From: Stanislav Fomichev <sdf@google.com>
To: netdev@vger.kernel.org, bpf@vger.kernel.org
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
Stanislav Fomichev <sdf@google.com>
Subject: [PATCH bpf-next v6 10/10] selftests/bpf: verify lsm_cgroup struct sock access
Date: Fri, 29 Apr 2022 14:15:40 -0700 [thread overview]
Message-ID: <20220429211540.715151-11-sdf@google.com> (raw)
In-Reply-To: <20220429211540.715151-1-sdf@google.com>
sk_priority & sk_mark are writable, the rest is readonly.
Add new ldx_offset fixups to lookup the offset of struct field.
Allow using test.kfunc regardless of prog_type.
One interesting thing here is that the verifier doesn't
really force me to add NULL checks anywhere :-/
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
tools/testing/selftests/bpf/test_verifier.c | 54 ++++++++++++++++++-
.../selftests/bpf/verifier/lsm_cgroup.c | 34 ++++++++++++
2 files changed, 87 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/bpf/verifier/lsm_cgroup.c
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 372579c9f45e..49961492cbd4 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -75,6 +75,12 @@ struct kfunc_btf_id_pair {
int insn_idx;
};
+struct ldx_offset {
+ const char *strct;
+ const char *field;
+ int insn_idx;
+};
+
struct bpf_test {
const char *descr;
struct bpf_insn insns[MAX_INSNS];
@@ -103,6 +109,7 @@ struct bpf_test {
int fixup_map_timer[MAX_FIXUPS];
int fixup_map_kptr[MAX_FIXUPS];
struct kfunc_btf_id_pair fixup_kfunc_btf_id[MAX_FIXUPS];
+ struct ldx_offset fixup_ldx[MAX_FIXUPS];
/* Expected verifier log output for result REJECT or VERBOSE_ACCEPT.
* Can be a tab-separated sequence of expected strings. An empty string
* means no log verification.
@@ -799,6 +806,7 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type,
int *fixup_map_timer = test->fixup_map_timer;
int *fixup_map_kptr = test->fixup_map_kptr;
struct kfunc_btf_id_pair *fixup_kfunc_btf_id = test->fixup_kfunc_btf_id;
+ struct ldx_offset *fixup_ldx = test->fixup_ldx;
if (test->fill_helper) {
test->fill_insns = calloc(MAX_TEST_INSNS, sizeof(struct bpf_insn));
@@ -1018,6 +1026,50 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type,
fixup_kfunc_btf_id++;
} while (fixup_kfunc_btf_id->kfunc);
}
+
+ if (fixup_ldx->strct) {
+ const struct btf_member *memb;
+ const struct btf_type *tp;
+ const char *name;
+ struct btf *btf;
+ int btf_id;
+ int off;
+ int i;
+
+ btf = btf__load_vmlinux_btf();
+
+ do {
+ off = -1;
+ if (!btf)
+ goto next_ldx;
+
+ btf_id = btf__find_by_name_kind(btf,
+ fixup_ldx->strct,
+ BTF_KIND_STRUCT);
+ if (btf_id < 0)
+ goto next_ldx;
+
+ tp = btf__type_by_id(btf, btf_id);
+ memb = btf_members(tp);
+
+ for (i = 0; i < btf_vlen(tp); i++) {
+ name = btf__name_by_offset(btf,
+ memb->name_off);
+ if (strcmp(fixup_ldx->field, name) == 0) {
+ off = memb->offset / 8;
+ break;
+ }
+ memb++;
+ }
+
+next_ldx:
+ prog[fixup_ldx->insn_idx].off = off;
+ fixup_ldx++;
+
+ } while (fixup_ldx->strct);
+
+ btf__free(btf);
+ }
}
struct libcap {
@@ -1182,7 +1234,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
opts.log_level = 4;
opts.prog_flags = pflags;
- if (prog_type == BPF_PROG_TYPE_TRACING && test->kfunc) {
+ if (test->kfunc) {
int attach_btf_id;
attach_btf_id = libbpf_find_vmlinux_btf_id(test->kfunc,
diff --git a/tools/testing/selftests/bpf/verifier/lsm_cgroup.c b/tools/testing/selftests/bpf/verifier/lsm_cgroup.c
new file mode 100644
index 000000000000..af0efe783511
--- /dev/null
+++ b/tools/testing/selftests/bpf/verifier/lsm_cgroup.c
