- Linux-kselftest-mirror - lists.linaro.org

[PATCH v2] selftests/sgx: Fix Q1 and Q2 calculation in sigstruct.c

by Jarkko Sakkinen

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Q1 and Q2 are numbers with *maximum* length of 384 bytes. If the calculated length of Q1 and Q2 is less than 384 bytes, things will go wrong. E.g. if Q2 is 383 bytes, then 1. The bytes of q2 are copied to sigstruct->q2 in calc_q1q2(). 2. The entire sigstruct->q2 is reversed, which results it being 256 * Q2, given that the last byte of sigstruct->q2 is added to before the bytes given by calc_q1q2(). Either change in key or measurement can trigger the bug. E.g. an unmeasured heap could cause a devastating change in Q1 or Q2. Reverse exactly the bytes of Q1 and Q2 in calc_q1q2() before returning to the caller. Fixes: dedde2634570 ("selftests/sgx: Trigger the reclaimer in the selftests") Link: https://lore.kernel.org/linux-sgx/20210301051836.30738-1-tianjia.zhang@linu… Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- The original patch did a bad job explaining the code change but it turned out making sense. I wrote a new description. v2: - Added a fixes tag. tools/testing/selftests/sgx/sigstruct.c | 41 +++++++++++++------------ 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/tools/testing/selftests/sgx/sigstruct.c b/tools/testing/selftests/sgx/sigstruct.c index dee7a3d6c5a5..92bbc5a15c39 100644 --- a/tools/testing/selftests/sgx/sigstruct.c +++ b/tools/testing/selftests/sgx/sigstruct.c @@ -55,10 +55,27 @@ static bool alloc_q1q2_ctx(const uint8_t *s, const uint8_t *m, return true; } +static void reverse_bytes(void *data, int length) +{ + int i = 0; + int j = length - 1; + uint8_t temp; + uint8_t *ptr = data; + + while (i < j) { + temp = ptr[i]; + ptr[i] = ptr[j]; + ptr[j] = temp; + i++; + j--; + } +} + static bool calc_q1q2(const uint8_t *s, const uint8_t *m, uint8_t *q1, uint8_t *q2) { struct q1q2_ctx ctx; + int len; if (!alloc_q1q2_ctx(s, m, &ctx)) { fprintf(stderr, "Not enough memory for Q1Q2 calculation\n"); @@ -89,8 +106,10 @@ static bool calc_q1q2(const uint8_t *s, const uint8_t *m, uint8_t *q1, goto out; } - BN_bn2bin(ctx.q1, q1); - BN_bn2bin(ctx.q2, q2); + len = BN_bn2bin(ctx.q1, q1); + reverse_bytes(q1, len); + len = BN_bn2bin(ctx.q2, q2); + reverse_bytes(q2, len); free_q1q2_ctx(&ctx); return true; @@ -152,22 +171,6 @@ static RSA *gen_sign_key(void) return key; } -static void reverse_bytes(void *data, int length) -{ - int i = 0; - int j = length - 1; - uint8_t temp; - uint8_t *ptr = data; - - while (i < j) { - temp = ptr[i]; - ptr[i] = ptr[j]; - ptr[j] = temp; - i++; - j--; - } -} - enum mrtags { MRECREATE = 0x0045544145524345, MREADD = 0x0000000044444145, @@ -367,8 +370,6 @@ bool encl_measure(struct encl *encl) /* BE -> LE */ reverse_bytes(sigstruct->signature, SGX_MODULUS_SIZE); reverse_bytes(sigstruct->modulus, SGX_MODULUS_SIZE); - reverse_bytes(sigstruct->q1, SGX_MODULUS_SIZE); - reverse_bytes(sigstruct->q2, SGX_MODULUS_SIZE); EVP_MD_CTX_destroy(ctx); RSA_free(key); -- 2.32.0

