microsoft / microsoft/ebpf-for-windows
Test suite needed to validate bfp_xxx run-time behavior equivalence with that of the Linux implementation.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the bug
The runtime parameter validation in our bpf_xxx API calls implementations is at a variance when compared to their Linux counterparts.
For example, passing a NULL as a 'value' argument to ```bpf_map_update_element``` returns an error on Linux while we ```assert``` in the user-mode entry point in ```ebpf_api.cpp``` and carry on. This is further complicated by the fact that some kernel-mode entry handlers in the ```ebpf_map_metadata_table_t``` table interpret/validate the parameters differently compared to the public, user-mode interface.
Another example is the inconsistency between the handling of invalid handles as a parameter between array-of-maps and hash-of-maps.
Apart from the security implications, from a 'port-from-linux' perspective, it would be extremely valuable to ensure Linux behavior compatibility _at_ _least_ at the public API level. Note that this includes ensuring identical error return values.
It would also be a good idea to review/update the validation logic at the metadata handler level to bring it in line with their corresponding public interfaces.
This test suite must:
1. Be completely source-level portable between windows and Linux.
2. Run against the latest 'stable' Linux kernel release.
3. Be a part of 'pre-merge' PR build checks.
4. Provide the ability for behavior compatibility verification to be automated. One option would be for both runs (Windows and Linux) to output a named text file with a specific format, and then 'diff' both versions for variances.
5. We also need an automated (dependabot?) mechanism to keep up with stable Linux kernel releases. This might become tricky, what with having to generate/update Linux images with the latest stable Linux kernel version.
### OS information
N/A
### Steps taken to reproduce bug
N/A
### Expected behavior
N/A
### Actual outcome
N/A
### Additional details
_No response_
Contributor guide
Research direction
Start by reading the validation paths in ebpf_api.cpp and the ebpf_map_metadata_table_t handlers, then compare cases such as NULL values for bpf_map_update_element and invalid map handles with Linux behavior. Done means a source-portable Windows/Linux suite verifies matching error results, runs against the latest stable Linux kernel, emits comparable output, and is included in pre-merge checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, cpp, linux
- Domain
- operating-systems, testing-qa
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100