1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2020, Tessares SA. */
3 /* Copyright (c) 2022, SUSE. */
4
5 #include <linux/const.h>
6 #include <netinet/in.h>
7 #include <test_progs.h>
8 #include <unistd.h>
9 #include <errno.h>
10 #include "cgroup_helpers.h"
11 #include "network_helpers.h"
12 #include "mptcp_sock.skel.h"
13 #include "mptcpify.skel.h"
14 #include "mptcp_subflow.skel.h"
15 #include "mptcp_sockmap.skel.h"
16
17 #define NS_TEST "mptcp_ns"
18 #define ADDR_1 "10.0.1.1"
19 #define ADDR_2 "10.0.1.2"
20 #define PORT_1 10001
21
22 #ifndef IPPROTO_MPTCP
23 #define IPPROTO_MPTCP 262
24 #endif
25
26 #ifndef SOL_MPTCP
27 #define SOL_MPTCP 284
28 #endif
29 #ifndef MPTCP_INFO
30 #define MPTCP_INFO 1
31 #endif
32 #ifndef MPTCP_INFO_FLAG_FALLBACK
33 #define MPTCP_INFO_FLAG_FALLBACK _BITUL(0)
34 #endif
35 #ifndef MPTCP_INFO_FLAG_REMOTE_KEY_RECEIVED
36 #define MPTCP_INFO_FLAG_REMOTE_KEY_RECEIVED _BITUL(1)
37 #endif
38
39 #ifndef TCP_CA_NAME_MAX
40 #define TCP_CA_NAME_MAX 16
41 #endif
42
43 struct __mptcp_info {
44 __u8 mptcpi_subflows;
45 __u8 mptcpi_add_addr_signal;
46 __u8 mptcpi_add_addr_accepted;
47 __u8 mptcpi_subflows_max;
48 __u8 mptcpi_add_addr_signal_max;
49 __u8 mptcpi_add_addr_accepted_max;
50 __u32 mptcpi_flags;
51 __u32 mptcpi_token;
52 __u64 mptcpi_write_seq;
53 __u64 mptcpi_snd_una;
54 __u64 mptcpi_rcv_nxt;
55 __u8 mptcpi_local_addr_used;
56 __u8 mptcpi_local_addr_max;
57 __u8 mptcpi_csum_enabled;
58 __u32 mptcpi_retransmits;
59 __u64 mptcpi_bytes_retrans;
60 __u64 mptcpi_bytes_sent;
61 __u64 mptcpi_bytes_received;
62 __u64 mptcpi_bytes_acked;
63 };
64
65 struct mptcp_storage {
66 __u32 invoked;
67 __u32 is_mptcp;
68 struct sock *sk;
69 __u32 token;
70 struct sock *first;
71 char ca_name[TCP_CA_NAME_MAX];
72 };
73
start_mptcp_server(int family,const char * addr_str,__u16 port,int timeout_ms)74 static int start_mptcp_server(int family, const char *addr_str, __u16 port,
75 int timeout_ms)
76 {
77 struct network_helper_opts opts = {
78 .timeout_ms = timeout_ms,
79 .proto = IPPROTO_MPTCP,
80 };
81
82 return start_server_str(family, SOCK_STREAM, addr_str, port, &opts);
83 }
84
verify_tsk(int map_fd,int client_fd)85 static int verify_tsk(int map_fd, int client_fd)
86 {
87 int err, cfd = client_fd;
88 struct mptcp_storage val;
89
90 err = bpf_map_lookup_elem(map_fd, &cfd, &val);
91 if (!ASSERT_OK(err, "bpf_map_lookup_elem"))
92 return err;
93
94 if (!ASSERT_EQ(val.invoked, 1, "unexpected invoked count"))
95 err++;
96
97 if (!ASSERT_EQ(val.is_mptcp, 0, "unexpected is_mptcp"))
98 err++;
99
100 return err;
101 }
102
get_msk_ca_name(char ca_name[])103 static void get_msk_ca_name(char ca_name[])
104 {
105 size_t len;
106 int fd;
107
108 fd = open("/proc/sys/net/ipv4/tcp_congestion_control", O_RDONLY);
109 if (!ASSERT_GE(fd, 0, "failed to open tcp_congestion_control"))
110 return;
111
112 len = read(fd, ca_name, TCP_CA_NAME_MAX);
