1
0
Fork 0
out-of-tree/pew.go

345 lines
7.4 KiB
Go
Raw Normal View History

2018-11-17 19:37:04 +00:00
// Copyright 2018 Mikhail Klementev. All rights reserved.
// Use of this source code is governed by a AGPLv3 license
// (or later) that can be found in the LICENSE file.
package main
import (
"errors"
"fmt"
"io/ioutil"
"log"
"math/rand"
"os"
"os/exec"
"runtime"
"strings"
"time"
"github.com/logrusorgru/aurora"
"github.com/otiai10/copy"
"github.com/remeh/sizedwaitgroup"
"github.com/jollheef/out-of-tree/config"
2018-11-17 19:37:04 +00:00
qemu "github.com/jollheef/out-of-tree/qemu"
)
func dockerCommand(container, workdir, timeout, command string) *exec.Cmd {
return exec.Command("timeout", "-k", timeout, timeout, "docker", "run",
"-v", workdir+":/work", container,
"bash", "-c", "cd /work && "+command)
}
2018-11-17 20:18:50 +00:00
func build(tmp string, ka config.Artifact, ki config.KernelInfo,
2018-11-17 19:37:04 +00:00
dockerTimeout time.Duration) (outPath, output string, err error) {
target := fmt.Sprintf("%d_%s", rand.Int(), ki.KernelRelease)
tmpSourcePath := tmp + "/source"
err = copy.Copy(ka.SourcePath, tmpSourcePath)
if err != nil {
return
}
outPath = tmpSourcePath + "/" + target
2018-11-17 20:18:50 +00:00
if ka.Type == config.KernelModule {
2018-11-17 19:37:04 +00:00
outPath += ".ko"
}
kernel := "/lib/modules/" + ki.KernelRelease + "/build"
seconds := fmt.Sprintf("%ds", dockerTimeout/time.Second)
cmd := dockerCommand(ki.ContainerName, tmpSourcePath, seconds,
"make KERNEL="+kernel+" TARGET="+target)
rawOutput, err := cmd.CombinedOutput()
output = string(rawOutput)
if err != nil {
err = errors.New("make execution error")
return
}
return
}
func cleanDmesg(q *qemu.QemuSystem) (err error) {
start := time.Now()
for {
_, err = q.Command("root", "dmesg -c")
if err == nil {
break
}
time.Sleep(time.Second)
if time.Now().After(start.Add(time.Minute)) {
err = errors.New("Can't connect to qemu")
break
}
}
return
}
2018-11-17 20:18:50 +00:00
func testKernelModule(q *qemu.QemuSystem, ka config.Artifact,
test string) (output string, err error) {
2018-11-17 19:37:04 +00:00
output, err = q.Command("root", test)
// TODO generic checks for WARNING's and so on
return
}
2018-11-17 20:18:50 +00:00
func testKernelExploit(q *qemu.QemuSystem, ka config.Artifact,
test, exploit string) (output string, err error) {
2018-11-17 19:37:04 +00:00
output, err = q.Command("user", "chmod +x "+exploit)
if err != nil {
return
}
randFilePath := fmt.Sprintf("/root/%d", rand.Int())
cmd := fmt.Sprintf("%s %s %s", test, exploit, randFilePath)
output, err = q.Command("user", cmd)
if err != nil {
return
}
_, err = q.Command("root", "stat "+randFilePath)
if err != nil {
return
}
return
}
func genOkFail(name string, ok bool) aurora.Value {
if ok {
s := " " + name + " SUCCESS "
return aurora.BgGreen(aurora.Black(s))
} else {
s := " " + name + " FAILURE "
return aurora.BgRed(aurora.Gray(aurora.Bold(s)))
}
}
2018-11-17 20:18:50 +00:00
func dumpResult(q *qemu.QemuSystem, ka config.Artifact, ki config.KernelInfo,
build_ok, run_ok, test_ok *bool) {
2018-11-17 19:37:04 +00:00
distroInfo := fmt.Sprintf("%s-%s {%s}", ki.DistroType,
ki.DistroRelease, ki.KernelRelease)
colored := ""
2018-11-17 20:18:50 +00:00
if ka.Type == config.KernelExploit {
2018-11-17 19:37:04 +00:00
colored = aurora.Sprintf("[*] %40s: %s %s", distroInfo,
genOkFail("BUILD", *build_ok),
genOkFail("LPE", *test_ok))
} else {
colored = aurora.Sprintf("[*] %40s: %s %s %s", distroInfo,
genOkFail("BUILD", *build_ok),
genOkFail("INSMOD", *run_ok),
genOkFail("TEST", *test_ok))
}
additional := ""
if q.KernelPanic {
additional = "(panic)"
} else if q.KilledByTimeout {
additional = "(timeout)"
}
if additional != "" {
fmt.Println(colored, additional)
} else {
fmt.Println(colored)
}
}
2018-11-17 20:18:50 +00:00
func whatever(swg *sizedwaitgroup.SizedWaitGroup, ka config.Artifact,
ki config.KernelInfo, binaryPath, testPath string,
2018-11-17 19:37:04 +00:00
qemuTimeout, dockerTimeout time.Duration) {
defer swg.Done()
kernel := qemu.Kernel{KernelPath: ki.KernelPath, InitrdPath: ki.InitrdPath}
