bpf/prog_tests/cgroup_attach_multi.c

0001 // SPDX-License-Identifier: GPL-2.0
0002
0003 #include <test_progs.h>
0004
0005 #include "cgroup_helpers.h"
0006
0007 #define PING_CMD    "ping -q -c1 -w1 127.0.0.1 > /dev/null"
0008
0009 static char bpf_log_buf[BPF_LOG_BUF_SIZE];
0010
0011 static int map_fd = -1;
0012
0013 static int prog_load_cnt(int verdict, int val)
0014 {
0015     int cgroup_storage_fd, percpu_cgroup_storage_fd;
0016
0017     if (map_fd < 0)
0018         map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL, 4, 8, 1, NULL);
0019     if (map_fd < 0) {
0020         printf("failed to create map '%s'\n", strerror(errno));
0021         return -1;
0022     }
0023
0024     cgroup_storage_fd = bpf_map_create(BPF_MAP_TYPE_CGROUP_STORAGE, NULL,
0025                 sizeof(struct bpf_cgroup_storage_key), 8, 0, NULL);
0026     if (cgroup_storage_fd < 0) {
0027         printf("failed to create map '%s'\n", strerror(errno));
0028         return -1;
0029     }
0030
0031     percpu_cgroup_storage_fd = bpf_map_create(
0032         BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE, NULL,
0033         sizeof(struct bpf_cgroup_storage_key), 8, 0, NULL);
0034     if (percpu_cgroup_storage_fd < 0) {
0035         printf("failed to create map '%s'\n", strerror(errno));
0036         return -1;
0037     }
0038
0039     struct bpf_insn prog[] = {
0040         BPF_MOV32_IMM(BPF_REG_0, 0),
0041         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
0042         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0043         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
0044         BPF_LD_MAP_FD(BPF_REG_1, map_fd),
0045         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0046         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0047         BPF_MOV64_IMM(BPF_REG_1, val), /* r1 = 1 */
0048         BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
0049
0050         BPF_LD_MAP_FD(BPF_REG_1, cgroup_storage_fd),
0051         BPF_MOV64_IMM(BPF_REG_2, 0),
0052         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
0053         BPF_MOV64_IMM(BPF_REG_1, val),
0054         BPF_ATOMIC_OP(BPF_W, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
0055
0056         BPF_LD_MAP_FD(BPF_REG_1, percpu_cgroup_storage_fd),
0057         BPF_MOV64_IMM(BPF_REG_2, 0),
0058         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
0059         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
0060         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 0x1),
0061         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
0062
0063         BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
0064         BPF_EXIT_INSN(),
0065     };
0066     size_t insns_cnt = ARRAY_SIZE(prog);
0067     int ret;
0068
0069     ret = bpf_test_load_program(BPF_PROG_TYPE_CGROUP_SKB,
0070                    prog, insns_cnt, "GPL", 0,
0071                    bpf_log_buf, BPF_LOG_BUF_SIZE);
0072
0073     close(cgroup_storage_fd);
0074     return ret;
0075 }
0076
0077 void serial_test_cgroup_attach_multi(void)
0078 {
0079     __u32 prog_ids[4], prog_cnt = 0, attach_flags, saved_prog_id;
0080     int cg1 = 0, cg2 = 0, cg3 = 0, cg4 = 0, cg5 = 0, key = 0;
0081     DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
0082     int allow_prog[7] = {-1};
0083     unsigned long long value;
0084     __u32 duration = 0;
0085     int i = 0;
0086
0087     for (i = 0; i < ARRAY_SIZE(allow_prog); i++) {
0088         allow_prog[i] = prog_load_cnt(1, 1 << i);
0089         if (CHECK(allow_prog[i] < 0, "prog_load",
0090               "verifier output:\n%s\n-------\n", bpf_log_buf))
0091             goto err;
0092     }
0093
0094     if (CHECK_FAIL(setup_cgroup_environment()))
0095         goto err;
0096
0097     cg1 = create_and_get_cgroup("/cg1");
0098     if (CHECK_FAIL(cg1 < 0))
0099         goto err;
0100     cg2 = create_and_get_cgroup("/cg1/cg2");
0101     if (CHECK_FAIL(cg2 < 0))
0102         goto err;
0103     cg3 = create_and_get_cgroup("/cg1/cg2/cg3");