113 if (!ASSERT_GT(len, 0, "failed to read ca_name"))
114 goto err;
115
116 if (len > 0 && ca_name[len - 1] == '\n')
117 ca_name[len - 1] = '\0';
118
119 err:
120 close(fd);
121 }
122
verify_msk(int map_fd,int client_fd,__u32 token)123 static int verify_msk(int map_fd, int client_fd, __u32 token)
124 {
125 char ca_name[TCP_CA_NAME_MAX];
126 int err, cfd = client_fd;
127 struct mptcp_storage val;
128
129 if (!ASSERT_GT(token, 0, "invalid token"))
130 return -1;
131
132 get_msk_ca_name(ca_name);
133
134 err = bpf_map_lookup_elem(map_fd, &cfd, &val);
135 if (!ASSERT_OK(err, "bpf_map_lookup_elem"))
136 return err;
137
138 if (!ASSERT_EQ(val.invoked, 1, "unexpected invoked count"))
139 err++;
140
141 if (!ASSERT_EQ(val.is_mptcp, 1, "unexpected is_mptcp"))
142 err++;
143
144 if (!ASSERT_EQ(val.token, token, "unexpected token"))
145 err++;
146
147 if (!ASSERT_EQ(val.first, val.sk, "unexpected first"))
148 err++;
149
150 if (!ASSERT_STRNEQ(val.ca_name, ca_name, TCP_CA_NAME_MAX, "unexpected ca_name"))
151 err++;
152
153 return err;
154 }
155
run_test(int cgroup_fd,int server_fd,bool is_mptcp)156 static int run_test(int cgroup_fd, int server_fd, bool is_mptcp)
157 {
158 int client_fd, prog_fd, map_fd, err;
159 struct mptcp_sock *sock_skel;
160
161 sock_skel = mptcp_sock__open_and_load();
162 if (!ASSERT_OK_PTR(sock_skel, "skel_open_load"))
163 return libbpf_get_error(sock_skel);
164
165 err = mptcp_sock__attach(sock_skel);
166 if (!ASSERT_OK(err, "skel_attach"))
167 goto out;
168
169 prog_fd = bpf_program__fd(sock_skel->progs._sockops);
170 map_fd = bpf_map__fd(sock_skel->maps.socket_storage_map);
171 err = bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_SOCK_OPS, 0);
172 if (!ASSERT_OK(err, "bpf_prog_attach"))
173 goto out;
174
175 client_fd = connect_to_fd(server_fd, 0);
176 if (!ASSERT_GE(client_fd, 0, "connect to fd")) {
177 err = -EIO;
178 goto out;
179 }
180
181 err += is_mptcp ? verify_msk(map_fd, client_fd, sock_skel->bss->token) :
182 verify_tsk(map_fd, client_fd);
183
184 close(client_fd);
185
186 out:
187 mptcp_sock__destroy(sock_skel);
188 return err;
189 }
190
test_base(void)191 static void test_base(void)
192 {
193 struct netns_obj *netns = NULL;
194 int server_fd, cgroup_fd;
195
196 cgroup_fd = test__join_cgroup("/mptcp");
197 if (!ASSERT_GE(cgroup_fd, 0, "test__join_cgroup"))
198 return;
199
200 netns = netns_new(NS_TEST, true);
201 if (!ASSERT_OK_PTR(netns, "netns_new"))
202 goto fail;
203
204 /* without MPTCP */
205 server_fd = start_server(AF_INET, SOCK_STREAM, NULL, 0, 0);
206 if (!ASSERT_GE(server_fd, 0, "start_server"))
207 goto with_mptcp;
208
209 ASSERT_OK(run_test(cgroup_fd, server_fd, false), "run_test tcp");
210
211 close(server_fd);
212
213 with_mptcp:
214 /* with MPTCP */
215 server_fd = start_mptcp_server(AF_INET, NULL, 0, 0);
216 if (!ASSERT_GE(server_fd, 0, "start_mptcp_server"))
217 goto fail;
218
219 ASSERT_OK(run_test(cgroup_fd, server_fd, true), "run_test mptcp");
220
221 close(server_fd);
222
223 fail:
224 netns_free(netns);
225 close(cgroup_fd);
226 }
227
send_byte(int fd)228 static void send_byte(int fd)
229 {
230 char b = 0x55;
231
232 ASSERT_EQ(write(fd, &b, sizeof(b)), 1, "send single byte");
233 }
234
verify_mptcpify(int server_fd,int client_fd)235 static int verify_mptcpify(int server_fd, int client_fd)
236 {
237 struct __mptcp_info info;
238 socklen_t optlen;
239 int protocol;
240 int err = 0;
241
242 optlen = sizeof(protocol);
243 if (!ASSERT_OK(getsockopt(server_fd, SOL_SOCKET, SO_PROTOCOL, &protocol, &optlen),
244 "getsockopt(SOL_PROTOCOL)"))
245 return -1;
246
247 if (!ASSERT_EQ(protocol, IPPROTO_MPTCP, "protocol isn't MPTCP"))
248 err++;
249
250 optlen = sizeof(info);
251 if (!ASSERT_OK(getsockopt(client_fd, SOL_MPTCP, MPTCP_INFO, &info, &optlen),
252 "getsockopt(MPTCP_INFO)"))
253 return -1;
254
255 if (!ASSERT_GE(info.mptcpi_flags, 0, "unexpected mptcpi_flags"))
256 err++;
257 if (!ASSERT_FALSE(info.mptcpi_flags & MPTCP_INFO_FLAG_FALLBACK,
258 "MPTCP fallback"))
259 err++;
260 if (!ASSERT_TRUE(info.mptcpi_flags & MPTCP_INFO_FLAG_REMOTE_KEY_RECEIVED,
261 "no remote key received"))
262 err++;
263
264 return err;
265 }
266
run_mptcpify(int cgroup_fd,int type)267 static int run_mptcpify(int cgroup_fd, int type)
268 {
269 int server_fd, client_fd, err = 0;
270 struct mptcpify *mptcpify_skel;
271
272 mptcpify_skel = mptcpify__open_and_load();
273 if (!ASSERT_OK_PTR(mptcpify_skel, "skel_open_load"))
274 return libbpf_get_error(mptcpify_skel);
275
276 mptcpify_skel->bss->pid = getpid();
277
278 err = mptcpify__attach(mptcpify_skel);
279 if (!ASSERT_OK(err, "skel_attach"))
280 goto out;
281
282 /* without MPTCP */
283 server_fd = start_server(AF_INET, type, NULL, 0, 0);
284 if (!ASSERT_GE(server_fd, 0, "start_server")) {
285 err = -EIO;
286 goto out;
287 }
288
289 client_fd = connect_to_fd(server_fd, 0);
290 if (!ASSERT_GE(client_fd, 0, "connect to fd")) {
291 err = -EIO;
292 goto close_server;
293 }
294
295 send_byte(client_fd);
296
297 err = verify_mptcpify(server_fd, client_fd);
298
299 close(client_fd);
300 close_server:
301 close(server_fd);
302 out:
303 mptcpify__destroy(mptcpify_skel);
304 return err;
305 }
306
test_mptcpify(void)307 static void test_mptcpify(void)
308 {
309 struct netns_obj *netns = NULL;
310 int cgroup_fd;
311
312 cgroup_fd = test__join_cgroup("/mptcpify");
313 if (!ASSERT_GE(cgroup_fd, 0, "test__join_cgroup"))
314 return;
315
316 netns = netns_new(NS_TEST, true);
317 if (!ASSERT_OK_PTR(netns, "netns_new"))
318 goto fail;
319
320 ASSERT_OK(run_mptcpify(cgroup_fd, SOCK_STREAM), "run_mptcpify");
321 /* userspace sets flags such as SOCK_CLOEXEC together with the type;
322 * the BPF prog must still upgrade the socket to MPTCP. See
323 * update_socket_protocol() in net/socket.c, which runs before the
324 * type is masked with SOCK_TYPE_MASK.
