tests/netd_test.cpp - platform/system/netd - Git at Google

 /*
  * Copyright (C) 2016 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
  */

 #include <arpa/inet.h>
 #include <errno.h>
 #include <linux/if_packet.h>
 #include <linux/if_tun.h>
 #include <net/if.h>
 #include <poll.h>
 #include <sched.h>
 #include <sys/capability.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <sys/types.h>

 #include <gtest/gtest.h>

 #include <android-base/unique_fd.h>

 #define LOG_TAG "NetdTest"
 #include "bpf/BpfMap.h"
 #include "netdbpf/bpf_shared.h"

 #include "OffloadUtils.h"

 namespace android {
 namespace net {

 using base::unique_fd;

 TEST(NetUtilsWrapperTest, TestFileCapabilities) {
     errno = 0;
     ASSERT_EQ(NULL, cap_get_file("/system/bin/netutils-wrapper-1.0"));
     ASSERT_EQ(ENODATA, errno);
 }

 TEST(NetdSELinuxTest, CheckProperMTULabels) {
     // Since we expect the egrep regexp to filter everything out,
     // we thus expect no matches and thus a return code of 1
     // NOLINTNEXTLINE(cert-env33-c)
     ASSERT_EQ(W_EXITCODE(1, 0), system("ls -Z /sys/class/net/*/mtu | egrep -q -v "
                                        "'^u:object_r:sysfs_net:s0 /sys/class/net/'"));
 }

 // Trivial thread function that simply immediately terminates successfully.
 static int thread(void*) {
     return 0;
 }

 typedef int (*thread_t)(void*);

 static void nsTest(int flags, bool success, thread_t newThread) {
     // We need a minimal stack, but not clear if it will grow up or down,
     // So allocate 2 pages and give a pointer to the middle.
     static char stack[PAGE_SIZE * 2];
     errno = 0;
     // VFORK: if thread is successfully created, then kernel will wait for it
     // to terminate before we resume -> hence static stack is safe to reuse.
     int tid = clone(newThread, &stack[PAGE_SIZE], flags | CLONE_VFORK, NULL);
     if (success) {
         ASSERT_EQ(errno, 0);
         ASSERT_GE(tid, 0);
     } else {
         ASSERT_EQ(errno, EINVAL);
         ASSERT_EQ(tid, -1);
     }
 }

 // Test kernel configuration option CONFIG_NAMESPACES=y
 TEST(NetdNamespaceTest, CheckMountNamespaceSupport) {
     nsTest(CLONE_NEWNS, true, thread);
 }

 // Test kernel configuration option CONFIG_UTS_NS=y
 TEST(NetdNamespaceTest, CheckUTSNamespaceSupport) {
     nsTest(CLONE_NEWUTS, true, thread);
 }

 // Test kernel configuration option CONFIG_NET_NS=y
 TEST(NetdNamespaceTest, CheckNetworkNamespaceSupport) {
     nsTest(CLONE_NEWNET, true, thread);
 }

 // Test kernel configuration option CONFIG_USER_NS=n
 TEST(NetdNamespaceTest, /*DISABLED_*/ CheckNoUserNamespaceSupport) {
     nsTest(CLONE_NEWUSER, false, thread);
 }

 // Test for all of the above
 TEST(NetdNamespaceTest, CheckFullNamespaceSupport) {
     nsTest(CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWNET, true, thread);
 }

 // Test for presence of kernel patch:
 //   ANDROID: net: bpf: permit redirect from ingress L3 to egress L2 devices at near max mtu
 // on 4.14+ kernels.
 TEST(NetdBpfTest, testBpfSkbChangeHeadAboveMTU) {
     SKIP_IF_EXTENDED_BPF_NOT_SUPPORTED;

     constexpr int mtu = 1500;

     errno = 0;

