1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (c) 2018 Facebook
9 #include <sys/socket.h>
11 #include <linux/filter.h>
15 #include "cgroup_helpers.h"
16 #include "bpf_endian.h"
17 #include "bpf_rlimit.h"
20 #define CG_PATH "/foo"
23 char bpf_log_buf[BPF_LOG_BUF_SIZE];
24 static bool verbose = false;
28 /* BPF prog properties */
29 struct bpf_insn insns[MAX_INSNS];
30 enum bpf_attach_type expected_attach_type;
31 enum bpf_attach_type attach_type;
32 /* Socket properties */
35 /* Endpoint to bind() to */
38 /* Expected test result */
47 static struct sock_test tests[] = {
49 "bind4 load with invalid access: src_ip6",
51 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
52 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
53 offsetof(struct bpf_sock, src_ip6[0])),
54 BPF_MOV64_IMM(BPF_REG_0, 1),
57 BPF_CGROUP_INET4_POST_BIND,
58 BPF_CGROUP_INET4_POST_BIND,
66 "bind4 load with invalid access: mark",
68 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
69 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
70 offsetof(struct bpf_sock, mark)),
71 BPF_MOV64_IMM(BPF_REG_0, 1),
74 BPF_CGROUP_INET4_POST_BIND,
75 BPF_CGROUP_INET4_POST_BIND,
83 "bind6 load with invalid access: src_ip4",
85 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
86 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
87 offsetof(struct bpf_sock, src_ip4)),
88 BPF_MOV64_IMM(BPF_REG_0, 1),
91 BPF_CGROUP_INET6_POST_BIND,
92 BPF_CGROUP_INET6_POST_BIND,
100 "sock_create load with invalid access: src_port",
102 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
103 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
104 offsetof(struct bpf_sock, src_port)),
105 BPF_MOV64_IMM(BPF_REG_0, 1),
108 BPF_CGROUP_INET_SOCK_CREATE,
109 BPF_CGROUP_INET_SOCK_CREATE,
117 "sock_create load w/o expected_attach_type (compat mode)",
119 BPF_MOV64_IMM(BPF_REG_0, 1),
123 BPF_CGROUP_INET_SOCK_CREATE,
131 "sock_create load w/ expected_attach_type",
133 BPF_MOV64_IMM(BPF_REG_0, 1),
136 BPF_CGROUP_INET_SOCK_CREATE,
137 BPF_CGROUP_INET_SOCK_CREATE,
145 "attach type mismatch bind4 vs bind6",
147 BPF_MOV64_IMM(BPF_REG_0, 1),
150 BPF_CGROUP_INET4_POST_BIND,
151 BPF_CGROUP_INET6_POST_BIND,
159 "attach type mismatch bind6 vs bind4",
161 BPF_MOV64_IMM(BPF_REG_0, 1),
164 BPF_CGROUP_INET6_POST_BIND,
165 BPF_CGROUP_INET4_POST_BIND,
173 "attach type mismatch default vs bind4",
175 BPF_MOV64_IMM(BPF_REG_0, 1),
179 BPF_CGROUP_INET4_POST_BIND,
187 "attach type mismatch bind6 vs sock_create",
189 BPF_MOV64_IMM(BPF_REG_0, 1),
192 BPF_CGROUP_INET6_POST_BIND,
193 BPF_CGROUP_INET_SOCK_CREATE,
203 BPF_MOV64_IMM(BPF_REG_0, 0),
206 BPF_CGROUP_INET4_POST_BIND,
207 BPF_CGROUP_INET4_POST_BIND,
217 BPF_MOV64_IMM(BPF_REG_0, 0),
220 BPF_CGROUP_INET6_POST_BIND,
221 BPF_CGROUP_INET6_POST_BIND,
229 "bind6 deny specific IP & port",
231 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
233 /* if (ip == expected && port == expected) */
234 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
235 offsetof(struct bpf_sock, src_ip6[3])),
236 BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
237 __bpf_constant_ntohl(0x00000001), 4),
238 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
239 offsetof(struct bpf_sock, src_port)),
240 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
243 BPF_MOV64_IMM(BPF_REG_0, 0),
246 /* else return ALLOW; */
247 BPF_MOV64_IMM(BPF_REG_0, 1),
250 BPF_CGROUP_INET6_POST_BIND,
251 BPF_CGROUP_INET6_POST_BIND,
259 "bind4 allow specific IP & port",
261 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
263 /* if (ip == expected && port == expected) */
264 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
265 offsetof(struct bpf_sock, src_ip4)),
266 BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
267 __bpf_constant_ntohl(0x7F000001), 4),
268 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
269 offsetof(struct bpf_sock, src_port)),
270 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
273 BPF_MOV64_IMM(BPF_REG_0, 1),
276 /* else return DENY; */
277 BPF_MOV64_IMM(BPF_REG_0, 0),
280 BPF_CGROUP_INET4_POST_BIND,
281 BPF_CGROUP_INET4_POST_BIND,
291 BPF_MOV64_IMM(BPF_REG_0, 1),
294 BPF_CGROUP_INET4_POST_BIND,
295 BPF_CGROUP_INET4_POST_BIND,
305 BPF_MOV64_IMM(BPF_REG_0, 1),
308 BPF_CGROUP_INET6_POST_BIND,
309 BPF_CGROUP_INET6_POST_BIND,
318 static size_t probe_prog_length(const struct bpf_insn *fp)
322 for (len = MAX_INSNS - 1; len > 0; --len)
323 if (fp[len].code != 0 || fp[len].imm != 0)
328 static int load_sock_prog(const struct bpf_insn *prog,
329 enum bpf_attach_type attach_type)
331 struct bpf_load_program_attr attr;
334 memset(&attr, 0, sizeof(struct bpf_load_program_attr));
335 attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK;
336 attr.expected_attach_type = attach_type;
338 attr.insns_cnt = probe_prog_length(attr.insns);
339 attr.license = "GPL";
342 ret = bpf_load_program_xattr(&attr, bpf_log_buf, BPF_LOG_BUF_SIZE);
343 if (verbose && ret < 0)
344 fprintf(stderr, "%s\n", bpf_log_buf);
349 static int attach_sock_prog(int cgfd, int progfd,
350 enum bpf_attach_type attach_type)
352 return bpf_prog_attach(progfd, cgfd, attach_type, BPF_F_ALLOW_OVERRIDE);
355 static int bind_sock(int domain, int type, const char *ip, unsigned short port)
357 struct sockaddr_storage addr;
358 struct sockaddr_in6 *addr6;
359 struct sockaddr_in *addr4;
364 sockfd = socket(domain, type, 0);
368 memset(&addr, 0, sizeof(addr));
370 if (domain == AF_INET) {
371 len = sizeof(struct sockaddr_in);
372 addr4 = (struct sockaddr_in *)&addr;
373 addr4->sin_family = domain;
374 addr4->sin_port = htons(port);
375 if (inet_pton(domain, ip, (void *)&addr4->sin_addr) != 1)
377 } else if (domain == AF_INET6) {
378 len = sizeof(struct sockaddr_in6);
379 addr6 = (struct sockaddr_in6 *)&addr;
380 addr6->sin6_family = domain;
381 addr6->sin6_port = htons(port);
382 if (inet_pton(domain, ip, (void *)&addr6->sin6_addr) != 1)
388 if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1)
399 static int run_test_case(int cgfd, const struct sock_test *test)
404 printf("Test case: %s .. ", test->descr);
405 progfd = load_sock_prog(test->insns, test->expected_attach_type);
407 if (test->result == LOAD_REJECT)
413 if (attach_sock_prog(cgfd, progfd, test->attach_type) == -1) {
414 if (test->result == ATTACH_REJECT)
420 if (bind_sock(test->domain, test->type, test->ip, test->port) == -1) {
421 /* sys_bind() may fail for different reasons, errno has to be
422 * checked to confirm that BPF program rejected it.
424 if (test->result == BIND_REJECT && errno == EPERM)
431 if (test->result != SUCCESS)
438 /* Detaching w/o checking return code: best effort attempt. */
440 bpf_prog_detach(cgfd, test->attach_type);
442 printf("[%s]\n", err ? "FAIL" : "PASS");
446 static int run_tests(int cgfd)
452 for (i = 0; i < ARRAY_SIZE(tests); ++i) {
453 if (run_test_case(cgfd, &tests[i]))
458 printf("Summary: %d PASSED, %d FAILED\n", passes, fails);
459 return fails ? -1 : 0;
462 int main(int argc, char **argv)
467 if (setup_cgroup_environment())
470 cgfd = create_and_get_cgroup(CG_PATH);
474 if (join_cgroup(CG_PATH))
485 cleanup_cgroup_environment();