Skip to content

Commit 22364ae

Browse files
andrwliliandrew-MSFT
andrwli
and
liandrew-MSFT
authored
Add support for hard permit in connect() hook (#4558)
* Add WFP hard permit support for connect hook * clean up * Add WFP hard permit support for connect hook * clean up * Run generate_expected_bpf2c_output * Deal with edge cases in auth-connect, fix VMIsRemote workflow * Add documentation * rebase * PR Feedback * More feedback * Organize caching into one function, handle redirected connected UDP case better, clean up * Clean up --------- Co-authored-by: Andrew Li <liandrew@microsoft.com>
1 parent d660364 commit 22364ae

17 files changed

+513
-281
lines changed

‎docs/NativeCodeGeneration.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -315,4 +315,6 @@ differ for each person regenerating them.
315315
316316
These paths therefore need to be canonicalized to make them portable and this is done by running the following command
317317
from the ```ebpf-for-windows``` project root directory:
318-
``` .\scripts\generate_expected_bpf2c_output.ps1 .\x64\Debug\```
318+
``` .\scripts\generate_expected_bpf2c_output.ps1 .\x64\Debug\```.
319+
320+
*Note: Tests may also fail if files generated by this script are formatted through clang-format.*

‎include/ebpf_nethooks.h‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ bind_hook_t(bind_md_t* context);
5656

5757
#define BPF_SOCK_ADDR_VERDICT_REJECT 0
5858
#define BPF_SOCK_ADDR_VERDICT_PROCEED 1
59+
#define BPF_SOCK_ADDR_VERDICT_PROCEED_HARD 2
5960

6061
#ifdef _MSC_VER
6162
#pragma warning(push)
@@ -134,10 +135,11 @@ EBPF_HELPER(int, bpf_sock_addr_set_redirect_context, (bpf_sock_addr_t * ctx, voi
134135
* \ref EBPF_ATTACH_TYPE_CGROUP_INET6_RECV_ACCEPT
135136
*
136137
* @param[in] context \ref bpf_sock_addr_t
137-
* @retval BPF_SOCK_ADDR_VERDICT_PROCEED Block the socket operation.
138-
* @retval BPF_SOCK_ADDR_VERDICT_REJECT Allow the socket operation.
138+
* @retval BPF_SOCK_ADDR_VERDICT_REJECT Block the socket operation. Maps to a hard block in WFP.
139+
* @retval BPF_SOCK_ADDR_VERDICT_PROCEED Allow the socket operation. Maps to a soft permit in WFP.
140+
* @retval BPF_SOCK_ADDR_VERDICT_PROCEED_HARD Allow the socket operation. Maps to a hard permit in WFP.
139141
*
140-
* Any other return value other than the two mentioned above is treated as BPF_SOCK_ADDR_VERDICT_REJECT.
142+
* Any return value other than the ones mentioned above is treated as BPF_SOCK_ADDR_VERDICT_REJECT.
141143
*/
142144
typedef int
143145
sock_addr_hook_t(bpf_sock_addr_t* context);

‎netebpfext/net_ebpf_ext_sock_addr.c‎

Lines changed: 314 additions & 201 deletions
Large diffs are not rendered by default.

‎netebpfext/net_ebpf_ext_tracelog.h‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -378,15 +378,6 @@ net_ebpf_ext_log_message_uint64_uint64_uint64(
378378
} \
379379
} while (false);
380380

381-
#define NET_EBPF_EXT_BAIL_ON_ERROR_STATUS(status) \
382-
do { \
383-
NTSTATUS local_status = (status); \
384-
if (!NT_SUCCESS(local_status)) { \
385-
NET_EBPF_EXT_LOG_FUNCTION_ERROR(local_status); \
386-
goto Exit; \
387-
} \
388-
} while (false);
389-
390381
#define NET_EBPF_EXT_BAIL_ON_ALLOC_FAILURE_RESULT(keyword, ptr, ptr_name, result) \
391382
do { \
392383
if ((ptr) == NULL) { \

‎scripts/common.psm1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ function Write-Log
1515

1616
process
1717
{
18-
if (($null -ne $TraceMessage) -and ![System.String]::IsNullOrEmpty($TraceMessage)) {
18+
if (![System.String]::IsNullOrEmpty($TraceMessage)) {
1919
$timestamp = (Get-Date).ToString('HH:mm:ss')
2020
Write-Host "[$timestamp] :: $TraceMessage"-ForegroundColor $ForegroundColor
2121
Write-Output "[$timestamp] :: $TraceMessage" | Out-File "$env:TEMP\$LogFileName" -Append

