bpf/prog_tests/cgroup_attach_override.c

0001 // SPDX-License-Identifier: GPL-2.0
0002
0003 #include <test_progs.h>
0004
0005 #include "cgroup_helpers.h"
0006
0007 #define FOO     "/foo"
0008 #define BAR     "/foo/bar/"
0009 #define PING_CMD    "ping -q -c1 -w1 127.0.0.1 > /dev/null"
0010
0011 static char bpf_log_buf[BPF_LOG_BUF_SIZE];
0012
0013 static int prog_load(int verdict)
0014 {
0015     struct bpf_insn prog[] = {
0016         BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
0017         BPF_EXIT_INSN(),
0018     };
0019     size_t insns_cnt = ARRAY_SIZE(prog);
0020
0021     return bpf_test_load_program(BPF_PROG_TYPE_CGROUP_SKB,
0022                    prog, insns_cnt, "GPL", 0,
0023                    bpf_log_buf, BPF_LOG_BUF_SIZE);
0024 }
0025
0026 void serial_test_cgroup_attach_override(void)
0027 {
0028     int drop_prog = -1, allow_prog = -1, foo = -1, bar = -1;
0029     __u32 duration = 0;
0030
0031     allow_prog = prog_load(1);
0032     if (CHECK(allow_prog < 0, "prog_load_allow",
0033           "verifier output:\n%s\n-------\n", bpf_log_buf))
0034         goto err;
0035
0036     drop_prog = prog_load(0);
0037     if (CHECK(drop_prog < 0, "prog_load_drop",
0038           "verifier output:\n%s\n-------\n", bpf_log_buf))
0039         goto err;
0040
0041     foo = test__join_cgroup(FOO);
0042     if (CHECK(foo < 0, "cgroup_join_foo", "cgroup setup failed\n"))
0043         goto err;
0044
0045     if (CHECK(bpf_prog_attach(drop_prog, foo, BPF_CGROUP_INET_EGRESS,
0046                   BPF_F_ALLOW_OVERRIDE),
0047           "prog_attach_drop_foo_override",
0048           "attach prog to %s failed, errno=%d\n", FOO, errno))
0049         goto err;
0050
0051     if (CHECK(!system(PING_CMD), "ping_fail",
0052           "ping unexpectedly succeeded\n"))
0053         goto err;
0054
0055     bar = test__join_cgroup(BAR);
0056     if (CHECK(bar < 0, "cgroup_join_bar", "cgroup setup failed\n"))
0057         goto err;
0058
0059     if (CHECK(!system(PING_CMD), "ping_fail",
0060           "ping unexpectedly succeeded\n"))
0061         goto err;
0062
0063     if (CHECK(bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
0064                   BPF_F_ALLOW_OVERRIDE),
0065           "prog_attach_allow_bar_override",
0066           "attach prog to %s failed, errno=%d\n", BAR, errno))
0067         goto err;
0068
0069     if (CHECK(system(PING_CMD), "ping_ok", "ping failed\n"))
0070         goto err;
0071
0072     if (CHECK(bpf_prog_detach(bar, BPF_CGROUP_INET_EGRESS),
0073           "prog_detach_bar",
0074           "detach prog from %s failed, errno=%d\n", BAR, errno))
0075         goto err;
0076
0077     if (CHECK(!system(PING_CMD), "ping_fail",
0078           "ping unexpectedly succeeded\n"))
0079         goto err;
0080
0081     if (CHECK(bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
0082                   BPF_F_ALLOW_OVERRIDE),
0083           "prog_attach_allow_bar_override",
0084           "attach prog to %s failed, errno=%d\n", BAR, errno))
0085         goto err;
0086
0087     if (CHECK(bpf_prog_detach(foo, BPF_CGROUP_INET_EGRESS),
0088           "prog_detach_foo",
0089           "detach prog from %s failed, errno=%d\n", FOO, errno))
0090         goto err;
0091
0092     if (CHECK(system(PING_CMD), "ping_ok", "ping failed\n"))
0093         goto err;
0094
0095     if (CHECK(bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
0096                   BPF_F_ALLOW_OVERRIDE),
0097           "prog_attach_allow_bar_override",
0098           "attach prog to %s failed, errno=%d\n", BAR, errno))
0099         goto err;
0100
0101     if (CHECK(!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS, 0),
0102           "fail_prog_attach_allow_bar_none",
0103           "attach prog to %s unexpectedly succeeded\n", BAR))
0104         goto err;
0105
0106     if (CHECK(bpf_prog_detach(bar, BPF_CGROUP_INET_EGRESS),
0107           "prog_detach_bar",
0108           "detach prog from %s failed, errno=%d\n", BAR, errno))
0109         goto err;
0110
0111     if (CHECK(!bpf_prog_detach(foo, BPF_CGROUP_INET_EGRESS),
0112           "fail_prog_detach_foo",
0113           "double detach from %s unexpectedly succeeded\n", FOO))
0114         goto err;
0115
0116     if (CHECK(bpf_prog_attach(allow_prog, foo, BPF_CGROUP_INET_EGRESS, 0),
0117           "prog_attach_allow_foo_none",
0118           "attach prog to %s failed, errno=%d\n", FOO, errno))
0119         goto err;
0120
0121     if (CHECK(!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS, 0),
0122           "fail_prog_attach_allow_bar_none",
0123           "attach prog to %s unexpectedly succeeded\n", BAR))
0124         goto err;
0125
0126     if (CHECK(!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
0127                    BPF_F_ALLOW_OVERRIDE),
0128           "fail_prog_attach_allow_bar_override",
0129           "attach prog to %s unexpectedly succeeded\n", BAR))
0130         goto err;
0131
0132     if (CHECK(!bpf_prog_attach(allow_prog, foo, BPF_CGROUP_INET_EGRESS,
0133                    BPF_F_ALLOW_OVERRIDE),
0134           "fail_prog_attach_allow_foo_override",
0135           "attach prog to %s unexpectedly succeeded\n", FOO))
0136         goto err;
0137
0138     if (CHECK(bpf_prog_attach(drop_prog, foo, BPF_CGROUP_INET_EGRESS, 0),
0139           "prog_attach_drop_foo_none",
0140           "attach prog to %s failed, errno=%d\n", FOO, errno))
0141         goto err;
0142
0143 err:
0144     close(foo);
0145     close(bar);
0146     close(allow_prog);
0147     close(drop_prog);
0148 }