Add bind multi-attach test suite and framework extension (#5338)

docs/BindHook.md

@@ -163,8 +163,41 @@ typedef enum _ebpf_sock_addr_verdict
 } ebpf_sock_addr_verdict_t;
 ```
 
-When multiple bind programs are attached, the verdicts are combined: if any program
-rejects, the bind is blocked.
+When multiple bind programs are attached, the verdicts are combined using a
+most-restrictive accumulation rule:
+
+- **Priority**: `REJECT` (2) > `PROCEED_HARD` (1) > `PROCEED_SOFT` (0)
+- The accumulated verdict is the highest-priority value seen across all
+  attached programs.
+- **Short-circuit on REJECT**: If any program returns `REJECT`, the provider
+  loop stops immediately — subsequent programs are not invoked.
+- If no programs are attached (or all are detached), the default verdict is
+  `PROCEED_SOFT` (permit).
+- An unknown/invalid return value from a program is treated as `REJECT`.
+
+The accumulated verdict then interacts with WFP:
+
+- `PROCEED_SOFT`: bind is allowed unless a WFP filter with higher weight blocks it.
+- `PROCEED_HARD`: bind is allowed unconditionally — clears `FWPS_RIGHT_ACTION_WRITE`
+  so no subsequent WFP filter can override.
+- `REJECT`: bind is denied (returns `WSAEACCES` / `EACCES`).
+
+### Multi-Attach Test Coverage
+
+The following scenarios are exercised in `tests/socket/socket_tests.cpp`
+(tagged `[bind_tests][multi_attach]`), across TCP/UDP and IPv4/IPv6:
+
+| Scenario | Programs | Expected Result |
+|---|---|---|
+| All soft permits | 2× `PROCEED_SOFT` | Bind allowed |
+| Second program rejects | `PROCEED_SOFT` + `REJECT` | Bind denied |
+| First program rejects (short-circuit) | `REJECT` + `PROCEED_SOFT` | Bind denied |
+| Soft + hard mix | `PROCEED_SOFT` + `PROCEED_HARD` | Bind allowed (hard priority) |
+| Soft permits blocked by WFP | 2× `PROCEED_SOFT` + WFP block | Bind denied |
+| Hard overrides WFP | `PROCEED_SOFT` + `PROCEED_HARD` + WFP block | Bind allowed |
+| Detach middle program | 3 programs → detach REJECT middle | Bind recovers |
+| Detach and reattach | Detach + reattach with new verdict | Verdict updates |
+| Three soft permits | 3× `PROCEED_SOFT` | Bind allowed |
 
 ## Architecture
 

libs/api/libbpf_program.cpp

@@ -250,6 +250,7 @@ _does_attach_type_support_attachable_fd(enum bpf_attach_type type)
     case BPF_CGROUP_INET4_LISTEN:
     case BPF_CGROUP_INET6_LISTEN:
     case BPF_CGROUP_SOCK_OPS:
+    case BPF_ATTACH_TYPE_BIND:
         supported = TRUE;
         break;
     default:

netebpfext/net_ebpf_ext_sock_addr.c

@@ -302,7 +302,7 @@ static bool
 _net_ebpf_extension_sock_addr_process_verdict(_Inout_ void* program_context, int program_verdict);
 
 static bool
-_net_ebpf_extension_sock_addr_bind_process_verdict(_Inout_ void* program_context, int program_verdict);
+_net_ebpf_extension_sock_addr_authorize_process_verdict(_Inout_ void* program_context, int program_verdict);
 
 //
 // sock_addr helper functions.
@@ -1402,7 +1402,7 @@ net_ebpf_ext_sock_addr_register_providers()
         .create_filter_context = _net_ebpf_extension_sock_addr_create_filter_context,
         .delete_filter_context = _net_ebpf_extension_sock_addr_delete_filter_context,
         .validate_client_data = _net_ebpf_extension_sock_addr_validate_client_data,
-        .process_verdict = _net_ebpf_extension_sock_addr_bind_process_verdict,
+        .process_verdict = _net_ebpf_extension_sock_addr_authorize_process_verdict,
     };
 
     const net_ebpf_extension_hook_provider_dispatch_table_t listen_dispatch_table = {
@@ -2058,23 +2058,42 @@ _net_ebpf_extension_sock_addr_process_verdict(_Inout_ void* program_context, int
     return TRUE;
 }
 
-// Multi-attach verdict accumulator for the sock_addr bind hook. Tracks the
-// most-restrictive verdict across attached programs in net_ebpf_sock_addr_t::verdict
-// using _get_verdict_priority(), and returns FALSE on REJECT so the hook provider
-// loop stops invoking subsequent programs. Address/port writes to the context are
-// ignored at bind (the WFP ALE_RESOURCE_ASSIGNMENT layer does not support address
-// rewrite), so no redirect handling is performed here.
