mirror of
https://github.com/torvalds/linux.git
synced 2026-05-25 23:52:08 +02:00
selftests/bpf: convert test_bpftool_map_access.sh into test_progs framework
The test_bpftool_map.sh script tests that maps read/write accesses are being properly allowed/refused by the kernel depending on a specific fmod_ret program being attached on security_bpf_map function. Rewrite this test to integrate it in the test_progs. The new test spawns a few subtests: #36/1 bpftool_maps_access/unprotected_unpinned:OK #36/2 bpftool_maps_access/unprotected_pinned:OK #36/3 bpftool_maps_access/protected_unpinned:OK #36/4 bpftool_maps_access/protected_pinned:OK #36/5 bpftool_maps_access/nested_maps:OK #36/6 bpftool_maps_access/btf_list:OK #36 bpftool_maps_access:OK Summary: 1/6 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Acked-by: Quentin Monnet <qmo@kernel.org> Link: https://lore.kernel.org/r/20260123-bpftool-tests-v4-3-a6653a7f28e7@bootlin.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Alexis Lothoré (eBPF Foundation)
Alexei Starovoitov
parent
1c0b505908
commit
2d96bbdfd3
|
|
@ -108,7 +108,6 @@ TEST_PROGS := test_kmod.sh \
|
|||
test_xdping.sh \
|
||||
test_bpftool_build.sh \
|
||||
test_bpftool.sh \
|
||||
test_bpftool_map.sh \
|
||||
test_doc_build.sh \
|
||||
test_xsk.sh \
|
||||
test_xdp_features.sh
|
||||
|
|
|
|||
371
tools/testing/selftests/bpf/prog_tests/bpftool_maps_access.c
Normal file
371
tools/testing/selftests/bpf/prog_tests/bpftool_maps_access.c
Normal file
|
|
@ -0,0 +1,371 @@
|
|||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
#include <stdint.h>
|
||||
#include <sys/stat.h>
|
||||
#include <stdbool.h>
|
||||
#include <linux/bpf.h>
|
||||
#include <bpf/libbpf.h>
|
||||
#include <bpftool_helpers.h>
|
||||
#include <test_progs.h>
|
||||
#include <bpf/bpf.h>
|
||||
#include "security_bpf_map.skel.h"
|
||||
|
||||
#define PROTECTED_MAP_NAME "prot_map"
|
||||
#define UNPROTECTED_MAP_NAME "not_prot_map"
|
||||
#define BPF_ITER_FILE "bpf_iter_map_elem.bpf.o"
|
||||
#define BPFFS_PIN_DIR "/sys/fs/bpf/test_bpftool_map"
|
||||
#define INNER_MAP_NAME "inner_map_tt"
|
||||
#define OUTER_MAP_NAME "outer_map_tt"
|
||||
|
||||
#define MAP_NAME_MAX_LEN 64
|
||||
#define PATH_MAX_LEN 128
|
||||
|
||||
enum map_protection {
|
||||
PROTECTED,
|
||||
UNPROTECTED
|
||||
};
|
||||
|
||||
struct test_desc {
|
||||
char *name;
|
||||
enum map_protection protection;
|
||||
struct bpf_map *map;
|
||||
char *map_name;
|
||||
bool pinned;
|
||||
char pin_path[PATH_MAX_LEN];
|
||||
bool write_must_fail;
|
||||
};
|
||||
|
||||
static struct security_bpf_map *general_setup(void)
|
||||
{
|
||||
struct security_bpf_map *skel;
|
||||
uint32_t key, value;
|
||||
int ret, i;
|
||||
|
||||
skel = security_bpf_map__open_and_load();
|
||||
if (!ASSERT_OK_PTR(skel, "open and load skeleton"))
|
||||
goto end;
|
||||
|
||||
struct bpf_map *maps[] = {skel->maps.prot_map, skel->maps.not_prot_map};
|
||||
|
||||
ret = security_bpf_map__attach(skel);
|
||||
if (!ASSERT_OK(ret, "attach maps security programs"))
|
||||
goto end_destroy;
|
||||