4 years, 2 months

2
5
0 0

[PATCH v2 0/4] Swap and fault all the pages of the test enclave binary

by Jarkko Sakkinen

Create a heap for the test enclave, which has the same size as all available Enclave Page Cache (EPC) pages in the system. This will guarantee that all test_encl.elf pages *and* SGX Enclave Control Structure (SECS) have been swapped out by the page reclaimer during the load time. Actually, this adds a bit more stress than that since part of the EPC gets reserved for the Version Array (VA) pages. For each test, the page fault handler gets triggered in two occasions: - When SGX_IOC_ENCLAVE_INIT is performed, SECS gets swapped in by the page fault handler. - During the execution, each page that is referenced gets swapped in by the page fault handler. Jarkko Sakkinen (3): x86/sgx: Add /sys/kernel/debug/x86/sgx_total_mem selftests/sgx: Assign source for each segment selftests/sgx: Trigger the reclaimer and #PF handler Tianjia Zhang (1): selftests/sgx: Fix calculations for sub-maximum field sizes Documentation/x86/sgx.rst | 6 +++ arch/x86/kernel/cpu/sgx/main.c | 10 ++++- tools/testing/selftests/sgx/load.c | 38 ++++++++++++++---- tools/testing/selftests/sgx/main.c | 42 +++++++++++++++++++- tools/testing/selftests/sgx/main.h | 4 +- tools/testing/selftests/sgx/sigstruct.c | 53 +++++++++++++------------ 6 files changed, 117 insertions(+), 36 deletions(-) -- 2.32.0

