1// SPDX-License-Identifier: GPL-2.0
  2#include <test_progs.h>
  3#include "cgroup_helpers.h"
  4
  5static char bpf_log_buf[4096];
  6static bool verbose;
  7
  8enum sockopt_test_error {
  9	OK = 0,
 10	DENY_LOAD,
 11	DENY_ATTACH,
 12	EPERM_GETSOCKOPT,
 13	EFAULT_GETSOCKOPT,
 14	EPERM_SETSOCKOPT,
 15	EFAULT_SETSOCKOPT,
 16};
 17
 18static struct sockopt_test {
 19	const char			*descr;
 20	const struct bpf_insn		insns[64];
 21	enum bpf_attach_type		attach_type;
 22	enum bpf_attach_type		expected_attach_type;
 23
 24	int				set_optname;
 25	int				set_level;
 26	const char			set_optval[64];
 27	socklen_t			set_optlen;
 28
 29	int				get_optname;
 30	int				get_level;
 31	const char			get_optval[64];
 32	socklen_t			get_optlen;
 33	socklen_t			get_optlen_ret;
 34
 35	enum sockopt_test_error		error;
 36} tests[] = {
 37
 38	/* ==================== getsockopt ====================  */
 39
 40	{
 41		.descr = "getsockopt: no expected_attach_type",
 42		.insns = {
 43			/* return 1 */
 44			BPF_MOV64_IMM(BPF_REG_0, 1),
 45			BPF_EXIT_INSN(),
 46
 47		},
 48		.attach_type = BPF_CGROUP_GETSOCKOPT,
 49		.expected_attach_type = 0,
 50		.error = DENY_LOAD,
 51	},
 52	{
 53		.descr = "getsockopt: wrong expected_attach_type",
 54		.insns = {
 55			/* return 1 */
 56			BPF_MOV64_IMM(BPF_REG_0, 1),
 57			BPF_EXIT_INSN(),
 58
 59		},
 60		.attach_type = BPF_CGROUP_GETSOCKOPT,
 61		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
 62		.error = DENY_ATTACH,
 63	},
 64	{
 65		.descr = "getsockopt: bypass bpf hook",
 66		.insns = {
 67			/* return 1 */
 68			BPF_MOV64_IMM(BPF_REG_0, 1),
 69			BPF_EXIT_INSN(),
 70		},
 71		.attach_type = BPF_CGROUP_GETSOCKOPT,
 72		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
 73
 74		.get_level = SOL_IP,
 75		.set_level = SOL_IP,
 76
 77		.get_optname = IP_TOS,
 78		.set_optname = IP_TOS,
 79
 80		.set_optval = { 1 << 3 },
 81		.set_optlen = 1,
 82
 83		.get_optval = { 1 << 3 },
 84		.get_optlen = 1,
 85	},
 86	{
 87		.descr = "getsockopt: return EPERM from bpf hook",
 88		.insns = {
 89			BPF_MOV64_IMM(BPF_REG_0, 0),
 90			BPF_EXIT_INSN(),
 91		},
 92		.attach_type = BPF_CGROUP_GETSOCKOPT,
 93		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
 94
 95		.get_level = SOL_IP,
 96		.get_optname = IP_TOS,
 97
 98		.get_optlen = 1,
 99		.error = EPERM_GETSOCKOPT,
100	},
101	{
102		.descr = "getsockopt: no optval bounds check, deny loading",
103		.insns = {
104			/* r6 = ctx->optval */
105			BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,
106				    offsetof(struct bpf_sockopt, optval)),
107
108			/* ctx->optval[0] = 0x80 */
109			BPF_MOV64_IMM(BPF_REG_0, 0x80),
110			BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_0, 0),
111
112			/* return 1 */
113			BPF_MOV64_IMM(BPF_REG_0, 1),
114			BPF_EXIT_INSN(),
115		},
116		.attach_type = BPF_CGROUP_GETSOCKOPT,
117		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
118		.error = DENY_LOAD,
119	},
120	{
121		.descr = "getsockopt: read ctx->level",
122		.insns = {
123			/* r6 = ctx->level */
124			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
125				    offsetof(struct bpf_sockopt, level)),
126
127			/* if (ctx->level == 123) { */
128			BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 123, 4),
129			/* ctx->retval = 0 */
130			BPF_MOV64_IMM(BPF_REG_0, 0),
131			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
132				    offsetof(struct bpf_sockopt, retval)),
133			/* return 1 */
