| Message ID | 202008101448.9BAFCF5@keescook (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | selftests/socket: Introduce simple SCM_RIGHTS tests | expand |
Hi, On Mon, 10 Aug 2020 at 23:52, Kees Cook <keescook@chromium.org> wrote: > > This makes sure that simple SCM_RIGHTS fd passing works as expected, to > avoid any future regressions. This is mostly code from Michael Kerrisk's > examples on how to set up and perform fd passing with SCM_RIGHTS. Add > a test script and wire it up to the selftests. > > Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Michael Kerrisk <mtk.manpages@gmail.com> (As per off-list discussion with Kees), I confirm that I'm okay with relicensing to GPL2+. Cheers, Michael > --- > FYI, this also relicenses Michael's code (with his permission) from > GPL3+ to GPL2+, who is on CC to publicly confirm. :) Thank you Michael! > --- > tools/testing/selftests/Makefile | 1 + > tools/testing/selftests/socket/.gitignore | 4 + > tools/testing/selftests/socket/Makefile | 11 ++ > tools/testing/selftests/socket/hello.txt | 1 + > tools/testing/selftests/socket/scm_rights.h | 40 +++++ > .../selftests/socket/scm_rights_recv.c | 168 ++++++++++++++++++ > .../selftests/socket/scm_rights_send.c | 144 +++++++++++++++ > .../selftests/socket/simple_scm_rights.sh | 30 ++++ > tools/testing/selftests/socket/unix_sockets.c | 88 +++++++++ > tools/testing/selftests/socket/unix_sockets.h | 23 +++ > 10 files changed, 510 insertions(+) > create mode 100644 tools/testing/selftests/socket/.gitignore > create mode 100644 tools/testing/selftests/socket/Makefile > create mode 100644 tools/testing/selftests/socket/hello.txt > create mode 100644 tools/testing/selftests/socket/scm_rights.h > create mode 100644 tools/testing/selftests/socket/scm_rights_recv.c > create mode 100644 tools/testing/selftests/socket/scm_rights_send.c > create mode 100755 tools/testing/selftests/socket/simple_scm_rights.sh > create mode 100644 tools/testing/selftests/socket/unix_sockets.c > create mode 100644 tools/testing/selftests/socket/unix_sockets.h > > diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile > index e03bc15ce731..97e155596660 100644 > --- a/tools/testing/selftests/Makefile > +++ b/tools/testing/selftests/Makefile > @@ -51,6 +51,7 @@ TARGETS += rtc > TARGETS += seccomp > TARGETS += sigaltstack > TARGETS += size > +TARGETS += socket > TARGETS += sparc64 > TARGETS += splice > TARGETS += static_keys > diff --git a/tools/testing/selftests/socket/.gitignore b/tools/testing/selftests/socket/.gitignore > new file mode 100644 > index 000000000000..bc9a892956b0 > --- /dev/null > +++ b/tools/testing/selftests/socket/.gitignore > @@ -0,0 +1,4 @@ > +unix_sockets.o > +scm_rights_send > +scm_rights_recv > +scm_rights > diff --git a/tools/testing/selftests/socket/Makefile b/tools/testing/selftests/socket/Makefile > new file mode 100644 > index 000000000000..3eb7ef0db997 > --- /dev/null > +++ b/tools/testing/selftests/socket/Makefile > @@ -0,0 +1,11 @@ > +# SPDX-License-Identifier: GPL-2.0+ > +TEST_PROGS := simple_scm_rights.sh > +TEST_GEN_PROGS_EXTENDED := scm_rights_send scm_rights_recv > + > +include ../lib.mk > + > +$(OUTPUT)/unix_sockets.o: unix_sockets.h > +$(OUTPUT)/scm_rights_recv: $(OUTPUT)/unix_sockets.o scm_rights.h > +$(OUTPUT)/scm_rights_send: $(OUTPUT)/unix_sockets.o scm_rights.h > + > +EXTRA_CLEAN += $(OUTPUT)/unix_sockets.o $(OUTPUT)/scm_rights > diff --git a/tools/testing/selftests/socket/hello.txt b/tools/testing/selftests/socket/hello.txt > new file mode 100644 > index 000000000000..e965047ad7c5 > --- /dev/null > +++ b/tools/testing/selftests/socket/hello.txt > @@ -0,0 +1 @@ > +Hello > diff --git a/tools/testing/selftests/socket/scm_rights.h b/tools/testing/selftests/socket/scm_rights.h > new file mode 100644 > index 000000000000..4501a46bf1be > --- /dev/null > +++ b/tools/testing/selftests/socket/scm_rights.h > @@ -0,0 +1,40 @@ > +/* SPDX-License-Identifier: GPL-2.0+ */ > +/* > + * scm_rights.h > + * > + * Copyright (C) Michael Kerrisk, 2020. > + * > + * Header file used by scm_rights_send.c and scm_rights_recv.c. > + */ > +#include <errno.h> > +#include <fcntl.h> > +#include <stdbool.h> > +#include <stdio.h> > +#include <stdlib.h> > +#include <sys/socket.h> > +#include <sys/un.h> > + > +#include "unix_sockets.h" > + > +#define SOCK_PATH "scm_rights" > + > +#define