Skip to content

Commit ae173a9

Browse files
fomichevAlexei Starovoitov
authored andcommitted
selftests/bpf: support BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG
bpf_flow.c: exit early unless BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG is passed in flags. Also, set ip_proto earlier, this makes sure we have correct value with fragmented packets. Add selftest cases to test ipv4/ipv6 fragments and skip eth_get_headlen tests that don't have BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG flag. eth_get_headlen calls flow dissector with BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG flag so we can't run tests that have different set of input flags against it. v2: * sefltests -> selftests (Willem de Bruijn) * Reword a comment about eth_get_headlen flags (Song Liu) Acked-by: Petar Penkov <[email protected]> Acked-by: Willem de Bruijn <[email protected]> Acked-by: Song Liu <[email protected]> Cc: Song Liu <[email protected]> Cc: Willem de Bruijn <[email protected]> Cc: Petar Penkov <[email protected]> Signed-off-by: Stanislav Fomichev <[email protected]> Signed-off-by: Alexei Starovoitov <[email protected]>
1 parent 57debff commit ae173a9

File tree

2 files changed

+155
-7
lines changed

2 files changed

+155
-7
lines changed

tools/testing/selftests/bpf/prog_tests/flow_dissector.c

Lines changed: 132 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
#include <linux/if_tun.h>
66
#include <sys/uio.h>
77

8+
#ifndef IP_MF
9+
#define IP_MF 0x2000
10+
#endif
11+
812
#define CHECK_FLOW_KEYS(desc, got, expected) \
913
CHECK_ATTR(memcmp(&got, &expected, sizeof(got)) != 0, \
1014
desc, \
@@ -49,6 +53,18 @@ struct ipv6_pkt {
4953
struct tcphdr tcp;
5054
} __packed;
5155

56+
struct ipv6_frag_pkt {
57+
struct ethhdr eth;
58+
struct ipv6hdr iph;
59+
struct frag_hdr {
60+
__u8 nexthdr;
61+
__u8 reserved;
62+
__be16 frag_off;
63+
__be32 identification;
64+
} ipf;
65+
struct tcphdr tcp;
66+
} __packed;
67+
5268
struct dvlan_ipv6_pkt {
5369
struct ethhdr eth;
5470
__u16 vlan_tci;
@@ -65,9 +81,11 @@ struct test {
6581
struct ipv4_pkt ipv4;
6682
struct svlan_ipv4_pkt svlan_ipv4;
6783
struct ipv6_pkt ipv6;
84+
struct ipv6_frag_pkt ipv6_frag;
6885
struct dvlan_ipv6_pkt dvlan_ipv6;
6986
} pkt;
7087
struct bpf_flow_keys keys;
88+
__u32 flags;
7189
};
7290