|
||||
for (i = 0; i < sizeof(maps)/sizeof(struct bpf_map *); i++) {
|
||||
for (key = 0; key < 2; key++) {
|
||||
int ret = bpf_map__update_elem(maps[i], &key,
|
||||
sizeof(key), &key, sizeof(key),
|
||||
0);
|
||||
if (!ASSERT_OK(ret, "set initial map value"))
|
||||
goto end_destroy;
|
||||
}
|
||||
}
|
||||
|
||||
key = 0;
|
||||
value = 1;
|
||||
ret = bpf_map__update_elem(skel->maps.prot_status_map, &key,
|
||||
sizeof(key), &value, sizeof(value), 0);
|
||||
if (!ASSERT_OK(ret, "configure map protection"))
|
||||
goto end_destroy;
|
||||
|
||||
if (!ASSERT_OK(mkdir(BPFFS_PIN_DIR, S_IFDIR), "create bpffs pin dir"))
|
||||
goto end_destroy;
|
||||
|
||||
return skel;
|
||||
end_destroy:
|
||||
security_bpf_map__destroy(skel);
|
||||
end:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static void general_cleanup(struct security_bpf_map *skel)
|
||||
{
|
||||
rmdir(BPFFS_PIN_DIR);
|
||||
security_bpf_map__destroy(skel);
|
||||
}
|
||||
|
||||
static void update_test_desc(struct security_bpf_map *skel,
|
||||
struct test_desc *test)
|
||||
{
|
||||
/* Now that the skeleton is loaded, update all missing fields to
|
||||
* have the subtest properly configured
|
||||
*/
|
||||
if (test->protection == PROTECTED) {
|
||||
test->map = skel->maps.prot_map;
|
||||
test->map_name = PROTECTED_MAP_NAME;
|
||||
} else {
|
||||
test->map = skel->maps.not_prot_map;
|
||||
test->map_name = UNPROTECTED_MAP_NAME;
|
||||
}
|
||||
}
|
||||
|
||||
static int test_setup(struct security_bpf_map *skel, struct test_desc *desc)
|
||||
{
|
||||
int ret;
|
||||
|
||||
update_test_desc(skel, desc);
|
||||
|
||||
if (desc->pinned) {
|
||||
ret = snprintf(desc->pin_path, PATH_MAX_LEN, "%s/%s", BPFFS_PIN_DIR,
|
||||
desc->name);
|
||||
if (!ASSERT_GT(ret, 0, "format pin path"))
|
||||
return 1;
|
||||
ret = bpf_map__pin(desc->map, desc->pin_path);
|
||||
if (!ASSERT_OK(ret, "pin map"))
|
||||
return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void test_cleanup(struct test_desc *desc)
|
||||
{
|
||||
if (desc->pinned)
|
||||
bpf_map__unpin(desc->map, NULL);
|
||||
}
|
||||
|
||||
static int lookup_map_value(char *map_handle)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
ret = snprintf(cmd, MAX_BPFTOOL_CMD_LEN, "map lookup %s key 0 0 0 0",
|
||||
map_handle);
|
||||
if (!ASSERT_GT(ret, 0, "format map lookup cmd"))
|
||||
return 1;
|
||||
return run_bpftool_command(cmd);
|
||||
}
|
||||
|
||||
static int read_map_btf_data(char *map_handle)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
ret = snprintf(cmd, MAX_BPFTOOL_CMD_LEN, "btf dump map %s",
|
||||
map_handle);
|
||||
if (!ASSERT_GT(ret, 0, "format map btf dump cmd"))
|
||||
return 1;
|
||||
return run_bpftool_command(cmd);
|
||||
}
|
||||
|
||||
static int write_map_value(char *map_handle)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
ret = snprintf(cmd, MAX_BPFTOOL_CMD_LEN,
|
||||
"map update %s key 0 0 0 0 value 1 1 1 1", map_handle);
|
||||
if (!ASSERT_GT(ret, 0, "format value write cmd"))
|
||||
return 1;
|
||||
return run_bpftool_command(cmd);
|
||||
