..a526db4 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -10457,6 +10457,7 @@ static u32 sk_lookup_convert_ctx_access(enum bpf_access_type type,
 }
 
 const struct bpf_prog_ops sk_lookup_prog_ops = {
+       .test_run = bpf_prog_test_run_sk_lookup,
 };
 
 const struct bpf_verifier_ops sk_lookup_verifier_ops = {

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 63a56ed..7f530e3 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -5953,7 +5953,10 @@ struct bpf_pidns_info {
 
 /* User accessible data for SK_LOOKUP programs. Add new fields at the end. */
 struct bpf_sk_lookup {
-       __bpf_md_ptr(struct bpf_sock *, sk); /* Selected socket */
+       union {
+               __bpf_md_ptr(struct bpf_sock *, sk); /* Selected socket */
+               __u64 cookie; /* Non-zero if socket was selected in PROG_TEST_RUN */
+       };
 
        __u32 family;           /* Protocol family (AF_INET, AF_INET6) */
        __u32 protocol;         /* IP protocol (IPPROTO_TCP, IPPROTO_UDP) */