| Message ID | 20250411-selftests-sockmap-redir-v2-0-5f9b018d6704@rbox.co |
|---|---|
| Headers | show |
| Series | selftests/bpf: Test sockmap/sockhash redirection | expand |
On Fri, Apr 11, 2025 at 01:32:41PM +0200, Michal Luczaj wrote: > Test redirection logic. All supported and unsupported redirect combinations > are tested for success and failure respectively. > > BPF_MAP_TYPE_SOCKMAP > BPF_MAP_TYPE_SOCKHASH > x > sk_msg-to-egress > sk_msg-to-ingress > sk_skb-to-egress > sk_skb-to-ingress Could we also add test cases for SK_PASS (and even SK_DROP)? Previously, we encountered deadlocks and incorrect sequence issues when the program returned SK_PASS, so explicit testing for these cases would be helpful. If implemented, this test would fully exercise all code paths and demonstrate a complete example that covers every aspect of sockmap's packet steering and connection management capabilities. > x > AF_INET, SOCK_STREAM > AF_INET6, SOCK_STREAM > AF_INET, SOCK_DGRAM > AF_INET6, SOCK_DGRAM > AF_UNIX, SOCK_STREAM > AF_UNIX, SOCK_DGRAM > AF_VSOCK, SOCK_STREAM > AF_VSOCK, SOCK_SEQPACKET > > Suggested-by: Jakub Sitnicki <jakub@cloudflare.com> > Signed-off-by: Michal Luczaj <mhal@rbox.co> > --- > .../selftests/bpf/prog_tests/sockmap_redir.c | 461 +++++++++++++++++++++ > 1 file changed, 461 insertions(+) > > diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_redir.c b/tools/testing/selftests/bpf/prog_tests/sockmap_redir.c > new file mode 100644 > index 0000000000000000000000000000000000000000..df550759c7e50d248322be3655b02b3a21267b4a > --- /dev/null > +++ b/tools/testing/selftests/bpf/prog_tests/sockmap_redir.c > @@ -0,0 +1,461 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * Test for sockmap/sockhash redirection. > + * > + * BPF_MAP_TYPE_SOCKMAP > + * BPF_MAP_TYPE_SOCKHASH > + * x > + * sk_msg-to-egress > + * sk_msg-to-ingress > + * sk_skb-to-egress > + * sk_skb-to-ingress > + * x > + * AF_INET, SOCK_STREAM > + * AF_INET6, SOCK_STREAM > + * AF_INET, SOCK_DGRAM > + * AF_INET6, SOCK_DGRAM > + * AF_UNIX, SOCK_STREAM > + * AF_UNIX, SOCK_DGRAM > + * AF_VSOCK, SOCK_STREAM > + * AF_VSOCK, SOCK_SEQPACKET > + */ > + > +#include <errno.h> > +#include <error.h> > +#include <sched.h> > +#include <stdio.h> > +#include <unistd.h> > + > +#include <netinet/in.h> > +#include <sys/socket.h> > +#include <sys/types.h> > +#include <sys/un.h> > +#include <linux/string.h> > +#include <linux/vm_sockets.h> > + > +#include <bpf/bpf.h> > +#include <bpf/libbpf.h> > + > +#include "linux/const.h" > +#include "test_progs.h" > +#include "sockmap_helpers.h" > +#include "test_sockmap_listen.skel.h" > + > +/* The meaning of SUPPORTED is "will redirect packet as expected". > + */ > +#define SUPPORTED _BITUL(0) > + > +/* Note on sk_skb-to-ingress ->af_vsock: > + * > + * Peer socket may receive the packet some time after the return from sendmsg(). > + * In a typical usage scenario, recvmsg() will block until the redirected packet > + * appears in the destination queue, or timeout if the packet was dropped. By > + * that point, the verdict map has already been updated to reflect what has > + * happened. > + * > + * But sk_skb-to-ingress/af_vsock is an unsupported combination, so no recvmsg() > + * takes place. Which means we may race the execution of the verdict logic and > + * read map_verd before it has been updated, i.e. we might observe > + * map_verd[SK_DROP]=0 instead of map_verd[SK_DROP]=1. > + * > + * This confuses the selftest logic: if there was no packet dropped, where's the > + * packet? So here's a heuristic: on map_verd[SK_DROP]=map_verd[SK_PASS]=0 > + * (which implies the verdict program has not been ran) just re-read the verdict > + * map again. > + */ > +#define UNSUPPORTED_RACY_VERD _BITUL(1) > + > +enum prog_type { > + SK_MSG_EGRESS, > + SK_MSG_INGRESS, > + SK_SKB_EGRESS, > + SK_SKB_INGRESS, > +}; > + > +enum { > + SEND_INNER = 0, > + SEND_OUTER, > +}; > + > +enum { > + RECV_INNER = 0, > + RECV_OUTER, > +}; > + > +struct maps { > + int in; > + int out; > + int verd; > +}; > + > +struct combo_spec { > + enum prog_type prog_type; > + const char *in, *out; > +}; > + > +struct redir_spec { > + const char *name; > + int idx_send; > + int idx_recv; > + enum prog_type prog_type; > +}; > + > +struct socket_spec { > + int family; > + int sotype; > + int send_flags; > + int in[2]; > + int out[2]; > +}; > + > +static int socket_spec_pairs(struct socket_spec *s) > +{ > + return create_socket_pairs(s->family, s->sotype, > + &s->in[0], &s->out[0], > + &s->in[1], &s->out[1]); > +} > + > +static void socket_spec_close(struct socket_spec *s) > +{ > + xclose(s->in[0]); > + xclose(s->in[1]); > + xclose(s->out[0]); > + xclose(s->out[1]); > +} > + > +static void get_redir_params(struct redir_spec *redir, > + struct test_sockmap_listen *skel, > + int *prog_fd, enum bpf_attach_type *attach_type, > + bool *ingress_flag) > +{ > + enum prog_type type = redir->prog_type; > + struct bpf_program *prog; > + bool sk_msg; > + > + sk_msg = type == SK_MSG_INGRESS || type == SK_MSG_EGRESS; > + prog = sk_msg ? skel->progs.prog_msg_verdict : skel->progs.prog_skb_verdict; > + > + *prog_fd = bpf_program__fd(prog); > + *attach_type = sk_msg ? BPF_SK_MSG_VERDICT : BPF_SK_SKB_VERDICT; > + *ingress_flag = type == SK_MSG_INGRESS || type == SK_SKB_INGRESS; > +} > + > +static void try_recv(const char *prefix, int fd, int flags, bool expect_success) > +{ > + ssize_t n; > + char buf; > + > + errno = 0; > + n = recv(fd, &buf, 1, flags); > + if (n < 0 && expect_success) > + FAIL_ERRNO("%s: unexpected failure: retval=%zd", prefix, n); > + if (!n && !expect_success) > + FAIL("%s: expected failure: retval=%zd", prefix, n); > +} > + > +static void handle_unsupported(int sd_send, int sd_peer, int sd_in, int sd_out, > + int sd_recv, int map_verd, int status) > +{ > + unsigned int drop, pass; > + char recv_buf; > + ssize_t n; > + > +get_verdict: > + if (xbpf_map_lookup_elem(map_verd, &u32(SK_DROP), &drop) || > + xbpf_map_lookup_elem(map_verd, &u32(SK_PASS), &pass)) > + return; > + > + if (pass == 0 && drop == 0 && (status & UNSUPPORTED_RACY_VERD)) { > + sched_yield(); > + goto get_verdict; > + } > + > + if (pass != 0) { > + FAIL("unsupported: wanted verdict pass 0, have %u", pass); > + return; > + } > + > + /* If nothing was dropped, packet should have reached the peer */ > + if (drop == 0) { > + errno = 0; > + n = recv_timeout(sd_peer, &recv_buf, 1, 0, IO_TIMEOUT_SEC); > + if (n != 1) > + FAIL_ERRNO("unsupported: packet missing, retval=%zd", n); > + } > + > + /* Ensure queues are empty */ > + try_recv("bpf.recv(sd_send)", sd_send, MSG_DONTWAIT, false); > + if (sd_in != sd_send) > + try_recv("bpf.recv(sd_in)", sd_in, MSG_DONTWAIT, false); > + > + try_recv("bpf.recv(sd_out)", sd_out, MSG_DONTWAIT, false); > + if (sd_recv != sd_out) > + try_recv("bpf.recv(sd_recv)", sd_recv, MSG_DONTWAIT, false); > +} > + > +static void test_send_redir_recv(int sd_send, int send_flags, int sd_peer, > + int sd_in, int sd_out, int sd_recv, > + struct maps *maps, int status) > +{ > + unsigned int drop, pass; > + char *send_buf = "ab"; > + char recv_buf = '\0'; > + ssize_t n, len = 1; > + > + /* Zero out the verdict map */ > + if (xbpf_map_update_elem(maps->verd, &u32(SK_DROP), &u32(0), BPF_ANY) || > + xbpf_map_update_elem(maps->verd, &u32(SK_PASS), &u32(0), BPF_ANY)) > + return; > + > + if (xbpf_map_update_elem(maps->in, &u32(0), &u64(sd_in), BPF_NOEXIST)) > + return; > + > + if (xbpf_map_update_elem(maps->out, &u32(0), &u64(sd_out), BPF_NOEXIST)) > + goto del_in; > + > + /* Last byte is OOB data when send_flags has MSG_OOB bit set */ > + if (send_flags & MSG_OOB) > + len++; > + n = send(sd_send, send_buf, len, send_flags); > + if (n >= 0 && n < len) > + FAIL("incomplete send"); > + if (n < 0) { > + /* sk_msg redirect combo not supported? */ > + if (status & SUPPORTED || errno != EACCES) > + FAIL_ERRNO("send"); > + goto out; > + } > + > + if (!(status & SUPPORTED)) { > + handle_unsupported(sd_send, sd_peer, sd_in, sd_out, sd_recv, > + maps->verd, status); > + goto out; > + } > + > + errno = 0; > + n = recv_timeout(sd_recv, &recv_buf, 1, 0, IO_TIMEOUT_SEC); > + if (n != 1) { > + FAIL_ERRNO("recv_timeout()"); > + goto out; > + } > + > + /* Check verdict _after_ recv(); af_vsock may need time to catch up */ > + if (xbpf_map_lookup_elem(maps->verd, &u32(SK_DROP), &drop) || > + xbpf_map_lookup_elem(maps->verd, &u32(SK_PASS), &pass)) > + goto out; > + > + if (drop != 0 || pass != 1) > + FAIL("unexpected verdict drop/pass: wanted 0/1, have %u/%u", > + drop, pass); > + > + if (recv_buf != send_buf[0]) > + FAIL("recv(): payload check, %02x != %02x", recv_buf, send_buf[0]); > + > + if (send_flags & MSG_OOB) { > + /* Fail reading OOB while in sockmap */ > + try_recv("bpf.recv(sd_out, MSG_OOB)", sd_out, > + MSG_OOB | MSG_DONTWAIT, false); > + > + /* Remove sd_out from sockmap */ > + xbpf_map_delete_elem(maps->out, &u32(0)); > + > + /* Check that OOB was dropped on redirect */ > + try_recv("recv(sd_out, MSG_OOB)", sd_out, > + MSG_OOB | MSG_DONTWAIT, false); > + > + goto del_in; > + } > +out: > + xbpf_map_delete_elem(maps->out, &u32(0)); > +del_in: > + xbpf_map_delete_elem(maps->in, &u32(0)); > +} > + > +static int is_redir_supported(enum prog_type type, const char *in, > + const char *out) > +{ > + /* Matching based on strings returned by socket_kind_to_str(): > + * tcp4, udp4, tcp6, udp6, u_str, u_dgr, v_str, v_seq > + * Plus a wildcard: any > + * Not in use: u_seq, v_dgr > + */ > + struct combo_spec *c, combos[] = { > + /* Send to local: TCP -> any, but vsock */ > + { SK_MSG_INGRESS, "tcp", "tcp" }, > + { SK_MSG_INGRESS, "tcp", "udp" }, > + { SK_MSG_INGRESS, "tcp", "u_str" }, > + { SK_MSG_INGRESS, "tcp", "u_dgr" }, > + > + /* Send to egress: TCP -> TCP */ > + { SK_MSG_EGRESS, "tcp", "tcp" }, > + > + /* Ingress to egress: any -> any */ > + { SK_SKB_EGRESS, "any", "any" }, > + > + /* Ingress to local: any -> any, but vsock */ > + { SK_SKB_INGRESS, "any", "tcp" }, > + { SK_SKB_INGRESS, "any", "udp" }, > + { SK_SKB_INGRESS, "any", "u_str" }, > + { SK_SKB_INGRESS, "any", "u_dgr" }, > + }; > + > + for (c = combos; c < combos + ARRAY_SIZE(combos); c++) { > + if (c->prog_type == type && > + (!strcmp(c->in, "any") || strstarts(in, c->in)) && > + (!strcmp(c->out, "any") || strstarts(out, c->out))) > + return SUPPORTED; > + } > + > + return 0; > +} > + > +static int get_support_status(enum prog_type type, const char *in, > + const char *out) > +{ > + int status = is_redir_supported(type, in, out); > + > + if (type == SK_SKB_INGRESS && strstarts(out, "v_")) > + status |= UNSUPPORTED_RACY_VERD; > + > + return status; > +} > + > +static void test_socket(enum bpf_map_type type, struct redir_spec *redir, > + struct maps *maps, struct socket_spec *s_in, > + struct socket_spec *s_out) > +{ > + int fd_in, fd_out, fd_send, fd_peer, fd_recv, flags, status; > + const char *in_str, *out_str; > + char s[MAX_TEST_NAME]; > + > + fd_in = s_in->in[0]; > + fd_out = s_out->out[0]; > + fd_send = s_in->in[redir->idx_send]; > + fd_peer = s_in->in[redir->idx_send ^ 1]; > + fd_recv = s_out->out[redir->idx_recv]; > + flags = s_in->send_flags; > + > + in_str = socket_kind_to_str(fd_in); > + out_str = socket_kind_to_str(fd_out); > + status = get_support_status(redir->prog_type, in_str, out_str); > + > + snprintf(s, sizeof(s), > + "%-4s %-17s %-5s %s %-5s%6s", > + /* hash sk_skb-to-ingress u_str → v_str (OOB) */ > + type == BPF_MAP_TYPE_SOCKMAP ? "map" : "hash", > + redir->name, > + in_str, > + status & SUPPORTED ? "→" : " ", > + out_str, > + (flags & MSG_OOB) ? "(OOB)" : ""); > + > + if (!test__start_subtest(s)) > + return; > + > + test_send_redir_recv(fd_send, flags, fd_peer, fd_in, fd_out, fd_recv, > + maps, status); > +} > + > +static void test_redir(enum bpf_map_type type, struct redir_spec *redir, > + struct maps *maps) > +{ > + struct socket_spec *s, sockets[] = { > + { AF_INET, SOCK_STREAM }, > + // { AF_INET, SOCK_STREAM, MSG_OOB }, /* Known to be broken */ > + { AF_INET6, SOCK_STREAM }, > + { AF_INET, SOCK_DGRAM }, > + { AF_INET6, SOCK_DGRAM }, > + { AF_UNIX, SOCK_STREAM }, > + { AF_UNIX, SOCK_STREAM, MSG_OOB }, > + { AF_UNIX, SOCK_DGRAM }, > + // { AF_UNIX, SOCK_SEQPACKET}, /* Unsupported BPF_MAP_UPDATE_ELEM */ > + { AF_VSOCK, SOCK_STREAM }, > + // { AF_VSOCK, SOCK_DGRAM }, /* Unsupported socket() */ > + { AF_VSOCK, SOCK_SEQPACKET }, > + }; > + > + for (s = sockets; s < sockets + ARRAY_SIZE(sockets); s++) > + if (socket_spec_pairs(s)) > + goto out; > + > + /* Intra-proto */ > + for (s = sockets; s < sockets + ARRAY_SIZE(sockets); s++) > + test_socket(type, redir, maps, s, s); > + > + /* Cross-proto */ > + for (int i = 0; i < ARRAY_SIZE(sockets); i++) { > + for (int j = 0; j < ARRAY_SIZE(sockets); j++) { > + struct socket_spec *out = &sockets[j]; > + struct socket_spec *in = &sockets[i]; > + > + /* Skip intra-proto and between variants */ > + if (out->send_flags || > + (in->family == out->family && > + in->sotype == out->sotype)) > + continue; > + > + test_socket(type, redir, maps, in, out); > + } > + } > +out: > + while (--s >= sockets) > + socket_spec_close(s); > +} > + > +static void test_map(enum bpf_map_type type) > +{ > + struct redir_spec *r, redirs[] = { > + { "sk_msg-to-ingress", SEND_INNER, RECV_INNER, SK_MSG_INGRESS }, > + { "sk_msg-to-egress", SEND_INNER, RECV_OUTER, SK_MSG_EGRESS }, > + { "sk_skb-to-egress", SEND_OUTER, RECV_OUTER, SK_SKB_EGRESS }, > + { "sk_skb-to-ingress", SEND_OUTER, RECV_INNER, SK_SKB_INGRESS }, > + }; > + > + for (r = redirs; r < redirs + ARRAY_SIZE(redirs); r++) { > + enum bpf_attach_type attach_type; > + struct test_sockmap_listen *skel; > + struct maps maps; > + int prog_fd; > + > + skel = test_sockmap_listen__open_and_load(); > + if (!skel) { > + FAIL("open_and_load"); > + return; > + } > + > + switch (type) { > + case BPF_MAP_TYPE_SOCKMAP: > + skel->bss->test_sockmap = true; > + maps.out = bpf_map__fd(skel->maps.sock_map); > + break; > + case BPF_MAP_TYPE_SOCKHASH: > + skel->bss->test_sockmap = false; > + maps.out = bpf_map__fd(skel->maps.sock_hash); > + break; > + default: > + FAIL("Unsupported bpf_map_type"); > + return; > + } > + > + maps.in = bpf_map__fd(skel->maps.nop_map); > + maps.verd = bpf_map__fd(skel->maps.verdict_map); > + get_redir_params(r, skel, &prog_fd, &attach_type, > + &skel->bss->test_ingress); > + > + if (xbpf_prog_attach(prog_fd, maps.in, attach_type, 0)) > + return; > + > + test_redir(type, r, &maps); > + > + if (xbpf_prog_detach2(prog_fd, maps.in, attach_type)) > + return; > + > + test_sockmap_listen__destroy(skel); > + } > +} > + > +void serial_test_sockmap_redir(void) > +{ > + test_map(BPF_MAP_TYPE_SOCKMAP); > + test_map(BPF_MAP_TYPE_SOCKHASH); > +} > > -- > 2.49.0 >
On Fri, Apr 11, 2025 at 01:32:41PM +0200, Michal Luczaj wrote: > +static void test_send_redir_recv(int sd_send, int send_flags, int sd_peer, > + int sd_in, int sd_out, int sd_recv, > + struct maps *maps, int status) > +{ > + unsigned int drop, pass; > + char *send_buf = "ab"; > + char recv_buf = '\0'; > + ssize_t n, len = 1; > + /* Zero out the verdict map */ > + if (xbpf_map_update_elem(maps->verd, &u32(SK_DROP), &u32(0), BPF_ANY) || > + xbpf_map_update_elem(maps->verd, &u32(SK_PASS), &u32(0), BPF_ANY)) > + return; > + > + if (xbpf_map_update_elem(maps->in, &u32(0), &u64(sd_in), BPF_NOEXIST)) > + return; > + > + if (xbpf_map_update_elem(maps->out, &u32(0), &u64(sd_out), BPF_NOEXIST)) > + goto del_in; > + > + /* Last byte is OOB data when send_flags has MSG_OOB bit set */ > + if (send_flags & MSG_OOB) > + len++; > + n = send(sd_send, send_buf, len, send_flags); > + if (n >= 0 && n < len) > + FAIL("incomplete send"); > + if (n < 0) { > + /* sk_msg redirect combo not supported? */ > + if (status & SUPPORTED || errno != EACCES) > + FAIL_ERRNO("send"); > + goto out; > + } > + > + if (!(status & SUPPORTED)) { > + handle_unsupported(sd_send, sd_peer, sd_in, sd_out, sd_recv, > + maps->verd, status); > + goto out; > + } > + > + errno = 0; > + n = recv_timeout(sd_recv, &recv_buf, 1, 0, IO_TIMEOUT_SEC); > + if (n != 1) { > + FAIL_ERRNO("recv_timeout()"); > + goto out; > + } I prefer multiple send and receive operations, or implementing a loop at the outer level. Thanks.