     // Amusingly can't use SIOC... on tun/tap fds.
     int rv = socket(AF_UNIX, SOCK_DGRAM | SOCK_NONBLOCK, 0);
     ASSERT_EQ(errno, 0);
     ASSERT_GE(rv, 3);
     unique_fd unixfd(rv);

     rv = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
     ASSERT_EQ(errno, 0);
     ASSERT_GE(rv, 3);
     unique_fd tun(rv);

     rv = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
     ASSERT_EQ(errno, 0);
     ASSERT_GE(rv, 3);
     unique_fd tap(rv);

     struct ifreq tun_ifr = {
             .ifr_flags = IFF_TUN | IFF_NO_PI,
             .ifr_name = "tun_bpftest",
     };

     struct ifreq tap_ifr = {
             .ifr_flags = IFF_TAP | IFF_NO_PI,
             .ifr_name = "tap_bpftest",
     };

     rv = ioctl(tun, TUNSETIFF, &tun_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     rv = ioctl(tap, TUNSETIFF, &tap_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     // prevents kernel from sending us spurious ipv6 packets
     rv = open("/proc/sys/net/ipv6/conf/tap_bpftest/disable_ipv6", O_WRONLY);
     ASSERT_EQ(errno, 0);
     ASSERT_GE(rv, 3);
     unique_fd f(rv);

     rv = write(f, "1\n", 2);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 2);

     rv = close(f.release());
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     int tunif = if_nametoindex(tun_ifr.ifr_name);
     ASSERT_GE(tunif, 2);

     int tapif = if_nametoindex(tap_ifr.ifr_name);
     ASSERT_GE(tapif, 2);

     tun_ifr.ifr_mtu = mtu;
     rv = ioctl(unixfd, SIOCSIFMTU, &tun_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     tap_ifr.ifr_mtu = mtu;
     rv = ioctl(unixfd, SIOCSIFMTU, &tap_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     rv = ioctl(unixfd, SIOCGIFFLAGS, &tun_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     rv = ioctl(unixfd, SIOCGIFFLAGS, &tap_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     tun_ifr.ifr_flags |= IFF_UP | IFF_RUNNING;

     tap_ifr.ifr_flags |= IFF_UP | IFF_RUNNING;

     rv = ioctl(unixfd, SIOCSIFFLAGS, &tun_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     rv = ioctl(unixfd, SIOCSIFFLAGS, &tap_ifr);
     ASSERT_EQ(errno, 0);
     ASSERT_EQ(rv, 0);

     rv = tcQdiscAddDevClsact(tunif);
     ASSERT_EQ(rv, 0);

     int bpfFd = getTetherIngressProgFd(/* ethernet */ false);
     ASSERT_EQ(errno, 0);
     ASSERT_GE(bpfFd, 3);

     rv = tcFilterAddDevIngressTether(tunif, bpfFd, /* ethernet*/ false);
     ASSERT_EQ(rv, 0);

     bpf::BpfMap<TetherIngressKey, TetherIngressValue> bpfIngressMap;
     bpf::BpfMap<uint32_t, TetherStatsValue> bpfStatsMap;
     bpf::BpfMap<uint32_t, uint64_t> bpfLimitMap;

     rv = getTetherIngressMapFd();
     ASSERT_GE(rv, 3);
     bpfIngressMap.reset(rv);

     rv = getTetherStatsMapFd();
     ASSERT_GE(rv, 3);
     bpfStatsMap.reset(rv);

     rv = getTetherLimitMapFd();
     ASSERT_GE(rv, 3);
     bpfLimitMap.reset(rv);

     TetherIngressKey key = {
             .iif = static_cast<uint32_t>(tunif),
             //.neigh6 = ,
     };

     ethhdr hdr = {
             .h_proto = htons(ETH_P_IPV6),
     };

     TetherIngressValue value = {
             .oif = static_cast<uint32_t>(tapif),
             .macHeader = hdr,
             .pmtu = mtu,
     };

 #define ASSERT_OK(status) ASSERT_TRUE((status).ok())

     ASSERT_OK(bpfIngressMap.writeValue(key, value, BPF_ANY));

     uint32_t k = tunif;
     TetherStatsValue stats = {};
     ASSERT_OK(bpfStatsMap.writeValue(k, stats, BPF_NOEXIST));

     uint64_t limit = ~0uLL;
     ASSERT_OK(bpfLimitMap.writeValue(k, limit, BPF_NOEXIST));

