niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

selftests/landlock: Test TCP accesses with protocol=IPPROTO_TCP

Browse source 
Extend protocol_variant structure with protocol field (Cf. socket(2)).

Extend protocol fixture with TCP test suits with protocol=IPPROTO_TCP
which can be used as an alias for IPPROTO_IP (=0) in socket(2).

Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Link: https://lore.kernel.org/r/20250205093651.1424339-3-ivanov.mikhail1@huawei-partners.com
Cc: <stable@vger.kernel.org> # 6.7.x
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Mikhail Ivanov 2025-02-05 17:36:50 +08:00 • committed by Mickaël Salaün
parent 854277e2cc
commit f5534d511b
No known key found for this signature in database
GPG key ID: E5E3D0E88C82F6D2
2 changed files with 67 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
tools/testing/selftests/landlock/common.h
View file

@ -207,6 +207,7 @@ enforce_ruleset(struct __test_metadata *const _metadata, const int ruleset_fd)
struct protocol_variant { struct protocol_variant {
int domain; int domain;
int type; int type;
int protocol;
}; };
struct service_fixture { struct service_fixture {

80
tools/testing/selftests/landlock/net_test.c
View file

@ -85,18 +85,18 @@ static void setup_loopback(struct __test_metadata *const _metadata)
clear_ambient_cap(_metadata, CAP_NET_ADMIN); clear_ambient_cap(_metadata, CAP_NET_ADMIN);
} }
static bool prot_is_tcp(const struct protocol_variant *const prot)
{
return (prot->domain == AF_INET || prot->domain == AF_INET6) &&
prot->type == SOCK_STREAM &&
(prot->protocol == IPPROTO_TCP || prot->protocol == IPPROTO_IP);
}
static bool is_restricted(const struct protocol_variant *const prot, static bool is_restricted(const struct protocol_variant *const prot,
const enum sandbox_type sandbox) const enum sandbox_type sandbox)
{ {
switch (prot->domain) { if (sandbox == TCP_SANDBOX)
case AF_INET: return prot_is_tcp(prot);
case AF_INET6:
switch (prot->type) {
case SOCK_STREAM:
return sandbox == TCP_SANDBOX;
}
break;
}
return false; return false;
} }
@ -105,7 +105,7 @@ static int socket_variant(const struct service_fixture *const srv)
int ret; int ret;
ret = socket(srv->protocol.domain, srv->protocol.type | SOCK_CLOEXEC, ret = socket(srv->protocol.domain, srv->protocol.type | SOCK_CLOEXEC,
0); srv->protocol.protocol);
if (ret < 0) if (ret < 0)
return -errno; return -errno;
return ret; return ret;
@ -290,22 +290,48 @@ FIXTURE_TEARDOWN(protocol)
} }
/* clang-format off */ /* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_tcp) { FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_tcp1) {
/* clang-format on */ /* clang-format on */
.sandbox = NO_SANDBOX, .sandbox = NO_SANDBOX,
.prot = { .prot = {
.domain = AF_INET, .domain = AF_INET,
.type = SOCK_STREAM, .type = SOCK_STREAM,
/* IPPROTO_IP == 0 */
.protocol = IPPROTO_IP,
}, },
}; };
/* clang-format off */ /* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_tcp) { FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_tcp2) {
/* clang-format on */
.sandbox = NO_SANDBOX,
.prot = {
.domain = AF_INET,
.type = SOCK_STREAM,
.protocol = IPPROTO_TCP,
},
};
/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_tcp1) {
/* clang-format on */ /* clang-format on */
.sandbox = NO_SANDBOX, .sandbox = NO_SANDBOX,
.prot = { .prot = {
.domain = AF_INET6, .domain = AF_INET6,
.type = SOCK_STREAM, .type = SOCK_STREAM,
/* IPPROTO_IP == 0 */
.protocol = IPPROTO_IP,
},
};
/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_tcp2) {
/* clang-format on */
.sandbox = NO_SANDBOX,
.prot = {
.domain = AF_INET6,
.type = SOCK_STREAM,
.protocol = IPPROTO_TCP,
}, },
}; };
@ -350,22 +376,48 @@ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_unix_datagram) {
}; };
/* clang-format off */ /* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_tcp) { FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_tcp1) {
/* clang-format on */ /* clang-format on */
.sandbox = TCP_SANDBOX, .sandbox = TCP_SANDBOX,
.prot = { .prot = {
.domain = AF_INET, .domain = AF_INET,
.type = SOCK_STREAM, .type = SOCK_STREAM,
/* IPPROTO_IP == 0 */
.protocol = IPPROTO_IP,
}, },
}; };
/* clang-format off */ /* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_tcp) { FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_tcp2) {
/* clang-format on */
.sandbox = TCP_SANDBOX,
.prot = {
.domain = AF_INET,
.type = SOCK_STREAM,
.protocol = IPPROTO_TCP,
},
};
/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_tcp1) {
/* clang-format on */ /* clang-format on */
.sandbox = TCP_SANDBOX, .sandbox = TCP_SANDBOX,
.prot = { .prot = {
.domain = AF_INET6, .domain = AF_INET6,
.type = SOCK_STREAM, .type = SOCK_STREAM,
/* IPPROTO_IP == 0 */
.protocol = IPPROTO_IP,
},
};
/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_tcp2) {
/* clang-format on */
.sandbox = TCP_SANDBOX,
.prot = {
.domain = AF_INET6,
.type = SOCK_STREAM,
.protocol = IPPROTO_TCP,
}, },
}; };