325 */
326 ASSERT_OK(run_mptcpify(cgroup_fd, SOCK_STREAM | SOCK_CLOEXEC),
327 "run_mptcpify_cloexec");
328
329 fail:
330 netns_free(netns);
331 close(cgroup_fd);
332 }
333
endpoint_init(char * flags)334 static int endpoint_init(char *flags)
335 {
336 SYS(fail, "ip -net %s link add veth1 type veth peer name veth2", NS_TEST);
337 SYS(fail, "ip -net %s addr add %s/24 dev veth1", NS_TEST, ADDR_1);
338 SYS(fail, "ip -net %s link set dev veth1 up", NS_TEST);
339 SYS(fail, "ip -net %s addr add %s/24 dev veth2", NS_TEST, ADDR_2);
340 SYS(fail, "ip -net %s link set dev veth2 up", NS_TEST);
341 if (SYS_NOFAIL("ip -net %s mptcp endpoint add %s %s", NS_TEST, ADDR_2, flags)) {
342 printf("'ip mptcp' not supported, skip this test.\n");
343 test__skip();
344 goto fail;
345 }
346
347 return 0;
348 fail:
349 return -1;
350 }
351
wait_for_new_subflows(int fd)352 static void wait_for_new_subflows(int fd)
353 {
354 socklen_t len;
355 u8 subflows;
356 int err, i;
357
358 len = sizeof(subflows);
359 /* Wait max 5 sec for new subflows to be created */
360 for (i = 0; i < 50; i++) {
361 err = getsockopt(fd, SOL_MPTCP, MPTCP_INFO, &subflows, &len);
362 if (!err && subflows > 0)
363 break;
364
365 usleep(100000); /* 0.1s */
366 }
367 }
368
run_subflow(void)369 static void run_subflow(void)
370 {
371 int server_fd, client_fd, err;
372 char new[TCP_CA_NAME_MAX];
373 char cc[TCP_CA_NAME_MAX];
374 unsigned int mark;
375 socklen_t len;
376
377 server_fd = start_mptcp_server(AF_INET, ADDR_1, PORT_1, 0);
378 if (!ASSERT_OK_FD(server_fd, "start_mptcp_server"))
379 return;
380
381 client_fd = connect_to_fd(server_fd, 0);
382 if (!ASSERT_OK_FD(client_fd, "connect_to_fd"))
383 goto close_server;
384
385 send_byte(client_fd);
386 wait_for_new_subflows(client_fd);
387
388 len = sizeof(mark);
389 err = getsockopt(client_fd, SOL_SOCKET, SO_MARK, &mark, &len);
390 if (ASSERT_OK(err, "getsockopt(client_fd, SO_MARK)"))
391 ASSERT_EQ(mark, 0, "mark");
392
393 len = sizeof(new);
394 err = getsockopt(client_fd, SOL_TCP, TCP_CONGESTION, new, &len);
395 if (ASSERT_OK(err, "getsockopt(client_fd, TCP_CONGESTION)")) {
396 get_msk_ca_name(cc);
397 ASSERT_STREQ(new, cc, "cc");
398 }
399
400 close(client_fd);
401 close_server:
402 close(server_fd);
403 }
404
test_subflow(void)405 static void test_subflow(void)
406 {
407 struct mptcp_subflow *skel;
408 struct netns_obj *netns;
409 int cgroup_fd;
410
411 cgroup_fd = test__join_cgroup("/mptcp_subflow");
412 if (!ASSERT_OK_FD(cgroup_fd, "join_cgroup: mptcp_subflow"))
413 return;
414
415 skel = mptcp_subflow__open_and_load();
416 if (!ASSERT_OK_PTR(skel, "skel_open_load: mptcp_subflow"))
417 goto close_cgroup;
418
419 skel->bss->pid = getpid();
420
421 skel->links.mptcp_subflow =
422 bpf_program__attach_cgroup(skel->progs.mptcp_subflow, cgroup_fd);