134			BPF_MOV64_IMM(BPF_REG_0, 1),
135			BPF_JMP_A(1),
136			/* } else { */
137			/* return 0 */
138			BPF_MOV64_IMM(BPF_REG_0, 0),
139			/* } */
140			BPF_EXIT_INSN(),
141		},
142		.attach_type = BPF_CGROUP_GETSOCKOPT,
143		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
144
145		.get_level = 123,
146
147		.get_optlen = 1,
148	},
149	{
150		.descr = "getsockopt: deny writing to ctx->level",
151		.insns = {
152			/* ctx->level = 1 */
153			BPF_MOV64_IMM(BPF_REG_0, 1),
154			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
155				    offsetof(struct bpf_sockopt, level)),
156			BPF_EXIT_INSN(),
157		},
158		.attach_type = BPF_CGROUP_GETSOCKOPT,
159		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
160
161		.error = DENY_LOAD,
162	},
163	{
164		.descr = "getsockopt: read ctx->optname",
165		.insns = {
166			/* r6 = ctx->optname */
167			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
168				    offsetof(struct bpf_sockopt, optname)),
169
170			/* if (ctx->optname == 123) { */
171			BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 123, 4),
172			/* ctx->retval = 0 */
173			BPF_MOV64_IMM(BPF_REG_0, 0),
174			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
175				    offsetof(struct bpf_sockopt, retval)),
176			/* return 1 */
177			BPF_MOV64_IMM(BPF_REG_0, 1),
178			BPF_JMP_A(1),
179			/* } else { */
180			/* return 0 */
181			BPF_MOV64_IMM(BPF_REG_0, 0),
182			/* } */
183			BPF_EXIT_INSN(),
184		},
185		.attach_type = BPF_CGROUP_GETSOCKOPT,
186		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
187
188		.get_optname = 123,
189
190		.get_optlen = 1,
191	},
192	{
193		.descr = "getsockopt: read ctx->retval",
194		.insns = {
195			/* r6 = ctx->retval */
196			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
197				    offsetof(struct bpf_sockopt, retval)),
198
199			/* return 1 */
200			BPF_MOV64_IMM(BPF_REG_0, 1),
201			BPF_EXIT_INSN(),
202		},
203		.attach_type = BPF_CGROUP_GETSOCKOPT,
204		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
205
206		.get_level = SOL_IP,
207		.get_optname = IP_TOS,
208		.get_optlen = 1,
209	},
210	{
211		.descr = "getsockopt: deny writing to ctx->optname",
212		.insns = {
213			/* ctx->optname = 1 */
214			BPF_MOV64_IMM(BPF_REG_0, 1),
215			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
216				    offsetof(struct bpf_sockopt, optname)),
217			BPF_EXIT_INSN(),
218		},
219		.attach_type = BPF_CGROUP_GETSOCKOPT,
220		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
221
222		.error = DENY_LOAD,
223	},
224	{
225		.descr = "getsockopt: read ctx->optlen",
226		.insns = {
227			/* r6 = ctx->optlen */
228			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
229				    offsetof(struct bpf_sockopt, optlen)),
230
231			/* if (ctx->optlen == 64) { */
232			BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 64, 4),
233			/* ctx->retval = 0 */
234			BPF_MOV64_IMM(BPF_REG_0, 0),
235			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
236				    offsetof(struct bpf_sockopt, retval)),
237			/* return 1 */
238			BPF_MOV64_IMM(BPF_REG_0, 1),
239			BPF_JMP_A(1),
240			/* } else { */
241			/* return 0 */
242			BPF_MOV64_IMM(BPF_REG_0, 0),
243			/* } */
244			BPF_EXIT_INSN(),
245		},
246		.attach_type = BPF_CGROUP_GETSOCKOPT,
247		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
248
249		.get_optlen = 64,
250	},
251	{
252		.descr = "getsockopt: deny bigger ctx->optlen",
253		.insns = {
254			/* ctx->optlen = 65 */
