1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (c) 2018 Facebook
3
4 #define _GNU_SOURCE
5
6 #include <stdio.h>
7 #include <stdlib.h>
8 #include <unistd.h>
9
10 #include <arpa/inet.h>
11 #include <netinet/in.h>
12 #include <sys/types.h>
13 #include <sys/select.h>
14 #include <sys/socket.h>
15
16 #include <linux/filter.h>
17
18 #include <bpf/bpf.h>
19 #include <bpf/libbpf.h>
20
21 #include "cgroup_helpers.h"
22 #include "bpf_rlimit.h"
23 #include "bpf_util.h"
24
25 #ifndef ENOTSUPP
26 # define ENOTSUPP 524
27 #endif
28
29 #define CG_PATH "/foo"
30 #define CONNECT4_PROG_PATH "./connect4_prog.o"
31 #define CONNECT6_PROG_PATH "./connect6_prog.o"
32 #define SENDMSG4_PROG_PATH "./sendmsg4_prog.o"
33 #define SENDMSG6_PROG_PATH "./sendmsg6_prog.o"
34
35 #define SERV4_IP "192.168.1.254"
36 #define SERV4_REWRITE_IP "127.0.0.1"
37 #define SRC4_IP "172.16.0.1"
38 #define SRC4_REWRITE_IP "127.0.0.4"
39 #define SERV4_PORT 4040
40 #define SERV4_REWRITE_PORT 4444
41
42 #define SERV6_IP "face:b00c:1234:5678::abcd"
43 #define SERV6_REWRITE_IP "::1"
44 #define SERV6_V4MAPPED_IP "::ffff:192.168.0.4"
45 #define SRC6_IP "::1"
46 #define SRC6_REWRITE_IP "::6"
47 #define SERV6_PORT 6060
48 #define SERV6_REWRITE_PORT 6666
49
50 #define INET_NTOP_BUF 40
51
52 struct sock_addr_test;
53
54 typedef int (*load_fn)(const struct sock_addr_test *test);
55 typedef int (*info_fn)(int, struct sockaddr *, socklen_t *);
56
57 char bpf_log_buf[BPF_LOG_BUF_SIZE];
58
59 struct sock_addr_test {
60 const char *descr;
61 /* BPF prog properties */
62 load_fn loadfn;
63 enum bpf_attach_type expected_attach_type;
64 enum bpf_attach_type attach_type;
65 /* Socket properties */
66 int domain;
67 int type;
68 /* IP:port pairs for BPF prog to override */
69 const char *requested_ip;
70 unsigned short requested_port;
71 const char *expected_ip;
72 unsigned short expected_port;
73 const char *expected_src_ip;
74 /* Expected test result */
75 enum {
76 LOAD_REJECT,
77 ATTACH_REJECT,
78 SYSCALL_EPERM,
79 SYSCALL_ENOTSUPP,
80 SUCCESS,
81 } expected_result;
82 };
83
84 static int bind4_prog_load(const struct sock_addr_test *test);
85 static int bind6_prog_load(const struct sock_addr_test *test);
86 static int connect4_prog_load(const struct sock_addr_test *test);
87 static int connect6_prog_load(const struct sock_addr_test *test);
88 static int sendmsg_deny_prog_load(const struct sock_addr_test *test);
89 static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test);
90 static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test);
91 static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test);
92 static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test);
93 static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test);
94
95 static struct sock_addr_test tests[] = {
96 /* bind */
97 {
98 "bind4: load prog with wrong expected attach type",
99 bind4_prog_load,
100 BPF_CGROUP_INET6_BIND,
101 BPF_CGROUP_INET4_BIND,
102 AF_INET,
103 SOCK_STREAM,
104 NULL,
105 0,
106 NULL,
107 0,
108 NULL,
109 LOAD_REJECT,
110 },
111 {
112 "bind4: attach prog with wrong attach type",
113 bind4_prog_load,
114 BPF_CGROUP_INET4_BIND,
115 BPF_CGROUP_INET6_BIND,
116 AF_INET,
117 SOCK_STREAM,
118 NULL,
119 0,
120 NULL,
121 0,
122 NULL,
123 ATTACH_REJECT,
124 },
125 {
126 "bind4: rewrite IP & TCP port in",
127 bind4_prog_load,
128 BPF_CGROUP_INET4_BIND,
129 BPF_CGROUP_INET4_BIND,
130 AF_INET,
131 SOCK_STREAM,
132 SERV4_IP,
133 SERV4_PORT,
134 SERV4_REWRITE_IP,
135 SERV4_REWRITE_PORT,
136 NULL,
137 SUCCESS,
138 },
139 {
140 "bind4: rewrite IP & UDP port in",
141 bind4_prog_load,
142 BPF_CGROUP_INET4_BIND,
143 BPF_CGROUP_INET4_BIND,
144 AF_INET,
145 SOCK_DGRAM,
146 SERV4_IP,
147 SERV4_PORT,
148 SERV4_REWRITE_IP,
149 SERV4_REWRITE_PORT,
150 NULL,
151 SUCCESS,
152 },
153 {
154 "bind6: load prog with wrong expected attach type",
155 bind6_prog_load,
156 BPF_CGROUP_INET4_BIND,
157 BPF_CGROUP_INET6_BIND,
158 AF_INET6,
159 SOCK_STREAM,
160 NULL,
161 0,
162 NULL,
163 0,
164 NULL,
165 LOAD_REJECT,
166 },
167 {
168 "bind6: attach prog with wrong attach type",
169 bind6_prog_load,
170 BPF_CGROUP_INET6_BIND,