}
|
||||
|
||||
static int delete_map_value(char *map_handle)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
ret = snprintf(cmd, MAX_BPFTOOL_CMD_LEN,
|
||||
"map delete %s key 0 0 0 0", map_handle);
|
||||
if (!ASSERT_GT(ret, 0, "format value deletion cmd"))
|
||||
return 1;
|
||||
return run_bpftool_command(cmd);
|
||||
}
|
||||
|
||||
static int iterate_on_map_values(char *map_handle, char *iter_pin_path)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
|
||||
ret = snprintf(cmd, MAX_BPFTOOL_CMD_LEN, "iter pin %s %s map %s",
|
||||
BPF_ITER_FILE, iter_pin_path, map_handle);
|
||||
if (!ASSERT_GT(ret, 0, "format iterator creation cmd"))
|
||||
return 1;
|
||||
ret = run_bpftool_command(cmd);
|
||||
if (ret)
|
||||
return ret;
|
||||
ret = snprintf(cmd, MAP_NAME_MAX_LEN, "cat %s", iter_pin_path);
|
||||
if (ret < 0)
|
||||
goto cleanup;
|
||||
ret = system(cmd);
|
||||
|
||||
cleanup:
|
||||
unlink(iter_pin_path);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int create_inner_map(void)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
ret = snprintf(
|
||||
cmd, MAX_BPFTOOL_CMD_LEN,
|
||||
"map create %s/%s type array key 4 value 4 entries 4 name %s",
|
||||
BPFFS_PIN_DIR, INNER_MAP_NAME, INNER_MAP_NAME);
|
||||
if (!ASSERT_GT(ret, 0, "format inner map create cmd"))
|
||||
return 1;
|
||||
return run_bpftool_command(cmd);
|
||||
}
|
||||
|
||||
static int create_outer_map(void)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
ret = snprintf(
|
||||
cmd, MAX_BPFTOOL_CMD_LEN,
|
||||
"map create %s/%s type hash_of_maps key 4 value 4 entries 2 name %s inner_map name %s",
|
||||
BPFFS_PIN_DIR, OUTER_MAP_NAME, OUTER_MAP_NAME, INNER_MAP_NAME);
|
||||
if (!ASSERT_GT(ret, 0, "format outer map create cmd"))
|
||||
return 1;
|
||||
return run_bpftool_command(cmd);
|
||||
}
|
||||
|
||||
static void delete_pinned_map(char *map_name)
|
||||
{
|
||||
char pin_path[PATH_MAX_LEN];
|
||||
int ret;
|
||||
|
||||
ret = snprintf(pin_path, PATH_MAX_LEN, "%s/%s", BPFFS_PIN_DIR,
|
||||
map_name);
|
||||
if (ret >= 0)
|
||||
unlink(pin_path);
|
||||
}
|
||||
|
||||
static int add_outer_map_entry(int key)
|
||||
{
|
||||
char cmd[MAX_BPFTOOL_CMD_LEN];
|
||||
int ret = 0;
|
||||
|
||||
ret = snprintf(
|
||||
cmd, MAX_BPFTOOL_CMD_LEN,
|
||||
"map update pinned %s/%s key %d 0 0 0 value name %s",
|
||||
BPFFS_PIN_DIR, OUTER_MAP_NAME, key, INNER_MAP_NAME);
|
||||
if (!ASSERT_GT(ret, 0, "format outer map value addition cmd"))
|
||||
return 1;
|
||||
return run_bpftool_command(cmd);
|
||||
}
|
||||
|
||||
static void test_basic_access(struct test_desc *desc)
|
||||
{
|
||||
char map_handle[MAP_NAME_MAX_LEN];
|
||||
char iter_pin_path[PATH_MAX_LEN];
|
||||
int ret;
|
||||
|
||||
if (desc->pinned)
|
||||
ret = snprintf(map_handle, MAP_NAME_MAX_LEN, "pinned %s",
|
||||
desc->pin_path);
|
||||
else
|
||||
ret = snprintf(map_handle, MAP_NAME_MAX_LEN, "name %s",
|
||||
desc->map_name);
|
||||
if (!ASSERT_GT(ret, 0, "format map handle"))
|
||||
return;
|
||||
|
||||
ret = lookup_map_value(map_handle);
|
||||
ASSERT_OK(ret, "read map value");
|
||||
|
||||
ret = read_map_btf_data(map_handle);
|
||||
ASSERT_OK(ret, "read map btf data");
|
||||
|
||||
ret = write_map_value(map_handle);
|
||||
ASSERT_OK(desc->write_must_fail ? !ret : ret, "write map value");
|
||||
|
||||
ret = delete_map_value(map_handle);
|
||||
ASSERT_OK(desc->write_must_fail ? !ret : ret, "delete map value");
|
||||
/* Restore deleted value */
|
||||
if (!ret)
|
||||
write_map_value(map_handle);
|
||||
|
||||
ret = snprintf(iter_pin_path, PATH_MAX_LEN, "%s/iter", BPFFS_PIN_DIR);
|
||||
if (ASSERT_GT(ret, 0, "format iter pin path")) {
|
||||
ret = iterate_on_map_values(map_handle, iter_pin_path);
|
||||
ASSERT_OK(ret, "iterate on map values");
|
||||
}
|
||||
}
|
||||
|
||||
static void test_create_nested_maps(void)
|
||||
{
|
||||
if (!ASSERT_OK(create_inner_map(), "create inner map"))
|
||||
return;
|
||||
if (!ASSERT_OK(create_outer_map(), "create outer map"))
|
||||
goto end_cleanup_inner;
|
||||
ASSERT_OK(add_outer_map_entry(0), "add a first entry in outer map");
|
||||
ASSERT_OK(add_outer_map_entry(1), "add a second entry in outer map");
|
||||
ASSERT_NEQ(add_outer_map_entry(2), 0, "add a third entry in outer map");
|
||||
|
||||
delete_pinned_map(OUTER_MAP_NAME);
|
||||
end_cleanup_inner:
|
||||
delete_pinned_map(INNER_MAP_NAME);
|
||||
}
|
||||
|
||||
static void test_btf_list(void)
|
||||
{
|
||||
ASSERT_OK(run_bpftool_command("btf list"), "list btf data");
|
||||
}
|
||||
|
||||
static struct test_desc tests[] = {
|
||||
{
|
||||
.name = "unprotected_unpinned",
|
||||
.protection = UNPROTECTED,
|
||||
.map_name = UNPROTECTED_MAP_NAME,
|
||||
.pinned = false,
|
||||
.write_must_fail = false,
|
||||
},
|
||||
{
|
||||
.name = "unprotected_pinned",
|
||||
.protection = UNPROTECTED,
|
||||
.map_name = UNPROTECTED_MAP_NAME,
|
||||
.pinned = true,
|
||||
.write_must_fail = false,
|
||||
},
|
||||
{
|
||||
.name = "protected_unpinned",
|
||||
.protection = PROTECTED,
|
||||
.map_name = UNPROTECTED_MAP_NAME,
|
||||
.pinned = false,
|
||||
.write_must_fail = true,
|
||||
},
|
||||
{
|
||||
.name = "protected_pinned",
|
||||
.protection = PROTECTED,
|
||||
.map_name = UNPROTECTED_MAP_NAME,
|
||||
.pinned = true,
|
||||
.write_must_fail = true,
|
||||
}
|
||||
};
|
||||
|
||||
static const size_t tests_count = ARRAY_SIZE(tests);
|
||||
|
||||
void test_bpftool_maps_access(void)
|
||||
{
|
||||
struct security_bpf_map *skel;
|
||||
struct test_desc *current;
|
||||
int i;
|
||||
|
||||
skel = general_setup();
|
||||
if (!ASSERT_OK_PTR(skel, "prepare programs"))
|
||||
goto cleanup;
|
||||
|
||||
for (i = 0; i < tests_count; i++) {
|
||||
current = &tests[i];
|
||||
if (!test__start_subtest(current->name))
|
||||
continue;
|
||||
if (ASSERT_OK(test_setup(skel, current), "subtest setup")) {
|
||||
test_basic_access(current);
|
||||
test_cleanup(current);
|
||||
}
|
||||
}
|
||||
if (test__start_subtest("nested_maps"))
|
||||
test_create_nested_maps();
|
||||
if (test__start_subtest("btf_list"))
|
||||
test_btf_list();
|
||||
|
||||
cleanup:
|
||||
general_cleanup(skel);
