1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4 */
5
6 #ifdef DEBUG
7
8 #include <linux/jiffies.h>
9
10 static const struct {
11 bool result;
12 unsigned int msec_to_sleep_before;
13 } expected_results[] __initconst = {
14 [0 ... PACKETS_BURSTABLE - 1] = { true, 0 },
15 [PACKETS_BURSTABLE] = { false, 0 },
16 [PACKETS_BURSTABLE + 1] = { true, MSEC_PER_SEC / PACKETS_PER_SECOND },
17 [PACKETS_BURSTABLE + 2] = { false, 0 },
18 [PACKETS_BURSTABLE + 3] = { true, (MSEC_PER_SEC / PACKETS_PER_SECOND) * 2 },
19 [PACKETS_BURSTABLE + 4] = { true, 0 },
20 [PACKETS_BURSTABLE + 5] = { false, 0 }
21 };
22
maximum_jiffies_at_index(int index)23 static __init unsigned int maximum_jiffies_at_index(int index)
24 {
25 unsigned int total_msecs = 2 * MSEC_PER_SEC / PACKETS_PER_SECOND / 3;
26 int i;
27
28 for (i = 0; i <= index; ++i)
29 total_msecs += expected_results[i].msec_to_sleep_before;
30 return msecs_to_jiffies(total_msecs);
31 }
32
timings_test(struct sk_buff * skb4,struct iphdr * hdr4,struct sk_buff * skb6,struct ipv6hdr * hdr6,int * test)33 static __init int timings_test(struct sk_buff *skb4, struct iphdr *hdr4,
34 struct sk_buff *skb6, struct ipv6hdr *hdr6,
35 int *test)
36 {
37 unsigned long loop_start_time;
38 int i;
39
40 wg_ratelimiter_gc_entries(NULL);
41 rcu_barrier();
42 loop_start_time = jiffies;
43
44 for (i = 0; i < ARRAY_SIZE(expected_results); ++i) {
45 if (expected_results[i].msec_to_sleep_before)
46 msleep(expected_results[i].msec_to_sleep_before);
47
48 if (time_is_before_jiffies(loop_start_time +
49 maximum_jiffies_at_index(i)))
50 return -ETIMEDOUT;
51 if (wg_ratelimiter_allow(skb4, &init_net) !=
52 expected_results[i].result)
53 return -EXFULL;
54 ++(*test);
55
56 hdr4->saddr = htonl(ntohl(hdr4->saddr) + i + 1);
57 if (time_is_before_jiffies(loop_start_time +
58 maximum_jiffies_at_index(i)))
59 return -ETIMEDOUT;
60 if (!wg_ratelimiter_allow(skb4, &init_net))
61 return -EXFULL;
62 ++(*test);
63
64 hdr4->saddr = htonl(ntohl(hdr4->saddr) - i - 1);
65
66 #if IS_ENABLED(CONFIG_IPV6)
67 hdr6->saddr.in6_u.u6_addr32[2] = htonl(i);
68 hdr6->saddr.in6_u.u6_addr32[3] = htonl(i);
69 if (time_is_before_jiffies(loop_start_time +
70 maximum_jiffies_at_index(i)))
71 return -ETIMEDOUT;
72 if (wg_ratelimiter_allow(skb6, &init_net) !=
73 expected_results[i].result)
74 return -EXFULL;
75 ++(*test);
76
77 hdr6->saddr.in6_u.u6_addr32[0] =
78 htonl(ntohl(hdr6->saddr.in6_u.u6_addr32[0]) + i + 1);
79 if (time_is_before_jiffies(loop_start_time +
80 maximum_jiffies_at_index(i)))
81 return -ETIMEDOUT;
82 if (!wg_ratelimiter_allow(skb6, &init_net))
83 return -EXFULL;
84 ++(*test);
85
86 hdr6->saddr.in6_u.u6_addr32[0] =
87 htonl(ntohl(hdr6->saddr.in6_u.u6_addr32[0]) - i - 1);
88
89 if (time_is_before_jiffies(loop_start_time +
90 maximum_jiffies_at_index(i)))
91 return -ETIMEDOUT;
92 #endif
93 }
94 return 0;
95 }
96
capacity_test(struct sk_buff * skb4,struct iphdr * hdr4,int * test)97 static __init int capacity_test(struct sk_buff *skb4, struct iphdr *hdr4,
98 int *test)
99 {
100 int i;
101
102 wg_ratelimiter_gc_entries(NULL);
103 rcu_barrier();
104
105 if (atomic_read(&total_entries))
106 return -EXFULL;
107 ++(*test);
108
109 for (i = 0; i <= max_entries; ++i) {
110 hdr4->saddr = htonl(i);
111 if (wg_ratelimiter_allow(skb4, &init_net) != (i != max_entries))
112 return -EXFULL;
113 ++(*test);
114 }
115 return 0;
116 }
117
wg_ratelimiter_selftest(void)118 bool __init wg_ratelimiter_selftest(void)
119 {
120 enum { TRIALS_BEFORE_GIVING_UP = 5000 };
121 bool success = false;
122 int test = 0, trials;
123 struct sk_buff *skb4, *skb6 = NULL;
124 struct iphdr *hdr4;
125 struct ipv6hdr *hdr6 = NULL;
126
127 if (IS_ENABLED(CONFIG_KASAN) || IS_ENABLED(CONFIG_UBSAN))
128 return true;
129
130 BUILD_BUG_ON(MSEC_PER_SEC % PACKETS_PER_SECOND != 0);
131
132 if (wg_ratelimiter_init())
133 goto out;
134 ++test;
135 if (wg_ratelimiter_init()) {
136 wg_ratelimiter_uninit();
137 goto out;
138 }
139 ++test;
140 if (wg_ratelimiter_init()) {
141 wg_ratelimiter_uninit();
142 wg_ratelimiter_uninit();
143 goto out;
144 }
145 ++test;
146
147 skb4 = alloc_skb(sizeof(struct iphdr), GFP_KERNEL);
148 if (unlikely(!skb4))
149 goto err_nofree;
150 skb4->protocol = htons(ETH_P_IP);
151 hdr4 = (struct iphdr *)skb_put(skb4, sizeof(*hdr4));
152 hdr4->saddr = htonl(8182);
153 skb_reset_network_header(skb4);
154 ++test;
155
156 #if IS_ENABLED(CONFIG_IPV6)
157 skb6 = alloc_skb(sizeof(struct ipv6hdr), GFP_KERNEL);
158 if (unlikely(!skb6)) {
159 kfree_skb(skb4);
160 goto err_nofree;
161 }
162 skb6->protocol = htons(ETH_P_IPV6);
163 hdr6 = (struct ipv6hdr *)skb_put(skb6, sizeof(*hdr6));
164 hdr6->saddr.in6_u.u6_addr32[0] = htonl(1212);
165 hdr6->saddr.in6_u.u6_addr32[1] = htonl(289188);
166 skb_reset_network_header(skb6);
167 ++test;
168 #endif
169
170 for (trials = TRIALS_BEFORE_GIVING_UP; IS_ENABLED(DEBUG_RATELIMITER_TIMINGS);) {
171 int test_count = 0, ret;
172
173 ret = timings_test(skb4, hdr4, skb6, hdr6, &test_count);
174 if (ret == -ETIMEDOUT) {
175 if (!trials--) {
176 test += test_count;
177 goto err;
178 }
179 continue;
180 } else if (ret < 0) {
181 test += test_count;
182 goto err;
183 } else {
184 test += test_count;
185 break;
186 }
187 }
188
189 for (trials = TRIALS_BEFORE_GIVING_UP;;) {
190 int test_count = 0;
191
192 if (capacity_test(skb4, hdr4, &test_count) < 0) {
193 if (!trials--) {
194 test += test_count;
195 goto err;
196 }
197 continue;
198 }
199 test += test_count;
200 break;
201 }
202
203 success = true;
204
205 err:
206 kfree_skb(skb4);
207 #if IS_ENABLED(CONFIG_IPV6)
208 kfree_skb(skb6);
209 #endif
210 err_nofree:
211 wg_ratelimiter_uninit();
212 wg_ratelimiter_uninit();
213 wg_ratelimiter_uninit();
214 /* Uninit one extra time to check underflow detection. */
215 wg_ratelimiter_uninit();
216 out:
217 if (success)
218 pr_info("ratelimiter self-tests: pass\n");
219 else
220 pr_err("ratelimiter self-test %d: FAIL\n", test);
221
222 return success;
223 }
224 #endif
225