[v14,10/12] selftests/landlock: Add network tests

Add 82 test suites to check edge cases related to bind() and connect()
actions. They are defined with 6 fixtures and their variants:

The "protocol" fixture is extended with 12 variants defined as a matrix
of: sandboxed/not-sandboxed, IPv4/IPv6/unix network domain, and
stream/datagram socket. 4 related tests suites are defined:
* bind: Tests with non-landlocked/landlocked ipv4, ipv6 and unix sockets.
* connect: Tests with non-landlocked/landlocked ipv4, ipv6 and unix
sockets.
* bind_unspec: Tests with non-landlocked/landlocked restrictions
for bind action with AF_UNSPEC socket family.
* connect_unspec: Tests with non-landlocked/landlocked restrictions
for connect action with AF_UNSPEC socket family.

The "ipv4" fixture is extended with 4 variants defined as a matrix
of: sandboxed/not-sandboxed, IPv4/unix network domain, and
stream/datagram socket. 1 related test suite is defined:
* from_unix_to_inet: Tests to make sure unix sockets' actions are not
restricted by Landlock rules applied to TCP ones.

The "tcp_layers" fixture is extended with 8 variants defined as a matrix
of: IPv4/IPv6 network domain, and different number of landlock rule layers.
2 related tests suites are defined:
* ruleset_overlap.
* ruleset_expand.

In the "mini" fixture 4 tests suites are defined:
* network_access_rights: Tests with legitimate access values.
* unknown_access_rights: Tests with invalid attributes, out of access
  range.
* inval:
  - unhandled allowed access.
  - zero access value.
* tcp_port_overflow: Tests with wrong port values more than U16_MAX.

In the "ipv4_tcp" fixture supports IPv4 network domain, stream socket.
2 tests suites are defined:
* port_endianness: Tests with big/little endian port formats.
* with_fs: Tests with network bind() socket action within
filesystem directory access test.

The "port_specific" fixture is extended with 4 variants defined
as a matrix of: sandboxed/not-sandboxed, IPv4/IPv6 network domain,
and stream socket. 2 related tests suites are defined:
* bind_connect_zero: Tests with port 0 value.
* bind_connect_1023: Tests with port 1023 value.

Test coverage for security/landlock is 94.5% of 932 lines according to
gcc/gcov-9.

Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Co-developed-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
---

Changes since v13:
* Refactors "port_specific" test fixture:
    - Deletes useless if .. else.
    - Deletes repeating bind to port 0.
    - Deletes useless lines.
    - Adds 2 file descriptors per socket.
    - Updates get_binded helper.
    - Split test suite to bind_connect_zero
      and bind_connect_1023.
* Adds CAP_NET_BIND_SERVICE to set_cap(); it helps
in bind_connect_1023 test.
* Moves with_net test from fs_test.c.
* Renames with_net test to with_fs.
* Refactors with_fs test by adding different
rule types per one ruleset layer.
* Minor fixes.
* Refactors commit message.

Changes since v12:
* Renames port_zero to port_specific fixture.
* Refactors port_specific test:
    - Adds set_port() and get_binded_port() helpers.
    - Adds checks for port 0, allowed by Landlock in this version.
    - Adds checks for port 1023.
* Refactors commit message.