|
||||
}
|
||||
|
||||
|
|
@ -1,398 +0,0 @@
|
|||
#!/bin/sh
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
# Kselftest framework requirement - SKIP code is 4.
|
||||
ksft_skip=4
|
||||
|
||||
TESTNAME="bpftool_map"
|
||||
BPF_FILE="security_bpf_map.bpf.o"
|
||||
BPF_ITER_FILE="bpf_iter_map_elem.bpf.o"
|
||||
PROTECTED_MAP_NAME="prot_map"
|
||||
NOT_PROTECTED_MAP_NAME="not_prot_map"
|
||||
BPF_FS_TMP_PARENT="/tmp"
|
||||
BPF_FS_PARENT=$(awk '$3 == "bpf" {print $2; exit}' /proc/mounts)
|
||||
BPF_FS_PARENT=${BPF_FS_PARENT:-$BPF_FS_TMP_PARENT}
|
||||
# bpftool will mount bpf file system under BPF_DIR if it is not mounted
|
||||
# under BPF_FS_PARENT.
|
||||
BPF_DIR="$BPF_FS_PARENT/test_$TESTNAME"
|
||||
SCRIPT_DIR=$(dirname $(realpath "$0"))
|
||||
BPF_FILE_PATH="$SCRIPT_DIR/$BPF_FILE"
|
||||
BPF_ITER_FILE_PATH="$SCRIPT_DIR/$BPF_ITER_FILE"
|
||||
BPFTOOL_PATH="bpftool"
|
||||
# Assume the script is located under tools/testing/selftests/bpf/
|
||||
KDIR_ROOT_DIR=$(realpath "$SCRIPT_DIR"/../../../../)
|
||||
|
||||
_cleanup()
|
||||
{
|
||||
set +eu
|
||||
|
||||
# If BPF_DIR is a mount point this will not remove the mount point itself.
|
||||
[ -d "$BPF_DIR" ] && rm -rf "$BPF_DIR" 2> /dev/null
|
||||
|
||||
# Unmount if BPF filesystem was temporarily created.
|
||||
if [ "$BPF_FS_PARENT" = "$BPF_FS_TMP_PARENT" ]; then
|
||||
# A loop and recursive unmount are required as bpftool might
|
||||
# create multiple mounts. For example, a bind mount of the directory
|
||||
# to itself. The bind mount is created to change mount propagation
|
||||
# flags on an actual mount point.
|
||||
max_attempts=3
|
||||
attempt=0
|
||||
while mountpoint -q "$BPF_DIR" && [ $attempt -lt $max_attempts ]; do
|
||||
umount -R "$BPF_DIR" 2>/dev/null
|
||||
attempt=$((attempt+1))
|
||||
done
|
||||
|
||||
# The directory still exists. Remove it now.
|
||||
[ -d "$BPF_DIR" ] && rm -rf "$BPF_DIR" 2>/dev/null
|
||||
fi
|
||||
}
|
||||
|
||||
cleanup_skip()
|
||||
{
|
||||
echo "selftests: $TESTNAME [SKIP]"
|
||||
_cleanup
|
||||
|
||||
exit $ksft_skip
|
||||
}
|
||||
|
||||
cleanup()
|
||||
{
|
||||
if [ "$?" = 0 ]; then
|
||||
echo "selftests: $TESTNAME [PASS]"
|
||||
else
|
||||
echo "selftests: $TESTNAME [FAILED]"
|
||||
fi
|
||||
_cleanup
|
||||
}
|
||||
|
||||
check_root_privileges() {
|
||||
if [ $(id -u) -ne 0 ]; then
|
||||
echo "Need root privileges"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to verify bpftool path.
|
||||
# Parameters:
|
||||
# $1: bpftool path
|
||||
verify_bpftool_path() {
|
||||
local bpftool_path="$1"
|
||||
if ! "$bpftool_path" version > /dev/null 2>&1; then
|
||||
echo "Could not run test without bpftool"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to verify BTF support.
|
||||
# The test requires BTF support for fmod_ret programs.
|
||||
verify_btf_support() {
|
||||
if [ ! -f /sys/kernel/btf/vmlinux ]; then
|
||||
echo "Could not run test without BTF support"
|
||||
exit $ksft_skip
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to initialize map entries with keys [0..2] and values set to 0.
