1 // SPDX-License-Identifier: GPL-2.0 2 // Copyright (c) 2019 Facebook 3 4 #include <fcntl.h> 5 #include <stdint.h> 6 #include <stdio.h> 7 #include <stdlib.h> 8 #include <string.h> 9 #include <unistd.h> 10 11 #include <linux/filter.h> 12 13 #include <bpf/bpf.h> 14 15 #include "bpf_rlimit.h" 16 #include "bpf_util.h" 17 #include "cgroup_helpers.h" 18 19 #define CG_PATH "/foo" 20 #define MAX_INSNS 512 21 #define FIXUP_SYSCTL_VALUE 0 22 23 char bpf_log_buf[BPF_LOG_BUF_SIZE]; 24 25 struct sysctl_test { 26 const char *descr; 27 size_t fixup_value_insn; 28 struct bpf_insn insns[MAX_INSNS]; 29 enum bpf_attach_type attach_type; 30 const char *sysctl; 31 int open_flags; 32 const char *newval; 33 const char *oldval; 34 enum { 35 LOAD_REJECT, 36 ATTACH_REJECT, 37 OP_EPERM, 38 SUCCESS, 39 } result; 40 }; 41 42 static struct sysctl_test tests[] = { 43 { 44 .descr = "sysctl wrong attach_type", 45 .insns = { 46 BPF_MOV64_IMM(BPF_REG_0, 1), 47 BPF_EXIT_INSN(), 48 }, 49 .attach_type = 0, 50 .sysctl = "kernel/ostype", 51 .open_flags = O_RDONLY, 52 .result = ATTACH_REJECT, 53 }, 54 { 55 .descr = "sysctl:read allow all", 56 .insns = { 57 BPF_MOV64_IMM(BPF_REG_0, 1), 58 BPF_EXIT_INSN(), 59 }, 60 .attach_type = BPF_CGROUP_SYSCTL, 61 .sysctl = "kernel/ostype", 62 .open_flags = O_RDONLY, 63 .result = SUCCESS, 64 }, 65 { 66 .descr = "sysctl:read deny all", 67 .insns = { 68 BPF_MOV64_IMM(BPF_REG_0, 0), 69 BPF_EXIT_INSN(), 70 }, 71 .attach_type = BPF_CGROUP_SYSCTL, 72 .sysctl = "kernel/ostype", 73 .open_flags = O_RDONLY, 74 .result = OP_EPERM, 75 }, 76 { 77 .descr = "ctx:write sysctl:read read ok", 78 .insns = { 79 /* If (write) */ 80 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 81 offsetof(struct bpf_sysctl, write)), 82 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 1, 2), 83 84 /* return DENY; */ 85 BPF_MOV64_IMM(BPF_REG_0, 0), 86 BPF_JMP_A(1), 87 88 /* else return ALLOW; */ 89 BPF_MOV64_IMM(BPF_REG_0, 1), 90 BPF_EXIT_INSN(), 91 }, 92 .attach_type = BPF_CGROUP_SYSCTL, 93 .sysctl = "kernel/ostype", 94 .open_flags = O_RDONLY, 95 .result = SUCCESS, 96 }, 97 { 98 .descr = "ctx:write sysctl:write read ok", 99 .insns = { 100 /* If (write) */ 101 BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1, 102 offsetof(struct bpf_sysctl, write)), 103 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 1, 2), 104 105 /* return DENY; */ 106 BPF_MOV64_IMM(BPF_REG_0, 0), 107 BPF_JMP_A(1), 108 109 /* else return ALLOW; */ 110 BPF_MOV64_IMM(BPF_REG_0, 1), 111 BPF_EXIT_INSN(), 112 }, 113 .attach_type = BPF_CGROUP_SYSCTL, 114 .sysctl = "kernel/domainname", 115 .open_flags = O_WRONLY, 116 .newval = "(none)", /* same as default, should fail anyway */ 117 .result = OP_EPERM, 118 }, 119 { 120 .descr = "ctx:write sysctl:read write reject", 121 .insns = { 122 /* write = X */ 123 BPF_MOV64_IMM(BPF_REG_0, 0), 124 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 125 offsetof(struct bpf_sysctl, write)), 126 BPF_MOV64_IMM(BPF_REG_0, 1), 127 BPF_EXIT_INSN(), 128 }, 129 .attach_type = BPF_CGROUP_SYSCTL, 130 .sysctl = "kernel/ostype", 131 .open_flags = O_RDONLY, 132 .result = LOAD_REJECT, 133 }, 134 { 135 .descr = "ctx:file_pos sysctl:read read ok", 136 .insns = { 137 /* If (file_pos == X) */ 138 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 139 offsetof(struct bpf_sysctl, file_pos)), 140 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 2), 141 142 /* return ALLOW; */ 143 BPF_MOV64_IMM(BPF_REG_0, 1), 144 BPF_JMP_A(1), 145 146 /* else return DENY; */ 147 BPF_MOV64_IMM(BPF_REG_0, 0), 148 BPF_EXIT_INSN(), 149 }, 150 .attach_type = BPF_CGROUP_SYSCTL, 151 .sysctl = "kernel/ostype", 152 .open_flags = O_RDONLY, 153 .result = SUCCESS, 154 }, 155 { 156 .descr = "ctx:file_pos sysctl:read read ok narrow", 157 .insns = { 158 /* If (file_pos == X) */ 159 BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1, 160 offsetof(struct bpf_sysctl, file_pos)), 161 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 2), 162 163 /* return ALLOW; */ 164 BPF_MOV64_IMM(BPF_REG_0, 1), 165 BPF_JMP_A(1), 166 167 /* else return DENY; */ 168 BPF_MOV64_IMM(BPF_REG_0, 0), 169 BPF_EXIT_INSN(), 170 }, 171 .attach_type = BPF_CGROUP_SYSCTL, 172 .sysctl = "kernel/ostype", 173 .open_flags = O_RDONLY, 174 .result = SUCCESS, 175 }, 176 { 177 .descr = "ctx:file_pos sysctl:read write ok", 178 .insns = { 179 /* file_pos = X */ 180 BPF_MOV64_IMM(BPF_REG_0, 2), 181 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 182 offsetof(struct bpf_sysctl, file_pos)), 183 BPF_MOV64_IMM(BPF_REG_0, 1), 184 BPF_EXIT_INSN(), 185 }, 186 .attach_type = BPF_CGROUP_SYSCTL, 187 .sysctl = "kernel/ostype", 188 .open_flags = O_RDONLY, 189 .oldval = "nux\n", 190 .result = SUCCESS, 191 }, 192 { 193 .descr = "sysctl_get_name sysctl_value:base ok", 194 .insns = { 195 /* sysctl_get_name arg2 (buf) */ 196 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 197 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 198 BPF_MOV64_IMM(BPF_REG_0, 0), 199 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 200 201 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 202 203 /* sysctl_get_name arg3 (buf_len) */ 204 BPF_MOV64_IMM(BPF_REG_3, 8), 205 206 /* sysctl_get_name arg4 (flags) */ 207 BPF_MOV64_IMM(BPF_REG_4, BPF_F_SYSCTL_BASE_NAME), 208 209 /* sysctl_get_name(ctx, buf, buf_len, flags) */ 210 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_name), 211 212 /* if (ret == expected && */ 213 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, sizeof("tcp_mem") - 1, 6), 214 /* buf == "tcp_mem\0") */ 215 BPF_LD_IMM64(BPF_REG_8, 0x006d656d5f706374ULL), 216 