4 years, 2 months

2
6
0 0

[PATCH 1/2] kunit: tool: make --raw_output support only showing kunit output

by Daniel Latypov

--raw_output is nice, but it would be nicer if could show only output after KUnit tests ahve started. So change the flag to allow specifying a string ('kunit'). Make it so `--raw_output` alone will default to `--raw_output=all` and have the same original behavior. Drop the small kunit_parser.raw_output() function since it feels wrong to put it in "kunit_parser.py" when the point of it is to not parse anything. E.g. $ ./tools/testing/kunit/kunit.py run --raw_output=kunit ... [15:24:07] Starting KUnit Kernel ... TAP version 14 1..1 # Subtest: example 1..3 # example_simple_test: initializing ok 1 - example_simple_test # example_skip_test: initializing # example_skip_test: You should not see a line below. ok 2 - example_skip_test # SKIP this test should be skipped # example_mark_skipped_test: initializing # example_mark_skipped_test: You should see a line below. # example_mark_skipped_test: You should see this line. ok 3 - example_mark_skipped_test # SKIP this test should be skipped ok 1 - example [15:24:10] Elapsed time: 6.487s total, 0.001s configuring, 3.510s building, 0.000s running Signed-off-by: Daniel Latypov <dlatypov(a)google.com> --- Documentation/dev-tools/kunit/kunit-tool.rst | 9 ++++++--- tools/testing/kunit/kunit.py | 20 +++++++++++++++----- tools/testing/kunit/kunit_parser.py | 4 ---- tools/testing/kunit/kunit_tool_test.py | 9 +++++++++ 4 files changed, 30 insertions(+), 12 deletions(-) diff --git a/Documentation/dev-tools/kunit/kunit-tool.rst b/Documentation/dev-tools/kunit/kunit-tool.rst index c7ff9afe407a..ae52e0f489f9 100644 --- a/Documentation/dev-tools/kunit/kunit-tool.rst +++ b/Documentation/dev-tools/kunit/kunit-tool.rst @@ -114,9 +114,12 @@ results in TAP format, you can pass the ``--raw_output`` argument. ./tools/testing/kunit/kunit.py run --raw_output -.. note:: - The raw output from test runs may contain other, non-KUnit kernel log - lines. +The raw output from test runs may contain other, non-KUnit kernel log +lines. You can see just KUnit output with ``--raw_output=kunit``: + +.. code-block:: bash + + ./tools/testing/kunit/kunit.py run --raw_output=kunit If you have KUnit results in their raw TAP format, you can parse them and print the human-readable summary with the ``parse`` command for kunit_tool. This diff --git a/tools/testing/kunit/kunit.py b/tools/testing/kunit/kunit.py index 7174377c2172..5a931456e718 100755 --- a/tools/testing/kunit/kunit.py +++ b/tools/testing/kunit/kunit.py @@ -16,6 +16,7 @@ assert sys.version_info >= (3, 7), "Python version is too old" from collections import namedtuple from enum import Enum, auto +from typing import Iterable import kunit_config import kunit_json @@ -114,7 +115,16 @@ def parse_tests(request: KunitParseRequest) -> KunitResult: 'Tests not Parsed.') if request.raw_output: - kunit_parser.raw_output(request.input_data) + output: Iterable[str] = request.input_data + if request.raw_output == 'all': + pass + elif request.raw_output == 'kunit': + output = kunit_parser.extract_tap_lines(output) + else: + print(f'Unknown --raw_output option "{request.raw_output}"', file=sys.stderr) + for line in output: + print(line.rstrip()) + else: test_result = kunit_parser.parse_run_tests(request.input_data) parse_end = time.time() @@ -135,7 +145,6 @@ def parse_tests(request: KunitParseRequest) -> KunitResult: return KunitResult(KunitStatus.SUCCESS, test_result, parse_end - parse_start) - def run_tests(linux: kunit_kernel.LinuxSourceTree, request: KunitRequest) -> KunitResult: run_start = time.time() @@ -181,7 +190,7 @@ def add_common_opts(parser) -> None: parser.add_argument('--build_dir', help='As in the make command, it specifies the build ' 'directory.', - type=str, default='.kunit', metavar='build_dir') + type=str, default='.kunit', metavar='build_dir') parser.add_argument('--make_options', help='X=Y make option, can be repeated.', action='append') @@ -246,8 +255,9 @@ def add_exec_opts(parser) -> None: action='append') def add_parse_opts(parser) -> None: - parser.add_argument('--raw_output', help='don\'t format output from kernel', - action='store_true') + parser.add_argument('--raw_output', help='If set don\'t format output from kernel. ' + 'If set to --raw_output=kunit, filters to just KUnit output.', + type=str, nargs='?', const='all', default=None) parser.add_argument('--json', nargs='?', help='Stores test results in a JSON, and either ' diff --git a/tools/testing/kunit/kunit_parser.py b/tools/testing/kunit/kunit_parser.py index b88db3f51dc5..84938fefbac0 100644 --- a/tools/testing/kunit/kunit_parser.py +++ b/tools/testing/kunit/kunit_parser.py @@ -106,10 +106,6 @@ def extract_tap_lines(kernel_output: Iterable[str]) -> LineStream: yield line_num, line[prefix_len:] return LineStream(lines=isolate_kunit_output(kernel_output)) -def raw_output(kernel_output) -> None: - for line in kernel_output: - print(line.rstrip()) - DIVIDER = '=' * 60 RESET = '\033[0;0m' diff --git a/tools/testing/kunit/kunit_tool_test.py b/tools/testing/kunit/kunit_tool_test.py index 628ab00f74bc..619c4554cbff 100755 --- a/tools/testing/kunit/kunit_tool_test.py +++ b/tools/testing/kunit/kunit_tool_test.py @@ -399,6 +399,15 @@ class KUnitMainTest(unittest.TestCase): self.assertNotEqual(call, mock.call(StrContains('Testing complete.'))) self.assertNotEqual(call, mock.call(StrContains(' 0 tests run'))) + def test_run_raw_output_kunit(self): + self.linux_source_mock.run_kernel = mock.Mock(return_value=[]) + kunit.main(['run', '--raw_output=kunit'], self.linux_source_mock) + self.assertEqual(self.linux_source_mock.build_reconfig.call_count, 1) + self.assertEqual(self.linux_source_mock.run_kernel.call_count, 1) + for call in self.print_mock.call_args_list: + self.assertNotEqual(call, mock.call(StrContains('Testing complete.'))) + self.assertNotEqual(call, mock.call(StrContains(' 0 tests run'))) + def test_exec_timeout(self): timeout = 3453 kunit.main(['exec', '--timeout', str(timeout)], self.linux_source_mock) base-commit: f684616e08e9cd9db3cd53fe2e068dfe02481657 -- 2.32.0.554.ge1b32706d8-goog