errExit(fmt, ...) do { \ > + fprintf(stderr, fmt, ## __VA_ARGS__); \ > + fprintf(stderr, ": %s\n", strerror(errno)); \ > + exit(EXIT_FAILURE); \ > + } while (0) > + > +#define fatal(str) errExit("%s\n", str) > + > +#define usageErr(fmt, ...) do { \ > + fprintf(stderr, "Usage: "); \ > + fprintf(stderr, fmt, ## __VA_ARGS__); \ > + exit(EXIT_FAILURE); \ > + } while (0) > + > +static bool debugging; > + > +#define debug(fmt, ...) do { \ > + if (debugging) \ > + fprintf(stderr, fmt, ## __VA_ARGS__); \ > + } while (0) > diff --git a/tools/testing/selftests/socket/scm_rights_recv.c b/tools/testing/selftests/socket/scm_rights_recv.c > new file mode 100644 > index 000000000000..4c916e43c319 > --- /dev/null > +++ b/tools/testing/selftests/socket/scm_rights_recv.c > @@ -0,0 +1,168 @@ > +// SPDX-License-Identifier: GPL-2.0+ > +/* > + * scm_rights_recv.c > + * > + * Copyright (C) Michael Kerrisk, 2020. > + * > + * Used in conjunction with scm_rights_send.c to demonstrate passing of > + * file descriptors via a UNIX domain socket. > + * > + * This program receives a file descriptor sent to a UNIX domain socket. > + * > + * Usage is as shown in the usageErr() call below. > + * > + * File descriptors can be exchanged over stream or datagram sockets. This > + * program uses stream sockets by default; the "-d" command-line option > + * specifies that datagram sockets should be used instead. > + * > + * This program is Linux-specific. > + */ > +#include "scm_rights.h" > + > +#define BUF_SIZE 100 > + > +int > +main(int argc, char *argv[]) > +{ > + int data, lfd, sfd, fd, opt; > + ssize_t nr; > + bool useDatagramSocket; > + struct msghdr msgh; > + struct iovec iov; > + > + /* Allocate a char array of suitable size to hold the ancillary data. > + * However, since this buffer is in reality a 'struct cmsghdr', use a > + * union to ensure that it is aligned as required for that structure. > + * Alternatively, we could allocate the buffer using malloc(), which > + * returns a buffer that satisfies the strictest alignment > + * requirements of any type > + */ > + > + union { > + char buf[CMSG_SPACE(sizeof(int))]; > + /* Space large enough to hold an 'int' */ > + struct cmsghdr align; > + } controlMsg; > + struct cmsghdr *cmsgp; /* Pointer used to iterate through > + * headers in ancillary data > + */ > + > + /* Parse command-line options */ > + > + useDatagramSocket = false; > + > + while ((opt = getopt(argc, argv, "dD")) != -1) { > + switch (opt) { > + case 'd': > + useDatagramSocket = true; > + break; > + > + default: > + usageErr("%s [-dD]\n" > + " -D enable debugging\n" > + " -d use datagram socket\n", argv[0]); > + } > + } > + > + /* Create socket bound to a well-known address. In the case where > + * we are using stream sockets, also make the socket a listening > + * socket and accept a connection on the socket. > + */ > + > + if (remove(SOCK_PATH) == -1 && errno != ENOENT) > + errExit("remove-%s", SOCK_PATH); > + > + if (useDatagramSocket) { > + sfd = unixBind(SOCK_PATH, SOCK_DGRAM); > + if (sfd == -1) > + errExit("unixBind"); > + > + } else { > + lfd = unixBind(SOCK_PATH, SOCK_STREAM); > + if (lfd == -1) > + errExit("unixBind"); > + > + if (listen(lfd, 5) == -1) > + errExit("listen"); > + > + sfd = accept(lfd, NULL, NULL); > + if (sfd == -1) > + errExit("accept"); > + } > + > + /* The 'msg_name' field can be set to point to a buffer where the > + * kernel will place the address of the peer socket. However, we don't > + * need the address of the peer, so we set this field to NULL. > + */ > + > + msgh.msg_name = NULL; > + msgh.msg_namelen = 0; > + > + /* Set fields of 'msgh' to point to buffer used to receive the (real) > + * data read by recvmsg() > + */ > + > + msgh.msg_iov = &iov; > + msgh.msg_iovlen = 1; > + iov.iov_base = &data; > + iov.iov_len = sizeof(int); > + > + /* Set 'msgh' fields to describe the ancillary data buffer */ > + > + msgh.msg_control = controlMsg.buf; > + msgh.msg_controllen = sizeof(controlMsg.buf); > + > + /* Receive real plus ancillary data */ > + > + nr = recvmsg(sfd, &msgh, 0); > + if (nr == -1) > + errExit("recvmsg"); > + debug("recvmsg() returned %ld\n", (long) nr); > + > + if (nr > 0) > + debug("Received data = %d\n", data); > + > + /* Get the address of the first 'cmsghdr' in the received > + * ancillary data > + */ > + > + cmsgp = CMSG_FIRSTHDR(&msgh); > + > + /* Check