171 BPF_CGROUP_INET4_BIND,
172 AF_INET,
173 SOCK_STREAM,
174 NULL,
175 0,
176 NULL,
177 0,
178 NULL,
179 ATTACH_REJECT,
180 },
181 {
182 "bind6: rewrite IP & TCP port in",
183 bind6_prog_load,
184 BPF_CGROUP_INET6_BIND,
185 BPF_CGROUP_INET6_BIND,
186 AF_INET6,
187 SOCK_STREAM,
188 SERV6_IP,
189 SERV6_PORT,
190 SERV6_REWRITE_IP,
191 SERV6_REWRITE_PORT,
192 NULL,
193 SUCCESS,
194 },
195 {
196 "bind6: rewrite IP & UDP port in",
197 bind6_prog_load,
198 BPF_CGROUP_INET6_BIND,
199 BPF_CGROUP_INET6_BIND,
200 AF_INET6,
201 SOCK_DGRAM,
202 SERV6_IP,
203 SERV6_PORT,
204 SERV6_REWRITE_IP,
205 SERV6_REWRITE_PORT,
206 NULL,
207 SUCCESS,
208 },
209
210 /* connect */
211 {
212 "connect4: load prog with wrong expected attach type",
213 connect4_prog_load,
214 BPF_CGROUP_INET6_CONNECT,
215 BPF_CGROUP_INET4_CONNECT,
216 AF_INET,
217 SOCK_STREAM,
218 NULL,
219 0,
220 NULL,
221 0,
222 NULL,
223 LOAD_REJECT,
224 },
225 {
226 "connect4: attach prog with wrong attach type",
227 connect4_prog_load,
228 BPF_CGROUP_INET4_CONNECT,
229 BPF_CGROUP_INET6_CONNECT,
230 AF_INET,
231 SOCK_STREAM,
232 NULL,
233 0,
234 NULL,
235 0,
236 NULL,
237 ATTACH_REJECT,
238 },
239 {
240 "connect4: rewrite IP & TCP port",
241 connect4_prog_load,
242 BPF_CGROUP_INET4_CONNECT,
243 BPF_CGROUP_INET4_CONNECT,
244 AF_INET,
245 SOCK_STREAM,
246 SERV4_IP,
247 SERV4_PORT,
248 SERV4_REWRITE_IP,
249 SERV4_REWRITE_PORT,
250 SRC4_REWRITE_IP,
251 SUCCESS,
252 },
253 {
254 "connect4: rewrite IP & UDP port",
255 connect4_prog_load,
256 BPF_CGROUP_INET4_CONNECT,
257 BPF_CGROUP_INET4_CONNECT,
258 AF_INET,
259 SOCK_DGRAM,
260 SERV4_IP,
261 SERV4_PORT,
262 SERV4_REWRITE_IP,
263 SERV4_REWRITE_PORT,
264 SRC4_REWRITE_IP,
265 SUCCESS,
266 },
267 {
268 "connect6: load prog with wrong expected attach type",
269 connect6_prog_load,
270 BPF_CGROUP_INET4_CONNECT,
271 BPF_CGROUP_INET6_CONNECT,
272 AF_INET6,
273 SOCK_STREAM,
274 NULL,
275 0,
276 NULL,
277 0,
278 NULL,
279 LOAD_REJECT,
280 },
281 {
282 "connect6: attach prog with wrong attach type",
283 connect6_prog_load,
284 BPF_CGROUP_INET6_CONNECT,
285 BPF_CGROUP_INET4_CONNECT,
286 AF_INET,
287 SOCK_STREAM,
288 NULL,
289 0,
290 NULL,
291 0,
292 NULL,
293 ATTACH_REJECT,
294 },
295 {
296 "connect6: rewrite IP & TCP port",
297 connect6_prog_load,
298 BPF_CGROUP_INET6_CONNECT,
299 BPF_CGROUP_INET6_CONNECT,
300 AF_INET6,
301 SOCK_STREAM,
302 SERV6_IP,
303 SERV6_PORT,
304 SERV6_REWRITE_IP,
305 SERV6_REWRITE_PORT,
306 SRC6_REWRITE_IP,
307 SUCCESS,
308 },
309 {
310 "connect6: rewrite IP & UDP port",
311 connect6_prog_load,
312 BPF_CGROUP_INET6_CONNECT,
313 BPF_CGROUP_INET6_CONNECT,
314 AF_INET6,
315 SOCK_DGRAM,
316 SERV6_IP,
317 SERV6_PORT,
318 SERV6_REWRITE_IP,
319 SERV6_REWRITE_PORT,
320 SRC6_REWRITE_IP,
321 SUCCESS,
322 },
323
324 /* sendmsg */
325 {
326 "sendmsg4: load prog with wrong expected attach type",
327 sendmsg4_rw_asm_prog_load,
328 BPF_CGROUP_UDP6_SENDMSG,
329 BPF_CGROUP_UDP4_SENDMSG,
330 AF_INET,
331 SOCK_DGRAM,
332 NULL,
333 0,
334 NULL,
335 0,
336 NULL,
337 LOAD_REJECT,
338 },
339 {
340 "sendmsg4: attach prog with wrong attach type",
341 sendmsg4_rw_asm_prog_load,
342 BPF_CGROUP_UDP4_SENDMSG,
343 BPF_CGROUP_UDP6_SENDMSG,
344 AF_INET,
345 SOCK_DGRAM,
346 NULL,
347 0,
348 NULL,
349 0,
350 NULL,
351 ATTACH_REJECT,
352 },
353 {
354 "sendmsg4: rewrite IP & port (asm)",
355 sendmsg4_rw_asm_prog_load,
356 BPF_CGROUP_UDP4_SENDMSG,
357 BPF_CGROUP_UDP4_SENDMSG,
358 AF_INET,
359 SOCK_DGRAM,
360 SERV4_IP,
361 SERV4_PORT,
362 SERV4_REWRITE_IP,
363 SERV4_REWRITE_PORT,
364 SRC4_REWRITE_IP,
365 SUCCESS,
366 },
367 {
368 "sendmsg4: rewrite IP & port (C)",
369 sendmsg4_rw_c_prog_load,
370 BPF_CGROUP_UDP4_SENDMSG,
371 BPF_CGROUP_UDP4_SENDMSG,
372 AF_INET,
373 SOCK_DGRAM,
374 SERV4_IP,
375 SERV4_PORT,
376 SERV4_REWRITE_IP,
377 SERV4_REWRITE_PORT,
378 SRC4_REWRITE_IP,
379 SUCCESS,
380 },
381 {
382 "sendmsg4: deny call",
383 sendmsg_deny_prog_load,
384 BPF_CGROUP_UDP4_SENDMSG,
385 BPF_CGROUP_UDP4_SENDMSG,
386 AF_INET,
387 SOCK_DGRAM,
388 SERV4_IP,
389 SERV4_PORT,
390 SERV4_REWRITE_IP,
391 SERV4_REWRITE_PORT,
392 SRC4_REWRITE_IP,
393 SYSCALL_EPERM,
394 },
395 {
396 "sendmsg6: load prog with wrong expected attach type",
