diff mbox series

[bpf-next,2/2] selftests/bpf: Ensure cgroup/connect{4,6} programs can bind unpriv ICMP ping

Message ID 345fbce9b67e4f287a771c497e8bd1bccff50b58.1662058674.git.zhuyifei@google.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series cgroup/connect{4,6} programs for unprivileged ICMP ping | expand

Checks

Context Check Description
netdev/tree_selection success Clearly marked for bpf-next, async
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix success Link
netdev/cover_letter success Series has a cover letter
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers warning 8 maintainers not CCed: shuah@kernel.org linux-kselftest@vger.kernel.org song@kernel.org yhs@fb.com haoluo@google.com mykolal@fb.com andrii@kernel.org kpsingh@kernel.org
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch fail ERROR: space required after that ',' (ctx:VxV) WARNING: added, moved or deleted file(s), does MAINTAINERS need updating? WARNING: line length of 82 exceeds 80 columns WARNING: line length of 90 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-4 success Logs for llvm-toolchain
bpf/vmtest-bpf-next-VM_Test-5 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-2 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-3 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-1 success Logs for build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-16 success Logs for test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-17 success Logs for test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-7 success Logs for test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-8 success Logs for test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-10 success Logs for test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-13 success Logs for test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-14 success Logs for test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-next-PR success PR summary
bpf/vmtest-bpf-next-VM_Test-6 success Logs for test_maps on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-12 success Logs for test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-15 success Logs for test_verifier on s390x with gcc

Commit Message

YiFei Zhu Sept. 1, 2022, 7:15 p.m. UTC 
This tests that when an unprivileged ICMP ping socket connects,
the hooks are actually invoked. We also ensure that if the hook does
not call bpf_bind(), the bound address is unmodified, and if the
hook calls bpf_bind(), the bound address is exactly what we provided
to the helper.

A new netns is used to enable ping_group_range in the test without
affecting ouside of the test, because by default, not even root is
permitted to use unprivileged ICMP ping...

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
---
 .../selftests/bpf/prog_tests/connect_ping.c   | 318 ++++++++++++++++++
 .../selftests/bpf/progs/connect_ping.c        |  53 +++
 2 files changed, 371 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/connect_ping.c
 create mode 100644 tools/testing/selftests/bpf/progs/connect_ping.c

Comments

Martin KaFai Lau Sept. 2, 2022, 5:55 a.m. UTC | #1 
On Thu, Sep 01, 2022 at 07:15:10PM +0000, YiFei Zhu wrote:
> diff --git a/tools/testing/selftests/bpf/prog_tests/connect_ping.c b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
> new file mode 100644
> index 0000000000000..99b1a2f0c4921
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
> @@ -0,0 +1,318 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +
> +/*
> + * Copyright 2022 Google LLC.
> + */
> +
> +#define _GNU_SOURCE
> +#include <sys/mount.h>
> +
> +#include <test_progs.h>
> +#include <cgroup_helpers.h>
> +#include <network_helpers.h>
> +
> +#include "connect_ping.skel.h"
> +
> +/* 2001:db8::1 */
> +#define BINDADDR_V6 { { { 0x20,0x01,0x0d,0xb8,0,0,0,0,0,0,0,0,0,0,0,1 } } }
> +const struct in6_addr bindaddr_v6 = BINDADDR_V6;
static

> +
> +static bool write_sysctl(const char *sysctl, const char *value)
This has been copied >2 times now which probably shows it will
also be useful in the future.
Take this chance to move it to testing_helpers.{h,c}.

