sefltests/bpf: Expand sockaddr hook deny tests

This patch expands test coverage for EPERM tests to include connect and
bind calls and rounds out the coverage for sendmsg by adding tests for
sendmsg_unix.

Signed-off-by: Jordan Rife <jrife@google.com>
Link: https://lore.kernel.org/r/20240510190246.3247730-16-jrife@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/prog_tests/sock_addr.c b/tools/testing/selftests/bpf/prog_tests/sock_addr.c
index ebd5e58e38c5c7956198b101366d98c958fc5a97..0477b4080b2e81f976fb8be0b3514eaa8c050e4f 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/sock_addr.c
+++ b/tools/testing/selftests/bpf/prog_tests/sock_addr.c
@@ -439,13 +439,18 @@ static void prog_name##_destroy(void *skel) \
 
 BPF_SKEL_FUNCS(bind4_prog, bind_v4_prog);
 BPF_SKEL_FUNCS_RAW(bind4_prog, bind_v4_prog);
+BPF_SKEL_FUNCS(bind4_prog, bind_v4_deny_prog);
 BPF_SKEL_FUNCS(bind6_prog, bind_v6_prog);
 BPF_SKEL_FUNCS_RAW(bind6_prog, bind_v6_prog);
+BPF_SKEL_FUNCS(bind6_prog, bind_v6_deny_prog);
 BPF_SKEL_FUNCS(connect4_prog, connect_v4_prog);
 BPF_SKEL_FUNCS_RAW(connect4_prog, connect_v4_prog);
+BPF_SKEL_FUNCS(connect4_prog, connect_v4_deny_prog);
 BPF_SKEL_FUNCS(connect6_prog, connect_v6_prog);
 BPF_SKEL_FUNCS_RAW(connect6_prog, connect_v6_prog);
+BPF_SKEL_FUNCS(connect6_prog, connect_v6_deny_prog);
 BPF_SKEL_FUNCS(connect_unix_prog, connect_unix_prog);
+BPF_SKEL_FUNCS(connect_unix_prog, connect_unix_deny_prog);
 BPF_SKEL_FUNCS(sendmsg4_prog, sendmsg_v4_prog);
 BPF_SKEL_FUNCS_RAW(sendmsg4_prog, sendmsg_v4_prog);
 BPF_SKEL_FUNCS(sendmsg4_prog, sendmsg_v4_deny_prog);
@@ -456,6 +461,7 @@ BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_preserve_dst_prog);
 BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_v4mapped_prog);
 BPF_SKEL_FUNCS(sendmsg6_prog, sendmsg_v6_wildcard_prog);
 BPF_SKEL_FUNCS(sendmsg_unix_prog, sendmsg_unix_prog);
+BPF_SKEL_FUNCS(sendmsg_unix_prog, sendmsg_unix_deny_prog);
 BPF_SKEL_FUNCS(recvmsg4_prog, recvmsg4_prog);
 BPF_SKEL_FUNCS(recvmsg6_prog, recvmsg6_prog);
 BPF_SKEL_FUNCS(recvmsg_unix_prog, recvmsg_unix_prog);
@@ -480,6 +486,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind4: bind deny (stream)",
+               bind_v4_deny_prog_load,
+               bind_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_BIND,
+               &user_ops,
+               AF_INET,
+               SOCK_STREAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_BIND,
                "bind4: bind (dgram)",
@@ -496,6 +518,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind4: bind deny (dgram)",
+               bind_v4_deny_prog_load,
+               bind_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_BIND,
+               &user_ops,
+               AF_INET,
+               SOCK_DGRAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_BIND,
                "bind4: load prog with wrong expected attach type",
@@ -544,6 +582,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind6: bind deny (stream)",
+               bind_v6_deny_prog_load,
+               bind_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_BIND,
+               &user_ops,
+               AF_INET6,
+               SOCK_STREAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_BIND,
                "bind6: bind (dgram)",
@@ -560,6 +614,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind6: bind deny (dgram)",
+               bind_v6_deny_prog_load,
+               bind_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_BIND,
+               &user_ops,
+               AF_INET6,
+               SOCK_DGRAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_BIND,
                "bind6: load prog with wrong expected attach type",
@@ -610,6 +680,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind4: kernel_bind deny (stream)",
+               bind_v4_deny_prog_load,
+               bind_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_BIND,
+               &kern_ops_sock_sendmsg,
+               AF_INET,
+               SOCK_STREAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_BIND,
                "bind4: kernel_bind (dgram)",
@@ -626,6 +712,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind4: kernel_bind deny (dgram)",
+               bind_v4_deny_prog_load,
+               bind_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_BIND,
+               &kern_ops_sock_sendmsg,
+               AF_INET,
+               SOCK_DGRAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_BIND,
                "bind6: kernel_bind (stream)",
@@ -642,6 +744,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind6: kernel_bind deny (stream)",
+               bind_v6_deny_prog_load,
+               bind_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_BIND,
+               &kern_ops_sock_sendmsg,
+               AF_INET6,
+               SOCK_STREAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_BIND,
                "bind6: kernel_bind (dgram)",
@@ -658,6 +776,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_BIND,
+               "bind6: kernel_bind deny (dgram)",
+               bind_v6_deny_prog_load,
+               bind_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_BIND,
+               &kern_ops_sock_sendmsg,
+               AF_INET6,
+               SOCK_DGRAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               NULL,
+               SYSCALL_EPERM,
+       },
 
        /* connect - system calls */
        {
@@ -676,6 +810,22 @@ static struct sock_addr_test tests[] = {
                SRC4_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect4: connect deny (stream)",
+               connect_v4_deny_prog_load,
+               connect_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_CONNECT,
+               &user_ops,
+               AF_INET,
+               SOCK_STREAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               SRC4_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect4: connect (dgram)",
@@ -692,6 +842,22 @@ static struct sock_addr_test tests[] = {
                SRC4_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect4: connect deny (dgram)",
+               connect_v4_deny_prog_load,
+               connect_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_CONNECT,
+               &user_ops,
+               AF_INET,
+               SOCK_DGRAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               SRC4_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect4: load prog with wrong expected attach type",
@@ -740,6 +906,22 @@ static struct sock_addr_test tests[] = {
                SRC6_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect6: connect deny (stream)",
+               connect_v6_deny_prog_load,
+               connect_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_CONNECT,
+               &user_ops,
+               AF_INET6,
+               SOCK_STREAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               SRC6_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect6: connect (dgram)",
@@ -756,6 +938,22 @@ static struct sock_addr_test tests[] = {
                SRC6_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect6: connect deny (dgram)",
+               connect_v6_deny_prog_load,
+               connect_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_CONNECT,
+               &user_ops,
+               AF_INET6,
+               SOCK_DGRAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               SRC6_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect6: load prog with wrong expected attach type",
@@ -804,6 +1002,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect_unix: connect deny (stream)",
+               connect_unix_deny_prog_load,
+               connect_unix_deny_prog_destroy,
+               BPF_CGROUP_UNIX_CONNECT,
+               &user_ops,
+               AF_UNIX,
+               SOCK_STREAM,
+               SERVUN_ADDRESS,
+               0,
+               SERVUN_REWRITE_ADDRESS,
+               0,
+               NULL,
+               SYSCALL_EPERM,
+       },
 
