Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
selftests/bpf: add missing netfilter return value and ctx access tests
Extend prog_tests with two test cases: # ./test_progs --allow=verifier_netfilter_retcode torvalds#278/1 verifier_netfilter_retcode/bpf_exit with invalid return code. test1:OK torvalds#278/2 verifier_netfilter_retcode/bpf_exit with valid return code. test2:OK torvalds#278/3 verifier_netfilter_retcode/bpf_exit with valid return code. test3:OK torvalds#278/4 verifier_netfilter_retcode/bpf_exit with invalid return code. test4:OK torvalds#278 verifier_netfilter_retcode:OK This checks that only accept and drop (0,1) are permitted. NF_QUEUE could be implemented later if we can guarantee that attachment of such programs can be rejected if they get attached to a pf/hook that doesn't support async reinjection. NF_STOLEN could be implemented via trusted helpers that can guarantee that the skb will eventually be free'd. v4: test case for bpf_nf_ctx access checks, requested by Alexei Starovoitov. v5: also check ctx->{state,skb} can be dereferenced (Alexei). # ./test_progs --allow=verifier_netfilter_ctx torvalds#281/1 verifier_netfilter_ctx/netfilter invalid context access, size too short:OK torvalds#281/2 verifier_netfilter_ctx/netfilter invalid context access, size too short:OK torvalds#281/3 verifier_netfilter_ctx/netfilter invalid context access, past end of ctx:OK torvalds#281/4 verifier_netfilter_ctx/netfilter invalid context, write:OK torvalds#281/5 verifier_netfilter_ctx/netfilter valid context read and invalid write:OK torvalds#281/6 verifier_netfilter_ctx/netfilter test prog with skb and state read access:OK torvalds#281/7 verifier_netfilter_ctx/netfilter test prog with skb and state read access @unpriv:OK torvalds#281 verifier_netfilter_ctx:OK Summary: 1/7 PASSED, 0 SKIPPED, 0 FAILED This checks: 1/2: partial reads of ctx->{skb,state} are rejected 3. read access past sizeof(ctx) is rejected 4. write to ctx content, e.g. 'ctx->skb = NULL;' is rejected 5. ctx->state content cannot be altered 6. ctx->state and ctx->skb can be dereferenced 7. ... same program fails for unpriv (CAP_NET_ADMIN needed). Link: https://lore.kernel.org/bpf/20230419021152.sjq4gttphzzy6b5f@dhcp-172-26-102-232.dhcp.thefacebook.com/ Link: https://lore.kernel.org/bpf/[email protected]/ Signed-off-by: Florian Westphal <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]>
- Loading branch information