Linux Audio

Check our new training course

In-person Linux kernel drivers training

Jun 16-20, 2025
Register
Loading...
v6.8
  1// SPDX-License-Identifier: GPL-2.0
  2// Copyright (c) 2018 Facebook
  3
  4#include <stdio.h>
  5#include <unistd.h>
  6
  7#include <arpa/inet.h>
  8#include <sys/types.h>
  9#include <sys/socket.h>
 10
 11#include <linux/filter.h>
 12
 13#include <bpf/bpf.h>
 14
 15#include "cgroup_helpers.h"
 16#include <bpf/bpf_endian.h>
 17#include "bpf_util.h"
 
 
 
 18
 19#define CG_PATH		"/foo"
 20#define MAX_INSNS	512
 21
 22char bpf_log_buf[BPF_LOG_BUF_SIZE];
 23static bool verbose = false;
 24
 25struct sock_test {
 26	const char *descr;
 27	/* BPF prog properties */
 28	struct bpf_insn	insns[MAX_INSNS];
 29	enum bpf_attach_type expected_attach_type;
 30	enum bpf_attach_type attach_type;
 31	/* Socket properties */
 32	int domain;
 33	int type;
 34	/* Endpoint to bind() to */
 35	const char *ip;
 36	unsigned short port;
 37	unsigned short port_retry;
 38	/* Expected test result */
 39	enum {
 40		LOAD_REJECT,
 41		ATTACH_REJECT,
 42		BIND_REJECT,
 43		SUCCESS,
 44		RETRY_SUCCESS,
 45		RETRY_REJECT
 46	} result;
 47};
 48
 49static struct sock_test tests[] = {
 50	{
 51		.descr = "bind4 load with invalid access: src_ip6",
 52		.insns = {
 53			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 54			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
 55				    offsetof(struct bpf_sock, src_ip6[0])),
 56			BPF_MOV64_IMM(BPF_REG_0, 1),
 57			BPF_EXIT_INSN(),
 58		},
 59		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
 60		.attach_type = BPF_CGROUP_INET4_POST_BIND,
 61		.result = LOAD_REJECT,
 
 
 
 
 62	},
 63	{
 64		.descr = "bind4 load with invalid access: mark",
 65		.insns = {
 66			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 67			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
 68				    offsetof(struct bpf_sock, mark)),
 69			BPF_MOV64_IMM(BPF_REG_0, 1),
 70			BPF_EXIT_INSN(),
 71		},
 72		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
 73		.attach_type = BPF_CGROUP_INET4_POST_BIND,
 74		.result = LOAD_REJECT,
 
 
 
 
 75	},
 76	{
 77		.descr = "bind6 load with invalid access: src_ip4",
 78		.insns = {
 79			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 80			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
 81				    offsetof(struct bpf_sock, src_ip4)),
 82			BPF_MOV64_IMM(BPF_REG_0, 1),
 83			BPF_EXIT_INSN(),
 84		},
 85		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
 86		.attach_type = BPF_CGROUP_INET6_POST_BIND,
 87		.result = LOAD_REJECT,
 
 
 
 
 88	},
 89	{
 90		.descr = "sock_create load with invalid access: src_port",
 91		.insns = {
 92			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 93			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
 94				    offsetof(struct bpf_sock, src_port)),
 95			BPF_MOV64_IMM(BPF_REG_0, 1),
 96			BPF_EXIT_INSN(),
 97		},
 98		.expected_attach_type = BPF_CGROUP_INET_SOCK_CREATE,
 99		.attach_type = BPF_CGROUP_INET_SOCK_CREATE,
100		.result = LOAD_REJECT,
 
 
 