        /* connect - kernel calls */
        {
@@ -822,6 +1036,22 @@ static struct sock_addr_test tests[] = {
                SRC4_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect4: kernel_connect deny (stream)",
+               connect_v4_deny_prog_load,
+               connect_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_CONNECT,
+               &kern_ops_sock_sendmsg,
+               AF_INET,
+               SOCK_STREAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               SRC4_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect4: kernel_connect (dgram)",
@@ -838,6 +1068,22 @@ static struct sock_addr_test tests[] = {
                SRC4_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect4: kernel_connect deny (dgram)",
+               connect_v4_deny_prog_load,
+               connect_v4_deny_prog_destroy,
+               BPF_CGROUP_INET4_CONNECT,
+               &kern_ops_sock_sendmsg,
+               AF_INET,
+               SOCK_DGRAM,
+               SERV4_IP,
+               SERV4_PORT,
+               SERV4_REWRITE_IP,
+               SERV4_REWRITE_PORT,
+               SRC4_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect6: kernel_connect (stream)",
@@ -854,6 +1100,22 @@ static struct sock_addr_test tests[] = {
                SRC6_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect6: kernel_connect deny (stream)",
+               connect_v6_deny_prog_load,
+               connect_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_CONNECT,
+               &kern_ops_sock_sendmsg,
+               AF_INET6,
+               SOCK_STREAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               SRC6_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect6: kernel_connect (dgram)",
@@ -870,6 +1132,22 @@ static struct sock_addr_test tests[] = {
                SRC6_REWRITE_IP,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect6: kernel_connect deny (dgram)",
+               connect_v6_deny_prog_load,
+               connect_v6_deny_prog_destroy,
+               BPF_CGROUP_INET6_CONNECT,
+               &kern_ops_sock_sendmsg,
+               AF_INET6,
+               SOCK_DGRAM,
+               SERV6_IP,
+               SERV6_PORT,
+               SERV6_REWRITE_IP,
+               SERV6_REWRITE_PORT,
+               SRC6_REWRITE_IP,
+               SYSCALL_EPERM,
+       },
        {
                SOCK_ADDR_TEST_CONNECT,
                "connect_unix: kernel_connect (dgram)",
@@ -886,6 +1164,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_CONNECT,
+               "connect_unix: kernel_connect deny (dgram)",
+               connect_unix_deny_prog_load,
+               connect_unix_deny_prog_destroy,
+               BPF_CGROUP_UNIX_CONNECT,
+               &kern_ops_sock_sendmsg,
+               AF_UNIX,
+               SOCK_STREAM,
+               SERVUN_ADDRESS,
+               0,
+               SERVUN_REWRITE_ADDRESS,
+               0,
+               NULL,
+               SYSCALL_EPERM,
+       },
 
        /* sendmsg - system calls */
        {
@@ -1080,6 +1374,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_SENDMSG,
+               "sendmsg_unix: sendmsg deny (dgram)",
+               sendmsg_unix_deny_prog_load,
+               sendmsg_unix_deny_prog_destroy,
+               BPF_CGROUP_UNIX_SENDMSG,
+               &user_ops,
+               AF_UNIX,
+               SOCK_DGRAM,
+               SERVUN_ADDRESS,
+               0,
+               SERVUN_REWRITE_ADDRESS,
+               0,
+               NULL,
+               SYSCALL_EPERM,
+       },
 
        /* sendmsg - kernel calls (sock_sendmsg) */
        {
@@ -1178,6 +1488,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_SENDMSG,
+               "sendmsg_unix: sock_sendmsg deny (dgram)",
+               sendmsg_unix_deny_prog_load,
+               sendmsg_unix_deny_prog_destroy,
+               BPF_CGROUP_UNIX_SENDMSG,
+               &kern_ops_sock_sendmsg,
+               AF_UNIX,
+               SOCK_DGRAM,
+               SERVUN_ADDRESS,
+               0,
+               SERVUN_REWRITE_ADDRESS,
+               0,
+               NULL,
+               SYSCALL_EPERM,
+       },
 
        /* sendmsg - kernel calls (kernel_sendmsg) */
        {
@@ -1276,6 +1602,22 @@ static struct sock_addr_test tests[] = {
                NULL,
                SUCCESS,
        },
+       {
+               SOCK_ADDR_TEST_SENDMSG,
+               "sendmsg_unix: kernel_sendmsg deny (dgram)",
+               sendmsg_unix_deny_prog_load,
+               sendmsg_unix_deny_prog_destroy,
+               BPF_CGROUP_UNIX_SENDMSG,
+               &kern_ops_kernel_sendmsg,
+               AF_UNIX,
+               SOCK_DGRAM,
+               SERVUN_ADDRESS,
+               0,
+               SERVUN_REWRITE_ADDRESS,
+               0,
+               NULL,
+               SYSCALL_EPERM,
+       },
 
        /* recvmsg - system calls */
        {

diff --git a/tools/testing/selftests/bpf/progs/bind4_prog.c b/tools/testing/selftests/bpf/progs/bind4_prog.c
index 66005c1a5b367c39ed52c9df1efd05d9849f72af..b7ddf8ec4ee898d6d68146919d3fa5f0ad46c747 100644 (file)
--- a/tools/testing/selftests/bpf/progs/bind4_prog.c
+++ b/tools/testing/selftests/bpf/progs/bind4_prog.c
@@ -158,4 +158,10 @@ int bind_v4_prog(struct bpf_sock_addr *ctx)
        return 1;
 }
 
