mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 14:19:16 +00:00
selftests/bpf: Add bpf_program__attach_netfilter helper test
Call bpf_program__attach_netfilter() with different protocol/hook/priority combinations. Test fails if supposedly-illegal attachments work (e.g., bogus protocol family, illegal priority and so on) or if a should-work attachment fails. Expected output: ./test_progs -t netfilter_link_attach #145/1 netfilter_link_attach/allzero:OK #145/2 netfilter_link_attach/invalid-pf:OK #145/3 netfilter_link_attach/invalid-hooknum:OK #145/4 netfilter_link_attach/invalid-priority-min:OK #145/5 netfilter_link_attach/invalid-priority-max:OK #145/6 netfilter_link_attach/invalid-flags:OK #145/7 netfilter_link_attach/invalid-inet-not-supported:OK #145/8 netfilter_link_attach/attach ipv4:OK #145/9 netfilter_link_attach/attach ipv6:OK Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: Daniel Xu <dxu@dxuuu.xyz> Link: https://lore.kernel.org/bpf/20230628152738.22765-3-fw@strlen.de
This commit is contained in:
parent
52364abb10
commit
a94098d490
2 changed files with 100 additions and 0 deletions
|
@ -0,0 +1,86 @@
|
|||
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||
|
||||
#include <netinet/in.h>
|
||||
#include <linux/netfilter.h>
|
||||
|
||||
#include "test_progs.h"
|
||||
#include "test_netfilter_link_attach.skel.h"
|
||||
|
||||
struct nf_link_test {
|
||||
__u32 pf;
|
||||
__u32 hooknum;
|
||||
__s32 priority;
|
||||
__u32 flags;
|
||||
|
||||
bool expect_success;
|
||||
const char * const name;
|
||||
};
|
||||
|
||||
static const struct nf_link_test nf_hook_link_tests[] = {
|
||||
{ .name = "allzero", },
|
||||
{ .pf = NFPROTO_NUMPROTO, .name = "invalid-pf", },
|
||||
{ .pf = NFPROTO_IPV4, .hooknum = 42, .name = "invalid-hooknum", },
|
||||
{ .pf = NFPROTO_IPV4, .priority = INT_MIN, .name = "invalid-priority-min", },
|
||||
{ .pf = NFPROTO_IPV4, .priority = INT_MAX, .name = "invalid-priority-max", },
|
||||
{ .pf = NFPROTO_IPV4, .flags = UINT_MAX, .name = "invalid-flags", },
|
||||
|
||||
{ .pf = NFPROTO_INET, .priority = 1, .name = "invalid-inet-not-supported", },
|
||||
|
||||
{ .pf = NFPROTO_IPV4, .priority = -10000, .expect_success = true, .name = "attach ipv4", },
|
||||
{ .pf = NFPROTO_IPV6, .priority = 10001, .expect_success = true, .name = "attach ipv6", },
|
||||
};
|
||||
|
||||
void test_netfilter_link_attach(void)
|
||||
{
|
||||
struct test_netfilter_link_attach *skel;
|
||||
struct bpf_program *prog;
|
||||
LIBBPF_OPTS(bpf_netfilter_opts, opts);
|
||||
int i;
|
||||
|
||||
skel = test_netfilter_link_attach__open_and_load();
|
||||
if (!ASSERT_OK_PTR(skel, "test_netfilter_link_attach__open_and_load"))
|
||||
goto out;
|
||||
|
||||
prog = skel->progs.nf_link_attach_test;
|
||||
if (!ASSERT_OK_PTR(prog, "attach program"))
|
||||
goto out;
|
||||
|
||||
for (i = 0; i < ARRAY_SIZE(nf_hook_link_tests); i++) {
|
||||
struct bpf_link *link;
|
||||
|
||||
if (!test__start_subtest(nf_hook_link_tests[i].name))
|
||||
continue;
|
||||
|
||||
#define X(opts, m, i) opts.m = nf_hook_link_tests[(i)].m
|
||||
X(opts, pf, i);
|
||||
X(opts, hooknum, i);
|
||||
X(opts, priority, i);
|
||||
X(opts, flags, i);
|
||||
#undef X
|
||||
link = bpf_program__attach_netfilter(prog, &opts);
|
||||
if (nf_hook_link_tests[i].expect_success) {
|
||||
struct bpf_link *link2;
|
||||
|
||||
if (!ASSERT_OK_PTR(link, "program attach successful"))
|
||||
continue;
|
||||
|
||||
link2 = bpf_program__attach_netfilter(prog, &opts);
|
||||
ASSERT_ERR_PTR(link2, "attach program with same pf/hook/priority");
|
||||
|
||||
if (!ASSERT_OK(bpf_link__destroy(link), "link destroy"))
|
||||
break;
|
||||
|
||||
link2 = bpf_program__attach_netfilter(prog, &opts);
|
||||
if (!ASSERT_OK_PTR(link2, "program reattach successful"))
|
||||
continue;
|
||||
if (!ASSERT_OK(bpf_link__destroy(link2), "link destroy"))
|
||||
break;
|
||||
} else {
|
||||
ASSERT_ERR_PTR(link, "program load failure");
|
||||
}
|
||||
}
|
||||
|
||||
out:
|
||||
test_netfilter_link_attach__destroy(skel);
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||
|
||||
#include "vmlinux.h"
|
||||
#include <bpf/bpf_helpers.h>
|
||||
|
||||
#define NF_ACCEPT 1
|
||||
|
||||
SEC("netfilter")
|
||||
int nf_link_attach_test(struct bpf_nf_ctx *ctx)
|
||||
{
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
Loading…
Reference in a new issue