 
101	},
102	{
103		.descr = "sock_create load w/o expected_attach_type (compat mode)",
104		.insns = {
105			BPF_MOV64_IMM(BPF_REG_0, 1),
106			BPF_EXIT_INSN(),
107		},
108		.expected_attach_type = 0,
109		.attach_type = BPF_CGROUP_INET_SOCK_CREATE,
110		.domain = AF_INET,
111		.type = SOCK_STREAM,
112		.ip = "127.0.0.1",
113		.port = 8097,
114		.result = SUCCESS,
115	},
116	{
117		.descr = "sock_create load w/ expected_attach_type",
118		.insns = {
119			BPF_MOV64_IMM(BPF_REG_0, 1),
120			BPF_EXIT_INSN(),
121		},
122		.expected_attach_type = BPF_CGROUP_INET_SOCK_CREATE,
123		.attach_type = BPF_CGROUP_INET_SOCK_CREATE,
124		.domain = AF_INET,
125		.type = SOCK_STREAM,
126		.ip = "127.0.0.1",
127		.port = 8097,
128		.result = SUCCESS,
129	},
130	{
131		.descr = "attach type mismatch bind4 vs bind6",
132		.insns = {
133			BPF_MOV64_IMM(BPF_REG_0, 1),
134			BPF_EXIT_INSN(),
135		},
136		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
137		.attach_type = BPF_CGROUP_INET6_POST_BIND,
138		.result = ATTACH_REJECT,
 
 
 
 
139	},
140	{
141		.descr = "attach type mismatch bind6 vs bind4",
142		.insns = {
143			BPF_MOV64_IMM(BPF_REG_0, 1),
144			BPF_EXIT_INSN(),
145		},
146		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
147		.attach_type = BPF_CGROUP_INET4_POST_BIND,
148		.result = ATTACH_REJECT,
 
 
 
 
149	},
150	{
151		.descr = "attach type mismatch default vs bind4",
152		.insns = {
153			BPF_MOV64_IMM(BPF_REG_0, 1),
154			BPF_EXIT_INSN(),
155		},
156		.expected_attach_type = 0,
157		.attach_type = BPF_CGROUP_INET4_POST_BIND,
158		.result = ATTACH_REJECT,
 
 
 
 
159	},
160	{
161		.descr = "attach type mismatch bind6 vs sock_create",
162		.insns = {
163			BPF_MOV64_IMM(BPF_REG_0, 1),
164			BPF_EXIT_INSN(),
165		},
166		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
167		.attach_type = BPF_CGROUP_INET_SOCK_CREATE,
168		.result = ATTACH_REJECT,
 
 
 
 
169	},
170	{
171		.descr = "bind4 reject all",
172		.insns = {
173			BPF_MOV64_IMM(BPF_REG_0, 0),
174			BPF_EXIT_INSN(),
175		},
176		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
177		.attach_type = BPF_CGROUP_INET4_POST_BIND,
178		.domain = AF_INET,
179		.type = SOCK_STREAM,
180		.ip = "0.0.0.0",
181		.result = BIND_REJECT,
 
182	},
183	{
184		.descr = "bind6 reject all",
185		.insns = {
186			BPF_MOV64_IMM(BPF_REG_0, 0),
187			BPF_EXIT_INSN(),
188		},
189		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
190		.attach_type = BPF_CGROUP_INET6_POST_BIND,
191		.domain = AF_INET6,
192		.type = SOCK_STREAM,
193		.ip = "::",
194		.result = BIND_REJECT,
 
195	},
196	{
197		.descr = "bind6 deny specific IP & port",
198		.insns = {
199			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
200
201			/* if (ip == expected && port == expected) */
202			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
203				    offsetof(struct bpf_sock, src_ip6[3])),
204			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
205				    __bpf_constant_ntohl(0x00000001), 4),
206			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
207				    offsetof(struct bpf_sock, src_port)),
208			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
209
210			/* return DENY; */
211			BPF_MOV64_IMM(BPF_REG_0, 0),
212			BPF_JMP_A(1),
213
214			/* else return ALLOW; */
215			BPF_MOV64_IMM(BPF_REG_0, 1),
216			BPF_EXIT_INSN(),
217		},
218		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
219		.attach_type = BPF_CGROUP_INET6_POST_BIND,
220		.domain = AF_INET6,
221		.type = SOCK_STREAM,
222		.ip = "::1",
223		.port = 8193,
224		.result = BIND_REJECT,
225	},
226	{
227		.descr = "bind4 allow specific IP & port",
228		.insns = {
229			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
230
231			/* if (ip == expected && port == expected) */
232			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
233				    offsetof(struct bpf_sock, src_ip4)),
234			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
235				    __bpf_constant_ntohl(0x7F000001), 4),
236			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
237				    offsetof(struct bpf_sock, src_port)),
238			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
239
240			/* return ALLOW; */
241			BPF_MOV64_IMM(BPF_REG_0, 1),
242			BPF_JMP_A(1),
243
244			/* else return DENY; */
245			BPF_MOV64_IMM(BPF_REG_0, 0),
246			BPF_EXIT_INSN(),
247		},
248		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
249		.attach_type = BPF_CGROUP_INET4_POST_BIND,
250		.domain = AF_INET,
251		.type = SOCK_STREAM,
252		.ip = "127.0.0.1",
253		.port = 4098,
254		.result = SUCCESS,
255	},
256	{
257		.descr = "bind4 deny specific IP & port of TCP, and retry",
258		.insns = {
259			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
260
261			/* if (ip == expected && port == expected) */
262			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
263				    offsetof(struct bpf_sock, src_ip4)),
264			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
265				    __bpf_constant_ntohl(0x7F000001), 4),
266			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
267				    offsetof(struct bpf_sock, src_port)),
268			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
269
270			/* return DENY; */
271			BPF_MOV64_IMM(BPF_REG_0, 0),
272			BPF_JMP_A(1),
273
274			/* else return ALLOW; */
275			BPF_MOV64_IMM(BPF_REG_0, 1),
276			BPF_EXIT_INSN(),
277		},
278		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
279		.attach_type = BPF_CGROUP_INET4_POST_BIND,
280		.domain = AF_INET,
281		.type = SOCK_STREAM,
282		.ip = "127.0.0.1",
283		.port = 4098,
284		.port_retry = 5000,
285		.result = RETRY_SUCCESS,
286	},
287	{
288		.descr = "bind4 deny specific IP & port of UDP, and retry",
289		.insns = {
290			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
291
292			/* if (ip == expected && port == expected) */
293			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
294				    offsetof(struct bpf_sock, src_ip4)),
295			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
296				    __bpf_constant_ntohl(0x7F000001), 4),
297			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
298				    offsetof(struct bpf_sock, src_port)),
299			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
300
301			/* return DENY; */
302			BPF_MOV64_IMM(BPF_REG_0, 0),
303			BPF_JMP_A(1),
304
305			/* else return ALLOW; */
306			BPF_MOV64_IMM(BPF_REG_0, 1),
307			BPF_EXIT_INSN(),
308		},
309		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
310		.attach_type = BPF_CGROUP_INET4_POST_BIND,
311		.domain = AF_INET,
312		.type = SOCK_DGRAM,
313		.ip = "127.0.0.1",
314		.port = 4098,
315		.port_retry = 5000,
316		.result = RETRY_SUCCESS,
317	},
318	{
319		.descr = "bind6 deny specific IP & port, and retry",
320		.insns = {
321			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
322
323			/* if (ip == expected && port == expected) */
324			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
325				    offsetof(struct bpf_sock, src_ip6[3])),
326			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
327				    __bpf_constant_ntohl(0x00000001), 4),
328			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
329				    offsetof(struct bpf_sock, src_port)),
330			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
331
332			/* return DENY; */
333			BPF_MOV64_IMM(BPF_REG_0, 0),
334			BPF_JMP_A(1),
335
336			/* else return ALLOW; */
337			BPF_MOV64_IMM(BPF_REG_0, 1),
338			BPF_EXIT_INSN(),
339		},
340		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
341		.attach_type = BPF_CGROUP_INET6_POST_BIND,
342		.domain = AF_INET6,
343		.type = SOCK_STREAM,
344		.ip = "::1",
345		.port = 8193,
346		.port_retry = 9000,
347		.result = RETRY_SUCCESS,
348	},
349	{
350		.descr = "bind4 allow all",
351		.insns = {
352			BPF_MOV64_IMM(BPF_REG_0, 1),
353			BPF_EXIT_INSN(),
354		},
355		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
356		.attach_type = BPF_CGROUP_INET4_POST_BIND,
357		.domain = AF_INET,
358		.type = SOCK_STREAM,
359		.ip = "0.0.0.0",
360		.result = SUCCESS,
 
