tools/testing/selftests/bpf/prog_tests/sk_assign.c - linux - Git at Google

 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2018 Facebook
 // Copyright (c) 2019 Cloudflare
 // Copyright (c) 2020 Isovalent, Inc.
 /*
  * Test that the socket assign program is able to redirect traffic towards a
  * socket, regardless of whether the port or address destination of the traffic
  * matches the port.
  */

 #define _GNU_SOURCE
 #include <fcntl.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <unistd.h>

 #include "test_progs.h"

 #define BIND_PORT 1234
 #define CONNECT_PORT 4321
 #define TEST_DADDR (0xC0A80203)
 #define NS_SELF "/proc/self/ns/net"
 #define SERVER_MAP_PATH "/sys/fs/bpf/tc/globals/server_map"

 static const struct timeval timeo_sec = { .tv_sec = 3 };
 static const size_t timeo_optlen = sizeof(timeo_sec);
 static int stop, duration;

 static bool
 configure_stack(void)
 {
 	char tc_cmd[BUFSIZ];

 	/* Move to a new networking namespace */
 	if (CHECK_FAIL(unshare(CLONE_NEWNET)))
 		return false;

 	/* Configure necessary links, routes */
 	if (CHECK_FAIL(system("ip link set dev lo up")))
 		return false;
 	if (CHECK_FAIL(system("ip route add local default dev lo")))
 		return false;
 	if (CHECK_FAIL(system("ip -6 route add local default dev lo")))
 		return false;

 	/* Load qdisc, BPF program */
 	if (CHECK_FAIL(system("tc qdisc add dev lo clsact")))
 		return false;
 	sprintf(tc_cmd, "%s %s %s %s", "tc filter add dev lo ingress bpf",
 		       "direct-action object-file ./test_sk_assign.o",
 		       "section classifier/sk_assign_test",
 		       (env.verbosity < VERBOSE_VERY) ? " 2>/dev/null" : "verbose");
 	if (CHECK(system(tc_cmd), "BPF load failed;",
 		  "run with -vv for more info\n"))
 		return false;

 	return true;
 }

 static int
 start_server(const struct sockaddr *addr, socklen_t len, int type)
 {
 	int fd;

 	fd = socket(addr->sa_family, type, 0);
 	if (CHECK_FAIL(fd == -1))
 		goto out;
 	if (CHECK_FAIL(setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo_sec,
 				  timeo_optlen)))
 		goto close_out;
 	if (CHECK_FAIL(bind(fd, addr, len) == -1))
 		goto close_out;
 	if (type == SOCK_STREAM && CHECK_FAIL(listen(fd, 128) == -1))
 		goto close_out;

 	goto out;
 close_out:
 	close(fd);
 	fd = -1;
 out:
 	return fd;
 }

 static int
 connect_to_server(const struct sockaddr *addr, socklen_t len, int type)
 {
 	int fd = -1;

 	fd = socket(addr->sa_family, type, 0);
 	if (CHECK_FAIL(fd == -1))
 		goto out;
 	if (CHECK_FAIL(setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo_sec,
 				  timeo_optlen)))
 		goto close_out;
 	if (CHECK_FAIL(connect(fd, addr, len)))
 		goto close_out;

 	goto out;
 close_out:
 	close(fd);
 	fd = -1;
 out:
 	return fd;
 }

 static in_port_t
 get_port(int fd)
 {
 	struct sockaddr_storage ss;
 	socklen_t slen = sizeof(ss);
 	in_port_t port = 0;

 	if (CHECK_FAIL(getsockname(fd, (struct sockaddr *)&ss, &slen)))
 		return port;

 	switch (ss.ss_family) {
 	case AF_INET:
 		port = ((struct sockaddr_in *)&ss)->sin_port;
 		break;
 	case AF_INET6:
 		port = ((struct sockaddr_in6 *)&ss)->sin6_port;
 		break;
 	default:
 		CHECK(1, "Invalid address family", "%d\n", ss.ss_family);
 	}
 	return port;
 }

 static ssize_t
 rcv_msg(int srv_client, int type)
 {
 	struct sockaddr_storage ss;
 	char buf[BUFSIZ];
 	socklen_t slen;

 	if (type == SOCK_STREAM)
 		return read(srv_client, &buf, sizeof(buf));
 	else
 		return recvfrom(srv_client, &buf, sizeof(buf), 0,
 				(struct sockaddr *)&ss, &slen);
 }

 static int
 run_test(int server_fd, const struct sockaddr *addr, socklen_t len, int type)
 {
 	int client = -1, srv_client = -1;
 	char buf[] = "testing";
 	in_port_t port;
 	int ret = 1;

 	client = connect_to_server(addr, len, type);
 	if (client == -1) {
 		perror("Cannot connect to server");
 		goto out;
 	}

 	if (type == SOCK_STREAM) {
 		srv_client = accept(server_fd, NULL, NULL);
 		if (CHECK_FAIL(srv_client == -1)) {
 			perror("Can't accept connection");
 			goto out;
 		}
 	} else {
 		srv_client = server_fd;
 	}
 	if (CHECK_FAIL(write(client, buf, sizeof(buf)) != sizeof(buf))) {
 		perror("Can't write on client");
 		goto out;
 	}
 	if (CHECK_FAIL(rcv_msg(srv_client, type) != sizeof(buf))) {
 		perror("Can't read on server");
 		goto out;
 	}

 	port = get_port(srv_client);
 	if (CHECK_FAIL(!port))
 		goto out;
 	/* SOCK_STREAM is connected via accept(), so the server's local address
 	 * will be the CONNECT_PORT rather than the BIND port that corresponds
 	 * to the listen socket. SOCK_DGRAM on the other hand is connectionless
 	 * so we can't really do the same check there; the server doesn't ever
 	 * create a socket with CONNECT_PORT.
 	 */
 	if (type == SOCK_STREAM &&
 	    CHECK(port != htons(CONNECT_PORT), "Expected", "port %u but got %u",
 		  CONNECT_PORT, ntohs(port)))
 		goto out;
 	else if (type == SOCK_DGRAM &&
 		 CHECK(port != htons(BIND_PORT), "Expected",
 		       "port %u but got %u", BIND_PORT, ntohs(port)))
 		goto out;

 	ret = 0;
 out:
 	close(client);
 	if (srv_client != server_fd)
 		close(srv_client);
 	if (ret)
 		WRITE_ONCE(stop, 1);
 	return ret;
 }

 static void
 prepare_addr(struct sockaddr *addr, int family, __u16 port, bool rewrite_addr)
 {
 	struct sockaddr_in *addr4;
 	struct sockaddr_in6 *addr6;

 	switch (family) {
 	case AF_INET:
 		addr4 = (struct sockaddr_in *)addr;
 		memset(addr4, 0, sizeof(*addr4));
 		addr4->sin_family = family;
 		addr4->sin_port = htons(port);
 		if (rewrite_addr)
 			addr4->sin_addr.s_addr = htonl(TEST_DADDR);
 		else
 			addr4->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 		break;
 	case AF_INET6:
 		addr6 = (struct sockaddr_in6 *)addr;
 		memset(addr6, 0, sizeof(*addr6));
 		addr6->sin6_family = family;
 		addr6->sin6_port = htons(port);
 		addr6->sin6_addr = in6addr_loopback;
 		if (rewrite_addr)
 			addr6->sin6_addr.s6_addr32[3] = htonl(TEST_DADDR);
 		break;
 	default:
 		fprintf(stderr, "Invalid family %d", family);
 	}
 }

 struct test_sk_cfg {
 	const char *name;
 	int family;
 	struct sockaddr *addr;
 	socklen_t len;
 	int type;
 	bool rewrite_addr;
 };

 #define TEST(NAME, FAMILY, TYPE, REWRITE)				\
 {									\
 	.name = NAME,							\
 	.family = FAMILY,						\
 	.addr = (FAMILY == AF_INET) ? (struct sockaddr *)&addr4		\
 				    : (struct sockaddr *)&addr6,	\
 	.len = (FAMILY == AF_INET) ? sizeof(addr4) : sizeof(addr6),	\
 	.type = TYPE,							\
 	.rewrite_addr = REWRITE,					\
 }