423 if (!ASSERT_OK_PTR(skel->links.mptcp_subflow, "attach mptcp_subflow"))
424 goto skel_destroy;
425
426 skel->links._getsockopt_subflow =
427 bpf_program__attach_cgroup(skel->progs._getsockopt_subflow, cgroup_fd);
428 if (!ASSERT_OK_PTR(skel->links._getsockopt_subflow, "attach _getsockopt_subflow"))
429 goto skel_destroy;
430
431 netns = netns_new(NS_TEST, true);
432 if (!ASSERT_OK_PTR(netns, "netns_new: mptcp_subflow"))
433 goto skel_destroy;
434
435 if (endpoint_init("subflow") < 0)
436 goto close_netns;
437
438 run_subflow();
439
440 close_netns:
441 netns_free(netns);
442 skel_destroy:
443 mptcp_subflow__destroy(skel);
444 close_cgroup:
445 close(cgroup_fd);
446 }
447
448 /* Test sockmap on MPTCP server handling non-mp-capable clients. */
test_sockmap_with_mptcp_fallback(struct mptcp_sockmap * skel)449 static void test_sockmap_with_mptcp_fallback(struct mptcp_sockmap *skel)
450 {
451 int listen_fd = -1, client_fd1 = -1, client_fd2 = -1;
452 int server_fd1 = -1, server_fd2 = -1, sent, recvd;
453 char snd[9] = "123456789";
454 char rcv[10];
455
456 /* start server with MPTCP enabled */
457 listen_fd = start_mptcp_server(AF_INET, NULL, 0, 0);
458 if (!ASSERT_OK_FD(listen_fd, "sockmap-fb:start_mptcp_server"))
459 return;
460
461 skel->bss->trace_port = ntohs(get_socket_local_port(listen_fd));
462 skel->bss->sk_index = 0;
463 /* create client without MPTCP enabled */
464 client_fd1 = connect_to_fd_opts(listen_fd, NULL);
465 if (!ASSERT_OK_FD(client_fd1, "sockmap-fb:connect_to_fd"))
466 goto end;
467
468 server_fd1 = accept(listen_fd, NULL, 0);
469 skel->bss->sk_index = 1;
470 client_fd2 = connect_to_fd_opts(listen_fd, NULL);
471 if (!ASSERT_OK_FD(client_fd2, "sockmap-fb:connect_to_fd"))
472 goto end;
473
474 server_fd2 = accept(listen_fd, NULL, 0);
475 /* test normal redirect behavior: data sent by client_fd1 can be
476 * received by client_fd2
477 */
478 skel->bss->redirect_idx = 1;
479 sent = send(client_fd1, snd, sizeof(snd), 0);
480 if (!ASSERT_EQ(sent, sizeof(snd), "sockmap-fb:send(client_fd1)"))
481 goto end;
482
483 /* try to recv more bytes to avoid truncation check */
484 recvd = recv(client_fd2, rcv, sizeof(rcv), 0);
485 if (!ASSERT_EQ(recvd, sizeof(snd), "sockmap-fb:recv(client_fd2)"))
486 goto end;
487
488 end:
489 if (client_fd1 >= 0)
490 close(client_fd1);
491 if (client_fd2 >= 0)
492 close(client_fd2);
493 if (server_fd1 >= 0)
494 close(server_fd1);
495 if (server_fd2 >= 0)
496 close(server_fd2);
497 close(listen_fd);
498 }
499
500 /* Test sockmap rejection of MPTCP sockets - both server and client sides. */
test_sockmap_reject_mptcp(struct mptcp_sockmap * skel)501 static void test_sockmap_reject_mptcp(struct mptcp_sockmap *skel)
502 {
503 int listen_fd = -1, server_fd = -1, client_fd1 = -1;
504 int err, zero = 0;
505