4 years, 2 months

1
1
0 0

[PATCH v2 2/3] kunit: Add support for suite initialization and cleanup

by Bart Van Assche

Reviewed-by: Brendan Higgins <brendanhiggins(a)google.com> Cc: David Gow <davidgow(a)google.com> Cc: Shuah Khan <skhan(a)linuxfoundation.org> Cc: kunit-dev(a)googlegroups.com Cc: linux-kselftest(a)vger.kernel.org Cc: Bodo Stroesser <bostroesser(a)gmail.com> Cc: Martin K. Petersen <martin.petersen(a)oracle.com> Cc: Yanko Kaneti <yaneti(a)declera.com> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- include/kunit/test.h | 4 ++++ lib/kunit/test.c | 14 ++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/include/kunit/test.h b/include/kunit/test.h index 24b40e5c160b..a6eef96a409c 100644 --- a/include/kunit/test.h +++ b/include/kunit/test.h @@ -215,6 +215,8 @@ static inline char *kunit_status_to_ok_not_ok(enum kunit_status status) * struct kunit_suite - describes a related collection of &struct kunit_case * * @name: the name of the test. Purely informational. + * @init_suite: called once per test suite before the test cases. + * @exit_suite: called once per test suite after all test cases. * @init: called before every test case. * @exit: called after every test case. * @test_cases: a null terminated array of test cases. @@ -229,6 +231,8 @@ static inline char *kunit_status_to_ok_not_ok(enum kunit_status status) */ struct kunit_suite { const char name[256]; + int (*init_suite)(void); + void (*exit_suite)(void); int (*init)(struct kunit *test); void (*exit)(struct kunit *test); struct kunit_case *test_cases; diff --git a/lib/kunit/test.c b/lib/kunit/test.c index d79ecb86ea57..c271692ced93 100644 --- a/lib/kunit/test.c +++ b/lib/kunit/test.c @@ -397,9 +397,19 @@ int kunit_run_tests(struct kunit_suite *suite) { char param_desc[KUNIT_PARAM_DESC_SIZE]; struct kunit_case *test_case; + int res = 0; kunit_print_subtest_start(suite); + if (suite->init_suite) + res = suite->init_suite(); + + if (res < 0) { + kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT + "# Suite initialization failed (%d)\n", res); + goto end; + } + kunit_suite_for_each_test_case(suite, test_case) { struct kunit test = { .param_value = NULL, .param_index = 0 }; test_case->status = KUNIT_SKIPPED; @@ -439,6 +449,10 @@ int kunit_run_tests(struct kunit_suite *suite) test.status_comment); } + if (suite->exit_suite) + suite->exit_suite(); + +end: kunit_print_subtest_end(suite); return 0;