397 sendmsg6_rw_asm_prog_load,
398 BPF_CGROUP_UDP4_SENDMSG,
399 BPF_CGROUP_UDP6_SENDMSG,
400 AF_INET6,
401 SOCK_DGRAM,
402 NULL,
403 0,
404 NULL,
405 0,
406 NULL,
407 LOAD_REJECT,
408 },
409 {
410 "sendmsg6: attach prog with wrong attach type",
411 sendmsg6_rw_asm_prog_load,
412 BPF_CGROUP_UDP6_SENDMSG,
413 BPF_CGROUP_UDP4_SENDMSG,
414 AF_INET6,
415 SOCK_DGRAM,
416 NULL,
417 0,
418 NULL,
419 0,
420 NULL,
421 ATTACH_REJECT,
422 },
423 {
424 "sendmsg6: rewrite IP & port (asm)",
425 sendmsg6_rw_asm_prog_load,
426 BPF_CGROUP_UDP6_SENDMSG,
427 BPF_CGROUP_UDP6_SENDMSG,
428 AF_INET6,
429 SOCK_DGRAM,
430 SERV6_IP,
431 SERV6_PORT,
432 SERV6_REWRITE_IP,
433 SERV6_REWRITE_PORT,
434 SRC6_REWRITE_IP,
435 SUCCESS,
436 },
437 {
438 "sendmsg6: rewrite IP & port (C)",
439 sendmsg6_rw_c_prog_load,
440 BPF_CGROUP_UDP6_SENDMSG,
441 BPF_CGROUP_UDP6_SENDMSG,
442 AF_INET6,
443 SOCK_DGRAM,
444 SERV6_IP,
445 SERV6_PORT,
446 SERV6_REWRITE_IP,
447 SERV6_REWRITE_PORT,
448 SRC6_REWRITE_IP,
449 SUCCESS,
450 },
451 {
452 "sendmsg6: IPv4-mapped IPv6",
453 sendmsg6_rw_v4mapped_prog_load,
454 BPF_CGROUP_UDP6_SENDMSG,
455 BPF_CGROUP_UDP6_SENDMSG,
456 AF_INET6,
457 SOCK_DGRAM,
458 SERV6_IP,
459 SERV6_PORT,
460 SERV6_REWRITE_IP,
461 SERV6_REWRITE_PORT,
462 SRC6_REWRITE_IP,
463 SYSCALL_ENOTSUPP,
464 },
465 {
466 "sendmsg6: deny call",
467 sendmsg_deny_prog_load,
468 BPF_CGROUP_UDP6_SENDMSG,
469 BPF_CGROUP_UDP6_SENDMSG,
470 AF_INET6,
471 SOCK_DGRAM,
472 SERV6_IP,
473 SERV6_PORT,
474 SERV6_REWRITE_IP,
475 SERV6_REWRITE_PORT,
476 SRC6_REWRITE_IP,
477 SYSCALL_EPERM,
478 },
479 };
480
mk_sockaddr(int domain,const char * ip,unsigned short port,struct sockaddr * addr,socklen_t addr_len)481 static int mk_sockaddr(int domain, const char *ip, unsigned short port,
482 struct sockaddr *addr, socklen_t addr_len)
483 {
484 struct sockaddr_in6 *addr6;
485 struct sockaddr_in *addr4;
486
487 if (domain != AF_INET && domain != AF_INET6) {
488 log_err("Unsupported address family");
489 return -1;
490 }
491
492 memset(addr, 0, addr_len);
493
494 if (domain == AF_INET) {
495 if (addr_len < sizeof(struct sockaddr_in))
496 return -1;
497 addr4 = (struct sockaddr_in *)addr;
498 addr4->sin_family = domain;
499 addr4->sin_port = htons(port);
500 if (inet_pton(domain, ip, (void *)&addr4->sin_addr) != 1) {
501 log_err("Invalid IPv4: %s", ip);
502 return -1;
503 }
504 } else if (domain == AF_INET6) {
505 if (addr_len < sizeof(struct sockaddr_in6))
506 return -1;
507 addr6 = (struct sockaddr_in6 *)addr;
508 addr6->sin6_family = domain;
509 addr6->sin6_port = htons(port);
510 if (inet_pton(domain, ip, (void *)&addr6->sin6_addr) != 1) {
511 log_err("Invalid IPv6: %s", ip);
512 return -1;
513 }
514 }
515
516 return 0;
517 }
518
load_insns(const struct sock_addr_test * test,const struct bpf_insn * insns,size_t insns_cnt)519 static int load_insns(const struct sock_addr_test *test,
520 const struct bpf_insn *insns, size_t insns_cnt)
521 {
522 struct bpf_load_program_attr load_attr;
523 int ret;
524
525 memset(&load_attr, 0, sizeof(struct bpf_load_program_attr));
526 load_attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
527 load_attr.expected_attach_type = test->expected_attach_type;
528 load_attr.insns = insns;
529 load_attr.insns_cnt = insns_cnt;
530 load_attr.license = "GPL";
531
532 ret = bpf_load_program_xattr(&load_attr, bpf_log_buf, BPF_LOG_BUF_SIZE);
533 if (ret < 0 && test->expected_result != LOAD_REJECT) {
534 log_err(">>> Loading program error.\n"
535 ">>> Verifier output:\n%s\n-------\n", bpf_log_buf);
536 }
537
538 return ret;
539 }
540
541 /* [1] These testing programs try to read different context fields, including
542 * narrow loads of different sizes from user_ip4 and user_ip6, and write to
543 * those allowed to be overridden.
544 *
545 * [2] BPF_LD_IMM64 & BPF_JMP_REG are used below whenever there is a need to
546 * compare a register with unsigned 32bit integer. BPF_JMP_IMM can't be used
547 * in such cases since it accepts only _signed_ 32bit integer as IMM
548 * argument. Also note that BPF_LD_IMM64 contains 2 instructions what matters
549 * to count jumps properly.
