1 /*
2 * Copyright 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * bpf_existence_test.cpp - checks that the device has expected BPF programs and maps
17 */
18
19 #include <cstdint>
20 #include <set>
21 #include <string>
22
23 #include <android-modules-utils/sdk_level.h>
24 #include <bpf/BpfUtils.h>
25
26 #include <gtest/gtest.h>
27
28 using std::find;
29 using std::set;
30 using std::string;
31
32 using android::bpf::isAtLeastKernelVersion;
33 using android::modules::sdklevel::IsAtLeastR;
34 using android::modules::sdklevel::IsAtLeastS;
35 using android::modules::sdklevel::IsAtLeastT;
36
37 #define PLATFORM "/sys/fs/bpf/"
38 #define TETHERING "/sys/fs/bpf/tethering/"
39 #define PRIVATE "/sys/fs/bpf/net_private/"
40 #define SHARED "/sys/fs/bpf/net_shared/"
41 #define NETD "/sys/fs/bpf/netd_shared/"
42
43 class BpfExistenceTest : public ::testing::Test {
44 };
45
46 // Part of Android R platform (for 4.9+), but mainlined in S
47 static const set<string> PLATFORM_ONLY_IN_R = {
48 PLATFORM "map_offload_tether_ingress_map",
49 PLATFORM "map_offload_tether_limit_map",
50 PLATFORM "map_offload_tether_stats_map",
51 PLATFORM "prog_offload_schedcls_ingress_tether_ether",
52 PLATFORM "prog_offload_schedcls_ingress_tether_rawip",
53 };
54
55 // Provided by *current* mainline module for S+ devices
56 static const set<string> MAINLINE_FOR_S_PLUS = {
57 TETHERING "map_offload_tether_dev_map",
58 TETHERING "map_offload_tether_downstream4_map",
59 TETHERING "map_offload_tether_downstream64_map",
60 TETHERING "map_offload_tether_downstream6_map",
61 TETHERING "map_offload_tether_error_map",
62 TETHERING "map_offload_tether_limit_map",
63 TETHERING "map_offload_tether_stats_map",
64 TETHERING "map_offload_tether_upstream4_map",
65 TETHERING "map_offload_tether_upstream6_map",
66 TETHERING "map_test_bitmap",
67 TETHERING "map_test_tether_downstream6_map",
68 TETHERING "prog_offload_schedcls_tether_downstream4_ether",
69 TETHERING "prog_offload_schedcls_tether_downstream4_rawip",
70 TETHERING "prog_offload_schedcls_tether_downstream6_ether",
71 TETHERING "prog_offload_schedcls_tether_downstream6_rawip",
72 TETHERING "prog_offload_schedcls_tether_upstream4_ether",
73 TETHERING "prog_offload_schedcls_tether_upstream4_rawip",
74 TETHERING "prog_offload_schedcls_tether_upstream6_ether",
75 TETHERING "prog_offload_schedcls_tether_upstream6_rawip",
76 };
77
78 // Provided by *current* mainline module for S+ devices with 5.10+ kernels
79 static const set<string> MAINLINE_FOR_S_5_10_PLUS = {
80 TETHERING "prog_test_xdp_drop_ipv4_udp_ether",
81 };
82
83 // Provided by *current* mainline module for T+ devices
84 static const set<string> MAINLINE_FOR_T_PLUS = {
85 SHARED "map_block_blocked_ports_map",
86 SHARED "map_clatd_clat_egress4_map",
87 SHARED "map_clatd_clat_ingress6_map",
88 SHARED "map_dscpPolicy_ipv4_dscp_policies_map",
89 SHARED "map_dscpPolicy_ipv6_dscp_policies_map",
90 SHARED "map_dscpPolicy_socket_policy_cache_map",
91 NETD "map_netd_app_uid_stats_map",
92 NETD "map_netd_configuration_map",
93 NETD "map_netd_cookie_tag_map",
94 NETD "map_netd_iface_index_name_map",
95 NETD "map_netd_iface_stats_map",
96 NETD "map_netd_stats_map_A",
97 NETD "map_netd_stats_map_B",
98 NETD "map_netd_uid_counterset_map",
99 NETD "map_netd_uid_owner_map",
100 NETD "map_netd_uid_permission_map",
101 SHARED "prog_clatd_schedcls_egress4_clat_rawip",
