1 /* $NetBSD: t_bpfilter.c,v 1.11 2017/01/13 21:30:42 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2012 The NetBSD Foundation, Inc. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 #include <sys/cdefs.h> 28 __RCSID("$NetBSD: t_bpfilter.c,v 1.11 2017/01/13 21:30:42 christos Exp $"); 29 30 #include <sys/param.h> 31 #include <sys/ioctl.h> 32 #include <sys/socket.h> 33 #include <sys/mbuf.h> 34 #include <sys/sysctl.h> 35 #include <sys/mman.h> 36 #include <sys/wait.h> 37 #include <unistd.h> 38 39 #include <net/if.h> 40 #include <net/if_ether.h> 41 #include <net/bpf.h> 42 43 #include <fcntl.h> 44 #include <stdint.h> 45 #include <stdio.h> 46 #include <string.h> 47 48 #include <rump/rump.h> 49 #include <rump/rump_syscalls.h> 50 51 /* XXX: atf-c.h has collisions with mbuf */ 52 #undef m_type 53 #undef m_data 54 #include <atf-c.h> 55 56 #include "h_macros.h" 57 #include "../config/netconfig.c" 58 59 60 #define SNAPLEN UINT32_MAX 61 62 #define BMAGIC UINT32_C(0x37) 63 #define HMAGIC UINT32_C(0xc2c2) 64 #define WMAGIC UINT32_C(0x7d7d7d7d) 65 66 static const char magic_echo_reply_tail[7] = { 67 BMAGIC, 68 HMAGIC & 0xff, 69 HMAGIC & 0xff, 70 WMAGIC & 0xff, 71 WMAGIC & 0xff, 72 WMAGIC & 0xff, 73 WMAGIC & 0xff 74 }; 75 76 /* 77 * Match ICMP_ECHOREPLY packet with 7 magic bytes at the end. 78 */ 79 static struct bpf_insn magic_echo_reply_prog[] = { 80 BPF_STMT(BPF_LD+BPF_ABS+BPF_B, 81 sizeof(struct ip) + offsetof(struct icmp, icmp_type)), 82 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ICMP_ECHOREPLY, 1, 0), 83 BPF_STMT(BPF_RET+BPF_K, 0), 84 85 BPF_STMT(BPF_LD+BPF_W+BPF_LEN, 0), /* A <- len */ 86 BPF_STMT(BPF_ALU+BPF_SUB+BPF_K, 7), /* A <- A - 7 */ 87 BPF_STMT(BPF_MISC+BPF_TAX, 0), /* X <- A */ 88 89 BPF_STMT(BPF_LD+BPF_IND+BPF_B, 0), 90 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, BMAGIC, 1, 0), 91 BPF_STMT(BPF_RET+BPF_K, 0), 92 93 BPF_STMT(BPF_LD+BPF_IND+BPF_H, 1), 94 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, HMAGIC, 1, 0), 95 BPF_STMT(BPF_RET+BPF_K, 0), 96 97 BPF_STMT(BPF_LD+BPF_IND+BPF_W, 3), 98 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, WMAGIC, 1, 0), 99 BPF_STMT(BPF_RET+BPF_K, 0), 100 101 BPF_STMT(BPF_RET+BPF_K, SNAPLEN) 102 }; 103 104 static struct bpf_insn badmem_prog[] = { 105 BPF_STMT(BPF_LD+BPF_MEM, 5), 106 BPF_STMT(BPF_RET+BPF_A, 0), 107 }; 108 109 static struct bpf_insn noinitA_prog[] = { 110 BPF_STMT(BPF_RET+BPF_A, 0), 111 }; 112 113 static struct bpf_insn noinitX_prog[] = { 114 BPF_STMT(BPF_MISC+BPF_TXA, 0), 115 BPF_STMT(BPF_RET+BPF_A, 0), 116 }; 117 118 static struct bpf_insn badjmp_prog[] = { 119 BPF_STMT(BPF_JMP+BPF_JA, 5), 120 BPF_STMT(BPF_RET+BPF_A, 0), 121 }; 122 123 static struct bpf_insn negjmp_prog[] = { 124 BPF_STMT(BPF_JMP+BPF_JA, 0), 125 BPF_STMT(BPF_JMP+BPF_JA, UINT32_MAX - 1), // -2 126 BPF_STMT(BPF_RET+BPF_A, 0), 127 }; 128 129 static struct bpf_insn badret_prog[] = { 130 BPF_STMT(BPF_RET+BPF_A+0x8000, 0), 131 }; 132 133 static uint16_t 134 in_cksum(void *data, size_t len) 135 { 136 uint16_t *buf = data; 137 unsigned sum; 138 139 for (sum = 0; len > 1; len -= 2) 140 sum += *buf++; 141 if (len) 142 sum += *(uint8_t *)buf; 143 144 sum = (sum >> 16) + (sum & 0xffff); 145 sum += (sum >> 16); 146 147 return ~sum; 148 } 149 150 /* 151 * Based on netcfg_rump_pingtest(). 