tools/testing/selftests/bpf/prog_tests/cgroup_attach_multi.c

   1 // SPDX-License-Identifier: GPL-2.0
   2
   3 #include <test_progs.h>
   4
   5 #include "cgroup_helpers.h"
   6
   7 #define PING_CMD        "ping -q -c1 -w1 127.0.0.1 > /dev/null"
   8
   9 static char bpf_log_buf[BPF_LOG_BUF_SIZE];
  10
  11 static int map_fd = -1;
  12
  13 static int prog_load_cnt(int verdict, int val)
  14 {
  15         int cgroup_storage_fd, percpu_cgroup_storage_fd;
  16
  17         if (map_fd < 0)
  18                 map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, 4, 8, 1, 0);
  19         if (map_fd < 0) {
  20                 printf("failed to create map '%s'\n", strerror(errno));
  21                 return -1;
  22         }
  23
  24         cgroup_storage_fd = bpf_create_map(BPF_MAP_TYPE_CGROUP_STORAGE,
  25                                 sizeof(struct bpf_cgroup_storage_key), 8, 0, 0);
  26         if (cgroup_storage_fd < 0) {
  27                 printf("failed to create map '%s'\n", strerror(errno));
  28                 return -1;
  29         }
  30
  31         percpu_cgroup_storage_fd = bpf_create_map(
  32                 BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE,
  33                 sizeof(struct bpf_cgroup_storage_key), 8, 0, 0);
  34         if (percpu_cgroup_storage_fd < 0) {
  35                 printf("failed to create map '%s'\n", strerror(errno));
  36                 return -1;
  37         }
  38
  39         struct bpf_insn prog[] = {
  40                 BPF_MOV32_IMM(BPF_REG_0, 0),
  41                 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
  42                 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  43                 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
  44                 BPF_LD_MAP_FD(BPF_REG_1, map_fd),
  45                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  46                 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  47                 BPF_MOV64_IMM(BPF_REG_1, val), /* r1 = 1 */
  48                 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
  49
  50                 BPF_LD_MAP_FD(BPF_REG_1, cgroup_storage_fd),
  51                 BPF_MOV64_IMM(BPF_REG_2, 0),
  52                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
  53                 BPF_MOV64_IMM(BPF_REG_1, val),
  54                 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_0, BPF_REG_1, 0, 0),
  55
  56                 BPF_LD_MAP_FD(BPF_REG_1, percpu_cgroup_storage_fd),
  57                 BPF_MOV64_IMM(BPF_REG_2, 0),
  58                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
  59                 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
  60                 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 0x1),
  61                 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
  62
  63                 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
  64                 BPF_EXIT_INSN(),
  65         };
  66         size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
  67         int ret;
  68
  69         ret = bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB,
  70                                prog, insns_cnt, "GPL", 0,
  71                                bpf_log_buf, BPF_LOG_BUF_SIZE);
  72
  73         close(cgroup_storage_fd);
  74         return ret;
  75 }
  76
  77 void test_cgroup_attach_multi(void)
  78 {
  79         __u32 prog_ids[4], prog_cnt = 0, attach_flags, saved_prog_id;
  80         int cg1 = 0, cg2 = 0, cg3 = 0, cg4 = 0, cg5 = 0, key = 0;
  81         DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
  82         int allow_prog[7] = {-1};
  83         unsigned long long value;
  84         __u32 duration = 0;
  85         int i = 0;
  86
  87         for (i = 0; i < ARRAY_SIZE(allow_prog); i++) {
  88                 allow_prog[i] = prog_load_cnt(1, 1 << i);
  89                 if (CHECK(allow_prog[i] < 0, "prog_load",
  90                           "verifier output:\n%s\n-------\n", bpf_log_buf))
  91                         goto err;
  92         }
  93
  94         if (CHECK_FAIL(setup_cgroup_environment()))
  95                 goto err;
  96
  97         cg1 = create_and_get_cgroup("/cg1");
  98         if (CHECK_FAIL(cg1 < 0))
  99                 goto err;
 100         cg2 = create_and_get_cgroup("/cg1/cg2");
 101         if (CHECK_FAIL(cg2 < 0))
 102                 goto err;
 103         cg3 = create_and_get_cgroup("/cg1/cg2/cg3");