     // minimal 'acceptable' 40-byte hoplimit 255 IPv6 packet, src ip 2000::
     uint8_t pkt[mtu] = {
             0x60, 0, 0, 0, 0, 40, 0, 255, 0x20,
     };

     // Iterate over all packet sizes from minimal ipv6 packet to mtu.
     // Tethering ebpf program should forward the packet from tun to tap interface.
     // TUN is L3, TAP is L2, so it will add a 14 byte ethernet header.
     for (int pkt_size = 40; pkt_size <= mtu; ++pkt_size) {
         rv = write(tun, pkt, pkt_size);
         ASSERT_EQ(errno, 0);
         ASSERT_EQ(rv, pkt_size);

         struct pollfd p = {
                 .fd = tap,
                 .events = POLLIN,
         };

         rv = poll(&p, 1, 1000 /*milliseconds*/);
         if (rv == 0) {
             // we hit a timeout at this packet size, log it
             EXPECT_EQ(pkt_size, -1);
             // this particular packet size is where it fails without the oneline kernel fix
             if (pkt_size + ETH_HLEN == mtu + 1) EXPECT_EQ("detected missing kernel patch", "");
             break;
         }
         EXPECT_EQ(errno, 0);
         EXPECT_EQ(rv, 1);
         EXPECT_EQ(p.revents, POLLIN);

         // use a buffer 1 byte larger then what we expect so we don't simply get truncated down
         uint8_t buf[ETH_HLEN + mtu + 1];
         rv = read(tap, buf, sizeof(buf));
         EXPECT_EQ(errno, 0);
         EXPECT_EQ(rv, ETH_HLEN + pkt_size);
         errno = 0;
         if (rv < 0) break;
     }

     ASSERT_OK(bpfIngressMap.deleteValue(key));
     ASSERT_OK(bpfStatsMap.deleteValue(k));
     ASSERT_OK(bpfLimitMap.deleteValue(k));
 }

 }  // namespace net
 }  // namespace android
	/*
	* Copyright (C) 2016 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*
	*/

	#include <arpa/inet.h>
	#include <errno.h>
	#include <linux/if_packet.h>
	#include <linux/if_tun.h>
	#include <net/if.h>
	#include <poll.h>
	#include <sched.h>
	#include <sys/capability.h>
	#include <sys/ioctl.h>
	#include <sys/socket.h>
	#include <sys/types.h>

	#include <gtest/gtest.h>

	#include <android-base/unique_fd.h>

	#define LOG_TAG "NetdTest"
	#include "bpf/BpfMap.h"
	#include "netdbpf/bpf_shared.h"

	#include "OffloadUtils.h"

	namespace android {
	namespace net {

	using base::unique_fd;

	TEST(NetUtilsWrapperTest, TestFileCapabilities) {
	errno = 0;
	ASSERT_EQ(NULL, cap_get_file("/system/bin/netutils-wrapper-1.0"));
	ASSERT_EQ(ENODATA, errno);
	}

	TEST(NetdSELinuxTest, CheckProperMTULabels) {
	// Since we expect the egrep regexp to filter everything out,
	// we thus expect no matches and thus a return code of 1
	// NOLINTNEXTLINE(cert-env33-c)
	ASSERT_EQ(W_EXITCODE(1, 0), system("ls -Z /sys/class/net/*/mtu \| egrep -q -v "
	"'^u:object_r:sysfs_net:s0 /sys/class/net/'"));
	}

	// Trivial thread function that simply immediately terminates successfully.
	static int thread(void*) {
	return 0;
	}

	typedef int (thread_t)(void);

	static void nsTest(int flags, bool success, thread_t newThread) {
	// We need a minimal stack, but not clear if it will grow up or down,
	// So allocate 2 pages and give a pointer to the middle.
	static char stack[PAGE_SIZE * 2];
	errno = 0;
	// VFORK: if thread is successfully created, then kernel will wait for it
	// to terminate before we resume -> hence static stack is safe to reuse.
	int tid = clone(newThread, &stack[PAGE_SIZE], flags \| CLONE_VFORK, NULL);
	if (success) {
	ASSERT_EQ(errno, 0);
	ASSERT_GE(tid, 0);
	} else {
	ASSERT_EQ(errno, EINVAL);
	ASSERT_EQ(tid, -1);
	}
	}

	// Test kernel configuration option CONFIG_NAMESPACES=y
	TEST(NetdNamespaceTest, CheckMountNamespaceSupport) {
	nsTest(CLONE_NEWNS, true, thread);
	}

	// Test kernel configuration option CONFIG_UTS_NS=y
	TEST(NetdNamespaceTest, CheckUTSNamespaceSupport) {
	nsTest(CLONE_NEWUTS, true, thread);
	}

	// Test kernel configuration option CONFIG_NET_NS=y
	TEST(NetdNamespaceTest, CheckNetworkNamespaceSupport) {
	nsTest(CLONE_NEWNET, true, thread);
	}

	// Test kernel configuration option CONFIG_USER_NS=n
	TEST(NetdNamespaceTest, /DISABLED_/ CheckNoUserNamespaceSupport) {
	nsTest(CLONE_NEWUSER, false, thread);
	}

	// Test for all of the above
	TEST(NetdNamespaceTest, CheckFullNamespaceSupport) {
	nsTest(CLONE_NEWNS \| CLONE_NEWUTS \| CLONE_NEWNET, true, thread);
	}

	// Test for presence of kernel patch:
	// ANDROID: net: bpf: permit redirect from ingress L3 to egress L2 devices at near max mtu
	// on 4.14+ kernels.
	TEST(NetdBpfTest, testBpfSkbChangeHeadAboveMTU) {
	SKIP_IF_EXTENDED_BPF_NOT_SUPPORTED;

	constexpr int mtu = 1500;

	errno = 0;

	// Amusingly can't use SIOC... on tun/tap fds.
	int rv = socket(AF_UNIX, SOCK_DGRAM \| SOCK_NONBLOCK, 0);
	ASSERT_EQ(errno, 0);
	ASSERT_GE(rv, 3);
	unique_fd unixfd(rv);

	rv = open("/dev/net/tun", O_RDWR \| O_NONBLOCK);
	ASSERT_EQ(errno, 0);
	ASSERT_GE(rv, 3);
	unique_fd tun(rv);

	rv = open("/dev/net/tun", O_RDWR \| O_NONBLOCK);
	ASSERT_EQ(errno, 0);
	ASSERT_GE(rv, 3);
	unique_fd tap(rv);

	struct ifreq tun_ifr = {
	.ifr_flags = IFF_TUN \| IFF_NO_PI,
	.ifr_name = "tun_bpftest",
	};

	struct ifreq tap_ifr = {
	.ifr_flags = IFF_TAP \| IFF_NO_PI,
	.ifr_name = "tap_bpftest",
	};

	rv = ioctl(tun, TUNSETIFF, &tun_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	rv = ioctl(tap, TUNSETIFF, &tap_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	// prevents kernel from sending us spurious ipv6 packets
	rv = open("/proc/sys/net/ipv6/conf/tap_bpftest/disable_ipv6", O_WRONLY);
	ASSERT_EQ(errno, 0);
	ASSERT_GE(rv, 3);
	unique_fd f(rv);

	rv = write(f, "1\n", 2);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 2);

	rv = close(f.release());
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	int tunif = if_nametoindex(tun_ifr.ifr_name);
	ASSERT_GE(tunif, 2);

	int tapif = if_nametoindex(tap_ifr.ifr_name);
	ASSERT_GE(tapif, 2);

	tun_ifr.ifr_mtu = mtu;
	rv = ioctl(unixfd, SIOCSIFMTU, &tun_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	tap_ifr.ifr_mtu = mtu;
	rv = ioctl(unixfd, SIOCSIFMTU, &tap_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	rv = ioctl(unixfd, SIOCGIFFLAGS, &tun_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	rv = ioctl(unixfd, SIOCGIFFLAGS, &tap_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	tun_ifr.ifr_flags \|= IFF_UP \| IFF_RUNNING;

	tap_ifr.ifr_flags \|= IFF_UP \| IFF_RUNNING;