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 217 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 218 219 /* return ALLOW; */ 220 BPF_MOV64_IMM(BPF_REG_0, 1), 221 BPF_JMP_A(1), 222 223 /* else return DENY; */ 224 BPF_MOV64_IMM(BPF_REG_0, 0), 225 BPF_EXIT_INSN(), 226 }, 227 .attach_type = BPF_CGROUP_SYSCTL, 228 .sysctl = "net/ipv4/tcp_mem", 229 .open_flags = O_RDONLY, 230 .result = SUCCESS, 231 }, 232 { 233 .descr = "sysctl_get_name sysctl_value:base E2BIG truncated", 234 .insns = { 235 /* sysctl_get_name arg2 (buf) */ 236 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 237 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 238 BPF_MOV64_IMM(BPF_REG_0, 0), 239 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 240 241 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 242 243 /* sysctl_get_name arg3 (buf_len) too small */ 244 BPF_MOV64_IMM(BPF_REG_3, 7), 245 246 /* sysctl_get_name arg4 (flags) */ 247 BPF_MOV64_IMM(BPF_REG_4, BPF_F_SYSCTL_BASE_NAME), 248 249 /* sysctl_get_name(ctx, buf, buf_len, flags) */ 250 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_name), 251 252 /* if (ret == expected && */ 253 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -E2BIG, 6), 254 255 /* buf[0:7] == "tcp_me\0") */ 256 BPF_LD_IMM64(BPF_REG_8, 0x00656d5f706374ULL), 257 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 258 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 259 260 /* return ALLOW; */ 261 BPF_MOV64_IMM(BPF_REG_0, 1), 262 BPF_JMP_A(1), 263 264 /* else return DENY; */ 265 BPF_MOV64_IMM(BPF_REG_0, 0), 266 BPF_EXIT_INSN(), 267 }, 268 .attach_type = BPF_CGROUP_SYSCTL, 269 .sysctl = "net/ipv4/tcp_mem", 270 .open_flags = O_RDONLY, 271 .result = SUCCESS, 272 }, 273 { 274 .descr = "sysctl_get_name sysctl:full ok", 275 .insns = { 276 /* sysctl_get_name arg2 (buf) */ 277 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 278 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -24), 279 BPF_MOV64_IMM(BPF_REG_0, 0), 280 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 281 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 8), 282 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 16), 283 284 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 285 286 /* sysctl_get_name arg3 (buf_len) */ 287 BPF_MOV64_IMM(BPF_REG_3, 17), 288 289 /* sysctl_get_name arg4 (flags) */ 290 BPF_MOV64_IMM(BPF_REG_4, 0), 291 292 /* sysctl_get_name(ctx, buf, buf_len, flags) */ 293 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_name), 294 295 /* if (ret == expected && */ 296 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 16, 14), 297 298 /* buf[0:8] == "net/ipv4" && */ 299 BPF_LD_IMM64(BPF_REG_8, 0x347670692f74656eULL), 300 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 301 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 10), 302 303 /* buf[8:16] == "/tcp_mem" && */ 304 BPF_LD_IMM64(BPF_REG_8, 0x6d656d5f7063742fULL), 305 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 8), 306 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 6), 307 308 /* buf[16:24] == "\0") */ 309 BPF_LD_IMM64(BPF_REG_8, 0x0ULL), 310 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 16), 311 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 312 313 /* return ALLOW; */ 314 BPF_MOV64_IMM(BPF_REG_0, 1), 315 BPF_JMP_A(1), 316 317 /* else return DENY; */ 318 BPF_MOV64_IMM(BPF_REG_0, 0), 319 BPF_EXIT_INSN(), 320 }, 321 .attach_type = BPF_CGROUP_SYSCTL, 322 .sysctl = "net/ipv4/tcp_mem", 323 .open_flags = O_RDONLY, 324 .result = SUCCESS, 325 }, 326 { 327 .descr = "sysctl_get_name sysctl:full E2BIG truncated", 328 .insns = { 329 /* sysctl_get_name arg2 (buf) */ 330 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 331 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -16), 332 BPF_MOV64_IMM(BPF_REG_0, 0), 333 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 334 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 8), 335 336 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 337 338 /* sysctl_get_name arg3 (buf_len) */ 339 BPF_MOV64_IMM(BPF_REG_3, 16), 340 341 /* sysctl_get_name arg4 (flags) */ 342 BPF_MOV64_IMM(BPF_REG_4, 0), 343 344 /* sysctl_get_name(ctx, buf, buf_len, flags) */ 345 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_name), 346 347 /* if (ret == expected && */ 348 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -E2BIG, 10), 349 350 /* buf[0:8] == "net/ipv4" && */ 351 BPF_LD_IMM64(BPF_REG_8, 0x347670692f74656eULL), 352 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 353 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 6), 354 355 /* buf[8:16] == "/tcp_me\0") */ 356 BPF_LD_IMM64(BPF_REG_8, 0x00656d5f7063742fULL), 357 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 8), 358 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 359 360 /* return ALLOW; */ 361 BPF_MOV64_IMM(BPF_REG_0, 1), 362 BPF_JMP_A(1), 363 364 /* else return DENY; */ 365 BPF_MOV64_IMM(BPF_REG_0, 0), 366 BPF_EXIT_INSN(), 367 }, 368 .attach_type = BPF_CGROUP_SYSCTL, 369 .sysctl = "net/ipv4/tcp_mem", 370 .open_flags = O_RDONLY, 371 .result = SUCCESS, 372 }, 373 { 374 .descr = "sysctl_get_name sysctl:full E2BIG truncated small", 375 .insns = { 376 /* sysctl_get_name arg2 (buf) */ 377 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 378 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 379 BPF_MOV64_IMM(BPF_REG_0, 0), 380 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 381 382 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 383 384 /* sysctl_get_name arg3 (buf_len) */ 385 BPF_MOV64_IMM(BPF_REG_3, 7), 386 387 /* sysctl_get_name