152 */ 153 static bool __unused 154 pingtest(const char *dst, unsigned int wirelen, const char tail[7]) 155 { 156 struct timeval tv; 157 struct sockaddr_in sin; 158 struct icmp *icmp; 159 char *pkt; 160 unsigned int pktsize; 161 socklen_t slen; 162 int s; 163 bool rv = false; 164 165 if (wirelen < ETHER_HDR_LEN + sizeof(struct ip)) 166 return false; 167 168 pktsize = wirelen - ETHER_HDR_LEN - sizeof(struct ip); 169 if (pktsize < sizeof(struct icmp) + 7) 170 return false; 171 172 s = rump_sys_socket(PF_INET, SOCK_RAW, IPPROTO_ICMP); 173 if (s == -1) 174 return false; 175 176 pkt = NULL; 177 178 tv.tv_sec = 1; 179 tv.tv_usec = 0; 180 if (rump_sys_setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, 181 &tv, sizeof(tv)) == -1) 182 goto out; 183 184 memset(&sin, 0, sizeof(sin)); 185 sin.sin_len = sizeof(sin); 186 sin.sin_family = AF_INET; 187 sin.sin_addr.s_addr = inet_addr(dst); 188 189 pkt = calloc(1, pktsize); 190 icmp = (struct icmp *)pkt; 191 if (pkt == NULL) 192 goto out; 193 194 memcpy(pkt + pktsize - 7, tail, 7); 195 icmp->icmp_type = ICMP_ECHO; 196 icmp->icmp_id = htons(37); 197 icmp->icmp_seq = htons(1); 198 icmp->icmp_cksum = in_cksum(pkt, pktsize); 199 200 slen = sizeof(sin); 201 if (rump_sys_sendto(s, pkt, pktsize, 0, 202 (struct sockaddr *)&sin, slen) == -1) { 203 goto out; 204 } 205 206 if (rump_sys_recvfrom(s, pkt, pktsize, 0, 207 (struct sockaddr *)&sin, &slen) == -1) 208 goto out; 209 210 rv = true; 211 out: 212 if (pkt != NULL) 213 free(pkt); 214 rump_sys_close(s); 215 return rv; 216 } 217 218 static void 219 magic_ping_test(const char *name, unsigned int wirelen) 220 { 221 struct bpf_program prog; 222 struct bpf_stat bstat; 223 struct ifreq ifr; 224 struct timeval tv; 225 unsigned int bufsize; 226 bool pinged; 227 ssize_t n; 228 char *buf; 229 pid_t child; 230 int bpfd; 231 char token; 232 int channel[2]; 233 234 struct bpf_hdr *hdr; 235 236 RL(pipe(channel)); 237 238 prog.bf_len = __arraycount(magic_echo_reply_prog); 239 prog.bf_insns = magic_echo_reply_prog; 240 241 child = fork(); 242 RZ(rump_init()); 243 netcfg_rump_makeshmif(name, ifr.ifr_name); 244 245 switch (child) { 246 case -1: 247 atf_tc_fail_errno("fork failed"); 248 case 0: 249 netcfg_rump_if(ifr.ifr_name, "10.1.1.10", "255.0.0.0"); 250 close(channel[0]); 251 ATF_CHECK(write(channel[1], "U", 1) == 1); 252 close(channel[1]); 253 pause(); 254 return; 255 default: 256 break; 257 } 258 259 netcfg_rump_if(ifr.ifr_name, "10.1.1.20", "255.0.0.0"); 260 261 RL(bpfd = rump_sys_open("/dev/bpf", O_RDONLY)); 