samples: bpf: add skb->field examples and tests

- modify sockex1 example to count number of bytes in outgoing packets
- modify sockex2 example to count number of bytes and packets per flow
- add 4 stress tests that exercise 'skb->field' code path of verifier

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/samples/bpf/sockex1_kern.c b/samples/bpf/sockex1_kern.c
index 0668926629154836b09dc81b9e4cf78cfb4eb343..ed18e9a4909c77899d6561680261e97a3dbea235 100644 (file)
--- a/samples/bpf/sockex1_kern.c
+++ b/samples/bpf/sockex1_kern.c
@@ -1,5 +1,6 @@
 #include <uapi/linux/bpf.h>
 #include <uapi/linux/if_ether.h>
+#include <uapi/linux/if_packet.h>
 #include <uapi/linux/ip.h>
 #include "bpf_helpers.h"
 
@@ -11,14 +12,17 @@ struct bpf_map_def SEC("maps") my_map = {
 };
 
 SEC("socket1")
-int bpf_prog1(struct sk_buff *skb)
+int bpf_prog1(struct __sk_buff *skb)
 {
        int index = load_byte(skb, ETH_HLEN + offsetof(struct iphdr, protocol));
        long *value;
 
+       if (skb->pkt_type != PACKET_OUTGOING)
+               return 0;
+
        value = bpf_map_lookup_elem(&my_map, &index);
        if (value)
-               __sync_fetch_and_add(value, 1);
+               __sync_fetch_and_add(value, skb->len);
 
        return 0;
 }

diff --git a/samples/bpf/sockex1_user.c b/samples/bpf/sockex1_user.c
index 34a443ff383121719f6f919694d5023fa36e1742..678ce469355152650ee055136821f4ad8b50ed85 100644 (file)
--- a/samples/bpf/sockex1_user.c
+++ b/samples/bpf/sockex1_user.c
@@ -40,7 +40,7 @@ int main(int ac, char **argv)
                key = IPPROTO_ICMP;
                assert(bpf_lookup_elem(map_fd[0], &key, &icmp_cnt) == 0);
 
-               printf("TCP %lld UDP %lld ICMP %lld packets\n",
+               printf("TCP %lld UDP %lld ICMP %lld bytes\n",
                       tcp_cnt, udp_cnt, icmp_cnt);
                sleep(1);
        }

diff --git a/samples/bpf/sockex2_kern.c b/samples/bpf/sockex2_kern.c
index 6f0135f0f2176c8a1825c884c4a28a13c7c1f123..ba0e177ff56151184a0685dc475eb2476d2d4126 100644 (file)
--- a/samples/bpf/sockex2_kern.c
+++ b/samples/bpf/sockex2_kern.c
@@ -42,13 +42,13 @@ static inline int proto_ports_offset(__u64 proto)
        }
 }
 
-static inline int ip_is_fragment(struct sk_buff *ctx, __u64 nhoff)
+static inline int ip_is_fragment(struct __sk_buff *ctx, __u64 nhoff)
 {
        return load_half(ctx, nhoff + offsetof(struct iphdr, frag_off))
                & (IP_MF | IP_OFFSET);
 }
 
-static inline __u32 ipv6_addr_hash(struct sk_buff *ctx, __u64 off)
+static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
 {
        __u64 w0 = load_word(ctx, off);
        __u64 w1 = load_word(ctx, off + 4);
@@ -58,7 +58,7 @@ static inline __u32 ipv6_addr_hash(struct sk_buff *ctx, __u64 off)
        return (__u32)(w0 ^ w1 ^ w2 ^ w3);
 }
 
-static inline __u64 parse_ip(struct sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
                             struct flow_keys *flow)
 {
        __u64 verlen;
@@ -82,7 +82,7 @@ static inline __u64 parse_ip(struct sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
        return nhoff;
 }
 
-static inline __u64 parse_ipv6(struct sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
                               struct flow_keys *flow)
 {
        *ip_proto = load_byte(skb,
@@ -96,7 +96,7 @@ static inline __u64 parse_ipv6(struct sk_buff *skb, __u64 nhoff, __u64 *ip_proto
        return nhoff;
 }
 
-static inline bool flow_dissector(struct sk_buff *skb, struct flow_keys *flow)
+static inline bool flow_dissector(struct __sk_buff *skb, struct flow_keys *flow)
 {
        __u64 nhoff = ETH_HLEN;
        __u64 ip_proto;
@@ -183,18 +183,23 @@ static inline bool flow_dissector(struct sk_buff *skb, struct flow_keys *flow)
        return true;
 }
 
+struct pair {
+       long packets;
+       long bytes;
+};
+
 struct bpf_map_def SEC("maps") hash_map = {
        .type = BPF_MAP_TYPE_HASH,
        .key_size = sizeof(__be32),
-       .value_size = sizeof(long),
+       .value_size = sizeof(struct pair),
        .max_entries = 1024,
 };
 
 SEC("socket2")
-int bpf_prog2(struct sk_buff *skb)
+int bpf_prog2(struct __sk_buff *skb)
 {
        struct flow_keys flow;
-       long *value;
+       struct pair *value;
        u32 key;
 
        if (!flow_dissector(skb, &flow))
@@ -203,9 +208,10 @@ int bpf_prog2(struct sk_buff *skb)
        key = flow.dst;
        value = bpf_map_lookup_elem(&hash_map, &key);
        if (value) {
-               __sync_fetch_and_add(value, 1);
+               __sync_fetch_and_add(&value->packets, 1);
+               __sync_fetch_and_add(&value->bytes, skb->len);
        } else {
-               long val = 1;
+               struct pair val = {1, skb->len};
 
                bpf_map_update_elem(&hash_map, &key, &val, BPF_ANY);
        }

diff --git a/samples/bpf/sockex2_user.c b/samples/bpf/sockex2_user.c
index d2d5f5a790d3c4952ff027b326add6a29e048157..29a276d766fc91fb0c0552ed5ebf0ef51146775b 100644 (file)
--- a/samples/bpf/sockex2_user.c
+++ b/samples/bpf/sockex2_user.c
@@ -6,6 +6,11 @@
 #include <unistd.h>
 #include <arpa/inet.h>
 
+struct pair {
+       __u64 packets;
+       __u64 bytes;
+};
+
 int main(int ac, char **argv)
 {
        char filename[256];
@@ -29,13 +34,13 @@ int main(int ac, char **argv)
 
        for (i = 0; i < 5; i++) {
                int key = 0, next_key;
-               long long value;
+               struct pair value;
 
                while (bpf_get_next_key(map_fd[0], &key, &next_key) == 0) {
                        bpf_lookup_elem(map_fd[0], &next_key, &value);
-                       printf("ip %s count %lld\n",
+                       printf("ip %s bytes %lld packets %lld\n",
                               inet_ntoa((struct in_addr){htonl(next_key)}),
-                              value);
+                              value.bytes, value.packets);
                        key = next_key;
                }
                sleep(1);

diff --git a/samples/bpf/test_verifier.c b/samples/bpf/test_verifier.c
index 7b56b59fad8ebb6e29ff0885efb20d0b847ffb89..df6dbb6576f663719eb3c5b926b257b21dcb3910 100644 (file)
--- a/samples/bpf/test_verifier.c
+++ b/samples/bpf/test_verifier.c
@@ -14,6 +14,7 @@
 #include <linux/unistd.h>
 #include <string.h>
 #include <linux/filter.h>
+#include <stddef.h>
 #include "libbpf.h"
 
 #define MAX_INSNS 512
@@ -642,6 +643,75 @@ static struct bpf_test tests[] = {
                },
                .result = ACCEPT,
        },
+       {
+               "access skb fields ok",
+               .insns = {
+                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                   offsetof(struct __sk_buff, len)),
+                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                   offsetof(struct __sk_buff, mark)),
+                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                   offsetof(struct __sk_buff, pkt_type)),
+                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                   offsetof(struct __sk_buff, queue_mapping)),
+                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
+                       BPF_EXIT_INSN(),
+               },
+               .result = ACCEPT,
+       },
+       {
+               "access skb fields bad1",
+               .insns = {
+                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
+                       BPF_EXIT_INSN(),
+               },
+               .errstr = "invalid bpf_context access",
+               .result = REJECT,
+       },
+       {
+               "access skb fields bad2",
+               .insns = {
+                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
+                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                       BPF_LD_MAP_FD(BPF_REG_1, 0),
+                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                       BPF_EXIT_INSN(),
+                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                   offsetof(struct __sk_buff, pkt_type)),
+                       BPF_EXIT_INSN(),
+               },
+               .fixup = {4},
+               .errstr = "different pointers",
+               .result = REJECT,
+       },
+       {
+               "access skb fields bad3",
+               .insns = {
+                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                   offsetof(struct __sk_buff, pkt_type)),
+                       BPF_EXIT_INSN(),
+                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                       BPF_LD_MAP_FD(BPF_REG_1, 0),
+                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                       BPF_EXIT_INSN(),
+                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+                       BPF_JMP_IMM(BPF_JA, 0, 0, -12),
+               },
+               .fixup = {6},
+               .errstr = "different pointers",
+               .result = REJECT,
+       },
 };
 
 static int probe_filter_length(struct bpf_insn *fp)