|
||||
# Parameters:
|
||||
# $1: Map name
|
||||
# $2: bpftool path
|
||||
initialize_map_entries() {
|
||||
local map_name="$1"
|
||||
local bpftool_path="$2"
|
||||
|
||||
for key in 0 1 2; do
|
||||
"$bpftool_path" map update name "$map_name" key $key 0 0 0 value 0 0 0 $key
|
||||
done
|
||||
}
|
||||
|
||||
# Test read access to the map.
|
||||
# Parameters:
|
||||
# $1: Name command (name/pinned)
|
||||
# $2: Map name
|
||||
# $3: bpftool path
|
||||
# $4: key
|
||||
access_for_read() {
|
||||
local name_cmd="$1"
|
||||
local map_name="$2"
|
||||
local bpftool_path="$3"
|
||||
local key="$4"
|
||||
|
||||
# Test read access to the map.
|
||||
if ! "$bpftool_path" map lookup "$name_cmd" "$map_name" key $key 1>/dev/null; then
|
||||
echo " Read access to $key in $map_name failed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Test read access to map's BTF data.
|
||||
if ! "$bpftool_path" btf dump map "$name_cmd" "$map_name" 1>/dev/null; then
|
||||
echo " Read access to $map_name for BTF data failed"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Test write access to the map.
|
||||
# Parameters:
|
||||
# $1: Name command (name/pinned)
|
||||
# $2: Map name
|
||||
# $3: bpftool path
|
||||
# $4: key
|
||||
# $5: Whether write should succeed (true/false)
|
||||
access_for_write() {
|
||||
local name_cmd="$1"
|
||||
local map_name="$2"
|
||||
local bpftool_path="$3"
|
||||
local key="$4"
|
||||
local write_should_succeed="$5"
|
||||
local value="1 1 1 1"
|
||||
|
||||
if "$bpftool_path" map update "$name_cmd" "$map_name" key $key value \
|
||||
$value 2>/dev/null; then
|
||||
if [ "$write_should_succeed" = "false" ]; then
|
||||
echo " Write access to $key in $map_name succeeded but should have failed"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
if [ "$write_should_succeed" = "true" ]; then
|
||||
echo " Write access to $key in $map_name failed but should have succeeded"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Test entry deletion for the map.
|
||||
# Parameters:
|
||||
# $1: Name command (name/pinned)
|
||||
# $2: Map name
|
||||
# $3: bpftool path
|
||||
# $4: key
|
||||
# $5: Whether write should succeed (true/false)
|
||||
access_for_deletion() {
|
||||
local name_cmd="$1"
|
||||
local map_name="$2"
|
||||
local bpftool_path="$3"
|
||||
local key="$4"
|
||||
local write_should_succeed="$5"
|
||||
local value="1 1 1 1"
|
||||
|
||||
# Test deletion by key for the map.
|
||||
# Before deleting, check the key exists.
|
||||
if ! "$bpftool_path" map lookup "$name_cmd" "$map_name" key $key 1>/dev/null; then
|
||||
echo " Key $key does not exist in $map_name"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Delete by key.
|
||||
if "$bpftool_path" map delete "$name_cmd" "$map_name" key $key 2>/dev/null; then
|
||||
if [ "$write_should_succeed" = "false" ]; then
|
||||
echo " Deletion for $key in $map_name succeeded but should have failed"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
if [ "$write_should_succeed" = "true" ]; then
|
||||
echo " Deletion for $key in $map_name failed but should have succeeded"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# After deleting, check the entry existence according to the expected status.
|
||||
if "$bpftool_path" map lookup "$name_cmd" "$map_name" key $key 1>/dev/null; then
|
||||
if [ "$write_should_succeed" = "true" ]; then
|
||||
echo " Key $key for $map_name was not deleted but should have been deleted"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
if [ "$write_should_succeed" = "false" ]; then
|
||||
echo "Key $key for $map_name was deleted but should have not been deleted"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Test creation of map's deleted entry, if deletion was successful.