> +{
> +	int fd, err, len;
> +
> +	fd = open(sysctl, O_WRONLY);
> +	if (!ASSERT_GE(fd, 0, "open-sysctl"))
> +		return false;
> +
> +	len = strlen(value);
> +	err = write(fd, value, len);
> +	close(fd);
> +	if (!ASSERT_EQ(err, len, "write-sysctl"))
> +		return false;
> +
> +	return true;
> +}
> +
> +static void test_ipv4(int cgroup_fd)
> +{
> +	struct sockaddr_in sa = {
> +		.sin_family = AF_INET,
> +		.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
> +	};
> +	socklen_t sa_len = sizeof(sa);
> +	struct connect_ping *obj;
> +	int sock_fd;
> +
> +	sock_fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
> +	if (!ASSERT_GE(sock_fd, 0, "sock-create"))
> +		return;
> +
> +	obj = connect_ping__open_and_load();
> +	if (!ASSERT_OK_PTR(obj, "skel-load"))
> +		goto close_sock;
> +
> +	obj->bss->do_bind = 0;
> +
> +	/* Attach connect v4 and connect v6 progs, connect a v4 ping socket to
> +	 * localhost, assert that only v4 is called, and called exactly once,
> +	 * and that the socket's bound address is original loopback address.
> +	 */
> +	obj->links.connect_v4_prog =
> +		bpf_program__attach_cgroup(obj->progs.connect_v4_prog, cgroup_fd);
> +	if (!ASSERT_OK_PTR(obj->links.connect_v4_prog, "cg-attach-v4"))
> +		goto close_bpf_object;
> +	obj->links.connect_v6_prog =
> +		bpf_program__attach_cgroup(obj->progs.connect_v6_prog, cgroup_fd);
> +	if (!ASSERT_OK_PTR(obj->links.connect_v6_prog, "cg-attach-v6"))
> +		goto close_bpf_object;
Overall, it seems like a lot of dup code can be saved
between test_ipv4, test_ipv6, and their _bind() version.

eg. The skel setup can be done once and the bss variables can be reset
at the beginning of each test by memset(skel->bss, 0, sizeof(*skel->bss)).
The result checking part is essentially checking the expected bss values
and the getsockname result also.

btw, does it make sense to do it as a subtest in
connect_force_port.c or they are very different?
YiFei Zhu Sept. 2, 2022, 11:52 p.m. UTC | #2 
On Thu, Sep 1, 2022 at 10:55 PM Martin KaFai Lau <kafai@fb.com> wrote:
>
> On Thu, Sep 01, 2022 at 07:15:10PM +0000, YiFei Zhu wrote:
> > diff --git a/tools/testing/selftests/bpf/prog_tests/connect_ping.c b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
> > new file mode 100644
> > index 0000000000000..99b1a2f0c4921
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
> > @@ -0,0 +1,318 @@
> > +// SPDX-License-Identifier: GPL-2.0-only
> > +
> > +/*
> > + * Copyright 2022 Google LLC.
> > + */
> > +
> > +#define _GNU_SOURCE
> > +#include <sys/mount.h>
> > +
> > +#include <test_progs.h>
> > +#include <cgroup_helpers.h>
> > +#include <network_helpers.h>
> > +
> > +#include "connect_ping.skel.h"
> > +
> > +/* 2001:db8::1 */
> > +#define BINDADDR_V6 { { { 0x20,0x01,0x0d,0xb8,0,0,0,0,0,0,0,0,0,0,0,1 } } }
> > +const struct in6_addr bindaddr_v6 = BINDADDR_V6;
> static

ack.

> > +
> > +static bool write_sysctl(const char *sysctl, const char *value)
> This has been copied >2 times now which probably shows it will
> also be useful in the future.
> Take this chance to move it to testing_helpers.{h,c}.

ack.