262 263 tv.tv_sec = 0; 264 tv.tv_usec = 500; 265 RL(rump_sys_ioctl(bpfd, BIOCSRTIMEOUT, &tv)); 266 267 RL(rump_sys_ioctl(bpfd, BIOCGBLEN, &bufsize)); 268 RL(rump_sys_ioctl(bpfd, BIOCSETF, &prog)); 269 RL(rump_sys_ioctl(bpfd, BIOCSETIF, &ifr)); 270 271 close(channel[1]); 272 ATF_CHECK(read(channel[0], &token, 1) == 1 && token == 'U'); 273 274 pinged = pingtest("10.1.1.10", wirelen, magic_echo_reply_tail); 275 ATF_CHECK(pinged); 276 277 buf = malloc(bufsize); 278 hdr = (struct bpf_hdr *)buf; 279 ATF_REQUIRE(buf != NULL); 280 ATF_REQUIRE(bufsize > sizeof(struct bpf_hdr)); 281 282 n = rump_sys_read(bpfd, buf, bufsize); 283 284 ATF_CHECK(n > (int)sizeof(struct bpf_hdr)); 285 ATF_CHECK(hdr->bh_caplen == MIN(SNAPLEN, wirelen)); 286 287 RL(rump_sys_ioctl(bpfd, BIOCGSTATS, &bstat)); 288 ATF_CHECK(bstat.bs_capt >= 1); /* XXX == 1 */ 289 290 rump_sys_close(bpfd); 291 free(buf); 292 293 close(channel[0]); 294 295 kill(child, SIGKILL); 296 } 297 298 static int 299 send_bpf_prog(const char *ifname, struct bpf_program *prog) 300 { 301 struct ifreq ifr; 302 int bpfd, e, rv; 303 304 RZ(rump_init()); 305 netcfg_rump_makeshmif(ifname, ifr.ifr_name); 306 netcfg_rump_if(ifr.ifr_name, "10.1.1.20", "255.0.0.0"); 307 308 RL(bpfd = rump_sys_open("/dev/bpf", O_RDONLY)); 309 310 rv = rump_sys_ioctl(bpfd, BIOCSETF, prog); 311 e = errno; 312 313 rump_sys_close(bpfd); 314 errno = e; 315 316 return rv; 317 } 318 319 ATF_TC(bpfiltercontig); 320 ATF_TC_HEAD(bpfiltercontig, tc) 321 { 322 323 atf_tc_set_md_var(tc, "descr", "Checks that bpf program " 324 "can read bytes from contiguous buffer."); 325 atf_tc_set_md_var(tc, "timeout", "30"); 326 } 327 328 ATF_TC_BODY(bpfiltercontig, tc) 329 { 330 331 magic_ping_test("bpfiltercontig", 128); 332 } 333 334 335 ATF_TC(bpfiltermchain); 336 ATF_TC_HEAD(bpfiltermchain, tc) 337 { 338 339 atf_tc_set_md_var(tc, "descr", "Checks that bpf program " 340 "can read bytes from mbuf chain."); 341 atf_tc_set_md_var(tc, "timeout", "30"); 342 } 343 344 ATF_TC_BODY(bpfiltermchain, tc) 345 { 346 347 magic_ping_test("bpfiltermchain", MINCLSIZE + 1); 348 } 349 350 351 ATF_TC(bpfilterbadmem); 352 ATF_TC_HEAD(bpfilterbadmem, tc) 353 { 354 355 atf_tc_set_md_var(tc, "descr", "Checks that bpf program that " 356 "doesn't initialize memomy store is rejected by the kernel"); 357 atf_tc_set_md_var(tc, "timeout", "30"); 358 } 359 360 ATF_TC_BODY(bpfilterbadmem, tc) 361 { 362 struct bpf_program prog; 363 364 prog.bf_len = __arraycount(badmem_prog); 365 prog.bf_insns = badmem_prog; 366 ATF_CHECK_ERRNO(EINVAL, send_bpf_prog("bpfilterbadmem", &prog) == -1); 367 } 368 369 ATF_TC(bpfilternoinitA); 370 ATF_TC_HEAD(bpfilternoinitA, tc) 371 { 372 373 atf_tc_set_md_var(tc, "descr", "Checks that bpf program that " 374 "doesn't initialize the A register is accepted by the kernel"); 375 atf_tc_set_md_var(tc, "timeout", "30"); 376 } 377 378 ATF_TC_BODY(bpfilternoinitA, tc) 