summaryrefslogtreecommitdiffstats
path: root/recipes-mac/smack/udp-smack-test
diff options
context:
space:
mode:
authorArmin Kuster <akuster808@gmail.com>2019-05-06 11:36:58 -0700
committerArmin Kuster <akuster808@gmail.com>2019-05-09 17:45:13 -0700
commit8eee8727cb09a9fc14e899b4058fcd108f44a0eb (patch)
treee6cd90e7b08c098e425a8d0efbb29fd88fc9ee2e /recipes-mac/smack/udp-smack-test
parent5d37937f2e495147fd2a756d22c09f49773ac8ae (diff)
downloadmeta-security-8eee8727cb09a9fc14e899b4058fcd108f44a0eb.tar.gz
smack-test: add smack tests from meta-intel-iot-security
ported over smack tests Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'recipes-mac/smack/udp-smack-test')
-rw-r--r--recipes-mac/smack/udp-smack-test/test_smack_udp_sockets.sh107
-rw-r--r--recipes-mac/smack/udp-smack-test/udp_client.c75
-rw-r--r--recipes-mac/smack/udp-smack-test/udp_server.c93
3 files changed, 275 insertions, 0 deletions
diff --git a/recipes-mac/smack/udp-smack-test/test_smack_udp_sockets.sh b/recipes-mac/smack/udp-smack-test/test_smack_udp_sockets.sh
new file mode 100644
index 0000000..419ab9f
--- /dev/null
+++ b/recipes-mac/smack/udp-smack-test/test_smack_udp_sockets.sh
@@ -0,0 +1,107 @@
1#!/bin/sh
2RC=0
3test_file="/tmp/smack_socket_udp"
4SMACK_PATH=`grep smack /proc/mounts | awk '{print $2}' `
5
6udp_server=`which udp_server`
7if [ -z $udp_server ]; then
8 if [ -f "/tmp/udp_server" ]; then
9 udp_server="/tmp/udp_server"
10 else
11 echo "udp_server binary not found"
12 exit 1
13 fi
14fi
15udp_client=`which udp_client`
16if [ -z $udp_client ]; then
17 if [ -f "/tmp/udp_client" ]; then
18 udp_client="/tmp/udp_client"
19 else
20 echo "udp_client binary not found"
21 exit 1
22 fi
23fi
24
25# make sure no access is granted
26# 12345678901234567890123456789012345678901234567890123456
27echo -n "label1 label2 -----" > $SMACK_PATH/load
28
29# checking access for sockets with different labels
30$udp_server 50021 label2 2>$test_file &
31server_pid=$!
32sleep 1
33$udp_client 50021 label1 2>$test_file &
34client_pid=$!
35wait $server_pid
36server_rv=$?
37wait $client_pid
38client_rv=$?
39if [ $server_rv -eq 0 ]; then
40 echo "Sockets with different labels should not communicate on udp"
41 exit 1
42fi
43
44# granting access between different labels
45# 12345678901234567890123456789012345678901234567890123456
46echo -n "label1 label2 rw---" > $SMACK_PATH/load
47# checking access for sockets with different labels, but having a rule granting rw
48$udp_server 50022 label2 2>$test_file &
49server_pid=$!
50sleep 1
51$udp_client 50022 label1 2>$test_file &
52client_pid=$!
53wait $server_pid
54server_rv=$?
55wait $client_pid
56client_rv=$?
57if [ $server_rv -ne 0 -o $client_rv -ne 0 ]; then
58 echo "Sockets with different labels, but having rw access, should communicate on udp"
59 exit 1
60fi
61
62# checking access for sockets with the same label
63$udp_server 50023 label1 &
64server_pid=$!
65sleep 1
66$udp_client 50023 label1 2>$test_file &
67client_pid=$!
68wait $server_pid
69server_rv=$?
70wait $client_pid
71client_rv=$?
72if [ $server_rv -ne 0 -o $client_rv -ne 0 ]; then
73 echo "Sockets with same labels should communicate on udp"
74 exit 1
75fi
76
77# checking access on socket labeled star (*)
78# should always be permitted
79$udp_server 50024 \* 2>$test_file &
80server_pid=$!
81sleep 1
82$udp_client 50024 label1 2>$test_file &
83client_pid=$!
84wait $server_pid
85server_rv=$?
86wait $client_pid
87client_rv=$?
88if [ $server_rv -ne 0 -o $client_rv -ne 0 ]; then
89 echo "Should have access on udp socket labeled star (*)"
90 exit 1
91fi
92
93# checking access from socket labeled star (*)
94# all access from subject star should be denied
95$udp_server 50025 label1 2>$test_file &
96server_pid=$!
97sleep 1
98$udp_client 50025 \* 2>$test_file &
99client_pid=$!
100wait $server_pid
101server_rv=$?
102wait $client_pid
103client_rv=$?
104if [ $server_rv -eq 0 ]; then
105 echo "Socket labeled star should not have access to any udp socket"
106 exit 1
107fi
diff --git a/recipes-mac/smack/udp-smack-test/udp_client.c b/recipes-mac/smack/udp-smack-test/udp_client.c
new file mode 100644
index 0000000..4d3afbe
--- /dev/null
+++ b/recipes-mac/smack/udp-smack-test/udp_client.c
@@ -0,0 +1,75 @@
1// (C) Copyright 2015 Intel Corporation
2//
3// Permission is hereby granted, free of charge, to any person obtaining a copy
4// of this software and associated documentation files (the "Software"), to deal
5// in the Software without restriction, including without limitation the rights
6// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
7// copies of the Software, and to permit persons to whom the Software is
8// furnished to do so, subject to the following conditions:
9//
10// The above copyright notice and this permission notice shall be included in
11// all copies or substantial portions of the Software.
12//
13// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
14// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
16// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
17// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
18// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
19// THE SOFTWARE.
20#include <sys/socket.h>
21#include <stdio.h>
22#include <netinet/in.h>
23#include <netdb.h>
24#include <string.h>
25
26int main(int argc, char* argv[])
27{
28 char* message = "hello";
29 int sock, ret;
30 struct sockaddr_in server_addr;
31 struct hostent* host = gethostbyname("localhost");
32 char* label;
33 char* attr = "security.SMACK64IPOUT";
34 int port;
35 if (argc != 3)
36 {
37 perror("Client: Argument missing, please provide port and label for SMACK64IPOUT");
38 return 2;
39 }
40
41 port = atoi(argv[1]);
42 label = argv[2];
43 sock = socket(AF_INET, SOCK_DGRAM,0);
44 if(sock < 0)
45 {
46 perror("Client: Socket failure");
47 return 2;
48 }
49
50
51 if(fsetxattr(sock, attr, label, strlen(label),0) < 0)
52 {
53 perror("Client: Unable to set attribute ");
54 return 2;
55 }
56
57
58 server_addr.sin_family = AF_INET;
59 server_addr.sin_port = htons(port);
60 bcopy((char*) host->h_addr, (char*) &server_addr.sin_addr.s_addr,host->h_length);
61 bzero(&(server_addr.sin_zero),8);
62
63 ret = sendto(sock, message, strlen(message),0,(const struct sockaddr*)&server_addr,
64 sizeof(struct sockaddr_in));
65
66 close(sock);
67 if(ret < 0)
68 {
69 perror("Client: Error sending message\n");
70 return 1;
71 }
72
73 return 0;
74}
75
diff --git a/recipes-mac/smack/udp-smack-test/udp_server.c b/recipes-mac/smack/udp-smack-test/udp_server.c
new file mode 100644
index 0000000..cbab71e
--- /dev/null
+++ b/recipes-mac/smack/udp-smack-test/udp_server.c
@@ -0,0 +1,93 @@
1// (C) Copyright 2015 Intel Corporation
2//
3// Permission is hereby granted, free of charge, to any person obtaining a copy
4// of this software and associated documentation files (the "Software"), to deal
5// in the Software without restriction, including without limitation the rights
6// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
7// copies of the Software, and to permit persons to whom the Software is
8// furnished to do so, subject to the following conditions:
9//
10// The above copyright notice and this permission notice shall be included in
11// all copies or substantial portions of the Software.
12//
13// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
14// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
16// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
17// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
18// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
19// THE SOFTWARE.
20#include <sys/socket.h>
21#include <stdio.h>
22#include <netinet/in.h>
23#include <netdb.h>
24#include <string.h>
25
26int main(int argc, char* argv[])
27{
28 int sock,ret;
29 struct sockaddr_in server_addr, client_addr;
30 socklen_t len;
31 char message[5];
32 char* label;
33 char* attr = "security.SMACK64IPIN";
34 int port;
35
36 if(argc != 3)
37 {
38 perror("Server: Argument missing, please provide port and label for SMACK64IPIN");
39 return 2;
40 }
41
42 port = atoi(argv[1]);
43 label = argv[2];
44
45 struct timeval timeout;
46 timeout.tv_sec = 15;
47 timeout.tv_usec = 0;
48
49 sock = socket(AF_INET,SOCK_DGRAM,0);
50 if(sock < 0)
51 {
52 perror("Server: Socket error");
53 return 2;
54 }
55
56
57 if(fsetxattr(sock, attr, label, strlen(label), 0) < 0)
58 {
59 perror("Server: Unable to set attribute ");
60 return 2;
61 }
62
63 server_addr.sin_family = AF_INET;
64 server_addr.sin_port = htons(port);
65 server_addr.sin_addr.s_addr = INADDR_ANY;
66 bzero(&(server_addr.sin_zero),8);
67
68
69 if(setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) < 0)
70 {
71 perror("Server: Set timeout failed\n");
72 return 2;
73 }
74
75 if(bind(sock, (struct sockaddr*) &server_addr, sizeof(server_addr)) < 0)
76 {
77 perror("Server: Bind failure");
78 return 2;
79 }
80
81 len = sizeof(client_addr);
82 ret = recvfrom(sock, message, sizeof(message), 0, (struct sockaddr*)&client_addr,
83 &len);
84 close(sock);
85 if(ret < 0)
86 {
87 perror("Server: Error receiving");
88 return 1;
89
90 }
91 return 0;
92}
93
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-26 10:30:18 +0000