 void test_sk_assign(void)
 {
 	struct sockaddr_in addr4;
 	struct sockaddr_in6 addr6;
 	struct test_sk_cfg tests[] = {
 		TEST("ipv4 tcp port redir", AF_INET, SOCK_STREAM, false),
 		TEST("ipv4 tcp addr redir", AF_INET, SOCK_STREAM, true),
 		TEST("ipv6 tcp port redir", AF_INET6, SOCK_STREAM, false),
 		TEST("ipv6 tcp addr redir", AF_INET6, SOCK_STREAM, true),
 		TEST("ipv4 udp port redir", AF_INET, SOCK_DGRAM, false),
 		TEST("ipv4 udp addr redir", AF_INET, SOCK_DGRAM, true),
 		TEST("ipv6 udp port redir", AF_INET6, SOCK_DGRAM, false),
 		TEST("ipv6 udp addr redir", AF_INET6, SOCK_DGRAM, true),
 	};
 	__s64 server = -1;
 	int server_map;
 	int self_net;
 	int i;

 	self_net = open(NS_SELF, O_RDONLY);
 	if (CHECK_FAIL(self_net < 0)) {
 		perror("Unable to open "NS_SELF);
 		return;
 	}

 	if (!configure_stack()) {
 		perror("configure_stack");
 		goto cleanup;
 	}

 	server_map = bpf_obj_get(SERVER_MAP_PATH);
 	if (CHECK_FAIL(server_map < 0)) {
 		perror("Unable to open " SERVER_MAP_PATH);
 		goto cleanup;
 	}

 	for (i = 0; i < ARRAY_SIZE(tests) && !READ_ONCE(stop); i++) {
 		struct test_sk_cfg *test = &tests[i];
 		const struct sockaddr *addr;
 		const int zero = 0;
 		int err;

 		if (!test__start_subtest(test->name))
 			continue;
 		prepare_addr(test->addr, test->family, BIND_PORT, false);
 		addr = (const struct sockaddr *)test->addr;
 		server = start_server(addr, test->len, test->type);
 		if (server == -1)
 			goto close;

 		err = bpf_map_update_elem(server_map, &zero, &server, BPF_ANY);
 		if (CHECK_FAIL(err)) {
 			perror("Unable to update server_map");
 			goto close;
 		}

 		/* connect to unbound ports */
 		prepare_addr(test->addr, test->family, CONNECT_PORT,
 			     test->rewrite_addr);
 		if (run_test(server, addr, test->len, test->type))
 			goto close;

 		close(server);
 		server = -1;
 	}

 close:
 	close(server);
 	close(server_map);
 cleanup:
 	if (CHECK_FAIL(unlink(SERVER_MAP_PATH)))
 		perror("Unable to unlink " SERVER_MAP_PATH);
 	if (CHECK_FAIL(setns(self_net, CLONE_NEWNET)))
 		perror("Failed to setns("NS_SELF")");
 	close(self_net);
 }
	// SPDX-License-Identifier: GPL-2.0
	// Copyright (c) 2018 Facebook
	// Copyright (c) 2019 Cloudflare
	// Copyright (c) 2020 Isovalent, Inc.
	/*
	* Test that the socket assign program is able to redirect traffic towards a
	* socket, regardless of whether the port or address destination of the traffic
	* matches the port.
	*/

	#define _GNU_SOURCE
	#include <fcntl.h>
	#include <signal.h>
	#include <stdlib.h>
	#include <unistd.h>

	#include "test_progs.h"

	#define BIND_PORT 1234
	#define CONNECT_PORT 4321
	#define TEST_DADDR (0xC0A80203)
	#define NS_SELF "/proc/self/ns/net"
	#define SERVER_MAP_PATH "/sys/fs/bpf/tc/globals/server_map"

	static const struct timeval timeo_sec = { .tv_sec = 3 };
	static const size_t timeo_optlen = sizeof(timeo_sec);
	static int stop, duration;

	static bool
	configure_stack(void)
	{
	char tc_cmd[BUFSIZ];

	/* Move to a new networking namespace */
	if (CHECK_FAIL(unshare(CLONE_NEWNET)))
	return false;

	/* Configure necessary links, routes */
	if (CHECK_FAIL(system("ip link set dev lo up")))
	return false;
	if (CHECK_FAIL(system("ip route add local default dev lo")))
	return false;
	if (CHECK_FAIL(system("ip -6 route add local default dev lo")))
	return false;

