Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
From:   Tom Cook <tom.k.cook@gmail.com>
Date:   Tue, 5 Jan 2021 13:42:31 +0000
Message-ID: <CAFSh4UwMr7t+R9mWUCjdecadJL6=_7jdgagAQK6Y1Yj0+Eu0sg@mail.gmail.com>
Subject: cBPF socket filters failing - inexplicably?
To:     linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

In the course of tracking down a defect in some existing software,
I've found the failure demonstrated by the short program below.
Essentially, a cBPF program that just rejects every frame (ie always
returns zero) and is attached to a socket using setsockopt(SOL_SOCKET,
SO_ATTACH_FILTER, ...) still occasionally lets frames through to
userspace.

The code is based on the first example in
Documentation/networking/filter.txt, except that I've changed the
content of the filter program and added a timeout on the socket.

To reproduce the problem:

# gcc test.c -o test
# sudo ./test
... and in another console start a large network operation.

In my case, I copied a ~300MB core file I had lying around to another
host on the LAN.  The test code should print the string "Failed to
read from socket" 100 times.  In practice, it produces about 10%
"Received packet with ethertype..." messages.

I've observed the same result on Ubuntu amd64 glibc system running a
5.9.0 kernel and also on Alpine arm64v8 muslc system running a 4.9.1
kernel.  I've written test code in both C and Python.  I'm fairly sure
this is not something I'm doing wrong - but very keen to have things
thrown at me if it is.

Regards,
Tom Cook


#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <linux/if_ether.h>
#include <linux/filter.h>
#include <stdint.h>
#include <unistd.h>

struct sock_filter code[] = {
    { 0x06,    0,    0,    0x00 }  /* BPF_RET | BPF_K   0   0   0 */
};

struct sock_fprog bpf = {
    .len = 1,
    .filter = code,
};

void test() {
    uint8_t buf[2048];

    int sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    if (sock < 0) {
        printf("Failed to open socket\n");
        return;
    }
    int ret = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf));
    if (ret < 0) {
        printf("Failed to set socket filter\n");
        return;
    }
    struct timeval tv = {
        .tv_sec = 1
    };

    ret = setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
    if (ret < 0) {
        printf("Failed to set socket timeout\n");
        return;
    }

    ssize_t count = recv(sock, buf, 2048, 0);
    if (count <= 0) {
        printf("Failed to read from socket\n");
        return;
    }

    close(sock);

    uint16_t *ethertype = (short*)(buf + 12);
    uint8_t *proto = (unsigned char *)(buf + 23);
    uint16_t *dport = (uint16_t *)(buf + 14 + 20);

    printf("Received packet with ethertype 0x%04hu, protocol 0x%02hhu
and dport 0x%04hu\n", *ethertype, *proto, *dport);
}

int main() {
    for (size_t ii = 0; ii < 100; ++ii) {
        test();
    }
}