361	},
362	{
363		.descr = "bind6 allow all",
364		.insns = {
365			BPF_MOV64_IMM(BPF_REG_0, 1),
366			BPF_EXIT_INSN(),
367		},
368		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
369		.attach_type = BPF_CGROUP_INET6_POST_BIND,
370		.domain = AF_INET6,
371		.type = SOCK_STREAM,
372		.ip = "::",
373		.result = SUCCESS,
 
374	},
375};
376
377static size_t probe_prog_length(const struct bpf_insn *fp)
378{
379	size_t len;
380
381	for (len = MAX_INSNS - 1; len > 0; --len)
382		if (fp[len].code != 0 || fp[len].imm != 0)
383			break;
384	return len + 1;
385}
386
387static int load_sock_prog(const struct bpf_insn *prog,
388			  enum bpf_attach_type attach_type)
389{
390	LIBBPF_OPTS(bpf_prog_load_opts, opts);
391	int ret, insn_cnt;
392
393	insn_cnt = probe_prog_length(prog);
 
 
 
 
 
394
395	opts.expected_attach_type = attach_type;
396	opts.log_buf = bpf_log_buf;
397	opts.log_size = BPF_LOG_BUF_SIZE;
398	opts.log_level = 2;
399
400	ret = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCK, NULL, "GPL", prog, insn_cnt, &opts);
401	if (verbose && ret < 0)
402		fprintf(stderr, "%s\n", bpf_log_buf);
403
404	return ret;
405}
406
407static int attach_sock_prog(int cgfd, int progfd,
408			    enum bpf_attach_type attach_type)
409{
410	return bpf_prog_attach(progfd, cgfd, attach_type, BPF_F_ALLOW_OVERRIDE);
411}
412
413static int bind_sock(int domain, int type, const char *ip,
414		     unsigned short port, unsigned short port_retry)
415{
416	struct sockaddr_storage addr;
417	struct sockaddr_in6 *addr6;
418	struct sockaddr_in *addr4;
419	int sockfd = -1;
420	socklen_t len;
421	int res = SUCCESS;
422
423	sockfd = socket(domain, type, 0);
424	if (sockfd < 0)
425		goto err;
426
427	memset(&addr, 0, sizeof(addr));
428
429	if (domain == AF_INET) {
430		len = sizeof(struct sockaddr_in);
431		addr4 = (struct sockaddr_in *)&addr;
432		addr4->sin_family = domain;
433		addr4->sin_port = htons(port);
434		if (inet_pton(domain, ip, (void *)&addr4->sin_addr) != 1)
435			goto err;
436	} else if (domain == AF_INET6) {
437		len = sizeof(struct sockaddr_in6);
438		addr6 = (struct sockaddr_in6 *)&addr;
439		addr6->sin6_family = domain;
440		addr6->sin6_port = htons(port);
441		if (inet_pton(domain, ip, (void *)&addr6->sin6_addr) != 1)
442			goto err;
443	} else {
444		goto err;
445	}
446
447	if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1) {
448		/* sys_bind() may fail for different reasons, errno has to be
449		 * checked to confirm that BPF program rejected it.
450		 */
451		if (errno != EPERM)
452			goto err;
453		if (port_retry)
454			goto retry;
455		res = BIND_REJECT;
456		goto out;
457	}
458
459	goto out;
460retry:
461	if (domain == AF_INET)
462		addr4->sin_port = htons(port_retry);
463	else
464		addr6->sin6_port = htons(port_retry);
465	if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1) {
466		if (errno != EPERM)
467			goto err;
468		res = RETRY_REJECT;
469	} else {
470		res = RETRY_SUCCESS;
471	}
472	goto out;
473err:
474	res = -1;
475out:
476	close(sockfd);
477	return res;
478}
479
480static int run_test_case(int cgfd, const struct sock_test *test)
481{
482	int progfd = -1;
483	int err = 0;
484	int res;
485
486	printf("Test case: %s .. ", test->descr);
487	progfd = load_sock_prog(test->insns, test->expected_attach_type);
488	if (progfd < 0) {
489		if (test->result == LOAD_REJECT)
490			goto out;
491		else
492			goto err;
493	}
494
495	if (attach_sock_prog(cgfd, progfd, test->attach_type) < 0) {
496		if (test->result == ATTACH_REJECT)
497			goto out;
498		else
499			goto err;
500	}
501
502	res = bind_sock(test->domain, test->type, test->ip, test->port,
503			test->port_retry);
504	if (res > 0 && test->result == res)
505		goto out;
 