the validity of the 'cmsghdr' */ > + > + if (cmsgp == NULL || cmsgp->cmsg_len != CMSG_LEN(sizeof(int))) > + fatal("bad cmsg header / message length"); > + if (cmsgp->cmsg_level != SOL_SOCKET) > + fatal("cmsg_level != SOL_SOCKET"); > + if (cmsgp->cmsg_type != SCM_RIGHTS) > + fatal("cmsg_type != SCM_RIGHTS"); > + > + /* The data area of the 'cmsghdr' is an 'int' (a file descriptor); > + * copy that integer to a local variable. (The received file descriptor > + * is typically a different file descriptor number than was used in the > + * sending process.) > + */ > + > + memcpy(&fd, CMSG_DATA(cmsgp), sizeof(int)); > + debug("Received FD %d\n", fd); > + > + /* Having obtained the file descriptor, read the file's contents and > + * print them on standard output > + */ > + > + for (;;) { > + char buf[BUF_SIZE]; > + ssize_t numRead; > + > + numRead = read(fd, buf, BUF_SIZE); > + if (numRead == -1) > + errExit("read"); > + > + if (numRead == 0) > + break; > + > + write(STDOUT_FILENO, buf, numRead); > + } > + > + exit(EXIT_SUCCESS); > +} > diff --git a/tools/testing/selftests/socket/scm_rights_send.c b/tools/testing/selftests/socket/scm_rights_send.c > new file mode 100644 > index 000000000000..c5718d10a80d > --- /dev/null > +++ b/tools/testing/selftests/socket/scm_rights_send.c > @@ -0,0 +1,144 @@ > +// SPDX-License-Identifier: GPL-2.0+ > +/* > + * scm_rights_send.c > + * > + * Copyright (C) Michael Kerrisk, 2020. > + * > + * Used in conjunction with scm_rights_recv.c to demonstrate passing of > + * file descriptors via a UNIX domain socket. > + * > + * This program sends a file descriptor to a UNIX domain socket. > + * > + * Usage is as shown in the usageErr() call below. > + * > + * File descriptors can be exchanged over stream or datagram sockets. This > + * program uses stream sockets by default; the "-d" command-line option > + * specifies that datagram sockets should be used instead. > + * > + * This program is Linux-specific. > + */ > +#include "scm_rights.h" > + > +int > +main(int argc, char *argv[]) > +{ > + int data, sfd, opt, fd; > + ssize_t ns; > + bool useDatagramSocket; > + struct msghdr msgh; > + struct iovec iov; > + > + /* Allocate a char array of suitable size to hold the ancillary data. > + * However, since this buffer is in reality a 'struct cmsghdr', use a > + * union to ensure that it is aligned as required for that structure. > + * Alternatively, we could allocate the buffer using malloc(), which > + * returns a buffer that satisfies the strictest alignment > + * requirements of any type. > + */ > + > + union { > + char buf[CMSG_SPACE(sizeof(int))]; > + /* Space large enough to hold an 'int' */ > + struct cmsghdr align; > + } controlMsg; > + struct cmsghdr *cmsgp; /* Pointer used to iterate through > + * headers in ancillary data > + */ > + > + /* Parse command-line options */ > + > + useDatagramSocket = false; > + > + while ((opt = getopt(argc, argv, "dD")) != -1) { > + switch (opt) { > + case 'd': > + useDatagramSocket = true; > + break; > + case 'D': > + debugging = true; > + break; > + default: > + usageErr("%s [-dD] file\n" > + " -D enable debugging\n" > + " -d use datagram socket\n", argv[0]); > + } > + } > + > + if (argc != optind + 1) > + usageErr("%s [-dD] file\n", argv[0]); > + > + /* Open the file named on the command line */ > + > + fd = open(argv[optind], O_RDONLY); > + if (fd == -1) > + errExit("open"); > + > + /* The 'msg_name' field can be used to specify the address of the > + * destination socket when sending a datagram. However, we do not > + * need to use this field because we use connect() below, which sets > + * a default outgoing address for datagrams. > + */ > + > + msgh.msg_name = NULL; > + msgh.msg_namelen = 0; > + > + /* On Linux, we must transmit at least 1 byte of real data in > + * order to send ancillary data > + */ > + > + msgh.msg_iov = &iov; > + msgh.msg_iovlen = 1; > + iov.iov_base = &data; > + iov.iov_len = sizeof(int); > + data = 12345; > + debug("Sending data = %d\n", data); > + > + /* Set 'msgh' fields to describe the ancillary data buffer */ > + > + msgh.msg_control = controlMsg.buf; > + msgh.msg_controllen = sizeof(controlMsg.buf); > + > + /* The control message buffer must be zero-initialized in order > + * for the CMSG_NXTHDR() macro to work correctly. Although we > + * don't need to use CMSG_NXTHDR() in this example (because > + * there is only one block of ancillary data), we show this > + * step to demonstrate best practice > + */ > + > + memset(controlMsg.buf, 0, sizeof(controlMsg.buf)); > + > + /* Set message header to describe the ancillary data that > + * we want to send > + */ > + > + cmsgp = CMSG_FIRSTHDR(&msgh); > + cmsgp->cmsg_len = CMSG_LEN(sizeof(int)); > + cmsgp->cmsg_level = SOL_SOCKET; > + cmsgp->cmsg_type = SCM_RIGHTS; > + memcpy(CMSG_DATA(cmsgp), &fd, sizeof(int)); > + > + /* Connect to the peer socket */ > + > + sfd = unixConnect(SOCK_PATH, useDatagramSocket ? SOCK_DGRAM : SOCK_STREAM); > + if (sfd == -1) > + errExit("unixConnect"); > + > + debug("Sending FD %d\n", fd); > + > + /* Send real plus ancillary data */ > + > + ns = sendmsg(sfd, &msgh, 0); > + if (ns == -1) > + errExit("sendmsg"); > + > + debug("sendmsg() returned %ld\n", (long) ns); > + > + /* Once the file descriptor has been sent, it is no longer necessary > + * to keep it open in the sending process > + */ > + > + if (close(fd) == -1) > + errExit("close"); > + > + exit(EXIT_SUCCESS); > +} > diff --git a/tools/testing/selftests/socket/simple_scm_rights.sh b/tools/testing/selftests/socket/simple_scm_rights.sh > new file mode 100755 > index 000000000000..31ea0fc1bb6d > --- /dev/null > +++ b/tools/testing/selftests/socket/simple_scm_rights.sh > @@ -0,0 +1,30 @@ > +#!/bin/sh > +# SPDX-License-Identifier: GPL-2.0+ > +set -e > + > +ret=0 > +hello=$(cat hello.txt) > + > +rm -f scm_rights > +(sleep 0.1; ./scm_rights_send hello.txt) & > +out=$(./scm_rights_recv) > + > +if [ "$hello" != "$out" ] ; then > + echo "FAIL: SCM_RIGHTS fd contents mismatch" > + ret=1 > +else > + echo "ok: SOCK_STREAM" > +fi > + > +rm -f scm_rights > +(sleep 0.1; ./scm_rights_send -d hello.txt) & > +out=$(./scm_rights_recv -d) > + > +if [ "$hello" != "$out" ] ; then > + echo "FAIL: SCM_RIGHTS fd contents mismatch" > + ret=1 > +else > + echo "ok: SOCK_DGRAM" > +fi > + > +exit $ret > diff --git a/tools/testing/selftests/socket/unix_sockets.c b/tools/testing/selftests/socket/unix_sockets.c > new file mode 100644 > index 000000000000..a7678fad1a16 > --- /dev/null > +++ b/tools/testing/selftests/socket/unix_sockets.c > @@ -0,0 +1,88 @@ > +// SPDX-License-Identifier: GPL-2.0+ > +/* > + * unix_sockets.c > + * > + * Copyright (C) Michael Kerrisk, 2020. > + * > + * A package of useful routines for UNIX domain sockets. > + */ > +#include "unix_sockets.h" /* Declares functions defined here */ > + > +/* Build a UNIX domain socket address structure for 'path', returning > + * it in 'addr'. Returns -1 on success, or 0 on error. > + */ > + > +int > +unixBuildAddress(const char *path, struct sockaddr_un *addr) > +{ > + if (addr == NULL || path == NULL) { > + errno = EINVAL; > + return -1; > + } > + > + memset(addr, 0, sizeof(struct sockaddr_un)); > + addr->sun_family = AF_UNIX; > + if (strlen(path) < sizeof(addr->sun_path)) { > + strncpy(addr->sun_path, path, sizeof(addr->sun_path) - 1); > + return 0; > + } else { > + errno = ENAMETOOLONG; > + return -1; > + } > +} > + > +/* Create a UNIX domain socket of type 'type' and connect it > + * to the remote address specified by the 'path'. > + * Return the socket descriptor on success, or -1 on error > + */ > + > +int > +unixConnect(const char *path, int type) > +{ > + int sd, savedErrno; > + struct sockaddr_un addr; > + > + if (unixBuildAddress(path, &addr) == -1) > + return -1; > + > + sd = socket(AF_UNIX, type, 0); > + if (sd == -1) > + return -1; > + > + if (connect(sd, (struct sockaddr *) &addr, > + sizeof(struct sockaddr_un)) == -1) { > + savedErrno = errno; > + close(sd); /* Might change 'errno' */ > + errno = savedErrno; > + return -1; > + } > + > + return sd; > +} > + > +/* Create a UNIX domain socket and bind it to 'path'. > + * Return the socket descriptor on success, or -1 on error. > + */ > + > +int > +unixBind(const char *path, int type) > +{ > + int sd, savedErrno; > + struct sockaddr_un addr; > + > + if (unixBuildAddress(path, &addr) == -1) > + return -1; > + > + sd = socket(AF_UNIX, type, 0); > + if (sd == -1) > + return -1; > + > + if (bind(sd, (struct sockaddr *) &addr, sizeof(struct sockaddr_un)) == -1) { > + savedErrno = errno; > + close(sd); /* Might change 'errno' */ > + errno = savedErrno; > + return -1; > + } > + > + return sd; > +} > diff --git a/tools/testing/selftests/socket/unix_sockets.h b/tools/testing/selftests/socket/unix_sockets.h > new file mode 100644 > index 000000000000..e03a5aecd10c > --- /dev/null > +++ b/tools/testing/selftests/socket/unix_sockets.h > @@ -0,0 +1,23 @@ > +/* SPDX-License-Identifier: GPL-2.0+ */ > +/* > + * unix_sockets.h > + * > + * Copyright (C) Michael Kerrisk, 2020. > + * > + * Header file for unix_sockets.c. > + */ > +#ifndef UNIX_SOCKETS_H > +#define UNIX_SOCKETS_H /* Prevent accidental double inclusion */ > + > +#include <errno.h> > +#include <unistd.h> > +#include <sys/socket.h> > +#include <sys/un.h> > + > +int unixBuildAddress(const char *path, struct sockaddr_un *addr); > + > +int unixConnect(const char *path, int type); > + > +int unixBind(const char *path, int type); > + > +#endif > -- > 2.25.1 > > > -- > Kees Cook
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile index e03bc15ce731..97e155596660 100644 --- a/tools/testing/selftests/Makefile +++ b/tools/testing/selftests/Makefile @@ -51,6 +51,7 @@ TARGETS += rtc TARGETS += seccomp TARGETS += sigaltstack TARGETS += size +TARGETS += socket TARGETS += sparc64 TARGETS += splice TARGETS += static_keys diff --git a/tools/testing/selftests/socket/.gitignore b/tools/testing/selftests/socket/.gitignore new file mode 100644 index 000000000000..bc9a892956b0 --- /dev/null +++ b/tools/testing/selftests/socket/.gitignore @@ -0,0 +1,4 @@ +unix_sockets.o +scm_rights_send +scm_rights_recv +scm_rights diff --git a/tools/testing/selftests/socket/Makefile b/tools/testing/selftests/socket/Makefile new file mode 100644 index 000000000000..3eb7ef0db997 --- /dev/null +++ b/tools/testing/selftests/socket/Makefile @@ -0,0 +1,11 @@ +# SPDX-License-Identifier: GPL-2.0+ +TEST_PROGS := simple_scm_rights.sh +TEST_GEN_PROGS_EXTENDED := scm_rights_send scm_rights_recv + +include ../lib.mk + +$(OUTPUT)/unix_sockets.o: unix_sockets.h +$(OUTPUT)/scm_rights_recv: $(OUTPUT)/unix_sockets.o scm_rights.h +$(OUTPUT)/scm_rights_send: $(OUTPUT)/unix_sockets.o scm_rights.h + +EXTRA_CLEAN += $(OUTPUT)/unix_sockets.o $(OUTPUT)/scm_rights diff --git a/tools/testing/selftests/socket/hello.txt b/tools/testing/selftests/socket/hello.txt new file mode 100644 index 000000000000..e965047ad7c5 --- /dev/null +++ b/tools/testing/selftests/socket/hello.txt @@ -0,0 +1 @@ +Hello diff --git a/tools/testing/selftests/socket/scm_rights.h b/tools/testing/selftests/socket/scm_rights.h new file mode 100644 index 000000000000..4501a46bf1be --- /dev/null +++ b/tools/testing/selftests/socket/scm_rights.h @@ -0,0 +1,40 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * scm_rights.h + * + * Copyright (C) Michael Kerrisk, 2020. + * + * Header file used by scm_rights_send.c and scm_rights_recv.c. + */ +#include <errno.h> +#include <fcntl.h> +#include <stdbool.h> +#include <stdio.h> +#include <stdlib.h> +#include <sys/socket.h> +#include <sys/un.h> + +#include "unix_sockets.h" + +#define SOCK_PATH "scm_rights" + +#define errExit(fmt, ...) do { \ + fprintf(stderr, fmt, ## __VA_ARGS__); \ + fprintf(stderr, ": %s\n", strerror(errno)); \ + exit(EXIT_FAILURE); \ + } while (0) + +#define fatal(str) errExit("%s\n", str) + +#define usageErr(fmt, ...) do { \ + fprintf(stderr, "Usage: "); \ + fprintf(stderr, fmt, ## __VA_ARGS__); \ + exit(EXIT_FAILURE); \ + } while (0) + +static bool debugging; + +#define debug(fmt, ...) do { \ + if (debugging) \ + fprintf(stderr, fmt, ## __VA_ARGS__); \ + } while (0) diff --git a/tools/testing/selftests/socket/scm_rights_recv.c b/tools/testing/selftests/socket/scm_rights_recv.c new file mode 100644 index 000000000000..4c916e43c319 --- /dev/null +++ b/tools/testing/selftests/socket/scm_rights_recv.c @@ -0,0 +1,168 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * scm_rights_recv.c + * + * Copyright (C) Michael Kerrisk, 2020. + * + * Used in conjunction with scm_rights_send.c to demonstrate passing of + * file descriptors via a UNIX domain socket. + * + * This program receives a file descriptor sent to a UNIX domain socket. + * + * Usage is as shown in the usageErr() call below. + * + * File descriptors can be exchanged over stream or datagram sockets. This + * program uses stream sockets by default; the "-d" command-line option + * specifies that datagram sockets should be used instead. + * + * This program is Linux-specific. + */ +#include "scm_rights.h" + +#define