4 years, 2 months

3
7
0 0

[PATCH v2 0/4] kselftest/arm64: Vector length configuration tests

by Mark Brown

Currently we don't have full automated tests for the vector length configuation ABIs offered for SVE, we have a helper binary for setting the vector length which can be used for manual tests and we use the prctl() interface to enumerate the vector lengths but don't actually verify that the vector lengths enumerated were set. This patch series provides a small helper which allows us to get the currently configured vector length using the RDVL instruction via either a library call or stdout of a process and then uses this to both add verification of enumerated vector lengths to our existing tests and also add a new test program which exercises both the prctl() and sysfs interfaces. In preparation for the forthcomng support for the Scalable Matrix Extension (SME) [1] which introduces a new vector length managed via a very similar hardware interface the helper and new test program are parameterised with the goal of allowing reuse for SME. [1] https://community.arm.com/developer/ip-products/processors/b/processors-ip-… v2: - Tweak log message on failure in sve-probe-vls. - Stylistic changes in vec-syscfg. - Flush stdout before forking in vec-syscfg. - Use EXIT_FAILURE. - Use fdopen() to get child output. - Replace a bunch of UNIX API usage with stdio. - Add a TODO list. - Verify that we're root before testing writes to /proc. Mark Brown (4): kselftest/arm64: Provide a helper binary and "library" for SVE RDVL kselftest/arm64: Validate vector lengths are set in sve-probe-vls kselftest/arm64: Add tests for SVE vector configuration kselftest/arm64: Add a TODO list for floating point tests tools/testing/selftests/arm64/fp/.gitignore | 2 + tools/testing/selftests/arm64/fp/Makefile | 11 +- tools/testing/selftests/arm64/fp/TODO | 3 + tools/testing/selftests/arm64/fp/rdvl-sve.c | 14 + tools/testing/selftests/arm64/fp/rdvl.S | 9 + tools/testing/selftests/arm64/fp/rdvl.h | 8 + .../selftests/arm64/fp/sve-probe-vls.c | 5 + tools/testing/selftests/arm64/fp/vec-syscfg.c | 580 ++++++++++++++++++ 8 files changed, 629 insertions(+), 3 deletions(-) create mode 100644 tools/testing/selftests/arm64/fp/TODO create mode 100644 tools/testing/selftests/arm64/fp/rdvl-sve.c create mode 100644 tools/testing/selftests/arm64/fp/rdvl.S create mode 100644 tools/testing/selftests/arm64/fp/rdvl.h create mode 100644 tools/testing/selftests/arm64/fp/vec-syscfg.c base-commit: ff1176468d368232b684f75e82563369208bc371 -- 2.20.1

4 years, 2 months

3
12
0 0

Re: [PATCH 3/4] kunit: Add support for suite initialization and cleanup

by Brendan Higgins

On Fri, Jul 23, 2021 at 2:24 PM Bart Van Assche <bvanassche(a)acm.org> wrote: > > Cc: Brendan Higgins <brendanhiggins(a)google.com> > Cc: Bodo Stroesser <bostroesser(a)gmail.com> > Cc: Martin K. Petersen <martin.petersen(a)oracle.com> > Cc: Yanko Kaneti <yaneti(a)declera.com> Please also CC davidgow(a)google.com, skhan(a)linuxfoundation.org, kunit-dev(a)googlegroups.com, and linux-kselftest(a)vger.kernel.org for KUnit changes in the future. > Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> This seems pretty sensible. Reviewed-by: Brendan Higgins <brendanhiggins(a)google.com> > --- > include/kunit/test.h | 4 ++++ > lib/kunit/test.c | 14 ++++++++++++++ > 2 files changed, 18 insertions(+) > > diff --git a/include/kunit/test.h b/include/kunit/test.h > index 24b40e5c160b..a6eef96a409c 100644 > --- a/include/kunit/test.h > +++ b/include/kunit/test.h > @@ -215,6 +215,8 @@ static inline char *kunit_status_to_ok_not_ok(enum kunit_status status) > * struct kunit_suite - describes a related collection of &struct kunit_case > * > * @name: the name of the test. Purely informational. > + * @init_suite: called once per test suite before the test cases. > + * @exit_suite: called once per test suite after all test cases. > * @init: called before every test case. > * @exit: called after every test case. > * @test_cases: a null terminated array of test cases. > @@ -229,6 +231,8 @@ static inline char *kunit_status_to_ok_not_ok(enum kunit_status status) > */ > struct kunit_suite { > const char name[256]; > + int (*init_suite)(void); > + void (*exit_suite)(void); I like this idea. Many other unit testing libraries in other languages have something similar. I think it probably makes sense to not use any kind of context object here (as you have done); nevertheless, I still think it is an appropriate question for the list. > int (*init)(struct kunit *test); > void (*exit)(struct kunit *test); > struct kunit_case *test_cases; > diff --git a/lib/kunit/test.c b/lib/kunit/test.c > index d79ecb86ea57..c271692ced93 100644 > --- a/lib/kunit/test.c > +++ b/lib/kunit/test.c > @@ -397,9 +397,19 @@ int kunit_run_tests(struct kunit_suite *suite) > { > char param_desc[KUNIT_PARAM_DESC_SIZE]; > struct kunit_case *test_case; > + int res = 0; > > kunit_print_subtest_start(suite); > > + if (suite->init_suite) > + res = suite->init_suite(); > + > + if (res < 0) { > + kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT > + "# Suite initialization failed (%d)\n", res); > + goto end; > + } > + > kunit_suite_for_each_test_case(suite, test_case) { > struct kunit test = { .param_value = NULL, .param_index = 0 }; > test_case->status = KUNIT_SKIPPED; > @@ -439,6 +449,10 @@ int kunit_run_tests(struct kunit_suite *suite) > test.status_comment); > } > > + if (suite->exit_suite) > + suite->exit_suite(); > + > +end: > kunit_print_subtest_end(suite); > > return 0;