 
 
 
 
 
506
 
 
 
 
507err:
508	err = -1;
509out:
510	/* Detaching w/o checking return code: best effort attempt. */
511	if (progfd != -1)
512		bpf_prog_detach(cgfd, test->attach_type);
513	close(progfd);
514	printf("[%s]\n", err ? "FAIL" : "PASS");
515	return err;
516}
517
518static int run_tests(int cgfd)
519{
520	int passes = 0;
521	int fails = 0;
522	int i;
523
524	for (i = 0; i < ARRAY_SIZE(tests); ++i) {
525		if (run_test_case(cgfd, &tests[i]))
526			++fails;
527		else
528			++passes;
529	}
530	printf("Summary: %d PASSED, %d FAILED\n", passes, fails);
531	return fails ? -1 : 0;
532}
533
534int main(int argc, char **argv)
535{
536	int cgfd = -1;
537	int err = 0;
538
539	cgfd = cgroup_setup_and_join(CG_PATH);
540	if (cgfd < 0)
541		goto err;
542
543	/* Use libbpf 1.0 API mode */
544	libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
 
 
 
 
545
546	if (run_tests(cgfd))
547		goto err;
548
549	goto out;
550err:
551	err = -1;
552out:
553	close(cgfd);
554	cleanup_cgroup_environment();
555	return err;
556}
v4.17
  1// SPDX-License-Identifier: GPL-2.0
  2// Copyright (c) 2018 Facebook
  3
  4#include <stdio.h>
  5#include <unistd.h>
  6
  7#include <arpa/inet.h>
  8#include <sys/types.h>
  9#include <sys/socket.h>
 10
 11#include <linux/filter.h>
 12
 13#include <bpf/bpf.h>
 14
 15#include "cgroup_helpers.h"
 16#include "bpf_rlimit.h"
 17
 18#ifndef ARRAY_SIZE
 19# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
 20#endif
 21
 22#define CG_PATH		"/foo"
 23#define MAX_INSNS	512
 24
 25char bpf_log_buf[BPF_LOG_BUF_SIZE];
 
 26
 27struct sock_test {
 28	const char *descr;
 29	/* BPF prog properties */
 30	struct bpf_insn	insns[MAX_INSNS];
 31	enum bpf_attach_type expected_attach_type;
 32	enum bpf_attach_type attach_type;
 33	/* Socket properties */
 34	int domain;
 35	int type;
 36	/* Endpoint to bind() to */
 37	const char *ip;
 38	unsigned short port;
 
 39	/* Expected test result */
 40	enum {
 41		LOAD_REJECT,
 42		ATTACH_REJECT,
 43		BIND_REJECT,
 44		SUCCESS,
 
