Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2#define BPF_NO_KFUNC_PROTOTYPES
3#include <vmlinux.h>
4#include <bpf/bpf_helpers.h>
5#include <bpf/bpf_endian.h>
6
7#define EAFNOSUPPORT 97
8#define EPROTO 71
9#define ENONET 64
10#define EINVAL 22
11#define ENOENT 2
12
13#define NF_CT_ZONE_DIR_ORIG (1 << IP_CT_DIR_ORIGINAL)
14#define NF_CT_ZONE_DIR_REPL (1 << IP_CT_DIR_REPLY)
15
16extern unsigned long CONFIG_HZ __kconfig;
17
18int test_einval_reserved = 0;
19int test_einval_reserved_new = 0;
20int test_einval_netns_id = 0;
21int test_einval_len_opts = 0;
22int test_eproto_l4proto = 0;
23int test_enonet_netns_id = 0;
24int test_enoent_lookup = 0;
25int test_eafnosupport = 0;
26int test_alloc_entry = -EINVAL;
27int test_insert_entry = -EAFNOSUPPORT;
28int test_succ_lookup = -ENOENT;
29int test_ct_zone_id_alloc_entry = -EINVAL;
30int test_ct_zone_id_insert_entry = -EAFNOSUPPORT;
31int test_ct_zone_id_succ_lookup = -ENOENT;
32int test_ct_zone_dir_enoent_lookup = 0;
33int test_ct_zone_id_enoent_lookup = 0;
34u32 test_delta_timeout = 0;
35u32 test_status = 0;
36u32 test_insert_lookup_mark = 0;
37int test_snat_addr = -EINVAL;
38int test_dnat_addr = -EINVAL;
39__be32 saddr = 0;
40__be16 sport = 0;
41__be32 daddr = 0;
42__be16 dport = 0;
43int test_exist_lookup = -ENOENT;
44u32 test_exist_lookup_mark = 0;
45
46enum nf_nat_manip_type___local {
47 NF_NAT_MANIP_SRC___local,
48 NF_NAT_MANIP_DST___local
49};
50
51struct nf_conn;
52
53struct bpf_ct_opts___local {
54 s32 netns_id;
55 s32 error;
56 u8 l4proto;
57 u8 dir;
58 u8 reserved[2];
59};
60
61struct bpf_ct_opts___new {
62 s32 netns_id;
63 s32 error;
64 u8 l4proto;
65 u8 dir;
66 u16 ct_zone_id;
67 u8 ct_zone_dir;
68 u8 reserved[3];
69} __attribute__((preserve_access_index));
70
71struct nf_conn *bpf_xdp_ct_alloc(struct xdp_md *, struct bpf_sock_tuple *, u32,
72 struct bpf_ct_opts___local *, u32) __ksym;
73struct nf_conn *bpf_xdp_ct_lookup(struct xdp_md *, struct bpf_sock_tuple *, u32,
74 struct bpf_ct_opts___local *, u32) __ksym;
75struct nf_conn *bpf_skb_ct_alloc(struct __sk_buff *, struct bpf_sock_tuple *, u32,
76 struct bpf_ct_opts___local *, u32) __ksym;
77struct nf_conn *bpf_skb_ct_lookup(struct __sk_buff *, struct bpf_sock_tuple *, u32,
78 struct bpf_ct_opts___local *, u32) __ksym;
79struct nf_conn *bpf_ct_insert_entry(struct nf_conn *) __ksym;
80void bpf_ct_release(struct nf_conn *) __ksym;
81void bpf_ct_set_timeout(struct nf_conn *, u32) __ksym;
82int bpf_ct_change_timeout(struct nf_conn *, u32) __ksym;
83int bpf_ct_set_status(struct nf_conn *, u32) __ksym;
84int bpf_ct_change_status(struct nf_conn *, u32) __ksym;
85int bpf_ct_set_nat_info(struct nf_conn *, union nf_inet_addr *,
86 int port, enum nf_nat_manip_type___local) __ksym;
87
88static __always_inline void
89nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
90 struct bpf_ct_opts___local *, u32),
91 struct nf_conn *(*alloc_fn)(void *, struct bpf_sock_tuple *, u32,
92 struct bpf_ct_opts___local *, u32),
93 void *ctx)
94{
95 struct bpf_ct_opts___local opts_def = { .l4proto = IPPROTO_TCP, .netns_id = -1 };
96 struct bpf_sock_tuple bpf_tuple;
97 struct nf_conn *ct;
98
99 __builtin_memset(&bpf_tuple, 0, sizeof(bpf_tuple.ipv4));
100
101 opts_def.reserved[0] = 1;
102 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
103 sizeof(opts_def));
104 opts_def.reserved[0] = 0;
105 opts_def.l4proto = IPPROTO_TCP;
106 if (ct)
107 bpf_ct_release(ct);
108 else
109 test_einval_reserved = opts_def.error;
