summaryrefslogtreecommitdiff
path: root/test/fuzz
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #27651 from mrc0mmand/more-nspawn-testsFrantisek Sumsal2023-05-161-20/+227
|\ | | | | nspawn: OCI related fixes & tests
| * fuzz: update the base JSON for fuzz-nspawn-ociFrantisek Sumsal2023-05-161-20/+227
| |
* | Merge pull request #27638 from YHNdnzj/upheldby-unit-fileMike Yuan2023-05-161-0/+2
|\ \ | |/ |/| unit-file: support UpheldBy= in [Install] settings (adding Upholds= deps from .upholds/)
| * test: add tests for UpheldBy= in [Install] sectionMike Yuan2023-05-151-0/+2
| |
* | test: update nspawn's basic config file used for fuzzingFrantisek Sumsal2023-05-151-3/+32
|/
* core: fix memory leak during deserializationFrantisek Sumsal2023-05-131-0/+6
| | | | | | when activation-details-unit-name is encountered multiple times. Resolves: #27623
* test: add a test case for #27521Frantisek Sumsal2023-05-051-0/+0
| | | | Which got resolved by e652663a04.
* core: check the unit type more thoroughly when deserializingFrantisek Sumsal2023-05-051-0/+4
| | | | Resolves: #27523
* shared: refuse fd == INT_MAXFrantisek Sumsal2023-05-051-0/+3
| | | | | | | Since we do `FD_TO_PTR(fd)` that expands to `INT_TO_PTR(fd) + 1` which triggers an integer overflow. Resolves: #27522
* shared: reject empty attachment pathFrantisek Sumsal2023-05-031-0/+11
|
* shared: ignore invalid valink socket fd when deserializingFrantisek Sumsal2023-05-031-0/+5
|
* core: fix NULL pointer dereference during deserializationFrantisek Sumsal2023-05-031-0/+10
|
* test: add a simple fuzzer for manager serializationFrantisek Sumsal2023-05-031-0/+233
|
* udev/scsi_id: rename positional argumentsYu Watanabe2023-04-112-4/+4
|
* systemctl: refuse to acquire dbus connection with --globalYu Watanabe2023-03-131-0/+0
| | | | | | | | | Maybe, better to check the runtime scope each verb for better log message, but this is a good start point to not trigger assertion. Fixes oss-fuzz#56915 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56915). Fixes #26402 and #26754.
* core: add missing MemoryPressureWatch= and MemoryPressureThresholdSec= settingYu Watanabe2023-03-091-0/+2
| | | | | | Follow-up for #26393. Addresses https://github.com/systemd/systemd/pull/26393#issuecomment-1458655798.
* meson: Copy files with git only in true git repositoryMichal Koutný2023-03-021-1/+1
| | | | | | | | | | | | | When mkosi is run from git-worktree(1), the .git is not a repository directory but a textfile pointing to the real git dir (e.g. /home/user/systemd/.git/worktrees/systemd-worktree). This git dir is not bind mounted into build environment and it fails with: > fatal: not a git repository: /home/user/systemd/.git/worktrees/systemd-worktree > test/meson.build:190:16: ERROR: Command `/usr/bin/env -u GIT_WORK_TREE /usr/bin/git --git-dir=/root/src/.git ls-files ':/test/dmidecode-dumps/*.bin'` failed with status 128. There is already a fallback to use shell globbing instead of ls-files, use it with git worktrees as well.
* journal: log filtering options support in PID1Quentin Deslandes2022-12-151-0/+1
| | | | | | | | | Define new unit parameter (LogFilterPatterns) to filter logs processed by journald. This option is used to store a regular expression which is carried from PID1 to systemd-journald through a cgroup xattrs: `user.journald_log_filter_patterns`.
* resolve: dedup entries in /etc/hostsYu Watanabe2022-12-131-0/+0
| | | | | | | | | | | | | | | | | | | | This improves the performance of parsing the file and reduces memory pressure. Running 'fuzz-etc-hosts timeout-strv' with valgrind, Before: total heap usage: 321,020 allocs, 321,020 frees, 15,820,387,193 bytes allocated real 0m23.531s user 0m21.458s sys 0m1.961s After: total heap usage: 112,408 allocs, 112,408 frees, 7,297,480 bytes allocated real 0m8.664s user 0m8.545s sys 0m0.065s Hopefully fixes oss-fuzz#47708 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47708).
* fuzz: shorten filename of testcaseYu Watanabe2022-12-092-0/+0
| | | | | Follow-up for 46dc071985ff487f5ccf20808531168a6add73d3 and 76519cecc749a3d0e2054fd6db8a99143666e123.