 
 45	} result;
 46};
 47
 48static struct sock_test tests[] = {
 49	{
 50		"bind4 load with invalid access: src_ip6",
 51		.insns = {
 52			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 53			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
 54				    offsetof(struct bpf_sock, src_ip6[0])),
 55			BPF_MOV64_IMM(BPF_REG_0, 1),
 56			BPF_EXIT_INSN(),
 57		},
 58		BPF_CGROUP_INET4_POST_BIND,
 59		BPF_CGROUP_INET4_POST_BIND,
 60		0,
 61		0,
 62		NULL,
 63		0,
 64		LOAD_REJECT,
 65	},
 66	{
 67		"bind4 load with invalid access: mark",
 68		.insns = {
 69			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 70			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
 71				    offsetof(struct bpf_sock, mark)),
 72			BPF_MOV64_IMM(BPF_REG_0, 1),
 73			BPF_EXIT_INSN(),
 74		},
 75		BPF_CGROUP_INET4_POST_BIND,
 76		BPF_CGROUP_INET4_POST_BIND,
 77		0,
 78		0,
 79		NULL,
 80		0,
 81		LOAD_REJECT,
 82	},
 83	{
 84		"bind6 load with invalid access: src_ip4",
 85		.insns = {
 86			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 87			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
 88				    offsetof(struct bpf_sock, src_ip4)),
 89			BPF_MOV64_IMM(BPF_REG_0, 1),
 90			BPF_EXIT_INSN(),
 91		},
 92		BPF_CGROUP_INET6_POST_BIND,
 93		BPF_CGROUP_INET6_POST_BIND,
 94		0,
 95		0,
 96		NULL,
 97		0,
 98		LOAD_REJECT,
 99	},
100	{
101		"sock_create load with invalid access: src_port",
102		.insns = {
103			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
104			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
105				    offsetof(struct bpf_sock, src_port)),
106			BPF_MOV64_IMM(BPF_REG_0, 1),
107			BPF_EXIT_INSN(),
108		},
109		BPF_CGROUP_INET_SOCK_CREATE,
110		BPF_CGROUP_INET_SOCK_CREATE,
111		0,
112		0,
113		NULL,
114		0,
115		LOAD_REJECT,
116	},
117	{
118		"sock_create load w/o expected_attach_type (compat mode)",
119		.insns = {
120			BPF_MOV64_IMM(BPF_REG_0, 1),
121			BPF_EXIT_INSN(),
122		},
123		0,
124		BPF_CGROUP_INET_SOCK_CREATE,
125		AF_INET,
126		SOCK_STREAM,
127		"127.0.0.1",
128		8097,
129		SUCCESS,
130	},
131	{
132		"sock_create load w/ expected_attach_type",
133		.insns = {
134			BPF_MOV64_IMM(BPF_REG_0, 1),
135			BPF_EXIT_INSN(),
136		},
137		BPF_CGROUP_INET_SOCK_CREATE,
138		BPF_CGROUP_INET_SOCK_CREATE,
139		AF_INET,
140		SOCK_STREAM,
141		"127.0.0.1",
142		8097,
143		SUCCESS,
144	},
145	{
146		"attach type mismatch bind4 vs bind6",
147		.insns = {
148			BPF_MOV64_IMM(BPF_REG_0, 1),
149			BPF_EXIT_INSN(),
150		},
151		BPF_CGROUP_INET4_POST_BIND,
152		BPF_CGROUP_INET6_POST_BIND,
153		0,
154		0,
155		NULL,
156		0,
157		ATTACH_REJECT,
158	},
159	{
160		"attach type mismatch bind6 vs bind4",
161		.insns = {
162			BPF_MOV64_IMM(BPF_REG_0, 1),
163			BPF_EXIT_INSN(),
164		},
165		BPF_CGROUP_INET6_POST_BIND,
166		BPF_CGROUP_INET4_POST_BIND,
167		0,
168		0,
169		NULL,
170		0,
171		ATTACH_REJECT,
172	},
173	{
174		"attach type mismatch default vs bind4",
175		.insns = {
176			BPF_MOV64_IMM(BPF_REG_0, 1),
177			BPF_EXIT_INSN(),
178		},
179		0,
180		BPF_CGROUP_INET4_POST_BIND,
181		0,
182		0,
183		NULL,
184		0,
185		ATTACH_REJECT,
186	},
187	{
188		"attach type mismatch bind6 vs sock_create",
189		.insns = {
190			BPF_MOV64_IMM(BPF_REG_0, 1),
191			BPF_EXIT_INSN(),
192		},
193		BPF_CGROUP_INET6_POST_BIND,
194		BPF_CGROUP_INET_SOCK_CREATE,
195		0,
196		0,
197		NULL,
198		0,
199		ATTACH_REJECT,
200	},
201	{
202		"bind4 reject all",
203		.insns = {
204			BPF_MOV64_IMM(BPF_REG_0, 0),
205			BPF_EXIT_INSN(),
206		},
207		BPF_CGROUP_INET4_POST_BIND,
208		BPF_CGROUP_INET4_POST_BIND,
209		AF_INET,
210		SOCK_STREAM,
211		"0.0.0.0",
212		0,
213		BIND_REJECT,
214	},
215	{
216		"bind6 reject all",
217		.insns = {
218			BPF_MOV64_IMM(BPF_REG_0, 0),
219			BPF_EXIT_INSN(),
220		},
221		BPF_CGROUP_INET6_POST_BIND,
222		BPF_CGROUP_INET6_POST_BIND,
223		AF_INET6,
224		SOCK_STREAM,
225		"::",
226		0,
227		BIND_REJECT,
228	},
229	{
230		"bind6 deny specific IP & port",
231		.insns = {
232			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
233
234			/* if (ip == expected && port == expected) */
235			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
236				    offsetof(struct bpf_sock, src_ip6[3])),
237			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x01000000, 4),
 