‎scripts/execute_ebpf_cicd_tests.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ $Job = Start-Job -ScriptBlock {
9898
Run-KernelTests -Config $Config
9999
Write-Log "Running kernel tests completed"
100100

101-
Stop-eBPFComponents -GranularTracing $GranularTracing
101+
Stop-eBPFComponents -GranularTracing $GranularTracing -LogFileName $script:LogFileName
102102
} catch [System.Management.Automation.RemoteException] {
103103
Write-Log $_.Exception.Message
104104
Write-Log $_.ScriptStackTrace

‎scripts/vm_run_tests.psm1‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,19 @@ Import-Module .\common.psm1 -Force -ArgumentList ($LogFileName) -WarningAction S
3232
function Invoke-OnHostOrVM {
3333
param(
3434
[Parameter(Mandatory = $true, Position = 0)][ScriptBlock] $ScriptBlock,
35-
[Parameter(Mandatory = $false)][object[]] $ArgumentList = @()
35+
[Parameter(Mandatory = $false)][object[]] $ArgumentList = @(),
36+
[Parameter(Mandatory = $false)][System.Management.Automation.Runspaces.PSSession] $Session
3637
)
3738
if ($script:ExecuteOnHost) {
3839
& $ScriptBlock @ArgumentList
3940
} elseif ($script:ExecuteOnVM) {
4041
$Credential = New-Credential -Username $script:Admin -AdminPassword $script:AdminPassword
4142
if ($script:VMIsRemote) {
42-
Invoke-Command -ComputerName $script:VMName -Credential $Credential -ScriptBlock $ScriptBlock -ArgumentList $ArgumentList -ErrorAction Stop
43+
if ($null -ne $Session) {
44+
Invoke-Command -Session $Session -ScriptBlock $ScriptBlock -ArgumentList $ArgumentList -ErrorAction Stop
45+
} else {
46+
Invoke-Command -ComputerName $script:VMName -Credential $Credential -ScriptBlock $ScriptBlock -ArgumentList $ArgumentList -ErrorAction Stop
47+
}
4348
} else {
4449
Invoke-Command -VMName $script:VMName -Credential $Credential -ScriptBlock $ScriptBlock -ArgumentList $ArgumentList -ErrorAction Stop
4550
}
@@ -120,7 +125,8 @@ function Remove-eBPFProgram {
120125
function Start-ProcessHelper {
121126
param (
122127
[Parameter(Mandatory = $true)] [string] $ProgramName,
123-
[string] $Parameters
128+
[string] $Parameters,
129+
[Parameter(Mandatory = $false)][System.Management.Automation.Runspaces.PSSession] $Session
124130
)
125131
$scriptBlock = {
126132
param($ProgramName, $Parameters, $WorkingDirectory)
@@ -129,7 +135,7 @@ function Start-ProcessHelper {
129135
}
130136
$argList = @($ProgramName, $Parameters, $script:WorkingDirectory)
131137
Write-Log "Starting process $ProgramName with arguments $Parameters"
132-
Invoke-OnHostOrVM -ScriptBlock $scriptBlock -ArgumentList $argList
138+
Invoke-OnHostOrVM -ScriptBlock $scriptBlock -ArgumentList $argList -Session $Session
133139
}
134140

135141
function Stop-ProcessHelper {
@@ -354,6 +360,11 @@ function Invoke-ConnectRedirectTestHelper
354360
$ProgramName = "tcp_udp_listener.exe"
355361
Add-FirewallRule -RuleName "Redirect_Test" -ProgramName $ProgramName -LogFileName $LogFileName
356362

363+
if ($script:VMIsRemote) {
364+
$Credential = New-Credential -Username $script:Admin -AdminPassword $script:AdminPassword
365+
$Session = New-PSSession -ComputerName $script:VMName -Credential $Credential
366+
}
367+
357368
if ($script:TestMode -eq "Regression") {
358369
# Previous versions of tcp_udp_listener did not suport the local_address parameter, use old parameter sets.
359370
$TcpServerParameters = "--protocol tcp --local-port $DestinationPort"
@@ -364,7 +375,7 @@ function Invoke-ConnectRedirectTestHelper
364375
$ParameterArray = @($TcpServerParameters, $TcpProxyParameters, $UdpServerParameters, $UdpProxyParameters)
365376
foreach ($parameter in $ParameterArray)
366377
{
367-
Start-ProcessHelper -ProgramName $ProgramName -Parameters $parameter
378+
Start-ProcessHelper -ProgramName $ProgramName -Parameters $parameter -Session $Session
368379
}
369380
} else {
370381
# Build array of all IP addresses from all interfaces
@@ -381,7 +392,7 @@ function Invoke-ConnectRedirectTestHelper
381392
foreach ($IPAddress in $IPAddresses) {
382393
foreach ($Protocol in $Protocols) {
383394
foreach ($Port in $Ports) {
384-
Start-ProcessHelper -ProgramName $ProgramName -Parameters "--protocol $Protocol --local-port $Port --local-address $IPAddress"
395+
Start-ProcessHelper -ProgramName $ProgramName -Parameters "--protocol $Protocol --local-port $Port --local-address $IPAddress" -Session $Session
385396
}
386397
}
387398
}
@@ -416,6 +427,11 @@ function Invoke-ConnectRedirectTestHelper
416427
Invoke-OnHostOrVM -ScriptBlock $scriptBlock -ArgumentList $argList
417428