q, err := qemu.NewQemuSystem(qemu.X86_64, kernel, ki.RootFS)
if err != nil {
return
}
q.Timeout = qemuTimeout
err = q.Start()
if err != nil {
return
}
defer q.Stop()
tmp, err := ioutil.TempDir("/tmp/", "out-of-tree_")
if err != nil {
return
}
defer os.RemoveAll(tmp)
build_ok := false
run_ok := false
test_ok := false
defer dumpResult(q, ka, ki, &build_ok, &run_ok, &test_ok)
var outFile, output string
if binaryPath == "" {
// TODO Write build log to file or database
outFile, output, err = build(tmp, ka, ki, dockerTimeout)
if err != nil {
log.Println(output)
return
}
build_ok = true
} else {
outFile = binaryPath
build_ok = true
}
err = cleanDmesg(q)
if err != nil {
return
}
if testPath == "" {
testPath = outFile + "_test"
}
remoteTest := fmt.Sprintf("/tmp/test_%d", rand.Int())
err = q.CopyFile("user", testPath, remoteTest)
if err != nil {
log.Println("copy file err", err)
// we should not exit because of testing 'insmod' part
// for kernel module
}
_, err = q.Command("root", "chmod +x "+remoteTest)
if err != nil {
return
}
2018-11-17 20:18:50 +00:00
if ka.Type == config.KernelModule {
2018-11-17 19:37:04 +00:00
// TODO Write insmod log to file or database
output, err := q.CopyAndInsmod(outFile)
if err != nil {
log.Println(output, err)
return
}
run_ok = true
// TODO Write test results to file or database
output, err = testKernelModule(q, ka, remoteTest)
if err != nil {
log.Println(output, err)
return
}
test_ok = true
2018-11-17 20:18:50 +00:00
} else if ka.Type == config.KernelExploit {
2018-11-17 19:37:04 +00:00
remoteExploit := fmt.Sprintf("/tmp/exploit_%d", rand.Int())
err = q.CopyFile("user", outFile, remoteExploit)
if err != nil {
return
}
// TODO Write test results to file or database
output, err = testKernelExploit(q, ka, remoteTest, remoteExploit)
if err != nil {
log.Println(output)
return
}
run_ok = true // does not really used
test_ok = true
} else {
err = errors.New("Unsupported artifact type")
}
return
}
2018-11-17 20:18:50 +00:00
func performCI(ka config.Artifact, kcfg config.KernelConfig, binaryPath,
testPath string, qemuTimeout, dockerTimeout time.Duration) (err error) {
2018-11-17 19:37:04 +00:00
found := false
swg := sizedwaitgroup.New(runtime.NumCPU())
for _, kernel := range kcfg.Kernels {
var supported bool
supported, err = ka.Supported(kernel)
if err != nil {
return
}
if supported {
found = true
swg.Add()
go whatever(&swg, ka, kernel, binaryPath, testPath,
qemuTimeout, dockerTimeout)
}
}
swg.Wait()
if !found {
err = errors.New("No supported kernels found")
}
return
}
func exists(path string) bool {
if _, err := os.Stat(path); err != nil {
return false
}
return true
}
2018-11-17 20:18:50 +00:00
func pewHandler(kcfg config.KernelConfig,
workPath, ovrrdKrnl, binary, test string, guess bool,
qemuTimeout, dockerTimeout time.Duration) (err error) {
2018-11-17 19:37:04 +00:00
2018-11-17 20:18:50 +00:00
ka, err := config.ReadArtifactConfig(workPath + "/.out-of-tree.toml")
2018-11-17 19:37:04 +00:00
if err != nil {
return
}
if ka.SourcePath == "" {
ka.SourcePath = workPath
}
if ovrrdKrnl != "" {
parts := strings.Split(ovrrdKrnl, ":")
if len(parts) != 2 {
return errors.New("Kernel is not 'distroType:regex'")
}
2018-11-17 20:18:50 +00:00
var dt config.DistroType
dt, err = config.NewDistroType(parts[0])
2018-11-17 19:37:04 +00:00
if err != nil {
return
}
2018-11-17 20:18:50 +00:00
km := config.KernelMask{DistroType: dt, ReleaseMask: parts[1]}
ka.SupportedKernels = []config.KernelMask{km}
2018-11-17 19:37:04 +00:00
}
if guess {
2018-11-17 20:18:50 +00:00
ka.SupportedKernels = []config.KernelMask{}
for _, dType := range config.DistroTypeStrings {
var dt config.DistroType
dt, err = config.NewDistroType(dType)
2018-11-17 19:37:04 +00:00
if err != nil {
return
}
2018-11-17 20:18:50 +00:00
km := config.KernelMask{DistroType: dt, ReleaseMask: ".*"}
2018-11-17 19:37:04 +00:00
ka.SupportedKernels = append(ka.SupportedKernels, km)
}
}
err = performCI(ka, kcfg, binary, test, qemuTimeout, dockerTimeout)
if err != nil {
return
}
return
}