Skip to contentSkip to conversation

cve/cve-2017-2671.c: check if socket() supports IPPROTO_ICMP

PATCH New Xiao Yang 2 participants 5 messages Aug 3, 2017 – Aug 4, 2017

lore
Share & tools
lore

Xiao Yang

author
#0 lore raw

PATCH 1/1 cve/cve-2017-2671.c: check if socket() supports IPPROTO_ICMP

socket() does not support IPPROTO_ICMP, and the ping_group_range file does not exist in older kernels(e.g. RHEL5.11GA). these supports are introduced by:
'c319b4d("net: ipv4: add IPPROTO_ICMP socket kind")'

This case should get TCONF instead of TBROK, so we add check to fix it.

Signed-off-by Xiao Yang <[email protected]>
---
 testcases/cve/cve-2017-2671.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)
testcases/cve/cve-2017-2671.c +18 -6
index 2148512..86d12e6 100644
@@ -37,6 +37,8 @@
  * enabled by default, root privileges are not required.
  */
 
+#include <errno.h>
+#include <unistd.h>
 #include <stdio.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>

@@ -52,7 +54,7 @@
 #define PING_SYSCTL_PATH "/proc/sys/net/ipv4/ping_group_range"
 
 static int sockfd;
-static unsigned int ping_min_grp = 1, ping_max_grp;
+static unsigned int ping_min_grp, ping_max_grp;
 static struct tst_fzsync_pair fzsync_pair = TST_FZSYNC_PAIR_INIT;
 static struct sockaddr_in iaddr, uaddr;
 

@@ -64,17 +66,27 @@ static void setup(void)
 	uaddr.sin_family = AF_UNSPEC;
 	fzsync_pair.delay_inc = 1;
 
-	SAFE_FILE_SCANF(PING_SYSCTL_PATH, "%u %u",
-			&ping_min_grp, &ping_max_grp);
-	SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "0 0");
+	if (!access(PING_SYSCTL_PATH, F_OK)) {
+		SAFE_FILE_SCANF(PING_SYSCTL_PATH, "%u %u",
+				&ping_min_grp, &ping_max_grp);
+		SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "0 0");
+	}
 
-	sockfd = SAFE_SOCKET(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+	sockfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+	if (sockfd == -1) {
+		if (errno == EPROTONOSUPPORT) {
+			tst_brk(TCONF | TERRNO,
+				"socket() does not support IPPROTO_ICMP");
+		}
+		tst_brk(TBROK | TERRNO, "socket() failed");
+	}
 	tst_res(TINFO, "Created ping socket, attempting to race...");
 }
 
 static void cleanup(void)
 {
-	SAFE_CLOSE(sockfd);
+	if (sockfd > 0)
+		SAFE_CLOSE(sockfd);
 	if (ping_min_grp | ping_max_grp)
 		SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "%u %u",
 				 ping_min_grp, ping_max_grp);
Signature · 1 line
1.8.3.1
#1 lore raw

PATCH 1/1 cve/cve-2017-2671.c: check if socket() supports IPPROTO_ICMP

Hi!

Quoted 4 lines

socket() does not support IPPROTO_ICMP, and the ping_group_range file does not exist in older kernels(e.g. RHEL5.11GA). these supports are introduced by:
'c319b4d("net: ipv4: add IPPROTO_ICMP socket kind")'

Hm, the question is if there is a system that supports IPPROTO_ICMP and where the ping_group_range file is missing. Does that even happen?

If not we should simplify this by exitting (tst_brk()) with TCONF if the ping_group_range is missing instead of doing that later on EPROTONOSUPPORT.

Signature · 2 lines
Cyril Hrubis
[email protected]
author
#2 lore raw

PATCH 1/1 cve/cve-2017-2671.c: check if socket() supports IPPROTO_ICMP

Quoted 5 lines · Cyril Hrubis

Hi!

Quoted 4 lines

socket() does not support IPPROTO_ICMP, and the ping_group_range file does not exist in older kernels(e.g. RHEL5.11GA). these supports are introduced by:
'c319b4d("net: ipv4: add IPPROTO_ICMP socket kind")'

Quoted 7 lines

Hm, the question is if there is a system that supports IPPROTO_ICMP and where the ping_group_range file is missing. Does that even happen?

If not we should simplify this by exitting (tst_brk()) with TCONF if the ping_group_range is missing instead of doing that later on EPROTONOSUPPORT.

Hi Cyril,

Thanks for your comments. I think there is not a system that supports IPPROTO_ICMP
and where the ping_group_range file is missing. I will simplify it as you suggested.

Thanks,
Xiao Yang.

author
#3 lore raw

PATCH v2 1/1 cve/cve-2017-2671.c: check if socket() supports IPPROTO_ICMP

In reply to Cyril Hrubis

socket() does not support IPPROTO_ICMP, and where the ping_group_range file is missing in older kernels(e.g. RHEL5.11GA). these supports are introduced by:
'c319b4d("net: ipv4: add IPPROTO_ICMP socket kind")'

This case should get TCONF if the ping_group_range is missing, so we add check to fix it.

Signed-off-by Xiao Yang <[email protected]>
---
 testcases/cve/cve-2017-2671.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
testcases/cve/cve-2017-2671.c +7 -2
index 2148512..77744db 100644
@@ -37,6 +37,7 @@
  * enabled by default, root privileges are not required.
  */
 
+#include <unistd.h>
 #include <stdio.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>

@@ -52,7 +53,7 @@
 #define PING_SYSCTL_PATH "/proc/sys/net/ipv4/ping_group_range"
 
 static int sockfd;
-static unsigned int ping_min_grp = 1, ping_max_grp;
+static unsigned int ping_min_grp, ping_max_grp;
 static struct tst_fzsync_pair fzsync_pair = TST_FZSYNC_PAIR_INIT;
 static struct sockaddr_in iaddr, uaddr;
 

@@ -64,6 +65,9 @@ static void setup(void)
 	uaddr.sin_family = AF_UNSPEC;
 	fzsync_pair.delay_inc = 1;
 
+	if (access(PING_SYSCTL_PATH, F_OK))
+		tst_brk(TCONF, "socket() does not support IPPROTO_ICMP");
+
 	SAFE_FILE_SCANF(PING_SYSCTL_PATH, "%u %u",
 			&ping_min_grp, &ping_max_grp);
 	SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "0 0");

@@ -74,7 +78,8 @@ static void setup(void)
 
 static void cleanup(void)
 {
-	SAFE_CLOSE(sockfd);
+	if (sockfd > 0)
+		SAFE_CLOSE(sockfd);
 	if (ping_min_grp | ping_max_grp)
 		SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "%u %u",
 				 ping_min_grp, ping_max_grp);
Signature · 1 line
1.8.3.1