arg4 (flags) */ 388 BPF_MOV64_IMM(BPF_REG_4, 0), 389 390 /* sysctl_get_name(ctx, buf, buf_len, flags) */ 391 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_name), 392 393 /* if (ret == expected && */ 394 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -E2BIG, 6), 395 396 /* buf[0:8] == "net/ip\0") */ 397 BPF_LD_IMM64(BPF_REG_8, 0x000070692f74656eULL), 398 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 399 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 400 401 /* return ALLOW; */ 402 BPF_MOV64_IMM(BPF_REG_0, 1), 403 BPF_JMP_A(1), 404 405 /* else return DENY; */ 406 BPF_MOV64_IMM(BPF_REG_0, 0), 407 BPF_EXIT_INSN(), 408 }, 409 .attach_type = BPF_CGROUP_SYSCTL, 410 .sysctl = "net/ipv4/tcp_mem", 411 .open_flags = O_RDONLY, 412 .result = SUCCESS, 413 }, 414 { 415 .descr = "sysctl_get_current_value sysctl:read ok, gt", 416 .insns = { 417 /* sysctl_get_current_value arg2 (buf) */ 418 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 419 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 420 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 421 422 /* sysctl_get_current_value arg3 (buf_len) */ 423 BPF_MOV64_IMM(BPF_REG_3, 8), 424 425 /* sysctl_get_current_value(ctx, buf, buf_len) */ 426 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_current_value), 427 428 /* if (ret == expected && */ 429 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 6, 6), 430 431 /* buf[0:6] == "Linux\n\0") */ 432 BPF_LD_IMM64(BPF_REG_8, 0x000a78756e694cULL), 433 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 434 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 435 436 /* return ALLOW; */ 437 BPF_MOV64_IMM(BPF_REG_0, 1), 438 BPF_JMP_A(1), 439 440 /* else return DENY; */ 441 BPF_MOV64_IMM(BPF_REG_0, 0), 442 BPF_EXIT_INSN(), 443 }, 444 .attach_type = BPF_CGROUP_SYSCTL, 445 .sysctl = "kernel/ostype", 446 .open_flags = O_RDONLY, 447 .result = SUCCESS, 448 }, 449 { 450 .descr = "sysctl_get_current_value sysctl:read ok, eq", 451 .insns = { 452 /* sysctl_get_current_value arg2 (buf) */ 453 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 454 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 455 BPF_MOV64_IMM(BPF_REG_0, 0), 456 BPF_STX_MEM(BPF_B, BPF_REG_7, BPF_REG_0, 7), 457 458 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 459 460 /* sysctl_get_current_value arg3 (buf_len) */ 461 BPF_MOV64_IMM(BPF_REG_3, 7), 462 463 /* sysctl_get_current_value(ctx, buf, buf_len) */ 464 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_current_value), 465 466 /* if (ret == expected && */ 467 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 6, 6), 468 469 /* buf[0:6] == "Linux\n\0") */ 470 BPF_LD_IMM64(BPF_REG_8, 0x000a78756e694cULL), 471 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 472 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 473 474 /* return ALLOW; */ 475 BPF_MOV64_IMM(BPF_REG_0, 1), 476 BPF_JMP_A(1), 477 478 /* else return DENY; */ 479 BPF_MOV64_IMM(BPF_REG_0, 0), 480 BPF_EXIT_INSN(), 481 }, 482 .attach_type = BPF_CGROUP_SYSCTL, 483 .sysctl = "kernel/ostype", 484 .open_flags = O_RDONLY, 485 .result = SUCCESS, 486 }, 487 { 488 .descr = "sysctl_get_current_value sysctl:read E2BIG truncated", 489 .insns = { 490 /* sysctl_get_current_value arg2 (buf) */ 491 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 492 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 493 BPF_MOV64_IMM(BPF_REG_0, 0), 494 BPF_STX_MEM(BPF_H, BPF_REG_7, BPF_REG_0, 6), 495 496 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 497 498 /* sysctl_get_current_value arg3 (buf_len) */ 499 BPF_MOV64_IMM(BPF_REG_3, 6), 500 501 /* sysctl_get_current_value(ctx, buf, buf_len) */ 502 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_current_value), 503 504 /* if (ret == expected && */ 505 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -E2BIG, 6), 506 507 /* buf[0:6] == "Linux\0") */ 508 BPF_LD_IMM64(BPF_REG_8, 0x000078756e694cULL), 509 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 510 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 511 512 /* return ALLOW; */ 513 BPF_MOV64_IMM(BPF_REG_0, 1), 514 BPF_JMP_A(1), 515 516 /* else return DENY; */ 517 BPF_MOV64_IMM(BPF_REG_0, 0), 518 BPF_EXIT_INSN(), 519 }, 520 .attach_type = BPF_CGROUP_SYSCTL, 521 .sysctl = "kernel/ostype", 522 .open_flags = O_RDONLY, 523 .result = SUCCESS, 524 }, 525 { 526 .descr = "sysctl_get_current_value sysctl:read EINVAL", 527 .insns = { 528 /* sysctl_get_current_value arg2 (buf) */ 529 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 530 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 531 532 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 533 534 /* sysctl_get_current_value arg3 (buf_len) */ 535 BPF_MOV64_IMM(BPF_REG_3, 8), 536 537 /* sysctl_get_current_value(ctx, buf, buf_len) */ 538 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_current_value), 539 540 /* if (ret == expected && */ 541 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -EINVAL, 4), 542 543 /* buf[0:8] is NUL-filled) */ 544 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 545 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 0, 2), 546 547 /* return DENY; */ 548 BPF_MOV64_IMM(BPF_REG_0, 0), 549 BPF_JMP_A(1), 550 551 /* else return ALLOW; */ 552 BPF_MOV64_IMM(BPF_REG_0, 1), 553 BPF_EXIT_INSN(), 554 }, 555 .attach_type = BPF_CGROUP_SYSCTL, 556 .sysctl = "net/ipv6/conf/lo/stable_secret", /* -EIO */ 557 .open_flags = O_RDONLY, 558 .result = OP_EPERM, 559 }, 560 { 561 .descr = "sysctl_get_current_value sysctl:write ok", 562 .fixup_value_insn = 6, 563 .insns = { 