1 // SPDX-License-Identifier: GPL-2.0
2 
3 #include <sys/types.h>
4 #include <sys/socket.h>
5 #include <test_progs.h>
6 #include <bpf/btf.h>
7 
8 #include "lsm_cgroup.skel.h"
9 #include "lsm_cgroup_nonvoid.skel.h"
10 #include "cgroup_helpers.h"
11 #include "network_helpers.h"
12 
13 #ifndef ENOTSUPP
14 #define ENOTSUPP 524
15 #endif
16 
17 static struct btf *btf;
18 
19 static __u32 query_prog_cnt(int cgroup_fd, const char *attach_func)
20 {
21 	LIBBPF_OPTS(bpf_prog_query_opts, p);
22 	int cnt = 0;
23 	int i;
24 
25 	ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
26 
27 	if (!attach_func)
28 		return p.prog_cnt;
29 
30 	/* When attach_func is provided, count the number of progs that
31 	 * attach to the given symbol.
32 	 */
33 
34 	if (!btf)
35 		btf = btf__load_vmlinux_btf();
36 	if (!ASSERT_OK(libbpf_get_error(btf), "btf_vmlinux"))
37 		return -1;
38 
39 	p.prog_ids = malloc(sizeof(u32) * p.prog_cnt);
40 	p.prog_attach_flags = malloc(sizeof(u32) * p.prog_cnt);
41 	ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
42 
43 	for (i = 0; i < p.prog_cnt; i++) {
44 		struct bpf_prog_info info = {};
45 		__u32 info_len = sizeof(info);
46 		int fd;
47 
48 		fd = bpf_prog_get_fd_by_id(p.prog_ids[i]);
49 		ASSERT_GE(fd, 0, "prog_get_fd_by_id");
50 		ASSERT_OK(bpf_obj_get_info_by_fd(fd, &info, &info_len), "prog_info_by_fd");
51 		close(fd);
52 
53 		if (info.attach_btf_id ==
54 		    btf__find_by_name_kind(btf, attach_func, BTF_KIND_FUNC))
55 			cnt++;
56 	}
57 
58 	free(p.prog_ids);
59 	free(p.prog_attach_flags);
60 
61 	return cnt;
62 }
63 
64 static void test_lsm_cgroup_functional(void)
65 {
66 	DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
67 	DECLARE_LIBBPF_OPTS(bpf_link_update_opts, update_opts);
68 	int cgroup_fd = -1, cgroup_fd2 = -1, cgroup_fd3 = -1;
69 	int listen_fd, client_fd, accepted_fd;
70 	struct lsm_cgroup *skel = NULL;
71 	int post_create_prog_fd2 = -1;
72 	int post_create_prog_fd = -1;
73 	int bind_link_fd2 = -1;
74 	int bind_prog_fd2 = -1;
75 	int alloc_prog_fd = -1;
76 	int bind_prog_fd = -1;
77 	int bind_link_fd = -1;
78 	int clone_prog_fd = -1;
79 	int err, fd, prio;
80 	socklen_t socklen;
81 
82 	cgroup_fd3 = test__join_cgroup("/sock_policy_empty");
83 	if (!ASSERT_GE(cgroup_fd3, 0, "create empty cgroup"))
84 		goto close_cgroup;
85 
86 	cgroup_fd2 = test__join_cgroup("/sock_policy_reuse");
87 	if (!ASSERT_GE(cgroup_fd2, 0, "create cgroup for reuse"))
88 		goto close_cgroup;
89 
90 	cgroup_fd = test__join_cgroup("/sock_policy");
91 	if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup"))
92 		goto close_cgroup;
93 
94 	skel = lsm_cgroup__open_and_load();
95 	if (!ASSERT_OK_PTR(skel, "open_and_load"))
96 		goto close_cgroup;
97 
98 	post_create_prog_fd = bpf_program__fd(skel->progs.socket_post_create);
99 	post_create_prog_fd2 = bpf_program__fd(skel->progs.socket_post_create2);
100 	bind_prog_fd = bpf_program__fd(skel->progs.socket_bind);
101 	bind_prog_fd2 = bpf_program__fd(skel->progs.socket_bind2);
102 	alloc_prog_fd = bpf_program__fd(skel->progs.socket_alloc);
103 	clone_prog_fd = bpf_program__fd(skel->progs.socket_clone);
104 
105 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 0, "prog count");
106 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 0, "total prog count");
107 	err = bpf_prog_attach(alloc_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
108 	if (err == -ENOTSUPP) {
109 		test__skip();
110 		goto close_cgroup;
111 	}
112 	if (!ASSERT_OK(err, "attach alloc_prog_fd"))
113 		goto detach_cgroup;
114 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 1, "prog count");
115 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 1, "total prog count");
116 
117 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 0, "prog count");
118 	err = bpf_prog_attach(clone_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
119 	if (!ASSERT_OK(err, "attach clone_prog_fd"))
120 		goto detach_cgroup;
121 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 1, "prog count");
122 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 2, "total prog count");
123 
124 	/* Make sure replacing works. */
125 
126 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 0, "prog count");
127 	err = bpf_prog_attach(post_create_prog_fd, cgroup_fd,
128 			      BPF_LSM_CGROUP, 0);
129 	if (!ASSERT_OK(err, "attach post_create_prog_fd"))
130 		goto detach_cgroup;
131 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
132 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
133 
134 	attach_opts.replace_prog_fd = post_create_prog_fd;
135 	err = bpf_prog_attach_opts(post_create_prog_fd2, cgroup_fd,
136 				   BPF_LSM_CGROUP, &attach_opts);
137 	if (!ASSERT_OK(err, "prog replace post_create_prog_fd"))
138 		goto detach_cgroup;
139 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
140 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
141 
142 	/* Try the same attach/replace via link API. */
143 
144 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 0, "prog count");
145 	bind_link_fd = bpf_link_create(bind_prog_fd, cgroup_fd,
146 				       BPF_LSM_CGROUP, NULL);
147 	if (!ASSERT_GE(bind_link_fd, 0, "link create bind_prog_fd"))
148 		goto detach_cgroup;
149 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
150 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
151 
152 	update_opts.old_prog_fd = bind_prog_fd;
153 	update_opts.flags = BPF_F_REPLACE;
154 
155 	err = bpf_link_update(bind_link_fd, bind_prog_fd2, &update_opts);
156 	if (!ASSERT_OK(err, "link update bind_prog_fd"))
157 		goto detach_cgroup;
158 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
159 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
160 
161 	/* Attach another instance of bind program to another cgroup.
162 	 * This should trigger the reuse of the trampoline shim (two
163 	 * programs attaching to the same btf_id).
164 	 */
165 
166 	ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
167 	ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 0, "prog count");
168 	bind_link_fd2 = bpf_link_create(bind_prog_fd2, cgroup_fd2,
169 					BPF_LSM_CGROUP, NULL);
170 	if (!ASSERT_GE(bind_link_fd2, 0, "link create bind_prog_fd2"))
171 		goto detach_cgroup;
172 	ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 1, "prog count");
173 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
174 	ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count");
175 
176 	/* AF_UNIX is prohibited. */
177 
178 	fd = socket(AF_UNIX, SOCK_STREAM, 0);
179 	ASSERT_LT(fd, 0, "socket(AF_UNIX)");
180 	close(fd);
181 
182 	/* AF_INET6 gets default policy (sk_priority). */
183 
184 	fd = socket(AF_INET6, SOCK_STREAM, 0);
185 	if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
186 		goto detach_cgroup;
187 
188 	prio = 0;
189 	socklen = sizeof(prio);
190 	ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
191 		  "getsockopt");
192 	ASSERT_EQ(prio, 123, "sk_priority");
193 
194 	close(fd);
195 
196 	/* TX-only AF_PACKET is allowed. */
197 