418429
Stop-ProcessHelper -ProgramName $ProgramName
430+
431+
if ($null -ne $Session)
432+
{
433+
Remove-PSSession -Session $Session -ErrorAction SilentlyContinue
434+
}
419435
}
420436

421437
function Stop-eBPFComponents {

‎tests/bpf2c_tests/expected/cgroup_sock_addr2_dll.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ static map_entry_t _maps[] = {
5555
{
5656
BPF_MAP_TYPE_HASH, // Type of map.
5757
24, // Size in bytes of a map key.
58-
24, // Size in bytes of a map value.
58+
28, // Size in bytes of a map value.
5959
100, // Maximum number of entries allowed in the map.
6060
0, // Inner map index.
6161
LIBBPF_PIN_NONE, // Pinning type for the map.
@@ -421,9 +421,9 @@ connect_redirect4(void* context, const program_runtime_context_t* runtime_contex
421421
// EBPF_OP_STXH pc=72 dst=r6 src=r1 offset=40 imm=0
422422
#line 80 "sample/cgroup_sock_addr2.c"
423423
WRITE_ONCE_16(r6, (uint16_t)r1, OFFSET(40));
424-
// EBPF_OP_MOV64_IMM pc=73 dst=r1 src=r0 offset=0 imm=1
425-
#line 80 "sample/cgroup_sock_addr2.c"
426-
r1 = IMMEDIATE(1);
424+
// EBPF_OP_LDXW pc=73 dst=r1 src=r7 offset=24 imm=0
425+
#line 82 "sample/cgroup_sock_addr2.c"
426+
READ_ONCE_32(r1, r7, OFFSET(24));
427427
label_2:
428428
// EBPF_OP_STXDW pc=74 dst=r10 src=r8 offset=-88 imm=0
429429
#line 43 "sample/cgroup_sock_addr2.c"
@@ -887,9 +887,9 @@ connect_redirect6(void* context, const program_runtime_context_t* runtime_contex
887887
// EBPF_OP_STXH pc=80 dst=r6 src=r1 offset=40 imm=0
888888
#line 118 "sample/cgroup_sock_addr2.c"
889889
WRITE_ONCE_16(r6, (uint16_t)r1, OFFSET(40));
890-
// EBPF_OP_MOV64_IMM pc=81 dst=r1 src=r0 offset=0 imm=1
891-
#line 118 "sample/cgroup_sock_addr2.c"
892-
r1 = IMMEDIATE(1);
890+
// EBPF_OP_LDXW pc=81 dst=r1 src=r7 offset=24 imm=0
891+
#line 120 "sample/cgroup_sock_addr2.c"
892+
READ_ONCE_32(r1, r7, OFFSET(24));
893893
label_2:
894894
// EBPF_OP_STXDW pc=82 dst=r10 src=r8 offset=-24 imm=0
895895
#line 43 "sample/cgroup_sock_addr2.c"