564 /* sysctl_get_current_value arg2 (buf) */ 565 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 566 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 567 568 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 569 570 /* sysctl_get_current_value arg3 (buf_len) */ 571 BPF_MOV64_IMM(BPF_REG_3, 8), 572 573 /* sysctl_get_current_value(ctx, buf, buf_len) */ 574 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_current_value), 575 576 /* if (ret == expected && */ 577 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, 6), 578 579 /* buf[0:4] == expected) */ 580 BPF_LD_IMM64(BPF_REG_8, FIXUP_SYSCTL_VALUE), 581 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 582 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 583 584 /* return DENY; */ 585 BPF_MOV64_IMM(BPF_REG_0, 0), 586 BPF_JMP_A(1), 587 588 /* else return ALLOW; */ 589 BPF_MOV64_IMM(BPF_REG_0, 1), 590 BPF_EXIT_INSN(), 591 }, 592 .attach_type = BPF_CGROUP_SYSCTL, 593 .sysctl = "net/ipv4/route/mtu_expires", 594 .open_flags = O_WRONLY, 595 .newval = "600", /* same as default, should fail anyway */ 596 .result = OP_EPERM, 597 }, 598 { 599 .descr = "sysctl_get_new_value sysctl:read EINVAL", 600 .insns = { 601 /* sysctl_get_new_value arg2 (buf) */ 602 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 603 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 604 BPF_MOV64_IMM(BPF_REG_0, 0), 605 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 606 607 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 608 609 /* sysctl_get_new_value arg3 (buf_len) */ 610 BPF_MOV64_IMM(BPF_REG_3, 8), 611 612 /* sysctl_get_new_value(ctx, buf, buf_len) */ 613 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_new_value), 614 615 /* if (ret == expected) */ 616 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -EINVAL, 2), 617 618 /* return ALLOW; */ 619 BPF_MOV64_IMM(BPF_REG_0, 1), 620 BPF_JMP_A(1), 621 622 /* else return DENY; */ 623 BPF_MOV64_IMM(BPF_REG_0, 0), 624 BPF_EXIT_INSN(), 625 }, 626 .attach_type = BPF_CGROUP_SYSCTL, 627 .sysctl = "net/ipv4/tcp_mem", 628 .open_flags = O_RDONLY, 629 .result = SUCCESS, 630 }, 631 { 632 .descr = "sysctl_get_new_value sysctl:write ok", 633 .insns = { 634 /* sysctl_get_new_value arg2 (buf) */ 635 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 636 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 637 638 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 639 640 /* sysctl_get_new_value arg3 (buf_len) */ 641 BPF_MOV64_IMM(BPF_REG_3, 4), 642 643 /* sysctl_get_new_value(ctx, buf, buf_len) */ 644 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_new_value), 645 646 /* if (ret == expected && */ 647 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 3, 4), 648 649 /* buf[0:4] == "606\0") */ 650 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_7, 0), 651 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 0x00363036, 2), 652 653 /* return DENY; */ 654 BPF_MOV64_IMM(BPF_REG_0, 0), 655 BPF_JMP_A(1), 656 657 /* else return ALLOW; */ 658 BPF_MOV64_IMM(BPF_REG_0, 1), 659 BPF_EXIT_INSN(), 660 }, 661 .attach_type = BPF_CGROUP_SYSCTL, 662 .sysctl = "net/ipv4/route/mtu_expires", 663 .open_flags = O_WRONLY, 664 .newval = "606", 665 .result = OP_EPERM, 666 }, 667 { 668 .descr = "sysctl_get_new_value sysctl:write ok long", 669 .insns = { 670 /* sysctl_get_new_value arg2 (buf) */ 671 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 672 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -24), 673 674 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 675 676 /* sysctl_get_new_value arg3 (buf_len) */ 677 BPF_MOV64_IMM(BPF_REG_3, 24), 678 679 /* sysctl_get_new_value(ctx, buf, buf_len) */ 680 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_new_value), 681 682 /* if (ret == expected && */ 683 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 23, 14), 684 685 /* buf[0:8] == "3000000 " && */ 686 BPF_LD_IMM64(BPF_REG_8, 0x2030303030303033ULL), 687 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 688 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 10), 689 690 /* buf[8:16] == "4000000 " && */ 691 BPF_LD_IMM64(BPF_REG_8, 0x2030303030303034ULL), 692 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 8), 693 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 6), 694 695 /* buf[16:24] == "6000000\0") */ 696 BPF_LD_IMM64(BPF_REG_8, 0x0030303030303036ULL), 697 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 16), 698 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 699 700 /* return DENY; */ 701 BPF_MOV64_IMM(BPF_REG_0, 0), 702 BPF_JMP_A(1), 703 704 /* else return ALLOW; */ 705 BPF_MOV64_IMM(BPF_REG_0, 1), 706 BPF_EXIT_INSN(), 707 }, 708 .attach_type = BPF_CGROUP_SYSCTL, 709 .sysctl = "net/ipv4/tcp_mem", 710 .open_flags = O_WRONLY, 711 .newval = "3000000 4000000 6000000", 712 .result = OP_EPERM, 713 }, 714 { 715 .descr = "sysctl_get_new_value sysctl:write E2BIG", 716 .insns = { 717 /* sysctl_get_new_value arg2 (buf) */ 718 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 719 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 720 BPF_MOV64_IMM(BPF_REG_0, 0), 721 BPF_STX_MEM(BPF_B, BPF_REG_7, BPF_REG_0, 3), 722 723 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 724 725 /* sysctl_get_new_value arg3 (buf_len) */ 726 BPF_MOV64_IMM(BPF_REG_3, 3), 727 728 /* sysctl_get_new_value(ctx, buf, buf_len) */ 729 BPF_EMIT_CALL(BPF_FUNC_sysctl_get_new_value), 730 731 /* if (ret == expected && */ 732 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -E2BIG, 4), 733 734 /* buf[0:3] == "60\0") */ 735 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_7, 