BUF_SIZE 100 + +int +main(int argc, char *argv[]) +{ + int data, lfd, sfd, fd, opt; + ssize_t nr; + bool useDatagramSocket; + struct msghdr msgh; + struct iovec iov; + + /* Allocate a char array of suitable size to hold the ancillary data. + * However, since this buffer is in reality a 'struct cmsghdr', use a + * union to ensure that it is aligned as required for that structure. + * Alternatively, we could allocate the buffer using malloc(), which + * returns a buffer that satisfies the strictest alignment + * requirements of any type + */ + + union { + char buf[CMSG_SPACE(sizeof(int))]; + /* Space large enough to hold an 'int' */ + struct cmsghdr align; + } controlMsg; + struct cmsghdr *cmsgp; /* Pointer used to iterate through + * headers in ancillary data + */ + + /* Parse command-line options */ + + useDatagramSocket = false; + + while ((opt = getopt(argc, argv, "dD")) != -1) { + switch (opt) { + case 'd': + useDatagramSocket = true; + break; + + default: + usageErr("%s [-dD]\n" + " -D enable debugging\n" + " -d use datagram socket\n", argv[0]); + } + } + + /* Create socket bound to a well-known address. In the case where + * we are using stream sockets, also make the socket a listening + * socket and accept a connection on the socket. + */ + + if (remove(SOCK_PATH) == -1 && errno != ENOENT) + errExit("remove-%s", SOCK_PATH); + + if (useDatagramSocket) { + sfd = unixBind(SOCK_PATH, SOCK_DGRAM); + if (sfd == -1) + errExit("unixBind"); + + } else { + lfd = unixBind(SOCK_PATH, SOCK_STREAM); + if (lfd == -1) + errExit("unixBind"); + + if (listen(lfd, 5) == -1) + errExit("listen"); + + sfd = accept(lfd, NULL, NULL); + if (sfd == -1) + errExit("accept"); + } + + /* The 'msg_name' field can be set to point to a buffer where the + * kernel will place the address of the peer socket. However, we don't + * need the address of the peer, so we set this field to NULL. + */ + + msgh.msg_name = NULL; + msgh.msg_namelen = 0; + + /* Set fields of 'msgh' to point to buffer used to receive the (real) + * data read by recvmsg() + */ + + msgh.msg_iov = &iov; + msgh.msg_iovlen = 1; + iov.iov_base = &data; + iov.iov_len = sizeof(int); + + /* Set 'msgh' fields to describe the ancillary data buffer */ + + msgh.msg_control = controlMsg.buf; + msgh.msg_controllen = sizeof(controlMsg.buf); + + /* Receive real plus ancillary data */ + + nr = recvmsg(sfd, &msgh, 0); + if (nr == -1) + errExit("recvmsg"); + debug("recvmsg() returned %ld\n", (long) nr); + + if (nr > 0) + debug("Received data = %d\n", data); + + /* Get the address of the first 'cmsghdr' in the received + * ancillary data + */ + + cmsgp = CMSG_FIRSTHDR(&msgh); + + /* Check the validity of the 'cmsghdr' */ + + if (cmsgp == NULL || cmsgp->cmsg_len != CMSG_LEN(sizeof(int))) + fatal("bad cmsg header / message length"); + if (cmsgp->cmsg_level != SOL_SOCKET) + fatal("cmsg_level != SOL_SOCKET"); + if (cmsgp->cmsg_type != SCM_RIGHTS) + fatal("cmsg_type != SCM_RIGHTS"); + + /* The data area of the 'cmsghdr' is an 'int' (a file descriptor); + * copy that integer to a local variable. (The received file descriptor + * is typically a different file descriptor number than was used in the + * sending process.) + */ + + memcpy(&fd, CMSG_DATA(cmsgp), sizeof(int)); + debug("Received FD %d\n", fd); + + /* Having obtained the file descriptor, read the file's contents and + * print them on standard output + */ + + for (;;) { + char buf[BUF_SIZE]; + ssize_t numRead; + + numRead = read(fd, buf, BUF_SIZE); + if (numRead == -1) + errExit("read"); + + if (numRead == 0) + break; + + write(STDOUT_FILENO, buf, numRead); + } + + exit(EXIT_SUCCESS); +} diff --git a/tools/testing/selftests/socket/scm_rights_send.c b/tools/testing/selftests/socket/scm_rights_send.c new file mode 100644 index 000000000000..c5718d10a80d --- /dev/null +++ b/tools/testing/selftests/socket/scm_rights_send.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * scm_rights_send.c + * + * Copyright (C) Michael Kerrisk, 2020. + * + * Used in conjunction with scm_rights_recv.c to demonstrate passing of + * file descriptors via a UNIX domain socket. + * + * This program sends a file descriptor to a UNIX domain socket. + * + * Usage is as shown in the usageErr() call below. + * + * File descriptors can be exchanged over stream or datagram sockets. This + * program uses stream sockets by default; the "-d" command-line option + * specifies that datagram sockets should be used instead. + * + * This program is Linux-specific. + */ +#include "scm_rights.h" + +int +main(int argc, char *argv[]) +{ + int data, sfd, opt, fd; + ssize_t ns; + bool useDatagramSocket; + struct msghdr msgh; + struct iovec iov; + + /* Allocate a char array of suitable size to hold the ancillary data. + * However, since this buffer is in reality a 'struct cmsghdr', use a + * union to ensure that it is aligned as required for that structure. + * Alternatively, we could allocate the buffer using malloc(), which + * returns a buffer that satisfies the strictest alignment + * requirements of any type. + */ + + union { + char buf[CMSG_SPACE(sizeof(int))]; + /* Space large enough to hold an 'int' */ + struct cmsghdr align; + } controlMsg; + struct cmsghdr *cmsgp; /* Pointer used to iterate through + * headers in ancillary data + */ + + /* Parse command-line options */ + + useDatagramSocket = false; + + while ((opt = getopt(argc, argv, "dD")) != -1) { + switch (opt) { + case 'd': + useDatagramSocket = true; + break; + case 'D': + debugging = true; + break; + default: + usageErr("%s [-dD] file\n" + " -D enable debugging\n" + " -d use datagram socket\n", argv[0]); + } + } + + if (argc != optind + 1) + usageErr("%s [-dD] file\n", argv[0]); + + /* Open the file named on the command line */ + + fd = open(argv[optind], O_RDONLY); + if (fd == -1) + errExit("open"); + + /* The 'msg_name' field can be used to specify the address of the + * destination socket when sending a datagram. However, we do not + * need to use this field because we use connect() below, which sets + * a default outgoing address for datagrams. + */ + + msgh.msg_name = NULL; + msgh.msg_namelen = 0; + + /* On Linux, we must transmit at least 1 byte of real data in + * order to send ancillary data + */ + + msgh.msg_iov = &iov; + msgh.msg_iovlen = 1; + iov.iov_base = &data; + iov.iov_len = sizeof(int); + data = 12345; + debug("Sending data = %d\n", data); + + /* Set 'msgh' fields to describe the ancillary data buffer */ + + msgh.msg_control = controlMsg.buf; + msgh.msg_controllen = sizeof(controlMsg.buf); + + /* The control message buffer must be zero-initialized in order + * for the CMSG_NXTHDR() macro to work correctly. Although we + * don't need to use CMSG_NXTHDR() in this example (because + * there is only one block of ancillary data), we show this + * step to demonstrate best practice + */ + + memset(controlMsg.buf, 0, sizeof(controlMsg.buf)); + + /* Set message header to describe the ancillary data that + * we want to send + */ + + cmsgp = CMSG_FIRSTHDR(&msgh); + cmsgp->cmsg_len = CMSG_LEN(sizeof(int)); + cmsgp->cmsg_level = SOL_SOCKET; + cmsgp->cmsg_type = SCM_RIGHTS; + memcpy(CMSG_DATA(cmsgp), &fd, sizeof(int)); + + /* Connect to the peer socket */ + + sfd = unixConnect(SOCK_PATH, useDatagramSocket ? SOCK_DGRAM : SOCK_STREAM); + if (sfd == -1) + errExit("unixConnect"); + + debug("Sending FD %d\n", fd); + + /* Send real plus ancillary data */ + + ns = sendmsg(sfd, &msgh, 0); + if (ns == -1) + errExit("sendmsg"); + + debug("sendmsg() returned %ld\n", (long) ns); + + /* Once the file descriptor has been sent, it is no longer necessary + * to keep it open in the sending process + */ + + if (close(fd) == -1) + errExit("close"); + + exit(EXIT_SUCCESS); +} diff --git a/tools/testing/selftests/socket/simple_scm_rights.sh b/tools/testing/selftests/socket/simple_scm_rights.sh new file mode 100755 index 000000000000..31ea0fc1bb6d --- /dev/null +++ b/tools/testing/selftests/socket/simple_scm_rights.sh @@ -0,0 +1,30 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0+ +set -e + +ret=0 +hello=$(cat hello.txt) + +rm -f scm_rights +(sleep 0.1; ./scm_rights_send hello.txt) & +out=$(./scm_rights_recv) + +if [ "$hello" != "$out" ] ; then + echo "FAIL: SCM_RIGHTS fd contents mismatch" + ret=1 +else + echo "ok: SOCK_STREAM" +fi + +rm -f scm_rights +(sleep 0.1; ./scm_rights_send -d hello.txt) & +out=$(./scm_rights_recv -d) + +if [ "$hello" != "$out" ] ; then + echo "FAIL: SCM_RIGHTS fd contents mismatch" + ret=1 +else + echo "ok: SOCK_DGRAM" +fi + +exit $ret diff --git a/tools/testing/selftests/socket/unix_sockets.c b/tools/testing/selftests/socket/unix_sockets.c new file mode 100644 index 000000000000..a7678fad1a16 --- /dev/null +++ b/tools/testing/selftests/socket/unix_sockets.c @@ -0,0 +1,88 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * unix_sockets.c + * + * Copyright (C) Michael Kerrisk, 2020. + * + * A package of useful routines for UNIX domain sockets. + */ +#include "unix_sockets.h" /* Declares functions defined here */ + +/* Build a UNIX domain socket address structure for 'path', returning + * it in 'addr'. Returns -1 on success, or 0 on error. + */ + +int +unixBuildAddress(const char *path, struct sockaddr_un *addr) +{ + if (addr == NULL || path == NULL) { + errno = EINVAL; + return -1; + } + + memset(addr, 0, sizeof(struct sockaddr_un)); + addr->sun_family = AF_UNIX; + if (strlen(path) < sizeof(addr->sun_path)) { + strncpy(addr->sun_path, path, sizeof(addr->sun_path) - 1); + return 0; + } else { + errno = ENAMETOOLONG; + return -1; + } +} + +/* Create a UNIX domain socket of type 'type' and connect it + * to the remote address specified by the 'path'. + * Return the socket descriptor on success, or -1 on error + */ + +int +unixConnect(const char *path, int type) +{ + int sd, savedErrno; + struct sockaddr_un addr; + + if (unixBuildAddress(path, &addr) == -1) + return -1; + + sd = socket(AF_UNIX, type, 0); + if (sd == -1) + return -1; + + if (connect(sd, (struct sockaddr *) &addr, + sizeof(struct sockaddr_un)) == -1) { + savedErrno = errno; + close(sd); /* Might change 'errno' */ + errno = savedErrno; + return -1; + } + + return sd; +} + +/* Create a UNIX domain socket and bind it to 'path'. + * Return the socket descriptor on success, or -1 on error. + */ + +int +unixBind(const char *path, int type) +{ + int sd, savedErrno; + struct sockaddr_un addr; + + if (unixBuildAddress(path, &addr) == -1) + return -1; + + sd = socket(AF_UNIX, type, 0); + if (sd == -1) + return -1; + + if (bind(sd, (struct sockaddr *) &addr, sizeof(struct sockaddr_un)) == -1) { + savedErrno = errno; + close(sd); /* Might change 'errno' */ + errno = savedErrno; + return -1; + } + + return sd; +} diff --git a/tools/testing/selftests/socket/unix_sockets.h b/tools/testing/selftests/socket/unix_sockets.h new file mode 100644 index 000000000000..e03a5aecd10c --- /dev/null +++ b/tools/testing/selftests/socket/unix_sockets.h @@ -0,0 +1,23 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * unix_sockets.h + * + * Copyright (C) Michael Kerrisk, 2020. + * + * Header file for unix_sockets.c. + */ +#ifndef UNIX_SOCKETS_H +#define UNIX_SOCKETS_H /* Prevent accidental double inclusion */ + +#include <errno.h> +#include <unistd.h> +#include <sys/socket.h> +#include <sys/un.h> + +int unixBuildAddress(const char *path, struct sockaddr_un *addr); + +int unixConnect(const char *path, int type); + +int unixBind(const char *path, int type); + +#endif
This makes sure that simple SCM_RIGHTS fd passing works as expected, to avoid any future regressions. This is mostly code from Michael Kerrisk's examples on how to set up and perform fd passing with SCM_RIGHTS. Add a test script and wire it up to the selftests. Signed-off-by: Kees Cook <keescook@chromium.org> --- FYI, this also relicenses Michael's code (with his permission) from GPL3+ to GPL2+, who is on CC to publicly confirm. :) Thank you Michael! --- tools/testing/selftests/Makefile | 1 + tools/testing/selftests/socket/.gitignore | 4 + tools/testing/selftests/socket/Makefile | 11 ++ tools/testing/selftests/socket/hello.txt | 1 + tools/testing/selftests/socket/scm_rights.h | 40 +++++ .../selftests/socket/scm_rights_recv.c | 168 ++++++++++++++++++ .../selftests/socket/scm_rights_send.c | 144 +++++++++++++++ .../selftests/socket/simple_scm_rights.sh | 30 ++++ tools/testing/selftests/socket/unix_sockets.c | 88 +++++++++ tools/testing/selftests/socket/unix_sockets.h | 23 +++ 10 files changed, 510 insertions(+) create mode 100644 tools/testing/selftests/socket/.gitignore create mode 100644 tools/testing/selftests/socket/Makefile create mode 100644 tools/testing/selftests/socket/hello.txt create mode 100644 tools/testing/selftests/socket/scm_rights.h create mode 100644 tools/testing/selftests/socket/scm_rights_recv.c create mode 100644 tools/testing/selftests/socket/scm_rights_send.c create mode 100755 tools/testing/selftests/socket/simple_scm_rights.sh create mode 100644 tools/testing/selftests/socket/unix_sockets.c create mode 100644 tools/testing/selftests/socket/unix_sockets.h