255			BPF_MOV64_IMM(BPF_REG_0, 65),
256			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
257				    offsetof(struct bpf_sockopt, optlen)),
258
259			/* ctx->retval = 0 */
260			BPF_MOV64_IMM(BPF_REG_0, 0),
261			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
262				    offsetof(struct bpf_sockopt, retval)),
263
264			/* return 1 */
265			BPF_MOV64_IMM(BPF_REG_0, 1),
266			BPF_EXIT_INSN(),
267		},
268		.attach_type = BPF_CGROUP_GETSOCKOPT,
269		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
270
271		.get_optlen = 64,
272
273		.error = EFAULT_GETSOCKOPT,
274	},
275	{
276		.descr = "getsockopt: deny arbitrary ctx->retval",
277		.insns = {
278			/* ctx->retval = 123 */
279			BPF_MOV64_IMM(BPF_REG_0, 123),
280			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
281				    offsetof(struct bpf_sockopt, retval)),
282
283			/* return 1 */
284			BPF_MOV64_IMM(BPF_REG_0, 1),
285			BPF_EXIT_INSN(),
286		},
287		.attach_type = BPF_CGROUP_GETSOCKOPT,
288		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
289
290		.get_optlen = 64,
291
292		.error = EFAULT_GETSOCKOPT,
293	},
294	{
295		.descr = "getsockopt: support smaller ctx->optlen",
296		.insns = {
297			/* ctx->optlen = 32 */
298			BPF_MOV64_IMM(BPF_REG_0, 32),
299			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
300				    offsetof(struct bpf_sockopt, optlen)),
301			/* ctx->retval = 0 */
302			BPF_MOV64_IMM(BPF_REG_0, 0),
303			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
304				    offsetof(struct bpf_sockopt, retval)),
305			/* return 1 */
306			BPF_MOV64_IMM(BPF_REG_0, 1),
307			BPF_EXIT_INSN(),
308		},
309		.attach_type = BPF_CGROUP_GETSOCKOPT,
310		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
311
312		.get_optlen = 64,
313		.get_optlen_ret = 32,
314	},
315	{
316		.descr = "getsockopt: deny writing to ctx->optval",
317		.insns = {
318			/* ctx->optval = 1 */
319			BPF_MOV64_IMM(BPF_REG_0, 1),
320			BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
321				    offsetof(struct bpf_sockopt, optval)),
322			BPF_EXIT_INSN(),
323		},
324		.attach_type = BPF_CGROUP_GETSOCKOPT,
325		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
326
327		.error = DENY_LOAD,
328	},
329	{
330		.descr = "getsockopt: deny writing to ctx->optval_end",
331		.insns = {
332			/* ctx->optval_end = 1 */
333			BPF_MOV64_IMM(BPF_REG_0, 1),
334			BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
335				    offsetof(struct bpf_sockopt, optval_end)),
336			BPF_EXIT_INSN(),
337		},
338		.attach_type = BPF_CGROUP_GETSOCKOPT,
339		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
340
341		.error = DENY_LOAD,
342	},
343	{
344		.descr = "getsockopt: rewrite value",
345		.insns = {
346			/* r6 = ctx->optval */
347			BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,
348				    offsetof(struct bpf_sockopt, optval)),
349			/* r2 = ctx->optval */
350			BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
351			/* r6 = ctx->optval + 1 */
352			BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
353
354			/* r7 = ctx->optval_end */
355			BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_1,
356				    offsetof(struct bpf_sockopt, optval_end)),
357
358			/* if (ctx->optval + 1 <= ctx->optval_end) { */
359			BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 1),
360			/* ctx->optval[0] = 0xF0 */
361			BPF_ST_MEM(BPF_B, BPF_REG_2, 0, 0xF0),
362			/* } */
363
364			/* ctx->retval = 0 */
