1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (c) 2018 Facebook
3
4 #include <stdio.h>
5 #include <unistd.h>
6
7 #include <arpa/inet.h>
8 #include <sys/types.h>
9 #include <sys/socket.h>
10
11 #include <linux/filter.h>
12
13 #include <bpf/bpf.h>
14
15 #include "cgroup_helpers.h"
16 #include "bpf_rlimit.h"
17 #include "bpf_util.h"
18
19 #define CG_PATH "/foo"
20 #define MAX_INSNS 512
21
22 char bpf_log_buf[BPF_LOG_BUF_SIZE];
23
24 struct sock_test {
25 const char *descr;
26 /* BPF prog properties */
27 struct bpf_insn insns[MAX_INSNS];
28 enum bpf_attach_type expected_attach_type;
29 enum bpf_attach_type attach_type;
30 /* Socket properties */
31 int domain;
32 int type;
33 /* Endpoint to bind() to */
34 const char *ip;
35 unsigned short port;
36 /* Expected test result */
37 enum {
38 LOAD_REJECT,
39 ATTACH_REJECT,
40 BIND_REJECT,
41 SUCCESS,
42 } result;
43 };
44
45 static struct sock_test tests[] = {
46 {
47 "bind4 load with invalid access: src_ip6",
48 .insns = {
49 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
50 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
51 offsetof(struct bpf_sock, src_ip6[0])),
52 BPF_MOV64_IMM(BPF_REG_0, 1),
53 BPF_EXIT_INSN(),
54 },
55 BPF_CGROUP_INET4_POST_BIND,
56 BPF_CGROUP_INET4_POST_BIND,
57 0,
58 0,
59 NULL,
60 0,
61 LOAD_REJECT,
62 },
63 {
64 "bind4 load with invalid access: mark",
65 .insns = {
66 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
67 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
68 offsetof(struct bpf_sock, mark)),
69 BPF_MOV64_IMM(BPF_REG_0, 1),
70 BPF_EXIT_INSN(),
71 },
72 BPF_CGROUP_INET4_POST_BIND,
73 BPF_CGROUP_INET4_POST_BIND,
74 0,
75 0,
76 NULL,
77 0,
78 LOAD_REJECT,
79 },
80 {
81 "bind6 load with invalid access: src_ip4",
82 .insns = {
83 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
84 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
85 offsetof(struct bpf_sock, src_ip4)),
86 BPF_MOV64_IMM(BPF_REG_0, 1),
87 BPF_EXIT_INSN(),
88 },
89 BPF_CGROUP_INET6_POST_BIND,
90 BPF_CGROUP_INET6_POST_BIND,
91 0,
92 0,
93 NULL,
94 0,
95 LOAD_REJECT,
96 },
97 {
98 "sock_create load with invalid access: src_port",
99 .insns = {
100 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
101 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
102 offsetof(struct bpf_sock, src_port)),
103 BPF_MOV64_IMM(BPF_REG_0, 1),
104 BPF_EXIT_INSN(),
105 },
106 BPF_CGROUP_INET_SOCK_CREATE,
107 BPF_CGROUP_INET_SOCK_CREATE,
108 0,
109 0,
110 NULL,
111 0,
112 LOAD_REJECT,
113 },
114 {
115 "sock_create load w/o expected_attach_type (compat mode)",
116 .insns = {
117 BPF_MOV64_IMM(BPF_REG_0, 1),
118 BPF_EXIT_INSN(),
119 },
120 0,
121 BPF_CGROUP_INET_SOCK_CREATE,
122 AF_INET,
123 SOCK_STREAM,
124 "127.0.0.1",
125 8097,
126 SUCCESS,
127 },
128 {
129 "sock_create load w/ expected_attach_type",
130 .insns = {
131 BPF_MOV64_IMM(BPF_REG_0, 1),
132 BPF_EXIT_INSN(),
133 },
134 BPF_CGROUP_INET_SOCK_CREATE,
135 BPF_CGROUP_INET_SOCK_CREATE,
136 AF_INET,
137 SOCK_STREAM,
138 "127.0.0.1",
139 8097,
140 SUCCESS,
141 },
142 {
143 "attach type mismatch bind4 vs bind6",
144 .insns = {
145 BPF_MOV64_IMM(BPF_REG_0, 1),
146 BPF_EXIT_INSN(),
147 },
148 BPF_CGROUP_INET4_POST_BIND,
149 BPF_CGROUP_INET6_POST_BIND,
150 0,
151 0,
152 NULL,
153 0,
154 ATTACH_REJECT,
155 },
156 {
157 "attach type mismatch bind6 vs bind4",
158 .insns = {
159 BPF_MOV64_IMM(BPF_REG_0, 1),
160 BPF_EXIT_INSN(),
161 },
162 BPF_CGROUP_INET6_POST_BIND,
163 BPF_CGROUP_INET4_POST_BIND,
164 0,
165 0,
166 NULL,
167 0,
168 ATTACH_REJECT,
169 },
170 {
171 "attach type mismatch default vs bind4",
172 .insns = {
173 BPF_MOV64_IMM(BPF_REG_0, 1),
174 BPF_EXIT_INSN(),
175 },
176 0,
177 BPF_CGROUP_INET4_POST_BIND,
178 0,
179 0,
180 NULL,
181 0,
182 ATTACH_REJECT,
183 },
184 {
185 "attach type mismatch bind6 vs sock_create",
186 .insns = {
187 BPF_MOV64_IMM(BPF_REG_0, 1),
188 BPF_EXIT_INSN(),
189 },
190 BPF_CGROUP_INET6_POST_BIND,
191 BPF_CGROUP_INET_SOCK_CREATE,
192 0,
193 0,
194 NULL,
195 0,
196 ATTACH_REJECT,
197 },
198 {
199 "bind4 reject all",
200 .insns = {
201 BPF_MOV64_IMM(BPF_REG_0, 0),
202 BPF_EXIT_INSN(),
203 },
204 BPF_CGROUP_INET4_POST_BIND,
205 BPF_CGROUP_INET4_POST_BIND,
206 AF_INET,
207 SOCK_STREAM,
208 "0.0.0.0",
209 0,
210 BIND_REJECT,
211 },
212 {
213 "bind6 reject all",
214 .insns = {
215 BPF_MOV64_IMM(BPF_REG_0, 0),
216 BPF_EXIT_INSN(),
217 },
218 BPF_CGROUP_INET6_POST_BIND,
219 BPF_CGROUP_INET6_POST_BIND,
220 AF_INET6,
221 SOCK_STREAM,
222 "::",
223 0,
224 BIND_REJECT,
225 },
226 {
227 "bind6 deny specific IP & port",
228 .insns = {
229 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
230
231 /* if (ip == expected && port == expected) */
232 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
233 offsetof(struct bpf_sock, src_ip6[3])),
234 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x01000000, 4),
235 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
236 offsetof(struct bpf_sock, src_port)),
237 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
238
239 /* return DENY; */
240 BPF_MOV64_IMM(BPF_REG_0, 0),
241 BPF_JMP_A(1),
242
243 /* else return ALLOW; */
244 BPF_MOV64_IMM(BPF_REG_0, 1),
245 BPF_EXIT_INSN(),
246 },
247 BPF_CGROUP_INET6_POST_BIND,
248 BPF_CGROUP_INET6_POST_BIND,
249 AF_INET6,
250 SOCK_STREAM,
251 "::1",
252 8193,
253 BIND_REJECT,
254 },
255 {
256 "bind4 allow specific IP & port",
257 .insns = {
258 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
259
260 /* if (ip == expected && port == expected) */
261 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
262 offsetof(struct bpf_sock, src_ip4)),
263 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x0100007F, 4),
264 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
265 offsetof(struct bpf_sock, src_port)),
266 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
267
268 /* return ALLOW; */
269 BPF_MOV64_IMM(BPF_REG_0, 1),
270 BPF_JMP_A(1),
271
272 /* else return DENY; */
273 BPF_MOV64_IMM(BPF_REG_0, 0),
274 BPF_EXIT_INSN(),
275 },
276 BPF_CGROUP_INET4_POST_BIND,
277 BPF_CGROUP_INET4_POST_BIND,
278 AF_INET,
279 SOCK_STREAM,
280 "127.0.0.1",
281 4098,
282 SUCCESS,
283 },
284 {
285 "bind4 allow all",
286 .insns = {
287 BPF_MOV64_IMM(BPF_REG_0, 1),
288 BPF_EXIT_INSN(),
289 },
290 BPF_CGROUP_INET4_POST_BIND,
291 BPF_CGROUP_INET4_POST_BIND,
292 AF_INET,
293 SOCK_STREAM,
294 "0.0.0.0",
295 0,
296 SUCCESS,
297 },
298 {
299 "bind6 allow all",
300 .insns = {
301 BPF_MOV64_IMM(BPF_REG_0, 1),
302 BPF_EXIT_INSN(),
303 },
304 BPF_CGROUP_INET6_POST_BIND,
305 BPF_CGROUP_INET6_POST_BIND,
306 AF_INET6,
307 SOCK_STREAM,
308 "::",
309 0,
310 SUCCESS,
311 },
312 };
313
probe_prog_length(const struct bpf_insn * fp)314 static size_t probe_prog_length(const struct bpf_insn *fp)
315 {
316 size_t len;
317
318 for (len = MAX_INSNS - 1; len > 0; --len)
319 if (fp[len].code != 0 || fp[len].imm != 0)
320 break;
321 return len + 1;
322 }
323
load_sock_prog(const struct bpf_insn * prog,enum bpf_attach_type attach_type)324 static int load_sock_prog(const struct bpf_insn *prog,
325 enum bpf_attach_type attach_type)
326 {
327 struct bpf_load_program_attr attr;
328
329 memset(&attr, 0, sizeof(struct bpf_load_program_attr));
330 attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK;
