From 1122b45dfdef5da534cb18da7cb9c688f9a2b528 Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Wed, 5 Apr 2023 16:35:08 +0200 Subject: Add support for 64 bits arguments --- tests/unit/test_filter.c | 76 ++++++++++++++++++++++++++++++++++++++---- tests/unit/test_filter_build.c | 21 ++++++++---- tests/unit/testutil.h | 7 +++- tests/unit/util.c | 14 ++++++-- 4 files changed, 101 insertions(+), 17 deletions(-) (limited to 'tests') diff --git a/tests/unit/test_filter.c b/tests/unit/test_filter.c index c1e0949..4d7c9d8 100644 --- a/tests/unit/test_filter.c +++ b/tests/unit/test_filter.c @@ -6,6 +6,8 @@ #define _GNU_SOURCE #include #include +#include +#include #include #include #include @@ -29,14 +31,26 @@ static int generate_install_filter(struct args_target *at) unsigned int size; for (i = 0; i < 6; i++) { - if (at->args[i] != NULL) { - calls[0].args[i] = (int)at->args[i]; - calls[0].check_arg[i] = true; - } else { - calls[0].check_arg[i] = false; + if (at->args[i] == NULL) { + calls[0].args[i].type = NO_CHECK; + continue; + } + switch (at->arg_type[i]) { + case U32: + calls[0].args[i].value.v32 = (uint32_t)at->args[i]; + calls[0].args[i].type = U32; + break; + case U64: + calls[0].args[i].value.v64 = (uint64_t)at->args[i]; + calls[0].args[i].type = U64; + break; + case NO_CHECK: + calls[0].args[i].type = NO_CHECK; + break; } } size = create_bfp_program(table, filter, 1); + bpf_disasm_all(filter, size); return install_filter(filter, size); } @@ -46,6 +60,7 @@ START_TEST(no_args) MAP_SHARED | MAP_ANONYMOUS, -1, 0); at->check_fd = false; at->nr = __NR_getpid; + set_args_no_check(at); at->install_filter = generate_install_filter; setup(); mock_syscall_target(); @@ -59,7 +74,9 @@ START_TEST(with_getsid) MAP_SHARED | MAP_ANONYMOUS, -1, 0); at->check_fd = false; at->nr = __NR_getsid; + set_args_no_check(at); at->args[0] = &id; + at->arg_type[0] = U32; at->install_filter = generate_install_filter; setup(); mock_syscall_target(); @@ -74,19 +91,59 @@ START_TEST(with_getpriority) MAP_SHARED | MAP_ANONYMOUS, -1, 0); at->check_fd = false; at->nr = __NR_getpriority; + set_args_no_check(at); at->args[0] = &which; + at->arg_type[0] = U32; at->args[1] = &who; + at->arg_type[0] = U32; + at->install_filter = generate_install_filter; + setup(); + mock_syscall_target(); +} +END_TEST + +static int target_lseek() +{ + int fd = open("/dev/zero", O_RDWR); + + /* Open the device on the target, but the arg0 isn't in the filter */ + ck_assert_int_ge(fd, 0); + at->args[0] = fd; + return target(); +} + +static void test_lseek(off_t offset) +{ + at = mmap(NULL, sizeof(struct args_target), PROT_READ | PROT_WRITE, + MAP_SHARED | MAP_ANONYMOUS, -1, 0); + at->check_fd = false; + at->nr = __NR_lseek; + at->target = target_lseek; + set_args_no_check(at); + at->args[1] = offset; + at->arg_type[1] = U64; at->install_filter = generate_install_filter; setup(); mock_syscall_target(); } + +START_TEST(with_lseek_lo) +{ + test_lseek(0x1); +} +END_TEST + +START_TEST(with_lseek_hi) +{ + test_lseek(0x0000000100000000); +} END_TEST Suite *op_call_suite(void) { Suite *s; int timeout = 30; - TCase *simple, *args32; + TCase *simple, *args32, *args64; s = suite_create("Test filter with target"); @@ -103,6 +160,13 @@ Suite *op_call_suite(void) tcase_add_test(args32, with_getpriority); suite_add_tcase(s, args32); + args64 = tcase_create("with args 64 bit"); + tcase_add_checked_fixture(args64, NULL, teardown); + tcase_set_timeout(args32, timeout); + tcase_add_test(args64, with_lseek_lo); + tcase_add_test(args64, with_lseek_hi); + suite_add_tcase(s, args64); + return s; } diff --git a/tests/unit/test_filter_build.c b/tests/unit/test_filter_build.c index 55e2a2b..4727e51 100644 --- a/tests/unit/test_filter_build.c +++ b/tests/unit/test_filter_build.c @@ -71,7 +71,8 @@ START_TEST(test_single_instr_two_args) { .name = "test1", .args = { 0, 123, 321, 0, 0, 0 }, - .check_arg = { false, true, true, false, false, false }, + .check_arg = { NO_CHECK, U32, U32, NO_CHECK, NO_CHECK, + NO_CHECK }, }, }; struct syscall_entry table[] = { @@ -198,12 +199,14 @@ START_TEST(test_multiple_instr_with_args) struct bpf_call calls[] = { { .name = "test1", .args = { 0, 123, 321, 0, 0, 0 }, - .check_arg = { false, true, true, false, false, false } }, + .check_arg = { NO_CHECK, U32, U32, NO_CHECK, NO_CHECK, + NO_CHECK } }, { .name = "test2" }, { .name = "test3" }, { .name = "test4", .args = { 0, 123, 321, 0, 0, 0 }, - .check_arg = { false, true, true, false, false, false } }, + .check_arg = { NO_CHECK, U32, U32, NO_CHECK, NO_CHECK, + NO_CHECK } }, { .name = "test5" }, }; struct syscall_entry table[] = { @@ -272,18 +275,22 @@ START_TEST(test_multiple_instance_same_instr) struct bpf_call calls[] = { { .name = "test1", .args = { 0, 123, 0, 0, 0, 0 }, - .check_arg = { false, true, false, false, false, false } }, + .check_arg = { NO_CHECK, U32, NO_CHECK, NO_CHECK, NO_CHECK, + NO_CHECK } }, { .name = "test1", .args = { 0, 0, 321, 0, 0, 0 }, - .check_arg = { false, false, true, false, false, false } }, + .check_arg = { NO_CHECK, NO_CHECK, U32, NO_CHECK, NO_CHECK, + NO_CHECK } }, { .name = "test2" }, { .name = "test3" }, { .name = "test4", .args = { 0, 123, 0, 0, 0, 0 }, - .check_arg = { false, true, false, false, false, false } }, + .check_arg = { NO_CHECK, U32, NO_CHECK, NO_CHECK, NO_CHECK, + NO_CHECK } }, { .name = "test4", .args = { 0, 0, 321, 0, 0, 0 }, - .check_arg = { false, false, true, false, false, false } }, + .check_arg = { NO_CHECK, NO_CHECK, U32, NO_CHECK, NO_CHECK, + NO_CHECK } }, { .name = "test5" }, }; struct syscall_entry table[] = { diff --git a/tests/unit/testutil.h b/tests/unit/testutil.h index dd4f1e9..7bb971a 100644 --- a/tests/unit/testutil.h +++ b/tests/unit/testutil.h @@ -5,8 +5,10 @@ #include #include #include +#include #include +#include "filter.h" #define STACK_SIZE (1024 * 1024 / 8) @@ -17,8 +19,10 @@ struct args_target { bool open_path; int fd; int nr; + enum arg_type arg_type[6]; void *args[6]; int (*install_filter)(struct args_target *at); + int (*target)(void *); }; extern struct seccomp_notif req; @@ -26,7 +30,7 @@ extern int notifyfd; extern struct args_target *at; extern int pipefd[2]; extern pid_t pid; -extern char path[100]; +extern char path[PATH_MAX]; extern uint16_t tmp_data[TMP_DATA_SIZE]; @@ -43,5 +47,6 @@ void teardown(); int install_notification_filter(struct args_target *at); void continue_target(); void mock_syscall_target(); +void set_args_no_check(struct args_target *at); #endif /* TESTUTIL_H */ diff --git a/tests/unit/util.c b/tests/unit/util.c index 5a1c5aa..7e5ec83 100644 --- a/tests/unit/util.c +++ b/tests/unit/util.c @@ -29,7 +29,7 @@ int notifyfd; struct args_target *at; int pipefd[2]; pid_t pid; -char path[] = "/tmp/test-seitan"; +char path[PATH_MAX] = "/tmp/test-seitan"; uint16_t tmp_data[TMP_DATA_SIZE]; int install_notification_filter(struct args_target *at) @@ -58,7 +58,7 @@ int target() at->ret = syscall(at->nr, at->args[0], at->args[1], at->args[2], at->args[3], at->args[4], at->args[5]); - at->err = errno; + at->err = errno; if (at->open_path) { if ((at->fd = open(path, O_CREAT | O_RDONLY)) < 0) { perror("open"); @@ -185,13 +185,21 @@ void mock_syscall_target() ck_assert_msg(ret == 0, strerror(errno)); } +void set_args_no_check(struct args_target *at) +{ + for (unsigned int i = 0; i < 6; i++) + at->arg_type[i] = NO_CHECK; +} + void setup() { int ret; signal(SIGCHLD, target_exit); ck_assert_int_ne(pipe(pipefd), -1); - pid = do_clone(target, NULL); + if (at->target == NULL) + at->target = target; + pid = do_clone(at->target, NULL); ck_assert_int_ge(pid, 0); /* Use write pipe to sync the target for checking the existance of the fd */ -- cgit v1.2.3