1/*
2 * Copyright (c) 2017 Jan Kokem��ller
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 *    notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 *    notice, this list of conditions and the following disclaimer in the
11 *    documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23 * SUCH DAMAGE.
24 */
25
26#include <sys/cdefs.h>
27__FBSDID("$FreeBSD$");
28
29#include <sys/param.h>
30#include <sys/capsicum.h>
31#include <sys/socket.h>
32#include <sys/sysctl.h>
33#include <sys/stat.h>
34
35#include <netinet/in.h>
36#include <arpa/inet.h>
37
38#include <atf-c.h>
39#include <dlfcn.h>
40#include <errno.h>
41#include <stdarg.h>
42#include <stdlib.h>
43#include <string.h>
44
45#include "freebsd_test_suite/macros.h"
46
47static int rootfd = -1;
48
49/* circumvent bug 215690 */
50int
51open(const char *path, int flags, ...)
52{
53	mode_t mode = 0;
54
55	if (flags & O_CREAT) {
56		va_list ap;
57		va_start(ap, flags);
58		mode = (mode_t) va_arg(ap, int);
59		va_end(ap);
60	}
61
62	if (path && path[0] == '/' && rootfd >= 0) {
63		return (openat(rootfd, path + 1, flags, mode));
64	} else {
65		return (openat(AT_FDCWD, path, flags, mode));
66	}
67}
68
69static void
70check_capsicum(void)
71{
72	ATF_REQUIRE_FEATURE("security_capabilities");
73	ATF_REQUIRE_FEATURE("security_capability_mode");
74
75	ATF_REQUIRE((rootfd = open("/", O_EXEC | O_CLOEXEC)) >= 0);
76}
77
78typedef int (*socket_fun)(int, const struct sockaddr *, socklen_t);
79
80static int
81connectat_fdcwd(int s, const struct sockaddr *name, socklen_t namelen)
82{
83
84	return (connectat(AT_FDCWD, s, name, namelen));
85}
86
87static int
88bindat_fdcwd(int s, const struct sockaddr *name, socklen_t namelen)
89{
90
91	return (bindat(AT_FDCWD, s, name, namelen));
92}
93
94
95ATF_TC(bindat_connectat_1);
96ATF_TC_HEAD(bindat_connectat_1, tc)
97{
98	atf_tc_set_md_var(tc, "descr",
99	    "Verify that connect/bind work in normal case");
100}
101
102static void
103check_1(socket_fun f, int s, const struct sockaddr_in *name)
104{
105
106	ATF_REQUIRE((s = socket(AF_INET, SOCK_STREAM, 0)) >= 0);
107	ATF_REQUIRE_ERRNO(EAFNOSUPPORT,
108	    f(s, (const struct sockaddr *)(name),
109	        sizeof(struct sockaddr_in)) < 0);
110}
111
112ATF_TC_BODY(bindat_connectat_1, tc)
113{
114	struct sockaddr_in sin;
115
116	memset(&sin, 0, sizeof(sin));
117	sin.sin_family = AF_INET;
118	sin.sin_port = htons(0);
119	sin.sin_addr.s_addr = htonl(0xE0000000);
120
121	check_1(bindat_fdcwd, 0, &sin);
122	check_1(bind, 0, &sin);
123	check_1(connectat_fdcwd, 0, &sin);
124	check_1(connect, 0, &sin);
125}
126
127
128ATF_TC(bindat_connectat_2);
129ATF_TC_HEAD(bindat_connectat_2, tc)
130{
131	atf_tc_set_md_var(tc, "descr",
132	    "Verify that connect/bind are disabled in cap-mode");
133}
134
135static void
136check_2(socket_fun f, int s, const struct sockaddr_in *name)
