[PATCH bpf-next v7 1/2] Add skb_store_bytes() for BPF_PROG_TYPE_CGROUP_SKB

[PATCH bpf-next v7 1/2] Add skb_store_bytes() for BPF_PROG_TYPE_CGROUP_SKB

[Tyler Wear]

Need to modify the ds field to support upcoming Wifi QoS Alliance spec.
Instead of adding generic function for just modifying the ds field,
add skb_store_bytes for BPF_PROG_TYPE_CGROUP_SKB.
This allows other fields in the network and transport header to be
modified in the future.

Checksum API's also need to be added for completeness.

It is not possible to use CGROUP_(SET|GET)SOCKOPT since
the policy may change during runtime and would result
in a large number of entries with wildcards.

The existing check for bpf_try_make_writable() should mean that
skb_share_check() is not needed.

Signed-off-by: Tyler Wear <quic_twear@quicinc.com>
---
 net/core/filter.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 6102f093d59a..f30d939cb4cf 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -7299,6 +7299,18 @@ cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		return &bpf_sk_storage_delete_proto;
 	case BPF_FUNC_perf_event_output:
 		return &bpf_skb_event_output_proto;
+	case BPF_FUNC_skb_store_bytes:
+		return &bpf_skb_store_bytes_proto;
+	case BPF_FUNC_csum_update:
+		return &bpf_csum_update_proto;
+	case BPF_FUNC_csum_level:
+		return &bpf_csum_level_proto;
+	case BPF_FUNC_l3_csum_replace:
+		return &bpf_l3_csum_replace_proto;
+	case BPF_FUNC_l4_csum_replace:
+		return &bpf_l4_csum_replace_proto;
+	case BPF_FUNC_csum_diff:
+		return &bpf_csum_diff_proto;
 #ifdef CONFIG_SOCK_CGROUP_DATA
 	case BPF_FUNC_skb_cgroup_id:
 		return &bpf_skb_cgroup_id_proto;
-- 
2.25.1

[PATCH bpf-next v7 2/2] selftests/bpf: CGROUP_SKB test for skb_store_bytes()

[Tyler Wear]

Test that the source port of an egress packet is changed
via skb_store_bytes() for a BPF_PROG_TYPE_CGROUP_SKB prog.

Test creates a client and server and checks that the packet
received on the server has the updated source IP and Port
that the bpf program modifies.

Signed-off-by: Tyler Wear <quic_twear@quicinc.com>
---
 .../bpf/prog_tests/cgroup_store_bytes.c       | 70 +++++++++++++++++++
 .../selftests/bpf/progs/cgroup_store_bytes.c  | 49 +++++++++++++
 2 files changed, 119 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/cgroup_store_bytes.c
 create mode 100644 tools/testing/selftests/bpf/progs/cgroup_store_bytes.c

