Commit f7342481 authored by Menglong Dong's avatar Menglong Dong Committed by Alexei Starovoitov
Browse files

bpf: selftests: Add bind retry for post_bind{4, 6} 



With previous patch, kernel is able to 'put_port' after sys_bind()
fails. Add the test for that case: rebind another port after
sys_bind() fails. If the bind success, it means previous bind
operation is already undoed.

Signed-off-by: default avatarMenglong Dong <imagedong@tencent.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20220106132022.3470772-4-imagedong@tencent.com
parent 6fd92c7f

tools/testing/selftests/bpf/test_sock.c

+130 −20
Original line number Diff line number Diff line
@@ -35,12 +35,15 @@ struct sock_test { 
	/* Endpoint to bind() to */

	const char *ip;

	unsigned short port;

	unsigned short port_retry;

	/* Expected test result */

	enum {

		LOAD_REJECT,

		ATTACH_REJECT,

		BIND_REJECT,

		SUCCESS,

		RETRY_SUCCESS,

		RETRY_REJECT

	} result;

};
@@ -251,6 +254,99 @@ static struct sock_test tests[] = { 
		.port = 4098,

		.result = SUCCESS,

	},

	{

		.descr = "bind4 deny specific IP & port of TCP, and retry",

		.insns = {

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),



			/* if (ip == expected && port == expected) */

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_ip4)),

			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,

				    __bpf_constant_ntohl(0x7F000001), 4),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_port)),

			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),



			/* return DENY; */

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_JMP_A(1),



			/* else return ALLOW; */

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,

		.attach_type = BPF_CGROUP_INET4_POST_BIND,

		.domain = AF_INET,

		.type = SOCK_STREAM,

		.ip = "127.0.0.1",

		.port = 4098,

		.port_retry = 5000,

		.result = RETRY_SUCCESS,

	},

	{

		.descr = "bind4 deny specific IP & port of UDP, and retry",

		.insns = {

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),



			/* if (ip == expected && port == expected) */

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_ip4)),

			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,

				    __bpf_constant_ntohl(0x7F000001), 4),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_port)),

			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),



			/* return DENY; */

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_JMP_A(1),



			/* else return ALLOW; */

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,

		.attach_type = BPF_CGROUP_INET4_POST_BIND,

		.domain = AF_INET,

		.type = SOCK_DGRAM,

		.ip = "127.0.0.1",

		.port = 4098,

		.port_retry = 5000,

		.result = RETRY_SUCCESS,

	},

	{

		.descr = "bind6 deny specific IP & port, and retry",

		.insns = {

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),



			/* if (ip == expected && port == expected) */

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_ip6[3])),

			BPF_JMP_IMM(BPF_JNE, BPF_REG_7,

				    __bpf_constant_ntohl(0x00000001), 4),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_port)),

			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),



			/* return DENY; */

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_JMP_A(1),



			/* else return ALLOW; */

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,

		.attach_type = BPF_CGROUP_INET6_POST_BIND,

		.domain = AF_INET6,

		.type = SOCK_STREAM,

		.ip = "::1",

		.port = 8193,

		.port_retry = 9000,

		.result = RETRY_SUCCESS,

	},

	{

		.descr = "bind4 allow all",

		.insns = {
@@ -315,14 +411,15 @@ static int attach_sock_prog(int cgfd, int progfd, 
	return bpf_prog_attach(progfd, cgfd, attach_type, BPF_F_ALLOW_OVERRIDE);

}



static int bind_sock(int domain, int type, const char *ip, unsigned short port)

static int bind_sock(int domain, int type, const char *ip,

		     unsigned short port, unsigned short port_retry)

{

	struct sockaddr_storage addr;

	struct sockaddr_in6 *addr6;

	struct sockaddr_in *addr4;

	int sockfd = -1;

	socklen_t len;

	int err = 0;

	int res = SUCCESS;



	sockfd = socket(domain, type, 0);

	if (sockfd < 0)
@@ -348,21 +445,44 @@ static int bind_sock(int domain, int type, const char *ip, unsigned short port) 
		goto err;

	}



	if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1)

	if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1) {

		/* sys_bind() may fail for different reasons, errno has to be

		 * checked to confirm that BPF program rejected it.

		 */

		if (errno != EPERM)

			goto err;

		if (port_retry)

			goto retry;

		res = BIND_REJECT;

		goto out;

	}



	goto out;

retry:

	if (domain == AF_INET)

		addr4->sin_port = htons(port_retry);

	else

		addr6->sin6_port = htons(port_retry);

	if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1) {

		if (errno != EPERM)

			goto err;

		res = RETRY_REJECT;

	} else {

		res = RETRY_SUCCESS;

	}

	goto out;

err:

	err = -1;

	res = -1;

out:

	close(sockfd);

	return err;

	return res;

}



static int run_test_case(int cgfd, const struct sock_test *test)

{

	int progfd = -1;

	int err = 0;

	int res;



	printf("Test case: %s .. ", test->descr);

	progfd = load_sock_prog(test->insns, test->expected_attach_type);
@@ -380,21 +500,11 @@ static int run_test_case(int cgfd, const struct sock_test *test) 
			goto err;

	}



	if (bind_sock(test->domain, test->type, test->ip, test->port) == -1) {

		/* sys_bind() may fail for different reasons, errno has to be

		 * checked to confirm that BPF program rejected it.

		 */

		if (test->result == BIND_REJECT && errno == EPERM)

	res = bind_sock(test->domain, test->type, test->ip, test->port,

			test->port_retry);

	if (res > 0 && test->result == res)

		goto out;

		else

			goto err;

	}





	if (test->result != SUCCESS)

		goto err;



	goto out;

err:

	err = -1;

out: