Page MenuHomeFreeBSD
Differential D16448

Add tests for various other ioctls for auditpipe(4)
Needs ReviewPublic
Actions

Authored by aniketp on Jul 26 2018, 7:06 AM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Apr 16, 8:08 PM
Unknown Object (File)
Sat, Apr 12, 5:21 AM
Unknown Object (File)
Mar 16 2025, 1:40 PM
Unknown Object (File)
Mar 14 2025, 10:27 AM
Unknown Object (File)
Jan 25 2025, 7:50 PM
Unknown Object (File)
Jan 25 2025, 7:18 PM
Unknown Object (File)
Jan 18 2025, 10:22 PM
Unknown Object (File)
Jan 18 2025, 5:22 PM
View All 82 Files
Subscribers
gnn
rwatson

Details

Reviewers
asomers
Summary

This revision introduces regression tests for various other ioctls for auditpipe. The ioctls are:

  • AUDITPIPE_GET_MAXAUDITDATA
  • AUDITPIPE_GET_PRESELECT_MODE
  • AUDITPIPE_SET_PRESELECT_MODE
  • AUDITPIPE_GET_PRESELECT_FLAGS
  • AUDITPIPE_SET_PRESELECT_FLAGS
  • AUDITPIPE_GET_PRESELECT_NAFLAGS
  • AUDITPIPE_SET_PRESELECT_NAFLAGS

Other important properties are also tested:

  • auditpipe_qlimit_less_than_qlimit_max
  • auditpipe_qlimit_more_than_qlimit_min
Test Plan

Execute make && make install from test/sys/auditpipe.
Execute kyua test from /usr/tests/sys/auditpipe. All testcases should succeed.

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 18382
Build 18097: arc lint + arc unit

Event Timeline

aniketp created this revision.Jul 26 2018, 7:06 AM
Harbormaster completed remote builds in B18342: Diff 45859.Jul 26 2018, 7:06 AM
asomers requested changes to this revision.Jul 27 2018, 4:49 PM

Looks mostly good, except for the FLUSH test. As written, that one isn't going to be reliable.

tests/sys/auditpipe/auditpipe_test.c
229

This test isn't going to be reliable. You have no way to be sure that more auditable events didn't arrive after the flush but before AUDITPIPE_GET_QLEN.

This revision now requires changes to proceed.Jul 27 2018, 4:49 PM
aniketp updated this revision to Diff 45927.Jul 27 2018, 8:31 PM
  • Check if auditing was enabled before AUDITPIPE_FLUSH test
Harbormaster completed remote builds in B18382: Diff 45927.Jul 27 2018, 8:31 PM
asomers requested changes to this revision.Jul 27 2018, 8:34 PM
asomers added inline comments.
tests/sys/auditpipe/auditpipe_test.c
234

Nope. In order for this technique to work, you need to stop auditing _before_ AUDITPIPE_FLUSH.

243

This needs to happen in the cleanup step, not in the body.

This revision now requires changes to proceed.Jul 27 2018, 8:34 PM
aniketp updated this revision to Diff 45928.Jul 27 2018, 8:41 PM
  • Move auditon code before starting calling AUDITPIPE_FLUSH
Harbormaster completed remote builds in B18383: Diff 45928.Jul 27 2018, 8:41 PM
aniketp added inline comments.Jul 27 2018, 8:41 PM
tests/sys/auditpipe/auditpipe_test.c
243

But I've changed

ATF_REQUIRE_EQ(0, ioctl(filedesc, AUDITPIPE_GET_QLEN, &qlen));
ATF_REQUIRE_EQ(0, qlen);

to

ATF_CHECK_EQ(0, ioctl(filedesc, AUDITPIPE_GET_QLEN, &qlen));
ATF_CHECK_EQ(0, qlen);

for the same reason that the test case won't stop even if the require condition fails

asomers requested changes to this revision.Jul 27 2018, 8:54 PM
asomers added inline comments.
tests/sys/auditpipe/auditpipe_test.c
232

What happens if aucond was anything else? Then the test will be pointless, because there won't be anything in the audit trail. In that case, you should skip it. Or, start auditd just like you do in the audit tests.