550 */
551
bind4_prog_load(const struct sock_addr_test * test)552 static int bind4_prog_load(const struct sock_addr_test *test)
553 {
554 union {
555 uint8_t u4_addr8[4];
556 uint16_t u4_addr16[2];
557 uint32_t u4_addr32;
558 } ip4;
559 struct sockaddr_in addr4_rw;
560
561 if (inet_pton(AF_INET, SERV4_IP, (void *)&ip4) != 1) {
562 log_err("Invalid IPv4: %s", SERV4_IP);
563 return -1;
564 }
565
566 if (mk_sockaddr(AF_INET, SERV4_REWRITE_IP, SERV4_REWRITE_PORT,
567 (struct sockaddr *)&addr4_rw, sizeof(addr4_rw)) == -1)
568 return -1;
569
570 /* See [1]. */
571 struct bpf_insn insns[] = {
572 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
573
574 /* if (sk.family == AF_INET && */
575 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
576 offsetof(struct bpf_sock_addr, family)),
577 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, AF_INET, 16),
578
579 /* (sk.type == SOCK_DGRAM || sk.type == SOCK_STREAM) && */
580 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
581 offsetof(struct bpf_sock_addr, type)),
582 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, SOCK_DGRAM, 1),
583 BPF_JMP_A(1),
584 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, SOCK_STREAM, 12),
585
586 /* 1st_byte_of_user_ip4 == expected && */
587 BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_6,
588 offsetof(struct bpf_sock_addr, user_ip4)),
589 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip4.u4_addr8[0], 10),
590
591 /* 1st_half_of_user_ip4 == expected && */
592 BPF_LDX_MEM(BPF_H, BPF_REG_7, BPF_REG_6,
593 offsetof(struct bpf_sock_addr, user_ip4)),
594 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip4.u4_addr16[0], 8),
595
596 /* whole_user_ip4 == expected) { */
597 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
598 offsetof(struct bpf_sock_addr, user_ip4)),
599 BPF_LD_IMM64(BPF_REG_8, ip4.u4_addr32), /* See [2]. */
600 BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_8, 4),
601
602 /* user_ip4 = addr4_rw.sin_addr */
603 BPF_MOV32_IMM(BPF_REG_7, addr4_rw.sin_addr.s_addr),
604 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
605 offsetof(struct bpf_sock_addr, user_ip4)),
606
607 /* user_port = addr4_rw.sin_port */
608 BPF_MOV32_IMM(BPF_REG_7, addr4_rw.sin_port),
609 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
610 offsetof(struct bpf_sock_addr, user_port)),
611 /* } */
612
613 /* return 1 */
614 BPF_MOV64_IMM(BPF_REG_0, 1),
615 BPF_EXIT_INSN(),
616 };
617
618 return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
619 }
620
bind6_prog_load(const struct sock_addr_test * test)621 static int bind6_prog_load(const struct sock_addr_test *test)
622 {
623 struct sockaddr_in6 addr6_rw;
624 struct in6_addr ip6;
625
626 if (inet_pton(AF_INET6, SERV6_IP, (void *)&ip6) != 1) {
627 log_err("Invalid IPv6: %s", SERV6_IP);
628 return -1;
629 }
630
631 if (mk_sockaddr(AF_INET6, SERV6_REWRITE_IP, SERV6_REWRITE_PORT,
632 (struct sockaddr *)&addr6_rw, sizeof(addr6_rw)) == -1)
633 return -1;
634
635 /* See [1]. */
636 struct bpf_insn insns[] = {
637 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
638
639 /* if (sk.family == AF_INET6 && */
640 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
641 offsetof(struct bpf_sock_addr, family)),
642 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, AF_INET6, 18),
643
644 /* 5th_byte_of_user_ip6 == expected && */
645 BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_6,
646 offsetof(struct bpf_sock_addr, user_ip6[1])),
647 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip6.s6_addr[4], 16),
648
649 /* 3rd_half_of_user_ip6 == expected && */
650 BPF_LDX_MEM(BPF_H, BPF_REG_7, BPF_REG_6,
651 offsetof(struct bpf_sock_addr, user_ip6[1])),
652 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip6.s6_addr16[2], 14),
653
654 /* last_word_of_user_ip6 == expected) { */
655 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
656 offsetof(struct bpf_sock_addr, user_ip6[3])),
657 BPF_LD_IMM64(BPF_REG_8, ip6.s6_addr32[3]), /* See [2]. */
658 BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_8, 10),
659
660
661 #define STORE_IPV6_WORD(N) \
662 BPF_MOV32_IMM(BPF_REG_7, addr6_rw.sin6_addr.s6_addr32[N]), \
663 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7, \
664 offsetof(struct bpf_sock_addr, user_ip6[N]))
665
666 /* user_ip6 = addr6_rw.sin6_addr */
667 STORE_IPV6_WORD(0),
668 STORE_IPV6_WORD(1),
669 STORE_IPV6_WORD(2),
670 STORE_IPV6_WORD(3),
671
672 /* user_port = addr6_rw.sin6_port */
673 BPF_MOV32_IMM(BPF_REG_7, addr6_rw.sin6_port),
674 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
675 offsetof(struct bpf_sock_addr, user_port)),
676
677 /* } */
678
679 /* return 1 */
680 BPF_MOV64_IMM(BPF_REG_0, 1),
681 BPF_EXIT_INSN(),
682 };
683
684 return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
685 }
686
load_path(const struct sock_addr_test * test,const char * path)687 static int load_path(const struct sock_addr_test *test, const char *path)
688 {
689 struct bpf_prog_load_attr attr;
690 struct bpf_object *obj;
691 int prog_fd;
692
693 memset(&attr, 0, sizeof(struct bpf_prog_load_attr));
694 attr.file = path;
695 attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
696 attr.expected_attach_type = test->expected_attach_type;
697
698 if (bpf_prog_load_xattr(&attr, &obj, &prog_fd)) {
699 if (test->expected_result != LOAD_REJECT)
700 log_err(">>> Loading program (%s) error.\n", path);
701 return -1;
702 }
703
704 return prog_fd;
705 }
706
connect4_prog_load(const struct sock_addr_test * test)707 static int connect4_prog_load(const struct sock_addr_test *test)
708 {
709 return load_path(test, CONNECT4_PROG_PATH);
710 }
711
