1/*	$NetBSD: t_bpf.c,v 1.3 2011/12/18 22:51:00 joerg Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Antti Kantee.  All Rights Reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
18 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
21 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/param.h>
29#include <sys/ioctl.h>
30#include <sys/socket.h>
31#include <sys/mbuf.h>
32#include <sys/sysctl.h>
33#include <sys/mman.h>
34#include <unistd.h>
35
36#include <net/if.h>
37#include <net/bpf.h>
38
39#include <fcntl.h>
40#include <stdio.h>
41#include <string.h>
42
43#include <rump/rump.h>
44#include <rump/rump_syscalls.h>
45
46/* XXX: atf-c.h has collisions with mbuf */
47#undef m_type
48#undef m_data
49#include <atf-c.h>
50
51#include "../../h_macros.h"
52#include "../config/netconfig.c"
53
54ATF_TC(bpfwriteleak);
55ATF_TC_HEAD(bpfwriteleak, tc)
56{
57
58	atf_tc_set_md_var(tc, "descr", "Checks that writing to /dev/bpf "
59	    "does not leak mbufs");
60}
61
62static int
63getmtdata(void)
64{
65	struct mbstat mbstat;
66	size_t mbstatlen = sizeof(mbstat);
67	const int mbstat_mib[] = { CTL_KERN, KERN_MBUF, MBUF_STATS };
68
69	RL(rump_sys___sysctl(mbstat_mib, __arraycount(mbstat_mib),
70	    &mbstat, &mbstatlen, NULL, 0));
71	return mbstat.m_mtypes[MT_DATA];
72}
73
74ATF_TC_BODY(bpfwriteleak, tc)
75{
76	char buf[28]; /* sizeof(garbage) > etherhdrlen */
77	struct ifreq ifr;
78	int ifnum, bpfd;
79
80	RZ(rump_init());
81	RZ(rump_pub_shmif_create(NULL, &ifnum));
82	sprintf(ifr.ifr_name, "shmif%d", ifnum);
83
84	RL(bpfd = rump_sys_open("/dev/bpf", O_RDWR));
85	RL(rump_sys_ioctl(bpfd, BIOCSETIF, &ifr));
86	RL(rump_sys_ioctl(bpfd, BIOCSFEEDBACK, &ifr));
87
88	if (getmtdata() != 0)
89		atf_tc_fail("test precondition failed: MT_DATA mbufs != 0");
90
91	ATF_REQUIRE_ERRNO(ENETDOWN, rump_sys_write(bpfd, buf, sizeof(buf))==-1);
92
93	ATF_REQUIRE_EQ(getmtdata(), 0);
94}
95
96#if (SIZE_MAX > UINT_MAX)
97ATF_TC(bpfwritetrunc);
98ATF_TC_HEAD(bpfwritetrunc, tc)
99{
100	atf_tc_set_md_var(tc, "descr", "Checks that write to /dev/bpf "
101	    "does not truncate size_t to int");
102}
103
104ATF_TC_BODY(bpfwritetrunc, tc)
105{
106	int bpfd;
107	struct ifreq ifr;
108	struct iovec *iov;
109	size_t iovlen, sz;
110	const size_t extra_bytes = 28;
111	const size_t total = extra_bytes + UINT_MAX + 1;
112	long iov_max, vm_page_size; /* round_page wants vm_page_size variable */
113
114	memset(&ifr, 0, sizeof(ifr));
115
116	iov_max      = sysconf(_SC_IOV_MAX);
117	vm_page_size = sysconf(_SC_PAGE_SIZE);
118	ATF_REQUIRE(iov_max > 1 && vm_page_size > 1);
119
120	/* Minimize memory consumption by using many iovecs
121	 * all pointing to one memory region */
122	iov = calloc(iov_max, sizeof(struct iovec));
123	ATF_REQUIRE(iov != NULL);
124
125	sz = round_page((total + (iov_max - 1)) / iov_max);
126
127	iov[0].iov_len = sz;
128	iov[0].iov_base = mmap(NULL, sz, PROT_READ, MAP_ANON, -1, 0);
129	ATF_REQUIRE(iov[0].iov_base != MAP_FAILED);
130
131	iovlen = 1;
132	while(sz + iov[0].iov_len <= total)
133	{
134		iov[iovlen].iov_len  = iov[0].iov_len;
135		iov[iovlen].iov_base = iov[0].iov_base;
136		sz += iov[0].iov_len;
137		iovlen++;
138	}
139
140	if(sz < total)
141	{
142		iov[iovlen].iov_len = total - sz;
143		iov[iovlen].iov_base = iov[0].iov_base;
144		iovlen++;
145	}
146
147	/* Sanity checks */
148	ATF_REQUIRE(iovlen >= 1 && iovlen <= (size_t)iov_max);
149	ATF_REQUIRE_EQ(iov[iovlen-1].iov_len, total % iov[0].iov_len);
150
151	RZ(rump_init());
152	netcfg_rump_makeshmif("bpfwritetrunc", ifr.ifr_name);
153	netcfg_rump_if(ifr.ifr_name, "10.1.1.1", "255.0.0.0");
154
155	RL(bpfd = rump_sys_open("/dev/bpf", O_RDWR));
156	RL(rump_sys_ioctl(bpfd, BIOCSETIF, &ifr));
157
158	ATF_CHECK_ERRNO(EMSGSIZE, rump_sys_writev(bpfd, iov, iovlen) == -1);
159
160	munmap(iov[0].iov_base, iov[0].iov_len);
161	free(iov);
162}
163#endif /* #if (SIZE_MAX > UINT_MAX) */
164
165ATF_TP_ADD_TCS(tp)
166{
167
168	ATF_TP_ADD_TC(tp, bpfwriteleak);
169#if (SIZE_MAX > UINT_MAX)
170	ATF_TP_ADD_TC(tp, bpfwritetrunc);
171#endif
172	return atf_no_error();
173}
174