1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2026 Isovalent */
3
4 #include <arpa/inet.h>
5
6 #include "test_progs.h"
7 #include "network_helpers.h"
8 #include "ksock_lsm.skel.h"
9 #include "ksock_lsm_verifier.skel.h"
10
11 #define NS_TEST "ksock_lsm_ns"
12 #define RECV_PORT 7777
13 #define RECV_TIMEOUT_SEC 5
14
15 struct ksock_test_env {
16 struct nstoken *nstoken;
17 int rfd;
18 };
19
ksock_test_env_setup(struct ksock_test_env * env)20 static bool ksock_test_env_setup(struct ksock_test_env *env)
21 {
22 struct sockaddr_in addr = {
23 .sin_family = AF_INET,
24 .sin_addr.s_addr = htonl(INADDR_LOOPBACK),
25 .sin_port = htons(RECV_PORT),
26 };
27 struct timeval tv = { .tv_sec = RECV_TIMEOUT_SEC };
28 int err;
29
30 memset(env, 0, sizeof(*env));
31 env->rfd = -1;
32
33 if (!ASSERT_OK(make_netns(NS_TEST), "make_netns"))
34 goto fail;
35
36 env->nstoken = open_netns(NS_TEST);
37 if (!ASSERT_OK_PTR(env->nstoken, "open_netns"))
38 goto fail;
39
40 env->rfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
41 if (!ASSERT_OK_FD(env->rfd, "receiver socket"))
42 goto fail;
43
44 err = bind(env->rfd, (struct sockaddr *)&addr, sizeof(addr));
45 if (!ASSERT_OK(err, "bind receiver"))
46 goto fail;
47
48 err = setsockopt(env->rfd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
49 if (!ASSERT_OK(err, "set rcvtimeo"))
50 goto fail;
51
52 return true;
53
54 fail:
55 return false;
56 }
57
test_ksock_lsm(void)58 void test_ksock_lsm(void)
59 {
60 LIBBPF_OPTS(bpf_test_run_opts, opts);
61 struct ksock_test_env env;
62 struct sockaddr_in trigger_addr = {
63 .sin_family = AF_INET,
64 .sin_addr.s_addr = htonl(INADDR_LOOPBACK),
65 };
66 struct ksock_lsm *skel;
67 char recv_data[sizeof(skel->data->send_data)] = {};
68 ssize_t n;
69 int tfd = -1;
70 int err;
71
72 skel = ksock_lsm__open_and_load();
73 if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
74 return;
75
76 if (!ksock_test_env_setup(&env))
77 goto fail;
78
79 /* Step 1: Run the setup SYSCALL prog to create the ksock */
80 skel->bss->ipv4_remote = htonl(INADDR_LOOPBACK);
81 skel->bss->remote_port = RECV_PORT;
82 err = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.ksock_setup),
83 &opts);
84 if (!ASSERT_OK(err, "ksock_setup run"))
85 goto fail;
86 if (!ASSERT_OK(opts.retval, "ksock_setup retval"))
87 goto fail;
88
89 /* Step 2: Attach LSM prog and trigger socket_bind from userspace */
90 skel->links.ksock_socket_bind =
91 bpf_program__attach_lsm(skel->progs.ksock_socket_bind);
92 if (!ASSERT_OK_PTR(skel->links.ksock_socket_bind,
93 "attach socket_bind lsm"))
94 goto fail;
95
96 tfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
97 if (!ASSERT_OK_FD(tfd, "trigger socket"))
98 goto fail;
99
100 skel->bss->target_pid = getpid();
101 err = bind(tfd, (struct sockaddr *)&trigger_addr, sizeof(trigger_addr));
102 skel->bss->target_pid = 0;
103 if (!ASSERT_OK(err, "trigger bind"))
104 goto fail;
105
106 /* Step 3: Verify the LSM hook sent the notification */
107 if (!ASSERT_EQ(skel->data->send_ret, sizeof(skel->data->send_data),
108 "LSM send bytes"))
109 goto fail;
110
111 n = recvfrom(env.rfd, recv_data, sizeof(recv_data), 0, NULL, NULL);
112 if (ASSERT_EQ(n, sizeof(recv_data), "recvfrom len"))
113 ASSERT_MEMEQ(recv_data, skel->data->send_data, sizeof(recv_data),
114 "payload match");
115
116 fail:
117 if (tfd >= 0)
118 close(tfd);
119 if (env.rfd >= 0)
120 close(env.rfd);
121 if (env.nstoken)
122 close_netns(env.nstoken);
123 remove_netns(NS_TEST);
124 ksock_lsm__destroy(skel);
125 }
126
test_ksock_lsm_verifier(void)127 void test_ksock_lsm_verifier(void)
128 {
129 RUN_TESTS(ksock_lsm_verifier);
130 }
131