From mboxrd@z Thu Jan 1 00:00:00 1970 From: Petr Vorel Date: Mon, 26 Mar 2018 13:05:12 +0200 Subject: [LTP] [PATCH v2 2/2] sctp: new regression test sctp_big_chunk for CVE-2018-5803 In-Reply-To: <1521819449-27489-3-git-send-email-alexey.kodanev@oracle.com> References: <1521819449-27489-1-git-send-email-alexey.kodanev@oracle.com> <1521819449-27489-3-git-send-email-alexey.kodanev@oracle.com> Message-ID: <20180326110512.GA2609@x230> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: ltp@lists.linux.it Hi Alexey, > Added two test-cases in runtest/cve: > * cve-2018-5803 - over-sized INIT_ACK packet > * cve-2018-5803_2 - over-sized INIT packet > Signed-off-by: Alexey Kodanev > --- > v2: rename the test file and move it to testcases/network/sctp/ > include/lapi/socket.h | 4 + > runtest/cve | 2 + > testcases/network/.gitignore | 1 + > testcases/network/sctp/Makefile | 2 +- > testcases/network/sctp/sctp_big_chunk.c | 121 +++++++++++++++++++++++++++++++ > 5 files changed, 129 insertions(+), 1 deletions(-) > create mode 100644 testcases/network/sctp/sctp_big_chunk.c > diff --git a/include/lapi/socket.h b/include/lapi/socket.h > index 426906f..d58c460 100644 > --- a/include/lapi/socket.h > +++ b/include/lapi/socket.h > @@ -45,6 +45,10 @@ > # define SOCK_CLOEXEC 02000000 > #endif > +#ifndef SOL_SCTP > +# define SOL_SCTP 132 > +#endif > + > #ifndef SOL_UDPLITE > # define SOL_UDPLITE 136 /* UDP-Lite (RFC 3828) */ > #endif > diff --git a/runtest/cve b/runtest/cve > index 8b7cbe5..1d9569a 100644 > --- a/runtest/cve > +++ b/runtest/cve > @@ -32,3 +32,5 @@ cve-2017-5754 meltdown > cve-2017-17052 cve-2017-17052 > cve-2017-16939 cve-2017-16939 > cve-2017-17053 cve-2017-17053 > +cve-2018-5803 sctp_big_chunk > +cve-2018-5803_2 sctp_big_chunk -a 10000 > diff --git a/testcases/network/.gitignore b/testcases/network/.gitignore > index d4ed925..e952f6f 100644 > --- a/testcases/network/.gitignore > +++ b/testcases/network/.gitignore > @@ -22,6 +22,7 @@ > /nfsv4/locks/locktests > /rpc/basic_tests/rpc01/rpc1 > /rpc/basic_tests/rpc01/rpc_server > +/sctp/sctp_big_chunk > /sockets/ltpClient > /sockets/ltpServer > /stress/ns-tools/ns-icmp_redirector > diff --git a/testcases/network/sctp/Makefile b/testcases/network/sctp/Makefile > index 914e389..0fa9125 100644 > --- a/testcases/network/sctp/Makefile > +++ b/testcases/network/sctp/Makefile > @@ -15,7 +15,7 @@ > top_srcdir ?= ../../.. > -include $(top_srcdir)/include/mk/env_pre.mk > +include $(top_srcdir)/include/mk/testcases.mk > INSTALL_TARGETS := sctp01.sh > diff --git a/testcases/network/sctp/sctp_big_chunk.c b/testcases/network/sctp/sctp_big_chunk.c > new file mode 100644 > index 0000000..55a2969 > --- /dev/null > +++ b/testcases/network/sctp/sctp_big_chunk.c > @@ -0,0 +1,121 @@ > +/* > + * Copyright (c) 2018 Oracle and/or its affiliates. All Rights Reserved. > + * > + * This program is free software; you can redistribute it and/or > + * modify it under the terms of the GNU General Public License as > + * published by the Free Software Foundation; either version 2 of > + * the License, or (at your option) any later version. > + * > + * This program is distributed in the hope that it would be useful, > + * but WITHOUT ANY WARRANTY; without even the implied warranty of > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > + * GNU General Public License for more details. > + * > + * You should have received a copy of the GNU General Public License > + * along with this program. If not, see . > + * > + * Regression test-case for the crash caused by over-sized SCTP chunk, > + * fixed by upstream commit 07f2c7ab6f8d ("sctp: verify size of a new > + * chunk in _sctp_make_chunk()") > + */ > + > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > + > +#include "tst_test.h" > +#include "tst_safe_stdio.h" > +#include "lapi/netinet_in.h" > +#include "lapi/socket.h" > +#include "lapi/sctp.h" > + > +static int port; > +static int sfd, cfd; > +static struct sockaddr_in6 rmt, loc; > + > +static char *addr_param; > +static int addr_num = 3273; > + > +static void setup_server(void) > +{ > + loc.sin6_family = AF_INET6; > + loc.sin6_addr = in6addr_loopback; > + > + sfd = SAFE_SOCKET(AF_INET6, SOCK_STREAM, IPPROTO_SCTP); > + SAFE_BIND(sfd, (struct sockaddr *)&loc, sizeof(loc)); > + > + port = TST_GETSOCKPORT(sfd); > + tst_res(TINFO, "sctp server listen on %d", port); > + > + SAFE_LISTEN(sfd, 1); > +} > + > +static void setup_client(void) > +{ > + struct sockaddr_in6 addr_buf[addr_num]; > + int i; > + > + cfd = SAFE_SOCKET(AF_INET6, SOCK_STREAM, IPPROTO_SCTP); > + rmt.sin6_family = AF_INET6; > + rmt.sin6_addr = in6addr_loopback; > + rmt.sin6_port = htons(port); > + > + tst_res(TINFO, "bind %d additional IP addresses", addr_num); > + > + memset(addr_buf, 0, sizeof(addr_buf)); > + for (i = 0; i < addr_num; ++i) { > + addr_buf[i].sin6_family = AF_INET6; > + addr_buf[i].sin6_addr = in6addr_loopback; > + } > + > + SAFE_SETSOCKOPT(cfd, SOL_SCTP, SCTP_SOCKOPT_BINDX_ADD, addr_buf, > + sizeof(addr_buf)); > +} > + > +static void setup(void) > +{ > + if (tst_parse_int(addr_param, &addr_num, 1, INT_MAX)) > + tst_brk(TBROK, "wrong address number '%s'", addr_param); > + > + setup_server(); > + setup_client(); > +} > + > +static void run(void) > +{ > + int pid = SAFE_FORK(); > + > + if (!pid) { > + struct sockaddr_in6 addr6; > + socklen_t addr_size = sizeof(addr6); > + > + if (accept(sfd, (struct sockaddr *)&addr6, &addr_size) < 0) > + tst_brk(TBROK | TERRNO, "accept() failed"); > + exit(0); > + } > + > + fcntl(cfd, F_SETFL, O_NONBLOCK); > + connect(cfd, (struct sockaddr *)&rmt, sizeof(rmt)); > + > + SAFE_KILL(pid, SIGKILL); > + SAFE_WAITPID(pid, NULL, 0); > + > + tst_res(TPASS, "test doesn't cause crash"); > +} > + > +static struct tst_option options[] = { > + {"a:", &addr_param, "-a number of additional IP address params"}, > + {NULL, NULL, NULL} > +}; > + > +static struct tst_test test = { > + .setup = setup, > + .forks_child = 1, > + .test_all = run, > + .options = options > +}; Acked-by: Petr Vorel