1 /*
2  * Copyright 2022 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  *
16  * bpf_existence_test.cpp - checks that the device has expected BPF programs and maps
17  */
18 
19 #include <cstdint>
20 #include <set>
21 #include <string>
22 
23 #include <android-modules-utils/sdk_level.h>
24 #include <bpf/BpfUtils.h>
25 
26 #include <gtest/gtest.h>
27 
28 using std::find;
29 using std::set;
30 using std::string;
31 
32 using android::bpf::isAtLeastKernelVersion;
33 using android::modules::sdklevel::IsAtLeastR;
34 using android::modules::sdklevel::IsAtLeastS;
35 using android::modules::sdklevel::IsAtLeastT;
36 using android::modules::sdklevel::IsAtLeastU;
37 using android::modules::sdklevel::IsAtLeastV;
38 
39 #define PLATFORM "/sys/fs/bpf/"
40 #define TETHERING "/sys/fs/bpf/tethering/"
41 #define PRIVATE "/sys/fs/bpf/net_private/"
42 #define SHARED "/sys/fs/bpf/net_shared/"
43 #define NETD_RO "/sys/fs/bpf/netd_readonly/"
44 #define NETD "/sys/fs/bpf/netd_shared/"
45 
46 class BpfExistenceTest : public ::testing::Test {
47 };
48 
49 // Part of Android R platform (for 4.9+), but mainlined in S
50 static const set<string> PLATFORM_ONLY_IN_R = {
51     PLATFORM "map_offload_tether_ingress_map",
52     PLATFORM "map_offload_tether_limit_map",
53     PLATFORM "map_offload_tether_stats_map",
54     PLATFORM "prog_offload_schedcls_ingress_tether_ether",
55     PLATFORM "prog_offload_schedcls_ingress_tether_rawip",
56 };
57 
58 // Provided by *current* mainline module for S+ devices
59 static const set<string> MAINLINE_FOR_S_PLUS = {
60     TETHERING "map_offload_tether_dev_map",
61     TETHERING "map_offload_tether_downstream4_map",
62     TETHERING "map_offload_tether_downstream64_map",
63     TETHERING "map_offload_tether_downstream6_map",
64     TETHERING "map_offload_tether_error_map",
65     TETHERING "map_offload_tether_limit_map",
66     TETHERING "map_offload_tether_stats_map",
67     TETHERING "map_offload_tether_upstream4_map",
68     TETHERING "map_offload_tether_upstream6_map",
69     TETHERING "map_test_bitmap",
70     TETHERING "map_test_tether_downstream6_map",
71     TETHERING "map_test_tether2_downstream6_map",
72     TETHERING "map_test_tether3_downstream6_map",
73     TETHERING "prog_offload_schedcls_tether_downstream4_ether",
74     TETHERING "prog_offload_schedcls_tether_downstream4_rawip",
75     TETHERING "prog_offload_schedcls_tether_downstream6_ether",
76     TETHERING "prog_offload_schedcls_tether_downstream6_rawip",
77     TETHERING "prog_offload_schedcls_tether_upstream4_ether",
78     TETHERING "prog_offload_schedcls_tether_upstream4_rawip",
79     TETHERING "prog_offload_schedcls_tether_upstream6_ether",
80     TETHERING "prog_offload_schedcls_tether_upstream6_rawip",
81 };
82 
83 // Provided by *current* mainline module for T+ devices
84 static const set<string> MAINLINE_FOR_T_PLUS = {
85     SHARED "map_clatd_clat_egress4_map",
86     SHARED "map_clatd_clat_ingress6_map",
87     SHARED "map_dscpPolicy_ipv4_dscp_policies_map",
88     SHARED "map_dscpPolicy_ipv6_dscp_policies_map",
89     SHARED "map_dscpPolicy_socket_policy_cache_map",
90     NETD "map_netd_app_uid_stats_map",
91     NETD "map_netd_blocked_ports_map",
92     NETD "map_netd_configuration_map",
93     NETD "map_netd_cookie_tag_map",
94     NETD "map_netd_data_saver_enabled_map",
95     NETD "map_netd_iface_index_name_map",
96     NETD "map_netd_iface_stats_map",
97     NETD "map_netd_ingress_discard_map",
98     NETD "map_netd_stats_map_A",
99     NETD "map_netd_stats_map_B",
100     NETD "map_netd_uid_counterset_map",
101     NETD "map_netd_uid_owner_map",
102     NETD "map_netd_uid_permission_map",
103     SHARED "prog_clatd_schedcls_egress4_clat_rawip",
104     SHARED "prog_clatd_schedcls_ingress6_clat_ether",
105     SHARED "prog_clatd_schedcls_ingress6_clat_rawip",
106     NETD "prog_netd_cgroupskb_egress_stats",
107     NETD "prog_netd_cgroupskb_ingress_stats",
108     NETD "prog_netd_schedact_ingress_account",
109     NETD "prog_netd_skfilter_allowlist_xtbpf",
110     NETD "prog_netd_skfilter_denylist_xtbpf",
111     NETD "prog_netd_skfilter_egress_xtbpf",
112     NETD "prog_netd_skfilter_ingress_xtbpf",
113 };
114 
115 // Provided by *current* mainline module for T+ devices with 4.14+ kernels
116 static const set<string> MAINLINE_FOR_T_4_14_PLUS = {
117     NETD "prog_netd_cgroupsock_inet_create",
118 };
119 
120 // Provided by *current* mainline module for T+ devices with 5.4+ kernels
121 static const set<string> MAINLINE_FOR_T_4_19_PLUS = {
122     NETD "prog_netd_bind4_inet4_bind",
123     NETD "prog_netd_bind6_inet6_bind",
124 };
125 