238			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
239				    offsetof(struct bpf_sock, src_port)),
240			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
241
242			/* return DENY; */
243			BPF_MOV64_IMM(BPF_REG_0, 0),
244			BPF_JMP_A(1),
245
246			/* else return ALLOW; */
247			BPF_MOV64_IMM(BPF_REG_0, 1),
248			BPF_EXIT_INSN(),
249		},
250		BPF_CGROUP_INET6_POST_BIND,
251		BPF_CGROUP_INET6_POST_BIND,
252		AF_INET6,
253		SOCK_STREAM,
254		"::1",
255		8193,
256		BIND_REJECT,
257	},
258	{
259		"bind4 allow specific IP & port",
260		.insns = {
261			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
262
263			/* if (ip == expected && port == expected) */
264			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
265				    offsetof(struct bpf_sock, src_ip4)),
266			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x0100007F, 4),
 
267			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
268				    offsetof(struct bpf_sock, src_port)),
269			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
270
271			/* return ALLOW; */
272			BPF_MOV64_IMM(BPF_REG_0, 1),
273			BPF_JMP_A(1),
274
275			/* else return DENY; */
276			BPF_MOV64_IMM(BPF_REG_0, 0),
277			BPF_EXIT_INSN(),
278		},
279		BPF_CGROUP_INET4_POST_BIND,
280		BPF_CGROUP_INET4_POST_BIND,
281		AF_INET,
282		SOCK_STREAM,
283		"127.0.0.1",
284		4098,
285		SUCCESS,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
286	},
287	{
288		"bind4 allow all",
289		.insns = {
290			BPF_MOV64_IMM(BPF_REG_0, 1),
291			BPF_EXIT_INSN(),
292		},
293		BPF_CGROUP_INET4_POST_BIND,
294		BPF_CGROUP_INET4_POST_BIND,
295		AF_INET,
296		SOCK_STREAM,
297		"0.0.0.0",
298		0,
299		SUCCESS,
300	},
301	{
302		"bind6 allow all",
303		.insns = {
304			BPF_MOV64_IMM(BPF_REG_0, 1),
305			BPF_EXIT_INSN(),
306		},
307		BPF_CGROUP_INET6_POST_BIND,
308		BPF_CGROUP_INET6_POST_BIND,
309		AF_INET6,
310		SOCK_STREAM,
311		"::",
312		0,
313		SUCCESS,
314	},
315};
316
317static size_t probe_prog_length(const struct bpf_insn *fp)
318{
319	size_t len;
320
321	for (len = MAX_INSNS - 1; len > 0; --len)
322		if (fp[len].code != 0 || fp[len].imm != 0)
323			break;
324	return len + 1;
325}
326
327static int load_sock_prog(const struct bpf_insn *prog,
328			  enum bpf_attach_type attach_type)
329{
330	struct bpf_load_program_attr attr;
 
331
332	memset(&attr, 0, sizeof(struct bpf_load_program_attr));
333	attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK;
334	attr.expected_attach_type = attach_type;
335	attr.insns = prog;
336	attr.insns_cnt = probe_prog_length(attr.insns);
337	attr.license = "GPL";
338
339	return bpf_load_program_xattr(&attr, bpf_log_buf, BPF_LOG_BUF_SIZE);
 