137{
138
139	ATF_REQUIRE_ERRNO(ECAPMODE,
140	    f(s, (const struct sockaddr *)name,
141	        sizeof(struct sockaddr_in)) < 0);
142}
143
144ATF_TC_BODY(bindat_connectat_2, tc)
145{
146	int sock;
147	struct sockaddr_in sin;
148
149	check_capsicum();
150
151	ATF_REQUIRE(cap_enter() >= 0);
152
153	/* note: sock is created _after_ cap_enter() and contains all rights */
154	ATF_REQUIRE((sock = socket(AF_INET, SOCK_STREAM, 0)) >= 0);
155
156	memset(&sin, 0, sizeof(sin));
157	sin.sin_family = AF_INET;
158	/* dummy port and multicast address (224.0.0.0) to distinguish two
159	 * cases:
160	 *  - ECAPMODE/ENOTCAPABLE --> call blocked by capsicum
161	 *  - EAFNOSUPPORT --> call went through to protocol layer
162	 */
163	sin.sin_port = htons(0);
164	sin.sin_addr.s_addr = htonl(0xE0000000);
165
166	check_2(bindat_fdcwd, sock, &sin);
167	check_2(bind, sock, &sin);
168	check_2(connectat_fdcwd, sock, &sin);
169	check_2(connect, sock, &sin);
170}
171
172
173ATF_TC(bindat_connectat_3);
174ATF_TC_HEAD(bindat_connectat_3, tc)
175{
176	atf_tc_set_md_var(tc, "descr",
177	    "Check that taking away CAP_BIND/CAP_CONNECT "
178	    "sabotages bind/connect");
179}
180
181static void
182check_3(socket_fun f, int s, const struct sockaddr_in *name,
183    cap_rights_t *rights, cap_rights_t *sub_rights)
184{
185
186	ATF_REQUIRE((s = socket(AF_INET, SOCK_STREAM, 0)) >= 0);
187	ATF_REQUIRE(cap_rights_limit(s, rights) >= 0);
188	ATF_REQUIRE_ERRNO(EAFNOSUPPORT,
189	    f(s, (const struct sockaddr *)name,
190	        sizeof(struct sockaddr_in)) < 0);
191	ATF_REQUIRE(cap_rights_limit(s,
192	                cap_rights_remove(rights, sub_rights)) >= 0);
193	ATF_REQUIRE_ERRNO(ENOTCAPABLE,
194	    f(s, (const struct sockaddr *)name,
195	        sizeof(struct sockaddr_in)) < 0);
196}
197
198ATF_TC_BODY(bindat_connectat_3, tc)
199{
200	struct sockaddr_in sin;
201	cap_rights_t rights, sub_rights;
202
203	check_capsicum();
204
205	memset(&sin, 0, sizeof(sin));
206	sin.sin_family = AF_INET;
207	sin.sin_port = htons(0);
208	sin.sin_addr.s_addr = htonl(0xE0000000);
209
210	check_3(bindat_fdcwd, 0, &sin,
211	    cap_rights_init(&rights, CAP_SOCK_SERVER),
212	    cap_rights_init(&sub_rights, CAP_BIND));
213	check_3(bind, 0, &sin,
214	    cap_rights_init(&rights, CAP_SOCK_SERVER),
215	    cap_rights_init(&sub_rights, CAP_BIND));
216	check_3(connectat_fdcwd, 0, &sin,
217	    cap_rights_init(&rights, CAP_SOCK_CLIENT),
218	    cap_rights_init(&sub_rights, CAP_CONNECT));
219	check_3(connect, 0, &sin,
220	    cap_rights_init(&rights, CAP_SOCK_CLIENT),
221	    cap_rights_init(&sub_rights, CAP_CONNECT));
222}
223
224
225ATF_TP_ADD_TCS(tp)
226{
227
228	ATF_TP_ADD_TC(tp, bindat_connectat_1);
229	ATF_TP_ADD_TC(tp, bindat_connectat_2);
230	ATF_TP_ADD_TC(tp, bindat_connectat_3);
231
232	return (atf_no_error());
233}
234