|
||||
# Otherwise, the entry exists.
|
||||
if "$bpftool_path" map update "$name_cmd" "$map_name" key $key value \
|
||||
$value 2>/dev/null; then
|
||||
if [ "$write_should_succeed" = "false" ]; then
|
||||
echo " Write access to $key in $map_name succeeded after deletion attempt but should have failed"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
if [ "$write_should_succeed" = "true" ]; then
|
||||
echo " Write access to $key in $map_name failed after deletion attempt but should have succeeded"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Test map elements iterator.
|
||||
# Parameters:
|
||||
# $1: Name command (name/pinned)
|
||||
# $2: Map name
|
||||
# $3: bpftool path
|
||||
# $4: BPF_DIR
|
||||
# $5: bpf iterator object file path
|
||||
iterate_map_elem() {
|
||||
local name_cmd="$1"
|
||||
local map_name="$2"
|
||||
local bpftool_path="$3"
|
||||
local bpf_dir="$4"
|
||||
local bpf_file="$5"
|
||||
local pin_path="$bpf_dir/map_iterator"
|
||||
|
||||
"$bpftool_path" iter pin "$bpf_file" "$pin_path" map "$name_cmd" "$map_name"
|
||||
if [ ! -f "$pin_path" ]; then
|
||||
echo " Failed to pin iterator to $pin_path"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat "$pin_path" 1>/dev/null
|
||||
rm "$pin_path" 2>/dev/null
|
||||
}
|
||||
|
||||
# Function to test map access with configurable write expectations
|
||||
# Parameters:
|
||||
# $1: Name command (name/pinned)
|
||||
# $2: Map name
|
||||
# $3: bpftool path
|
||||
# $4: key for rw
|
||||
# $5: key to delete
|
||||
# $6: Whether write should succeed (true/false)
|
||||
# $7: BPF_DIR
|
||||
# $8: bpf iterator object file path
|
||||
access_map() {
|
||||
local name_cmd="$1"
|
||||
local map_name="$2"
|
||||
local bpftool_path="$3"
|
||||
local key_for_rw="$4"
|
||||
local key_to_del="$5"
|
||||
local write_should_succeed="$6"
|
||||
local bpf_dir="$7"
|
||||
local bpf_iter_file_path="$8"
|
||||
|
||||
access_for_read "$name_cmd" "$map_name" "$bpftool_path" "$key_for_rw"
|
||||
access_for_write "$name_cmd" "$map_name" "$bpftool_path" "$key_for_rw" \
|
||||
"$write_should_succeed"
|
||||
access_for_deletion "$name_cmd" "$map_name" "$bpftool_path" "$key_to_del" \
|
||||
"$write_should_succeed"
|
||||
iterate_map_elem "$name_cmd" "$map_name" "$bpftool_path" "$bpf_dir" \
|
||||
"$bpf_iter_file_path"
|
||||
}
|
||||
|
||||
# Function to test map access with configurable write expectations
|
||||
# Parameters:
|
||||
# $1: Map name
|
||||
# $2: bpftool path
|
||||
# $3: BPF_DIR
|
||||
# $4: Whether write should succeed (true/false)
|
||||
# $5: bpf iterator object file path
|
||||
test_map_access() {
|
||||
local map_name="$1"
|
||||
local bpftool_path="$2"
|
||||
local bpf_dir="$3"
|
||||
local pin_path="$bpf_dir/${map_name}_pinned"
|
||||
local write_should_succeed="$4"
|
||||
local bpf_iter_file_path="$5"
|
||||
|
||||
# Test access to the map by name.
|
||||
access_map "name" "$map_name" "$bpftool_path" "0 0 0 0" "1 0 0 0" \
|
||||
"$write_should_succeed" "$bpf_dir" "$bpf_iter_file_path"
|
||||
|
||||
# Pin the map to the BPF filesystem
|
||||
"$bpftool_path" map pin name "$map_name" "$pin_path"
|
||||
if [ ! -e "$pin_path" ]; then
|
||||
echo " Failed to pin $map_name"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Test access to the pinned map.