 104         if (CHECK_FAIL(cg3 < 0))
 105                 goto err;
 106         cg4 = create_and_get_cgroup("/cg1/cg2/cg3/cg4");
 107         if (CHECK_FAIL(cg4 < 0))
 108                 goto err;
 109         cg5 = create_and_get_cgroup("/cg1/cg2/cg3/cg4/cg5");
 110         if (CHECK_FAIL(cg5 < 0))
 111                 goto err;
 112
 113         if (CHECK_FAIL(join_cgroup("/cg1/cg2/cg3/cg4/cg5")))
 114                 goto err;
 115
 116         if (CHECK(bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
 117                                   BPF_F_ALLOW_MULTI),
 118                   "prog0_attach_to_cg1_multi", "errno=%d\n", errno))
 119                 goto err;
 120
 121         if (CHECK(!bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
 122                                    BPF_F_ALLOW_MULTI),
 123                   "fail_same_prog_attach_to_cg1", "unexpected success\n"))
 124                 goto err;
 125
 126         if (CHECK(bpf_prog_attach(allow_prog[1], cg1, BPF_CGROUP_INET_EGRESS,
 127                                   BPF_F_ALLOW_MULTI),
 128                   "prog1_attach_to_cg1_multi", "errno=%d\n", errno))
 129                 goto err;
 130
 131         if (CHECK(bpf_prog_attach(allow_prog[2], cg2, BPF_CGROUP_INET_EGRESS,
 132                                   BPF_F_ALLOW_OVERRIDE),
 133                   "prog2_attach_to_cg2_override", "errno=%d\n", errno))
 134                 goto err;
 135
 136         if (CHECK(bpf_prog_attach(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS,
 137                                   BPF_F_ALLOW_MULTI),
 138                   "prog3_attach_to_cg3_multi", "errno=%d\n", errno))
 139                 goto err;
 140
 141         if (CHECK(bpf_prog_attach(allow_prog[4], cg4, BPF_CGROUP_INET_EGRESS,
 142                             BPF_F_ALLOW_OVERRIDE),
 143                   "prog4_attach_to_cg4_override", "errno=%d\n", errno))
 144                 goto err;
 145
 146         if (CHECK(bpf_prog_attach(allow_prog[5], cg5, BPF_CGROUP_INET_EGRESS, 0),
 147                   "prog5_attach_to_cg5_none", "errno=%d\n", errno))
 148                 goto err;
 149
 150         CHECK_FAIL(system(PING_CMD));
 151         CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
 152         CHECK_FAIL(value != 1 + 2 + 8 + 32);
 153
 154         /* query the number of effective progs in cg5 */
 155         CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
 156                                   BPF_F_QUERY_EFFECTIVE, NULL, NULL, &prog_cnt));
 157         CHECK_FAIL(prog_cnt != 4);
 158         /* retrieve prog_ids of effective progs in cg5 */
 159         CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
 160                                   BPF_F_QUERY_EFFECTIVE, &attach_flags,
 161                                   prog_ids, &prog_cnt));
 162         CHECK_FAIL(prog_cnt != 4);
 163         CHECK_FAIL(attach_flags != 0);
 164         saved_prog_id = prog_ids[0];
 165         /* check enospc handling */
 166         prog_ids[0] = 0;
 167         prog_cnt = 2;
 168         CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
 169                                   BPF_F_QUERY_EFFECTIVE, &attach_flags,
 170                                   prog_ids, &prog_cnt) != -1);
 171         CHECK_FAIL(errno != ENOSPC);
 172         CHECK_FAIL(prog_cnt != 4);
 173         /* check that prog_ids are returned even when buffer is too small */
 174         CHECK_FAIL(prog_ids[0] != saved_prog_id);
 175         /* retrieve prog_id of single attached prog in cg5 */
 176         prog_ids[0] = 0;
 177         CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0, NULL,
 178                                   prog_ids, &prog_cnt));
 179         CHECK_FAIL(prog_cnt != 1);
 180         CHECK_FAIL(prog_ids[0] != saved_prog_id);
 181
 182         /* detach bottom program and ping again */
 183         if (CHECK(bpf_prog_detach2(-1, cg5, BPF_CGROUP_INET_EGRESS),
 184                   "prog_detach_from_cg5", "errno=%d\n", errno))
 185                 goto err;
 186
 187         value = 0;
 188         CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
 189         CHECK_FAIL(system(PING_CMD));
 190         CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
 191         CHECK_FAIL(value != 1 + 2 + 8 + 16);
 192
 193         /* test replace */
 194
 195         attach_opts.flags = BPF_F_ALLOW_OVERRIDE | BPF_F_REPLACE;
 196         attach_opts.replace_prog_fd = allow_prog[0];
 197         if (CHECK(!bpf_prog_attach_xattr(allow_prog[6], cg1,
 198                                          BPF_CGROUP_INET_EGRESS, &attach_opts),
 199                   "fail_prog_replace_override", "unexpected success\n"))
 200                 goto err;
 201         CHECK_FAIL(errno != EINVAL);
 202
 203         attach_opts.flags = BPF_F_REPLACE;
 204         if (CHECK(!bpf_prog_attach_xattr(allow_prog[6], cg1,
 205                                          BPF_CGROUP_INET_EGRESS, &attach_opts),
 206                   "fail_prog_replace_no_multi", "unexpected success\n"))
 207                 goto err;
 208         CHECK_FAIL(errno != EINVAL);
 209
 210         attach_opts.flags = BPF_F_ALLOW_MULTI | BPF_F_REPLACE;
 211         attach_opts.replace_prog_fd = -1;
 212         if (CHECK(!bpf_prog_attach_xattr(allow_prog[6], cg1,
 213                                          BPF_CGROUP_INET_EGRESS, &attach_opts),
 214                   "fail_prog_replace_bad_fd", "unexpected success\n"))
 215                 goto err;
 216         CHECK_FAIL(errno != EBADF);
 217
 218         /* replacing a program that is not attached to cgroup should fail  */
 219         attach_opts.replace_prog_fd = allow_prog[3];
 220         if (CHECK(!bpf_prog_attach_xattr(allow_prog[6], cg1,
 221                                          BPF_CGROUP_INET_EGRESS, &attach_opts),
 222                   "fail_prog_replace_no_ent", "unexpected success\n"))
 223                 goto err;
 224         CHECK_FAIL(errno != ENOENT);
 225
 226         /* replace 1st from the top program */
 227         attach_opts.replace_prog_fd = allow_prog[0];
 228         if (CHECK(bpf_prog_attach_xattr(allow_prog[6], cg1,
 229                                         BPF_CGROUP_INET_EGRESS, &attach_opts),
 230                   "prog_replace", "errno=%d\n", errno))
 231                 goto err;
 232
 233         /* replace program with itself */
 234         attach_opts.replace_prog_fd = allow_prog[6];
 235         if (CHECK(bpf_prog_attach_xattr(allow_prog[6], cg1,
 236                                         BPF_CGROUP_INET_EGRESS, &attach_opts),
 237                   "prog_replace", "errno=%d\n", errno))
 238                 goto err;
 239
 240         value = 0;
 241         CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
 242         CHECK_FAIL(system(PING_CMD));
 243         CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
 244         CHECK_FAIL(value != 64 + 2 + 8 + 16);
 245
 246         /* detach 3rd from bottom program and ping again */
 247         if (CHECK(!bpf_prog_detach2(0, cg3, BPF_CGROUP_INET_EGRESS),
 248                   "fail_prog_detach_from_cg3", "unexpected success\n"))
 249                 goto err;
 250
 251         if (CHECK(bpf_prog_detach2(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS),
 252                   "prog3_detach_from_cg3", "errno=%d\n", errno))
 253                 goto err;
 254
 255         value = 0;
 256         CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
 257         CHECK_FAIL(system(PING_CMD));
 258         CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
 259         CHECK_FAIL(value != 64 + 2 + 16);
 260
 261         /* detach 2nd from bottom program and ping again */
 262         if (CHECK(bpf_prog_detach2(-1, cg4, BPF_CGROUP_INET_EGRESS),
 263                   "prog_detach_from_cg4", "errno=%d\n", errno))
 264                 goto err;
 265
 266         value = 0;
 267         CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
 268         CHECK_FAIL(system(PING_CMD));
 269         CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
 270         CHECK_FAIL(value != 64 + 2 + 4);
 271
 272         prog_cnt = 4;
 273         CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
 274                                   BPF_F_QUERY_EFFECTIVE, &attach_flags,
 275                                   prog_ids, &prog_cnt));
 276         CHECK_FAIL(prog_cnt != 3);
 277         CHECK_FAIL(attach_flags != 0);
 278         CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0, NULL,
 279                                   prog_ids, &prog_cnt));
 280         CHECK_FAIL(prog_cnt != 0);
 281
 282 err:
 283         for (i = 0; i < ARRAY_SIZE(allow_prog); i++)
 284                 if (allow_prog[i] >= 0)
 285                         close(allow_prog[i]);
 286         close(cg1);
 287         close(cg2);
 288         close(cg3);
 289         close(cg4);
 290         close(cg5);
 291         cleanup_cgroup_environment();
 292 }