0104     if (CHECK_FAIL(cg3 < 0))
0105         goto err;
0106     cg4 = create_and_get_cgroup("/cg1/cg2/cg3/cg4");
0107     if (CHECK_FAIL(cg4 < 0))
0108         goto err;
0109     cg5 = create_and_get_cgroup("/cg1/cg2/cg3/cg4/cg5");
0110     if (CHECK_FAIL(cg5 < 0))
0111         goto err;
0112
0113     if (CHECK_FAIL(join_cgroup("/cg1/cg2/cg3/cg4/cg5")))
0114         goto err;
0115
0116     if (CHECK(bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
0117                   BPF_F_ALLOW_MULTI),
0118           "prog0_attach_to_cg1_multi", "errno=%d\n", errno))
0119         goto err;
0120
0121     if (CHECK(!bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
0122                    BPF_F_ALLOW_MULTI),
0123           "fail_same_prog_attach_to_cg1", "unexpected success\n"))
0124         goto err;
0125
0126     if (CHECK(bpf_prog_attach(allow_prog[1], cg1, BPF_CGROUP_INET_EGRESS,
0127                   BPF_F_ALLOW_MULTI),
0128           "prog1_attach_to_cg1_multi", "errno=%d\n", errno))
0129         goto err;
0130
0131     if (CHECK(bpf_prog_attach(allow_prog[2], cg2, BPF_CGROUP_INET_EGRESS,
0132                   BPF_F_ALLOW_OVERRIDE),
0133           "prog2_attach_to_cg2_override", "errno=%d\n", errno))
0134         goto err;
0135
0136     if (CHECK(bpf_prog_attach(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS,
0137                   BPF_F_ALLOW_MULTI),
0138           "prog3_attach_to_cg3_multi", "errno=%d\n", errno))
0139         goto err;
0140
0141     if (CHECK(bpf_prog_attach(allow_prog[4], cg4, BPF_CGROUP_INET_EGRESS,
0142                 BPF_F_ALLOW_OVERRIDE),
0143           "prog4_attach_to_cg4_override", "errno=%d\n", errno))
0144         goto err;
0145
0146     if (CHECK(bpf_prog_attach(allow_prog[5], cg5, BPF_CGROUP_INET_EGRESS, 0),
0147           "prog5_attach_to_cg5_none", "errno=%d\n", errno))
0148         goto err;
0149
0150     CHECK_FAIL(system(PING_CMD));
0151     CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
0152     CHECK_FAIL(value != 1 + 2 + 8 + 32);
0153
0154     /* query the number of effective progs in cg5 */
0155     CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
0156                   BPF_F_QUERY_EFFECTIVE, NULL, NULL, &prog_cnt));
0157     CHECK_FAIL(prog_cnt != 4);
0158     /* retrieve prog_ids of effective progs in cg5 */
0159     CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
0160                   BPF_F_QUERY_EFFECTIVE, &attach_flags,
0161                   prog_ids, &prog_cnt));
0162     CHECK_FAIL(prog_cnt != 4);
0163     CHECK_FAIL(attach_flags != 0);
0164     saved_prog_id = prog_ids[0];
0165     /* check enospc handling */
0166     prog_ids[0] = 0;
0167     prog_cnt = 2;
0168     CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
0169                   BPF_F_QUERY_EFFECTIVE, &attach_flags,
0170                   prog_ids, &prog_cnt) >= 0);
0171     CHECK_FAIL(errno != ENOSPC);
0172     CHECK_FAIL(prog_cnt != 4);
0173     /* check that prog_ids are returned even when buffer is too small */
0174     CHECK_FAIL(prog_ids[0] != saved_prog_id);
0175     /* retrieve prog_id of single attached prog in cg5 */
0176     prog_ids[0] = 0;
0177     CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0, NULL,
0178                   prog_ids, &prog_cnt));
0179     CHECK_FAIL(prog_cnt != 1);
0180     CHECK_FAIL(prog_ids[0] != saved_prog_id);
0181
0182     /* detach bottom program and ping again */
0183     if (CHECK(bpf_prog_detach2(-1, cg5, BPF_CGROUP_INET_EGRESS),
0184           "prog_detach_from_cg5", "errno=%d\n", errno))
0185         goto err;
0186
0187     value = 0;
0188     CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
0189     CHECK_FAIL(system(PING_CMD));
0190     CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
0191     CHECK_FAIL(value != 1 + 2 + 8 + 16);
0192
0193     /* test replace */
0194
0195     attach_opts.flags = BPF_F_ALLOW_OVERRIDE | BPF_F_REPLACE;
0196     attach_opts.replace_prog_fd = allow_prog[0];
