1 /*
2 * Copyright 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * bpf_existence_test.cpp - checks that the device has expected BPF programs and maps
17 */
18
19 #include <cstdint>
20 #include <set>
21 #include <string>
22
23 #include <android-base/properties.h>
24 #include <android/api-level.h>
25 #include <bpf/BpfUtils.h>
26
27 #include <gtest/gtest.h>
28
29 using std::find;
30 using std::set;
31 using std::string;
32
33 using android::bpf::isAtLeastKernelVersion;
34 using android::bpf::isAtLeastR;
35 using android::bpf::isAtLeastS;
36 using android::bpf::isAtLeastT;
37 using android::bpf::isAtLeastU;
38 using android::bpf::isAtLeastV;
39 using android::bpf::isAtLeast25Q2;
40
41 #define PLATFORM "/sys/fs/bpf/"
42 #define TETHERING "/sys/fs/bpf/tethering/"
43 #define PRIVATE "/sys/fs/bpf/net_private/"
44 #define SHARED "/sys/fs/bpf/net_shared/"
45 #define NETD_RO "/sys/fs/bpf/netd_readonly/"
46 #define NETD "/sys/fs/bpf/netd_shared/"
47
48 class BpfExistenceTest : public ::testing::Test {
49 };
50
51 // Part of Android R platform (for 4.9+), but mainlined in S
52 static const set<string> PLATFORM_ONLY_IN_R = {
53 PLATFORM "map_offload_tether_ingress_map",
54 PLATFORM "map_offload_tether_limit_map",
55 PLATFORM "map_offload_tether_stats_map",
56 PLATFORM "prog_offload_schedcls_ingress_tether_ether",
57 PLATFORM "prog_offload_schedcls_ingress_tether_rawip",
58 };
59
60 // Provided by *current* mainline module for S+ devices
61 static const set<string> MAINLINE_FOR_S_PLUS = {
62 TETHERING "map_offload_tether_dev_map",
63 TETHERING "map_offload_tether_downstream4_map",
64 TETHERING "map_offload_tether_downstream64_map",
65 TETHERING "map_offload_tether_downstream6_map",
66 TETHERING "map_offload_tether_error_map",
67 TETHERING "map_offload_tether_limit_map",
68 TETHERING "map_offload_tether_stats_map",
69 TETHERING "map_offload_tether_upstream4_map",
70 TETHERING "map_offload_tether_upstream6_map",
71 TETHERING "map_test_bitmap",
72 TETHERING "map_test_tether_downstream6_map",
73 TETHERING "map_test_tether2_downstream6_map",
74 TETHERING "map_test_tether3_downstream6_map",
75 TETHERING "prog_offload_schedcls_tether_downstream4_ether",
76 TETHERING "prog_offload_schedcls_tether_downstream4_rawip",
77 TETHERING "prog_offload_schedcls_tether_downstream6_ether",
78 TETHERING "prog_offload_schedcls_tether_downstream6_rawip",
79 TETHERING "prog_offload_schedcls_tether_upstream4_ether",
80 TETHERING "prog_offload_schedcls_tether_upstream4_rawip",
81 TETHERING "prog_offload_schedcls_tether_upstream6_ether",
82 TETHERING "prog_offload_schedcls_tether_upstream6_rawip",
83 };
84
85 // Provided by *current* mainline module for T+ devices
86 static const set<string> MAINLINE_FOR_T_PLUS = {
87 SHARED "map_clatd_clat_egress4_map",
88 SHARED "map_clatd_clat_ingress6_map",
89 SHARED "map_dscpPolicy_ipv4_dscp_policies_map",
90 SHARED "map_dscpPolicy_ipv6_dscp_policies_map",
91 SHARED "map_dscpPolicy_socket_policy_cache_map",
92 NETD "map_netd_app_uid_stats_map",
93 NETD "map_netd_blocked_ports_map",
94 NETD "map_netd_configuration_map",
95 NETD "map_netd_cookie_tag_map",
96 NETD "map_netd_data_saver_enabled_map",
97 NETD "map_netd_iface_index_name_map",
98 NETD "map_netd_iface_stats_map",
99 NETD "map_netd_ingress_discard_map",
100 NETD "map_netd_stats_map_A",
101 NETD "map_netd_stats_map_B",
102 NETD "map_netd_uid_counterset_map",
103 NETD "map_netd_uid_owner_map",
104 NETD "map_netd_uid_permission_map",
105 SHARED "prog_clatd_schedcls_egress4_clat_rawip",
106 SHARED "prog_clatd_schedcls_ingress6_clat_ether",
107 SHARED "prog_clatd_schedcls_ingress6_clat_rawip",
108 NETD "prog_netd_cgroupskb_egress_stats",
109 NETD "prog_netd_cgroupskb_ingress_stats",
110 NETD "prog_netd_schedact_ingress_account",
111 NETD "prog_netd_skfilter_allowlist_xtbpf",
112 NETD "prog_netd_skfilter_denylist_xtbpf",
113 NETD "prog_netd_skfilter_egress_xtbpf",
114 NETD "prog_netd_skfilter_ingress_xtbpf",
115 };
116
117 // Provided by *current* mainline module for T+ devices with 4.14+ kernels
118 static const set<string> MAINLINE_FOR_T_4_14_PLUS = {
119 NETD "prog_netd_cgroupsock_inet_create",
120 };
121
122 // Provided by *current* mainline module for T+ devices with 5.4+ kernels
123 static const set<string> MAINLINE_FOR_T_4_19_PLUS = {
124 NETD "prog_netd_bind4_inet4_bind",
125 NETD "prog_netd_bind6_inet6_bind",
126 };
127
128 // Provided by *current* mainline module for T+ devices with 5.10+ kernels
129 static const set<string> MAINLINE_FOR_T_5_10_PLUS = {
130 NETD "prog_netd_cgroupsockrelease_inet_release",
131 };
132
133 // Provided by *current* mainline module for T+ devices with 5.15+ kernels
134 static const set<string> MAINLINE_FOR_T_5_15_PLUS = {
135 SHARED "prog_dscpPolicy_schedcls_set_dscp_ether",
136 };
137
138 // Provided by *current* mainline module for U+ devices
139 static const set<string> MAINLINE_FOR_U_PLUS = {
140 NETD "map_netd_packet_trace_enabled_map",
141 };
142
143 // Provided by *current* mainline module for U+ devices with 5.10+ kernels
144 static const set<string> MAINLINE_FOR_U_5_10_PLUS = {
145 NETD "map_netd_packet_trace_ringbuf",
146 };
147
148 // Provided by *current* mainline module for V+ devices
149 static const set<string> MAINLINE_FOR_V_PLUS = {
150 NETD "prog_netd_connect4_inet4_connect",
151 NETD "prog_netd_connect6_inet6_connect",
152 NETD "prog_netd_recvmsg4_udp4_recvmsg",
153 NETD "prog_netd_recvmsg6_udp6_recvmsg",
154 NETD "prog_netd_sendmsg4_udp4_sendmsg",
155 NETD "prog_netd_sendmsg6_udp6_sendmsg",
156 };
157
158 // Provided by *current* mainline module for V+ devices with 5.4+ kernels
159 static const set<string> MAINLINE_FOR_V_5_4_PLUS = {
160 NETD "prog_netd_getsockopt_prog",
161 NETD "prog_netd_setsockopt_prog",
162 };
163
164 // Provided by *current* mainline module for 25Q2+ devices
165 static const set<string> MAINLINE_FOR_25Q2_PLUS = {
166 NETD "map_netd_local_net_access_map",
167 NETD "map_netd_local_net_blocked_uid_map",
168 };
169
addAll(set<string> & a,const set<string> & b)170 static void addAll(set<string>& a, const set<string>& b) {
171 a.insert(b.begin(), b.end());
172 }
173
174 #define DO_EXPECT(B, V) addAll((B) ? mustExist : mustNotExist, (V))
175
TEST_F(BpfExistenceTest,TestPrograms)176 TEST_F(BpfExistenceTest, TestPrograms) {
177 // Only unconfined root is guaranteed to be able to access everything in /sys/fs/bpf.
178 ASSERT_EQ(0, getuid()) << "This test must run as root.";
179
180 set<string> mustExist;
181 set<string> mustNotExist;
182
183 // We do not actually check the platform P/Q (netd) and Q (clatd) things
184 // and only verify the mainline module relevant R+ offload maps & progs.
185 //
186 // The goal of this test is to verify compatibility with the tethering mainline module,
187 // and not to test the platform itself, which may have been modified by vendor or oems,
188 // so we should only test for the removal of stuff that was mainline'd,
189 // and for the presence of mainline stuff.
190
191 // Note: Q is no longer supported by mainline
192 ASSERT_TRUE(isAtLeastR);
193
194 // R can potentially run on pre-4.9 kernel non-eBPF capable devices.
195 DO_EXPECT(isAtLeastR && !isAtLeastS && isAtLeastKernelVersion(4, 9, 0), PLATFORM_ONLY_IN_R);
196
197 // S requires Linux Kernel 4.9+ and thus requires eBPF support.
198 if (isAtLeastS) ASSERT_TRUE(isAtLeastKernelVersion(4, 9, 0));
199
200 // on S without a new enough DnsResolver apex, NetBpfLoad doesn't get triggered,
201 // and thus no mainline programs get loaded.
202 bool mainlineBpfCapableResolve = !access("/apex/com.android.resolv/NetBpfLoad-S.flag", F_OK);
203 bool mainlineNetBpfLoad = isAtLeastT || mainlineBpfCapableResolve;
204 DO_EXPECT(isAtLeastS && mainlineNetBpfLoad, MAINLINE_FOR_S_PLUS);
205
206 // Nothing added or removed in SCv2.
207
208 // T still only requires Linux Kernel 4.9+.
209 DO_EXPECT(isAtLeastT, MAINLINE_FOR_T_PLUS);
210 DO_EXPECT(isAtLeastT && isAtLeastKernelVersion(4, 14, 0), MAINLINE_FOR_T_4_14_PLUS);
211 DO_EXPECT(isAtLeastT && isAtLeastKernelVersion(4, 19, 0), MAINLINE_FOR_T_4_19_PLUS);
212 DO_EXPECT(isAtLeastT && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_T_5_10_PLUS);
213 DO_EXPECT(isAtLeastT && isAtLeastKernelVersion(5, 15, 0), MAINLINE_FOR_T_5_15_PLUS);
214
215 // U requires Linux Kernel 4.14+, but nothing (as yet) added or removed in U.
216 if (isAtLeastU) ASSERT_TRUE(isAtLeastKernelVersion(4, 14, 0));
217 DO_EXPECT(isAtLeastU, MAINLINE_FOR_U_PLUS);
218 DO_EXPECT(isAtLeastU && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_U_5_10_PLUS);
219
220 // V requires Linux Kernel 4.19+, but nothing (as yet) added or removed in V.
221 if (isAtLeastV) ASSERT_TRUE(isAtLeastKernelVersion(4, 19, 0));
222 DO_EXPECT(isAtLeastV, MAINLINE_FOR_V_PLUS);
223 DO_EXPECT(isAtLeastV && isAtLeastKernelVersion(5, 4, 0), MAINLINE_FOR_V_5_4_PLUS);
224
225 if (isAtLeast25Q2) ASSERT_TRUE(isAtLeastKernelVersion(5, 4, 0));
226 DO_EXPECT(isAtLeast25Q2, MAINLINE_FOR_25Q2_PLUS);
227
228 for (const auto& file : mustExist) {
229 EXPECT_EQ(0, access(file.c_str(), R_OK)) << file << " does not exist";
230 }
231 for (const auto& file : mustNotExist) {
232 int ret = access(file.c_str(), R_OK);
233 int err = errno;
234 EXPECT_EQ(-1, ret) << file << " unexpectedly exists";
235 if (ret == -1) {
236 EXPECT_EQ(ENOENT, err) << " accessing " << file << " failed with errno " << err;
237 }
238 }
239 }
240