> > +{
> > +     int fd, err, len;
> > +
> > +     fd = open(sysctl, O_WRONLY);
> > +     if (!ASSERT_GE(fd, 0, "open-sysctl"))
> > +             return false;
> > +
> > +     len = strlen(value);
> > +     err = write(fd, value, len);
> > +     close(fd);
> > +     if (!ASSERT_EQ(err, len, "write-sysctl"))
> > +             return false;
> > +
> > +     return true;
> > +}
> > +
> > +static void test_ipv4(int cgroup_fd)
> > +{
> > +     struct sockaddr_in sa = {
> > +             .sin_family = AF_INET,
> > +             .sin_addr.s_addr = htonl(INADDR_LOOPBACK),
> > +     };
> > +     socklen_t sa_len = sizeof(sa);
> > +     struct connect_ping *obj;
> > +     int sock_fd;
> > +
> > +     sock_fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
> > +     if (!ASSERT_GE(sock_fd, 0, "sock-create"))
> > +             return;
> > +
> > +     obj = connect_ping__open_and_load();
> > +     if (!ASSERT_OK_PTR(obj, "skel-load"))
> > +             goto close_sock;
> > +
> > +     obj->bss->do_bind = 0;
> > +
> > +     /* Attach connect v4 and connect v6 progs, connect a v4 ping socket to
> > +      * localhost, assert that only v4 is called, and called exactly once,
> > +      * and that the socket's bound address is original loopback address.
> > +      */
> > +     obj->links.connect_v4_prog =
> > +             bpf_program__attach_cgroup(obj->progs.connect_v4_prog, cgroup_fd);
> > +     if (!ASSERT_OK_PTR(obj->links.connect_v4_prog, "cg-attach-v4"))
> > +             goto close_bpf_object;
> > +     obj->links.connect_v6_prog =
> > +             bpf_program__attach_cgroup(obj->progs.connect_v6_prog, cgroup_fd);
> > +     if (!ASSERT_OK_PTR(obj->links.connect_v6_prog, "cg-attach-v6"))
> > +             goto close_bpf_object;
> Overall, it seems like a lot of dup code can be saved
> between test_ipv4, test_ipv6, and their _bind() version.
>
> eg. The skel setup can be done once and the bss variables can be reset
> at the beginning of each test by memset(skel->bss, 0, sizeof(*skel->bss)).
> The result checking part is essentially checking the expected bss values
> and the getsockname result also.

ack.

> btw, does it make sense to do it as a subtest in
> connect_force_port.c or they are very different?

I could try, but they are structured differently; that checks the
ports whereas this checks the bound IPs. That test also doesn't use
skels or sets up netns whereas this test does. I think I would prefer
to have two tests since tests are cheap, but I can try to restructure
connect_force_port.c in a way that is compatible with both if you
insist.
Martin KaFai Lau Sept. 6, 2022, 5:16 p.m. UTC | #3 
On 9/2/22 4:52 PM, YiFei Zhu wrote:
>> btw, does it make sense to do it as a subtest in
>> connect_force_port.c or they are very different?
> 
> I could try, but they are structured differently; that checks the
> ports whereas this checks the bound IPs. That test also doesn't use
> skels or sets up netns whereas this test does. I think I would prefer
> to have two tests since tests are cheap, but I can try to restructure
> connect_force_port.c in a way that is compatible with both if you
> insist.
Yep. Keeping them separate is fine.  I was asking because they are 
testing the same hook other than the port-vs-ip difference.

connect[46]_prog.c looks like a better one also but not yet in 
test_progs infra.  It will be useful to migrate it in the future.
YiFei Zhu Sept. 6, 2022, 11:52 p.m. UTC | #4 
On Fri, Sep 2, 2022 at 4:52 PM YiFei Zhu <zhuyifei@google.com> wrote:
>
> On Thu, Sep 1, 2022 at 10:55 PM Martin KaFai Lau <kafai@fb.com> wrote:
> >
> > On Thu, Sep 01, 2022 at 07:15:10PM +0000, YiFei Zhu wrote:
> > > diff --git a/tools/testing/selftests/bpf/prog_tests/connect_ping.c b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
> > > new file mode 100644
> > > index 0000000000000..99b1a2f0c4921
> > > --- /dev/null
> > > +++ b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
> > > @@ -0,0 +1,318 @@
> > > +// SPDX-License-Identifier: GPL-2.0-only
> > > +
> > > +/*
> > > + * Copyright 2022 Google LLC.
> > > + */
> > > +
> > > +#define _GNU_SOURCE
> > > +#include <sys/mount.h>
> > > +
> > > +#include <test_progs.h>
> > > +#include <cgroup_helpers.h>
> > > +#include <network_helpers.h>
> > > +
> > > +#include "connect_ping.skel.h"
> > > +
> > > +/* 2001:db8::1 */
> > > +#define BINDADDR_V6 { { { 0x20,0x01,0x0d,0xb8,0,0,0,0,0,0,0,0,0,0,0,1 } } }
> > > +const struct in6_addr bindaddr_v6 = BINDADDR_V6;
> > static
>
> ack.
>
> > > +
> > > +static bool write_sysctl(const char *sysctl, const char *value)
> > This has been copied >2 times now which probably shows it will
> > also be useful in the future.
> > Take this chance to move it to testing_helpers.{h,c}.
>
> ack.