331 attr.expected_attach_type = attach_type;
332 attr.insns = prog;
333 attr.insns_cnt = probe_prog_length(attr.insns);
334 attr.license = "GPL";
335
336 return bpf_load_program_xattr(&attr, bpf_log_buf, BPF_LOG_BUF_SIZE);
337 }
338
attach_sock_prog(int cgfd,int progfd,enum bpf_attach_type attach_type)339 static int attach_sock_prog(int cgfd, int progfd,
340 enum bpf_attach_type attach_type)
341 {
342 return bpf_prog_attach(progfd, cgfd, attach_type, BPF_F_ALLOW_OVERRIDE);
343 }
344
bind_sock(int domain,int type,const char * ip,unsigned short port)345 static int bind_sock(int domain, int type, const char *ip, unsigned short port)
346 {
347 struct sockaddr_storage addr;
348 struct sockaddr_in6 *addr6;
349 struct sockaddr_in *addr4;
350 int sockfd = -1;
351 socklen_t len;
352 int err = 0;
353
354 sockfd = socket(domain, type, 0);
355 if (sockfd < 0)
356 goto err;
357
358 memset(&addr, 0, sizeof(addr));
359
360 if (domain == AF_INET) {
361 len = sizeof(struct sockaddr_in);
362 addr4 = (struct sockaddr_in *)&addr;
363 addr4->sin_family = domain;
364 addr4->sin_port = htons(port);
365 if (inet_pton(domain, ip, (void *)&addr4->sin_addr) != 1)
366 goto err;
367 } else if (domain == AF_INET6) {
368 len = sizeof(struct sockaddr_in6);
369 addr6 = (struct sockaddr_in6 *)&addr;
370 addr6->sin6_family = domain;
371 addr6->sin6_port = htons(port);
372 if (inet_pton(domain, ip, (void *)&addr6->sin6_addr) != 1)
373 goto err;
374 } else {
375 goto err;
376 }
377
378 if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1)
379 goto err;
380
381 goto out;
382 err:
383 err = -1;
384 out:
385 close(sockfd);
386 return err;
387 }
388
run_test_case(int cgfd,const struct sock_test * test)389 static int run_test_case(int cgfd, const struct sock_test *test)
390 {
391 int progfd = -1;
392 int err = 0;
393
394 printf("Test case: %s .. ", test->descr);
395 progfd = load_sock_prog(test->insns, test->expected_attach_type);
396 if (progfd < 0) {
397 if (test->result == LOAD_REJECT)
398 goto out;
399 else
400 goto err;
401 }
402
403 if (attach_sock_prog(cgfd, progfd, test->attach_type) == -1) {
404 if (test->result == ATTACH_REJECT)
405 goto out;
406 else
407 goto err;
408 }
409
410 if (bind_sock(test->domain, test->type, test->ip, test->port) == -1) {
411 /* sys_bind() may fail for different reasons, errno has to be
412 * checked to confirm that BPF program rejected it.
413 */
414 if (test->result == BIND_REJECT && errno == EPERM)
415 goto out;
416 else
417 goto err;
418 }
419
420
421 if (test->result != SUCCESS)
422 goto err;
423
424 goto out;
425 err:
426 err = -1;
427 out:
428 /* Detaching w/o checking return code: best effort attempt. */
429 if (progfd != -1)
430 bpf_prog_detach(cgfd, test->attach_type);
431 close(progfd);
432 printf("[%s]\n", err ? "FAIL" : "PASS");
433 return err;
434 }
435
run_tests(int cgfd)436 static int run_tests(int cgfd)
437 {
438 int passes = 0;
439 int fails = 0;
440 int i;
441
442 for (i = 0; i < ARRAY_SIZE(tests); ++i) {
443 if (run_test_case(cgfd, &tests[i]))
444 ++fails;
445 else
446 ++passes;
447 }
448 printf("Summary: %d PASSED, %d FAILED\n", passes, fails);
449 return fails ? -1 : 0;
450 }
451
main(int argc,char ** argv)452 int main(int argc, char **argv)
453 {
454 int cgfd = -1;
455 int err = 0;
456
457 if (setup_cgroup_environment())
458 goto err;
459
460 cgfd = create_and_get_cgroup(CG_PATH);
461 if (!cgfd)
462 goto err;
463
464 if (join_cgroup(CG_PATH))
465 goto err;
466
467 if (run_tests(cgfd))
468 goto err;
469
470 goto out;
471 err:
472 err = -1;
473 out:
474 close(cgfd);
475 cleanup_cgroup_environment();
476 return err;
477 }
478