bpf/prog_tests/bind_perm.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 #define _GNU_SOURCE
0003 #include <sched.h>
0004 #include <stdlib.h>
0005 #include <sys/types.h>
0006 #include <sys/socket.h>
0007
0008 #include "test_progs.h"
0009 #include "cap_helpers.h"
0010 #include "bind_perm.skel.h"
0011
0012 static int duration;
0013
0014 static int create_netns(void)
0015 {
0016     if (!ASSERT_OK(unshare(CLONE_NEWNET), "create netns"))
0017         return -1;
0018
0019     return 0;
0020 }
0021
0022 void try_bind(int family, int port, int expected_errno)
0023 {
0024     struct sockaddr_storage addr = {};
0025     struct sockaddr_in6 *sin6;
0026     struct sockaddr_in *sin;
0027     int fd = -1;
0028
0029     fd = socket(family, SOCK_STREAM, 0);
0030     if (CHECK(fd < 0, "fd", "errno %d", errno))
0031         goto close_socket;
0032
0033     if (family == AF_INET) {
0034         sin = (struct sockaddr_in *)&addr;
0035         sin->sin_family = family;
0036         sin->sin_port = htons(port);
0037     } else {
0038         sin6 = (struct sockaddr_in6 *)&addr;
0039         sin6->sin6_family = family;
0040         sin6->sin6_port = htons(port);
0041     }
0042
0043     errno = 0;
0044     bind(fd, (struct sockaddr *)&addr, sizeof(addr));
0045     ASSERT_EQ(errno, expected_errno, "bind");
0046
0047 close_socket:
0048     if (fd >= 0)
0049         close(fd);
0050 }
0051
0052 void test_bind_perm(void)
0053 {
0054     const __u64 net_bind_svc_cap = 1ULL << CAP_NET_BIND_SERVICE;
0055     struct bind_perm *skel;
0056     __u64 old_caps = 0;
0057     int cgroup_fd;
0058
0059     if (create_netns())
0060         return;
0061
0062     cgroup_fd = test__join_cgroup("/bind_perm");
0063     if (CHECK(cgroup_fd < 0, "cg-join", "errno %d", errno))
0064         return;
0065
0066     skel = bind_perm__open_and_load();
0067     if (!ASSERT_OK_PTR(skel, "skel"))
0068         goto close_cgroup_fd;
0069
0070     skel->links.bind_v4_prog = bpf_program__attach_cgroup(skel->progs.bind_v4_prog, cgroup_fd);
0071     if (!ASSERT_OK_PTR(skel, "bind_v4_prog"))
0072         goto close_skeleton;
0073
0074     skel->links.bind_v6_prog = bpf_program__attach_cgroup(skel->progs.bind_v6_prog, cgroup_fd);
0075     if (!ASSERT_OK_PTR(skel, "bind_v6_prog"))
0076         goto close_skeleton;
0077
0078     ASSERT_OK(cap_disable_effective(net_bind_svc_cap, &old_caps),
0079           "cap_disable_effective");
0080
0081     try_bind(AF_INET, 110, EACCES);
0082     try_bind(AF_INET6, 110, EACCES);
0083
0084     try_bind(AF_INET, 111, 0);
0085     try_bind(AF_INET6, 111, 0);
0086
0087     if (old_caps & net_bind_svc_cap)
0088         ASSERT_OK(cap_enable_effective(net_bind_svc_cap, NULL),
0089               "cap_enable_effective");
0090
0091 close_skeleton:
0092     bind_perm__destroy(skel);
0093 close_cgroup_fd:
0094     close(cgroup_fd);
0095 }