198 	ASSERT_LT(socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), 0,
199 		  "socket(AF_PACKET, ..., ETH_P_ALL)");
200 
201 	fd = socket(AF_PACKET, SOCK_RAW, 0);
202 	ASSERT_GE(fd, 0, "socket(AF_PACKET, ..., 0)");
203 
204 	/* TX-only AF_PACKET can not be rebound. */
205 
206 	struct sockaddr_ll sa = {
207 		.sll_family = AF_PACKET,
208 		.sll_protocol = htons(ETH_P_ALL),
209 	};
210 	ASSERT_LT(bind(fd, (struct sockaddr *)&sa, sizeof(sa)), 0,
211 		  "bind(ETH_P_ALL)");
212 
213 	close(fd);
214 
215 	/* Trigger passive open. */
216 
217 	listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
218 	ASSERT_GE(listen_fd, 0, "start_server");
219 	client_fd = connect_to_fd(listen_fd, 0);
220 	ASSERT_GE(client_fd, 0, "connect_to_fd");
221 	accepted_fd = accept(listen_fd, NULL, NULL);
222 	ASSERT_GE(accepted_fd, 0, "accept");
223 
224 	prio = 0;
225 	socklen = sizeof(prio);
226 	ASSERT_GE(getsockopt(accepted_fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
227 		  "getsockopt");
228 	ASSERT_EQ(prio, 234, "sk_priority");
229 
230 	/* These are replaced and never called. */
231 	ASSERT_EQ(skel->bss->called_socket_post_create, 0, "called_create");
232 	ASSERT_EQ(skel->bss->called_socket_bind, 0, "called_bind");
233 
234 	/* AF_INET6+SOCK_STREAM
235 	 * AF_PACKET+SOCK_RAW
236 	 * listen_fd
237 	 * client_fd
238 	 * accepted_fd
239 	 */
240 	ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
241 
242 	/* start_server
243 	 * bind(ETH_P_ALL)
244 	 */
245 	ASSERT_EQ(skel->bss->called_socket_bind2, 2, "called_bind2");
246 	/* Single accept(). */
247 	ASSERT_EQ(skel->bss->called_socket_clone, 1, "called_clone");
248 
249 	/* AF_UNIX+SOCK_STREAM (failed)
250 	 * AF_INET6+SOCK_STREAM
251 	 * AF_PACKET+SOCK_RAW (failed)
252 	 * AF_PACKET+SOCK_RAW
253 	 * listen_fd
254 	 * client_fd
255 	 * accepted_fd
256 	 */
257 	ASSERT_EQ(skel->bss->called_socket_alloc, 7, "called_alloc");
258 
259 	close(listen_fd);
260 	close(client_fd);
261 	close(accepted_fd);
262 
263 	/* Make sure other cgroup doesn't trigger the programs. */
264 
265 	if (!ASSERT_OK(join_cgroup("/sock_policy_empty"), "join root cgroup"))
266 		goto detach_cgroup;
267 
268 	fd = socket(AF_INET6, SOCK_STREAM, 0);
269 	if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
270 		goto detach_cgroup;
271 
272 	prio = 0;
273 	socklen = sizeof(prio);
274 	ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
275 		  "getsockopt");
276 	ASSERT_EQ(prio, 0, "sk_priority");
277 
278 	close(fd);
279 
280 detach_cgroup:
281 	ASSERT_GE(bpf_prog_detach2(post_create_prog_fd2, cgroup_fd,
282 				   BPF_LSM_CGROUP), 0, "detach_create");
283 	close(bind_link_fd);
284 	/* Don't close bind_link_fd2, exercise cgroup release cleanup. */
285 	ASSERT_GE(bpf_prog_detach2(alloc_prog_fd, cgroup_fd,
286 				   BPF_LSM_CGROUP), 0, "detach_alloc");
287 	ASSERT_GE(bpf_prog_detach2(clone_prog_fd, cgroup_fd,
288 				   BPF_LSM_CGROUP), 0, "detach_clone");
289 
290 close_cgroup:
291 	close(cgroup_fd);
292 	close(cgroup_fd2);
293 	close(cgroup_fd3);
294 	lsm_cgroup__destroy(skel);
295 }
296 
297 static void test_lsm_cgroup_nonvoid(void)
298 {
299 	struct lsm_cgroup_nonvoid *skel = NULL;
300 
301 	skel = lsm_cgroup_nonvoid__open_and_load();
302 	ASSERT_NULL(skel, "open succeeds");
303 	lsm_cgroup_nonvoid__destroy(skel);
304 }
305 
306 void test_lsm_cgroup(void)
307 {
308 	if (test__start_subtest("functional"))
309 		test_lsm_cgroup_functional();
310 	if (test__start_subtest("nonvoid"))
311 		test_lsm_cgroup_nonvoid();
312 	btf__free(btf);
313 }
314