tests: add tests for db_chain_lt()

Add a test to improve the test coverage for db_chain_lt().

Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>
[PM: stripped the conversion from a macro to function, kept the test]
Signed-off-by: Paul Moore <paul@paul-moore.com>

5 files changed, 179 insertions, 3 deletions

diff --git a/tests/.gitignore b/tests/.gitignore
index 8b89252..1ead61f 100644
--- a/tests/.gitignore
+++ b/tests/.gitignore
@@ -50,3 +50,4 @@ util.pyc
 42-sim-adv_chains
 43-sim-a2_order
 44-live-a2_order
+45-sim-chain_code_coverage
diff --git a/tests/45-sim-chain_code_coverage.c b/tests/45-sim-chain_code_coverage.c
new file mode 100644
index 0000000..1ae8dab
--- /dev/null
+++ b/tests/45-sim-chain_code_coverage.c
@@ -0,0 +1,108 @@
+/**
+ * Seccomp Library test program
+ *
+ * Copyright (c) 2018 Oracle and/or its affiliates.  All rights reserved.
+ * Author: Tom Hromatka <tom.hromatka@oracle.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdbool.h>
+
+#include <seccomp.h>
+
+#include "util.h"
+
+int main(int argc, char *argv[])
+{
+	int rc;
+	struct util_options opts;
+	scmp_filter_ctx ctx = NULL;
+
+	rc = util_getopt(argc, argv, &opts);
+	if (rc < 0)
+		goto out;
+
+	ctx = seccomp_init(SCMP_ACT_KILL);
+	if (ctx == NULL)
+		return ENOMEM;
+
+	/* the syscall and argument numbers are all fake to make the test
+	 * simpler */
+
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 1,
+				    SCMP_A0(SCMP_CMP_GE, 1));
+	if (rc != 0)
+		goto out;
+
+	/* db_chain_lt() path #1 - due to "A1" > "A0" */
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 1,
+				    SCMP_A1(SCMP_CMP_GE, 2));
+	if (rc != 0)
+		goto out;
+
+	/* db_chain_lt() path #2 - due to "GT" > "GE" */
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 1,
+				    SCMP_A0(SCMP_CMP_GT, 3));
+	if (rc != 0)
+		goto out;
+
+	/* db_chain_lt() path #3 - due to the second mask (0xff) being greater
+	 * than the first (0xf) */
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 1,
+				    SCMP_A2(SCMP_CMP_MASKED_EQ, 0xf, 4));
+	if (rc != 0)
+		goto out;
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 1,
+				    SCMP_A2(SCMP_CMP_MASKED_EQ, 0xff, 5));
+	if (rc != 0)
+		goto out;
+
+	/* db_chain_lt() path #4 - due to datum (6) > previous datum (5) */
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 1,
+				    SCMP_A2(SCMP_CMP_MASKED_EQ, 0xff, 6));
+	if (rc != 0)
+		goto out;
+
+	/* attempt to hit some of the lvl_prv and lvl_nxt code in db.c */
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 5,
+				    SCMP_A0(SCMP_CMP_NE, 7),
+				    SCMP_A1(SCMP_CMP_LT, 8),
+				    SCMP_A2(SCMP_CMP_EQ, 9),
+				    SCMP_A3(SCMP_CMP_GE, 10),
+				    SCMP_A4(SCMP_CMP_GT, 11),
+				    SCMP_A5(SCMP_CMP_MASKED_EQ, 0xffff, 12));
+	if (rc != 0)
+		goto out;
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, 1008, 5,
+				    SCMP_A0(SCMP_CMP_NE, 7),
+				    SCMP_A1(SCMP_CMP_LT, 8),
+				    SCMP_A2(SCMP_CMP_EQ, 9),
+				    SCMP_A3(SCMP_CMP_GE, 10),
+				    SCMP_A4(SCMP_CMP_GT, 11),
+				    SCMP_A5(SCMP_CMP_MASKED_EQ, 0xffff, 13));
+	if (rc != 0)
+		goto out;
+
+	rc = util_filter_output(&opts, ctx);
+	if (rc)
+		goto out;
+
+out:
+	seccomp_release(ctx);
+	return (rc < 0 ? -rc : rc);