102 SHARED "prog_clatd_schedcls_ingress6_clat_ether",
103 SHARED "prog_clatd_schedcls_ingress6_clat_rawip",
104 NETD "prog_netd_cgroupskb_egress_stats",
105 NETD "prog_netd_cgroupskb_ingress_stats",
106 NETD "prog_netd_schedact_ingress_account",
107 NETD "prog_netd_skfilter_allowlist_xtbpf",
108 NETD "prog_netd_skfilter_denylist_xtbpf",
109 NETD "prog_netd_skfilter_egress_xtbpf",
110 NETD "prog_netd_skfilter_ingress_xtbpf",
111 };
112
113 // Provided by *current* mainline module for T+ devices with 4.14+ kernels
114 static const set<string> MAINLINE_FOR_T_4_14_PLUS = {
115 NETD "prog_netd_cgroupsock_inet_create",
116 };
117
118 // Provided by *current* mainline module for T+ devices with 5.4+ kernels
119 static const set<string> MAINLINE_FOR_T_5_4_PLUS = {
120 SHARED "prog_block_bind4_block_port",
121 SHARED "prog_block_bind6_block_port",
122 };
123
124 // Provided by *current* mainline module for T+ devices with 5.15+ kernels
125 static const set<string> MAINLINE_FOR_T_5_15_PLUS = {
126 SHARED "prog_dscpPolicy_schedcls_set_dscp_ether",
127 };
128
addAll(set<string> & a,const set<string> & b)129 static void addAll(set<string>& a, const set<string>& b) {
130 a.insert(b.begin(), b.end());
131 }
132
133 #define DO_EXPECT(B, V) addAll((B) ? mustExist : mustNotExist, (V))
134
TEST_F(BpfExistenceTest,TestPrograms)135 TEST_F(BpfExistenceTest, TestPrograms) {
136 // Only unconfined root is guaranteed to be able to access everything in /sys/fs/bpf.
137 ASSERT_EQ(0, getuid()) << "This test must run as root.";
138
139 set<string> mustExist;
140 set<string> mustNotExist;
141
142 // We do not actually check the platform P/Q (netd) and Q (clatd) things
143 // and only verify the mainline module relevant R+ offload maps & progs.
144 //
145 // The goal of this test is to verify compatibility with the tethering mainline module,
146 // and not to test the platform itself, which may have been modified by vendor or oems,
147 // so we should only test for the removal of stuff that was mainline'd,
148 // and for the presence of mainline stuff.
149
150 // R can potentially run on pre-4.9 kernel non-eBPF capable devices.
151 DO_EXPECT(IsAtLeastR() && !IsAtLeastS() && isAtLeastKernelVersion(4, 9, 0), PLATFORM_ONLY_IN_R);
152
153 // S requires Linux Kernel 4.9+ and thus requires eBPF support.
154 DO_EXPECT(IsAtLeastS(), MAINLINE_FOR_S_PLUS);
155 DO_EXPECT(IsAtLeastS() && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_S_5_10_PLUS);
156
157 // Nothing added or removed in SCv2.
158
159 // T still only requires Linux Kernel 4.9+.
160 DO_EXPECT(IsAtLeastT(), MAINLINE_FOR_T_PLUS);
161 DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(4, 14, 0), MAINLINE_FOR_T_4_14_PLUS);
162 DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(5, 4, 0), MAINLINE_FOR_T_5_4_PLUS);
163 DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(5, 15, 0), MAINLINE_FOR_T_5_15_PLUS);
164
165 // U requires Linux Kernel 4.14+, but nothing (as yet) added or removed in U.
166
167 for (const auto& file : mustExist) {
168 EXPECT_EQ(0, access(file.c_str(), R_OK)) << file << " does not exist";
169 }
170 for (const auto& file : mustNotExist) {
171 int ret = access(file.c_str(), R_OK);
172 int err = errno;
173 EXPECT_EQ(-1, ret) << file << " unexpectedly exists";
174 if (ret == -1) {
175 EXPECT_EQ(ENOENT, err) << " accessing " << file << " failed with errno " << err;
176 }
177 }
178 }
179