1 /* $NetBSD: t_bpf.c,v 1.4 2012/01/13 16:28:44 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2010 Antti Kantee. All Rights Reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/param.h> 29 #include <sys/ioctl.h> 30 #include <sys/socket.h> 31 #include <sys/mbuf.h> 32 #include <sys/sysctl.h> 33 #include <sys/mman.h> 34 #include <unistd.h> 35 36 #include <net/if.h> 37 #include <net/bpf.h> 38 39 #include <fcntl.h> 40 #include <stdio.h> 41 #include <string.h> 42 43 #include <rump/rump.h> 44 #include <rump/rump_syscalls.h> 45 46 /* XXX: atf-c.h has collisions with mbuf */ 47 #undef m_type 48 #undef m_data 49 #include <atf-c.h> 50 51 #include "../../h_macros.h" 52 #include "../config/netconfig.c" 53 54 ATF_TC(bpfwriteleak); 55 ATF_TC_HEAD(bpfwriteleak, tc) 56 { 57 58 atf_tc_set_md_var(tc, "descr", "Checks that writing to /dev/bpf " 59 "does not leak mbufs"); 60 } 61 62 static int 63 getmtdata(void) 64 { 65 struct mbstat mbstat; 66 size_t mbstatlen = sizeof(mbstat); 67 const int mbstat_mib[] = { CTL_KERN, KERN_MBUF, MBUF_STATS }; 68 69 RL(rump_sys___sysctl(mbstat_mib, __arraycount(mbstat_mib), 70 &mbstat, &mbstatlen, NULL, 0)); 71 return mbstat.m_mtypes[MT_DATA]; 72 } 73 74 ATF_TC_BODY(bpfwriteleak, tc) 75 { 76 char buf[28]; /* sizeof(garbage) > etherhdrlen */ 77 struct ifreq ifr; 78 int ifnum, bpfd; 79 80 RZ(rump_init()); 81 RZ(rump_pub_shmif_create(NULL, &ifnum)); 82 sprintf(ifr.ifr_name, "shmif%d", ifnum); 83 84 RL(bpfd = rump_sys_open("/dev/bpf", O_RDWR)); 85 RL(rump_sys_ioctl(bpfd, BIOCSETIF, &ifr)); 86 RL(rump_sys_ioctl(bpfd, BIOCSFEEDBACK, &ifr)); 87 88 if (getmtdata() != 0) 89 atf_tc_fail("test precondition failed: MT_DATA mbufs != 0"); 90 91 ATF_REQUIRE_ERRNO(ENETDOWN, rump_sys_write(bpfd, buf, sizeof(buf))==-1); 92 93 ATF_REQUIRE_EQ(getmtdata(), 0); 94 } 95 96 #if (SIZE_MAX > UINT_MAX) 97 ATF_TC(bpfwritetrunc); 98 ATF_TC_HEAD(bpfwritetrunc, tc) 99 { 100 atf_tc_set_md_var(tc, "descr", "Checks that write to /dev/bpf " 101 "does not truncate size_t to int"); 102 } 103 104 ATF_TC_BODY(bpfwritetrunc, tc) 105 { 106 int bpfd; 107 struct ifreq ifr; 108 struct iovec *iov; 109 size_t iovlen, sz; 110 const size_t extra_bytes = 28; 111 const size_t total = extra_bytes + UINT_MAX + 1; 112 long iov_max, vm_page_size; /* round_page wants vm_page_size variable */ 113 114 memset(&ifr, 0, sizeof(ifr)); 115 116 iov_max = sysconf(_SC_IOV_MAX); 117 vm_page_size = sysconf(_SC_PAGE_SIZE); 118 ATF_REQUIRE(iov_max > 1 && vm_page_size > 1); 119 120 /* Minimize memory consumption by using many iovecs 121 * all pointing to one memory region */ 122 iov = calloc(iov_max, sizeof(struct iovec)); 123 ATF_REQUIRE(iov != NULL); 124 125 sz = round_page((total + (iov_max - 1)) / iov_max); 126 127 iov[0].iov_len = sz; 128 iov[0].iov_base = mmap(NULL, sz, PROT_READ, MAP_ANON, -1, 0); 129 ATF_REQUIRE(iov[0].iov_base != MAP_FAILED); 130 131 iovlen = 1; 132 while(sz + iov[0].iov_len <= total) 133 { 134 iov[iovlen].iov_len = iov[0].iov_len; 135 iov[iovlen].iov_base = iov[0].iov_base; 136 sz += iov[0].iov_len; 137 iovlen++; 138 } 139 140 if(sz < total) 141 { 142 iov[iovlen].iov_len = total - sz; 143 iov[iovlen].iov_base = iov[0].iov_base; 144 iovlen++; 145 } 146 147 /* Sanity checks */ 148 ATF_REQUIRE(iovlen >= 1 && iovlen <= (size_t)iov_max); 149 ATF_REQUIRE_EQ(iov[iovlen-1].iov_len, total % iov[0].iov_len); 150 151 RZ(rump_init()); 152 netcfg_rump_makeshmif("bpfwritetrunc", ifr.ifr_name); 153 netcfg_rump_if(ifr.ifr_name, "10.1.1.1", "255.0.0.0"); 154 155 RL(bpfd = rump_sys_open("/dev/bpf", O_RDWR)); 156 RL(rump_sys_ioctl(bpfd, BIOCSETIF, &ifr)); 157 158 ATF_CHECK_ERRNO(EMSGSIZE, rump_sys_writev(bpfd, iov, iovlen) == -1); 159 160 munmap(iov[0].iov_base, iov[0].iov_len); 161 free(iov); 162 } 163 #endif /* #if (SIZE_MAX > UINT_MAX) */ 164 165 ATF_TP_ADD_TCS(tp) 166 { 167 168 ATF_TP_ADD_TC(tp, bpfwriteleak); 169 #if (SIZE_MAX > UINT_MAX) 170 ATF_TP_ADD_TC(tp, bpfwritetrunc); 171 #endif 172 return atf_no_error(); 173 } 174