I changed it to test_progs.c because this helper uses CHECK which is
provided by test_progs.h, and testing_helpers.c seems to be used
elsewhere (non-test_progs) too. Lmk if this is not a good alternative.
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/connect_ping.c b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
new file mode 100644
index 0000000000000..99b1a2f0c4921
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/connect_ping.c
@@ -0,0 +1,318 @@ 
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright 2022 Google LLC.
+ */
+
+#define _GNU_SOURCE
+#include <sys/mount.h>
+
+#include <test_progs.h>
+#include <cgroup_helpers.h>
+#include <network_helpers.h>
+
+#include "connect_ping.skel.h"
+
+/* 2001:db8::1 */
+#define BINDADDR_V6 { { { 0x20,0x01,0x0d,0xb8,0,0,0,0,0,0,0,0,0,0,0,1 } } }
+const struct in6_addr bindaddr_v6 = BINDADDR_V6;
+
+static bool write_sysctl(const char *sysctl, const char *value)
+{
+	int fd, err, len;
+
+	fd = open(sysctl, O_WRONLY);
+	if (!ASSERT_GE(fd, 0, "open-sysctl"))
+		return false;
+
+	len = strlen(value);
+	err = write(fd, value, len);
+	close(fd);
+	if (!ASSERT_EQ(err, len, "write-sysctl"))
+		return false;
+
+	return true;
+}
+
+static void test_ipv4(int cgroup_fd)
+{
+	struct sockaddr_in sa = {
+		.sin_family = AF_INET,
+		.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
+	};
+	socklen_t sa_len = sizeof(sa);
+	struct connect_ping *obj;
+	int sock_fd;
+
+	sock_fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+	if (!ASSERT_GE(sock_fd, 0, "sock-create"))
+		return;
+
+	obj = connect_ping__open_and_load();
+	if (!ASSERT_OK_PTR(obj, "skel-load"))
+		goto close_sock;
+
+	obj->bss->do_bind = 0;
+
+	/* Attach connect v4 and connect v6 progs, connect a v4 ping socket to
+	 * localhost, assert that only v4 is called, and called exactly once,
+	 * and that the socket's bound address is original loopback address.
+	 */
+	obj->links.connect_v4_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v4_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v4_prog, "cg-attach-v4"))
+		goto close_bpf_object;
+	obj->links.connect_v6_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v6_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v6_prog, "cg-attach-v6"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(connect(sock_fd, (struct sockaddr *)&sa, sa_len),
+		       "connect"))
+		goto close_bpf_object;
+
+	if (!ASSERT_EQ(obj->bss->invocations_v4, 1, "invocations_v4"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->invocations_v6, 0, "invocations_v6"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->has_error, 0, "has_error"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(getsockname(sock_fd, (struct sockaddr *)&sa, &sa_len),
+		       "getsockname"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(sa.sin_family, AF_INET, "sin_family"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(sa.sin_addr.s_addr, htonl(INADDR_LOOPBACK), "sin_addr"))
+		goto close_bpf_object;
+
+close_bpf_object:
+	connect_ping__destroy(obj);
+close_sock:
+	close(sock_fd);
+}
+
+static void test_ipv4_bind(int cgroup_fd)
+{
+	struct sockaddr_in sa = {
+		.sin_family = AF_INET,
+		.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
+	};
+	socklen_t sa_len = sizeof(sa);
+	struct connect_ping *obj;
+	int sock_fd;
+
+	sock_fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+	if (!ASSERT_GE(sock_fd, 0, "sock-create"))
+		return;
+
+	obj = connect_ping__open_and_load();
+	if (!ASSERT_OK_PTR(obj, "skel-load"))
+		goto close_sock;
+
+	obj->bss->do_bind = 1;
+
+	/* Attach connect v4 and connect v6 progs, connect a v4 ping socket to
+	 * localhost, assert that only v4 is called, and called exactly once,
+	 * and that the socket's bound address is address we explicitly bound.
+	 */