	/* Load qdisc, BPF program */
	if (CHECK_FAIL(system("tc qdisc add dev lo clsact")))
	return false;
	sprintf(tc_cmd, "%s %s %s %s", "tc filter add dev lo ingress bpf",
	"direct-action object-file ./test_sk_assign.o",
	"section classifier/sk_assign_test",
	(env.verbosity < VERBOSE_VERY) ? " 2>/dev/null" : "verbose");
	if (CHECK(system(tc_cmd), "BPF load failed;",
	"run with -vv for more info\n"))
	return false;

	return true;
	}

	static int
	start_server(const struct sockaddr *addr, socklen_t len, int type)
	{
	int fd;

	fd = socket(addr->sa_family, type, 0);
	if (CHECK_FAIL(fd == -1))
	goto out;
	if (CHECK_FAIL(setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo_sec,
	timeo_optlen)))
	goto close_out;
	if (CHECK_FAIL(bind(fd, addr, len) == -1))
	goto close_out;
	if (type == SOCK_STREAM && CHECK_FAIL(listen(fd, 128) == -1))
	goto close_out;

	goto out;
	close_out:
	close(fd);
	fd = -1;
	out:
	return fd;
	}

	static int
	connect_to_server(const struct sockaddr *addr, socklen_t len, int type)
	{
	int fd = -1;

	fd = socket(addr->sa_family, type, 0);
	if (CHECK_FAIL(fd == -1))
	goto out;
	if (CHECK_FAIL(setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo_sec,
	timeo_optlen)))
	goto close_out;
	if (CHECK_FAIL(connect(fd, addr, len)))
	goto close_out;

	goto out;
	close_out:
	close(fd);
	fd = -1;
	out:
	return fd;
	}

	static in_port_t
	get_port(int fd)
	{
	struct sockaddr_storage ss;
	socklen_t slen = sizeof(ss);
	in_port_t port = 0;

	if (CHECK_FAIL(getsockname(fd, (struct sockaddr *)&ss, &slen)))
	return port;

	switch (ss.ss_family) {
	case AF_INET:
	port = ((struct sockaddr_in *)&ss)->sin_port;
	break;
	case AF_INET6:
	port = ((struct sockaddr_in6 *)&ss)->sin6_port;
	break;
	default:
	CHECK(1, "Invalid address family", "%d\n", ss.ss_family);
	}
	return port;
	}

	static ssize_t
	rcv_msg(int srv_client, int type)
	{
	struct sockaddr_storage ss;
	char buf[BUFSIZ];
	socklen_t slen;

	if (type == SOCK_STREAM)
	return read(srv_client, &buf, sizeof(buf));
	else
	return recvfrom(srv_client, &buf, sizeof(buf), 0,
	(struct sockaddr *)&ss, &slen);
	}

	static int
	run_test(int server_fd, const struct sockaddr *addr, socklen_t len, int type)
	{
	int client = -1, srv_client = -1;
	char buf[] = "testing";
	in_port_t port;
	int ret = 1;

	client = connect_to_server(addr, len, type);
	if (client == -1) {
	perror("Cannot connect to server");
	goto out;
	}

	if (type == SOCK_STREAM) {
	srv_client = accept(server_fd, NULL, NULL);
	if (CHECK_FAIL(srv_client == -1)) {
	perror("Can't accept connection");
	goto out;
	}
	} else {
	srv_client = server_fd;
	}
	if (CHECK_FAIL(write(client, buf, sizeof(buf)) != sizeof(buf))) {
	perror("Can't write on client");
	goto out;
	}
	if (CHECK_FAIL(rcv_msg(srv_client, type) != sizeof(buf))) {
	perror("Can't read on server");
	goto out;
	}

	port = get_port(srv_client);
	if (CHECK_FAIL(!port))
	goto out;
	/* SOCK_STREAM is connected via accept(), so the server's local address
	* will be the CONNECT_PORT rather than the BIND port that corresponds
	* to the listen socket. SOCK_DGRAM on the other hand is connectionless
	* so we can't really do the same check there; the server doesn't ever
	* create a socket with CONNECT_PORT.
	*/
	if (type == SOCK_STREAM &&
	CHECK(port != htons(CONNECT_PORT), "Expected", "port %u but got %u",
	CONNECT_PORT, ntohs(port)))
	goto out;
	else if (type == SOCK_DGRAM &&
	CHECK(port != htons(BIND_PORT), "Expected",
	"port %u but got %u", BIND_PORT, ntohs(port)))
	goto out;

	ret = 0;
	out:
	close(client);
	if (srv_client != server_fd)
	close(srv_client);
	if (ret)
	WRITE_ONCE(stop, 1);
	return ret;
	}