4 years, 2 months

2
1
0 0

[PATCH v1 0/3] kselftest/arm64: Vector length configuration tests

by Mark Brown

Currently we don't have full automated tests for the vector length configuation ABIs offered for SVE, we have a helper binary for setting the vector length which can be used for manual tests and we use the prctl() interface to enumerate the vector lengths but don't actually verify that the vector lengths enumerated were set. This patch series provides a small helper which allows us to get the currently configured vector length using the RDVL instruction via either a library call or stdout of a process and then uses this to both add verification of enumerated vector lengths to our existing tests and also add a new test program which exercises both the prctl() and sysfs interfaces. In preparation for the forthcomng support for the Scalable Matrix Extension (SME) [1] which introduces a new vector length managed via a very similar hardware interface the helper and new test program are parameterised with the goal of allowing reuse for SME. [1] https://community.arm.com/developer/ip-products/processors/b/processors-ip-… Mark Brown (3): kselftest/arm64: Provide a helper binary and "library" for SVE RDVL kselftest/arm64: Validate vector lengths are set in sve-probe-vls kselftest/arm64: Add tests for SVE vector configuration tools/testing/selftests/arm64/fp/.gitignore | 2 + tools/testing/selftests/arm64/fp/Makefile | 11 +- tools/testing/selftests/arm64/fp/rdvl-sve.c | 14 + tools/testing/selftests/arm64/fp/rdvl.S | 9 + tools/testing/selftests/arm64/fp/rdvl.h | 8 + .../selftests/arm64/fp/sve-probe-vls.c | 5 + tools/testing/selftests/arm64/fp/vec-syscfg.c | 578 ++++++++++++++++++ 7 files changed, 624 insertions(+), 3 deletions(-) create mode 100644 tools/testing/selftests/arm64/fp/rdvl-sve.c create mode 100644 tools/testing/selftests/arm64/fp/rdvl.S create mode 100644 tools/testing/selftests/arm64/fp/rdvl.h create mode 100644 tools/testing/selftests/arm64/fp/vec-syscfg.c base-commit: ff1176468d368232b684f75e82563369208bc371 -- 2.20.1

4 years, 2 months

2
14
0 0

[PATCH] kernel/module: add documentation for try_module_get()

by Luis Chamberlain

There is quite a bit of tribal knowledge around proper use of try_module_get() and that it must be used only in a context which can ensure the module won't be gone during the operation. Document this little bit of tribal knowledge. Signed-off-by: Luis Chamberlain <mcgrof(a)kernel.org> --- kernel/module.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index ed13917ea5f3..0d609647a54d 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -1066,6 +1066,28 @@ void __module_get(struct module *module) } EXPORT_SYMBOL(__module_get); +/** + * try_module_get - yields to module removal and bumps reference count otherwise + * @module: the module we should check for + * + * This can be used to check if userspace has requested to remove a module, + * and if so let the caller give up. Otherwise it takes a reference count to + * ensure a request from userspace to remove the module cannot happen. + * + * Care must be taken to ensure the module cannot be removed during + * try_module_get(). This can be done by having another entity other than the + * module itself increment the module reference count, or through some other + * means which gaurantees the module could not be removed during an operation. + * An example of this later case is using this call in a sysfs file which the + * module created. The sysfs store / read file operation is ensured to exist + * and still be present by kernfs's active reference. If a sysfs file operation + * is being run, the module which created it must still exist as the module is + * in charge of removal of the sysfs file. + * + * The real value to try_module_get() is the module_is_live() check which + * ensures this the caller of try_module_get() can yields to userspace module + * removal requests and fail whatever it was about to process. + */ bool try_module_get(struct module *module) { bool ret = true; -- 2.30.2