0), 736 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 0x003036, 2), 737 738 /* return DENY; */ 739 BPF_MOV64_IMM(BPF_REG_0, 0), 740 BPF_JMP_A(1), 741 742 /* else return ALLOW; */ 743 BPF_MOV64_IMM(BPF_REG_0, 1), 744 BPF_EXIT_INSN(), 745 }, 746 .attach_type = BPF_CGROUP_SYSCTL, 747 .sysctl = "net/ipv4/route/mtu_expires", 748 .open_flags = O_WRONLY, 749 .newval = "606", 750 .result = OP_EPERM, 751 }, 752 { 753 .descr = "sysctl_set_new_value sysctl:read EINVAL", 754 .insns = { 755 /* sysctl_set_new_value arg2 (buf) */ 756 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 757 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 758 BPF_MOV64_IMM(BPF_REG_0, 0x00303036), 759 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 760 761 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 762 763 /* sysctl_set_new_value arg3 (buf_len) */ 764 BPF_MOV64_IMM(BPF_REG_3, 3), 765 766 /* sysctl_set_new_value(ctx, buf, buf_len) */ 767 BPF_EMIT_CALL(BPF_FUNC_sysctl_set_new_value), 768 769 /* if (ret == expected) */ 770 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -EINVAL, 2), 771 772 /* return ALLOW; */ 773 BPF_MOV64_IMM(BPF_REG_0, 1), 774 BPF_JMP_A(1), 775 776 /* else return DENY; */ 777 BPF_MOV64_IMM(BPF_REG_0, 0), 778 BPF_EXIT_INSN(), 779 }, 780 .attach_type = BPF_CGROUP_SYSCTL, 781 .sysctl = "net/ipv4/route/mtu_expires", 782 .open_flags = O_RDONLY, 783 .result = SUCCESS, 784 }, 785 { 786 .descr = "sysctl_set_new_value sysctl:write ok", 787 .fixup_value_insn = 2, 788 .insns = { 789 /* sysctl_set_new_value arg2 (buf) */ 790 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 791 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 792 BPF_MOV64_IMM(BPF_REG_0, FIXUP_SYSCTL_VALUE), 793 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 794 795 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 796 797 /* sysctl_set_new_value arg3 (buf_len) */ 798 BPF_MOV64_IMM(BPF_REG_3, 3), 799 800 /* sysctl_set_new_value(ctx, buf, buf_len) */ 801 BPF_EMIT_CALL(BPF_FUNC_sysctl_set_new_value), 802 803 /* if (ret == expected) */ 804 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 805 806 /* return ALLOW; */ 807 BPF_MOV64_IMM(BPF_REG_0, 1), 808 BPF_JMP_A(1), 809 810 /* else return DENY; */ 811 BPF_MOV64_IMM(BPF_REG_0, 0), 812 BPF_EXIT_INSN(), 813 }, 814 .attach_type = BPF_CGROUP_SYSCTL, 815 .sysctl = "net/ipv4/route/mtu_expires", 816 .open_flags = O_WRONLY, 817 .newval = "606", 818 .result = SUCCESS, 819 }, 820 { 821 "bpf_strtoul one number string", 822 .insns = { 823 /* arg1 (buf) */ 824 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 825 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 826 BPF_MOV64_IMM(BPF_REG_0, 0x00303036), 827 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 828 829 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 830 831 /* arg2 (buf_len) */ 832 BPF_MOV64_IMM(BPF_REG_2, 4), 833 834 /* arg3 (flags) */ 835 BPF_MOV64_IMM(BPF_REG_3, 0), 836 837 /* arg4 (res) */ 838 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 839 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 840 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 841 842 BPF_EMIT_CALL(BPF_FUNC_strtoul), 843 844 /* if (ret == expected && */ 845 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 3, 4), 846 /* res == expected) */ 847 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 848 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 600, 2), 849 850 /* return ALLOW; */ 851 BPF_MOV64_IMM(BPF_REG_0, 1), 852 BPF_JMP_A(1), 853 854 /* else return DENY; */ 855 BPF_MOV64_IMM(BPF_REG_0, 0), 856 BPF_EXIT_INSN(), 857 }, 858 .attach_type = BPF_CGROUP_SYSCTL, 859 .sysctl = "net/ipv4/route/mtu_expires", 860 .open_flags = O_RDONLY, 861 .result = SUCCESS, 862 }, 863 { 864 "bpf_strtoul multi number string", 865 .insns = { 866 /* arg1 (buf) */ 867 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 868 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 869 /* "600 602\0" */ 870 BPF_LD_IMM64(BPF_REG_0, 0x0032303620303036ULL), 871 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 872 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 873 874 /* arg2 (buf_len) */ 875 BPF_MOV64_IMM(BPF_REG_2, 8), 876 877 /* arg3 (flags) */ 878 BPF_MOV64_IMM(BPF_REG_3, 0), 879 880 /* arg4 (res) */ 881 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 882 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 883 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 884 885 BPF_EMIT_CALL(BPF_FUNC_strtoul), 886 887 /* if (ret == expected && */ 888 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 3, 18), 889 /* res == expected) */ 890 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 891 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 600, 16), 892 893 /* arg1 (buf) */ 894 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 895 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 896 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0), 897 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 898 899 /* arg2 (buf_len) */ 900 BPF_MOV64_IMM(BPF_REG_2, 8), 901 BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_0), 902 903 /* arg3 (flags) */ 904 BPF_MOV64_IMM(BPF_REG_3, 0), 905 906 /* arg4 (res) */ 907 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 908 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -16), 909 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 910 911 BPF_EMIT_CALL(BPF_FUNC_strtoul), 912 913 /* if (ret == expected && */ 914 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, 4), 915 /* res == expected) */ 916 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 917 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 602, 2), 918 919 /* return ALLOW; */ 920 BPF_MOV64_IMM(BPF_REG_0, 1), 921 BPF_JMP_A(1), 922 923 /* else return DENY; */ 924 BPF_MOV64_IMM(BPF_REG_0, 0), 925 BPF_EXIT_INSN(), 926 }, 927 .attach_type = BPF_CGROUP_SYSCTL, 928 .sysctl = "net/ipv4/tcp_mem", 929 .open_flags = O_RDONLY, 930 .result = SUCCESS, 931 }, 932 { 933 "bpf_strtoul buf_len = 0, reject", 934 .insns = { 935 /* arg1 (buf) */ 936 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 937 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 938 BPF_MOV64_IMM(BPF_REG_0, 0x00303036), 939 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 940 941 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 942 943 /* arg2 (buf_len) */ 944 BPF_MOV64_IMM(BPF_REG_2, 0), 945 946 /* arg3 (flags) */ 947 BPF_MOV64_IMM(BPF_REG_3, 0), 948 949 /* arg4 (res) */ 950 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 951 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 952 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 953 954 BPF_EMIT_CALL(BPF_FUNC_strtoul), 955 956 BPF_MOV64_IMM(BPF_REG_0, 1), 957 BPF_EXIT_INSN(), 958 }, 959 .attach_type = BPF_CGROUP_SYSCTL, 960 .sysctl = "net/ipv4/route/mtu_expires", 961 .open_flags = O_RDONLY, 962 .result = LOAD_REJECT, 963 }, 964 { 965 "bpf_strtoul supported base, ok", 966 .insns = { 967 /* arg1 (buf) */ 968 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 969 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 970 BPF_MOV64_IMM(BPF_REG_0, 0x00373730), 971 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 972 973 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 974 975 /* arg2 (buf_len) */ 976 BPF_MOV64_IMM(BPF_REG_2, 4), 977 978 /* arg3 (flags) */ 979 BPF_MOV64_IMM(BPF_REG_3, 8), 980 981 /* arg4 (res) */ 982 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 983 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 984 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 985 986 BPF_EMIT_CALL(BPF_FUNC_strtoul), 987 988 /* if (ret == expected && */ 989 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 3, 4), 990 /* res == expected) */ 991 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 992 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 63, 2), 993 994 /* return ALLOW; */ 995 BPF_MOV64_IMM(BPF_REG_0, 1), 996 BPF_JMP_A(1), 997 998 /* else return DENY; */ 999 BPF_MOV64_IMM(BPF_REG_0, 0), 1000 BPF_EXIT_INSN(), 1001 }, 1002 .attach_type = BPF_CGROUP_SYSCTL, 1003 .sysctl = "net/ipv4/route/mtu_expires", 1004 .open_flags = O_RDONLY, 1005 .result = SUCCESS, 1006 }, 1007 { 1008 "bpf_strtoul unsupported base, EINVAL", 1009 .insns = { 1010 /* arg1 (buf) */ 1011 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 1012 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1013 BPF_MOV64_IMM(BPF_REG_0, 0x00303036), 1014 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1015 1016 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1017 1018 /* arg2 (buf_len) */ 1019 BPF_MOV64_IMM(BPF_REG_2, 4), 1020 1021 /* arg3 (flags) */ 1022 BPF_MOV64_IMM(BPF_REG_3, 3), 1023 1024 /* arg4 (res) */ 1025 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1026 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1027 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 1028 1029 BPF_EMIT_CALL(BPF_FUNC_strtoul), 1030 1031 /* if (ret == expected) */ 1032 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -EINVAL, 2), 1033 1034 /* return ALLOW; */ 1035 BPF_MOV64_IMM(BPF_REG_0, 1), 1036 BPF_JMP_A(1), 1037 1038 /* else return DENY; */ 1039 BPF_MOV64_IMM(BPF_REG_0, 0), 1040 BPF_EXIT_INSN(), 1041 }, 1042 .attach_type = BPF_CGROUP_SYSCTL, 1043 .sysctl = "net/ipv4/route/mtu_expires", 1044 .open_flags = O_RDONLY, 1045 .result = SUCCESS, 1046 }, 1047 { 1048 "bpf_strtoul buf with spaces only, EINVAL", 1049 .insns = { 1050 /* arg1 (buf) */ 1051 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 1052 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1053 BPF_MOV64_IMM(BPF_REG_0, 0x090a0c0d), 1054 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1055 1056 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1057 1058 /* arg2 (buf_len) */ 1059 BPF_MOV64_IMM(BPF_REG_2, 4), 1060 1061 /* arg3 (flags) */ 1062 BPF_MOV64_IMM(BPF_REG_3, 0), 1063 1064 /* arg4 (res) */ 1065 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1066 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1067 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 1068 1069 BPF_EMIT_CALL(BPF_FUNC_strtoul), 1070 1071 /* if (ret == expected) */ 1072 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -EINVAL, 2), 1073 1074 /* return ALLOW; */ 1075 BPF_MOV64_IMM(BPF_REG_0, 1), 1076 BPF_JMP_A(1), 1077 1078 /* else return DENY; */ 1079 BPF_MOV64_IMM(BPF_REG_0, 0), 1080 BPF_EXIT_INSN(), 1081 }, 1082 .attach_type = BPF_CGROUP_SYSCTL, 1083 .sysctl = "net/ipv4/route/mtu_expires", 1084 .open_flags = O_RDONLY, 1085 .result = SUCCESS, 1086 }, 1087 { 1088 "bpf_strtoul negative number, EINVAL", 1089 .insns = { 1090 /* arg1 (buf) */ 1091 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 1092 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1093 BPF_MOV64_IMM(BPF_REG_0, 0x00362d0a), /* " -6\0" */ 1094 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1095 1096 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1097 1098 /* arg2 (buf_len) */ 1099 BPF_MOV64_IMM(BPF_REG_2, 4), 1100 1101 /* arg3 (flags) */ 1102 BPF_MOV64_IMM(BPF_REG_3, 0), 1103 1104 /* arg4 (res) */ 1105 