126 // Provided by *current* mainline module for T+ devices with 5.10+ kernels
127 static const set<string> MAINLINE_FOR_T_5_10_PLUS = {
128     NETD "prog_netd_cgroupsockrelease_inet_release",
129 };
130 
131 // Provided by *current* mainline module for T+ devices with 5.15+ kernels
132 static const set<string> MAINLINE_FOR_T_5_15_PLUS = {
133     SHARED "prog_dscpPolicy_schedcls_set_dscp_ether",
134 };
135 
136 // Provided by *current* mainline module for U+ devices
137 static const set<string> MAINLINE_FOR_U_PLUS = {
138     NETD "map_netd_packet_trace_enabled_map",
139 };
140 
141 // Provided by *current* mainline module for U+ devices with 5.10+ kernels
142 static const set<string> MAINLINE_FOR_U_5_10_PLUS = {
143     NETD "map_netd_packet_trace_ringbuf",
144 };
145 
146 // Provided by *current* mainline module for V+ devices
147 static const set<string> MAINLINE_FOR_V_PLUS = {
148     NETD "prog_netd_connect4_inet4_connect",
149     NETD "prog_netd_connect6_inet6_connect",
150     NETD "prog_netd_recvmsg4_udp4_recvmsg",
151     NETD "prog_netd_recvmsg6_udp6_recvmsg",
152     NETD "prog_netd_sendmsg4_udp4_sendmsg",
153     NETD "prog_netd_sendmsg6_udp6_sendmsg",
154 };
155 
156 // Provided by *current* mainline module for V+ devices with 5.4+ kernels
157 static const set<string> MAINLINE_FOR_V_5_4_PLUS = {
158     NETD "prog_netd_getsockopt_prog",
159     NETD "prog_netd_setsockopt_prog",
160 };
161 
addAll(set<string> & a,const set<string> & b)162 static void addAll(set<string>& a, const set<string>& b) {
163     a.insert(b.begin(), b.end());
164 }
165 
166 #define DO_EXPECT(B, V) addAll((B) ? mustExist : mustNotExist, (V))
167 
TEST_F(BpfExistenceTest,TestPrograms)168 TEST_F(BpfExistenceTest, TestPrograms) {
169     // Only unconfined root is guaranteed to be able to access everything in /sys/fs/bpf.
170     ASSERT_EQ(0, getuid()) << "This test must run as root.";
171 
172     set<string> mustExist;
173     set<string> mustNotExist;
174 
175     // We do not actually check the platform P/Q (netd) and Q (clatd) things
176     // and only verify the mainline module relevant R+ offload maps & progs.
177     //
178     // The goal of this test is to verify compatibility with the tethering mainline module,
179     // and not to test the platform itself, which may have been modified by vendor or oems,
180     // so we should only test for the removal of stuff that was mainline'd,
181     // and for the presence of mainline stuff.
182 
183     // Note: Q is no longer supported by mainline
184     ASSERT_TRUE(IsAtLeastR());
185 
186     // R can potentially run on pre-4.9 kernel non-eBPF capable devices.
187     DO_EXPECT(IsAtLeastR() && !IsAtLeastS() && isAtLeastKernelVersion(4, 9, 0), PLATFORM_ONLY_IN_R);
188 
189     // S requires Linux Kernel 4.9+ and thus requires eBPF support.
190     if (IsAtLeastS()) ASSERT_TRUE(isAtLeastKernelVersion(4, 9, 0));
191     DO_EXPECT(IsAtLeastS(), MAINLINE_FOR_S_PLUS);
192 
193     // Nothing added or removed in SCv2.
194 
195     // T still only requires Linux Kernel 4.9+.
196     DO_EXPECT(IsAtLeastT(), MAINLINE_FOR_T_PLUS);
197     DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(4, 14, 0), MAINLINE_FOR_T_4_14_PLUS);
198     DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(4, 19, 0), MAINLINE_FOR_T_4_19_PLUS);
199     DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_T_5_10_PLUS);
200     DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(5, 15, 0), MAINLINE_FOR_T_5_15_PLUS);
201 
202     // U requires Linux Kernel 4.14+, but nothing (as yet) added or removed in U.
203     if (IsAtLeastU()) ASSERT_TRUE(isAtLeastKernelVersion(4, 14, 0));
204     DO_EXPECT(IsAtLeastU(), MAINLINE_FOR_U_PLUS);
205     DO_EXPECT(IsAtLeastU() && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_U_5_10_PLUS);
206 
207     // V requires Linux Kernel 4.19+, but nothing (as yet) added or removed in V.
208     if (IsAtLeastV()) ASSERT_TRUE(isAtLeastKernelVersion(4, 19, 0));
209     DO_EXPECT(IsAtLeastV(), MAINLINE_FOR_V_PLUS);
210     DO_EXPECT(IsAtLeastV() && isAtLeastKernelVersion(5, 4, 0), MAINLINE_FOR_V_5_4_PLUS);
211 
212     for (const auto& file : mustExist) {
213         EXPECT_EQ(0, access(file.c_str(), R_OK)) << file << " does not exist";
214     }
215     for (const auto& file : mustNotExist) {
216         int ret = access(file.c_str(), R_OK);
217         int err = errno;
218         EXPECT_EQ(-1, ret) << file << " unexpectedly exists";
219         if (ret == -1) {
220             EXPECT_EQ(ENOENT, err) << " accessing " << file << " failed with errno " << err;
221         }
222     }
223 }
224