+	obj->links.connect_v4_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v4_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v4_prog, "cg-attach-v4"))
+		goto close_bpf_object;
+	obj->links.connect_v6_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v6_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v6_prog, "cg-attach-v6"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(connect(sock_fd, (struct sockaddr *)&sa, sa_len),
+		       "connect"))
+		goto close_bpf_object;
+
+	if (!ASSERT_EQ(obj->bss->invocations_v4, 1, "invocations_v4"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->invocations_v6, 0, "invocations_v6"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->has_error, 0, "has_error"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(getsockname(sock_fd, (struct sockaddr *)&sa, &sa_len),
+		       "getsockname"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(sa.sin_family, AF_INET, "sin_family"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(sa.sin_addr.s_addr, htonl(0x01010101), "sin_addr"))
+		goto close_bpf_object;
+
+close_bpf_object:
+	connect_ping__destroy(obj);
+close_sock:
+	close(sock_fd);
+}
+
+static void test_ipv6(int cgroup_fd)
+{
+	struct sockaddr_in6 sa = {
+		.sin6_family = AF_INET6,
+		.sin6_addr = IN6ADDR_LOOPBACK_INIT,
+	};
+	socklen_t sa_len = sizeof(sa);
+	struct connect_ping *obj;
+	int sock_fd;
+
+	sock_fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6);
+	if (!ASSERT_GE(sock_fd, 0, "sock-create"))
+		return;
+
+	obj = connect_ping__open_and_load();
+	if (!ASSERT_OK_PTR(obj, "skel-load"))
+		goto close_sock;
+
+	obj->bss->do_bind = 0;
+
+	/* Attach connect v4 and connect v6 progs, connect a v6 ping socket to
+	 * localhost, assert that only v6 is called, and called exactly once,
+	 * and that the socket's bound address is original loopback address.
+	 */
+	obj->links.connect_v4_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v4_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v4_prog, "cg-attach-v4"))
+		goto close_bpf_object;
+	obj->links.connect_v6_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v6_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v6_prog, "cg-attach-v6"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(connect(sock_fd, (struct sockaddr *)&sa, sa_len),
+		       "connect"))
+		goto close_bpf_object;
+
+	if (!ASSERT_EQ(obj->bss->invocations_v4, 0, "invocations_v4"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->invocations_v6, 1, "invocations_v6"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->has_error, 0, "has_error"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(getsockname(sock_fd, (struct sockaddr *)&sa, &sa_len),
+		       "getsockname"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(sa.sin6_family, AF_INET6, "sin6_family"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(memcmp(&sa.sin6_addr, &in6addr_loopback, sizeof(in6addr_loopback)),
+		       0, "sin_addr"))
+		goto close_bpf_object;
+
+close_bpf_object:
+	connect_ping__destroy(obj);
+close_sock:
+	close(sock_fd);
+}
+
+static void test_ipv6_bind(int cgroup_fd)
+{
+	struct sockaddr_in6 sa = {
+		.sin6_family = AF_INET6,
+		.sin6_addr = IN6ADDR_LOOPBACK_INIT,
+	};
+	socklen_t sa_len = sizeof(sa);
+	struct connect_ping *obj;
+	int sock_fd;
+
+	sock_fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6);
+	if (!ASSERT_GE(sock_fd, 0, "sock-create"))
+		return;
+
+	obj = connect_ping__open_and_load();
+	if (!ASSERT_OK_PTR(obj, "skel-load"))
+		goto close_sock;
+
+	obj->bss->do_bind = 1;
+
+	/* Attach connect v4 and connect v6 progs, connect a v6 ping socket to
+	 * localhost, assert that only v6 is called, and called exactly once,
+	 * and that the socket's bound address is address we explicitly bound.
+	 */
+	obj->links.connect_v4_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v4_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v4_prog, "cg-attach-v4"))
