elastic / elastic/ebpf

BPFTcFilterTests failing on AL2 x64 and aarch64

Open
#34 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
86
Forks
11
Avg merge
15d 19h
Merged PRs (30d)
1

Description

While working on the CMake porting I noticed that the prog_test_run tests ( `BPFTcFilterTests` ) for AL2 both on ARM and are having failures.

Initially the failures I noticed were related to the BPF filesystem not being mounted, after solving that there was the problem with map names solved in #33 - 5 tests are still failing, I'm not sure yet if it's a problem related to the tests themselves or if it is related to the program. This needs investigation.

Here's a dump of the test output when it fails.

```
Running main() from /var/lib/jenkins/workspace/pf_multibranch_pipeline_lf_cmake/contrib/googletest/googletest/src/gtest_main.cc
[==========] Running 14 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 14 tests from BPFTcFilterTests
[ RUN ] BPFTcFilterTests.TestAllowArpPacket
/var/lib/jenkins/workspace/pf_multibranch_pipeline_lf_cmake/GPL/HostIsolation/TcFilter/BPFTcFilterTests.cpp:150: Failure
Value of: bpf_prog_test_run_xattr(&tattr)
Actual: true
Expected: false
[ FAILED ] BPFTcFilterTests.TestAllowArpPacket (0 ms)
[ RUN ] BPFTcFilterTests.TestDropUnsupportedPackets
/var/lib/jenkins/workspace/pf_multibranch_pipeline_lf_cmake/GPL/HostIsolation/TcFilter/BPFTcFilterTests.cpp:189: Failure
Value of: bpf_prog_test_run_xattr(&tattr)
Actual: true
Expected: false
[ FAILED ] BPFTcFilterTests.TestDropUnsupportedPackets (0 ms)
[ RUN ] BPFTcFilterTests.TestDropIPV6Packets
/var/lib/jenkins/workspace/pf_multibranch_pipeline_lf_cmake/GPL/HostIsolation/TcFilter/BPFTcFilterTests.cpp:229: Failure
Value of: bpf_prog_test_run_xattr(&tattr)
Actual: true
Expected: false
[ FAILED ] BPFTcFilterTests.TestDropIPV6Packets (0 ms)
[ RUN ] BPFTcFilterTests.TestDropInvalidHeaderLength
[ OK ] BPFTcFilterTests.TestDropInvalidHeaderLength (0 ms)
[ RUN ] BPFTcFilterTests.TestDropFragmentedPacket
[ OK ] BPFTcFilterTests.TestDropFragmentedPacket (0 ms)
[ RUN ] BPFTcFilterTests.TestAllowUDPPacketDNSPortSource
[ OK ] BPFTcFilterTests.TestAllowUDPPacketDNSPortSource (0 ms)
[ RUN ] BPFTcFilterTests.TestAllowUDPPacketDNSPortDest
[ OK ] BPFTcFilterTests.TestAllowUDPPacketDNSPortDest (0 ms)
[ RUN ] BPFTcFilterTests.TestAllowUDPPacketDHCPClient
[ OK ] BPFTcFilterTests.TestAllowUDPPacketDHCPClient (0 ms)
[ RUN ] BPFTcFilterTests.TestAllowUDPPacketDHCPServer
[ OK ] BPFTcFilterTests.TestAllowUDPPacketDHCPServer (0 ms)
[ RUN ] BPFTcFilterTests.TestDropUnknownUDPPackets
[ OK ] BPFTcFilterTests.TestDropUnknownUDPPackets (0 ms)
[ RUN ] BPFTcFilterTests.TestDropUnknownTCPDestination
[ OK ] BPFTcFilterTests.TestDropUnknownTCPDestination (0 ms)
[ RUN ] BPFTcFilterTests.TestAllowTCPAddressInAllowedIPs
/var/lib/jenkins/workspace/pf_multibranch_pipeline_lf_cmake/GPL/HostIsolation/TcFilter/BPFTcFilterTests.cpp:517: Failure
Expected equality of these values:
ret
Which is: -1
0
[ FAILED ] BPFTcFilterTests.TestAllowTCPAddressInAllowedIPs (0 ms)
[ RUN ] BPFTcFilterTests.TestDropUnknownICMPDestination
[ OK ] BPFTcFilterTests.TestDropUnknownICMPDestination (0 ms)
[ RUN ] BPFTcFilterTests.TestAllowICMPAddressInAllowedIPs
/var/lib/jenkins/workspace/pf_multibranch_pipeline_lf_cmake/GPL/HostIsolation/TcFilter/BPFTcFilterTests.cpp:589: Failure
Expected equality of these values:
ret
Which is: -1
0
[ FAILED ] BPFTcFilterTests.TestAllowICMPAddressInAllowedIPs (0 ms)
[----------] 14 tests from BPFTcFilterTests (2 ms total)

[----------] Global test environment tear-down
[==========] 14 tests from 1 test suite ran. (2 ms total)
[ PASSED ] 9 tests.
[ FAILED ] 5 tests, listed below:
[ FAILED ] BPFTcFilterTests.TestAllowArpPacket
[ FAILED ] BPFTcFilterTests.TestDropUnsupportedPackets
[ FAILED ] BPFTcFilterTests.TestDropIPV6Packets
[ FAILED ] BPFTcFilterTests.TestAllowTCPAddressInAllowedIPs
[ FAILED ] BPFTcFilterTests.TestAllowICMPAddressInAllowedIPs

5 FAILED TESTS
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with GPL/HostIsolation/TcFilter/BPFTcFilterTests.cpp and reproduce BPFTcFilterTests on AL2 x64 and aarch64. Compare the five failures with the test setup and the BPF program behavior to determine whether the tests or program are responsible. Done means identifying the cause and making all 14 tests pass on the affected architectures.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cmake, cpp
Domain
operating-systems, security, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.