+SEC("cgroup/bind4")
+int bind_v4_deny_prog(struct bpf_sock_addr *ctx)
+{
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";

diff --git a/tools/testing/selftests/bpf/progs/bind6_prog.c b/tools/testing/selftests/bpf/progs/bind6_prog.c
index 9c86c712348cf58a96213312158f57ad72b96d0f..501c3fc11d356ce9fe571b21322189fa71bad409 100644 (file)
--- a/tools/testing/selftests/bpf/progs/bind6_prog.c
+++ b/tools/testing/selftests/bpf/progs/bind6_prog.c
@@ -175,4 +175,10 @@ int bind_v6_prog(struct bpf_sock_addr *ctx)
        return 1;
 }
 
+SEC("cgroup/bind6")
+int bind_v6_deny_prog(struct bpf_sock_addr *ctx)
+{
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";

diff --git a/tools/testing/selftests/bpf/progs/connect4_prog.c b/tools/testing/selftests/bpf/progs/connect4_prog.c
index bec529da7c9d2ecd1f9181361e9397b4004771da..9e9ebf27b8784ed31750d4cb6bfeb35d74715306 100644 (file)
--- a/tools/testing/selftests/bpf/progs/connect4_prog.c
+++ b/tools/testing/selftests/bpf/progs/connect4_prog.c
@@ -199,4 +199,10 @@ int connect_v4_prog(struct bpf_sock_addr *ctx)
        return do_bind(ctx) ? 1 : 0;
 }
 
+SEC("cgroup/connect4")
+int connect_v4_deny_prog(struct bpf_sock_addr *ctx)
+{
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";

diff --git a/tools/testing/selftests/bpf/progs/connect6_prog.c b/tools/testing/selftests/bpf/progs/connect6_prog.c
index 40266d2c737c2e4bd2a92c5de252db2f9959cf6e..e98573b00ddb226b0a88c914da5ff7fe3b3619cc 100644 (file)
--- a/tools/testing/selftests/bpf/progs/connect6_prog.c
+++ b/tools/testing/selftests/bpf/progs/connect6_prog.c
@@ -90,4 +90,10 @@ int connect_v6_prog(struct bpf_sock_addr *ctx)
        return 1;
 }
 
+SEC("cgroup/connect6")
+int connect_v6_deny_prog(struct bpf_sock_addr *ctx)
+{
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";

diff --git a/tools/testing/selftests/bpf/progs/connect_unix_prog.c b/tools/testing/selftests/bpf/progs/connect_unix_prog.c
index 2ef0e0c46d17bb873e347c4aeaddcd3a17039215..ba60adadb33556361ae08ac5047e224babcbd809 100644 (file)
--- a/tools/testing/selftests/bpf/progs/connect_unix_prog.c
+++ b/tools/testing/selftests/bpf/progs/connect_unix_prog.c
@@ -36,4 +36,10 @@ int connect_unix_prog(struct bpf_sock_addr *ctx)
        return 1;
 }
 
+SEC("cgroup/connect_unix")
+int connect_unix_deny_prog(struct bpf_sock_addr *ctx)
+{
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";

diff --git a/tools/testing/selftests/bpf/progs/sendmsg_unix_prog.c b/tools/testing/selftests/bpf/progs/sendmsg_unix_prog.c
index d8869b03dda9b066b7a31869256bfc7a88452e53..332d0eb1116f86d8a1c8c9b1ab6cc4cd3b66a372 100644 (file)
--- a/tools/testing/selftests/bpf/progs/sendmsg_unix_prog.c
+++ b/tools/testing/selftests/bpf/progs/sendmsg_unix_prog.c
@@ -36,4 +36,10 @@ int sendmsg_unix_prog(struct bpf_sock_addr *ctx)
        return 1;
 }
 
+SEC("cgroup/sendmsg_unix")
+int sendmsg_unix_deny_prog(struct bpf_sock_addr *ctx)
+{
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";