+}
diff --git a/tests/45-sim-chain_code_coverage.py b/tests/45-sim-chain_code_coverage.py
new file mode 100755
index 0000000..32ea547
--- /dev/null
+++ b/tests/45-sim-chain_code_coverage.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+
+#
+# Seccomp Library test program
+#
+# Copyright (c) 2018 Oracle and/or its affiliates.  All rights reserved.
+# Author: Tom Hromatka <tom.hromatka@oracle.com>
+#
+
+#
+# This library is free software; you can redistribute it and/or modify it
+# under the terms of version 2.1 of the GNU Lesser General Public License as
+# published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+# for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library; if not, see <http://www.gnu.org/licenses>.
+#
+
+import argparse
+import sys
+
+import util
+
+from seccomp import *
+
+def test(args):
+    f = SyscallFilter(KILL)
+    # the syscall and argument numbers are all fake to make the test simpler
+    f.add_rule_exactly(ALLOW, 1008, Arg(0, GE, 1))
+    f.add_rule_exactly(ALLOW, 1008, Arg(1, GE, 2))
+    f.add_rule_exactly(ALLOW, 1008, Arg(0, GT, 3))
+    f.add_rule_exactly(ALLOW, 1008, Arg(2, MASKED_EQ, 0xf, 4))
+    f.add_rule_exactly(ALLOW, 1008, Arg(2, MASKED_EQ, 0xff, 5))
+    f.add_rule_exactly(ALLOW, 1008, Arg(2, MASKED_EQ, 0xff, 6))
+
+    return f
+
+args = util.get_opt()
+ctx = test(args)
+util.filter_output(args, ctx)
+
+# kate: syntax python;
+# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;
diff --git a/tests/45-sim-chain_code_coverage.tests b/tests/45-sim-chain_code_coverage.tests
new file mode 100644
index 0000000..482f6e9
--- /dev/null
+++ b/tests/45-sim-chain_code_coverage.tests
@@ -0,0 +1,16 @@
+#
+# libseccomp regression test automation data
+#
+# Copyright (c) 2018 Oracle and/or its affiliates.  All rights reserved.
+# Author: Tom Hromatka <tom.hromatka@oracle.com>
+#
+
+test type: bpf-sim
+
+# Testname			Arch	Syscall	Arg0	Arg1	Arg2	Arg3	Arg4	Arg5	Result
+45-sim-chain_code_coverage	all	1008	1	1	1	1	1	1	ALLOW
+45-sim-chain_code_coverage	all	1008	1	2	1	1	1	1	ALLOW
+45-sim-chain_code_coverage	all	1008	4	1	1	1	1	1	ALLOW
+45-sim-chain_code_coverage	all	1008	1	1	0x14	1	1	1	ALLOW
+45-sim-chain_code_coverage	all	1008	4	1	0x15	1	1	1	ALLOW
+45-sim-chain_code_coverage	all	1008	4	1	0x106	1	1	1	ALLOW
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 844c403..6cd8130 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -83,7 +83,8 @@ check_PROGRAMS = \
 	41-sim-syscall_priority_arch \
 	42-sim-adv_chains \
 	43-sim-a2_order \
-	44-live-a2_order
+	44-live-a2_order \
+	45-sim-chain_code_coverage
 
 EXTRA_DIST_TESTPYTHON = \
 	util.py \
@@ -128,7 +129,8 @@ EXTRA_DIST_TESTPYTHON = \
 	41-sim-syscall_priority_arch.py \
 	42-sim-adv_chains.py \
 	43-sim-a2_order.py \
-	44-live-a2_order.py
+	44-live-a2_order.py \
+	45-sim-chain_code_coverage.py
 
 EXTRA_DIST_TESTCFGS = \
 	01-sim-allow.tests \
@@ -174,7 +176,8 @@ EXTRA_DIST_TESTCFGS = \
 	41-sim-syscall_priority_arch.tests \
 	42-sim-adv_chains.tests \
 	43-sim-a2_order.tests \
-	44-live-a2_order.tests
+	44-live-a2_order.tests \
+	45-sim-chain_code_coverage.tests
 
 EXTRA_DIST_TESTSCRIPTS = \
 	38-basic-pfc_coverage.sh 38-basic-pfc_coverage.pfc