365			BPF_MOV64_IMM(BPF_REG_0, 0),
366			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
367				    offsetof(struct bpf_sockopt, retval)),
368
369			/* return 1*/
370			BPF_MOV64_IMM(BPF_REG_0, 1),
371			BPF_EXIT_INSN(),
372		},
373		.attach_type = BPF_CGROUP_GETSOCKOPT,
374		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
375
376		.get_level = SOL_IP,
377		.get_optname = IP_TOS,
378
379		.get_optval = { 0xF0 },
380		.get_optlen = 1,
381	},
382
383	/* ==================== setsockopt ====================  */
384
385	{
386		.descr = "setsockopt: no expected_attach_type",
387		.insns = {
388			/* return 1 */
389			BPF_MOV64_IMM(BPF_REG_0, 1),
390			BPF_EXIT_INSN(),
391
392		},
393		.attach_type = BPF_CGROUP_SETSOCKOPT,
394		.expected_attach_type = 0,
395		.error = DENY_LOAD,
396	},
397	{
398		.descr = "setsockopt: wrong expected_attach_type",
399		.insns = {
400			/* return 1 */
401			BPF_MOV64_IMM(BPF_REG_0, 1),
402			BPF_EXIT_INSN(),
403
404		},
405		.attach_type = BPF_CGROUP_SETSOCKOPT,
406		.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
407		.error = DENY_ATTACH,
408	},
409	{
410		.descr = "setsockopt: bypass bpf hook",
411		.insns = {
412			/* return 1 */
413			BPF_MOV64_IMM(BPF_REG_0, 1),
414			BPF_EXIT_INSN(),
415		},
416		.attach_type = BPF_CGROUP_SETSOCKOPT,
417		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
418
419		.get_level = SOL_IP,
420		.set_level = SOL_IP,
421
422		.get_optname = IP_TOS,
423		.set_optname = IP_TOS,
424
425		.set_optval = { 1 << 3 },
426		.set_optlen = 1,
427
428		.get_optval = { 1 << 3 },
429		.get_optlen = 1,
430	},
431	{
432		.descr = "setsockopt: return EPERM from bpf hook",
433		.insns = {
434			/* return 0 */
435			BPF_MOV64_IMM(BPF_REG_0, 0),
436			BPF_EXIT_INSN(),
437		},
438		.attach_type = BPF_CGROUP_SETSOCKOPT,
439		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
440
441		.set_level = SOL_IP,
442		.set_optname = IP_TOS,
443
444		.set_optlen = 1,
445		.error = EPERM_SETSOCKOPT,
446	},
447	{
448		.descr = "setsockopt: no optval bounds check, deny loading",
449		.insns = {
450			/* r6 = ctx->optval */
451			BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,
452				    offsetof(struct bpf_sockopt, optval)),
453
454			/* r0 = ctx->optval[0] */
455			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, 0),
456
457			/* return 1 */
458			BPF_MOV64_IMM(BPF_REG_0, 1),
459			BPF_EXIT_INSN(),
460		},
461		.attach_type = BPF_CGROUP_SETSOCKOPT,
462		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
463		.error = DENY_LOAD,
464	},
465	{
466		.descr = "setsockopt: read ctx->level",
467		.insns = {
468			/* r6 = ctx->level */
469			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
470				    offsetof(struct bpf_sockopt, level)),
471
472			/* if (ctx->level == 123) { */
473			BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 123, 4),
474			/* ctx->optlen = -1 */
475			BPF_MOV64_IMM(BPF_REG_0, -1),
476			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
477				    offsetof(struct bpf_sockopt, optlen)),
478			/* return 1 */
479			BPF_MOV64_IMM(BPF_REG_0, 1),
480			BPF_JMP_A(1),
481			/* } else { */
482			/* return 0 */
483			BPF_MOV64_IMM(BPF_REG_0, 0),
484			/* } */
485			BPF_EXIT_INSN(),
486		},
487		.attach_type = BPF_CGROUP_SETSOCKOPT,
488		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
489
490		.set_level = 123,
491
492		.set_optlen = 1,
493	},
494	{
495		.descr = "setsockopt: allow changing ctx->level",
