summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/meson.build2
-rw-r--r--src/n-acd/.github/workflows/ci.yml36
-rw-r--r--src/n-acd/README.md7
-rw-r--r--src/n-acd/meson.build2
-rw-r--r--src/n-acd/meson_options.txt1
-rw-r--r--src/n-acd/src/meson.build17
-rw-r--r--src/n-acd/src/n-acd-bpf-fallback.c30
-rw-r--r--src/n-acd/src/n-acd-probe.c6
-rw-r--r--src/n-acd/src/n-acd.c12
-rw-r--r--src/n-acd/src/test-bpf.c19
10 files changed, 25 insertions, 107 deletions
diff --git a/src/meson.build b/src/meson.build
index 92e95e68ef..d186b4db4c 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -24,7 +24,7 @@ libn_acd = static_library(
'n-acd/src/n-acd.c',
'n-acd/src/n-acd-probe.c',
'n-acd/src/util/timer.c',
- enable_ebpf ? 'n-acd/src/n-acd-bpf.c' : 'n-acd/src/n-acd-bpf-fallback.c',
+ 'n-acd/src/n-acd-bpf.c',
),
include_directories: include_directories(
'c-list/src',
diff --git a/src/n-acd/.github/workflows/ci.yml b/src/n-acd/.github/workflows/ci.yml
index 22fc814187..f6987414ca 100644
--- a/src/n-acd/.github/workflows/ci.yml
+++ b/src/n-acd/.github/workflows/ci.yml
@@ -49,42 +49,6 @@ jobs:
"--m32=1" \
"--source=/github/workspace"
- ci-no-ebpf:
- name: CI without eBPF
- runs-on: ubuntu-latest
-
- steps:
- # See above in 'ci' job.
- - name: Fetch CI
- uses: actions/checkout@v2
- with:
- repository: c-util/automation
- ref: v1
- path: automation
- - name: Build CI
- working-directory: automation/src/ci-c-util
- run: docker build --tag ci-c-util:v1 .
-
- #
- # Run CI
- #
- # This again runs the CI, but this time disables eBPF. We do support the
- # legacy BPF fallback, so lets make sure we test for it.
- #
- - name: Fetch Sources
- uses: actions/checkout@v2
- with:
- path: source
- - name: Run through C-Util CI
- run: |
- docker run \
- --privileged \
- -v "$(pwd)/source:/github/workspace" \
- "ci-c-util:v1" \
- "--m32=1" \
- "--mesonargs=-Debpf=false" \
- "--source=/github/workspace"
-
ci-valgrind:
name: CI through Valgrind
runs-on: ubuntu-latest
diff --git a/src/n-acd/README.md b/src/n-acd/README.md
index 089541825d..d207e70041 100644
--- a/src/n-acd/README.md
+++ b/src/n-acd/README.md
@@ -41,13 +41,6 @@ meson test
ninja install
```
-The following configuration options are available:
-
- * `ebpf`: This boolean controls whether `ebpf` features are used to improve
- the package filtering performance. If disabled, classic bpf will be
- used. This feature requires a rather recent kernel (>=3.19).
