Skip to content

L
linux
Commit dfb7539b authored by Jordan Rife's avatar Jordan Rife Committed by Alexei Starovoitov
Browse files
Options

sefltests/bpf: Expand sockaddr hook deny tests 

This patch expands test coverage for EPERM tests to include connect and
bind calls and rounds out the coverage for sendmsg by adding tests for
sendmsg_unix.
Signed-off-by: default avatarJordan Rife <jrife@google.com>
Link: https://lore.kernel.org/r/20240510190246.3247730-16-jrife@google.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 1e0a8367
Hide whitespace changes
Inline Side-by-side
Showing with 378 additions and 0 deletions
tools/testing/selftests/bpf/prog_tests/sock_addr.c
View file @ dfb7539b
......@@ -439,13 +439,18 @@ static void prog_name##_destroy(void *skel) \
BPF_SKEL_FUNCS(bind4_prog, bind_v4_prog);
BPF_SKEL_FUNCS_RAW(bind4_prog, bind_v4_prog);
BPF_SKEL_FUNCS(bind4_prog, bind_v4_deny_prog);
BPF_SKEL_FUNCS(bind6_prog, bind_v6_prog);
BPF_SKEL_FUNCS_RAW(bind6_prog, bind_v6_prog);
BPF_SKEL_FUNCS(bind6_prog, bind_v6_deny_prog);
BPF_SKEL_FUNCS(connect4_prog, connect_v4_prog);
BPF_SKEL_FUNCS_RAW(connect4_prog, connect_v4_prog);
BPF_SKEL_FUNCS(connect4_prog, connect_v4_deny_prog);
BPF_SKEL_FUNCS(connect6_prog, connect_v6_prog);
BPF_SKEL_FUNCS_RAW(connect6_prog, connect_v6_prog);
BPF_SKEL_FUNCS(connect6_prog, connect_v6_deny_prog);
BPF_SKEL_FUNCS(connect_unix_prog, connect_unix_prog);
BPF_SKEL_FUNCS(connect_unix_prog, connect_unix_deny_prog);
BPF_SKEL_FUNCS(sendmsg4_prog, sendmsg_v4_prog);
BPF_SKEL_FUNCS_RAW(sendmsg4_prog, sendmsg_v4_prog);
BPF_SKEL_FUNCS(sendmsg4_prog, sendmsg_v4_deny_prog);
......@@ -456,6 +461,7 @@ BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_preserve_dst_prog);
BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_v4mapped_prog);
BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_wildcard_prog);
BPF_SKEL_FUNCS(sendmsg_unix_prog, sendmsg_unix_prog);
BPF_SKEL_FUNCS(sendmsg_unix_prog, sendmsg_unix_deny_prog);
BPF_SKEL_FUNCS(recvmsg4_prog, recvmsg4_prog);
BPF_SKEL_FUNCS(recvmsg6_prog, recvmsg6_prog);
BPF_SKEL_FUNCS(recvmsg_unix_prog, recvmsg_unix_prog);
......@@ -480,6 +486,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: bind deny (stream)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&user_ops,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: bind (dgram)",
......@@ -496,6 +518,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: bind deny (dgram)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&user_ops,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: load prog with wrong expected attach type",
......@@ -544,6 +582,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: bind deny (stream)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&user_ops,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: bind (dgram)",
......@@ -560,6 +614,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: bind deny (dgram)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&user_ops,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: load prog with wrong expected attach type",
......@@ -610,6 +680,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: kernel_bind deny (stream)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: kernel_bind (dgram)",
......@@ -626,6 +712,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind4: kernel_bind deny (dgram)",
bind_v4_deny_prog_load,
bind_v4_deny_prog_destroy,
BPF_CGROUP_INET4_BIND,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind (stream)",
......@@ -642,6 +744,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind deny (stream)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind (dgram)",
......@@ -658,6 +776,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_BIND,
"bind6: kernel_bind deny (dgram)",
bind_v6_deny_prog_load,
bind_v6_deny_prog_destroy,
BPF_CGROUP_INET6_BIND,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
NULL,
SYSCALL_EPERM,
},
/* connect - system calls */
{
......@@ -676,6 +810,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: connect deny (stream)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&user_ops,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: connect (dgram)",
......@@ -692,6 +842,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: connect deny (dgram)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&user_ops,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: load prog with wrong expected attach type",
......@@ -740,6 +906,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: connect deny (stream)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&user_ops,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: connect (dgram)",
