1 // SPDX-License-Identifier: GPL-2.0
2
3 #include "vmlinux.h"
4
5 #include "bpf_misc.h"
6
7 #include <bpf/bpf_endian.h>
8 #include <bpf/bpf_tracing.h>
9 #include <bpf/bpf_helpers.h>
10
11 SEC("netfilter")
12 __description("netfilter invalid context access, size too short")
13 __failure __msg("invalid bpf_context access")
with_invalid_ctx_access_test1(void)14 __naked void with_invalid_ctx_access_test1(void)
15 {
16 asm volatile (" \
17 r2 = *(u8*)(r1 + %[__bpf_nf_ctx_state]); \
18 r0 = 0; \
19 exit; \
20 " :
21 : __imm_const(__bpf_nf_ctx_state, offsetof(struct bpf_nf_ctx, state))
22 : __clobber_all);
23 }
24
25 SEC("netfilter")
26 __description("netfilter invalid context access, size too short")
27 __failure __msg("invalid bpf_context access")
with_invalid_ctx_access_test2(void)28 __naked void with_invalid_ctx_access_test2(void)
29 {
30 asm volatile (" \
31 r2 = *(u16*)(r1 + %[__bpf_nf_ctx_skb]); \
32 r0 = 0; \
33 exit; \
34 " :
35 : __imm_const(__bpf_nf_ctx_skb, offsetof(struct bpf_nf_ctx, skb))
36 : __clobber_all);
37 }
38
39 SEC("netfilter")
40 __description("netfilter invalid context access, past end of ctx")
41 __failure __msg("invalid bpf_context access")
with_invalid_ctx_access_test3(void)42 __naked void with_invalid_ctx_access_test3(void)
43 {
44 asm volatile (" \
45 r2 = *(u64*)(r1 + %[__bpf_nf_ctx_size]); \
46 r0 = 0; \
47 exit; \
48 " :
49 : __imm_const(__bpf_nf_ctx_size, sizeof(struct bpf_nf_ctx))
50 : __clobber_all);
51 }
52
53 SEC("netfilter")
54 __description("netfilter invalid context, write")
55 __failure __msg("invalid bpf_context access")
with_invalid_ctx_access_test4(void)56 __naked void with_invalid_ctx_access_test4(void)
57 {
58 asm volatile (" \
59 r2 = r1; \
60 *(u64*)(r2 + 0) = r1; \
61 r0 = 1; \
62 exit; \
63 " :
64 : __imm_const(__bpf_nf_ctx_skb, offsetof(struct bpf_nf_ctx, skb))
65 : __clobber_all);
66 }
67
68 #define NF_DROP 0
69 #define NF_ACCEPT 1
70
71 SEC("netfilter")
72 __description("netfilter valid context read and invalid write")
73 __failure __msg("only read is supported")
with_invalid_ctx_access_test5(struct bpf_nf_ctx * ctx)74 int with_invalid_ctx_access_test5(struct bpf_nf_ctx *ctx)
75 {
76 struct nf_hook_state *state = (void *)ctx->state;
77
78 state->sk = NULL;
79 return NF_ACCEPT;
80 }
81
82 SEC("netfilter")
83 __description("netfilter test prog with skb and state read access")
84 __success __failure_unpriv
85 __retval(0)
with_valid_ctx_access_test6(struct bpf_nf_ctx * ctx)86 int with_valid_ctx_access_test6(struct bpf_nf_ctx *ctx)
87 {
88 struct __sk_buff *skb = (struct __sk_buff *)ctx->skb;
89 const struct nf_hook_state *state = ctx->state;
90 const struct iphdr *iph;
91 const struct tcphdr *th;
92 u8 buffer_iph[20] = {};
93 u8 buffer_th[40] = {};
94 struct bpf_dynptr ptr;
95 uint8_t ihl;
96
97 if (ctx->skb->len <= 20 || bpf_dynptr_from_skb(skb, 0, &ptr))
98 return NF_ACCEPT;
99
100 iph = bpf_dynptr_slice(&ptr, 0, buffer_iph, sizeof(buffer_iph));
101 if (!iph)
102 return NF_ACCEPT;
103
104 if (state->pf != 2)
105 return NF_ACCEPT;
106
107 ihl = iph->ihl << 2;
108
109 th = bpf_dynptr_slice(&ptr, ihl, buffer_th, sizeof(buffer_th));
110 if (!th)
111 return NF_ACCEPT;
112
113 return th->dest == bpf_htons(22) ? NF_ACCEPT : NF_DROP;
114 }
115
116 SEC("netfilter")
117 __description("netfilter test prog with skb write access")
118 __failure __msg("only read is supported")
skb_len_write(struct bpf_nf_ctx * ctx)119 int skb_len_write(struct bpf_nf_ctx *ctx)
120 {
121 ctx->skb->len = 1;
122 return 1;
123 }
124
125 SEC("netfilter")
126 __description("netfilter test prog with skb data write access")
127 __failure __msg("cannot write into rdonly_untrusted_mem")
skb_data_write(struct bpf_nf_ctx * ctx)128 int skb_data_write(struct bpf_nf_ctx *ctx)
129 {
130 ctx->skb->data[0] = 0;
131 return 1;
132 }
133
134 SEC("netfilter")
135 __description("netfilter test prog with bpf_dynptr_write")
136 __success __failure_unpriv
137 __retval(0)
with_dynptr_write(struct bpf_nf_ctx * ctx)138 int with_dynptr_write(struct bpf_nf_ctx *ctx)
139 {
140 struct __sk_buff *skb = (struct __sk_buff *)ctx->skb;
141 struct bpf_dynptr ptr;
142 u8 buffer[1] = {};
143
144 if (bpf_dynptr_from_skb(skb, 0, &ptr))
145 return 1;
146
147 if (bpf_dynptr_write(&ptr, 0, buffer, sizeof(buffer), 0))
148 return 0; /* must always fail */
149
150 return 1;
151 }
152
153 SEC("netfilter")
154 __description("netfilter test prog with bpf_dynptr_slice_rdwr")
155 __failure __msg("the prog does not allow writes to packet data")
with_dynptr_rdwr(struct bpf_nf_ctx * ctx)156 int with_dynptr_rdwr(struct bpf_nf_ctx *ctx)
157 {
158 struct __sk_buff *skb = (struct __sk_buff *)ctx->skb;
159 u8 buffer_iph[20] = {};
160 struct bpf_dynptr ptr;
161 struct iphdr *iph;
162
163 if (bpf_dynptr_from_skb(skb, 0, &ptr))
164 return 1;
165
166 iph = bpf_dynptr_slice_rdwr(&ptr, 0, buffer_iph, sizeof(buffer_iph));
167 if (!iph)
168 return 0;
169
170 return 1;
171 }
172
173 SEC("netfilter")
174 __description("netfilter test prog with bpf_dynptr_slice + write")
175 __failure __msg("cannot write into rdonly_mem")
with_dynptr_store(struct bpf_nf_ctx * ctx)176 int with_dynptr_store(struct bpf_nf_ctx *ctx)
177 {
178 struct __sk_buff *skb = (struct __sk_buff *)ctx->skb;
179 u8 buffer_iph[20] = {};
180 struct bpf_dynptr ptr;
181 struct iphdr *iph;
182
183 if (bpf_dynptr_from_skb(skb, 0, &ptr))
184 return 1;
185
186 iph = bpf_dynptr_slice(&ptr, 0, buffer_iph, sizeof(buffer_iph));
187 if (!iph)
188 return 0;
189 iph->protocol = 42;
190
191 return 1;
192 }
193
194 char _license[] SEC("license") = "GPL";
195