On Fri, Apr 11, 2025 at 09:09 PM +08, Jiayuan Chen wrote: > On Fri, Apr 11, 2025 at 01:32:41PM +0200, Michal Luczaj wrote: >> Test redirection logic. All supported and unsupported redirect combinations >> are tested for success and failure respectively. >> >> BPF_MAP_TYPE_SOCKMAP >> BPF_MAP_TYPE_SOCKHASH >> x >> sk_msg-to-egress >> sk_msg-to-ingress >> sk_skb-to-egress >> sk_skb-to-ingress > > Could we also add test cases for SK_PASS (and even SK_DROP)? > Previously, we encountered deadlocks and incorrect sequence issues when > the program returned SK_PASS, so explicit testing for these cases would > be helpful. > > If implemented, this test would fully exercise all code paths and > demonstrate a complete example that covers every aspect of > sockmap's packet steering and connection management capabilities. This could easily be a follow up in my mind. [...]
The idea behind this series is to comprehensively test the BPF redirection: BPF_MAP_TYPE_SOCKMAP, BPF_MAP_TYPE_SOCKHASH x sk_msg-to-egress, sk_msg-to-ingress, sk_skb-to-egress, sk_skb-to-ingress x AF_INET, SOCK_STREAM, AF_INET6, SOCK_STREAM, AF_INET, SOCK_DGRAM, AF_INET6, SOCK_DGRAM, AF_UNIX, SOCK_STREAM, AF_UNIX, SOCK_DGRAM, AF_VSOCK, SOCK_STREAM, AF_VSOCK, SOCK_SEQPACKET New module is introduced, sockmap_redir: all supported and unsupported redirect combinations are tested for success and failure respectively. Code is pretty much stolen/adapted from Jakub Sitnicki's sockmap_redir_matrix.c [1]. Usage: $ cd tools/testing/selftests/bpf $ make $ sudo ./test_progs -t sockmap_redir ... Summary: 1/576 PASSED, 0 SKIPPED, 0 FAILED [1]: https://github.com/jsitnicki/sockmap-redir-matrix/blob/main/sockmap_redir_matrix.c Changes in v2: - Verify that the unsupported redirect combos do fail [Jakub] - Dedup tests in sockmap_listen - Cosmetic changes and code reordering - Link to v1: https://lore.kernel.org/bpf/42939687-20f9-4a45-b7c2-342a0e11a014@rbox.co/ Suggested-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Michal Luczaj <mhal@rbox.co> --- Michal Luczaj (9): selftests/bpf: Support af_unix SOCK_DGRAM socket pair creation selftests/bpf: Add socket_kind_to_str() to socket_helpers selftests/bpf: Add u32()/u64() to sockmap_helpers selftests/bpf: Allow setting BPF_F_INGRESS in prog_msg_verdict() selftests/bpf: Add selftest for sockmap/hashmap redirection selftests/bpf: sockmap_listen cleanup: Drop af_vsock redir tests selftests/bpf: sockmap_listen cleanup: Drop af_unix redir tests selftests/bpf: sockmap_listen cleanup: Drop af_inet SOCK_DGRAM redir tests docs/bpf: sockmap: Add a missing comma Documentation/bpf/map_sockmap.rst | 2 +- .../selftests/bpf/prog_tests/socket_helpers.h | 84 +++- .../selftests/bpf/prog_tests/sockmap_helpers.h | 25 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 459 +------------------- .../selftests/bpf/prog_tests/sockmap_redir.c | 461 +++++++++++++++++++++ .../selftests/bpf/progs/test_sockmap_listen.c | 6 +- 6 files changed, 558 insertions(+), 479 deletions(-) --- base-commit: a27a97f713947b20ba91b23a3ef77fa92d74171b change-id: 20240922-selftests-sockmap-redir-5d839396c75e Best regards,