1 // SPDX-License-Identifier: GPL-2.0
2 
3 #include <test_progs.h>
4 
5 #include "cgroup_helpers.h"
6 
7 #define FOO		"/foo"
8 #define BAR		"/foo/bar/"
9 #define PING_CMD	"ping -q -c1 -w1 127.0.0.1 > /dev/null"
10 
11 static char bpf_log_buf[BPF_LOG_BUF_SIZE];
12 
13 static int prog_load(int verdict)
14 {
15 	struct bpf_insn prog[] = {
16 		BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
17 		BPF_EXIT_INSN(),
18 	};
19 	size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
20 
21 	return bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB,
22 			       prog, insns_cnt, "GPL", 0,
23 			       bpf_log_buf, BPF_LOG_BUF_SIZE);
24 }
25 
26 void test_cgroup_attach_override(void)
27 {
28 	int drop_prog = -1, allow_prog = -1, foo = -1, bar = -1;
29 	__u32 duration = 0;
30 
31 	allow_prog = prog_load(1);
32 	if (CHECK(allow_prog < 0, "prog_load_allow",
33 		  "verifier output:\n%s\n-------\n", bpf_log_buf))
34 		goto err;
35 
36 	drop_prog = prog_load(0);
37 	if (CHECK(drop_prog < 0, "prog_load_drop",
38 		  "verifier output:\n%s\n-------\n", bpf_log_buf))
39 		goto err;
40 
41 	foo = test__join_cgroup(FOO);
42 	if (CHECK(foo < 0, "cgroup_join_foo", "cgroup setup failed\n"))
43 		goto err;
44 
45 	if (CHECK(bpf_prog_attach(drop_prog, foo, BPF_CGROUP_INET_EGRESS,
46 				  BPF_F_ALLOW_OVERRIDE),
47 		  "prog_attach_drop_foo_override",
48 		  "attach prog to %s failed, errno=%d\n", FOO, errno))
49 		goto err;
50 
51 	if (CHECK(!system(PING_CMD), "ping_fail",
52 		  "ping unexpectedly succeeded\n"))
53 		goto err;
54 
55 	bar = test__join_cgroup(BAR);
56 	if (CHECK(bar < 0, "cgroup_join_bar", "cgroup setup failed\n"))
57 		goto err;
58 
59 	if (CHECK(!system(PING_CMD), "ping_fail",
60 		  "ping unexpectedly succeeded\n"))
61 		goto err;
62 
63 	if (CHECK(bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
64 				  BPF_F_ALLOW_OVERRIDE),
65 		  "prog_attach_allow_bar_override",
66 		  "attach prog to %s failed, errno=%d\n", BAR, errno))
67 		goto err;
68 
69 	if (CHECK(system(PING_CMD), "ping_ok", "ping failed\n"))
70 		goto err;
71 
72 	if (CHECK(bpf_prog_detach(bar, BPF_CGROUP_INET_EGRESS),
73 		  "prog_detach_bar",
74 		  "detach prog from %s failed, errno=%d\n", BAR, errno))
75 		goto err;
76 
77 	if (CHECK(!system(PING_CMD), "ping_fail",
78 		  "ping unexpectedly succeeded\n"))
79 		goto err;
80 
81 	if (CHECK(bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
82 				  BPF_F_ALLOW_OVERRIDE),
83 		  "prog_attach_allow_bar_override",
84 		  "attach prog to %s failed, errno=%d\n", BAR, errno))
85 		goto err;
86 
87 	if (CHECK(bpf_prog_detach(foo, BPF_CGROUP_INET_EGRESS),
88 		  "prog_detach_foo",
89 		  "detach prog from %s failed, errno=%d\n", FOO, errno))
90 		goto err;
91 
92 	if (CHECK(system(PING_CMD), "ping_ok", "ping failed\n"))
93 		goto err;
94 
95 	if (CHECK(bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
96 				  BPF_F_ALLOW_OVERRIDE),
97 		  "prog_attach_allow_bar_override",
98 		  "attach prog to %s failed, errno=%d\n", BAR, errno))
99 		goto err;
100 
101 	if (CHECK(!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS, 0),
102 		  "fail_prog_attach_allow_bar_none",
103 		  "attach prog to %s unexpectedly succeeded\n", BAR))
104 		goto err;
105 
106 	if (CHECK(bpf_prog_detach(bar, BPF_CGROUP_INET_EGRESS),
107 		  "prog_detach_bar",
108 		  "detach prog from %s failed, errno=%d\n", BAR, errno))
109 		goto err;
110 
111 	if (CHECK(!bpf_prog_detach(foo, BPF_CGROUP_INET_EGRESS),
112 		  "fail_prog_detach_foo",
113 		  "double detach from %s unexpectedly succeeded\n", FOO))
114 		goto err;
115 
116 	if (CHECK(bpf_prog_attach(allow_prog, foo, BPF_CGROUP_INET_EGRESS, 0),
117 		  "prog_attach_allow_foo_none",
118 		  "attach prog to %s failed, errno=%d\n", FOO, errno))
119 		goto err;
120 
121 	if (CHECK(!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS, 0),
122 		  "fail_prog_attach_allow_bar_none",
123 		  "attach prog to %s unexpectedly succeeded\n", BAR))
124 		goto err;
125 
126 	if (CHECK(!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
127 				   BPF_F_ALLOW_OVERRIDE),
128 		  "fail_prog_attach_allow_bar_override",
129 		  "attach prog to %s unexpectedly succeeded\n", BAR))
130 		goto err;
131 
132 	if (CHECK(!bpf_prog_attach(allow_prog, foo, BPF_CGROUP_INET_EGRESS,
133 				   BPF_F_ALLOW_OVERRIDE),
134 		  "fail_prog_attach_allow_foo_override",
135 		  "attach prog to %s unexpectedly succeeded\n", FOO))
136 		goto err;
137 
138 	if (CHECK(bpf_prog_attach(drop_prog, foo, BPF_CGROUP_INET_EGRESS, 0),
139 		  "prog_attach_drop_foo_none",
140 		  "attach prog to %s failed, errno=%d\n", FOO, errno))
141 		goto err;
142 
143 err:
144 	close(foo);
145 	close(bar);
146 	close(allow_prog);
147 	close(drop_prog);
148 }
149