110
111 opts_def.netns_id = -2;
112 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
113 sizeof(opts_def));
114 opts_def.netns_id = -1;
115 if (ct)
116 bpf_ct_release(ct);
117 else
118 test_einval_netns_id = opts_def.error;
119
120 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
121 sizeof(opts_def) - 1);
122 if (ct)
123 bpf_ct_release(ct);
124 else
125 test_einval_len_opts = opts_def.error;
126
127 opts_def.l4proto = IPPROTO_ICMP;
128 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
129 sizeof(opts_def));
130 opts_def.l4proto = IPPROTO_TCP;
131 if (ct)
132 bpf_ct_release(ct);
133 else
134 test_eproto_l4proto = opts_def.error;
135
136 opts_def.netns_id = 0xf00f;
137 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
138 sizeof(opts_def));
139 opts_def.netns_id = -1;
140 if (ct)
141 bpf_ct_release(ct);
142 else
143 test_enonet_netns_id = opts_def.error;
144
145 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
146 sizeof(opts_def));
147 if (ct)
148 bpf_ct_release(ct);
149 else
150 test_enoent_lookup = opts_def.error;
151
152 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4) - 1, &opts_def,
153 sizeof(opts_def));
154 if (ct)
155 bpf_ct_release(ct);
156 else
157 test_eafnosupport = opts_def.error;
158
159 bpf_tuple.ipv4.saddr = bpf_get_prandom_u32(); /* src IP */
160 bpf_tuple.ipv4.daddr = bpf_get_prandom_u32(); /* dst IP */
161 bpf_tuple.ipv4.sport = bpf_get_prandom_u32(); /* src port */
162 bpf_tuple.ipv4.dport = bpf_get_prandom_u32(); /* dst port */
163
164 ct = alloc_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
165 sizeof(opts_def));
166 if (ct) {
167 __u16 sport = bpf_get_prandom_u32();
168 __u16 dport = bpf_get_prandom_u32();
169 union nf_inet_addr saddr = {};
170 union nf_inet_addr daddr = {};
171 struct nf_conn *ct_ins;
172
173 bpf_ct_set_timeout(ct, 10000);
174 ct->mark = 77;
175
176 /* snat */
177 saddr.ip = bpf_get_prandom_u32();
178 bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC___local);
179 /* dnat */
180 daddr.ip = bpf_get_prandom_u32();
181 bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST___local);
182
183 ct_ins = bpf_ct_insert_entry(ct);
184 if (ct_ins) {
185 struct nf_conn *ct_lk;
186
187 ct_lk = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4),
188 &opts_def, sizeof(opts_def));
189 if (ct_lk) {
190 struct nf_conntrack_tuple *tuple;
191
192 /* check snat and dnat addresses */
193 tuple = &ct_lk->tuplehash[IP_CT_DIR_REPLY].tuple;
194 if (tuple->dst.u3.ip == saddr.ip &&
195 tuple->dst.u.all == bpf_htons(sport))
196 test_snat_addr = 0;
197 if (tuple->src.u3.ip == daddr.ip &&
198 tuple->src.u.all == bpf_htons(dport))
199 test_dnat_addr = 0;
200
201 /* update ct entry timeout */
202 bpf_ct_change_timeout(ct_lk, 10000);
203 test_delta_timeout = ct_lk->timeout - bpf_jiffies64();
204 test_delta_timeout /= CONFIG_HZ;
205 test_insert_lookup_mark = ct_lk->mark;
206 bpf_ct_change_status(ct_lk,
207 IPS_CONFIRMED | IPS_SEEN_REPLY);
208 test_status = ct_lk->status;
209
210 bpf_ct_release(ct_lk);
211 test_succ_lookup = 0;
212 }
213 bpf_ct_release(ct_ins);
214 test_insert_entry = 0;
215 }
216 test_alloc_entry = 0;
217 }
218
219 bpf_tuple.ipv4.saddr = saddr;
220 bpf_tuple.ipv4.daddr = daddr;
221 bpf_tuple.ipv4.sport = sport;
222 bpf_tuple.ipv4.dport = dport;
223 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
224 sizeof(opts_def));
225 if (ct) {
226 test_exist_lookup = 0;
227 if (ct->mark == 42) {
228 ct->mark++;