+// Multi-attach verdict accumulator for sock_addr authorization gates that do
+// not support context rewrite, such as the sock_addr bind hook
+// (ALE_RESOURCE_ASSIGNMENT) and the sock_addr listen hook (ALE_AUTH_LISTEN).
+// Tracks the most-restrictive normalized verdict across attached programs in
+// net_ebpf_sock_addr_t::verdict using _get_verdict_priority(), and returns
+// FALSE on REJECT so the hook provider loop stops invoking subsequent
+// programs.
+//
+// Any address/port writes a program makes to the context are silently ignored
+// for WFP purposes (the underlying ALE layer does not support address
+// rewrite). To prevent one program's writes from being observed by subsequent
+// programs in the same multi-attach invocation, the context is restored from
+// net_ebpf_sock_addr_t::original_context after each program. The caller must
+// set original_context to point at a pristine snapshot of bpf_sock_addr_t
+// before invoking any program.
 static bool
-_net_ebpf_extension_sock_addr_bind_process_verdict(_Inout_ void* program_context, int program_verdict)
+_net_ebpf_extension_sock_addr_authorize_process_verdict(_Inout_ void* program_context, int program_verdict)
 {
     bpf_sock_addr_t* sock_addr_ctx = (bpf_sock_addr_t*)program_context;
     net_ebpf_sock_addr_t* context = CONTAINING_RECORD(sock_addr_ctx, net_ebpf_sock_addr_t, base);
+    bpf_sock_addr_t* original_context = context->original_context;
     int normalized_verdict = _normalize_sock_addr_verdict(program_verdict);
 
+    // original_context must be set by the caller before invoking programs.
+    // It points to a caller's stack variable and is only valid during synchronous program invocation.
+    ASSERT(original_context != NULL);
+
     if (_get_verdict_priority(normalized_verdict) > _get_verdict_priority(context->verdict)) {
         context->verdict = normalized_verdict;
     }
 
+    // Restore the context so the next attached program sees the original
+    // WFP-provided values, not whatever the previous program may have written
+    // to user_ip / user_port / msg_src_*.
+    *sock_addr_ctx = *original_context;
+
     return normalized_verdict != BPF_SOCK_ADDR_VERDICT_REJECT;
 }
 
@@ -2120,6 +2139,14 @@ net_ebpf_extension_sock_addr_authorize_listen_classify(
     UNREFERENCED_PARAMETER(classify_context);
     UNREFERENCED_PARAMETER(flow_context);
 
+    if ((classify_output->rights & FWPS_RIGHT_ACTION_WRITE) == 0) {
+        // A callout with higher weight has revoked the write permission. Bail out
+        // without touching classify_output->actionType.
+        EBPF_EXT_LOG_MESSAGE(
+            EBPF_EXT_TRACELOG_LEVEL_VERBOSE, EBPF_EXT_TRACELOG_KEYWORD_SOCK_ADDR, "No \"write\" right; exiting.");
+        goto Exit;
+    }
+
     classify_output->actionType = FWP_ACTION_PERMIT;
 
     filter_context = (net_ebpf_extension_sock_addr_wfp_filter_context_t*)filter->context;
@@ -2235,6 +2262,14 @@ net_ebpf_extension_sock_addr_authorize_recv_accept_classify(
     UNREFERENCED_PARAMETER(classify_context);
     UNREFERENCED_PARAMETER(flow_context);
 
+    if ((classify_output->rights & FWPS_RIGHT_ACTION_WRITE) == 0) {
+        // A callout with higher weight has revoked the write permission. Bail out
+        // without touching classify_output->actionType.