- Default is: true
-
### Repository:
- **web**: <https://github.com/nettools/n-acd>
diff --git a/src/n-acd/meson.build b/src/n-acd/meson.build
index 6479eb1a77..ca72e567e3 100644
--- a/src/n-acd/meson.build
+++ b/src/n-acd/meson.build
@@ -22,6 +22,4 @@ dep_crbtree = sub_crbtree.get_variable('libcrbtree_dep')
dep_csiphash = sub_csiphash.get_variable('libcsiphash_dep')
dep_cstdaux = sub_cstdaux.get_variable('libcstdaux_dep')
-use_ebpf = get_option('ebpf')
-
subdir('src')
diff --git a/src/n-acd/meson_options.txt b/src/n-acd/meson_options.txt
deleted file mode 100644
index b024ee1d4c..0000000000
--- a/src/n-acd/meson_options.txt
+++ /dev/null
@@ -1 +0,0 @@
-option('ebpf', type: 'boolean', value: true, description: 'Enable eBPF packet filtering')
diff --git a/src/n-acd/src/meson.build b/src/n-acd/src/meson.build
index 3e92681f91..db0bce6201 100644
--- a/src/n-acd/src/meson.build
+++ b/src/n-acd/src/meson.build
@@ -13,20 +13,11 @@ libnacd_deps = [
libnacd_sources = [
'n-acd.c',
+ 'n-acd-bpf.c',
'n-acd-probe.c',
'util/timer.c',
]
-if use_ebpf
- libnacd_sources += [
- 'n-acd-bpf.c',
- ]
-else
- libnacd_sources += [
- 'n-acd-bpf-fallback.c',
- ]
-endif
-
libnacd_private = static_library(
'nacd-private',
libnacd_sources,
@@ -77,10 +68,8 @@ endif
test_api = executable('test-api', ['test-api.c'], link_with: libnacd_shared)
test('API Symbol Visibility', test_api)
-if use_ebpf
- test_bpf = executable('test-bpf', ['test-bpf.c'], dependencies: libnacd_dep)
- test('eBPF socket filtering', test_bpf)
-endif
+test_bpf = executable('test-bpf', ['test-bpf.c'], dependencies: libnacd_dep)
+test('eBPF socket filtering', test_bpf)
test_loopback = executable('test-loopback', ['test-loopback.c'], dependencies: libnacd_dep)
test('Echo Suppression via Loopback', test_loopback)
diff --git a/src/n-acd/src/n-acd-bpf-fallback.c b/src/n-acd/src/n-acd-bpf-fallback.c
deleted file mode 100644
index 3cf4eb0679..0000000000
--- a/src/n-acd/src/n-acd-bpf-fallback.c
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * A noop implementation of eBPF filter for IPv4 Address Conflict Detection
- *
- * These are a collection of dummy functions that have no effect, but allows
- * n-acd to compile without eBPF support.
- *
- * See n-acd-bpf.c for documentation.
- */
-
-#include <c-stdaux.h>
-#include <stddef.h>
-#include "n-acd-private.h"
-
-int n_acd_bpf_map_create(int *mapfdp, size_t max_entries) {
- *mapfdp = -1;
- return 0;
-}
-
-int n_acd_bpf_map_add(int mapfd, struct in_addr *addrp) {
- return 0;
-}
-
-int n_acd_bpf_map_remove(int mapfd, struct in_addr *addrp) {
- return 0;
-}
-
-int n_acd_bpf_compile(int *progfdp, int mapfd, struct ether_addr *macp) {
- *progfdp = -1;
- return 0;
-}
diff --git a/src/n-acd/src/n-acd-probe.c b/src/n-acd/src/n-acd-probe.c
index c1ed59ae9e..2f7d364233 100644
--- a/src/n-acd/src/n-acd-probe.c
+++ b/src/n-acd/src/n-acd-probe.c
@@ -208,8 +208,6 @@ static int n_acd_probe_link(NAcdProbe *probe) {
* entry.
*/
r = n_acd_ensure_bpf_map_space(probe->acd);
- if (r)
- return r;
/*
* Link entry into context, indexed by its IP. Note that we allow
@@ -238,7 +236,7 @@ static int n_acd_probe_link(NAcdProbe *probe) {
/*
* Add the ip address to the map, if it is not already there.
*/
- if (n_acd_probe_is_unique(probe)) {
+ if (probe->acd->fd_bpf_map >= 0 && n_acd_probe_is_unique(probe)) {
r = n_acd_bpf_map_add(probe->acd->fd_bpf_map, &probe->ip);
if (r) {
/*
@@ -261,7 +259,7 @@ static void n_acd_probe_unlink(NAcdProbe *probe) {
* If this is the only probe for a given IP, remove the IP from the
* kernel BPF map.
*/
- if (n_acd_probe_is_unique(probe)) {
+ if (probe->acd->fd_bpf_map >= 0 && n_acd_probe_is_unique(probe)) {
r = n_acd_bpf_map_remove(probe->acd->fd_bpf_map, &probe->ip);
c_assert(r >= 0);
--probe->acd->n_bpf_map;
diff --git a/src/n-acd/src/n-acd.c b/src/n-acd/src/n-acd.c
index c1d9286503..5f49a38ac6 100644
--- a/src/n-acd/src/n-acd.c
+++ b/src/n-acd/src/n-acd.c
@@ -296,7 +296,7 @@ int n_acd_ensure_bpf_map_space(NAcd *acd) {
r = n_acd_bpf_compile(&fd_prog, fd_map, (struct ether_addr*) acd->mac);
if (r)
- return r;
+ fd_prog = -1;
if (fd_prog >= 0) {
r = setsockopt(acd->fd_socket, SOL_SOCKET, SO_ATTACH_BPF, &fd_prog, sizeof(fd_prog));
@@ -360,12 +360,12 @@ _c_public_ int n_acd_new(NAcd **acdp, NAcdConfig *config) {
acd->max_bpf_map = 8;
r = n_acd_bpf_map_create(&acd->fd_bpf_map, acd->max_bpf_map);
- if (r)
- return r;
- r = n_acd_bpf_compile(&fd_bpf_prog, acd->fd_bpf_map, (struct ether_addr*) acd->mac);
- if (r)
- return r;
+ if (acd->fd_bpf_map >= 0) {
+ r = n_acd_bpf_compile(&fd_bpf_prog, acd->fd_bpf_map, (struct ether_addr*) acd->mac);
+ if (r)
+ fd_bpf_prog = -1;
+ }
r = n_acd_socket_new(&acd->fd_socket, fd_bpf_prog, config);
if (r)
diff --git a/src/n-acd/src/test-bpf.c b/src/n-acd/src/test-bpf.c
index 78f9d0f19c..f4576012db 100644
--- a/src/n-acd/src/test-bpf.c
+++ b/src/n-acd/src/test-bpf.c
@@ -48,8 +48,9 @@ static void test_map(void) {
struct in_addr addr = { 1 };
r = n_acd_bpf_map_create(&mapfd, 8);
- c_assert(r >= 0);
- c_assert(mapfd >= 0);
+
+ if (r == -EPERM)
+ return;
r = n_acd_bpf_map_remove(mapfd, &addr);
c_assert(r == -ENOENT);
@@ -103,7 +104,13 @@ static void test_filter(void) {
int r, mapfd = -1, progfd = -1, pair[2];
r = n_acd_bpf_map_create(&mapfd, 1);
+
+ if (r == -EPERM)
+ return;
+
c_assert(r >= 0);
+ c_assert(mapfd >= 0);
+
r = n_acd_bpf_compile(&progfd, mapfd, &mac1);
c_assert(r >= 0);
@@ -113,7 +120,7 @@ static void test_filter(void) {
c_assert(r >= 0);
r = setsockopt(pair[1], SOL_SOCKET, SO_ATTACH_BPF, &progfd,
- sizeof(progfd));
+ sizeof(progfd));
c_assert(r >= 0);
r = n_acd_bpf_map_add(mapfd, &ip1);
@@ -190,9 +197,9 @@ static void test_filter(void) {
c_assert(errno == EAGAIN);
/*
- * Send one packet before and one packet after modifying the map,
- * verify that the modification applies at the time of send(), not recv().
- */
+ * Send one packet before and one packet after modifying the map,
+ * verify that the modification applies at the time of send(), not recv().
+ */
*packet = (struct ether_arp)ETHER_ARP_PACKET_INIT(ARPOP_REQUEST, &mac2, &ip1, &ip2);
r = send(pair[0], buf, sizeof(struct ether_arp), 0);
c_assert(r == sizeof(struct ether_arp));
View Lorry Controller Status