1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2026 Isovalent */ 3 4 #include <arpa/inet.h> 5 6 #include "test_progs.h" 7 #include "network_helpers.h" 8 #include "ksock_lsm.skel.h" 9 #include "ksock_lsm_verifier.skel.h" 10 11 #define NS_TEST "ksock_lsm_ns" 12 #define RECV_PORT 7777 13 #define RECV_TIMEOUT_SEC 5 14 15 struct ksock_test_env { 16 struct nstoken *nstoken; 17 int rfd; 18 }; 19 20 static bool ksock_test_env_setup(struct ksock_test_env *env) 21 { 22 struct sockaddr_in addr = { 23 .sin_family = AF_INET, 24 .sin_addr.s_addr = htonl(INADDR_LOOPBACK), 25 .sin_port = htons(RECV_PORT), 26 }; 27 struct timeval tv = { .tv_sec = RECV_TIMEOUT_SEC }; 28 int err; 29 30 memset(env, 0, sizeof(*env)); 31 env->rfd = -1; 32 33 if (!ASSERT_OK(make_netns(NS_TEST), "make_netns")) 34 goto fail; 35 36 env->nstoken = open_netns(NS_TEST); 37 if (!ASSERT_OK_PTR(env->nstoken, "open_netns")) 38 goto fail; 39 40 env->rfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); 41 if (!ASSERT_OK_FD(env->rfd, "receiver socket")) 42 goto fail; 43 44 err = bind(env->rfd, (struct sockaddr *)&addr, sizeof(addr)); 45 if (!ASSERT_OK(err, "bind receiver")) 46 goto fail; 47 48 err = setsockopt(env->rfd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)); 49 if (!ASSERT_OK(err, "set rcvtimeo")) 50 goto fail; 51 52 return true; 53 54 fail: 55 return false; 56 } 57 58 void test_ksock_lsm(void) 59 { 60 LIBBPF_OPTS(bpf_test_run_opts, opts); 61 struct ksock_test_env env; 62 struct sockaddr_in trigger_addr = { 63 .sin_family = AF_INET, 64 .sin_addr.s_addr = htonl(INADDR_LOOPBACK), 65 }; 66 struct ksock_lsm *skel; 67 char recv_data[sizeof(skel->data->send_data)] = {}; 68 ssize_t n; 69 int tfd = -1; 70 int err; 71 72 skel = ksock_lsm__open_and_load(); 73 if (!ASSERT_OK_PTR(skel, "skel open_and_load")) 74 return; 75 76 if (!ksock_test_env_setup(&env)) 77 goto fail; 78 79 /* Step 1: Run the setup SYSCALL prog to create the ksock */ 80 skel->bss->ipv4_remote = htonl(INADDR_LOOPBACK); 81 skel->bss->remote_port = RECV_PORT; 82 err = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.ksock_setup), 83 &opts); 84 if (!ASSERT_OK(err, "ksock_setup run")) 85 goto fail; 86 if (!ASSERT_OK(opts.retval, "ksock_setup retval")) 87 goto fail; 88 89 /* Step 2: Attach LSM prog and trigger socket_bind from userspace */ 90 skel->links.ksock_socket_bind = 91 bpf_program__attach_lsm(skel->progs.ksock_socket_bind); 92 if (!ASSERT_OK_PTR(skel->links.ksock_socket_bind, 93 "attach socket_bind lsm")) 94 goto fail; 95 96 tfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); 97 if (!ASSERT_OK_FD(tfd, "trigger socket")) 98 goto fail; 99 100 skel->bss->target_pid = getpid(); 101 err = bind(tfd, (struct sockaddr *)&trigger_addr, sizeof(trigger_addr)); 102 skel->bss->target_pid = 0; 103 if (!ASSERT_OK(err, "trigger bind")) 104 goto fail; 105 106 /* Step 3: Verify the LSM hook sent the notification */ 107 if (!ASSERT_EQ(skel->data->send_ret, sizeof(skel->data->send_data), 108 "LSM send bytes")) 109 goto fail; 110 111 n = recvfrom(env.rfd, recv_data, sizeof(recv_data), 0, NULL, NULL); 112 if (ASSERT_EQ(n, sizeof(recv_data), "recvfrom len")) 113 ASSERT_MEMEQ(recv_data, skel->data->send_data, sizeof(recv_data), 114 "payload match"); 115 116 fail: 117 if (tfd >= 0) 118 close(tfd); 119 if (env.rfd >= 0) 120 close(env.rfd); 121 if (env.nstoken) 122 close_netns(env.nstoken); 123 remove_netns(NS_TEST); 124 ksock_lsm__destroy(skel); 125 } 126 127 void test_ksock_lsm_verifier(void) 128 { 129 RUN_TESTS(ksock_lsm_verifier); 130 } 131