	rv = ioctl(unixfd, SIOCSIFFLAGS, &tun_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	rv = ioctl(unixfd, SIOCSIFFLAGS, &tap_ifr);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, 0);

	rv = tcQdiscAddDevClsact(tunif);
	ASSERT_EQ(rv, 0);

	int bpfFd = getTetherIngressProgFd(/* ethernet */ false);
	ASSERT_EQ(errno, 0);
	ASSERT_GE(bpfFd, 3);

	rv = tcFilterAddDevIngressTether(tunif, bpfFd, /* ethernet*/ false);
	ASSERT_EQ(rv, 0);

	bpf::BpfMap<TetherIngressKey, TetherIngressValue> bpfIngressMap;
	bpf::BpfMap<uint32_t, TetherStatsValue> bpfStatsMap;
	bpf::BpfMap<uint32_t, uint64_t> bpfLimitMap;

	rv = getTetherIngressMapFd();
	ASSERT_GE(rv, 3);
	bpfIngressMap.reset(rv);

	rv = getTetherStatsMapFd();
	ASSERT_GE(rv, 3);
	bpfStatsMap.reset(rv);

	rv = getTetherLimitMapFd();
	ASSERT_GE(rv, 3);
	bpfLimitMap.reset(rv);

	TetherIngressKey key = {
	.iif = static_cast<uint32_t>(tunif),
	//.neigh6 = ,
	};

	ethhdr hdr = {
	.h_proto = htons(ETH_P_IPV6),
	};

	TetherIngressValue value = {
	.oif = static_cast<uint32_t>(tapif),
	.macHeader = hdr,
	.pmtu = mtu,
	};

	#define ASSERT_OK(status) ASSERT_TRUE((status).ok())

	ASSERT_OK(bpfIngressMap.writeValue(key, value, BPF_ANY));

	uint32_t k = tunif;
	TetherStatsValue stats = {};
	ASSERT_OK(bpfStatsMap.writeValue(k, stats, BPF_NOEXIST));

	uint64_t limit = ~0uLL;
	ASSERT_OK(bpfLimitMap.writeValue(k, limit, BPF_NOEXIST));

	// minimal 'acceptable' 40-byte hoplimit 255 IPv6 packet, src ip 2000::
	uint8_t pkt[mtu] = {
	0x60, 0, 0, 0, 0, 40, 0, 255, 0x20,
	};

	// Iterate over all packet sizes from minimal ipv6 packet to mtu.
	// Tethering ebpf program should forward the packet from tun to tap interface.
	// TUN is L3, TAP is L2, so it will add a 14 byte ethernet header.
	for (int pkt_size = 40; pkt_size <= mtu; ++pkt_size) {
	rv = write(tun, pkt, pkt_size);
	ASSERT_EQ(errno, 0);
	ASSERT_EQ(rv, pkt_size);

	struct pollfd p = {
	.fd = tap,
	.events = POLLIN,
	};

	rv = poll(&p, 1, 1000 /milliseconds/);
	if (rv == 0) {
	// we hit a timeout at this packet size, log it
	EXPECT_EQ(pkt_size, -1);
	// this particular packet size is where it fails without the oneline kernel fix
	if (pkt_size + ETH_HLEN == mtu + 1) EXPECT_EQ("detected missing kernel patch", "");
	break;
	}
	EXPECT_EQ(errno, 0);
	EXPECT_EQ(rv, 1);
	EXPECT_EQ(p.revents, POLLIN);

	// use a buffer 1 byte larger then what we expect so we don't simply get truncated down
	uint8_t buf[ETH_HLEN + mtu + 1];
	rv = read(tap, buf, sizeof(buf));
	EXPECT_EQ(errno, 0);
	EXPECT_EQ(rv, ETH_HLEN + pkt_size);
	errno = 0;
	if (rv < 0) break;
	}

	ASSERT_OK(bpfIngressMap.deleteValue(key));
	ASSERT_OK(bpfStatsMap.deleteValue(k));
	ASSERT_OK(bpfLimitMap.deleteValue(k));
	}

	} // namespace net
	} // namespace android