netdev - Re: [PATCH v5 11/15] seltests/landlock: connect() with AF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 May 2022 11:40:24 +0300
From:   Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
To:     Mickaël Salaün <mic@...ikod.net>
CC:     <willemdebruijn.kernel@...il.com>,
        <linux-security-module@...r.kernel.org>, <netdev@...r.kernel.org>,
        <netfilter-devel@...r.kernel.org>, <yusongping@...wei.com>,
        <anton.sirazetdinov@...wei.com>
Subject: Re: [PATCH v5 11/15] seltests/landlock: connect() with AF_UNSPEC
 tests



5/19/2022 6:00 PM, Mickaël Salaün пишет:
> 
> On 19/05/2022 14:31, Konstantin Meskhidze wrote:
>>
>>
>> 5/17/2022 11:55 AM, Mickaël Salaün пишет:
>>> I guess these tests would also work with IPv6. You can then use the 
>>> "alternative" tests I explained.
>>>
>>    Do you mean adding new helpers such as bind_variant() and 
>> connect_variant()??
>>> On 16/05/2022 17:20, Konstantin Meskhidze wrote:
>>>> Adds two selftests for connect() action with
>>>> AF_UNSPEC family flag.
>>>> The one is with no landlock restrictions
>>>> allows to disconnect already conneted socket
>>>> with connect(..., AF_UNSPEC, ...):
>>>>      - connect_afunspec_no_restictions;
>>>> The second one refuses landlocked process
>>>> to disconnect already connected socket:
>>>>      - connect_afunspec_with_restictions;
>>>>
>>>> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
>>>> ---
>>>>
>>>> Changes since v3:
>>>> * Add connect_afunspec_no_restictions test.
>>>> * Add connect_afunspec_with_restictions test.
>>>>
>>>> Changes since v4:
>>>> * Refactoring code with self->port, self->addr4 variables.
>>>> * Adds bind() hook check for with AF_UNSPEC family.
>>>>
>>>> ---
>>>>   tools/testing/selftests/landlock/net_test.c | 121 
>>>> ++++++++++++++++++++
>>>>   1 file changed, 121 insertions(+)
>>>>
>>>> diff --git a/tools/testing/selftests/landlock/net_test.c 
>>>> b/tools/testing/selftests/landlock/net_test.c
>>>> index cf914d311eb3..bf8e49466d1d 100644
>>>> --- a/tools/testing/selftests/landlock/net_test.c
>>>> +++ b/tools/testing/selftests/landlock/net_test.c
>>>> @@ -449,6 +449,7 @@ TEST_F_FORK(socket_test, 
>>>> connect_with_restrictions_ip6) {
>>>>       int new_fd;
>>>>       int sockfd_1, sockfd_2;
>>>>       pid_t child_1, child_2;
>>>> +
>>>>       int status;
>>>>
>>>>       struct landlock_ruleset_attr ruleset_attr = {
>>>> @@ -467,10 +468,12 @@ TEST_F_FORK(socket_test, 
>>>> connect_with_restrictions_ip6) {
>>>>
>>>>       const int ruleset_fd = landlock_create_ruleset(&ruleset_attr,
>>>>               sizeof(ruleset_attr), 0);
>>>> +
>>>
>>> Please no…
>>>
>>   Sorry for that. I will apply clang-format-14.
> 
> clang-format will not complain about these new lines.

   Anyway I will check that no additional new lines appear.
   Thank you.
> 
> 
>>>
>>>>       ASSERT_LE(0, ruleset_fd);
>>>>
>>>>       /* Allows connect and bind operations to the port[0] socket */
>>>>       ASSERT_EQ(0, landlock_add_rule(ruleset_fd, 
>>>> LANDLOCK_RULE_NET_SERVICE,
>>>> +
>>>
>>> ditto
>>
>>    Ditto. Will be fixed with clang-format.
> .