496		.insns = {
497			/* ctx->level = SOL_IP */
498			BPF_MOV64_IMM(BPF_REG_0, SOL_IP),
499			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
500				    offsetof(struct bpf_sockopt, level)),
501			/* return 1 */
502			BPF_MOV64_IMM(BPF_REG_0, 1),
503			BPF_EXIT_INSN(),
504		},
505		.attach_type = BPF_CGROUP_SETSOCKOPT,
506		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
507
508		.get_level = SOL_IP,
509		.set_level = 234, /* should be rewritten to SOL_IP */
510
511		.get_optname = IP_TOS,
512		.set_optname = IP_TOS,
513
514		.set_optval = { 1 << 3 },
515		.set_optlen = 1,
516		.get_optval = { 1 << 3 },
517		.get_optlen = 1,
518	},
519	{
520		.descr = "setsockopt: read ctx->optname",
521		.insns = {
522			/* r6 = ctx->optname */
523			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
524				    offsetof(struct bpf_sockopt, optname)),
525
526			/* if (ctx->optname == 123) { */
527			BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 123, 4),
528			/* ctx->optlen = -1 */
529			BPF_MOV64_IMM(BPF_REG_0, -1),
530			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
531				    offsetof(struct bpf_sockopt, optlen)),
532			/* return 1 */
533			BPF_MOV64_IMM(BPF_REG_0, 1),
534			BPF_JMP_A(1),
535			/* } else { */
536			/* return 0 */
537			BPF_MOV64_IMM(BPF_REG_0, 0),
538			/* } */
539			BPF_EXIT_INSN(),
540		},
541		.attach_type = BPF_CGROUP_SETSOCKOPT,
542		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
543
544		.set_optname = 123,
545
546		.set_optlen = 1,
547	},
548	{
549		.descr = "setsockopt: allow changing ctx->optname",
550		.insns = {
551			/* ctx->optname = IP_TOS */
552			BPF_MOV64_IMM(BPF_REG_0, IP_TOS),
553			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
554				    offsetof(struct bpf_sockopt, optname)),
555			/* return 1 */
556			BPF_MOV64_IMM(BPF_REG_0, 1),
557			BPF_EXIT_INSN(),
558		},
559		.attach_type = BPF_CGROUP_SETSOCKOPT,
560		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
561
562		.get_level = SOL_IP,
563		.set_level = SOL_IP,
564
565		.get_optname = IP_TOS,
566		.set_optname = 456, /* should be rewritten to IP_TOS */
567
568		.set_optval = { 1 << 3 },
569		.set_optlen = 1,
570		.get_optval = { 1 << 3 },
571		.get_optlen = 1,
572	},
573	{
574		.descr = "setsockopt: read ctx->optlen",
575		.insns = {
576			/* r6 = ctx->optlen */
577			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
578				    offsetof(struct bpf_sockopt, optlen)),
579
580			/* if (ctx->optlen == 64) { */
581			BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 64, 4),
582			/* ctx->optlen = -1 */
583			BPF_MOV64_IMM(BPF_REG_0, -1),
584			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
585				    offsetof(struct bpf_sockopt, optlen)),
586			/* return 1 */
587			BPF_MOV64_IMM(BPF_REG_0, 1),
588			BPF_JMP_A(1),
589			/* } else { */
590			/* return 0 */
591			BPF_MOV64_IMM(BPF_REG_0, 0),
592			/* } */
593			BPF_EXIT_INSN(),
594		},
595		.attach_type = BPF_CGROUP_SETSOCKOPT,
596		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
597
598		.set_optlen = 64,
599	},
600	{
601		.descr = "setsockopt: ctx->optlen == -1 is ok",
602		.insns = {
603			/* ctx->optlen = -1 */
604			BPF_MOV64_IMM(BPF_REG_0, -1),
605			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
606				    offsetof(struct bpf_sockopt, optlen)),
607			/* return 1 */
608			BPF_MOV64_IMM(BPF_REG_0, 1),
609			BPF_EXIT_INSN(),
610		},
611		.attach_type = BPF_CGROUP_SETSOCKOPT,