Changes since v11:
* Adds ipv4.from_unix_to_tcp test suite to check that socket family is
  the same between a socket and a sockaddr by trying to connect/bind on
  a unix socket (stream or dgram) using an inet family.  Landlock should
  not change the error code.  This found a bug (which needs to be fixed)
  with the TCP restriction.
* Revamps the inet.{bind,connect} tests into protocol.{bind,connect}:
  - Merge bind_connect_unix_dgram_socket, bind_connect_unix_dgram_socket
    and bind_connect_inval_addrlen into it: add a full test matrix of
    IPv4/TCP, IPv6/TCP, IPv4/UDP, IPv6/UDP, unix/stream, unix/dgram, all
    of them with or without sandboxing. This improve coverage and it
    enables to check that a TCP restriction work as expected but doesn't
    restrict other stream or datagram protocols. This also enables to
    check consistency of the network stack with or without Landlock.
    We now have 76 test suites for the network.
  - Add full send/recv checks.
  - Make a generic framework that will be ready for future
    protocol supports.
* Replaces most ASSERT with EXPECT according to the criticity of an
  action: if we can get more meaningful information with following
  checks.  For instance, failure to create a kernel object (e.g.
  socket(), accept() or fork() call) is critical if it is used by
  following checks. For Landlock ruleset building, the following checks
  don't make sense if the sandbox is not complete.  However, it doesn't
  make sense to continue a FIXTURE_SETUP() if any check failed.
* Adds a new unspec fixture to replace inet.bind_afunspec with
  unspec.bind and inet.connect_afunspec with unspec.connect, factoring
  and simplifying code.
* Replaces inet.bind_afunspec with protocol.bind_unspec, and
  inet.connect_afunspec with protocol.connect_unspec.  Extend these
  tests with the matrix of all "protocol" variants.  Don't test connect
  with the same socket which is already binded/listening (I guess this
  was an copy-paste error).  The protocol.bind_unspec tests found a bug
  (which needs to be fixed).
* Add* and use set_service() and setup_loopback() helpers to configure
  network services.  Add and use and test_bind_and_connect() to factor
  out a lot of checks.
* Adds new types (protocol_variant, service_fixture) and update related
  helpers to get more generic test code.
* Replaces static (port) arrays with service_fixture variables.
* Adds new helpers: {bind,connect}_variant_addrlen() and get_addrlen() to
  cover all protocols with previous bind_connect_inval_addrlen tests.
  Make them return -errno in case of error.
* Switchs from a unix socket path address to an abstract one. This
  enables to avoid file cleanup in test teardowns.
* Closes all rulesets after enforcement.
* Removes the duplicate "empty access" test.
* Replaces inet.ruleset_overlay with tcp_layers.ruleset_overlap and
  simplify test:
  - Always run sandbox tests because test were always run sandboxed and
    it doesn't give more guarantees to do it not sandboxed.
  - Rewrite test with variant->num_layers to make it simpler and
    configurable.
  - Add another test layer to tcp_layers used for ruleset_overlap and
    test without sandbox.
  - Leverage test_bind_and_connect() and avoid using SO_REUSEADDR
    because the socket was not listened to, and don't use the same
    socket/FD for server and client.
  - Replace inet.ruleset_expanding with tcp_layers.ruleset_expand.
* Drops capabilities in all FIXTURE_SETUP().
* Changes test ports to cover more ranges.
* Adds "mini" tests:
  - Replace the invalid ruleset attribute test from port.inval with
    mini.unknow_access_rights.
  - Simplify port.inval and move some code to other mini.* tests.
  - Add new mini.network_access_rights test.
* Rewrites inet.inval_port_format into mini.tcp_port_overflow:
  - Remove useless is_sandbox checks.
  - Extend tests with bind/connect checks.
  - Interleave valid requests with invalid ones.
* Adds two_srv.port_endianness test, extracted and extended from
  inet.inval_port_format .
* Adds Microsoft copyright.
* Rename some variables to make them easier to read.
* Constifies variables.
* Adds minimal logs to help debug test failures.
* Renames inet test to ipv4 and deletes is_sandboxed and prot vars from
  FIXTURE_VARIANT.
* Adds port_zero tests.
* Renames all "net_service" to "net_port".

Changes since v10:
* Replaces FIXTURE_VARIANT() with struct _fixture_variant_ .
* Changes tests names socket -> inet, standalone -> port.
* Gets rid of some DEFINEs.
* Changes names and groups tests' variables.
* Changes create_socket_variant() helper name to socket_variant().
* Refactors FIXTURE_SETUP(port) logic.
* Changes TEST_F_FORK -> TEST_F since there no teardown.
* Refactors some tests' logic.
* Minor fixes.
* Refactors commit message.

Changes since v9:
* Fixes mixing code declaration and code.
* Refactors FIXTURE_TEARDOWN() with clang-format.
* Replaces struct _fixture_variant_socket with
FIXTURE_VARIANT(socket).
* Deletes useless condition if (variant->is_sandboxed)
in multiple locations.
* Deletes zero_size argument in bind_variant() and
connect_variant().
* Adds tests for port values exceeding U16_MAX.

Changes since v8:
* Adds is_sandboxed const for FIXTURE_VARIANT(socket).
* Refactors AF_UNSPEC tests.
* Adds address length checking tests.
* Convert ports in all tests to __be16.
* Adds invalid port values tests.
* Minor fixes.

Changes since v7:
* Squashes all selftest commits.
* Adds fs test with network bind() socket action.
* Minor fixes.

---
 tools/testing/selftests/landlock/common.h   |    3 +
 tools/testing/selftests/landlock/config     |    4 +
 tools/testing/selftests/landlock/net_test.c | 1744 +++++++++++++++++++
 3 files changed, 1751 insertions(+)
 create mode 100644 tools/testing/selftests/landlock/net_test.c

--
2.25.1

Message ID	20231026014751.414649-11-konstantin.meskhidze@huawei.com (mailing list archive)
State	Not Applicable
Headers	show Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3FD98BE1 for <netdev@vger.kernel.org>; Thu, 26 Oct 2023 01:48:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=none Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA23618D; Wed, 25 Oct 2023 18:48:22 -0700 (PDT) Received: from lhrpeml500004.china.huawei.com (unknown [172.18.147.200]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4SG7w96X7bz6K8t6; Thu, 26 Oct 2023 09:47:37 +0800 (CST) Received: from mscphis00759.huawei.com (10.123.66.134) by lhrpeml500004.china.huawei.com (7.191.163.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Thu, 26 Oct 2023 02:48:19 +0100 From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> To: <mic@digikod.net> CC: <willemdebruijn.kernel@gmail.com>, <gnoack3000@gmail.com>, <linux-security-module@vger.kernel.org>, <netdev@vger.kernel.org>, <netfilter-devel@vger.kernel.org>, <yusongping@huawei.com>, <artem.kuzin@huawei.com> Subject: [PATCH v14 10/12] selftests/landlock: Add network tests Date: Thu, 26 Oct 2023 09:47:49 +0800 Message-ID: <20231026014751.414649-11-konstantin.meskhidze@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20231026014751.414649-1-konstantin.meskhidze@huawei.com> References: <20231026014751.414649-1-konstantin.meskhidze@huawei.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: <netdev.vger.kernel.org> List-Subscribe: <mailto:netdev+subscribe@vger.kernel.org> List-Unsubscribe: <mailto:netdev+unsubscribe@vger.kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Originating-IP: [10.123.66.134] X-ClientProxiedBy: mscpeml500002.china.huawei.com (7.188.26.138) To lhrpeml500004.china.huawei.com (7.191.163.9) X-CFilter-Loop: Reflected
Series	Network support for Landlock \| expand [v14,00/12] Network support for Landlock [v14,01/12] landlock: Make ruleset's access masks more generic [v14,02/12] landlock: Allow FS topology changes for domains without such rule type [v14,03/12] landlock: Refactor landlock_find_rule/insert_rule [v14,04/12] landlock: Refactor merge/inherit_ruleset functions [v14,05/12] landlock: Move and rename layer helpers [v14,06/12] landlock: Refactor layer helpers [v14,07/12] landlock: Refactor landlock_add_rule() syscall [v14,08/12] landlock: Add network rules and TCP hooks support [v14,09/12] selftests/landlock: Share enforce_ruleset() [v14,10/12] selftests/landlock: Add network tests [v14,11/12] samples/landlock: Support TCP restrictions [v14,12/12] landlock: Document network support

[v14,10/12] selftests/landlock: Add network tests

Checks

Commit Message

Comments

Patch