* resolve: optimize conversion of TXT fields to jsonYu Watanabe2022-12-091-0/+0
| | | | | | Fixes oss-fuzz#54080 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54080). Fixes #25654.
* hexdecoct: fix NULL pointer dereferences in hexmem()Yu Watanabe2022-12-091-0/+0
| | | | | | Fixes oss-fuzz#54090 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54090). Fixes #25655.
* hexdecoct: add missing NULL checkYu Watanabe2022-12-091-0/+0
| | | | | | Fixes oss-fuzz#54065 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54065). Fixes #25650.
* escape: fix wrong octescape of bad characterYu Watanabe2022-12-061-0/+0
| | | | | | | | | | Fixes a bug introduced by 95052df3760523e1f3bb9705c918d85aae7fb431. This also makes octescape() support NULL or zero length string. Fixes [oss-fuzz#54059](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54059). Fixes #25643.
* Merge pull request #25537 from evverx/fuzz-resource-recordsZbigniew Jędrzejewski-Szmek2022-12-052-0/+0
|\ | | | | tests: fuzz dns resource records
| * tests: add a file triggering "applying zero offset to null pointer"Evgeny Vereshchagin2022-11-261-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ``` ../src/basic/hexdecoct.c:66:44: runtime error: applying zero offset to null pointer #0 0x7f6022650c44 in hexmem /home/vagrant/systemd/build-fuzzers/../src/basic/hexdecoct.c:66:44 #1 0x577583 in dns_resource_record_to_string /home/vagrant/systemd/build-fuzzers/../src/resolve/resolved-dns-rr.c:1140:21 #2 0x563669 in LLVMFuzzerTestOneInput /home/vagrant/systemd/build-fuzzers/../src/resolve/fuzz-resource-record.c:25:39 #3 0x44d2a1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/vagrant/systemd/out/fuzz-resource-record+0x44d2a1) (BuildId: 88135c111396e9441a475302ccabd2f9a58c7e89) #4 0x42d32f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/vagrant/systemd/out/fuzz-resource-record+0x42d32f) (BuildId: 88135c111396e9441a475302ccabd2f9a58c7e89) #5 0x434920 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/vagrant/systemd/out/fuzz-resource-record+0x434920) (BuildId: 88135c111396e9441a475302ccabd2f9a58c7e89) #6 0x424006 in main (/home/vagrant/systemd/out/fuzz-resource-record+0x424006) (BuildId: 88135c111396e9441a475302ccabd2f9a58c7e89) #7 0x7f602142950f in __libc_start_call_main (/lib64/libc.so.6+0x2950f) (BuildId: 85c438f4ff93e21675ff174371c9c583dca00b2c) #8 0x7f60214295c8 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x295c8) (BuildId: 85c438f4ff93e21675ff174371c9c583dca00b2c) #9 0x424044 in _start (/home/vagrant/systemd/out/fuzz-resource-record+0x424044) (BuildId: 88135c111396e9441a475302ccabd2f9a58c7e89) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../src/basic/hexdecoct.c:66:44 in ```
| * tests: add a file triggering crash in type_bitmap_to_jsonEvgeny Vereshchagin2022-11-251-0/+0
| | | | | | | | It's a follow-up to https://github.com/systemd/systemd/pull/25518
* | bootspec: fix null-dereference-readYu Watanabe2022-12-021-0/+1
|/ | | | | Fixes [oss-fuzz#53578](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53578). Fixes #25450.
* MemoryZSwapMax directive to configure new memory.zswap.max cgroup filePasha Vorobyev2022-11-151-0/+1
|
* meson: Generate fuzzer inputs with directivesMichal Koutný2022-10-2014-2175/+74
| | | | | | | | | | | | | | | | The lists of directives for fuzzer tests are maintained manually in the repo. There is a tools/check-directives.sh script that runs during test phase and reports stale directive lists. Let's rework the script into a generator so that these directive files are created on-the-flight and needn't be updated whenever a unit file directives change. The scripts is rewritten in Python to get rid of gawk dependency and each generated file is a separate meson target so that incremental builds refresh what is just necessary (and parallelize (negligible)). Note: test/fuzz/fuzz-unit-file/directives-all.slice is kept since there is not automated way to generate it (it is not covered by the check script neither).
* meson: Store fuzz tests in structured wayMichal Koutný2022-10-111-6/+16
| | | | | | Put fuzzer tests into dictionary that maps `fuzzer->list of inputs` instead of the flat list. This is just refactoring with no intentional .
