[PATCH v1 2/2] selftests/landlock: Improve AF_UNSPEC tests

Mickaël Salaün mic at digikod.net
Wed Mar 27 12:00:34 UTC 2024


Test that an IPv6 socket requested to be binded with AF_UNSPEC returns
-EAFNOSUPPORT if the sockaddr length is valid.

Cc: Eric Dumazet <edumazet at google.com>
Cc: Günther Noack <gnoack at google.com>
Cc: Ivanov Mikhail <ivanov.mikhail1 at huawei-partners.com>
Cc: Konstantin Meskhidze <konstantin.meskhidze at huawei.com>
Cc: Paul Moore <paul at paul-moore.com>
Cc: Serge E. Hallyn <serge at hallyn.com>
Signed-off-by: Mickaël Salaün <mic at digikod.net>
---
 tools/testing/selftests/landlock/net_test.c | 37 +++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index f21cfbbc3638..f15cf565f856 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -673,6 +673,7 @@ TEST_F(protocol, bind_unspec)
 		.port = self->srv0.port,
 	};
 	int bind_fd, ret;
+	socklen_t inet_len, inet6_len, unix_len;
 
 	if (variant->sandbox == TCP_SANDBOX) {
 		const int ruleset_fd = landlock_create_ruleset(
@@ -736,12 +737,48 @@ TEST_F(protocol, bind_unspec)
 	if (variant->prot.domain == AF_INET) {
 		EXPECT_EQ(-EAFNOSUPPORT, ret);
 	} else {
+		/* The sockaddr length is less than SIN6_LEN_RFC2133. */
 		EXPECT_EQ(-EINVAL, ret)
 		{
 			TH_LOG("Wrong bind error: %s", strerror(errno));
 		}
 	}
 	EXPECT_EQ(0, close(bind_fd));
+
+	/* Stores the minimal sockaddr lengths per family. */
+	self->unspec_srv0.protocol.domain = AF_INET;
+	inet_len = get_addrlen(&self->unspec_srv0, true);
+	self->unspec_srv0.protocol.domain = AF_INET6;
+	inet6_len = get_addrlen(&self->unspec_srv0, true);
+	self->unspec_srv0.protocol.domain = AF_UNIX;
+	unix_len = get_addrlen(&self->unspec_srv0, true);
+	self->unspec_srv0.protocol.domain = AF_UNSPEC;
+
+	/* Checks bind with AF_UNSPEC and less than IPv4 sockaddr length. */
+	bind_fd = socket_variant(&self->srv0);
+	ASSERT_LE(0, bind_fd);
+	ret = bind_variant_addrlen(bind_fd, &self->unspec_srv0, inet_len - 1);
+	EXPECT_EQ(-EINVAL, ret);
+	EXPECT_EQ(0, close(bind_fd));
+
+	/* Checks bind with AF_UNSPEC and IPv6 sockaddr length. */
+	bind_fd = socket_variant(&self->srv0);
+	ASSERT_LE(0, bind_fd);
+	ret = bind_variant_addrlen(bind_fd, &self->unspec_srv0, inet6_len);
+	if (variant->prot.domain == AF_INET ||
+	    variant->prot.domain == AF_INET6) {
+		EXPECT_EQ(-EAFNOSUPPORT, ret);
+	} else {
+		EXPECT_EQ(-EINVAL, ret);
+	}
+	EXPECT_EQ(0, close(bind_fd));
+
+	/* Checks bind with AF_UNSPEC and unix sockaddr length. */
+	bind_fd = socket_variant(&self->srv0);
+	ASSERT_LE(0, bind_fd);
+	ret = bind_variant_addrlen(bind_fd, &self->unspec_srv0, unix_len);
+	EXPECT_EQ(-EINVAL, ret);
+	EXPECT_EQ(0, close(bind_fd));
 }
 
 TEST_F(protocol, connect_unspec)
-- 
2.44.0




More information about the Linux-security-module-archive mailing list