 
 
 
 
 
 
 
 
340}
341
342static int attach_sock_prog(int cgfd, int progfd,
343			    enum bpf_attach_type attach_type)
344{
345	return bpf_prog_attach(progfd, cgfd, attach_type, BPF_F_ALLOW_OVERRIDE);
346}
347
348static int bind_sock(int domain, int type, const char *ip, unsigned short port)
 
349{
350	struct sockaddr_storage addr;
351	struct sockaddr_in6 *addr6;
352	struct sockaddr_in *addr4;
353	int sockfd = -1;
354	socklen_t len;
355	int err = 0;
356
357	sockfd = socket(domain, type, 0);
358	if (sockfd < 0)
359		goto err;
360
361	memset(&addr, 0, sizeof(addr));
362
363	if (domain == AF_INET) {
364		len = sizeof(struct sockaddr_in);
365		addr4 = (struct sockaddr_in *)&addr;
366		addr4->sin_family = domain;
367		addr4->sin_port = htons(port);
368		if (inet_pton(domain, ip, (void *)&addr4->sin_addr) != 1)
369			goto err;
370	} else if (domain == AF_INET6) {
371		len = sizeof(struct sockaddr_in6);
372		addr6 = (struct sockaddr_in6 *)&addr;
373		addr6->sin6_family = domain;
374		addr6->sin6_port = htons(port);
375		if (inet_pton(domain, ip, (void *)&addr6->sin6_addr) != 1)
376			goto err;
377	} else {
378		goto err;
379	}
380
381	if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1)
382		goto err;
 
 
 
 
 
 
 
 
 
383
384	goto out;
 
 
 
 
 
 
 
 
 
 
 
 
 
385err:
386	err = -1;
387out:
388	close(sockfd);
389	return err;
390}
391
392static int run_test_case(int cgfd, const struct sock_test *test)
393{
394	int progfd = -1;
395	int err = 0;
 
396
397	printf("Test case: %s .. ", test->descr);
398	progfd = load_sock_prog(test->insns, test->expected_attach_type);
399	if (progfd < 0) {
400		if (test->result == LOAD_REJECT)
401			goto out;
402		else
403			goto err;
404	}
405
406	if (attach_sock_prog(cgfd, progfd, test->attach_type) == -1) {
407		if (test->result == ATTACH_REJECT)
408			goto out;
409		else
410			goto err;
411	}
412
413	if (bind_sock(test->domain, test->type, test->ip, test->port) == -1) {
414		/* sys_bind() may fail for different reasons, errno has to be
415		 * checked to confirm that BPF program rejected it.
416		 */
417		if (test->result == BIND_REJECT && errno == EPERM)
418			goto out;
419		else
420			goto err;
421	}
422
423
424	if (test->result != SUCCESS)
425		goto err;
426
427	goto out;
428err:
429	err = -1;
430out:
431	/* Detaching w/o checking return code: best effort attempt. */
432	if (progfd != -1)
433		bpf_prog_detach(cgfd, test->attach_type);
434	close(progfd);
435	printf("[%s]\n", err ? "FAIL" : "PASS");
436	return err;
437}
438
439static int run_tests(int cgfd)
440{
441	int passes = 0;
442	int fails = 0;
443	int i;
444
445	for (i = 0; i < ARRAY_SIZE(tests); ++i) {
446		if (run_test_case(cgfd, &tests[i]))
447			++fails;
448		else
449			++passes;
450	}
451	printf("Summary: %d PASSED, %d FAILED\n", passes, fails);
452	return fails ? -1 : 0;
453}
454
455int main(int argc, char **argv)
456{
457	int cgfd = -1;
458	int err = 0;
459
460	if (setup_cgroup_environment())
 
461		goto err;
462
463	cgfd = create_and_get_cgroup(CG_PATH);
464	if (!cgfd)
465		goto err;
466
467	if (join_cgroup(CG_PATH))
468		goto err;
469
470	if (run_tests(cgfd))
471		goto err;
472
473	goto out;
474err:
475	err = -1;
476out:
477	close(cgfd);
478	cleanup_cgroup_environment();
479	return err;
480}