From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
To: <mic@digikod.net>
Cc: <willemdebruijn.kernel@gmail.com>,
<linux-security-module@vger.kernel.org>, <netdev@vger.kernel.org>,
<netfilter-devel@vger.kernel.org>, <yusongping@huawei.com>,
<anton.sirazetdinov@huawei.com>
Subject: [PATCH v6 12/17] seltests/landlock: adds tests for connect() hooks
Date: Tue, 21 Jun 2022 16:23:08 +0800 [thread overview]
Message-ID: <20220621082313.3330667-13-konstantin.meskhidze@huawei.com> (raw)
In-Reply-To: <20220621082313.3330667-1-konstantin.meskhidze@huawei.com>
Adds selftests for connect socket action.
The first are with no landlock restrictions:
- connect without restrictions for ip4;
- connect without restrictions for ip6;
The second ones are with mixed landlock rules:
- connect with restrictions ip4;
- connect with restrictions ip6;
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
---
Changes since v5:
* Adds connect_variant() helper.
* Formats code with clang-format-14.
Changes since v4:
* Adds selftests for IP6 family:
- connect_no_restrictions_ip6.
- connect_with_restrictions_ip6.
* Refactors code with self->port, self->addr4 and
self->addr6 variables.
Changes since v3:
* Split commit.
---
tools/testing/selftests/landlock/net_test.c | 174 ++++++++++++++++++++
1 file changed, 174 insertions(+)
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index a0e02b6bd79f..ce6fd51a922d 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -26,6 +26,9 @@
#define IP_ADDRESS "127.0.0.1"
+/* Number pending connections queue to be hold */
+#define BACKLOG 10
+
FIXTURE(socket)
{
uint port[MAX_SOCKET_NUM];
@@ -72,6 +75,19 @@ static int bind_variant(const FIXTURE_VARIANT(socket) * const variant,
sizeof(self->addr6[index]));
}
+static int connect_variant(const FIXTURE_VARIANT(socket) * const variant,
+ const int sockfd,
+ const FIXTURE_DATA(socket) * const self,
+ const size_t index)
+{
+ if (variant->is_ipv4)
+ return connect(sockfd, &self->addr4[index],
+ sizeof(self->addr4[index]));
+ else
+ return connect(sockfd, &self->addr6[index],
+ sizeof(self->addr6[index]));
+}
+
FIXTURE_SETUP(socket)
{
int i;
@@ -177,4 +193,162 @@ TEST_F(socket, bind_with_restrictions)
ASSERT_EQ(-1, bind_variant(variant, sockfd, self, 2));
ASSERT_EQ(EACCES, errno);
}
+
+TEST_F(socket, connect_no_restrictions)
+{
+ int sockfd, new_fd;
+ pid_t child;
+ int status;
+
+ /* Creates a server socket. */
+ sockfd = create_socket_variant(variant, SOCK_STREAM);
+ ASSERT_LE(0, sockfd);
+
+ /* Binds a socket to port[0]. */
+ ASSERT_EQ(0, bind_variant(variant, sockfd, self, 0));
+
+ /* Makes listening socket. */
+ ASSERT_EQ(0, listen(sockfd, BACKLOG));
+
+ child = fork();
+ ASSERT_LE(0, child);
+ if (child == 0) {
+ int child_sockfd;
+
+ /* Closes listening socket for the child. */
+ ASSERT_EQ(0, close(sockfd));
+ /* Create a stream client socket. */
+ child_sockfd = create_socket_variant(variant, SOCK_STREAM);
+ ASSERT_LE(0, child_sockfd);
+
+ /* Makes connection to the listening socket with port[0]. */
+ ASSERT_EQ(0, connect_variant(variant, child_sockfd, self, 0));
+ _exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
+ return;
+ }
+ /* Accepts connection from the child. */
+ new_fd = accept(sockfd, NULL, 0);
+ ASSERT_LE(0, new_fd);
+
+ /* Closes connection. */
+ ASSERT_EQ(0, close(new_fd));
+
+ /* Closes listening socket for the parent. */
+ ASSERT_EQ(0, close(sockfd));
+
+ ASSERT_EQ(child, waitpid(child, &status, 0));
+ ASSERT_EQ(1, WIFEXITED(status));
+ ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
+}
+
+TEST_F(socket, connect_with_restrictions)
+{
+ int new_fd;
+ int sockfd_1, sockfd_2;
+ pid_t child_1, child_2;
+ int status;
+
+ struct landlock_ruleset_attr ruleset_attr = {
+ .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
+ LANDLOCK_ACCESS_NET_CONNECT_TCP,
+ };
+ struct landlock_net_service_attr net_service_1 = {
+ .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP |
+ LANDLOCK_ACCESS_NET_CONNECT_TCP,
+ .port = self->port[0],
+ };
+ struct landlock_net_service_attr net_service_2 = {
+ .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
+ .port = self->port[1],
+ };
+
+ const int ruleset_fd =
+ landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+ ASSERT_LE(0, ruleset_fd);
+
+ /* Allows connect and bind operations to the port[0] socket. */
+ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_SERVICE,
+ &net_service_1, 0));
+ /* Allows connect and deny bind operations to the port[1] socket. */
+ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_SERVICE,
+ &net_service_2, 0));
+
+ /* Enforces the ruleset. */
+ enforce_ruleset(_metadata, ruleset_fd);
+
+ /* Creates a server socket 1. */
+ sockfd_1 = create_socket_variant(variant, SOCK_STREAM);
+ ASSERT_LE(0, sockfd_1);
+
+ /* Binds the socket 1 to address with port[0]. */
+ ASSERT_EQ(0, bind_variant(variant, sockfd_1, self, 0));
+
+ /* Makes listening socket 1. */
+ ASSERT_EQ(0, listen(sockfd_1, BACKLOG));
+
+ child_1 = fork();
+ ASSERT_LE(0, child_1);
+ if (child_1 == 0) {
+ int child_sockfd;
+
+ /* Closes listening socket for the child. */
+ ASSERT_EQ(0, close(sockfd_1));
+ /* Creates a stream client socket. */
+ child_sockfd = create_socket_variant(variant, SOCK_STREAM);
+ ASSERT_LE(0, child_sockfd);
+
+ /* Makes connection to the listening socket with port[0]. */
+ ASSERT_EQ(0, connect_variant(variant, child_sockfd, self, 0));
+ _exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
+ return;
+ }
+ /* Accepts connection from the child 1. */
+ new_fd = accept(sockfd_1, NULL, 0);
+ ASSERT_LE(0, new_fd);
+
+ /* Closes connection. */
+ ASSERT_EQ(0, close(new_fd));
+
+ /* Closes listening socket 1 for the parent. */
+ ASSERT_EQ(0, close(sockfd_1));
+
+ ASSERT_EQ(child_1, waitpid(child_1, &status, 0));
+ ASSERT_EQ(1, WIFEXITED(status));
+ ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
+
+ /* Creates a server socket 2. */
+ sockfd_2 = create_socket_variant(variant, SOCK_STREAM);
+ ASSERT_LE(0, sockfd_2);
+
+ /* Binds the socket 2 to address with port[1]. */
+ ASSERT_EQ(0, bind_variant(variant, sockfd_2, self, 1));
+
+ /* Makes listening socket 2. */
+ ASSERT_EQ(0, listen(sockfd_2, BACKLOG));
+
+ child_2 = fork();
+ ASSERT_LE(0, child_2);
+ if (child_2 == 0) {
+ int child_sockfd;
+
+ /* Closes listening socket for the child. */
+ ASSERT_EQ(0, close(sockfd_2));
+ /* Creates a stream client socket. */
+ child_sockfd = create_socket_variant(variant, SOCK_STREAM);
+ ASSERT_LE(0, child_sockfd);
+
+ /* Makes connection to the listening socket with port[1]. */
+ ASSERT_EQ(-1, connect_variant(variant, child_sockfd, self, 1));
+ ASSERT_EQ(EACCES, errno);
+ _exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
+ return;
+ }
+
+ /* Closes listening socket 2 for the parent. */
+ ASSERT_EQ(0, close(sockfd_2));
+
+ ASSERT_EQ(child_2, waitpid(child_2, &status, 0));
+ ASSERT_EQ(1, WIFEXITED(status));
+ ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
+}
TEST_HARNESS_MAIN
--