+        EBPF_EXT_LOG_MESSAGE(
+            EBPF_EXT_TRACELOG_LEVEL_VERBOSE, EBPF_EXT_TRACELOG_KEYWORD_SOCK_ADDR, "No \"write\" right; exiting.");
+        goto Exit;
+    }
+
     classify_output->actionType = FWP_ACTION_PERMIT;
 
     filter_context = (net_ebpf_extension_sock_addr_wfp_filter_context_t*)filter->context;
@@ -2355,6 +2390,14 @@ net_ebpf_extension_sock_addr_bind_classify(
     UNREFERENCED_PARAMETER(classify_context);
     UNREFERENCED_PARAMETER(flow_context);
 
+    if ((classify_output->rights & FWPS_RIGHT_ACTION_WRITE) == 0) {
+        // A callout with higher weight has revoked the write permission. Bail out
+        // without touching classify_output->actionType.
+        EBPF_EXT_LOG_MESSAGE(
+            EBPF_EXT_TRACELOG_LEVEL_VERBOSE, EBPF_EXT_TRACELOG_KEYWORD_SOCK_ADDR, "No \"write\" right; exiting.");
+        goto Exit;
+    }
+
     classify_output->actionType = FWP_ACTION_PERMIT;
 
     filter_context = (net_ebpf_extension_sock_addr_wfp_filter_context_t*)filter->context;
@@ -2383,10 +2426,17 @@ net_ebpf_extension_sock_addr_bind_classify(
 
     // Initialize the accumulated verdict to PROCEED_SOFT so that if no program updates it
     // (e.g. all clients are filtered out), the bind defaults to permit.
-    // The bind process_verdict callback updates net_ebpf_sock_addr_ctx.verdict with the
+    // The authorize_process_verdict callback updates net_ebpf_sock_addr_ctx.verdict with the
     // most-restrictive verdict across multi-attach programs and short-circuits on REJECT.
     net_ebpf_sock_addr_ctx.verdict = BPF_SOCK_ADDR_VERDICT_PROCEED_SOFT;
 
+    // Snapshot the context so the shared authorize_process_verdict callback can restore it
+    // between programs. The snapshot is stack-local and only valid for the synchronous
+    // program invocation below.
+    bpf_sock_addr_t sock_addr_ctx_original;
+    memcpy(&sock_addr_ctx_original, sock_addr_ctx, sizeof(sock_addr_ctx_original));
+    net_ebpf_sock_addr_ctx.original_context = &sock_addr_ctx_original;
+
     program_result =
         net_ebpf_extension_hook_expand_stack_and_invoke_programs(sock_addr_ctx, &filter_context->base, &ignored_result);
     if (program_result == EBPF_OBJECT_NOT_FOUND) {
@@ -2399,9 +2449,9 @@ net_ebpf_extension_sock_addr_bind_classify(
         goto Exit;
     }
 
-    // Use the accumulated verdict from the bind process_verdict callback. Bind hooks do not
+    // Use the accumulated verdict from the authorize_process_verdict callback. Bind hooks do not
     // support address modification: any changes the program made to user_ip/user_port are
-    // silently ignored.
+    // silently ignored (and restored between programs by the shared accumulator).
     verdict = net_ebpf_sock_addr_ctx.verdict;
     switch (verdict) {
     case BPF_SOCK_ADDR_VERDICT_PROCEED_SOFT:
@@ -2465,6 +2515,7 @@ net_ebpf_extension_sock_addr_authorize_connection_classify(
     bpf_sock_addr_t* sock_addr_ctx = &net_ebpf_sock_addr_ctx.base;
     uint32_t compartment_id = UNSPECIFIED_COMPARTMENT_ID;
     ebpf_result_t program_result;
+    bool rights_revoked = FALSE;
 
     UNREFERENCED_PARAMETER(incoming_metadata_values);
     UNREFERENCED_PARAMETER(layer_data);
@@ -2506,9 +2557,21 @@ net_ebpf_extension_sock_addr_authorize_connection_classify(
     }
 
     // First, try to find and use existing connection context from redirect layer.
+    // This must happen before the rights check so the cached entry is always cleaned up,
+    // even when a higher-weight callout has revoked our write permission.
     verdict = _net_ebpf_ext_find_and_remove_connection_context(
         incoming_metadata_values->transportEndpointHandle, sock_addr_ctx);
 
+    if ((classify_output->rights & FWPS_RIGHT_ACTION_WRITE) == 0) {
+        // A callout with higher weight has revoked the write permission. Bail out
+        // without touching classify_output->actionType (the Exit-block switch is
+        // also skipped via rights_revoked). The cache cleanup above has already run.
