TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sefltests/bpf: Expand sockaddr hook deny tests

Browse Source 
This patch expands test coverage for EPERM tests to include connect and
bind calls and rounds out the coverage for sendmsg by adding tests for
sendmsg_unix.

Signed-off-by: Jordan Rife <jrife@google.com>
Link: https://lore.kernel.org/r/20240510190246.3247730-16-jrife@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Jordan Rife
2024-05-10 14:02:32 -05:00
committed by Alexei Starovoitov
parent 1e0a8367c8
commit dfb7539b47
7 changed files with 378 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/testing/selftests/bpf/prog_tests/sock_addr.c
+342
View File
@@ -439,13 +439,18 @@ static void prog_name##_destroy(void *skel) \
BPF_SKEL_FUNCS(bind4_prog, bind_v4_prog);
BPF_SKEL_FUNCS_RAW(bind4_prog, bind_v4_prog);
BPF_SKEL_FUNCS(bind4_prog, bind_v4_deny_prog);
BPF_SKEL_FUNCS(bind6_prog, bind_v6_prog);
BPF_SKEL_FUNCS_RAW(bind6_prog, bind_v6_prog);
BPF_SKEL_FUNCS(bind6_prog, bind_v6_deny_prog);
BPF_SKEL_FUNCS(connect4_prog, connect_v4_prog);
BPF_SKEL_FUNCS_RAW(connect4_prog, connect_v4_prog);
BPF_SKEL_FUNCS(connect4_prog, connect_v4_deny_prog);
BPF_SKEL_FUNCS(connect6_prog, connect_v6_prog);
BPF_SKEL_FUNCS_RAW(connect6_prog, connect_v6_prog);
BPF_SKEL_FUNCS(connect6_prog, connect_v6_deny_prog);
BPF_SKEL_FUNCS(connect_unix_prog, connect_unix_prog);
BPF_SKEL_FUNCS(connect_unix_prog, connect_unix_deny_prog);
BPF_SKEL_FUNCS(sendmsg4_prog, sendmsg_v4_prog);
BPF_SKEL_FUNCS_RAW(sendmsg4_prog, sendmsg_v4_prog);
BPF_SKEL_FUNCS(sendmsg4_prog, sendmsg_v4_deny_prog);
@@ -456,6 +461,7 @@ BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_preserve_dst_prog);
BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_v4mapped_prog);
BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_wildcard_prog);
BPF_SKEL_FUNCS(sendmsg_unix_prog, sendmsg_unix_prog);
BPF_SKEL_FUNCS(sendmsg_unix_prog, sendmsg_unix_deny_prog);
BPF_SKEL_FUNCS(recvmsg4_prog, recvmsg4_prog);
BPF_SKEL_FUNCS(recvmsg6_prog, recvmsg6_prog);
BPF_SKEL_FUNCS(recvmsg_unix_prog, recvmsg_unix_prog);
@@ -480,6 +486,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: bind deny (stream)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&user_ops,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: bind (dgram)",
@@ -496,6 +518,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: bind deny (dgram)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&user_ops,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: load prog with wrong expected attach type",
@@ -544,6 +582,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: bind deny (stream)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&user_ops,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: bind (dgram)",
@@ -560,6 +614,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: bind deny (dgram)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&user_ops,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: load prog with wrong expected attach type",
@@ -610,6 +680,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: kernel_bind deny (stream)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: kernel_bind (dgram)",
@@ -626,6 +712,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: kernel_bind deny (dgram)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind (stream)",
@@ -642,6 +744,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind deny (stream)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind (dgram)",
@@ -658,6 +776,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind deny (dgram)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
/* connect - system calls */
{
@@ -676,6 +810,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: connect deny (stream)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&user_ops,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: connect (dgram)",
@@ -692,6 +842,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: connect deny (dgram)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&user_ops,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: load prog with wrong expected attach type",
@@ -740,6 +906,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: connect deny (stream)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&user_ops,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: connect (dgram)",
@@ -756,6 +938,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: connect deny (dgram)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&user_ops,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: load prog with wrong expected attach type",
@@ -804,6 +1002,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect_unix: connect deny (stream)",
connect_unix_deny_prog_load,
connect_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_CONNECT,
&user_ops,
AF_UNIX,
SOCK_STREAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* connect - kernel calls */
{
@@ -822,6 +1036,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: kernel_connect deny (stream)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: kernel_connect (dgram)",
@@ -838,6 +1068,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: kernel_connect deny (dgram)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect (stream)",
@@ -854,6 +1100,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect deny (stream)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect (dgram)",
@@ -870,6 +1132,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect deny (dgram)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect_unix: kernel_connect (dgram)",
@@ -886,6 +1164,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect_unix: kernel_connect deny (dgram)",
connect_unix_deny_prog_load,
connect_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_CONNECT,
&kern_ops_sock_sendmsg,
AF_UNIX,
SOCK_STREAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* sendmsg - system calls */
{
@@ -1080,6 +1374,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_SENDMSG,
"sendmsg_unix: sendmsg deny (dgram)",
sendmsg_unix_deny_prog_load,
sendmsg_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_SENDMSG,
&user_ops,
AF_UNIX,
SOCK_DGRAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* sendmsg - kernel calls (sock_sendmsg) */
{
@@ -1178,6 +1488,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_SENDMSG,
"sendmsg_unix: sock_sendmsg deny (dgram)",
sendmsg_unix_deny_prog_load,
sendmsg_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_SENDMSG,
&kern_ops_sock_sendmsg,
AF_UNIX,
SOCK_DGRAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* sendmsg - kernel calls (kernel_sendmsg) */
{
@@ -1276,6 +1602,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_SENDMSG,
"sendmsg_unix: kernel_sendmsg deny (dgram)",
sendmsg_unix_deny_prog_load,
sendmsg_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_SENDMSG,
&kern_ops_kernel_sendmsg,
AF_UNIX,
SOCK_DGRAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* recvmsg - system calls */
{
tools/testing/selftests/bpf/progs/bind4_prog.c
+6
View File
@@ -158,4 +158,10 @@ int bind_v4_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/bind4")
int bind_v4_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/bind6_prog.c
+6
View File
@@ -175,4 +175,10 @@ int bind_v6_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/bind6")
int bind_v6_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/connect4_prog.c
+6
View File
@@ -199,4 +199,10 @@ int connect_v4_prog(struct bpf_sock_addr *ctx)
return do_bind(ctx) ? 1 : 0;
}
SEC("cgroup/connect4")
int connect_v4_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/connect6_prog.c
+6
View File
@@ -90,4 +90,10 @@ int connect_v6_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/connect6")
int connect_v6_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/connect_unix_prog.c
+6
View File
@@ -36,4 +36,10 @@ int connect_unix_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/connect_unix")
int connect_unix_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/sendmsg_unix_prog.c
+6
View File
@@ -36,4 +36,10 @@ int sendmsg_unix_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/sendmsg_unix")
int sendmsg_unix_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";