Re: [PATCH bpf-next v5 9/9] bpf: xfrm: Add selftest for bpf_xdp_get_xfrm_state()

On Mon, Dec 11, 2023 at 01:39:25PM -0800, Eyal Birger wrote:

Hi Daniel,

Tiny nits below in case you respin this for other reasons:

On Mon, Dec 11, 2023 at 12:20 PM Daniel Xu dxu@dxuuu.xyz wrote:

...

This commit extends test_tunnel selftest to test the new XDP xfrm state lookup kfunc.

Co-developed-by: Antony Antony antony.antony@secunet.com Signed-off-by: Antony Antony antony.antony@secunet.com Signed-off-by: Daniel Xu dxu@dxuuu.xyz

---

.../selftests/bpf/prog_tests/test_tunnel.c | 20 ++++++-- .../selftests/bpf/progs/test_tunnel_kern.c | 51 +++++++++++++++++++ 2 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c index 2d7f8fa82ebd..fc804095d578 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_tunnel.c +++ b/tools/testing/selftests/bpf/prog_tests/test_tunnel.c @@ -278,7 +278,7 @@ static int add_xfrm_tunnel(void) SYS(fail, "ip netns exec at_ns0 " "ip xfrm state add src %s dst %s proto esp "

•                   "spi %d reqid 1 mode tunnel "
  

•                   "spi %d reqid 1 mode tunnel replay-window 42 "
                    "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s",
        IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC);
    SYS(fail,
  

@@ -292,7 +292,7 @@ static int add_xfrm_tunnel(void) SYS(fail, "ip netns exec at_ns0 " "ip xfrm state add src %s dst %s proto esp "

•                   "spi %d reqid 2 mode tunnel "
  

•                   "spi %d reqid 2 mode tunnel replay-window 42 "
  

nit: why do you need to set the replay-window in both directions?

No reason - probably just careless here.

...

                    "auth-trunc 'hmac(sha1)' %s 96 enc 'cbc(aes)' %s",
        IP4_ADDR1_VETH1, IP4_ADDR_VETH0, XFRM_SPI_OUT_TO_IN, XFRM_AUTH, XFRM_ENC);
    SYS(fail,

@@ -313,7 +313,7 @@ static int add_xfrm_tunnel(void) */ SYS(fail, "ip xfrm state add src %s dst %s proto esp "

•               "spi %d reqid 1 mode tunnel "
  

•               "spi %d reqid 1 mode tunnel replay-window 42 "
                "auth-trunc 'hmac(sha1)' %s 96  enc 'cbc(aes)' %s",
        IP4_ADDR_VETH0, IP4_ADDR1_VETH1, XFRM_SPI_IN_TO_OUT, XFRM_AUTH, XFRM_ENC);
    SYS(fail,
  

@@ -325,7 +325,7 @@ static int add_xfrm_tunnel(void) /* root -> at_ns0 */ SYS(fail, "ip xfrm state add src %s dst %s proto esp "

•               "spi %d reqid 2 mode tunnel "
  

•               "spi %d reqid 2 mode tunnel replay-window 42 "
                "auth-trunc 'hmac(sha1)' %s 96  enc 'cbc(aes)' %s",
        IP4_ADDR1_VETH1, IP4_ADDR_VETH0, XFRM_SPI_OUT_TO_IN, XFRM_AUTH, XFRM_ENC);
    SYS(fail,
  

@@ -628,8 +628,10 @@ static void test_xfrm_tunnel(void) { DECLARE_LIBBPF_OPTS(bpf_tc_hook, tc_hook, .attach_point = BPF_TC_INGRESS);

•   LIBBPF_OPTS(bpf_xdp_attach_opts, opts);
    struct test_tunnel_kern *skel = NULL;
    struct nstoken *nstoken;
  

•   int xdp_prog_fd;
    int tc_prog_fd;
    int ifindex;
    int err;
  

@@ -654,6 +656,14 @@ static void test_xfrm_tunnel(void) if (attach_tc_prog(&tc_hook, tc_prog_fd, -1)) goto done;

•   /* attach xdp prog to tunnel dev */
  

•   xdp_prog_fd = bpf_program__fd(skel->progs.xfrm_get_state_xdp);
  

•   if (!ASSERT_GE(xdp_prog_fd, 0, "bpf_program__fd"))
  

•           goto done;
  

•   err = bpf_xdp_attach(ifindex, xdp_prog_fd, XDP_FLAGS_REPLACE, &opts);
  

•   if (!ASSERT_OK(err, "bpf_xdp_attach"))
  

•           goto done;
  

•   /* ping from at_ns0 namespace test */
    nstoken = open_netns("at_ns0");
    err = test_ping(AF_INET, IP4_ADDR_TUNL_DEV1);
  

@@ -667,6 +677,8 @@ static void test_xfrm_tunnel(void) goto done; if (!ASSERT_EQ(skel->bss->xfrm_remote_ip, 0xac100164, "remote_ip")) goto done;

•   if (!ASSERT_EQ(skel->bss->xfrm_replay_window, 42, "replay_window"))
  

•           goto done;
  
  

done: delete_xfrm_tunnel(); diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c index 3a59eb9c34de..c0dd38616562 100644 --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c @@ -30,6 +30,10 @@ int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx, struct bpf_fou_encap *encap, int type) __ksym; int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx, struct bpf_fou_encap *encap) __ksym; +struct xfrm_state * +bpf_xdp_get_xfrm_state(struct xdp_md *ctx, struct bpf_xfrm_state_opts *opts,

•                  u32 opts__sz) __ksym;
  

+void bpf_xdp_xfrm_state_release(struct xfrm_state *x) __ksym;

struct { __uint(type, BPF_MAP_TYPE_ARRAY); @@ -950,4 +954,51 @@ int xfrm_get_state(struct __sk_buff *skb) return TC_ACT_OK; }

+volatile int xfrm_replay_window = 0;

+SEC("xdp") +int xfrm_get_state_xdp(struct xdp_md *xdp) +{

•   struct bpf_xfrm_state_opts opts = {};
  

•   struct xfrm_state *x = NULL;
  

•   struct ip_esp_hdr *esph;
  

•   struct bpf_dynptr ptr;
  

•   u8 esph_buf[8] = {};
  

•   u8 iph_buf[20] = {};
  

•   struct iphdr *iph;
  

•   u32 off;
  

•   if (bpf_dynptr_from_xdp(xdp, 0, &ptr))
  

•           goto out;
  

•   off = sizeof(struct ethhdr);
  

•   iph = bpf_dynptr_slice(&ptr, off, iph_buf, sizeof(iph_buf));
  

•   if (!iph || iph->protocol != IPPROTO_ESP)
  

•           goto out;
  

•   off += sizeof(struct iphdr);
  

•   esph = bpf_dynptr_slice(&ptr, off, esph_buf, sizeof(esph_buf));
  

•   if (!esph)
  

•           goto out;
  

•   opts.netns_id = BPF_F_CURRENT_NETNS;
  

•   opts.daddr.a4 = iph->daddr;
  

•   opts.spi = esph->spi;
  

•   opts.proto = IPPROTO_ESP;
  

•   opts.family = AF_INET;
  

•   x = bpf_xdp_get_xfrm_state(xdp, &opts, sizeof(opts));
  

•   if (!x || opts.error)
  

nit: how can opts.error be non zero if x == NULL?

Ignoring the new -ENOENT case, it can't. Which is why I'm testing that behavior here.

[...]

Thanks, Daniel