2.25.1
next prev parent reply other threads:[~2022-06-21 8:24 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-21 8:22 [PATCH v6 00/17] Network support for Landlock Konstantin Meskhidze
2022-06-21 8:22 ` [PATCH v6 01/17] landlock: renames access mask Konstantin Meskhidze
2022-07-01 17:08 ` Mickaël Salaün
2022-07-04 9:23 ` Konstantin Meskhidze (A)
2022-07-05 11:29 ` Konstantin Meskhidze (A)
2022-07-05 13:26 ` Mickaël Salaün
2022-07-08 12:56 ` Konstantin Meskhidze (A)
2022-06-21 8:22 ` [PATCH v6 02/17] landlock: refactors landlock_find/insert_rule Konstantin Meskhidze
2022-07-07 16:44 ` Mickaël Salaün
2022-07-08 12:53 ` Konstantin Meskhidze (A)
2022-07-08 13:56 ` Mickaël Salaün
2022-07-08 14:14 ` Konstantin Meskhidze (A)
2022-07-08 14:20 ` Konstantin Meskhidze (A)
2022-07-08 16:57 ` Mickaël Salaün
2022-07-11 8:16 ` Konstantin Meskhidze (A)
2022-07-08 13:10 ` Konstantin Meskhidze (A)
2022-07-08 13:59 ` Mickaël Salaün
2022-07-08 14:14 ` Konstantin Meskhidze (A)
2022-07-08 14:35 ` Mickaël Salaün
2022-07-11 14:05 ` Konstantin Meskhidze (A)
2022-07-28 14:48 ` Mickaël Salaün
2022-07-07 16:46 ` Mickaël Salaün
2022-07-08 12:54 ` Konstantin Meskhidze (A)
2022-06-21 8:22 ` [PATCH v6 03/17] landlock: refactors merge and inherit functions Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 04/17] landlock: moves helper functions Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 05/17] landlock: refactors " Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 06/17] landlock: refactors landlock_add_rule syscall Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 07/17] landlock: user space API network support Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 08/17] landlock: adds support network rules Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 09/17] landlock: implements TCP network hooks Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 10/17] seltests/landlock: moves helper function Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 11/17] seltests/landlock: adds tests for bind() hooks Konstantin Meskhidze
2022-07-28 13:24 ` Mickaël Salaün
2022-06-21 8:23 ` Konstantin Meskhidze [this message]
2022-06-21 8:23 ` [PATCH v6 13/17] seltests/landlock: adds AF_UNSPEC family test Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 14/17] seltests/landlock: adds rules overlapping test Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 15/17] seltests/landlock: adds ruleset expanding test Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 16/17] seltests/landlock: adds invalid input data test Konstantin Meskhidze
2022-06-21 8:23 ` [PATCH v6 17/17] samples/landlock: adds network demo Konstantin Meskhidze
2022-07-27 20:26 ` Mickaël Salaün
2022-07-28 9:21 ` Konstantin Meskhidze (A)
2022-07-26 17:43 ` [PATCH v6 00/17] Network support for Landlock Mickaël Salaün
2022-07-27 19:54 ` Mickaël Salaün
2022-07-28 9:19 ` Konstantin Meskhidze (A)
2022-07-28 9:25 ` Konstantin Meskhidze (A)
2022-07-28 10:12 ` Mickaël Salaün
2022-07-28 11:27 ` Konstantin Meskhidze (A)
2022-07-28 13:17 ` Mickaël Salaün
2022-08-23 9:10 ` Konstantin Meskhidze (A)
2022-08-27 13:30 ` Konstantin Meskhidze (A)
2022-08-29 13:10 ` Mickaël Salaün
2022-07-27 20:21 ` Mickaël Salaün
2022-07-28 9:20 ` Konstantin Meskhidze (A)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220621082313.3330667-13-konstantin.meskhidze@huawei.com \
--to=konstantin.meskhidze@huawei.com \
--cc=anton.sirazetdinov@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).