229 test_exist_lookup_mark = ct->mark;
230 }
231 bpf_ct_release(ct);
232 } else {
233 test_exist_lookup = opts_def.error;
234 }
235}
236
237static __always_inline void
238nf_ct_opts_new_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
239 struct bpf_ct_opts___new *, u32),
240 struct nf_conn *(*alloc_fn)(void *, struct bpf_sock_tuple *, u32,
241 struct bpf_ct_opts___new *, u32),
242 void *ctx)
243{
244 struct bpf_ct_opts___new opts_def = { .l4proto = IPPROTO_TCP, .netns_id = -1 };
245 struct bpf_sock_tuple bpf_tuple;
246 struct nf_conn *ct;
247
248 __builtin_memset(&bpf_tuple, 0, sizeof(bpf_tuple.ipv4));
249
250 opts_def.reserved[0] = 1;
251 ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
252 sizeof(opts_def));
253 opts_def.reserved[0] = 0;
254 if (ct)
255 bpf_ct_release(ct);
256 else
257 test_einval_reserved_new = opts_def.error;
258
259 bpf_tuple.ipv4.saddr = bpf_get_prandom_u32(); /* src IP */
260 bpf_tuple.ipv4.daddr = bpf_get_prandom_u32(); /* dst IP */
261 bpf_tuple.ipv4.sport = bpf_get_prandom_u32(); /* src port */
262 bpf_tuple.ipv4.dport = bpf_get_prandom_u32(); /* dst port */
263
264 /* use non-default ct zone */
265 opts_def.ct_zone_id = 10;
266 opts_def.ct_zone_dir = NF_CT_ZONE_DIR_ORIG;
267 ct = alloc_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def,
268 sizeof(opts_def));
269 if (ct) {
270 __u16 sport = bpf_get_prandom_u32();
271 __u16 dport = bpf_get_prandom_u32();
272 union nf_inet_addr saddr = {};
273 union nf_inet_addr daddr = {};
274 struct nf_conn *ct_ins;
275
276 bpf_ct_set_timeout(ct, 10000);
277
278 /* snat */
279 saddr.ip = bpf_get_prandom_u32();
280 bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC___local);
281 /* dnat */
282 daddr.ip = bpf_get_prandom_u32();
283 bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST___local);
284
285 ct_ins = bpf_ct_insert_entry(ct);
286 if (ct_ins) {
287 struct nf_conn *ct_lk;
288
289 /* entry should exist in same ct zone we inserted it */
290 ct_lk = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4),
291 &opts_def, sizeof(opts_def));
292 if (ct_lk) {
293 bpf_ct_release(ct_lk);
294 test_ct_zone_id_succ_lookup = 0;
295 }
296
297 /* entry should not exist with wrong direction */
298 opts_def.ct_zone_dir = NF_CT_ZONE_DIR_REPL;
299 ct_lk = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4),
300 &opts_def, sizeof(opts_def));
301 opts_def.ct_zone_dir = NF_CT_ZONE_DIR_ORIG;
302 if (ct_lk)
303 bpf_ct_release(ct_lk);
304 else
305 test_ct_zone_dir_enoent_lookup = opts_def.error;
306
307 /* entry should not exist in default ct zone */
308 opts_def.ct_zone_id = 0;
309 ct_lk = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4),
310 &opts_def, sizeof(opts_def));
311 if (ct_lk)
312 bpf_ct_release(ct_lk);
313 else
314 test_ct_zone_id_enoent_lookup = opts_def.error;
315
316 bpf_ct_release(ct_ins);
317 test_ct_zone_id_insert_entry = 0;
318 }
319 test_ct_zone_id_alloc_entry = 0;
320 }
321}
322
323SEC("xdp")
324int nf_xdp_ct_test(struct xdp_md *ctx)
325{
326 nf_ct_test((void *)bpf_xdp_ct_lookup, (void *)bpf_xdp_ct_alloc, ctx);
327 nf_ct_opts_new_test((void *)bpf_xdp_ct_lookup, (void *)bpf_xdp_ct_alloc, ctx);
328 return 0;
329}
330
331SEC("tc")
332int nf_skb_ct_test(struct __sk_buff *ctx)
333{
334 nf_ct_test((void *)bpf_skb_ct_lookup, (void *)bpf_skb_ct_alloc, ctx);
335 nf_ct_opts_new_test((void *)bpf_skb_ct_lookup, (void *)bpf_skb_ct_alloc, ctx);
336 return 0;
337}
338
339char _license[] SEC("license") = "GPL";