612		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
613
614		.set_optlen = 64,
615	},
616	{
617		.descr = "setsockopt: deny ctx->optlen < 0 (except -1)",
618		.insns = {
619			/* ctx->optlen = -2 */
620			BPF_MOV64_IMM(BPF_REG_0, -2),
621			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
622				    offsetof(struct bpf_sockopt, optlen)),
623			/* return 1 */
624			BPF_MOV64_IMM(BPF_REG_0, 1),
625			BPF_EXIT_INSN(),
626		},
627		.attach_type = BPF_CGROUP_SETSOCKOPT,
628		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
629
630		.set_optlen = 4,
631
632		.error = EFAULT_SETSOCKOPT,
633	},
634	{
635		.descr = "setsockopt: deny ctx->optlen > input optlen",
636		.insns = {
637			/* ctx->optlen = 65 */
638			BPF_MOV64_IMM(BPF_REG_0, 65),
639			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
640				    offsetof(struct bpf_sockopt, optlen)),
641			BPF_MOV64_IMM(BPF_REG_0, 1),
642			BPF_EXIT_INSN(),
643		},
644		.attach_type = BPF_CGROUP_SETSOCKOPT,
645		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
646
647		.set_optlen = 64,
648
649		.error = EFAULT_SETSOCKOPT,
650	},
651	{
652		.descr = "setsockopt: allow changing ctx->optlen within bounds",
653		.insns = {
654			/* r6 = ctx->optval */
655			BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,
656				    offsetof(struct bpf_sockopt, optval)),
657			/* r2 = ctx->optval */
658			BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
659			/* r6 = ctx->optval + 1 */
660			BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
661
662			/* r7 = ctx->optval_end */
663			BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_1,
664				    offsetof(struct bpf_sockopt, optval_end)),
665
666			/* if (ctx->optval + 1 <= ctx->optval_end) { */
667			BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 1),
668			/* ctx->optval[0] = 1 << 3 */
669			BPF_ST_MEM(BPF_B, BPF_REG_2, 0, 1 << 3),
670			/* } */
671
672			/* ctx->optlen = 1 */
673			BPF_MOV64_IMM(BPF_REG_0, 1),
674			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
675				    offsetof(struct bpf_sockopt, optlen)),
676
677			/* return 1*/
678			BPF_MOV64_IMM(BPF_REG_0, 1),
679			BPF_EXIT_INSN(),
680		},
681		.attach_type = BPF_CGROUP_SETSOCKOPT,
682		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
683
684		.get_level = SOL_IP,
685		.set_level = SOL_IP,
686
687		.get_optname = IP_TOS,
688		.set_optname = IP_TOS,
689
690		.set_optval = { 1, 1, 1, 1 },
691		.set_optlen = 4,
692		.get_optval = { 1 << 3 },
693		.get_optlen = 1,
694	},
695	{
696		.descr = "setsockopt: deny write ctx->retval",
697		.insns = {
698			/* ctx->retval = 0 */
699			BPF_MOV64_IMM(BPF_REG_0, 0),
700			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
701				    offsetof(struct bpf_sockopt, retval)),
702
703			/* return 1 */
704			BPF_MOV64_IMM(BPF_REG_0, 1),
705			BPF_EXIT_INSN(),
706		},
707		.attach_type = BPF_CGROUP_SETSOCKOPT,
708		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
709
710		.error = DENY_LOAD,
711	},
712	{
713		.descr = "setsockopt: deny read ctx->retval",
714		.insns = {
715			/* r6 = ctx->retval */
716			BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
717				    offsetof(struct bpf_sockopt, retval)),
718
719			/* return 1 */
720			BPF_MOV64_IMM(BPF_REG_0, 1),
721			BPF_EXIT_INSN(),
722		},
723		.attach_type = BPF_CGROUP_SETSOCKOPT,
724		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
725
726		.error = DENY_LOAD,
727	},
728	{