* fuzz: shorten name of fuzz test caseZbigniew Jędrzejewski-Szmek2022-10-081-0/+0
| | | | Wide fuzzer case names make meson test output very wide…
* fuzz: add a test case for fuzz-bootspecYu Watanabe2022-09-031-0/+1
| | | | | This adds a testcase for the issue oss-fuzz#50949 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50949).
* network: NetLabel integrationTopi Miettinen2022-08-291-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `NetLabel=` provides a method for integrating static and dynamic network configuration into Linux NetLabel subsystem rules, used by Linux Security Modules (LSMs) for network access control. The label, with suitable LSM rules, can be used to control connectivity of (for example) a service with peers in the local network. At least with SELinux, only the ingress can be controlled but not egress. The benefit of using this setting is that it may be possible to apply interface independent part of NetLabel configuration at very early stage of system boot sequence, at the time when the network interfaces are not available yet, with netlabelctl(8), and the per-interface configuration with systemd-networkd once the interfaces appear later. Currently this feature is only implemented for SELinux. The option expects a single NetLabel label. The label must conform to lexical restrictions of LSM labels. When an interface is configured with IP addresses, the addresses and subnetwork masks will be appended to the NetLabel Fallback Peer Labeling rules. They will be removed when the interface is deconfigured. Failures to manage the labels will be ignored. Example: ``` [DHCPv4] NetLabel=system_u:object_r:localnet_peer_t:s0 ``` With the above rules for interface `eth0`, when the interface is configured with an IPv4 address of 10.0.0.123/8, `systemd-networkd` performs the equivalent of `netlabelctl` operation ``` $ sudo netlabelctl unlbl add interface eth0 address:10.0.0.0/8 label:system_u:object_r:localnet_peer_t:s0 ``` Result: ``` $ sudo netlabelctl -p unlbl list ... interface: eth0 address: 10.0.0.0/8 label: "system_u:object_r:localnet_peer_t:s0" ... ```
* network: introduce TCPCongestionControlAlgorithm=Yu Watanabe2022-08-261-0/+1
| | | | Closes #24432.
* tree-wide: change --kill-who to --kill-whomZbigniew Jędrzejewski-Szmek2022-08-261-0/+0
| | | | | | | | | | | getopt allows non-ambiguous abbreviations, so backwards-compat is maintained, and people can use --kill-who (or even shorter abbreviations). English is flexible, so in common speach people would use both forms, even if "whom" is technically more correct. The advantage of using the longer form in the code is that we effectively allow both forms, so we stop punishing people who DTGCT¹, but still allow people to use the spoken form if they prefer. 1. Do the gramatically correct thing
* rules: import previous SYSTEMD_READY state for suspended DM devices and skip ↵Michal Sekletar2022-08-191-0/+6
| | | | | | | | | | | other rules We can't get any FS meta-data from a suspended device. Hence defer making any plugged/unplugged decisions, i.e. we just import whatever was previous state and skip processing all other rules. Thanks Lennart Poettering <lennart@poettering.net> for suggesting this solution.
* network/tuntap: introduce KeepCarrier= settingYu Watanabe2022-08-161-0/+2
| | | | Closes #24267.
* fuzz: add ConditionCredential= to fuzz files, and sort their sectionsLennart Poettering2022-07-155-23/+31
|
* network: Add support to select an IPv4 link-local start addressAndre Kalb2022-07-131-0/+1
|
* Merge pull request #23916 from keszybz/assorted-patchesYu Watanabe2022-07-0614-0/+0
|\ | | | | Assorted patches
| * fuzz: rename samples to avoid long test namesZbigniew Jędrzejewski-Szmek2022-07-0514-0/+0
| |
* | tree-wide: link to docs.kernel.org for kernel documentationnl67202022-07-041-1/+1
|/ | | | | | | https://www.kernel.org/ links to https://docs.kernel.org/ for the documentation. See https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=ebc1c372850f249dd143c6d942e66c88ec610520 These URLs are shorter and nicer looking.
* Revert "networkd: NetLabel integration"Yu Watanabe2022-06-221-5/+0
| | | | | | | | | | | | | | This reverts PR #23269 and its follow-up commit. Especially, 2299b1cae32c1fb8911da0ce26efced68032f4f8 (partially), and 3cf63830acdef9d8afdc9ef1cf25aa7e85a5e4d5. The PR was merged without final approval, and has several issues: - The NetLabel for static addresses are not assigned, as labels are stored in the Address objects managed by Network, instead of Link. - If NetLabel is specified for a static address, then the address section will be invalid and the address will not be configured, - It should be implemented with Request object, - There is no test about the feature.