connect6_prog_load(const struct sock_addr_test * test)712 static int connect6_prog_load(const struct sock_addr_test *test)
713 {
714 return load_path(test, CONNECT6_PROG_PATH);
715 }
716
sendmsg_deny_prog_load(const struct sock_addr_test * test)717 static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
718 {
719 struct bpf_insn insns[] = {
720 /* return 0 */
721 BPF_MOV64_IMM(BPF_REG_0, 0),
722 BPF_EXIT_INSN(),
723 };
724 return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
725 }
726
sendmsg4_rw_asm_prog_load(const struct sock_addr_test * test)727 static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test)
728 {
729 struct sockaddr_in dst4_rw_addr;
730 struct in_addr src4_rw_ip;
731
732 if (inet_pton(AF_INET, SRC4_REWRITE_IP, (void *)&src4_rw_ip) != 1) {
733 log_err("Invalid IPv4: %s", SRC4_REWRITE_IP);
734 return -1;
735 }
736
737 if (mk_sockaddr(AF_INET, SERV4_REWRITE_IP, SERV4_REWRITE_PORT,
738 (struct sockaddr *)&dst4_rw_addr,
739 sizeof(dst4_rw_addr)) == -1)
740 return -1;
741
742 struct bpf_insn insns[] = {
743 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
744
745 /* if (sk.family == AF_INET && */
746 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
747 offsetof(struct bpf_sock_addr, family)),
748 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, AF_INET, 8),
749
750 /* sk.type == SOCK_DGRAM) { */
751 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
752 offsetof(struct bpf_sock_addr, type)),
753 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, SOCK_DGRAM, 6),
754
755 /* msg_src_ip4 = src4_rw_ip */
756 BPF_MOV32_IMM(BPF_REG_7, src4_rw_ip.s_addr),
757 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
758 offsetof(struct bpf_sock_addr, msg_src_ip4)),
759
760 /* user_ip4 = dst4_rw_addr.sin_addr */
761 BPF_MOV32_IMM(BPF_REG_7, dst4_rw_addr.sin_addr.s_addr),
762 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
763 offsetof(struct bpf_sock_addr, user_ip4)),
764
765 /* user_port = dst4_rw_addr.sin_port */
766 BPF_MOV32_IMM(BPF_REG_7, dst4_rw_addr.sin_port),
767 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
768 offsetof(struct bpf_sock_addr, user_port)),
769 /* } */
770
771 /* return 1 */
772 BPF_MOV64_IMM(BPF_REG_0, 1),
773 BPF_EXIT_INSN(),
774 };
775
776 return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
777 }
778
sendmsg4_rw_c_prog_load(const struct sock_addr_test * test)779 static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test)
780 {
781 return load_path(test, SENDMSG4_PROG_PATH);
782 }
783
sendmsg6_rw_dst_asm_prog_load(const struct sock_addr_test * test,const char * rw_dst_ip)784 static int sendmsg6_rw_dst_asm_prog_load(const struct sock_addr_test *test,
785 const char *rw_dst_ip)
786 {
787 struct sockaddr_in6 dst6_rw_addr;
788 struct in6_addr src6_rw_ip;
789
790 if (inet_pton(AF_INET6, SRC6_REWRITE_IP, (void *)&src6_rw_ip) != 1) {
791 log_err("Invalid IPv6: %s", SRC6_REWRITE_IP);
792 return -1;
793 }
794
795 if (mk_sockaddr(AF_INET6, rw_dst_ip, SERV6_REWRITE_PORT,
796 (struct sockaddr *)&dst6_rw_addr,
797 sizeof(dst6_rw_addr)) == -1)
798 return -1;
799
800 struct bpf_insn insns[] = {
801 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
802
803 /* if (sk.family == AF_INET6) { */
804 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
805 offsetof(struct bpf_sock_addr, family)),
806 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, AF_INET6, 18),
807
808 #define STORE_IPV6_WORD_N(DST, SRC, N) \
809 BPF_MOV32_IMM(BPF_REG_7, SRC[N]), \
810 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7, \
811 offsetof(struct bpf_sock_addr, DST[N]))
812
813 #define STORE_IPV6(DST, SRC) \
814 STORE_IPV6_WORD_N(DST, SRC, 0), \
815 STORE_IPV6_WORD_N(DST, SRC, 1), \
816 STORE_IPV6_WORD_N(DST, SRC, 2), \
817 STORE_IPV6_WORD_N(DST, SRC, 3)
818
819 STORE_IPV6(msg_src_ip6, src6_rw_ip.s6_addr32),
820 STORE_IPV6(user_ip6, dst6_rw_addr.sin6_addr.s6_addr32),
821
822 /* user_port = dst6_rw_addr.sin6_port */
823 BPF_MOV32_IMM(BPF_REG_7, dst6_rw_addr.sin6_port),
824 BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
825 offsetof(struct bpf_sock_addr, user_port)),
826
827 /* } */
828
829 /* return 1 */
830 BPF_MOV64_IMM(BPF_REG_0, 1),
831 BPF_EXIT_INSN(),
832 };
833
834 return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
835 }
836
sendmsg6_rw_asm_prog_load(const struct sock_addr_test * test)837 static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test)
838 {
839 return sendmsg6_rw_dst_asm_prog_load(test, SERV6_REWRITE_IP);
840 }
841
sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test * test)842 static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test)
843 {
844 return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP);
845 }
846
sendmsg6_rw_c_prog_load(const struct sock_addr_test * test)847 static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test)
848 {
849 return load_path(test, SENDMSG6_PROG_PATH);
850 }
851
cmp_addr(const struct sockaddr_storage * addr1,const struct sockaddr_storage * addr2,int cmp_port)852 static int cmp_addr(const struct sockaddr_storage *addr1,
853 const struct sockaddr_storage *addr2, int cmp_port)
854 {
855 const struct sockaddr_in *four1, *four2;
856 const struct sockaddr_in6 *six1, *six2;
857
858 if (addr1->ss_family != addr2->ss_family)
859 return -1;
860
861 if (addr1->ss_family == AF_INET) {
862 four1 = (const struct sockaddr_in *)addr1;
863 four2 = (const struct sockaddr_in *)addr2;
864 return !((four1->sin_port == four2->sin_port || !cmp_port) &&
865 four1->sin_addr.s_addr == four2->sin_addr.s_addr);
866 } else if (addr1->ss_family == AF_INET6) {
867 six1 = (const struct sockaddr_in6 *)addr1;
868 six2 = (const struct sockaddr_in6 *)addr2;