729		.descr = "setsockopt: deny writing to ctx->optval",
730		.insns = {
731			/* ctx->optval = 1 */
732			BPF_MOV64_IMM(BPF_REG_0, 1),
733			BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
734				    offsetof(struct bpf_sockopt, optval)),
735			BPF_EXIT_INSN(),
736		},
737		.attach_type = BPF_CGROUP_SETSOCKOPT,
738		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
739
740		.error = DENY_LOAD,
741	},
742	{
743		.descr = "setsockopt: deny writing to ctx->optval_end",
744		.insns = {
745			/* ctx->optval_end = 1 */
746			BPF_MOV64_IMM(BPF_REG_0, 1),
747			BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
748				    offsetof(struct bpf_sockopt, optval_end)),
749			BPF_EXIT_INSN(),
750		},
751		.attach_type = BPF_CGROUP_SETSOCKOPT,
752		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
753
754		.error = DENY_LOAD,
755	},
756	{
757		.descr = "setsockopt: allow IP_TOS <= 128",
758		.insns = {
759			/* r6 = ctx->optval */
760			BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,
761				    offsetof(struct bpf_sockopt, optval)),
762			/* r7 = ctx->optval + 1 */
763			BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
764			BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 1),
765
766			/* r8 = ctx->optval_end */
767			BPF_LDX_MEM(BPF_DW, BPF_REG_8, BPF_REG_1,
768				    offsetof(struct bpf_sockopt, optval_end)),
769
770			/* if (ctx->optval + 1 <= ctx->optval_end) { */
771			BPF_JMP_REG(BPF_JGT, BPF_REG_7, BPF_REG_8, 4),
772
773			/* r9 = ctx->optval[0] */
774			BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_6, 0),
775
776			/* if (ctx->optval[0] < 128) */
777			BPF_JMP_IMM(BPF_JGT, BPF_REG_9, 128, 2),
778			BPF_MOV64_IMM(BPF_REG_0, 1),
779			BPF_JMP_A(1),
780			/* } */
781
782			/* } else { */
783			BPF_MOV64_IMM(BPF_REG_0, 0),
784			/* } */
785
786			BPF_EXIT_INSN(),
787		},
788		.attach_type = BPF_CGROUP_SETSOCKOPT,
789		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
790
791		.get_level = SOL_IP,
792		.set_level = SOL_IP,
793
794		.get_optname = IP_TOS,
795		.set_optname = IP_TOS,
796
797		.set_optval = { 0x80 },
798		.set_optlen = 1,
799		.get_optval = { 0x80 },
800		.get_optlen = 1,
801	},
802	{
803		.descr = "setsockopt: deny IP_TOS > 128",
804		.insns = {
805			/* r6 = ctx->optval */
806			BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,
807				    offsetof(struct bpf_sockopt, optval)),
808			/* r7 = ctx->optval + 1 */
809			BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
810			BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 1),
811
812			/* r8 = ctx->optval_end */
813			BPF_LDX_MEM(BPF_DW, BPF_REG_8, BPF_REG_1,
814				    offsetof(struct bpf_sockopt, optval_end)),
815
816			/* if (ctx->optval + 1 <= ctx->optval_end) { */
817			BPF_JMP_REG(BPF_JGT, BPF_REG_7, BPF_REG_8, 4),
818
819			/* r9 = ctx->optval[0] */
820			BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_6, 0),
821
822			/* if (ctx->optval[0] < 128) */
823			BPF_JMP_IMM(BPF_JGT, BPF_REG_9, 128, 2),
824			BPF_MOV64_IMM(BPF_REG_0, 1),
825			BPF_JMP_A(1),
826			/* } */
827
828			/* } else { */
829			BPF_MOV64_IMM(BPF_REG_0, 0),
830			/* } */
831
832			BPF_EXIT_INSN(),
833		},
834		.attach_type = BPF_CGROUP_SETSOCKOPT,
835		.expected_attach_type = BPF_CGROUP_SETSOCKOPT,
836
837		.get_level = SOL_IP,
838		.set_level = SOL_IP,
839
840		.get_optname = IP_TOS,
841		.set_optname = IP_TOS,
842
843		.set_optval = { 0x81 },
844		.set_optlen = 1,
845		.get_optval = { 0x00 },
846		.get_optlen = 1,