4 years, 3 months

5
10
0 0

[PATCH] net: netfilter: Fix port selection of FTP for NF_NAT_RANGE_PROTO_SPECIFIED

by Cole Dishington

FTP port selection ignores specified port ranges (with iptables masquerade --to-ports) when creating an expectation, based on FTP commands PORT or PASV, for the data connection. Co-developed-by: Anthony Lineham <anthony.lineham(a)alliedtelesis.co.nz> Signed-off-by: Anthony Lineham <anthony.lineham(a)alliedtelesis.co.nz> Co-developed-by: Scott Parlane <scott.parlane(a)alliedtelesis.co.nz> Signed-off-by: Scott Parlane <scott.parlane(a)alliedtelesis.co.nz> Co-developed-by: Blair Steven <blair.steven(a)alliedtelesis.co.nz> Signed-off-by: Blair Steven <blair.steven(a)alliedtelesis.co.nz> Signed-off-by: Cole Dishington <Cole.Dishington(a)alliedtelesis.co.nz> --- Notes: Currently with iptables -t nat -j MASQUERADE -p tcp --to-ports 10000-10005, creating a passive ftp connection from a client will result in the control connection being within the specified port range but the data connection being outside of the range. This patch fixes this behaviour to have both connections be in the specified range. include/net/netfilter/nf_conntrack.h | 3 +++ net/netfilter/nf_nat_core.c | 10 ++++++---- net/netfilter/nf_nat_ftp.c | 26 ++++++++++++-------------- net/netfilter/nf_nat_helper.c | 12 ++++++++---- 4 files changed, 29 insertions(+), 22 deletions(-) diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h index cc663c68ddc4..b98d5d04c7ab 100644 --- a/include/net/netfilter/nf_conntrack.h +++ b/include/net/netfilter/nf_conntrack.h @@ -24,6 +24,8 @@ #include <net/netfilter/nf_conntrack_tuple.h> +#include <uapi/linux/netfilter/nf_nat.h> + struct nf_ct_udp { unsigned long stream_ts; }; @@ -99,6 +101,7 @@ struct nf_conn { #if IS_ENABLED(CONFIG_NF_NAT) struct hlist_node nat_bysource; + struct nf_nat_range2 range; #endif /* all members below initialized via memset */ struct { } __nfct_init_offset; diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index 7de595ead06a..4772c8457ef2 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -360,10 +360,10 @@ find_best_ips_proto(const struct nf_conntrack_zone *zone, * * Per-protocol part of tuple is initialized to the incoming packet. */ -static void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple, - const struct nf_nat_range2 *range, - enum nf_nat_manip_type maniptype, - const struct nf_conn *ct) +void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple, + const struct nf_nat_range2 *range, + enum nf_nat_manip_type maniptype, + const struct nf_conn *ct) { unsigned int range_size, min, max, i, attempts; __be16 *keyptr; @@ -586,6 +586,8 @@ nf_nat_setup_info(struct nf_conn *ct, &ct->tuplehash[IP_CT_DIR_REPLY].tuple); get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype); + if (range) + ct->range = *range; if (!nf_ct_tuple_equal(&new_tuple, &curr_tuple)) { struct nf_conntrack_tuple reply; diff --git a/net/netfilter/nf_nat_ftp.c b/net/netfilter/nf_nat_ftp.c index aace6768a64e..6794aa77162b 100644 --- a/net/netfilter/nf_nat_ftp.c +++ b/net/netfilter/nf_nat_ftp.c @@ -17,6 +17,10 @@ #include <net/netfilter/nf_conntrack_helper.h> #include <net/netfilter/nf_conntrack_expect.h> #include <linux/netfilter/nf_conntrack_ftp.h> +void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple, + const struct nf_nat_range2 *range, + enum nf_nat_manip_type maniptype, + const struct nf_conn *ct); #define NAT_HELPER_NAME "ftp" @@ -74,6 +78,7 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb, struct nf_conn *ct = exp->master; char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN]; unsigned int buflen; + int ret; pr_debug("type %i, off %u len %u\n", type, matchoff, matchlen); @@ -86,21 +91,14 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb, * this one. */ exp->expectfn = nf_nat_follow_master; - /* Try to get same port: if not, try to change it. */ - for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) { - int ret; - - exp->tuple.dst.u.tcp.port = htons(port); - ret = nf_ct_expect_related(exp, 0); - if (ret == 0) - break; - else if (ret != -EBUSY) { - port = 0; - break; - } - } + /* Find a port that matches the NAT rule */ + nf_nat_l4proto_unique_tuple(&exp->tuple, &ct->range, + dir ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST, + ct); + port = ntohs(exp->tuple.dst.u.tcp.port); + ret = nf_ct_expect_related(exp, 0); - if (port == 0) { + if ((ret != 0 && ret != -EBUSY) || port == 0) { nf_ct_helper_log(skb, ct, "all ports in use"); return NF_DROP; } diff --git a/net/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c index a263505455fc..912bf50be58a 100644 --- a/net/netfilter/nf_nat_helper.c +++ b/net/netfilter/nf_nat_helper.c @@ -184,10 +184,14 @@ void nf_nat_follow_master(struct nf_conn *ct, /* This must be a fresh one. */ BUG_ON(ct->status & IPS_NAT_DONE_MASK); - /* Change src to where master sends to */ - range.flags = NF_NAT_RANGE_MAP_IPS; - range.min_addr = range.max_addr - = ct->master->tuplehash[!exp->dir].tuple.dst.u3; + if (exp->master && !exp->dir) { + range = exp->master->range; + } else { + /* Change src to where master sends to */ + range.flags = NF_NAT_RANGE_MAP_IPS; + range.min_addr = ct->master->tuplehash[!exp->dir].tuple.dst.u3; + range.max_addr = ct->master->tuplehash[!exp->dir].tuple.dst.u3; + } nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC); /* For DST manip, map port here to where it's expected. */ -- 2.32.0

