CTL: add ATF tests for REPORT SUPPORTED OPCODES

[asomers]

Summary

This includes a regression test for CVE-2024-42416

MFC after: 2 weeks
Sponsored by: Axcient

[asomers]

Note that some of these tests, including the CVE-2024-4241 regression test, depend on a recent unreleased change in sg3_utils. For now, you can only get it by building sg3_utils from its git source.

[asomers]

I've avoided committing this so far because of the sg3_utils dependency. But I really don't want to leave it in Phabricator forever. Doug Gilbert is back at his keyboard again, and probably will release at some point. Shall I go ahead and commit now?

[emaste]

How about commenting out the Makefile change for now with a comment about needing newer sg3_utils?

[asomers]

In D46613#1290787, @emaste wrote:

How about commenting out the Makefile change for now with a comment about needing newer sg3_utils?

I think that's overkill, given that some of the test cases don't need the newer version.

[emaste]

Do newly added tests report failure if sg3_utils is not updated?

[asomers]

In D46613#1290789, @emaste wrote:

Do newly added tests report failure if sg3_utils is not updated?

They'll check the version, and report "skipped" if it's too old.

[emaste]

Oh, in that case I think it's fine.