869 return !((six1->sin6_port == six2->sin6_port || !cmp_port) &&
870 !memcmp(&six1->sin6_addr, &six2->sin6_addr,
871 sizeof(struct in6_addr)));
872 }
873
874 return -1;
875 }
876
cmp_sock_addr(info_fn fn,int sock1,const struct sockaddr_storage * addr2,int cmp_port)877 static int cmp_sock_addr(info_fn fn, int sock1,
878 const struct sockaddr_storage *addr2, int cmp_port)
879 {
880 struct sockaddr_storage addr1;
881 socklen_t len1 = sizeof(addr1);
882
883 memset(&addr1, 0, len1);
884 if (fn(sock1, (struct sockaddr *)&addr1, (socklen_t *)&len1) != 0)
885 return -1;
886
887 return cmp_addr(&addr1, addr2, cmp_port);
888 }
889
cmp_local_ip(int sock1,const struct sockaddr_storage * addr2)890 static int cmp_local_ip(int sock1, const struct sockaddr_storage *addr2)
891 {
892 return cmp_sock_addr(getsockname, sock1, addr2, /*cmp_port*/ 0);
893 }
894
cmp_local_addr(int sock1,const struct sockaddr_storage * addr2)895 static int cmp_local_addr(int sock1, const struct sockaddr_storage *addr2)
896 {
897 return cmp_sock_addr(getsockname, sock1, addr2, /*cmp_port*/ 1);
898 }
899
cmp_peer_addr(int sock1,const struct sockaddr_storage * addr2)900 static int cmp_peer_addr(int sock1, const struct sockaddr_storage *addr2)
901 {
902 return cmp_sock_addr(getpeername, sock1, addr2, /*cmp_port*/ 1);
903 }
904
start_server(int type,const struct sockaddr_storage * addr,socklen_t addr_len)905 static int start_server(int type, const struct sockaddr_storage *addr,
906 socklen_t addr_len)
907 {
908 int fd;
909
910 fd = socket(addr->ss_family, type, 0);
911 if (fd == -1) {
912 log_err("Failed to create server socket");
913 goto out;
914 }
915
916 if (bind(fd, (const struct sockaddr *)addr, addr_len) == -1) {
917 log_err("Failed to bind server socket");
918 goto close_out;
919 }
920
921 if (type == SOCK_STREAM) {
922 if (listen(fd, 128) == -1) {
923 log_err("Failed to listen on server socket");
924 goto close_out;
925 }
926 }
927
928 goto out;
929 close_out:
930 close(fd);
931 fd = -1;
932 out:
933 return fd;
934 }
935
connect_to_server(int type,const struct sockaddr_storage * addr,socklen_t addr_len)936 static int connect_to_server(int type, const struct sockaddr_storage *addr,
937 socklen_t addr_len)
938 {
939 int domain;
940 int fd = -1;
941
942 domain = addr->ss_family;
943
944 if (domain != AF_INET && domain != AF_INET6) {
945 log_err("Unsupported address family");
946 goto err;
947 }
948
949 fd = socket(domain, type, 0);
950 if (fd == -1) {
951 log_err("Failed to create client socket");
952 goto err;
953 }
954
955 if (connect(fd, (const struct sockaddr *)addr, addr_len) == -1) {
956 log_err("Fail to connect to server");
957 goto err;
958 }
959
960 goto out;
961 err:
962 close(fd);
963 fd = -1;
964 out:
965 return fd;
966 }
967
init_pktinfo(int domain,struct cmsghdr * cmsg)968 int init_pktinfo(int domain, struct cmsghdr *cmsg)
969 {
970 struct in6_pktinfo *pktinfo6;
971 struct in_pktinfo *pktinfo4;
972
973 if (domain == AF_INET) {
974 cmsg->cmsg_level = SOL_IP;
975 cmsg->cmsg_type = IP_PKTINFO;
976 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
977 pktinfo4 = (struct in_pktinfo *)CMSG_DATA(cmsg);
978 memset(pktinfo4, 0, sizeof(struct in_pktinfo));
979 if (inet_pton(domain, SRC4_IP,
980 (void *)&pktinfo4->ipi_spec_dst) != 1)
981 return -1;
982 } else if (domain == AF_INET6) {
983 cmsg->cmsg_level = SOL_IPV6;
984 cmsg->cmsg_type = IPV6_PKTINFO;
985 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
986 pktinfo6 = (struct in6_pktinfo *)CMSG_DATA(cmsg);
987 memset(pktinfo6, 0, sizeof(struct in6_pktinfo));
988 if (inet_pton(domain, SRC6_IP,
989 (void *)&pktinfo6->ipi6_addr) != 1)
990 return -1;
991 } else {
992 return -1;
993 }
994
995 return 0;
996 }
997
sendmsg_to_server(int type,const struct sockaddr_storage * addr,socklen_t addr_len,int set_cmsg,int flags,int * syscall_err)998 static int sendmsg_to_server(int type, const struct sockaddr_storage *addr,
999 socklen_t addr_len, int set_cmsg, int flags,
1000 int *syscall_err)
1001 {
1002 union {
1003 char buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1004 struct cmsghdr align;
1005 } control6;
1006 union {
1007 char buf[CMSG_SPACE(sizeof(struct in_pktinfo))];
1008 struct cmsghdr align;
1009 } control4;
1010 struct msghdr hdr;
1011 struct iovec iov;
1012 char data = 'a';
1013 int domain;
1014 int fd = -1;
1015
1016 domain = addr->ss_family;
1017
1018 if (domain != AF_INET && domain != AF_INET6) {
1019 log_err("Unsupported address family");
1020 goto err;
1021 }
1022
1023 fd = socket(domain, type, 0);
1024 if (fd == -1) {
1025 log_err("Failed to create client socket");
1026 goto err;
1027 }
1028
1029 memset(&iov, 0, sizeof(iov));
1030 iov.iov_base = &data;
1031 iov.iov_len = sizeof(data);
1032
1033 memset(&hdr, 0, sizeof(hdr));
1034 hdr.msg_name = (void *)addr;
1035 hdr.msg_namelen = addr_len;
1036 hdr.msg_iov = &iov;
1037 hdr.msg_iovlen = 1;
1038
1039 if (set_cmsg) {
1040 if (domain == AF_INET) {
1041 hdr.msg_control = &control4;
1042 hdr.msg_controllen = sizeof(control4.buf);
1043 } else if (domain == AF_INET6) {
1044 hdr.msg_control = &control6;
1045 hdr.msg_controllen = sizeof(control6.buf);
1046 }
1047 if (init_pktinfo(domain, CMSG_FIRSTHDR(&hdr))) {
1048 log_err("Fail to init pktinfo");
1049 goto err;
1050 }
1051 }
1052
1053 if (sendmsg(fd, &hdr, flags) != sizeof(data)) {
1054 log_err("Fail to send message to server");
1055 *syscall_err = errno;
1056 goto err;
1057 }
1058
1059 goto out;
1060 err:
1061 close(fd);
1062 fd = -1;
1063 out:
1064 return fd;
1065 }
1066
fastconnect_to_server(const struct sockaddr_storage * addr,socklen_t addr_len)1067 static int fastconnect_to_server(const struct sockaddr_storage *addr,
1068 socklen_t addr_len)