7391
#define VLAN_HLEN 4
@@ -143,6 +161,102 @@ struct test tests[] = {
143161
.n_proto = __bpf_constant_htons(ETH_P_IPV6),
144162
},
145163
},
164+
{
165+
.name = "ipv4-frag",
166+
.pkt.ipv4 = {
167+
.eth.h_proto = __bpf_constant_htons(ETH_P_IP),
168+
.iph.ihl = 5,
169+
.iph.protocol = IPPROTO_TCP,
170+
.iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
171+
.iph.frag_off = __bpf_constant_htons(IP_MF),
172+
.tcp.doff = 5,
173+
.tcp.source = 80,
174+
.tcp.dest = 8080,
175+
},
176+
.keys = {
177+
.flags = BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG,
178+
.nhoff = ETH_HLEN,
179+
.thoff = ETH_HLEN + sizeof(struct iphdr),
180+
.addr_proto = ETH_P_IP,
181+
.ip_proto = IPPROTO_TCP,
182+
.n_proto = __bpf_constant_htons(ETH_P_IP),
183+
.is_frag = true,
184+
.is_first_frag = true,
185+
.sport = 80,
186+
.dport = 8080,
187+
},
188+
.flags = BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG,
189+
},
190+
{
191+
.name = "ipv4-no-frag",
192+
.pkt.ipv4 = {
193+
.eth.h_proto = __bpf_constant_htons(ETH_P_IP),
194+
.iph.ihl = 5,
195+
.iph.protocol = IPPROTO_TCP,
196+
.iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
197+
.iph.frag_off = __bpf_constant_htons(IP_MF),
198+
.tcp.doff = 5,
199+
.tcp.source = 80,
200+
.tcp.dest = 8080,
201+
},
202+
.keys = {
203+
.nhoff = ETH_HLEN,
204+
.thoff = ETH_HLEN + sizeof(struct iphdr),
205+
.addr_proto = ETH_P_IP,
206+
.ip_proto = IPPROTO_TCP,
207+
.n_proto = __bpf_constant_htons(ETH_P_IP),
208+
.is_frag = true,
209+
.is_first_frag = true,
210+
},
211+
},
212+
{
213+
.name = "ipv6-frag",
214+
.pkt.ipv6_frag = {
215+
.eth.h_proto = __bpf_constant_htons(ETH_P_IPV6),
216+
.iph.nexthdr = IPPROTO_FRAGMENT,
217+
.iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),
218+
.ipf.nexthdr = IPPROTO_TCP,
219+
.tcp.doff = 5,
220+
.tcp.source = 80,
221+
.tcp.dest = 8080,
222+
},
223+
.keys = {
224+
.flags = BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG,
225+
.nhoff = ETH_HLEN,
226+
.thoff = ETH_HLEN + sizeof(struct ipv6hdr) +
227+
sizeof(struct frag_hdr),
228+
.addr_proto = ETH_P_IPV6,
229+
.ip_proto = IPPROTO_TCP,
230+
.n_proto = __bpf_constant_htons(ETH_P_IPV6),
231+
.is_frag = true,
232+
.is_first_frag = true,
233+
.sport = 80,
234+
.dport = 8080,
235+
},
236+
.flags = BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG,
237+
},
238+
{
239+
.name = "ipv6-no-frag",
240+
.pkt.ipv6_frag = {
241+
.eth.h_proto = __bpf_constant_htons(ETH_P_IPV6),
242+
.iph.nexthdr = IPPROTO_FRAGMENT,
243+
.iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),
244+
.ipf.nexthdr = IPPROTO_TCP,
245+
.tcp.doff = 5,
246+
.tcp.source = 80,
247+
.tcp.dest = 8080,
248+
},
249+
.keys = {
250+
.nhoff = ETH_HLEN,
251+
.thoff = ETH_HLEN + sizeof(struct ipv6hdr) +
252+
sizeof(struct frag_hdr),
253+
.addr_proto = ETH_P_IPV6,
254+
.ip_proto = IPPROTO_TCP,
255+
.n_proto = __bpf_constant_htons(ETH_P_IPV6),
256+
.is_frag = true,
257+
.is_first_frag = true,
258+
},
259+
},
146260
};
147261

148262
static int create_tap(const char *ifname)
@@ -225,6 +339,13 @@ void test_flow_dissector(void)
225339
.data_size_in = sizeof(tests[i].pkt),
226340
.data_out = &flow_keys,
227341
};
342+
static struct bpf_flow_keys ctx = {};
343+
344+
if (tests[i].flags) {
345+
tattr.ctx_in = &ctx;
346+
tattr.ctx_size_in = sizeof(ctx);
347+
ctx.flags = tests[i].flags;
348+
}
228349

229350
err = bpf_prog_test_run_xattr(&tattr);
230351
CHECK_ATTR(tattr.data_size_out != sizeof(flow_keys) ||
@@ -251,10 +372,20 @@ void test_flow_dissector(void)
251372
CHECK(err, "ifup", "err %d errno %d\n", err, errno);
252373

253374
for (i = 0; i < ARRAY_SIZE(tests); i++) {
254-
struct bpf_flow_keys flow_keys = {};
375+
/* Keep in sync with 'flags' from eth_get_headlen. */
376+
__u32 eth_get_headlen_flags =
377+
BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG;
255378
struct bpf_prog_test_run_attr tattr = {};
379+
struct bpf_flow_keys flow_keys = {};
256380
__u32 key = 0;
257381