379 { 380 struct bpf_program prog; 381 382 prog.bf_len = __arraycount(noinitA_prog); 383 prog.bf_insns = noinitA_prog; 384 RL(send_bpf_prog("bpfilternoinitA", &prog)); 385 } 386 387 ATF_TC(bpfilternoinitX); 388 ATF_TC_HEAD(bpfilternoinitX, tc) 389 { 390 391 atf_tc_set_md_var(tc, "descr", "Checks that bpf program that " 392 "doesn't initialize the X register is accepted by the kernel"); 393 atf_tc_set_md_var(tc, "timeout", "30"); 394 } 395 396 ATF_TC_BODY(bpfilternoinitX, tc) 397 { 398 struct bpf_program prog; 399 400 prog.bf_len = __arraycount(noinitX_prog); 401 prog.bf_insns = noinitX_prog; 402 RL(send_bpf_prog("bpfilternoinitX", &prog)); 403 } 404 405 ATF_TC(bpfilterbadjmp); 406 ATF_TC_HEAD(bpfilterbadjmp, tc) 407 { 408 409 atf_tc_set_md_var(tc, "descr", "Checks that bpf program that " 410 "jumps to invalid destination is rejected by the kernel"); 411 atf_tc_set_md_var(tc, "timeout", "30"); 412 } 413 414 ATF_TC_BODY(bpfilterbadjmp, tc) 415 { 416 struct bpf_program prog; 417 418 prog.bf_len = __arraycount(badjmp_prog); 419 prog.bf_insns = badjmp_prog; 420 ATF_CHECK_ERRNO(EINVAL, send_bpf_prog("bpfilterbadjmp", &prog) == -1); 421 } 422 423 ATF_TC(bpfilternegjmp); 424 ATF_TC_HEAD(bpfilternegjmp, tc) 425 { 426 427 atf_tc_set_md_var(tc, "descr", "Checks that bpf program that " 428 "jumps backwards is rejected by the kernel"); 429 atf_tc_set_md_var(tc, "timeout", "30"); 430 } 431 432 ATF_TC_BODY(bpfilternegjmp, tc) 433 { 434 struct bpf_program prog; 435 436 prog.bf_len = __arraycount(negjmp_prog); 437 prog.bf_insns = negjmp_prog; 438 ATF_CHECK_ERRNO(EINVAL, send_bpf_prog("bpfilternegjmp", &prog) == -1); 439 } 440 441 ATF_TC(bpfilterbadret); 442 ATF_TC_HEAD(bpfilterbadret, tc) 443 { 444 445 atf_tc_set_md_var(tc, "descr", "Checks that bpf program that " 446 "ends with invalid BPF_RET instruction is rejected by the kernel"); 447 atf_tc_set_md_var(tc, "timeout", "30"); 448 } 449 450 ATF_TC_BODY(bpfilterbadret, tc) 451 { 452 struct bpf_program prog; 453 struct bpf_insn *last; 454 455 prog.bf_len = __arraycount(badret_prog); 456 prog.bf_insns = badret_prog; 457 458 /* 459 * The point of this test is checking a bad instruction of 460 * a valid class and with a valid BPF_RVAL data. 461 */ 462 last = &prog.bf_insns[prog.bf_len - 1]; 463 ATF_CHECK(BPF_CLASS(last->code) == BPF_RET && 464 (BPF_RVAL(last->code) == BPF_K || BPF_RVAL(last->code) == BPF_A)); 465 466 ATF_CHECK_ERRNO(EINVAL, send_bpf_prog("bpfilterbadret", &prog) == -1); 467 } 468 469 ATF_TP_ADD_TCS(tp) 470 { 471 472 ATF_TP_ADD_TC(tp, bpfiltercontig); 473 ATF_TP_ADD_TC(tp, bpfiltermchain); 474 ATF_TP_ADD_TC(tp, bpfilterbadmem); 475 ATF_TP_ADD_TC(tp, bpfilternoinitA); 476 ATF_TP_ADD_TC(tp, bpfilternoinitX); 477 ATF_TP_ADD_TC(tp, bpfilterbadjmp); 478 ATF_TP_ADD_TC(tp, bpfilternegjmp); 479 ATF_TP_ADD_TC(tp, bpfilterbadret); 480 481 return atf_no_error(); 482 } 483
Indexes created Sat Sep 20 22:09:52 GMT 2025