......@@ -756,6 +938,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: connect deny (dgram)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&user_ops,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: load prog with wrong expected attach type",
......@@ -804,6 +1002,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect_unix: connect deny (stream)",
connect_unix_deny_prog_load,
connect_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_CONNECT,
&user_ops,
AF_UNIX,
SOCK_STREAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* connect - kernel calls */
{
......@@ -822,6 +1036,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: kernel_connect deny (stream)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_STREAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: kernel_connect (dgram)",
......@@ -838,6 +1068,22 @@ static struct sock_addr_test tests[] = {
SRC4_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect4: kernel_connect deny (dgram)",
connect_v4_deny_prog_load,
connect_v4_deny_prog_destroy,
BPF_CGROUP_INET4_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET,
SOCK_DGRAM,
SERV4_IP,
SERV4_PORT,
SERV4_REWRITE_IP,
SERV4_REWRITE_PORT,
SRC4_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect (stream)",
......@@ -854,6 +1100,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect deny (stream)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_STREAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect (dgram)",
......@@ -870,6 +1132,22 @@ static struct sock_addr_test tests[] = {
SRC6_REWRITE_IP,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect6: kernel_connect deny (dgram)",
connect_v6_deny_prog_load,
connect_v6_deny_prog_destroy,
BPF_CGROUP_INET6_CONNECT,
&kern_ops_sock_sendmsg,
AF_INET6,
SOCK_DGRAM,
SERV6_IP,
SERV6_PORT,
SERV6_REWRITE_IP,
SERV6_REWRITE_PORT,
SRC6_REWRITE_IP,
SYSCALL_EPERM,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect_unix: kernel_connect (dgram)",
......@@ -886,6 +1164,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_CONNECT,
"connect_unix: kernel_connect deny (dgram)",
connect_unix_deny_prog_load,
connect_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_CONNECT,
&kern_ops_sock_sendmsg,
AF_UNIX,
SOCK_STREAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* sendmsg - system calls */
{
......@@ -1080,6 +1374,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_SENDMSG,
"sendmsg_unix: sendmsg deny (dgram)",
sendmsg_unix_deny_prog_load,
sendmsg_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_SENDMSG,
&user_ops,
AF_UNIX,
SOCK_DGRAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* sendmsg - kernel calls (sock_sendmsg) */
{
......@@ -1178,6 +1488,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_SENDMSG,
"sendmsg_unix: sock_sendmsg deny (dgram)",
sendmsg_unix_deny_prog_load,
sendmsg_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_SENDMSG,
&kern_ops_sock_sendmsg,
AF_UNIX,
SOCK_DGRAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* sendmsg - kernel calls (kernel_sendmsg) */
{
......@@ -1276,6 +1602,22 @@ static struct sock_addr_test tests[] = {
NULL,
SUCCESS,
},
{
SOCK_ADDR_TEST_SENDMSG,
"sendmsg_unix: kernel_sendmsg deny (dgram)",
sendmsg_unix_deny_prog_load,
sendmsg_unix_deny_prog_destroy,
BPF_CGROUP_UNIX_SENDMSG,
&kern_ops_kernel_sendmsg,
AF_UNIX,
SOCK_DGRAM,
SERVUN_ADDRESS,
0,
SERVUN_REWRITE_ADDRESS,
0,
NULL,
SYSCALL_EPERM,
},
/* recvmsg - system calls */
{
......
tools/testing/selftests/bpf/progs/bind4_prog.c
View file @ dfb7539b
......@@ -158,4 +158,10 @@ int bind_v4_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/bind4")
int bind_v4_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/bind6_prog.c
View file @ dfb7539b
......@@ -175,4 +175,10 @@ int bind_v6_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/bind6")
int bind_v6_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/connect4_prog.c
View file @ dfb7539b
......@@ -199,4 +199,10 @@ int connect_v4_prog(struct bpf_sock_addr *ctx)
return do_bind(ctx) ? 1 : 0;
}
SEC("cgroup/connect4")
int connect_v4_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/connect6_prog.c
View file @ dfb7539b
......@@ -90,4 +90,10 @@ int connect_v6_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/connect6")
int connect_v6_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/connect_unix_prog.c
View file @ dfb7539b
......@@ -36,4 +36,10 @@ int connect_unix_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/connect_unix")
int connect_unix_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
tools/testing/selftests/bpf/progs/sendmsg_unix_prog.c
View file @ dfb7539b
......@@ -36,4 +36,10 @@ int sendmsg_unix_prog(struct bpf_sock_addr *ctx)
return 1;
}
SEC("cgroup/sendmsg_unix")
int sendmsg_unix_deny_prog(struct bpf_sock_addr *ctx)
{
return 0;
}
char _license[] SEC("license") = "GPL";
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7