235

This won't work either. By opening the auditpipe after pausing auditing, you're guaranteeing that the queue will be empty even before AUDITPIPE_FLUSH. You need to:

  1. Open auditpipe
  2. Cause something auditable to happen so the pipe gets data
  3. Suspend auditing
  4. Flush the pipe
  5. verify qlen == 0
243

Ok, I guess that's fine. Not universally, but it should be ok for this test. I say not universally, because something like a segfault could always prevent the tests's body from completing. But in this case I don't think there's anyway for the test to crash that wouldn't also be a possibility for the cleanup step.

This revision now requires changes to proceed.Jul 27 2018, 8:54 PM
aniketp updated this revision to Diff 45989.EditedJul 29 2018, 1:03 PM
  • Add auditable startup and closeup events if auditd(8) was not already running
Harbormaster completed remote builds in B18415: Diff 45989.Jul 29 2018, 1:04 PM
asomers added inline comments.Jul 29 2018, 3:01 PM
tests/sys/auditpipe/auditpipe_test.c
235

Does this statement (or the one two lines above) cause an audit entry? If not, then the queue still may be empty before you flush it.

Revision Contents
Changeset List

PathSize
tests/
sys/
auditpipe/
229 lines

Diff 45927

View Options

tests/sys/auditpipe/auditpipe_test.c

Show First 20 Lines • Show All 249 Lines • ▼ Show 20 Linesenum tcp_log_events {
BBR_LOG_SRTT_GAIN_EVENT, /* SRTT gaining -- now not used 49 */ BBR_LOG_SRTT_GAIN_EVENT, /* SRTT gaining -- now not used 49 */
TCP_LOG_REASS, /* Reassembly buffer logging 50 */ TCP_LOG_REASS, /* Reassembly buffer logging 50 */
TCP_HDWR_PACE_SIZE, /* TCP pacing size set (rl and rack uses this) 51 */ TCP_HDWR_PACE_SIZE, /* TCP pacing size set (rl and rack uses this) 51 */
BBR_LOG_HDWR_PACE, /* TCP Hardware pacing log 52 */ BBR_LOG_HDWR_PACE, /* TCP Hardware pacing log 52 */
BBR_LOG_TSTMP_VAL, /* Temp debug timestamp validation 53 */ BBR_LOG_TSTMP_VAL, /* Temp debug timestamp validation 53 */
TCP_LOG_CONNEND, /* End of connection 54 */ TCP_LOG_CONNEND, /* End of connection 54 */
TCP_LOG_LRO, /* LRO entry 55 */ TCP_LOG_LRO, /* LRO entry 55 */
TCP_SACK_FILTER_RES, /* Results of SACK Filter 56 */ TCP_SACK_FILTER_RES, /* Results of SACK Filter 56 */
TCP_SAD_DETECTION, /* Sack Attack Detection 57 */ TCP_SAD_DETECT, /* Sack Attack Detection 57 */
ccUnsubmitted
Done
Inline Actions

Please adjust the alignment of the comment.

cc: Please adjust the alignment of the comment.
TCP_TIMELY_WORK, /* Logs regarding Timely CC tweaks 58 */ TCP_TIMELY_WORK, /* Logs regarding Timely CC tweaks 58 */
TCP_LOG_USER_EVENT, /* User space event data 59 */ TCP_LOG_USER_EVENT, /* User space event data 59 */
TCP_LOG_SENDFILE, /* sendfile() logging for TCP connections 60 */ TCP_LOG_SENDFILE, /* sendfile() logging for TCP connections 60 */
TCP_LOG_HTTP_T, /* logging of http request tracking 61 */ TCP_LOG_HTTP_T, /* logging of http request tracking 61 */
TCP_LOG_ACCOUNTING, /* Log of TCP Accounting data 62 */ TCP_LOG_ACCOUNTING, /* Log of TCP Accounting data 62 */
TCP_LOG_FSB, /* FSB information 63 */ TCP_LOG_FSB, /* FSB information 63 */
RACK_DSACK_HANDLING, /* Handling of DSACK in rack for reordering window 64 */ RACK_DSACK_HANDLING, /* Handling of DSACK in rack for reordering window 64 */
TCP_HYSTART, /* TCP Hystart logging 65 */ TCP_HYSTART, /* TCP Hystart logging 65 */
▲ Show 20 Lines • Show All 332 Lines • Show Last 20 Lines