+		goto close_bpf_object;
+	obj->links.connect_v6_prog =
+		bpf_program__attach_cgroup(obj->progs.connect_v6_prog, cgroup_fd);
+	if (!ASSERT_OK_PTR(obj->links.connect_v6_prog, "cg-attach-v6"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(connect(sock_fd, (struct sockaddr *)&sa, sa_len),
+		       "connect"))
+		goto close_bpf_object;
+
+	if (!ASSERT_EQ(obj->bss->invocations_v4, 0, "invocations_v4"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->invocations_v6, 1, "invocations_v6"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(obj->bss->has_error, 0, "has_error"))
+		goto close_bpf_object;
+
+	if (!ASSERT_OK(getsockname(sock_fd, (struct sockaddr *)&sa, &sa_len),
+		       "getsockname"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(sa.sin6_family, AF_INET6, "sin6_family"))
+		goto close_bpf_object;
+	if (!ASSERT_EQ(memcmp(&sa.sin6_addr, &bindaddr_v6, sizeof(bindaddr_v6)),
+		       0, "sin_addr"))
+		goto close_bpf_object;
+
+close_bpf_object:
+	connect_ping__destroy(obj);
+close_sock:
+	close(sock_fd);
+}
+
+void test_connect_ping(void)
+{
+	int cgroup_fd;
+
+	if (!ASSERT_OK(unshare(CLONE_NEWNET | CLONE_NEWNS), "unshare"))
+		return;
+
+	/* overmount sysfs, and making original sysfs private so overmount
+	 * does not propagate to other mntns.
+	 */
+	if (!ASSERT_OK(mount("none", "/sys", NULL, MS_PRIVATE, NULL),
+		       "remount-private-sys"))
+		return;
+	if (!ASSERT_OK(mount("sysfs", "/sys", "sysfs", 0, NULL),
+		       "mount-sys"))
+		return;
+	if (!ASSERT_OK(mount("bpffs", "/sys/fs/bpf", "bpf", 0, NULL),
+		       "mount-bpf"))
+		goto clean_mount;
+
+	if (!ASSERT_OK(system("ip link set dev lo up"), "lo-up"))
+		goto clean_mount;
+	if (!ASSERT_OK(system("ip addr add 1.1.1.1 dev lo"), "lo-addr-v4"))
+		goto clean_mount;
+	if (!ASSERT_OK(system("ip -6 addr add 2001:db8::1 dev lo"), "lo-addr-v6"))
+		goto clean_mount;
+	if (!write_sysctl("/proc/sys/net/ipv4/ping_group_range", "0 0"))
+		goto clean_mount;
+
+	cgroup_fd = test__join_cgroup("/connect_ping");
+	if (!ASSERT_GE(cgroup_fd, 0, "cg-create"))
+		goto clean_mount;
+
+	if (test__start_subtest("ipv4"))
+		test_ipv4(cgroup_fd);
+	if (test__start_subtest("ipv4-bind"))
+		test_ipv4_bind(cgroup_fd);
+
+	if (test__start_subtest("ipv6"))
+		test_ipv6(cgroup_fd);
+	if (test__start_subtest("ipv6-bind"))
+		test_ipv6_bind(cgroup_fd);
+
+	close(cgroup_fd);
+
+clean_mount:
+	umount2("/sys", MNT_DETACH);
+}
diff --git a/tools/testing/selftests/bpf/progs/connect_ping.c b/tools/testing/selftests/bpf/progs/connect_ping.c
new file mode 100644
index 0000000000000..60178192b672f
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/connect_ping.c
@@ -0,0 +1,53 @@ 
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright 2022 Google LLC.
+ */
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_endian.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+
+/* 2001:db8::1 */
+#define BINDADDR_V6 { { { 0x20,0x01,0x0d,0xb8,0,0,0,0,0,0,0,0,0,0,0,1 } } }
+
+__u32 do_bind = 0;
+__u32 has_error = 0;
+__u32 invocations_v4 = 0;
+__u32 invocations_v6 = 0;
+
+SEC("cgroup/connect4")
+int connect_v4_prog(struct bpf_sock_addr *ctx)
+{
+	struct sockaddr_in sa = {
+		.sin_family = AF_INET,
+		.sin_addr.s_addr = bpf_htonl(0x01010101),
+	};
+
+	__sync_fetch_and_add(&invocations_v4, 1);
+
+	if (do_bind && bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)))
+		has_error = 1;
+
+	return 1;
+}
+
+SEC("cgroup/connect6")
+int connect_v6_prog(struct bpf_sock_addr *ctx)
+{
+	struct sockaddr_in6 sa = {
+		.sin6_family = AF_INET6,
+		.sin6_addr = BINDADDR_V6,
+	};
+
+	__sync_fetch_and_add(&invocations_v6, 1);
+
+	if (do_bind && bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)))
+		has_error = 1;
+
+	return 1;
+}
+
+char _license[] SEC("license") = "GPL";