microsoft / microsoft/ebpf-for-windows

Test suite needed to validate bfp_xxx run-time behavior equivalence with that of the Linux implementation.

Open
#1,956 1 comment 0 reactions 0 assignees View on GitHub
enhancement help wanted P3 tests triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

The runtime parameter validation in our bpf_xxx API calls implementations is at a variance when compared to their Linux counterparts.

For example, passing a NULL as a 'value' argument to ```bpf_map_update_element``` returns an error on Linux while we ```assert``` in the user-mode entry point in ```ebpf_api.cpp``` and carry on. This is further complicated by the fact that some kernel-mode entry handlers in the ```ebpf_map_metadata_table_t``` table interpret/validate the parameters differently compared to the public, user-mode interface.

Another example is the inconsistency between the handling of invalid handles as a parameter between array-of-maps and hash-of-maps.

Apart from the security implications, from a 'port-from-linux' perspective, it would be extremely valuable to ensure Linux behavior compatibility _at_ _least_ at the public API level. Note that this includes ensuring identical error return values.

It would also be a good idea to review/update the validation logic at the metadata handler level to bring it in line with their corresponding public interfaces.

This test suite must:

1. Be completely source-level portable between windows and Linux.
2. Run against the latest 'stable' Linux kernel release.
3. Be a part of 'pre-merge' PR build checks.
4. Provide the ability for behavior compatibility verification to be automated. One option would be for both runs (Windows and Linux) to output a named text file with a specific format, and then 'diff' both versions for variances.
5. We also need an automated (dependabot?) mechanism to keep up with stable Linux kernel releases. This might become tricky, what with having to generate/update Linux images with the latest stable Linux kernel version.

### OS information

N/A

### Steps taken to reproduce bug

N/A

### Expected behavior

N/A

### Actual outcome

N/A

### Additional details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reading the validation paths in ebpf_api.cpp and the ebpf_map_metadata_table_t handlers, then compare cases such as NULL values for bpf_map_update_element and invalid map handles with Linux behavior. Done means a source-portable Windows/Linux suite verifies matching error results, runs against the latest stable Linux kernel, emits comparable output, and is included in pre-merge checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp, linux
Domain
operating-systems, testing-qa
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.