Commit 8a027dc0 authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Alexei Starovoitov
Browse files

selftests/bpf: add sockopt test that exercises sk helpers 



socktop test that introduces new SOL_CUSTOM sockopt level and
stores whatever users sets in sk storage. Whenever getsockopt
is called, the original value is retrieved.

v9:
* SO_SNDBUF example to override user-supplied buffer

v7:
* use retval=0 and optlen-1

v6:
* test 'ret=1' use-case as well (Alexei Starovoitov)

v4:
* don't call bpf_sk_fullsock helper

v3:
* drop (__u8 *)(long) casts for optval{,_end}

v2:
* new test

Cc: Andrii Nakryiko <andriin@fb.com>
Cc: Martin Lau <kafai@fb.com>
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 9ec8a4c9

tools/testing/selftests/bpf/.gitignore

+1 −0
Original line number Original line Diff line number Diff line
@@ -40,3 +40,4 @@ test_hashmap 
test_btf_dump

test_btf_dump

xdping

xdping

test_sockopt

test_sockopt

test_sockopt_sk

tools/testing/selftests/bpf/Makefile

+2 −1
Original line number Original line Diff line number Diff line
@@ -26,7 +26,7 @@ TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test 
	test_sock test_btf test_sockmap get_cgroup_id_user test_socket_cookie \

	test_sock test_btf test_sockmap get_cgroup_id_user test_socket_cookie \

	test_cgroup_storage test_select_reuseport test_section_names \

	test_cgroup_storage test_select_reuseport test_section_names \

	test_netcnt test_tcpnotify_user test_sock_fields test_sysctl test_hashmap \

	test_netcnt test_tcpnotify_user test_sock_fields test_sysctl test_hashmap \

	test_btf_dump test_cgroup_attach xdping test_sockopt

	test_btf_dump test_cgroup_attach xdping test_sockopt test_sockopt_sk





BPF_OBJ_FILES = $(patsubst %.c,%.o, $(notdir $(wildcard progs/*.c)))

BPF_OBJ_FILES = $(patsubst %.c,%.o, $(notdir $(wildcard progs/*.c)))

TEST_GEN_FILES = $(BPF_OBJ_FILES)

TEST_GEN_FILES = $(BPF_OBJ_FILES)
@@ -104,6 +104,7 @@ $(OUTPUT)/test_sock_fields: cgroup_helpers.c 
$(OUTPUT)/test_sysctl: cgroup_helpers.c

$(OUTPUT)/test_sysctl: cgroup_helpers.c

$(OUTPUT)/test_cgroup_attach: cgroup_helpers.c

$(OUTPUT)/test_cgroup_attach: cgroup_helpers.c

$(OUTPUT)/test_sockopt: cgroup_helpers.c

$(OUTPUT)/test_sockopt: cgroup_helpers.c

$(OUTPUT)/test_sockopt_sk: cgroup_helpers.c





.PHONY: force

.PHONY: force

tools/testing/selftests/bpf/progs/sockopt_sk.c

0 → 100644
+111 −0
Original line number Original line Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

#include <netinet/in.h>

#include <linux/bpf.h>

#include "bpf_helpers.h"



char _license[] SEC("license") = "GPL";

__u32 _version SEC("version") = 1;



#define SOL_CUSTOM			0xdeadbeef



struct sockopt_sk {

	__u8 val;

};



struct bpf_map_def SEC("maps") socket_storage_map = {

	.type = BPF_MAP_TYPE_SK_STORAGE,

	.key_size = sizeof(int),

	.value_size = sizeof(struct sockopt_sk),

	.map_flags = BPF_F_NO_PREALLOC,

};

BPF_ANNOTATE_KV_PAIR(socket_storage_map, int, struct sockopt_sk);



SEC("cgroup/getsockopt")

int _getsockopt(struct bpf_sockopt *ctx)

{

	__u8 *optval_end = ctx->optval_end;

	__u8 *optval = ctx->optval;

	struct sockopt_sk *storage;



	if (ctx->level == SOL_IP && ctx->optname == IP_TOS)

		/* Not interested in SOL_IP:IP_TOS;

		 * let next BPF program in the cgroup chain or kernel

		 * handle it.

		 */

		return 1;



	if (ctx->level == SOL_SOCKET && ctx->optname == SO_SNDBUF) {

		/* Not interested in SOL_SOCKET:SO_SNDBUF;

		 * let next BPF program in the cgroup chain or kernel

		 * handle it.

		 */

		return 1;

	}



	if (ctx->level != SOL_CUSTOM)

		return 0; /* EPERM, deny everything except custom level */



	if (optval + 1 > optval_end)

		return 0; /* EPERM, bounds check */



	storage = bpf_sk_storage_get(&socket_storage_map, ctx->sk, 0,

				     BPF_SK_STORAGE_GET_F_CREATE);

	if (!storage)

		return 0; /* EPERM, couldn't get sk storage */



	if (!ctx->retval)

		return 0; /* EPERM, kernel should not have handled

			   * SOL_CUSTOM, something is wrong!

			   */

	ctx->retval = 0; /* Reset system call return value to zero */



	optval[0] = storage->val;

	ctx->optlen = 1;



	return 1;

}



SEC("cgroup/setsockopt")

int _setsockopt(struct bpf_sockopt *ctx)

{

	__u8 *optval_end = ctx->optval_end;

	__u8 *optval = ctx->optval;

	struct sockopt_sk *storage;



	if (ctx->level == SOL_IP && ctx->optname == IP_TOS)

		/* Not interested in SOL_IP:IP_TOS;

		 * let next BPF program in the cgroup chain or kernel

		 * handle it.

		 */

		return 1;



	if (ctx->level == SOL_SOCKET && ctx->optname == SO_SNDBUF) {

		/* Overwrite SO_SNDBUF value */



		if (optval + sizeof(__u32) > optval_end)

			return 0; /* EPERM, bounds check */



		*(__u32 *)optval = 0x55AA;

		ctx->optlen = 4;



		return 1;

	}



	if (ctx->level != SOL_CUSTOM)

		return 0; /* EPERM, deny everything except custom level */



	if (optval + 1 > optval_end)

		return 0; /* EPERM, bounds check */



	storage = bpf_sk_storage_get(&socket_storage_map, ctx->sk, 0,

				     BPF_SK_STORAGE_GET_F_CREATE);

	if (!storage)

		return 0; /* EPERM, couldn't get sk storage */



	storage->val = optval[0];

	ctx->optlen = -1; /* BPF has consumed this option, don't call kernel

			   * setsockopt handler.

			   */



	return 1;

}

tools/testing/selftests/bpf/test_sockopt_sk.c

0 → 100644
+214 −0
Original line number Original line Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0



#include <errno.h>

#include <stdio.h>

#include <unistd.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <netinet/in.h>



#include <linux/filter.h>

#include <bpf/bpf.h>

#include <bpf/libbpf.h>



#include "bpf_rlimit.h"

#include "bpf_util.h"

#include "cgroup_helpers.h"



#define CG_PATH				"/sockopt"



#define SOL_CUSTOM			0xdeadbeef



static int getsetsockopt(void)

{

	int fd, err;

	char buf[4] = {};

	socklen_t optlen;



	fd = socket(AF_INET, SOCK_STREAM, 0);

	if (fd < 0) {

		log_err("Failed to create socket");

		return -1;

	}



	/* IP_TOS - BPF bypass */



	buf[0] = 0x08;

	err = setsockopt(fd, SOL_IP, IP_TOS, buf, 1);

	if (err) {

		log_err("Failed to call setsockopt(IP_TOS)");

		goto err;

	}



	buf[0] = 0x00;

	optlen = 1;

	err = getsockopt(fd, SOL_IP, IP_TOS, buf, &optlen);

	if (err) {

		log_err("Failed to call getsockopt(IP_TOS)");

		goto err;

	}



	if (buf[0] != 0x08) {

		log_err("Unexpected getsockopt(IP_TOS) buf[0] 0x%02x != 0x08",

			buf[0]);

		goto err;

	}



	/* IP_TTL - EPERM */



	buf[0] = 1;

	err = setsockopt(fd, SOL_IP, IP_TTL, buf, 1);

	if (!err || errno != EPERM) {

		log_err("Unexpected success from setsockopt(IP_TTL)");

		goto err;

	}



	/* SOL_CUSTOM - handled by BPF */



	buf[0] = 0x01;

	err = setsockopt(fd, SOL_CUSTOM, 0, buf, 1);

	if (err) {

		log_err("Failed to call setsockopt");

		goto err;

	}



	buf[0] = 0x00;

	optlen = 4;

	err = getsockopt(fd, SOL_CUSTOM, 0, buf, &optlen);

	if (err) {

		log_err("Failed to call getsockopt");

		goto err;

	}



	if (optlen != 1) {

		log_err("Unexpected optlen %d != 1", optlen);

		goto err;

	}

	if (buf[0] != 0x01) {

		log_err("Unexpected buf[0] 0x%02x != 0x01", buf[0]);

		goto err;

	}



	/* SO_SNDBUF is overwritten */



	buf[0] = 0x01;

	buf[1] = 0x01;

	buf[2] = 0x01;

	buf[3] = 0x01;

	err = setsockopt(fd, SOL_SOCKET, SO_SNDBUF, buf, 4);

	if (err) {

		log_err("Failed to call setsockopt(SO_SNDBUF)");

		goto err;

	}



	buf[0] = 0x00;

	buf[1] = 0x00;

	buf[2] = 0x00;

	buf[3] = 0x00;

	optlen = 4;

	err = getsockopt(fd, SOL_SOCKET, SO_SNDBUF, buf, &optlen);

	if (err) {

		log_err("Failed to call getsockopt(SO_SNDBUF)");

		goto err;

	}



	if (*(__u32 *)buf != 0x55AA*2) {

		log_err("Unexpected getsockopt(SO_SNDBUF) 0x%x != 0x55AA*2",

			*(__u32 *)buf);

		goto err;

	}



	close(fd);

	return 0;

err:

	close(fd);

	return -1;

}



static int prog_attach(struct bpf_object *obj, int cgroup_fd, const char *title)

{

	enum bpf_attach_type attach_type;

	enum bpf_prog_type prog_type;

	struct bpf_program *prog;

	int err;



	err = libbpf_prog_type_by_name(title, &prog_type, &attach_type);

	if (err) {

		log_err("Failed to deduct types for %s BPF program", title);

		return -1;

	}



	prog = bpf_object__find_program_by_title(obj, title);

	if (!prog) {

		log_err("Failed to find %s BPF program", title);

		return -1;

	}



	err = bpf_prog_attach(bpf_program__fd(prog), cgroup_fd,

			      attach_type, 0);

	if (err) {

		log_err("Failed to attach %s BPF program", title);

		return -1;

	}



	return 0;

}



static int run_test(int cgroup_fd)

{

	struct bpf_prog_load_attr attr = {

		.file = "./sockopt_sk.o",

	};

	struct bpf_object *obj;

	int ignored;

	int err;



	err = bpf_prog_load_xattr(&attr, &obj, &ignored);

	if (err) {

		log_err("Failed to load BPF object");

		return -1;

	}



	err = prog_attach(obj, cgroup_fd, "cgroup/getsockopt");

	if (err)

		goto close_bpf_object;



	err = prog_attach(obj, cgroup_fd, "cgroup/setsockopt");

	if (err)

		goto close_bpf_object;



	err = getsetsockopt();



close_bpf_object:

	bpf_object__close(obj);

	return err;

}



int main(int args, char **argv)

{

	int cgroup_fd;

	int err = EXIT_SUCCESS;



	if (setup_cgroup_environment())

		goto cleanup_obj;



	cgroup_fd = create_and_get_cgroup(CG_PATH);

	if (cgroup_fd < 0)

		goto cleanup_cgroup_env;



	if (join_cgroup(CG_PATH))

		goto cleanup_cgroup;



	if (run_test(cgroup_fd))

		err = EXIT_FAILURE;



	printf("test_sockopt_sk: %s\n",

	       err == EXIT_SUCCESS ? "PASSED" : "FAILED");



cleanup_cgroup:

	close(cgroup_fd);

cleanup_cgroup_env:

	cleanup_cgroup_environment();

cleanup_obj:

	return err;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE