| Message ID | 20240728002602.3198398-8-ivanov.mikhail1@huawei-partners.com (mailing list archive) |
|---|---|
| State | RFC |
| Headers | show |
| Series | Support TCP listen access-control | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch, async |
On Sun, Jul 28, 2024 at 08:26:00AM +0800, Mikhail Ivanov wrote: > Test checks that listen(2) doesn't wrongfully return -EACCES instead of > -EINVAL when trying to listen on a socket which is set to ULP that doesn't > have clone method in inet_csk(sk)->icsk_ulp_ops (espintcp). > > Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> > --- > tools/testing/selftests/landlock/config | 1 + > tools/testing/selftests/landlock/net_test.c | 38 +++++++++++++++++++++ > 2 files changed, 39 insertions(+) > > diff --git a/tools/testing/selftests/landlock/config b/tools/testing/selftests/landlock/config > index 0086efaa7b68..014401fe6114 100644 > --- a/tools/testing/selftests/landlock/config > +++ b/tools/testing/selftests/landlock/config > @@ -12,3 +12,4 @@ CONFIG_SHMEM=y > CONFIG_SYSFS=y > CONFIG_TMPFS=y > CONFIG_TMPFS_XATTR=y > +CONFIG_INET_ESPINTCP=y > \ No newline at end of file There are missing dependencies, and also please sort entries. I think it should be: CONFIG_CGROUPS=y CONFIG_CGROUP_SCHED=y CONFIG_INET=y +CONFIG_INET_ESPINTCP=y +CONFIG_INET_ESP=y CONFIG_IPV6=y +CONFIG_IPV6_ESP=y +CONFIG_INET6_ESPINTCP=y CONFIG_NET=y CONFIG_NET_NS=y CONFIG_OVERLAY_FS=y This works with check-linux.sh from https://github.com/landlock-lsm/landlock-test-tools IPv6 is currently not tested, which should be the case (with the "protocol" variants).
8/1/2024 6:08 PM, Mickaël Salaün wrote: > On Sun, Jul 28, 2024 at 08:26:00AM +0800, Mikhail Ivanov wrote: >> Test checks that listen(2) doesn't wrongfully return -EACCES instead of >> -EINVAL when trying to listen on a socket which is set to ULP that doesn't >> have clone method in inet_csk(sk)->icsk_ulp_ops (espintcp). >> >> Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> >> --- >> tools/testing/selftests/landlock/config | 1 + >> tools/testing/selftests/landlock/net_test.c | 38 +++++++++++++++++++++ >> 2 files changed, 39 insertions(+) >> >> diff --git a/tools/testing/selftests/landlock/config b/tools/testing/selftests/landlock/config >> index 0086efaa7b68..014401fe6114 100644 >> --- a/tools/testing/selftests/landlock/config >> +++ b/tools/testing/selftests/landlock/config >> @@ -12,3 +12,4 @@ CONFIG_SHMEM=y >> CONFIG_SYSFS=y >> CONFIG_TMPFS=y >> CONFIG_TMPFS_XATTR=y >> +CONFIG_INET_ESPINTCP=y >> \ No newline at end of file > > There are missing dependencies, and also please sort entries. I think it should > be: > > CONFIG_CGROUPS=y > CONFIG_CGROUP_SCHED=y > CONFIG_INET=y > +CONFIG_INET_ESPINTCP=y > +CONFIG_INET_ESP=y > CONFIG_IPV6=y > +CONFIG_IPV6_ESP=y > +CONFIG_INET6_ESPINTCP=y > CONFIG_NET=y > CONFIG_NET_NS=y > CONFIG_OVERLAY_FS=y > > This works with check-linux.sh from > https://github.com/landlock-lsm/landlock-test-tools Thanks, I'll fix this. > > IPv6 is currently not tested, which should be the case (with the "protocol" > variants).
diff --git a/tools/testing/selftests/landlock/config b/tools/testing/selftests/landlock/config index 0086efaa7b68..014401fe6114 100644 --- a/tools/testing/selftests/landlock/config +++ b/tools/testing/selftests/landlock/config @@ -12,3 +12,4 @@ CONFIG_SHMEM=y CONFIG_SYSFS=y CONFIG_TMPFS=y CONFIG_TMPFS_XATTR=y +CONFIG_INET_ESPINTCP=y \ No newline at end of file diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c index 1a4c4d1cabc2..caf5f38996ed 100644 --- a/tools/testing/selftests/landlock/net_test.c +++ b/tools/testing/selftests/landlock/net_test.c @@ -12,6 +12,7 @@ #include <fcntl.h> #include <linux/landlock.h> #include <linux/in.h> +#include <linux/tcp.h> #include <sched.h> #include <stdint.h> #include <string.h> @@ -1709,6 +1710,43 @@ TEST_F(ipv4_tcp, listen_on_connected) EXPECT_EQ(0, close(bind_fd)); } +TEST_F(ipv4_tcp, espintcp_listen) +{ + const struct landlock_ruleset_attr ruleset_attr = { + .handled_access_net = ACCESS_ALL, + }; + const struct landlock_net_port_attr tcp_denied_listen_p0 = { + .allowed_access = ACCESS_ALL & ~LANDLOCK_ACCESS_NET_LISTEN_TCP, + .port = self->srv0.port, + }; + int ruleset_fd; + int listen_fd; + + ruleset_fd = + landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); + ASSERT_LE(0, ruleset_fd); + + /* Deny listen. */ + ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + &tcp_denied_listen_p0, 0)); + + enforce_ruleset(_metadata, ruleset_fd); + EXPECT_EQ(0, close(ruleset_fd)); + + listen_fd = socket_variant(&self->srv0); + ASSERT_LE(0, listen_fd); + + /* Set espintcp ULP. */ + EXPECT_EQ(0, setsockopt(listen_fd, IPPROTO_TCP, TCP_ULP, "espintcp", + sizeof("espintcp"))); + + EXPECT_EQ(0, bind_variant(listen_fd, &self->srv0)); + + /* Espintcp ULP doesn't have clone method, so listen is denied. */ + EXPECT_EQ(-EINVAL, listen_variant(listen_fd, backlog)); + EXPECT_EQ(0, close(listen_fd)); +} + FIXTURE(port_specific) { struct service_fixture srv0;
Test checks that listen(2) doesn't wrongfully return -EACCES instead of -EINVAL when trying to listen on a socket which is set to ULP that doesn't have clone method in inet_csk(sk)->icsk_ulp_ops (espintcp). Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> --- tools/testing/selftests/landlock/config | 1 + tools/testing/selftests/landlock/net_test.c | 38 +++++++++++++++++++++ 2 files changed, 39 insertions(+)