* Revert NFTSet featureYu Watanabe2022-06-227-16/+0
| | | | | | | | | | | | | | | | | | | | | | | | This reverts PR #22587 and its follow-up commit. More specifically, 2299b1cae32c1fb8911da0ce26efced68032f4f8 (partially), e176f855278d5098d3fecc5aa24ba702147d42e0, ceb46a31a01b3d3d1d6095d857e29ea214a2776b, and 51bb9076ab8c050bebb64db5035852385accda35. The PR was merged without final approval, and has several issues: - OSS fuzz reported issues in the conf parser, - It calls synchrnous netlink call, it should not be especially in PID1, - The importance of NFTSet for CGroup and DynamicUser may be questionable, at least, there was no justification PID1 should support it. - For networkd, it should be implemented with Request object, - There is no test for the feature. Fixes #23711. Fixes #23717. Fixes #23719. Fixes #23720. Fixes #23721. Fixes #23759.
* core: firewall integration with DynamicUserNFTSet=Topi Miettinen2022-06-084-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `DynamicUserNFTSet=` provides a method for integrating configuration of dynamic users into firewall rules with NFT sets. Example: ``` table inet filter { set u { typeof meta skuid } chain service_output { meta skuid != @u drop accept } } ``` ``` /etc/systemd/system/dunft.service [Service] DynamicUser=yes DynamicUserNFTSet=inet:filter:u ExecStart=/bin/sleep 1000 [Install] WantedBy=multi-user.target ``` ``` $ sudo nft list set inet filter u table inet filter { set u { typeof meta skuid elements = { 64864 } } } $ ps -n --format user,group,pid,command -p `pgrep sleep` USER GROUP PID COMMAND 64864 64864 55158 /bin/sleep 1000 ```
* core: firewall integration with ControlGroupNFTSet=Topi Miettinen2022-06-086-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `ControlGroupNFTSet=` provides a method for integrating services into firewall rules with NFT sets. Example: ``` table inet filter { ... set timesyncd { type cgroupsv2 } chain ntp_output { socket cgroupv2 != @timesyncd counter drop accept } ... } ``` /etc/systemd/system/systemd-timesyncd.service.d/override.conf ``` [Service] ControlGroupNFTSet=inet:filter:timesyncd ``` ``` $ sudo nft list set inet filter timesyncd table inet filter { set timesyncd { type cgroupsv2 elements = { "system.slice/systemd-timesyncd.service" } } } ```
* network: firewall integration with NFT setsTopi Miettinen2022-06-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directives `NFTSet=`, `IPv4NFTSet=` and `IPv6NFTSet=` provide a method for integrating configuration of dynamic networks into firewall rules with NFT sets. /etc/systemd/network/eth.network ``` [DHCPv4] ... NFTSet=netdev:filter:eth_ipv4_address ``` ``` table netdev filter { set eth_ipv4_address { type ipv4_addr flags interval } chain eth_ingress { type filter hook ingress device "eth0" priority filter; policy drop; ip saddr != @eth_ipv4_address drop accept } } ``` ``` sudo nft list set netdev filter eth_ipv4_address table netdev filter { set eth_ipv4_address { type ipv4_addr flags interval elements = { 10.0.0.0/24 } } } ```
* networkd: NetLabel integrationTopi Miettinen2022-06-061-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `NetLabel=` provides a method for integrating dynamic network configuration into Linux NetLabel subsystem rules, used by Linux security modules (LSMs) for network access control. The option expects a whitespace separated list of NetLabel labels. The labels must conform to lexical restrictions of LSM labels. When an interface is configured with IP addresses, the addresses and subnetwork masks will be appended to the NetLabel Fallback Peer Labeling rules. They will be removed when the interface is deconfigured. Failures to manage the labels will be ignored. Example: ``` [DHCP] NetLabel=system_u:object_r:localnet_peer_t:s0 ``` With the above rules for interface `eth0`, when the interface is configured with an IPv4 address of 10.0.0.0/8, `systemd-networkd` performs the equivalent of `netlabelctl` operation ``` $ sudo netlabelctl unlbl add interface eth0 address:10.0.0.0/8 label:system_u:object_r:localnet_peer_t:s0 ``` Result: ``` $ sudo netlabelctl -p unlbl list ... interface: eth0 address: 10.0.0.0/8 label: "system_u:object_r:localnet_peer_t:s0" ... ```
* network/erspan: support erspan version 0 and 2Yu Watanabe2022-06-011-0/+3
| | | | | | This also makes networkd accepts erspan index 0. Closes #23570.
View Lorry Controller Status