506 /* start server with MPTCP enabled */
507 listen_fd = start_mptcp_server(AF_INET, NULL, 0, 0);
508 if (!ASSERT_OK_FD(listen_fd, "start_mptcp_server"))
509 return;
510
511 skel->bss->trace_port = ntohs(get_socket_local_port(listen_fd));
512 skel->bss->sk_index = 0;
513 /* create client with MPTCP enabled */
514 client_fd1 = connect_to_fd(listen_fd, 0);
515 if (!ASSERT_OK_FD(client_fd1, "connect_to_fd client_fd1"))
516 goto end;
517
518 /* bpf_sock_map_update() called from sockops should reject MPTCP sk */
519 if (!ASSERT_EQ(skel->bss->helper_ret, -EOPNOTSUPP, "should reject"))
520 goto end;
521
522 server_fd = accept(listen_fd, NULL, 0);
523 err = bpf_map_update_elem(bpf_map__fd(skel->maps.sock_map),
524 &zero, &server_fd, BPF_NOEXIST);
525 if (!ASSERT_EQ(err, -EOPNOTSUPP, "server should be disallowed"))
526 goto end;
527
528 /* MPTCP client should also be disallowed */
529 err = bpf_map_update_elem(bpf_map__fd(skel->maps.sock_map),
530 &zero, &client_fd1, BPF_NOEXIST);
531 if (!ASSERT_EQ(err, -EOPNOTSUPP, "client should be disallowed"))
532 goto end;
533 end:
534 if (client_fd1 >= 0)
535 close(client_fd1);
536 if (server_fd >= 0)
537 close(server_fd);
538 close(listen_fd);
539 }
540
test_mptcp_sockmap(void)541 static void test_mptcp_sockmap(void)
542 {
543 struct mptcp_sockmap *skel;
544 struct netns_obj *netns;
545 int cgroup_fd, err;
546
547 cgroup_fd = test__join_cgroup("/mptcp_sockmap");
548 if (!ASSERT_OK_FD(cgroup_fd, "join_cgroup: mptcp_sockmap"))
549 return;
550
551 skel = mptcp_sockmap__open_and_load();
552 if (!ASSERT_OK_PTR(skel, "skel_open_load: mptcp_sockmap"))
553 goto close_cgroup;
554
555 skel->links.mptcp_sockmap_inject =
556 bpf_program__attach_cgroup(skel->progs.mptcp_sockmap_inject, cgroup_fd);
557 if (!ASSERT_OK_PTR(skel->links.mptcp_sockmap_inject, "attach sockmap"))
558 goto skel_destroy;
559
560 err = bpf_prog_attach(bpf_program__fd(skel->progs.mptcp_sockmap_redirect),
561 bpf_map__fd(skel->maps.sock_map),
562 BPF_SK_SKB_STREAM_VERDICT, 0);
563 if (!ASSERT_OK(err, "bpf_prog_attach stream verdict"))
564 goto skel_destroy;
565
566 netns = netns_new(NS_TEST, true);
567 if (!ASSERT_OK_PTR(netns, "netns_new: mptcp_sockmap"))
568 goto skel_destroy;
569
570 if (endpoint_init("subflow") < 0)
571 goto close_netns;
572
573 test_sockmap_with_mptcp_fallback(skel);
574 test_sockmap_reject_mptcp(skel);
575
576 close_netns:
577 netns_free(netns);
578 skel_destroy:
579 mptcp_sockmap__destroy(skel);
580 close_cgroup:
581 close(cgroup_fd);
582 }
583
test_mptcp(void)584 void test_mptcp(void)
585 {
586 if (test__start_subtest("base"))
587 test_base();
588 if (test__start_subtest("mptcpify"))
589 test_mptcpify();
590 if (test__start_subtest("subflow"))
591 test_subflow();
592 if (test__start_subtest("sockmap"))
593 test_mptcp_sockmap();
594 }
595