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1106 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1107 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 1108 1109 BPF_EMIT_CALL(BPF_FUNC_strtoul), 1110 1111 /* if (ret == expected) */ 1112 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -EINVAL, 2), 1113 1114 /* return ALLOW; */ 1115 BPF_MOV64_IMM(BPF_REG_0, 1), 1116 BPF_JMP_A(1), 1117 1118 /* else return DENY; */ 1119 BPF_MOV64_IMM(BPF_REG_0, 0), 1120 BPF_EXIT_INSN(), 1121 }, 1122 .attach_type = BPF_CGROUP_SYSCTL, 1123 .sysctl = "net/ipv4/route/mtu_expires", 1124 .open_flags = O_RDONLY, 1125 .result = SUCCESS, 1126 }, 1127 { 1128 "bpf_strtol negative number, ok", 1129 .insns = { 1130 /* arg1 (buf) */ 1131 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 1132 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1133 BPF_MOV64_IMM(BPF_REG_0, 0x00362d0a), /* " -6\0" */ 1134 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1135 1136 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1137 1138 /* arg2 (buf_len) */ 1139 BPF_MOV64_IMM(BPF_REG_2, 4), 1140 1141 /* arg3 (flags) */ 1142 BPF_MOV64_IMM(BPF_REG_3, 10), 1143 1144 /* arg4 (res) */ 1145 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1146 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1147 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 1148 1149 BPF_EMIT_CALL(BPF_FUNC_strtol), 1150 1151 /* if (ret == expected && */ 1152 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 3, 4), 1153 /* res == expected) */ 1154 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 1155 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, -6, 2), 1156 1157 /* return ALLOW; */ 1158 BPF_MOV64_IMM(BPF_REG_0, 1), 1159 BPF_JMP_A(1), 1160 1161 /* else return DENY; */ 1162 BPF_MOV64_IMM(BPF_REG_0, 0), 1163 BPF_EXIT_INSN(), 1164 }, 1165 .attach_type = BPF_CGROUP_SYSCTL, 1166 .sysctl = "net/ipv4/route/mtu_expires", 1167 .open_flags = O_RDONLY, 1168 .result = SUCCESS, 1169 }, 1170 { 1171 "bpf_strtol hex number, ok", 1172 .insns = { 1173 /* arg1 (buf) */ 1174 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 1175 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1176 BPF_MOV64_IMM(BPF_REG_0, 0x65667830), /* "0xfe" */ 1177 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1178 1179 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1180 1181 /* arg2 (buf_len) */ 1182 BPF_MOV64_IMM(BPF_REG_2, 4), 1183 1184 /* arg3 (flags) */ 1185 BPF_MOV64_IMM(BPF_REG_3, 0), 1186 1187 /* arg4 (res) */ 1188 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1189 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1190 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 1191 1192 BPF_EMIT_CALL(BPF_FUNC_strtol), 1193 1194 /* if (ret == expected && */ 1195 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, 4), 1196 /* res == expected) */ 1197 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 1198 BPF_JMP_IMM(BPF_JNE, BPF_REG_9, 254, 2), 1199 1200 /* return ALLOW; */ 1201 BPF_MOV64_IMM(BPF_REG_0, 1), 1202 BPF_JMP_A(1), 1203 1204 /* else return DENY; */ 1205 BPF_MOV64_IMM(BPF_REG_0, 0), 1206 BPF_EXIT_INSN(), 1207 }, 1208 .attach_type = BPF_CGROUP_SYSCTL, 1209 .sysctl = "net/ipv4/route/mtu_expires", 1210 .open_flags = O_RDONLY, 1211 .result = SUCCESS, 1212 }, 1213 { 1214 "bpf_strtol max long", 1215 .insns = { 1216 /* arg1 (buf) 9223372036854775807 */ 1217 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 1218 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -24), 1219 BPF_LD_IMM64(BPF_REG_0, 0x3032373333323239ULL), 1220 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1221 BPF_LD_IMM64(BPF_REG_0, 0x3537373435383633ULL), 1222 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 8), 1223 BPF_LD_IMM64(BPF_REG_0, 0x0000000000373038ULL), 1224 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 16), 1225 1226 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1227 1228 /* arg2 (buf_len) */ 1229 BPF_MOV64_IMM(BPF_REG_2, 19), 1230 1231 /* arg3 (flags) */ 1232 BPF_MOV64_IMM(BPF_REG_3, 0), 1233 1234 /* arg4 (res) */ 1235 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1236 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1237 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 1238 1239 BPF_EMIT_CALL(BPF_FUNC_strtol), 1240 1241 /* if (ret == expected && */ 1242 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 19, 6), 1243 /* res == expected) */ 1244 BPF_LD_IMM64(BPF_REG_8, 0x7fffffffffffffffULL), 1245 BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_7, 0), 1246 BPF_JMP_REG(BPF_JNE, BPF_REG_8, BPF_REG_9, 2), 1247 1248 /* return ALLOW; */ 1249 BPF_MOV64_IMM(BPF_REG_0, 1), 1250 BPF_JMP_A(1), 1251 1252 /* else return DENY; */ 1253 BPF_MOV64_IMM(BPF_REG_0, 0), 1254 BPF_EXIT_INSN(), 1255 }, 1256 .attach_type = BPF_CGROUP_SYSCTL, 1257 .sysctl = "net/ipv4/route/mtu_expires", 1258 .open_flags = O_RDONLY, 1259 .result = SUCCESS, 1260 }, 1261 { 1262 "bpf_strtol overflow, ERANGE", 1263 .insns = { 1264 /* arg1 (buf) 9223372036854775808 */ 1265 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10), 1266 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -24), 1267 BPF_LD_IMM64(BPF_REG_0, 0x3032373333323239ULL), 1268 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1269 BPF_LD_IMM64(BPF_REG_0, 0x3537373435383633ULL), 1270 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 8), 1271 BPF_LD_IMM64(BPF_REG_0, 0x0000000000383038ULL), 1272 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 16), 1273 1274 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1275 1276 /* arg2 (buf_len) */ 1277 BPF_MOV64_IMM(BPF_REG_2, 19), 1278 1279 /* arg3 (flags) */ 1280 BPF_MOV64_IMM(BPF_REG_3, 0), 1281 1282 /* arg4 (res) */ 1283 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8), 1284 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1285 BPF_MOV64_REG(BPF_REG_4, BPF_REG_7), 1286 1287 BPF_EMIT_CALL(BPF_FUNC_strtol), 1288 1289 /* if (ret == expected) */ 1290 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, -ERANGE, 2), 1291 1292 /* return ALLOW; */ 1293 BPF_MOV64_IMM(BPF_REG_0, 1), 1294 BPF_JMP_A(1), 1295 1296 /* else return DENY; */ 1297 BPF_MOV64_IMM(BPF_REG_0, 0), 1298 BPF_EXIT_INSN(), 1299 }, 1300 .attach_type = BPF_CGROUP_SYSCTL, 1301 .sysctl = "net/ipv4/route/mtu_expires", 1302 .open_flags = O_RDONLY, 1303 .result = SUCCESS, 1304 }, 1305 }; 1306 1307 static size_t probe_prog_length(const struct bpf_insn *fp) 1308 { 1309 size_t len; 1310 1311 for (len = MAX_INSNS - 1; len > 0; --len) 1312 if (fp[len].code != 0 || fp[len].imm != 0) 1313 break; 1314 return len + 1; 1315 } 1316 1317 static int fixup_sysctl_value(const char *buf, size_t buf_len, 1318 struct bpf_insn *prog, size_t insn_num) 1319 { 1320 uint32_t value_num = 0; 1321 uint8_t c, i; 1322 1323 if (buf_len > sizeof(value_num)) { 1324 log_err("Value is too big (%zd) to use in fixup", buf_len); 1325 return -1; 1326 } 1327 1328 for (i = 0; i < buf_len; ++i) { 1329 c = buf[i]; 1330 value_num |= (c << i * 8); 1331 } 1332 1333 prog[insn_num].imm = value_num; 1334 1335 return 0; 1336 } 1337 1338 static int load_sysctl_prog(struct sysctl_test *test, const char *sysctl_path) 1339 { 1340 struct bpf_insn *prog = test->insns; 1341 struct bpf_load_program_attr attr; 1342 int ret; 1343 1344 memset(&attr, 0, sizeof(struct bpf_load_program_attr)); 1345 attr.prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL; 1346 attr.insns = prog; 1347 attr.insns_cnt = probe_prog_length(attr.insns); 1348 attr.license = "GPL"; 1349 1350 if (test->fixup_value_insn) { 1351 char buf[128]; 1352 ssize_t len; 1353 int fd; 1354 1355 fd = open(sysctl_path, O_RDONLY | O_CLOEXEC); 1356 if (fd < 0) { 1357 log_err("open(%s) failed", sysctl_path); 1358 return -1; 1359 } 1360 len = read(fd, buf, sizeof(buf)); 1361 if (len == -1) { 1362 log_err("read(%s) failed", sysctl_path); 1363 close(fd); 1364 return -1; 1365 } 1366 close(fd); 1367 if (fixup_sysctl_value(buf, len, prog, test->fixup_value_insn)) 1368 return -1; 1369 } 1370 1371 ret = bpf_load_program_xattr(&attr, bpf_log_buf, BPF_LOG_BUF_SIZE); 1372 if (ret < 0 && test->result != LOAD_REJECT) { 1373 log_err(">>> Loading program error.\n" 1374 ">>> Verifier output:\n%s\n-------\n", bpf_log_buf); 1375 } 1376 1377 return ret; 1378 } 1379 1380 static int access_sysctl(const char *sysctl_path, 1381 const struct sysctl_test *test) 1382 { 1383 int err = 0; 1384 int fd; 1385 1386 fd = open(sysctl_path, test->open_flags | O_CLOEXEC); 1387 if (fd < 0) 1388 return fd; 1389 1390 if (test->open_flags == O_RDONLY) { 1391 char buf[128]; 1392 1393 if (read(fd, buf, sizeof(buf)) == -1) 1394 goto err; 1395 if (test->oldval && 1396 strncmp(buf, test->oldval, strlen(test->oldval))) { 1397 log_err("Read value %s != %s", buf, test->oldval); 1398 goto err; 1399 } 1400 } else if (test->open_flags == O_WRONLY) { 1401 if (!test->newval) { 1402 log_err("New value for sysctl is not set"); 1403 goto err; 1404 } 1405 if (write(fd, test->newval, strlen(test->newval)) == -1) 1406 goto err; 1407 } else { 1408 log_err("Unexpected sysctl access: neither read nor write"); 1409 goto err; 1410 } 1411 1412 goto out; 1413 err: 1414 err = -1; 1415 out: 1416 close(fd); 1417 return err; 1418 } 1419 1420 static int run_test_case(int cgfd, struct sysctl_test *test) 1421 { 1422 enum bpf_attach_type atype = test->attach_type; 1423 char sysctl_path[128]; 1424 int progfd = -1; 1425 int err = 0; 1426 1427 printf("Test case: %s .. ", test->descr); 1428 1429 snprintf(sysctl_path, sizeof(sysctl_path), "/proc/sys/%s", 1430 test->sysctl); 1431 1432 progfd = load_sysctl_prog(test, sysctl_path); 1433 if (progfd < 0) { 1434 if (test->result == LOAD_REJECT) 1435 goto out; 1436 else 1437 goto err; 1438 } 1439 1440 if (bpf_prog_attach(progfd, cgfd, atype, BPF_F_ALLOW_OVERRIDE) == -1) { 1441 if (test->result == ATTACH_REJECT) 1442 goto out; 1443 else 1444 goto err; 1445 } 1446 1447 if (access_sysctl(sysctl_path, test) == -1) { 1448 if (test->result == OP_EPERM && errno == EPERM) 1449 goto out; 1450 else 1451 goto err; 1452 } 1453 1454 if (test->result != SUCCESS) { 1455 log_err("Unexpected failure"); 1456 goto err; 1457 } 1458 1459 goto out; 1460 err: 1461 err = -1; 1462 out: 1463 /* Detaching w/o checking return code: best effort attempt. */ 1464 if (progfd != -1) 1465 bpf_prog_detach(cgfd, atype); 1466 close(progfd); 1467 printf("[%s]\n", err ? "FAIL" : "PASS"); 1468 return err; 1469 } 1470 1471 static int run_tests(int cgfd) 1472 { 1473 int passes = 0; 1474 int fails = 0; 1475 int i; 1476 1477 for (i = 0; i < ARRAY_SIZE(tests); ++i) { 1478 if (run_test_case(cgfd, &tests[i])) 1479 ++fails; 1480 else 1481 ++passes; 1482 } 1483 printf("Summary: %d PASSED, %d FAILED\n", passes, fails); 1484 return fails ? -1 : 0; 1485 } 1486 1487 int main(int argc, char **argv) 1488 { 1489 int cgfd = -1; 1490 int err = 0; 1491 1492 if (setup_cgroup_environment()) 1493 goto err; 1494 1495 cgfd = create_and_get_cgroup(CG_PATH); 1496 if (cgfd < 0) 1497 goto err; 1498 1499 if (join_cgroup(CG_PATH)) 1500 goto err; 1501 1502 if (run_tests(cgfd)) 1503 goto err; 1504 1505 goto out; 1506 err: 1507 err = -1; 1508 out: 1509 close(cgfd); 1510 cleanup_cgroup_environment(); 1511 return err; 1512 } 1513