diff --git a/tools/testing/selftests/bpf/prog_tests/cgroup_store_bytes.c b/tools/testing/selftests/bpf/prog_tests/cgroup_store_bytes.c
new file mode 100644
index 000000000000..c6cabc19849e
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/cgroup_store_bytes.c
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <test_progs.h>
+#include <network_helpers.h>
+
+#include "cgroup_store_bytes.skel.h"
+
+void test_cgroup_store_bytes(void)
+{
+	int server_fd, cgroup_fd, client_fd, err, bytes;
+	struct sockaddr server_addr;
+	socklen_t addrlen = sizeof(server_addr);
+	char buf[] = "testing";
+	struct sockaddr_storage ss;
+	socklen_t slen = sizeof(ss);
+	char recv_buf[BUFSIZ];
+	struct in_addr addr;
+	unsigned short port;
+	struct cgroup_store_bytes *skel;
+
+	cgroup_fd = test__join_cgroup("/cgroup_store_bytes");
+	if (!ASSERT_GE(cgroup_fd, 0, "cgroup_fd"))
+		return;
+
+	skel = cgroup_store_bytes__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel"))
+		goto close_cgroup_fd;
+
+	skel->links.cgroup_store_bytes = bpf_program__attach_cgroup(
+			skel->progs.cgroup_store_bytes, cgroup_fd);
+	if (!ASSERT_OK_PTR(skel->links.cgroup_store_bytes , "cgroup_store_bytes"))
+		goto close_skeleton;
+
+	server_fd = start_server(AF_INET, SOCK_DGRAM, NULL, 0, 0);
+	if (!ASSERT_GE(server_fd, 0, "server_fd"))
+		goto close_skeleton;
+
+	client_fd = start_server(AF_INET, SOCK_DGRAM, NULL, 0, 0);
+	if (!ASSERT_GE(client_fd, 0, "client_fd"))
+		goto close_server_fd;
+
+	err = getsockname(server_fd, &server_addr, &addrlen);
+	if (!ASSERT_OK(err, "getsockname"))
+		goto close_client_fd;
+
+	bytes = sendto(client_fd, buf, sizeof(buf), 0, &server_addr,
+			sizeof(server_addr));
+	if (!ASSERT_EQ(bytes, sizeof(buf), "sendto"))
+		goto close_client_fd;
+
+	bytes = recvfrom(server_fd, &recv_buf, sizeof(recv_buf), 0,
+			(struct sockaddr *)&ss, &slen);
+	if (!ASSERT_GE(bytes, 0, "recvfrom"))
+		goto close_client_fd;
+
+	addr = ((struct sockaddr_in *)&ss)->sin_addr;
+
+	ASSERT_EQ(skel->bss->test_result, 1, "bpf program returned failure");
+	port = ((struct sockaddr_in *)&ss)->sin_port;
+	ASSERT_EQ(port, 5555, "bpf program failed to change port");
+
+close_client_fd:
+	close(client_fd);
+close_server_fd:
+	close(server_fd);
+close_skeleton:
+	cgroup_store_bytes__destroy(skel);
+close_cgroup_fd:
+	close(cgroup_fd);
+}
diff --git a/tools/testing/selftests/bpf/progs/cgroup_store_bytes.c b/tools/testing/selftests/bpf/progs/cgroup_store_bytes.c
new file mode 100644
index 000000000000..4608083e18b7
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/cgroup_store_bytes.c
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <errno.h>
+#include <linux/bpf.h>
+#include <linux/if_ether.h>
+#include <linux/ip.h>
+#include <netinet/in.h>
+#include <netinet/udp.h>
+#include <bpf/bpf_helpers.h>
+
+#define IP_SRC_OFF offsetof(struct iphdr, saddr)
+#define UDP_SPORT_OFF (sizeof(struct iphdr) + offsetof(struct udphdr, source))
+
+#define IS_PSEUDO 0x10
+
+#define UDP_CSUM_OFF (sizeof(struct iphdr) + offsetof(struct udphdr, check))
+#define IP_CSUM_OFF offsetof(struct iphdr, check)
+
+int test_result = 0;
+
+SEC("cgroup_skb/egress")
+int cgroup_store_bytes(struct __sk_buff *skb)
+{
+	struct ethhdr eth;
+	struct iphdr iph;
+	struct udphdr udph;
+
+	__u32 map_key = 0;
+	__u16 new_port = 5555;
+	__u16 old_port;
+	__u32 old_ip;
+
+	if (bpf_skb_load_bytes_relative(skb, 0, &iph, sizeof(iph), BPF_HDR_START_NET))
+		goto fail;
+
+	if (bpf_skb_load_bytes_relative(skb, sizeof(iph), &udph, sizeof(udph), BPF_HDR_START_NET))
+		goto fail;
+
+	old_port = udph.source;
+	bpf_l4_csum_replace(skb, UDP_CSUM_OFF, old_port, new_port,
+						IS_PSEUDO | sizeof(new_port));
+	if (bpf_skb_store_bytes(skb, UDP_SPORT_OFF, &new_port, sizeof(new_port), 0) < 0)
+		goto fail;
+
+	test_result = 1;
+
+fail:
+	return 1;
+}
-- 
2.25.1