+        EBPF_EXT_LOG_MESSAGE(
+            EBPF_EXT_TRACELOG_LEVEL_VERBOSE, EBPF_EXT_TRACELOG_KEYWORD_SOCK_ADDR, "No \"write\" right; exiting.");
+        rights_revoked = TRUE;
+        goto Exit;
+    }
+
     // CONNECT_AUTHORIZATION programs run for all non-REJECT verdicts from the redirect layer.
     // REJECT is already final. PROCEED_HARD and PROCEED_SOFT both allow authorization programs
     // to run so they can make decisions based on route-dependent metadata.
@@ -2552,18 +2615,20 @@ net_ebpf_extension_sock_addr_authorize_connection_classify(
 Exit:
     // Set action type based on verdict.
     // Clear FWPS_RIGHT_ACTION_WRITE for block and hard permit.
-    switch (verdict) {
-    case BPF_SOCK_ADDR_VERDICT_PROCEED_SOFT:
-        classify_output->actionType = FWP_ACTION_PERMIT;
-        break;
-    case BPF_SOCK_ADDR_VERDICT_PROCEED_HARD:
-        classify_output->actionType = FWP_ACTION_PERMIT;
-        classify_output->rights &= ~FWPS_RIGHT_ACTION_WRITE;
-        break;
-    default:
-        classify_output->actionType = FWP_ACTION_BLOCK;
-        classify_output->rights &= ~FWPS_RIGHT_ACTION_WRITE;
-        break;
+    if (!rights_revoked) {
+        switch (verdict) {
+        case BPF_SOCK_ADDR_VERDICT_PROCEED_SOFT:
+            classify_output->actionType = FWP_ACTION_PERMIT;
+            break;
+        case BPF_SOCK_ADDR_VERDICT_PROCEED_HARD:
+            classify_output->actionType = FWP_ACTION_PERMIT;
+            classify_output->rights &= ~FWPS_RIGHT_ACTION_WRITE;
+            break;
+        default:
+            classify_output->actionType = FWP_ACTION_BLOCK;
+            classify_output->rights &= ~FWPS_RIGHT_ACTION_WRITE;
+            break;
+        }
     }
 
     _net_ebpf_ext_log_sock_addr_classify(

tests/libs/util/native_helper.cpp

@@ -68,3 +68,25 @@ _native_module_helper::~_native_module_helper()
         DeleteFileA(_file_name.c_str());
     }
 }
+
+_native_module_helper::_native_module_helper(_native_module_helper&& other) noexcept
+    : _file_name(std::move(other._file_name)), _delete_file_on_destruction(other._delete_file_on_destruction),
+      _is_main_thread(other._is_main_thread)
+{
+    other._delete_file_on_destruction = false;
+}
+
+_native_module_helper&
+_native_module_helper::operator=(_native_module_helper&& other) noexcept
+{
+    if (this != &other) {
+        if (_delete_file_on_destruction && !_file_name.empty()) {
+            DeleteFileA(_file_name.c_str());
+        }
+        _file_name = std::move(other._file_name);
+        _delete_file_on_destruction = other._delete_file_on_destruction;
+        _is_main_thread = other._is_main_thread;
+        other._delete_file_on_destruction = false;
+    }
+    return *this;
+}

tests/libs/util/native_helper.hpp

@@ -21,6 +21,21 @@
 typedef class _native_module_helper
 {
   public:
+    _native_module_helper() = default;
+
+    // Non-copyable: the destructor deletes the underlying .sys file, so two
+    // instances with the same _file_name and _delete_file_on_destruction = true
+    // would race / double-delete.
+    _native_module_helper(const _native_module_helper&) = delete;
+    _native_module_helper&
+    operator=(const _native_module_helper&) = delete;
+
+    // Movable: transfer the file ownership flag and clear it on the source so
+    // only the destination's destructor deletes the file.
+    _native_module_helper(_native_module_helper&& other) noexcept;
+    _native_module_helper&
+    operator=(_native_module_helper&& other) noexcept;
+
     void
     initialize(_In_z_ const char* file_name_prefix)
     {