0197     if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
0198                      BPF_CGROUP_INET_EGRESS, &attach_opts),
0199           "fail_prog_replace_override", "unexpected success\n"))
0200         goto err;
0201     CHECK_FAIL(errno != EINVAL);
0202
0203     attach_opts.flags = BPF_F_REPLACE;
0204     if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
0205                      BPF_CGROUP_INET_EGRESS, &attach_opts),
0206           "fail_prog_replace_no_multi", "unexpected success\n"))
0207         goto err;
0208     CHECK_FAIL(errno != EINVAL);
0209
0210     attach_opts.flags = BPF_F_ALLOW_MULTI | BPF_F_REPLACE;
0211     attach_opts.replace_prog_fd = -1;
0212     if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
0213                      BPF_CGROUP_INET_EGRESS, &attach_opts),
0214           "fail_prog_replace_bad_fd", "unexpected success\n"))
0215         goto err;
0216     CHECK_FAIL(errno != EBADF);
0217
0218     /* replacing a program that is not attached to cgroup should fail  */
0219     attach_opts.replace_prog_fd = allow_prog[3];
0220     if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
0221                      BPF_CGROUP_INET_EGRESS, &attach_opts),
0222           "fail_prog_replace_no_ent", "unexpected success\n"))
0223         goto err;
0224     CHECK_FAIL(errno != ENOENT);
0225
0226     /* replace 1st from the top program */
0227     attach_opts.replace_prog_fd = allow_prog[0];
0228     if (CHECK(bpf_prog_attach_opts(allow_prog[6], cg1,
0229                     BPF_CGROUP_INET_EGRESS, &attach_opts),
0230           "prog_replace", "errno=%d\n", errno))
0231         goto err;
0232
0233     /* replace program with itself */
0234     attach_opts.replace_prog_fd = allow_prog[6];
0235     if (CHECK(bpf_prog_attach_opts(allow_prog[6], cg1,
0236                     BPF_CGROUP_INET_EGRESS, &attach_opts),
0237           "prog_replace", "errno=%d\n", errno))
0238         goto err;
0239
0240     value = 0;
0241     CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
0242     CHECK_FAIL(system(PING_CMD));
0243     CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
0244     CHECK_FAIL(value != 64 + 2 + 8 + 16);
0245
0246     /* detach 3rd from bottom program and ping again */
0247     if (CHECK(!bpf_prog_detach2(0, cg3, BPF_CGROUP_INET_EGRESS),
0248           "fail_prog_detach_from_cg3", "unexpected success\n"))
0249         goto err;
0250
0251     if (CHECK(bpf_prog_detach2(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS),
0252           "prog3_detach_from_cg3", "errno=%d\n", errno))
0253         goto err;
0254
0255     value = 0;
0256     CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
0257     CHECK_FAIL(system(PING_CMD));
0258     CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
0259     CHECK_FAIL(value != 64 + 2 + 16);
0260
0261     /* detach 2nd from bottom program and ping again */
0262     if (CHECK(bpf_prog_detach2(-1, cg4, BPF_CGROUP_INET_EGRESS),
0263           "prog_detach_from_cg4", "errno=%d\n", errno))
0264         goto err;
0265
0266     value = 0;
0267     CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
0268     CHECK_FAIL(system(PING_CMD));
0269     CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
0270     CHECK_FAIL(value != 64 + 2 + 4);
0271
0272     prog_cnt = 4;
0273     CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
0274                   BPF_F_QUERY_EFFECTIVE, &attach_flags,
0275                   prog_ids, &prog_cnt));
0276     CHECK_FAIL(prog_cnt != 3);
0277     CHECK_FAIL(attach_flags != 0);
0278     CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0, NULL,
0279                   prog_ids, &prog_cnt));
0280     CHECK_FAIL(prog_cnt != 0);
0281
0282 err:
0283     for (i = 0; i < ARRAY_SIZE(allow_prog); i++)
0284         if (allow_prog[i] >= 0)
0285             close(allow_prog[i]);
0286     close(cg1);
0287     close(cg2);
0288     close(cg3);
0289     close(cg4);
0290     close(cg5);
0291     cleanup_cgroup_environment();
0292 }