|
||||
access_map "pinned" "$pin_path" "$bpftool_path" "0 0 0 0" "2 0 0 0" \
|
||||
"$write_should_succeed" "$bpf_dir" "$bpf_iter_file_path"
|
||||
}
|
||||
|
||||
# Function to test map creation and map-of-maps
|
||||
# Parameters:
|
||||
# $1: bpftool path
|
||||
# $2: BPF_DIR
|
||||
test_map_creation_and_map_of_maps() {
|
||||
local bpftool_path="$1"
|
||||
local bpf_dir="$2"
|
||||
local outer_map_name="outer_map_tt"
|
||||
local inner_map_name="inner_map_tt"
|
||||
|
||||
"$bpftool_path" map create "$bpf_dir/$inner_map_name" type array key 4 \
|
||||
value 4 entries 4 name "$inner_map_name"
|
||||
if [ ! -f "$bpf_dir/$inner_map_name" ]; then
|
||||
echo " Failed to create inner map file at $bpf_dir/$outer_map_name"
|
||||
return 1
|
||||
fi
|
||||
|
||||
"$bpftool_path" map create "$bpf_dir/$outer_map_name" type hash_of_maps \
|
||||
key 4 value 4 entries 2 name "$outer_map_name" inner_map name "$inner_map_name"
|
||||
if [ ! -f "$bpf_dir/$outer_map_name" ]; then
|
||||
echo " Failed to create outer map file at $bpf_dir/$outer_map_name"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Add entries to the outer map by name and by pinned path.
|
||||
"$bpftool_path" map update pinned "$bpf_dir/$outer_map_name" key 0 0 0 0 \
|
||||
value pinned "$bpf_dir/$inner_map_name"
|
||||
"$bpftool_path" map update name "$outer_map_name" key 1 0 0 0 value \
|
||||
name "$inner_map_name"
|
||||
|
||||
# The outer map should be full by now.
|
||||
# The following map update command is expected to fail.
|
||||
if "$bpftool_path" map update name "$outer_map_name" key 2 0 0 0 value name \
|
||||
"$inner_map_name" 2>/dev/null; then
|
||||
echo " Update for $outer_map_name succeeded but should have failed"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to test map access with the btf list command
|
||||
# Parameters:
|
||||
# $1: bpftool path
|
||||
test_map_access_with_btf_list() {
|
||||
local bpftool_path="$1"
|
||||
|
||||
# The btf list command iterates over maps for
|
||||
# loaded BPF programs.
|
||||
if ! "$bpftool_path" btf list 1>/dev/null; then
|
||||
echo " Failed to access btf data"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
set -eu
|
||||
|
||||
trap cleanup_skip EXIT
|
||||
|
||||
check_root_privileges
|
||||
|
||||
verify_bpftool_path "$BPFTOOL_PATH"
|
||||
|
||||
verify_btf_support
|
||||
|
||||
trap cleanup EXIT
|
||||
|
||||
# Load and attach the BPF programs to control maps access.
|
||||
"$BPFTOOL_PATH" prog loadall "$BPF_FILE_PATH" "$BPF_DIR" autoattach
|
||||
|
||||
initialize_map_entries "$PROTECTED_MAP_NAME" "$BPFTOOL_PATH"
|
||||
initialize_map_entries "$NOT_PROTECTED_MAP_NAME" "$BPFTOOL_PATH"
|
||||
|
||||
# Activate the map protection mechanism. Protection status is controlled
|
||||
# by a value stored in the prot_status_map at index 0.
|
||||
"$BPFTOOL_PATH" map update name prot_status_map key 0 0 0 0 value 1 0 0 0
|
||||
|
||||
# Test protected map (write should fail).
|
||||
test_map_access "$PROTECTED_MAP_NAME" "$BPFTOOL_PATH" "$BPF_DIR" "false" \
|
||||
"$BPF_ITER_FILE_PATH"
|
||||
|
||||
# Test not protected map (write should succeed).
|
||||
test_map_access "$NOT_PROTECTED_MAP_NAME" "$BPFTOOL_PATH" "$BPF_DIR" "true" \
|
||||
"$BPF_ITER_FILE_PATH"
|
||||
|
||||
test_map_creation_and_map_of_maps "$BPFTOOL_PATH" "$BPF_DIR"
|
||||
|
||||
test_map_access_with_btf_list "$BPFTOOL_PATH"
|
||||
|
||||
exit 0
|
||||
Loading…
Reference in New Issue
Block a user