847
848		.error = EPERM_SETSOCKOPT,
849	},
850};
851
852static int load_prog(const struct bpf_insn *insns,
853		     enum bpf_attach_type expected_attach_type)
854{
855	struct bpf_load_program_attr attr = {
856		.prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT,
857		.expected_attach_type = expected_attach_type,
858		.insns = insns,
859		.license = "GPL",
860		.log_level = 2,
861	};
862	int fd;
863
864	for (;
865	     insns[attr.insns_cnt].code != (BPF_JMP | BPF_EXIT);
866	     attr.insns_cnt++) {
867	}
868	attr.insns_cnt++;
869
870	fd = bpf_load_program_xattr(&attr, bpf_log_buf, sizeof(bpf_log_buf));
871	if (verbose && fd < 0)
872		fprintf(stderr, "%s\n", bpf_log_buf);
873
874	return fd;
875}
876
877static int run_test(int cgroup_fd, struct sockopt_test *test)
878{
879	int sock_fd, err, prog_fd;
880	void *optval = NULL;
881	int ret = 0;
882
883	prog_fd = load_prog(test->insns, test->expected_attach_type);
884	if (prog_fd < 0) {
885		if (test->error == DENY_LOAD)
886			return 0;
887
888		log_err("Failed to load BPF program");
889		return -1;
890	}
891
892	err = bpf_prog_attach(prog_fd, cgroup_fd, test->attach_type, 0);
893	if (err < 0) {
894		if (test->error == DENY_ATTACH)
895			goto close_prog_fd;
896
897		log_err("Failed to attach BPF program");
898		ret = -1;
899		goto close_prog_fd;
900	}
901
902	sock_fd = socket(AF_INET, SOCK_STREAM, 0);
903	if (sock_fd < 0) {
904		log_err("Failed to create AF_INET socket");
905		ret = -1;
906		goto detach_prog;
907	}
908
909	if (test->set_optlen) {
910		err = setsockopt(sock_fd, test->set_level, test->set_optname,
911				 test->set_optval, test->set_optlen);
912		if (err) {
913			if (errno == EPERM && test->error == EPERM_SETSOCKOPT)
914				goto close_sock_fd;
915			if (errno == EFAULT && test->error == EFAULT_SETSOCKOPT)
916				goto free_optval;
917
918			log_err("Failed to call setsockopt");
919			ret = -1;
920			goto close_sock_fd;
921		}
922	}
923
924	if (test->get_optlen) {
925		optval = malloc(test->get_optlen);
926		socklen_t optlen = test->get_optlen;
927		socklen_t expected_get_optlen = test->get_optlen_ret ?:
928			test->get_optlen;
929
930		err = getsockopt(sock_fd, test->get_level, test->get_optname,
931				 optval, &optlen);
932		if (err) {
933			if (errno == EPERM && test->error == EPERM_GETSOCKOPT)
934				goto free_optval;
935			if (errno == EFAULT && test->error == EFAULT_GETSOCKOPT)
936				goto free_optval;
937
938			log_err("Failed to call getsockopt");
939			ret = -1;
940			goto free_optval;
941		}
942
943		if (optlen != expected_get_optlen) {
944			errno = 0;
945			log_err("getsockopt returned unexpected optlen");
946			ret = -1;
947			goto free_optval;
948		}
949
950		if (memcmp(optval, test->get_optval, optlen) != 0) {
951			errno = 0;
952			log_err("getsockopt returned unexpected optval");
953			ret = -1;
954			goto free_optval;
955		}
956	}
957
958	ret = test->error != OK;
959
960free_optval:
961	free(optval);
962close_sock_fd:
963	close(sock_fd);
964detach_prog:
965	bpf_prog_detach2(prog_fd, cgroup_fd, test->attach_type);
966close_prog_fd:
967	close(prog_fd);
968	return ret;
969}
970
971void test_sockopt(void)
972{
973	int cgroup_fd, i;
974
975	cgroup_fd = test__join_cgroup("/sockopt");
976	if (CHECK_FAIL(cgroup_fd < 0))
977		return;
978
979	for (i = 0; i < ARRAY_SIZE(tests); i++) {
980		test__start_subtest(tests[i].descr);
981		CHECK_FAIL(run_test(cgroup_fd, &tests[i]));
982	}
983
984	close(cgroup_fd);
985}