// SPDX-License-Identifier: GPL-2.0 #include <test_progs.h>#include <io_uring/mini_liburing.h>#include "cgroup_helpers.h" static char bpf_log_buf[4096];static bool verbose;#ifndef PAGE_SIZE#define PAGE_SIZE 4096#endif enum sockopt_test_error {static struct sockopt_test {const char *descr;const struct bpf_insn insns[64];enum bpf_prog_type prog_type;enum bpf_attach_type attach_type;enum bpf_attach_type expected_attach_type;int set_optname;int set_level;const char set_optval[64];int get_optname;int get_level;const char get_optval[64];enum sockopt_test_error error;bool io_uring_support;/* ==================== getsockopt ==================== */ "getsockopt: no expected_attach_type" ,/* return 1 */ "getsockopt: wrong expected_attach_type" ,/* return 1 */ "getsockopt: bypass bpf hook" ,/* return 1 */ "getsockopt: return EPERM from bpf hook" ,"getsockopt: no optval bounds check, deny loading" ,/* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* ctx->optval[0] = 0x80 */ /* return 1 */ "getsockopt: read ctx->level" ,/* r6 = ctx->level */ struct bpf_sockopt, level)),/* if (ctx->level == 123) { */ /* ctx->retval = 0 */ struct bpf_sockopt, retval)),/* return 1 */ /* } else { */ /* return 0 */ /* } */ "getsockopt: deny writing to ctx->level" ,/* ctx->level = 1 */ struct bpf_sockopt, level)),"getsockopt: read ctx->optname" ,/* r6 = ctx->optname */ struct bpf_sockopt, optname)),/* if (ctx->optname == 123) { */ /* ctx->retval = 0 */ struct bpf_sockopt, retval)),/* return 1 */ /* } else { */ /* return 0 */ /* } */ "getsockopt: read ctx->retval" ,/* r6 = ctx->retval */ struct bpf_sockopt, retval)),/* return 1 */ "getsockopt: deny writing to ctx->optname" ,/* ctx->optname = 1 */ struct bpf_sockopt, optname)),"getsockopt: read ctx->optlen" ,/* r6 = ctx->optlen */ struct bpf_sockopt, optlen)),/* if (ctx->optlen == 64) { */ /* ctx->retval = 0 */ struct bpf_sockopt, retval)),/* return 1 */ /* } else { */ /* return 0 */ /* } */ true ,"getsockopt: deny bigger ctx->optlen" ,/* ctx->optlen = 65 */ struct bpf_sockopt, optlen)),/* ctx->retval = 0 */ struct bpf_sockopt, retval)),/* return 1 */ true ,"getsockopt: ignore >PAGE_SIZE optlen" ,/* write 0xFF to the first optval byte */ /* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* r2 = ctx->optval */ /* r6 = ctx->optval + 1 */ /* r7 = ctx->optval_end */ struct bpf_sockopt, optval_end)),/* if (ctx->optval + 1 <= ctx->optval_end) { */ /* ctx->optval[0] = 0xF0 */ /* } */ /* retval changes are ignored */ /* ctx->retval = 5 */ struct bpf_sockopt, retval)),/* return 1 */ /* the changes are ignored */ true ,"getsockopt: support smaller ctx->optlen" ,/* ctx->optlen = 32 */ struct bpf_sockopt, optlen)),/* ctx->retval = 0 */ struct bpf_sockopt, retval)),/* return 1 */ true ,"getsockopt: deny writing to ctx->optval" ,/* ctx->optval = 1 */ struct bpf_sockopt, optval)),"getsockopt: deny writing to ctx->optval_end" ,/* ctx->optval_end = 1 */ struct bpf_sockopt, optval_end)),"getsockopt: rewrite value" ,/* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* r2 = ctx->optval */ /* r6 = ctx->optval + 1 */ /* r7 = ctx->optval_end */ struct bpf_sockopt, optval_end)),/* if (ctx->optval + 1 <= ctx->optval_end) { */ /* ctx->optval[0] = 0xF0 */ /* } */ /* ctx->retval = 0 */ struct bpf_sockopt, retval)),/* return 1*/ /* ==================== setsockopt ==================== */ "setsockopt: no expected_attach_type" ,/* return 1 */ "setsockopt: wrong expected_attach_type" ,/* return 1 */ "setsockopt: bypass bpf hook" ,/* return 1 */ "setsockopt: return EPERM from bpf hook" ,/* return 0 */ "setsockopt: no optval bounds check, deny loading" ,/* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* r0 = ctx->optval[0] */ /* return 1 */ "setsockopt: read ctx->level" ,/* r6 = ctx->level */ struct bpf_sockopt, level)),/* if (ctx->level == 123) { */ /* ctx->optlen = -1 */ struct bpf_sockopt, optlen)),/* return 1 */ /* } else { */ /* return 0 */ /* } */ true ,"setsockopt: allow changing ctx->level" ,/* ctx->level = SOL_IP */ struct bpf_sockopt, level)),/* return 1 */ /* should be rewritten to SOL_IP */ "setsockopt: read ctx->optname" ,/* r6 = ctx->optname */ struct bpf_sockopt, optname)),/* if (ctx->optname == 123) { */ /* ctx->optlen = -1 */ struct bpf_sockopt, optlen)),/* return 1 */ /* } else { */ /* return 0 */ /* } */ true ,"setsockopt: allow changing ctx->optname" ,/* ctx->optname = IP_TOS */ struct bpf_sockopt, optname)),/* return 1 */ /* should be rewritten to IP_TOS */ "setsockopt: read ctx->optlen" ,/* r6 = ctx->optlen */ struct bpf_sockopt, optlen)),/* if (ctx->optlen == 64) { */ /* ctx->optlen = -1 */ struct bpf_sockopt, optlen)),/* return 1 */ /* } else { */ /* return 0 */ /* } */ true ,"setsockopt: ctx->optlen == -1 is ok" ,/* ctx->optlen = -1 */ struct bpf_sockopt, optlen)),/* return 1 */ true ,"setsockopt: deny ctx->optlen < 0 (except -1)" ,/* ctx->optlen = -2 */ struct bpf_sockopt, optlen)),/* return 1 */ true ,"setsockopt: deny ctx->optlen > input optlen" ,/* ctx->optlen = 65 */ struct bpf_sockopt, optlen)),true ,"setsockopt: ignore >PAGE_SIZE optlen" ,/* write 0xFF to the first optval byte */ /* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* r2 = ctx->optval */ /* r6 = ctx->optval + 1 */ /* r7 = ctx->optval_end */ struct bpf_sockopt, optval_end)),/* if (ctx->optval + 1 <= ctx->optval_end) { */ /* ctx->optval[0] = 0xF0 */ /* } */ /* the changes are ignored */ "setsockopt: allow changing ctx->optlen within bounds" ,/* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* r2 = ctx->optval */ /* r6 = ctx->optval + 1 */ /* r7 = ctx->optval_end */ struct bpf_sockopt, optval_end)),/* if (ctx->optval + 1 <= ctx->optval_end) { */ /* ctx->optval[0] = 1 << 3 */ /* } */ /* ctx->optlen = 1 */ struct bpf_sockopt, optlen)),/* return 1*/ "setsockopt: deny write ctx->retval" ,/* ctx->retval = 0 */ struct bpf_sockopt, retval)),/* return 1 */ "setsockopt: deny read ctx->retval" ,/* r6 = ctx->retval */ struct bpf_sockopt, retval)),/* return 1 */ "setsockopt: deny writing to ctx->optval" ,/* ctx->optval = 1 */ struct bpf_sockopt, optval)),"setsockopt: deny writing to ctx->optval_end" ,/* ctx->optval_end = 1 */ struct bpf_sockopt, optval_end)),"setsockopt: allow IP_TOS <= 128" ,/* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* r7 = ctx->optval + 1 */ /* r8 = ctx->optval_end */ struct bpf_sockopt, optval_end)),/* if (ctx->optval + 1 <= ctx->optval_end) { */ /* r9 = ctx->optval[0] */ /* if (ctx->optval[0] < 128) */ /* } */ /* } else { */ /* } */ "setsockopt: deny IP_TOS > 128" ,/* r6 = ctx->optval */ struct bpf_sockopt, optval)),/* r7 = ctx->optval + 1 */ /* r8 = ctx->optval_end */ struct bpf_sockopt, optval_end)),/* if (ctx->optval + 1 <= ctx->optval_end) { */ /* r9 = ctx->optval[0] */ /* if (ctx->optval[0] < 128) */ /* } */ /* } else { */ /* } */ /* ==================== prog_type ==================== */ "can attach only BPF_CGROUP_SETSOCKOP" ,/* return 1 */ "can attach only BPF_CGROUP_GETSOCKOP" ,/* return 1 */ static int load_prog(const struct bpf_insn *insns,enum bpf_prog_type prog_type,enum bpf_attach_type expected_attach_type)sizeof (bpf_log_buf),int fd, insns_cnt = 0;for (;"GPL" , insns, insns_cnt, &opts);if (verbose && fd < 0)"%s\n" , bpf_log_buf);return fd;/* Core function that handles io_uring ring initialization, * sending SQE with sockopt command and waiting for the CQE. static int uring_sockopt(int op, int fd, int level, int optname,const void *optval, socklen_t optlen)struct io_uring_cqe *cqe;struct io_uring_sqe *sqe;struct io_uring ring;int err;if (!ASSERT_OK(err, "io_uring initialization" ))return err;if (!ASSERT_NEQ(sqe, NULL, "Get an SQE" )) {goto fail;if (!ASSERT_EQ(err, 1, "Submit SQE" ))goto fail;if (!ASSERT_OK(err, "Wait for CQE" ))goto fail;return err;static int uring_setsockopt(int fd, int level, int optname, const void *optval,return uring_sockopt(SOCKET_URING_OP_SETSOCKOPT, fd, level, optname,static int uring_getsockopt(int fd, int level, int optname, void *optval,int ret = uring_sockopt(SOCKET_URING_OP_GETSOCKOPT, fd, level, optname,if (ret < 0)return ret;/* Populate optlen back to be compatible with systemcall interface, * and simplify the test. return 0;/* Execute the setsocktopt operation */ static int call_setsockopt(bool use_io_uring, int fd, int level, int optname,const void *optval, socklen_t optlen)if (use_io_uring)return uring_setsockopt(fd, level, optname, optval, optlen);return setsockopt(fd, level, optname, optval, optlen);/* Execute the getsocktopt operation */ static int call_getsockopt(bool use_io_uring, int fd, int level, int optname,void *optval, socklen_t *optlen)if (use_io_uring)return uring_getsockopt(fd, level, optname, optval, optlen);return getsockopt(fd, level, optname, optval, optlen);static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring,bool use_link)int prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT;int sock_fd, err, prog_fd, link_fd = -1;void *optval = NULL;int ret = 0;if (test->prog_type)if (prog_fd < 0) {if (test->error == DENY_LOAD)return 0;"Failed to load BPF program" );return -1;if (use_link) {else {if (err < 0) {if (test->error == DENY_ATTACH)goto close_prog_fd;"Failed to attach BPF program" );goto close_prog_fd;if (sock_fd < 0) {"Failed to create AF_INET socket" );goto detach_prog;if (test->set_optlen) {if (test->set_optlen >= PAGE_SIZE) {int num_pages = test->set_optlen / PAGE_SIZE;int remainder = test->set_optlen % PAGE_SIZE;if (err) {if (errno == EPERM && test->error == EPERM_SETSOCKOPT)goto close_sock_fd;if (errno == EFAULT && test->error == EFAULT_SETSOCKOPT)goto free_optval;"Failed to call setsockopt" );goto close_sock_fd;if (test->get_optlen) {if (test->get_optlen >= PAGE_SIZE) {int num_pages = test->get_optlen / PAGE_SIZE;int remainder = test->get_optlen % PAGE_SIZE;if (err) {if (errno == EOPNOTSUPP && test->error == EOPNOTSUPP_GETSOCKOPT)goto free_optval;if (errno == EPERM && test->error == EPERM_GETSOCKOPT)goto free_optval;if (errno == EFAULT && test->error == EFAULT_GETSOCKOPT)goto free_optval;"Failed to call getsockopt" );goto free_optval;if (optlen != expected_get_optlen) {"getsockopt returned unexpected optlen" );goto free_optval;if (memcmp(optval, test->get_optval, optlen) != 0) {"getsockopt returned unexpected optval" );goto free_optval;if (use_link) {if (link_fd >= 0)else {return ret;void test_sockopt(void )int cgroup_fd, i;"/sockopt" );if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup" ))return ;for (i = 0; i < ARRAY_SIZE(tests); i++) {if (!test__start_subtest(tests[i].descr))continue ;false , false ),false , true ),if (tests[i].io_uring_support)true , false ),
Messung V0.5 C=94 H=87 G=90
¤ Dauer der Verarbeitung: 0.7 Sekunden
¤ *© Formatika GbR, Deutschland