@@ -0,0 +1,34 @@
+#define SK_WRITABLE_FIELD(tp, field, size, res) \
+{ \
+ .descr = field, \
+ .insns = { \
+ /* r1 = *(u64 *)(r1 + 0) */ \
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0), \
+ /* r1 = *(u64 *)(r1 + offsetof(struct socket, sk)) */ \
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0), \
+ /* r2 = *(u64 *)(r1 + offsetof(struct sock, <field>)) */ \
+ BPF_LDX_MEM(size, BPF_REG_2, BPF_REG_1, 0), \
+ /* *(u64 *)(r1 + offsetof(struct sock, <field>)) = r2 */ \
+ BPF_STX_MEM(size, BPF_REG_1, BPF_REG_2, 0), \
+ BPF_MOV64_IMM(BPF_REG_0, 1), \
+ BPF_EXIT_INSN(), \
+ }, \
+ .result = res, \
+ .errstr = res ? "no write support to 'struct sock' at off" : "", \
+ .prog_type = BPF_PROG_TYPE_LSM, \
+ .expected_attach_type = BPF_LSM_CGROUP, \
+ .kfunc = "socket_post_create", \
+ .fixup_ldx = { \
+ { "socket", "sk", 1 }, \
+ { tp, field, 2 }, \
+ { tp, field, 3 }, \
+ }, \
+}
+
+SK_WRITABLE_FIELD("sock_common", "skc_family", BPF_H, REJECT),
+SK_WRITABLE_FIELD("sock", "sk_sndtimeo", BPF_DW, REJECT),
+SK_WRITABLE_FIELD("sock", "sk_priority", BPF_W, ACCEPT),
+SK_WRITABLE_FIELD("sock", "sk_mark", BPF_W, ACCEPT),
+SK_WRITABLE_FIELD("sock", "sk_pacing_rate", BPF_DW, REJECT),
+
+#undef SK_WRITABLE_FIELD
--
2.36.0.464.gb9c8b46e94-goog
next prev parent reply other threads:[~2022-04-29 21:16 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-29 21:15 [PATCH bpf-next v6 00/10] bpf: cgroup_sock lsm flavor Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 01/10] bpf: add bpf_func_t and trampoline helpers Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 02/10] bpf: convert cgroup_bpf.progs to hlist Stanislav Fomichev
2022-05-18 15:16 ` Jakub Sitnicki
2022-04-29 21:15 ` [PATCH bpf-next v6 03/10] bpf: per-cgroup lsm flavor Stanislav Fomichev
2022-05-06 23:02 ` Martin KaFai Lau
2022-05-09 23:38 ` Stanislav Fomichev
2022-05-10 7:13 ` Martin KaFai Lau
2022-05-10 17:30 ` Stanislav Fomichev
2022-05-10 19:18 ` Martin KaFai Lau
2022-05-10 21:14 ` Stanislav Fomichev
2022-05-09 21:51 ` Andrii Nakryiko
2022-05-09 23:38 ` Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 04/10] bpf: minimize number of allocated lsm slots per program Stanislav Fomichev
2022-05-10 5:05 ` Alexei Starovoitov
2022-05-10 17:31 ` sdf
2022-05-12 4:07 ` Alexei Starovoitov
2022-04-29 21:15 ` [PATCH bpf-next v6 05/10] bpf: implement BPF_PROG_QUERY for BPF_LSM_CGROUP Stanislav Fomichev
2022-05-07 0:12 ` Martin KaFai Lau
2022-05-09 23:38 ` Stanislav Fomichev
2022-05-09 21:49 ` Andrii Nakryiko
2022-05-09 23:38 ` Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 06/10] bpf: allow writing to a subset of sock fields from lsm progtype Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 07/10] libbpf: add lsm_cgoup_sock type Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 08/10] bpftool: implement cgroup tree for BPF_LSM_CGROUP Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 09/10] selftests/bpf: lsm_cgroup functional test Stanislav Fomichev
2022-04-29 21:15 ` Stanislav Fomichev [this message]
2022-05-09 21:54 ` [PATCH bpf-next v6 10/10] selftests/bpf: verify lsm_cgroup struct sock access Andrii Nakryiko
2022-05-09 23:38 ` Stanislav Fomichev
2022-05-09 23:43 ` Andrii Nakryiko
2022-05-10 17:31 ` Stanislav Fomichev
2022-05-12 3:37 ` Andrii Nakryiko
2022-05-12 17:11 ` Stanislav Fomichev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220429211540.715151-11-sdf@google.com \
--to=sdf@google.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).