4 years, 3 months

2
1
0 0

[RFC PATCH v1 0/2] Introduce XSAVE/XRSTOR self-test

by Pengfei Xu

The XSAVE feature set supports the saving and restoring of state components such as FPU, which is used for process context switching. In order to ensure that XSAVE works correctly, add XSAVE basic test for XSAVE architecture functionality. This patch set tests XSAVE/XRSTOR instructions on x86 platforms and verify if the XSAVE/XRSTOR works correctly during signal handling. Cases such as signal handling, process creation, other xstate(except FPU) tests for XSAVE check, etc. will be added to the Linux kernel self-test. If appropriate, it is even planned to add the [1] mentioned XSAVE issues reproduce and some XSAVE anomaly tests to the kernel self-test. [1]: https://lore.kernel.org/lkml/0000000000004c453905c30f8334@google.com/ Pengfei Xu (2): selftests/xsave: test basic XSAVE architecture functionality selftests/xsave: add xsave test during signal handling tools/testing/selftests/Makefile | 1 + tools/testing/selftests/xsave/.gitignore | 3 + tools/testing/selftests/xsave/Makefile | 6 + tools/testing/selftests/xsave/xsave_common.h | 246 ++++++++++++++++++ .../selftests/xsave/xsave_instruction.c | 83 ++++++ .../selftests/xsave/xsave_signal_handle.c | 184 +++++++++++++ 6 files changed, 523 insertions(+) create mode 100644 tools/testing/selftests/xsave/.gitignore create mode 100644 tools/testing/selftests/xsave/Makefile create mode 100644 tools/testing/selftests/xsave/xsave_common.h create mode 100644 tools/testing/selftests/xsave/xsave_instruction.c create mode 100644 tools/testing/selftests/xsave/xsave_signal_handle.c -- 2.20.1

4 years, 3 months

2
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror