sctp: add new regression test for CVE-2018-5803

Signed-off-by Alexey Kodanev <[email protected]>

---
v2: include linux/sctp.h header and check it in the configure

 configure.ac        |    1 +
 include/lapi/sctp.h |   29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 0 deletions(-)
 create mode 100644 include/lapi/sctp.h

configure.ac +1 -0

index 85426ad..97d643b 100644
@@ -44,6 +44,7 @@ AC_CHECK_HEADERS([ \
     linux/mempolicy.h \
     linux/module.h \
     linux/netlink.h \
+    linux/sctp.h \
     mm.h \
     pthread.h \
     sys/epoll.h \

include/lapi/sctp.h new file +19 -0

new file mode 100644
index 0000000..69adc7a
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2018 Oracle and/or its affiliates.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef LAPI_SCTP_H__
+#define LAPI_SCTP_H__

Quoted 3 lines

Signed-off-by Alexey Kodanev <[email protected]>

---
v2: include linux/sctp.h header and check it in the configure

BTW SCTP_SOCKOPT_BINDX_ADD is defined in both <linux/sctp.h> and <netinet/sctp.h>, so if we ever in future want to have some definitions from netinet/sctp.h, I'd be to create special file include/lapi/netinet_sctp.h (the same like include/lapi/netinet_in.h - taking that default is for "kernel/").

And we have included netinet/sctp.h in sources (utils/sctp/include/netinet/sctp.h), IMHO not good idea to have common headers in our sources.

Kind regards,
Petr

Quoted 4 lines

BTW SCTP_SOCKOPT_BINDX_ADD is defined in both <linux/sctp.h> and <netinet/sctp.h>, so if we ever in future want to have some definitions from netinet/sctp.h, I'd be to create special file include/lapi/netinet_sctp.h (the same like include/lapi/netinet_in.h - taking that default is for "kernel/").

I think if we have netinet/sctp.h it should take precedences over linux/sctp.h. In OL7 it is provided by optional lksctp-tools-devel package.

Thanks,
Alexey

Added two test-cases in runtest/cve:
* cve-2018-5803 - over-sized INIT_ACK packet
* cve-2018-5803_2 - over-sized INIT packet

Signed-off-by Alexey Kodanev <[email protected]>

---
v2: rename the test file and move it to testcases/network/sctp/

 include/lapi/socket.h                   |    4 +
 runtest/cve                             |    2 +
 testcases/network/.gitignore            |    1 +
 testcases/network/sctp/Makefile         |    2 +-
 testcases/network/sctp/sctp_big_chunk.c |  121 +++++++++++++++++++++++++++++++
 5 files changed, 129 insertions(+), 1 deletions(-)
 create mode 100644 testcases/network/sctp/sctp_big_chunk.c

include/lapi/socket.h +4 -0

index 426906f..d58c460 100644
@@ -45,6 +45,10 @@
 # define SOCK_CLOEXEC 02000000
 #endif
 
+#ifndef SOL_SCTP
+# define SOL_SCTP	132
+#endif
+
 #ifndef SOL_UDPLITE
 # define SOL_UDPLITE		136 /* UDP-Lite (RFC 3828) */
 #endif

runtest/cve +2 -0

index 8b7cbe5..1d9569a 100644
@@ -32,3 +32,5 @@ cve-2017-5754 meltdown
 cve-2017-17052 cve-2017-17052
 cve-2017-16939 cve-2017-16939
 cve-2017-17053 cve-2017-17053
+cve-2018-5803 sctp_big_chunk
+cve-2018-5803_2 sctp_big_chunk -a 10000

testcases/network/.gitignore +1 -0

index d4ed925..e952f6f 100644
@@ -22,6 +22,7 @@
 /nfsv4/locks/locktests
 /rpc/basic_tests/rpc01/rpc1
 /rpc/basic_tests/rpc01/rpc_server
+/sctp/sctp_big_chunk
 /sockets/ltpClient
 /sockets/ltpServer
 /stress/ns-tools/ns-icmp_redirector

testcases/network/sctp/Makefile +1 -1

index 914e389..0fa9125 100644
@@ -15,7 +15,7 @@
 
 top_srcdir		?= ../../..
 
-include $(top_srcdir)/include/mk/env_pre.mk
+include $(top_srcdir)/include/mk/testcases.mk
 
 INSTALL_TARGETS		:= sctp01.sh
 

testcases/network/sctp/sctp_big_chunk.c new file +111 -0

new file mode 100644
index 0000000..55a2969
@@ -0,0 +1,121 @@
+/*
+ * Copyright (c) 2018 Oracle and/or its affiliates. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it would be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Regression test-case for the crash caused by over-sized SCTP chunk,
+ * fixed by upstream commit 07f2c7ab6f8d ("sctp: verify size of a new
+ * chunk in _sctp_make_chunk()")
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <sys/syscall.h>
+#include <fcntl.h>
+
+#include "tst_test.h"
+#include "tst_safe_stdio.h"
+#include "lapi/netinet_in.h"
+#include "lapi/socket.h"
+#include "lapi/sctp.h"
+
+static int port;
+static int sfd, cfd;
+static struct sockaddr_in6 rmt, loc;
+
+static char *addr_param;
+static int addr_num = 3273;
+
+static void setup_server(void)
+{
+	loc.sin6_family = AF_INET6;
+	loc.sin6_addr = in6addr_loopback;
+
+	sfd = SAFE_SOCKET(AF_INET6, SOCK_STREAM, IPPROTO_SCTP);
+	SAFE_BIND(sfd, (struct sockaddr *)&loc, sizeof(loc));
+
+	port = TST_GETSOCKPORT(sfd);
+	tst_res(TINFO, "sctp server listen on %d", port);
+
+	SAFE_LISTEN(sfd, 1);
+}
+
+static void setup_client(void)
+{
+	struct sockaddr_in6 addr_buf[addr_num];
+	int i;
+
+	cfd = SAFE_SOCKET(AF_INET6, SOCK_STREAM, IPPROTO_SCTP);
+	rmt.sin6_family = AF_INET6;
+	rmt.sin6_addr = in6addr_loopback;
+	rmt.sin6_port = htons(port);
+
+	tst_res(TINFO, "bind %d additional IP addresses", addr_num);
+
+	memset(addr_buf, 0, sizeof(addr_buf));
+	for (i = 0; i < addr_num; ++i) {
+		addr_buf[i].sin6_family = AF_INET6;
+		addr_buf[i].sin6_addr = in6addr_loopback;
+	}
+
+	SAFE_SETSOCKOPT(cfd, SOL_SCTP, SCTP_SOCKOPT_BINDX_ADD, addr_buf,
+			sizeof(addr_buf));
+}
+
+static void setup(void)
+{
+	if (tst_parse_int(addr_param, &addr_num, 1, INT_MAX))
+		tst_brk(TBROK, "wrong address number '%s'", addr_param);
+
+	setup_server();
+	setup_client();
+}
+
+static void run(void)
+{
+	int pid = SAFE_FORK();
+
+	if (!pid) {
+		struct sockaddr_in6 addr6;
+		socklen_t addr_size = sizeof(addr6);
+
+		if (accept(sfd, (struct sockaddr *)&addr6, &addr_size) < 0)
+			tst_brk(TBROK | TERRNO, "accept() failed");
+		exit(0);
+	}
+
+	fcntl(cfd, F_SETFL, O_NONBLOCK);
+	connect(cfd, (struct sockaddr *)&rmt, sizeof(rmt));
+
+	SAFE_KILL(pid, SIGKILL);
+	SAFE_WAITPID(pid, NULL, 0);
+
+	tst_res(TPASS, "test doesn't cause crash");
+}
+
+static struct tst_option options[] = {