‎tests/bpf2c_tests/expected/cgroup_sock_addr2_raw.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ static map_entry_t _maps[] = {
2525
{
2626
BPF_MAP_TYPE_HASH, // Type of map.
2727
24, // Size in bytes of a map key.
28-
24, // Size in bytes of a map value.
28+
28, // Size in bytes of a map value.
2929
100, // Maximum number of entries allowed in the map.
3030
0, // Inner map index.
3131
LIBBPF_PIN_NONE, // Pinning type for the map.
@@ -391,9 +391,9 @@ connect_redirect4(void* context, const program_runtime_context_t* runtime_contex
391391
// EBPF_OP_STXH pc=72 dst=r6 src=r1 offset=40 imm=0
392392
#line 80 "sample/cgroup_sock_addr2.c"
393393
WRITE_ONCE_16(r6, (uint16_t)r1, OFFSET(40));
394-
// EBPF_OP_MOV64_IMM pc=73 dst=r1 src=r0 offset=0 imm=1
395-
#line 80 "sample/cgroup_sock_addr2.c"
396-
r1 = IMMEDIATE(1);
394+
// EBPF_OP_LDXW pc=73 dst=r1 src=r7 offset=24 imm=0
395+
#line 82 "sample/cgroup_sock_addr2.c"
396+
READ_ONCE_32(r1, r7, OFFSET(24));
397397
label_2:
398398
// EBPF_OP_STXDW pc=74 dst=r10 src=r8 offset=-88 imm=0
399399
#line 43 "sample/cgroup_sock_addr2.c"
@@ -857,9 +857,9 @@ connect_redirect6(void* context, const program_runtime_context_t* runtime_contex
857857
// EBPF_OP_STXH pc=80 dst=r6 src=r1 offset=40 imm=0
858858
#line 118 "sample/cgroup_sock_addr2.c"
859859
WRITE_ONCE_16(r6, (uint16_t)r1, OFFSET(40));
860-
// EBPF_OP_MOV64_IMM pc=81 dst=r1 src=r0 offset=0 imm=1
861-
#line 118 "sample/cgroup_sock_addr2.c"
862-
r1 = IMMEDIATE(1);
860+
// EBPF_OP_LDXW pc=81 dst=r1 src=r7 offset=24 imm=0
861+
#line 120 "sample/cgroup_sock_addr2.c"
862+
READ_ONCE_32(r1, r7, OFFSET(24));
863863
label_2:
864864
// EBPF_OP_STXDW pc=82 dst=r10 src=r8 offset=-24 imm=0
865865
#line 43 "sample/cgroup_sock_addr2.c"

‎tests/bpf2c_tests/expected/cgroup_sock_addr2_sys.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ static map_entry_t _maps[] = {
180180
{
181181
BPF_MAP_TYPE_HASH, // Type of map.
182182
24, // Size in bytes of a map key.
183-
24, // Size in bytes of a map value.
183+
28, // Size in bytes of a map value.
184184
100, // Maximum number of entries allowed in the map.
185185
0, // Inner map index.
186186
LIBBPF_PIN_NONE, // Pinning type for the map.
@@ -546,9 +546,9 @@ connect_redirect4(void* context, const program_runtime_context_t* runtime_contex
546546
// EBPF_OP_STXH pc=72 dst=r6 src=r1 offset=40 imm=0
547547
#line 80 "sample/cgroup_sock_addr2.c"
548548
WRITE_ONCE_16(r6, (uint16_t)r1, OFFSET(40));
549-
// EBPF_OP_MOV64_IMM pc=73 dst=r1 src=r0 offset=0 imm=1
550-
#line 80 "sample/cgroup_sock_addr2.c"
551-
r1 = IMMEDIATE(1);
549+
// EBPF_OP_LDXW pc=73 dst=r1 src=r7 offset=24 imm=0
550+
#line 82 "sample/cgroup_sock_addr2.c"
551+
READ_ONCE_32(r1, r7, OFFSET(24));
552552
label_2:
553553
// EBPF_OP_STXDW pc=74 dst=r10 src=r8 offset=-88 imm=0
554554
#line 43 "sample/cgroup_sock_addr2.c"
@@ -1012,9 +1012,9 @@ connect_redirect6(void* context, const program_runtime_context_t* runtime_contex
10121012
// EBPF_OP_STXH pc=80 dst=r6 src=r1 offset=40 imm=0
10131013
#line 118 "sample/cgroup_sock_addr2.c"
10141014
WRITE_ONCE_16(r6, (uint16_t)r1, OFFSET(40));
1015-
// EBPF_OP_MOV64_IMM pc=81 dst=r1 src=r0 offset=0 imm=1
1016-
#line 118 "sample/cgroup_sock_addr2.c"
1017-
r1 = IMMEDIATE(1);
1015+
// EBPF_OP_LDXW pc=81 dst=r1 src=r7 offset=24 imm=0
1016+
#line 120 "sample/cgroup_sock_addr2.c"
1017+
READ_ONCE_32(r1, r7, OFFSET(24));
10181018
label_2:
10191019
// EBPF_OP_STXDW pc=82 dst=r10 src=r8 offset=-24 imm=0
10201020
#line 43 "sample/cgroup_sock_addr2.c"

0 commit comments

Comments
 (0)