1069 {
1070 int sendmsg_err;
1071
1072 return sendmsg_to_server(SOCK_STREAM, addr, addr_len, /*set_cmsg*/0,
1073 MSG_FASTOPEN, &sendmsg_err);
1074 }
1075
recvmsg_from_client(int sockfd,struct sockaddr_storage * src_addr)1076 static int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr)
1077 {
1078 struct timeval tv;
1079 struct msghdr hdr;
1080 struct iovec iov;
1081 char data[64];
1082 fd_set rfds;
1083
1084 FD_ZERO(&rfds);
1085 FD_SET(sockfd, &rfds);
1086
1087 tv.tv_sec = 2;
1088 tv.tv_usec = 0;
1089
1090 if (select(sockfd + 1, &rfds, NULL, NULL, &tv) <= 0 ||
1091 !FD_ISSET(sockfd, &rfds))
1092 return -1;
1093
1094 memset(&iov, 0, sizeof(iov));
1095 iov.iov_base = data;
1096 iov.iov_len = sizeof(data);
1097
1098 memset(&hdr, 0, sizeof(hdr));
1099 hdr.msg_name = src_addr;
1100 hdr.msg_namelen = sizeof(struct sockaddr_storage);
1101 hdr.msg_iov = &iov;
1102 hdr.msg_iovlen = 1;
1103
1104 return recvmsg(sockfd, &hdr, 0);
1105 }
1106
init_addrs(const struct sock_addr_test * test,struct sockaddr_storage * requested_addr,struct sockaddr_storage * expected_addr,struct sockaddr_storage * expected_src_addr)1107 static int init_addrs(const struct sock_addr_test *test,
1108 struct sockaddr_storage *requested_addr,
1109 struct sockaddr_storage *expected_addr,
1110 struct sockaddr_storage *expected_src_addr)
1111 {
1112 socklen_t addr_len = sizeof(struct sockaddr_storage);
1113
1114 if (mk_sockaddr(test->domain, test->expected_ip, test->expected_port,
1115 (struct sockaddr *)expected_addr, addr_len) == -1)
1116 goto err;
1117
1118 if (mk_sockaddr(test->domain, test->requested_ip, test->requested_port,
1119 (struct sockaddr *)requested_addr, addr_len) == -1)
1120 goto err;
1121
1122 if (test->expected_src_ip &&
1123 mk_sockaddr(test->domain, test->expected_src_ip, 0,
1124 (struct sockaddr *)expected_src_addr, addr_len) == -1)
1125 goto err;
1126
1127 return 0;
1128 err:
1129 return -1;
1130 }
1131
run_bind_test_case(const struct sock_addr_test * test)1132 static int run_bind_test_case(const struct sock_addr_test *test)
1133 {
1134 socklen_t addr_len = sizeof(struct sockaddr_storage);
1135 struct sockaddr_storage requested_addr;
1136 struct sockaddr_storage expected_addr;
1137 int clientfd = -1;
1138 int servfd = -1;
1139 int err = 0;
1140
1141 if (init_addrs(test, &requested_addr, &expected_addr, NULL))
1142 goto err;
1143
1144 servfd = start_server(test->type, &requested_addr, addr_len);
1145 if (servfd == -1)
1146 goto err;
1147
1148 if (cmp_local_addr(servfd, &expected_addr))
1149 goto err;
1150
1151 /* Try to connect to server just in case */
1152 clientfd = connect_to_server(test->type, &expected_addr, addr_len);
1153 if (clientfd == -1)
1154 goto err;
1155
1156 goto out;
1157 err:
1158 err = -1;
1159 out:
1160 close(clientfd);
1161 close(servfd);
1162 return err;
1163 }
1164
run_connect_test_case(const struct sock_addr_test * test)1165 static int run_connect_test_case(const struct sock_addr_test *test)
1166 {
1167 socklen_t addr_len = sizeof(struct sockaddr_storage);
1168 struct sockaddr_storage expected_src_addr;
1169 struct sockaddr_storage requested_addr;
1170 struct sockaddr_storage expected_addr;
1171 int clientfd = -1;
1172 int servfd = -1;
1173 int err = 0;
1174
1175 if (init_addrs(test, &requested_addr, &expected_addr,
1176 &expected_src_addr))
1177 goto err;
1178
1179 /* Prepare server to connect to */
1180 servfd = start_server(test->type, &expected_addr, addr_len);
1181 if (servfd == -1)
1182 goto err;
1183
1184 clientfd = connect_to_server(test->type, &requested_addr, addr_len);
1185 if (clientfd == -1)
1186 goto err;
1187
1188 /* Make sure src and dst addrs were overridden properly */
1189 if (cmp_peer_addr(clientfd, &expected_addr))
1190 goto err;
1191
1192 if (cmp_local_ip(clientfd, &expected_src_addr))
1193 goto err;
1194
1195 if (test->type == SOCK_STREAM) {
1196 /* Test TCP Fast Open scenario */
1197 clientfd = fastconnect_to_server(&requested_addr, addr_len);
1198 if (clientfd == -1)
1199 goto err;
1200
1201 /* Make sure src and dst addrs were overridden properly */
1202 if (cmp_peer_addr(clientfd, &expected_addr))
1203 goto err;
1204
1205 if (cmp_local_ip(clientfd, &expected_src_addr))
1206 goto err;
1207 }
1208
1209 goto out;
1210 err:
1211 err = -1;
1212 out:
1213 close(clientfd);
1214 close(servfd);
1215 return err;
1216 }
1217
run_sendmsg_test_case(const struct sock_addr_test * test)1218 static int run_sendmsg_test_case(const struct sock_addr_test *test)
1219 {
1220 socklen_t addr_len = sizeof(struct sockaddr_storage);
1221 struct sockaddr_storage expected_src_addr;
1222 struct sockaddr_storage requested_addr;
1223 struct sockaddr_storage expected_addr;
1224 struct sockaddr_storage real_src_addr;
1225 int clientfd = -1;
1226 int servfd = -1;
1227 int set_cmsg;
1228 int err = 0;
1229
1230 if (test->type != SOCK_DGRAM)
1231 goto err;
1232
1233 if (init_addrs(test, &requested_addr, &expected_addr,
1234 &expected_src_addr))
1235 goto err;
1236
1237 /* Prepare server to sendmsg to */
1238 servfd = start_server(test->type, &expected_addr, addr_len);
1239 if (servfd == -1)
1240 goto err;
1241
1242 for (set_cmsg = 0; set_cmsg <= 1; ++set_cmsg) {
1243 if (clientfd >= 0)
1244 close(clientfd);
1245
1246 clientfd = sendmsg_to_server(test->type, &requested_addr,
1247 addr_len, set_cmsg, /*flags*/0,
1248 &err);
1249 if (err)
1250 goto out;
1251 else if (clientfd == -1)
1252 goto err;
1253
1254 /* Try to receive message on server instead of using
1255 * getpeername(2) on client socket, to check that client's
1256 * destination address was rewritten properly, since
1257 * getpeername(2) doesn't work with unconnected datagram
1258 * sockets.