382+
/* For skb-less case we can't pass input flags; run
383+
* only the tests that have a matching set of flags.
384+
*/
385+
386+
if (tests[i].flags != eth_get_headlen_flags)
387+
continue;
388+
258389
err = tx_tap(tap_fd, &tests[i].pkt, sizeof(tests[i].pkt));
259390
CHECK(err < 0, "tx_tap", "err %d errno %d\n", err, errno);
260391

tools/testing/selftests/bpf/progs/bpf_flow.c

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,6 @@ static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
153153
struct tcphdr *tcp, _tcp;
154154
struct udphdr *udp, _udp;
155155

156-
keys->ip_proto = proto;
157156
switch (proto) {
158157
case IPPROTO_ICMP:
159158
icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
@@ -231,7 +230,6 @@ static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
231230
{
232231
struct bpf_flow_keys *keys = skb->flow_keys;
233232

234-
keys->ip_proto = nexthdr;
235233
switch (nexthdr) {
236234
case IPPROTO_HOPOPTS:
237235
case IPPROTO_DSTOPTS:
@@ -266,20 +264,28 @@ PROG(IP)(struct __sk_buff *skb)
266264
keys->addr_proto = ETH_P_IP;
267265
keys->ipv4_src = iph->saddr;
268266
keys->ipv4_dst = iph->daddr;
267+
keys->ip_proto = iph->protocol;
269268

270269
keys->thoff += iph->ihl << 2;
271270
if (data + keys->thoff > data_end)
272271
return export_flow_keys(keys, BPF_DROP);
273272

274273
if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
275274
keys->is_frag = true;
276-
if (iph->frag_off & bpf_htons(IP_OFFSET))
275+
if (iph->frag_off & bpf_htons(IP_OFFSET)) {
277276
/* From second fragment on, packets do not have headers
278277
* we can parse.
279278
*/
280279
done = true;
281-
else
280+
} else {
282281
keys->is_first_frag = true;
282+
/* No need to parse fragmented packet unless
283+
* explicitly asked for.
284+
*/
285+
if (!(keys->flags &
286+
BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
287+
done = true;
288+
}
283289
}
284290

285291
if (done)
@@ -301,6 +307,7 @@ PROG(IPV6)(struct __sk_buff *skb)
301307
memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
302308

303309
keys->thoff += sizeof(struct ipv6hdr);
310+
keys->ip_proto = ip6h->nexthdr;
304311

305312
return parse_ipv6_proto(skb, ip6h->nexthdr);
306313
}
@@ -317,7 +324,8 @@ PROG(IPV6OP)(struct __sk_buff *skb)
317324
/* hlen is in 8-octets and does not include the first 8 bytes
318325
* of the header
319326
*/
320-
skb->flow_keys->thoff += (1 + ip6h->hdrlen) << 3;
327+
keys->thoff += (1 + ip6h->hdrlen) << 3;
328+
keys->ip_proto = ip6h->nexthdr;
321329

322330
return parse_ipv6_proto(skb, ip6h->nexthdr);
323331
}
@@ -333,9 +341,18 @@ PROG(IPV6FR)(struct __sk_buff *skb)
333341

334342
keys->thoff += sizeof(*fragh);
335343
keys->is_frag = true;
336-
if (!(fragh->frag_off & bpf_htons(IP6_OFFSET)))
344+
keys->ip_proto = fragh->nexthdr;
345+
346+
if (!(fragh->frag_off & bpf_htons(IP6_OFFSET))) {
337347
keys->is_first_frag = true;
338348

349+
/* No need to parse fragmented packet unless
350+
* explicitly asked for.
351+
*/
352+
if (!(keys->flags & BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
353+
return export_flow_keys(keys, BPF_OK);
354+
}
355+
339356
return parse_ipv6_proto(skb, fragh->nexthdr);
340357
}
341358

0 commit comments

Comments
 (0)