	static void
	prepare_addr(struct sockaddr *addr, int family, __u16 port, bool rewrite_addr)
	{
	struct sockaddr_in *addr4;
	struct sockaddr_in6 *addr6;

	switch (family) {
	case AF_INET:
	addr4 = (struct sockaddr_in *)addr;
	memset(addr4, 0, sizeof(*addr4));
	addr4->sin_family = family;
	addr4->sin_port = htons(port);
	if (rewrite_addr)
	addr4->sin_addr.s_addr = htonl(TEST_DADDR);
	else
	addr4->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	break;
	case AF_INET6:
	addr6 = (struct sockaddr_in6 *)addr;
	memset(addr6, 0, sizeof(*addr6));
	addr6->sin6_family = family;
	addr6->sin6_port = htons(port);
	addr6->sin6_addr = in6addr_loopback;
	if (rewrite_addr)
	addr6->sin6_addr.s6_addr32[3] = htonl(TEST_DADDR);
	break;
	default:
	fprintf(stderr, "Invalid family %d", family);
	}
	}

	struct test_sk_cfg {
	const char *name;
	int family;
	struct sockaddr *addr;
	socklen_t len;
	int type;
	bool rewrite_addr;
	};

	#define TEST(NAME, FAMILY, TYPE, REWRITE) \
	{ \
	.name = NAME, \
	.family = FAMILY, \
	.addr = (FAMILY == AF_INET) ? (struct sockaddr *)&addr4 \
	: (struct sockaddr *)&addr6, \
	.len = (FAMILY == AF_INET) ? sizeof(addr4) : sizeof(addr6), \
	.type = TYPE, \
	.rewrite_addr = REWRITE, \
	}

	void test_sk_assign(void)
	{
	struct sockaddr_in addr4;
	struct sockaddr_in6 addr6;
	struct test_sk_cfg tests[] = {
	TEST("ipv4 tcp port redir", AF_INET, SOCK_STREAM, false),
	TEST("ipv4 tcp addr redir", AF_INET, SOCK_STREAM, true),
	TEST("ipv6 tcp port redir", AF_INET6, SOCK_STREAM, false),
	TEST("ipv6 tcp addr redir", AF_INET6, SOCK_STREAM, true),
	TEST("ipv4 udp port redir", AF_INET, SOCK_DGRAM, false),
	TEST("ipv4 udp addr redir", AF_INET, SOCK_DGRAM, true),
	TEST("ipv6 udp port redir", AF_INET6, SOCK_DGRAM, false),
	TEST("ipv6 udp addr redir", AF_INET6, SOCK_DGRAM, true),
	};
	__s64 server = -1;
	int server_map;
	int self_net;
	int i;

	self_net = open(NS_SELF, O_RDONLY);
	if (CHECK_FAIL(self_net < 0)) {
	perror("Unable to open "NS_SELF);
	return;
	}

	if (!configure_stack()) {
	perror("configure_stack");
	goto cleanup;
	}

	server_map = bpf_obj_get(SERVER_MAP_PATH);
	if (CHECK_FAIL(server_map < 0)) {
	perror("Unable to open " SERVER_MAP_PATH);
	goto cleanup;
	}

	for (i = 0; i < ARRAY_SIZE(tests) && !READ_ONCE(stop); i++) {
	struct test_sk_cfg *test = &tests[i];
	const struct sockaddr *addr;
	const int zero = 0;
	int err;

	if (!test__start_subtest(test->name))
	continue;
	prepare_addr(test->addr, test->family, BIND_PORT, false);
	addr = (const struct sockaddr *)test->addr;
	server = start_server(addr, test->len, test->type);
	if (server == -1)
	goto close;

	err = bpf_map_update_elem(server_map, &zero, &server, BPF_ANY);
	if (CHECK_FAIL(err)) {
	perror("Unable to update server_map");
	goto close;
	}

	/* connect to unbound ports */
	prepare_addr(test->addr, test->family, CONNECT_PORT,
	test->rewrite_addr);
	if (run_test(server, addr, test->len, test->type))
	goto close;

	close(server);
	server = -1;
	}

	close:
	close(server);
	close(server_map);
	cleanup:
	if (CHECK_FAIL(unlink(SERVER_MAP_PATH)))
	perror("Unable to unlink " SERVER_MAP_PATH);
	if (CHECK_FAIL(setns(self_net, CLONE_NEWNET)))
	perror("Failed to setns("NS_SELF")");
	close(self_net);
	}