1259 *
1260 * Get source address from recvmsg(2) as well to make sure
1261 * source was rewritten properly: getsockname(2) can't be used
1262 * since socket is unconnected and source defined for one
1263 * specific packet may differ from the one used by default and
1264 * returned by getsockname(2).
1265 */
1266 if (recvmsg_from_client(servfd, &real_src_addr) == -1)
1267 goto err;
1268
1269 if (cmp_addr(&real_src_addr, &expected_src_addr, /*cmp_port*/0))
1270 goto err;
1271 }
1272
1273 goto out;
1274 err:
1275 err = -1;
1276 out:
1277 close(clientfd);
1278 close(servfd);
1279 return err;
1280 }
1281
run_test_case(int cgfd,const struct sock_addr_test * test)1282 static int run_test_case(int cgfd, const struct sock_addr_test *test)
1283 {
1284 int progfd = -1;
1285 int err = 0;
1286
1287 printf("Test case: %s .. ", test->descr);
1288
1289 progfd = test->loadfn(test);
1290 if (test->expected_result == LOAD_REJECT && progfd < 0)
1291 goto out;
1292 else if (test->expected_result == LOAD_REJECT || progfd < 0)
1293 goto err;
1294
1295 err = bpf_prog_attach(progfd, cgfd, test->attach_type,
1296 BPF_F_ALLOW_OVERRIDE);
1297 if (test->expected_result == ATTACH_REJECT && err) {
1298 err = 0; /* error was expected, reset it */
1299 goto out;
1300 } else if (test->expected_result == ATTACH_REJECT || err) {
1301 goto err;
1302 }
1303
1304 switch (test->attach_type) {
1305 case BPF_CGROUP_INET4_BIND:
1306 case BPF_CGROUP_INET6_BIND:
1307 err = run_bind_test_case(test);
1308 break;
1309 case BPF_CGROUP_INET4_CONNECT:
1310 case BPF_CGROUP_INET6_CONNECT:
1311 err = run_connect_test_case(test);
1312 break;
1313 case BPF_CGROUP_UDP4_SENDMSG:
1314 case BPF_CGROUP_UDP6_SENDMSG:
1315 err = run_sendmsg_test_case(test);
1316 break;
1317 default:
1318 goto err;
1319 }
1320
1321 if (test->expected_result == SYSCALL_EPERM && err == EPERM) {
1322 err = 0; /* error was expected, reset it */
1323 goto out;
1324 }
1325
1326 if (test->expected_result == SYSCALL_ENOTSUPP && err == ENOTSUPP) {
1327 err = 0; /* error was expected, reset it */
1328 goto out;
1329 }
1330
1331 if (err || test->expected_result != SUCCESS)
1332 goto err;
1333
1334 goto out;
1335 err:
1336 err = -1;
1337 out:
1338 /* Detaching w/o checking return code: best effort attempt. */
1339 if (progfd != -1)
1340 bpf_prog_detach(cgfd, test->attach_type);
1341 close(progfd);
1342 printf("[%s]\n", err ? "FAIL" : "PASS");
1343 return err;
1344 }
1345
run_tests(int cgfd)1346 static int run_tests(int cgfd)
1347 {
1348 int passes = 0;
1349 int fails = 0;
1350 int i;
1351
1352 for (i = 0; i < ARRAY_SIZE(tests); ++i) {
1353 if (run_test_case(cgfd, &tests[i]))
1354 ++fails;
1355 else
1356 ++passes;
1357 }
1358 printf("Summary: %d PASSED, %d FAILED\n", passes, fails);
1359 return fails ? -1 : 0;
1360 }
1361
main(int argc,char ** argv)1362 int main(int argc, char **argv)
1363 {
1364 int cgfd = -1;
1365 int err = 0;
1366
1367 if (argc < 2) {
1368 fprintf(stderr,
1369 "%s has to be run via %s.sh. Skip direct run.\n",
1370 argv[0], argv[0]);
1371 exit(err);
1372 }
1373
1374 if (setup_cgroup_environment())
1375 goto err;
1376
1377 cgfd = create_and_get_cgroup(CG_PATH);
1378 if (!cgfd)
1379 goto err;
1380
1381 if (join_cgroup(CG_PATH))
1382 goto err;
1383
1384 if (run_tests(cgfd))
1385 goto err;
1386
1387 goto out;
1388 err:
1389 err = -1;
1390 out:
1391 close(cgfd);
1392 cleanup_cgroup_environment();
1393 return err;
1394 }
1395
