out-of-tree kernel {module, exploit} development tool
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

main.go 11KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357
  1. // Copyright 2018 Mikhail Klementev. All rights reserved.
  2. // Use of this source code is governed by a AGPLv3 license
  3. // (or later) that can be found in the LICENSE file.
  4. package main
  5. import (
  6. "fmt"
  7. "log"
  8. "math/rand"
  9. "os"
  10. "os/exec"
  11. "os/user"
  12. "runtime"
  13. "sort"
  14. "strconv"
  15. "time"
  16. kingpin "gopkg.in/alecthomas/kingpin.v2"
  17. "code.dumpstack.io/tools/out-of-tree/config"
  18. )
  19. func findFallback(kcfg config.KernelConfig, ki config.KernelInfo) (rootfs string) {
  20. for _, k := range kcfg.Kernels {
  21. if !exists(k.RootFS) || k.DistroType != ki.DistroType {
  22. continue
  23. }
  24. if k.RootFS < ki.RootFS {
  25. rootfs = k.RootFS
  26. return
  27. }
  28. }
  29. return
  30. }
  31. func handleFallbacks(kcfg config.KernelConfig) {
  32. sort.Sort(sort.Reverse(config.ByRootFS(kcfg.Kernels)))
  33. for i, k := range kcfg.Kernels {
  34. if !exists(k.RootFS) {
  35. newRootFS := findFallback(kcfg, k)
  36. s := k.RootFS + " does not exists "
  37. if newRootFS != "" {
  38. s += "(fallback to " + newRootFS + ")"
  39. } else {
  40. s += "(no fallback found)"
  41. }
  42. kcfg.Kernels[i].RootFS = newRootFS
  43. log.Println(s)
  44. }
  45. }
  46. }
  47. func checkRequiredUtils() (err error) {
  48. // Check for required commands
  49. for _, cmd := range []string{"docker", "qemu-system-x86_64"} {
  50. _, err := exec.Command("which", cmd).CombinedOutput()
  51. if err != nil {
  52. return fmt.Errorf("Command not found: %s", cmd)
  53. }
  54. }
  55. return
  56. }
  57. func checkDockerPermissions() (err error) {
  58. output, err := exec.Command("docker", "ps").CombinedOutput()
  59. if err != nil {
  60. err = fmt.Errorf("%s", output)
  61. }
  62. return
  63. }
  64. func main() {
  65. log.SetFlags(log.Lshortfile)
  66. rand.Seed(time.Now().UnixNano())
  67. app := kingpin.New(
  68. "out-of-tree",
  69. "kernel {module, exploit} development tool",
  70. )
  71. app.Author("Mikhail Klementev <root@dumpstack.io>")
  72. app.Version("1.2.1")
  73. pathFlag := app.Flag("path", "Path to work directory")
  74. path := pathFlag.Default(".").ExistingDir()
  75. usr, err := user.Current()
  76. if err != nil {
  77. return
  78. }
  79. os.MkdirAll(usr.HomeDir+"/.out-of-tree", os.ModePerm)
  80. confPath := usr.HomeDir + "/.out-of-tree/out-of-tree.toml"
  81. conf, err := config.ReadOutOfTreeConf(confPath)
  82. if err != nil {
  83. return
  84. }
  85. kcfgPathFlag := app.Flag("kernels", "Path to main kernels config")
  86. kcfgPath := kcfgPathFlag.Default(conf.Kernels).String()
  87. dbPathFlag := app.Flag("db", "Path to database")
  88. dbPath := dbPathFlag.Default(conf.Database).String()
  89. userKcfgPathFlag := app.Flag("user-kernels", "User kernels config")
  90. userKcfgPathEnv := userKcfgPathFlag.Envar("OUT_OF_TREE_KCFG")
  91. userKcfgPath := userKcfgPathEnv.Default(conf.UserKernels).String()
  92. timeoutFlag := app.Flag("timeout", "Timeout after tool will not spawn new tests")
  93. timeout := timeoutFlag.Duration()
  94. qemuTimeoutFlag := app.Flag("qemu-timeout", "Timeout for qemu")
  95. qemuTimeout := qemuTimeoutFlag.Default(conf.Qemu.Timeout).Duration()
  96. dockerTimeoutFlag := app.Flag("docker-timeout", "Timeout for docker")
  97. dockerTimeout := dockerTimeoutFlag.Default(conf.Docker.Timeout).Duration()
  98. dockerRegistryFlag := app.Flag("docker-registry", "Registry for docker")
  99. dockerRegistry := dockerRegistryFlag.Default(conf.Docker.Registry).String()
  100. thresholdFlag := app.Flag("threshold", "Reliablity threshold for exit code")
  101. threshold := thresholdFlag.Default("1.00").Float64()
  102. pewCommand := app.Command("pew", "Build, run and test module/exploit")
  103. pewMax := pewCommand.Flag("max", "Test no more than X kernels").
  104. PlaceHolder("X").Default(fmt.Sprint(kernelsAll)).Int64()
  105. pewRuns := pewCommand.Flag("runs", "Runs per each kernel").
  106. Default("1").Int64()
  107. pewKernelFlag := pewCommand.Flag("kernel", "Override kernel regex")
  108. pewKernel := pewKernelFlag.String()
  109. pewGuessFlag := pewCommand.Flag("guess", "Try all defined kernels")
  110. pewGuess := pewGuessFlag.Bool()
  111. pewBinaryFlag := pewCommand.Flag("binary", "Use binary, do not build")
  112. pewBinary := pewBinaryFlag.String()
  113. pewTestFlag := pewCommand.Flag("test", "Override path test")
  114. pewTest := pewTestFlag.String()
  115. pewDistFlag := pewCommand.Flag("dist", "Build result path")
  116. pewDist := pewDistFlag.Default(pathDevNull).String()
  117. pewThreadsFlag := pewCommand.Flag("threads", "Build result path")
  118. pewThreads := pewThreadsFlag.Default(strconv.Itoa(runtime.NumCPU())).Int()
  119. pewTagFlag := pewCommand.Flag("tag", "Log tagging")
  120. pewTag := pewTagFlag.String()
  121. pewVerboseFlag := pewCommand.Flag("verbose", "Show more information")
  122. pewVerbose := pewVerboseFlag.Bool()
  123. kernelCommand := app.Command("kernel", "Manipulate kernels")
  124. kernelNoDownload := kernelCommand.Flag("no-download",
  125. "Do not download qemu image while kernel generation").Bool()
  126. kernelUseHost := kernelCommand.Flag("host", "Use also host kernels").Bool()
  127. kernelListCommand := kernelCommand.Command("list", "List kernels")
  128. kernelAutogenCommand := kernelCommand.Command("autogen",
  129. "Generate kernels based on a current config")
  130. kernelAutogenMax := kernelAutogenCommand.Flag("max",
  131. "Download random kernels from set defined by regex in "+
  132. "release_mask, but no more than X for each of "+
  133. "release_mask").PlaceHolder("X").Default(
  134. fmt.Sprint(kernelsAll)).Int64()
  135. kernelDockerRegenCommand := kernelCommand.Command("docker-regen",
  136. "Regenerate kernels config from out_of_tree_* docker images")
  137. kernelGenallCommand := kernelCommand.Command("genall",
  138. "Generate all kernels for distro")
  139. genallDistroFlag := kernelGenallCommand.Flag("distro", "Distributive")
  140. distro := genallDistroFlag.Required().String()
  141. genallVerFlag := kernelGenallCommand.Flag("ver", "Distro version")
  142. version := genallVerFlag.Required().String()
  143. genCommand := app.Command("gen", "Generate .out-of-tree.toml skeleton")
  144. genModuleCommand := genCommand.Command("module",
  145. "Generate .out-of-tree.toml skeleton for kernel module")
  146. genExploitCommand := genCommand.Command("exploit",
  147. "Generate .out-of-tree.toml skeleton for kernel exploit")
  148. debugCommand := app.Command("debug", "Kernel debug environment")
  149. debugCommandFlag := debugCommand.Flag("kernel", "Regex (first match)")
  150. debugKernel := debugCommandFlag.Required().String()
  151. debugFlagGDB := debugCommand.Flag("gdb", "Set gdb listen address")
  152. debugGDB := debugFlagGDB.Default("tcp::1234").String()
  153. yekaslr := debugCommand.Flag("enable-kaslr", "Enable KASLR").Bool()
  154. yesmep := debugCommand.Flag("enable-smep", "Enable SMEP").Bool()
  155. yesmap := debugCommand.Flag("enable-smap", "Enable SMAP").Bool()
  156. yekpti := debugCommand.Flag("enable-kpti", "Enable KPTI").Bool()
  157. nokaslr := debugCommand.Flag("disable-kaslr", "Disable KASLR").Bool()
  158. nosmep := debugCommand.Flag("disable-smep", "Disable SMEP").Bool()
  159. nosmap := debugCommand.Flag("disable-smap", "Disable SMAP").Bool()
  160. nokpti := debugCommand.Flag("disable-kpti", "Disable KPTI").Bool()
  161. bootstrapCommand := app.Command("bootstrap", "Apparently nothing")
  162. logCommand := app.Command("log", "Logs")
  163. logQueryCommand := logCommand.Command("query", "Query logs")
  164. logNum := logQueryCommand.Flag("num", "How much lines").Default("50").Int()
  165. logRate := logQueryCommand.Flag("rate", "Show artifact success rate").Bool()
  166. logTag := logQueryCommand.Flag("tag", "Filter tag").String()
  167. logDumpCommand := logCommand.Command("dump",
  168. "Show all info for log entry with ID")
  169. logDumpID := logDumpCommand.Arg("ID", "").Required().Int()
  170. logJSONCommand := logCommand.Command("json", "Generate json statistics")
  171. logJSONTag := logJSONCommand.Flag("tag", "Filter tag").Required().String()
  172. logMarkdownCommand := logCommand.Command("markdown", "Generate markdown statistics")
  173. logMarkdownTag := logMarkdownCommand.Flag("tag", "Filter tag").Required().String()
  174. packCommand := app.Command("pack", "Exploit pack test")
  175. packAutogen := packCommand.Flag("autogen", "Kernel autogeneration").Bool()
  176. packNoDownload := packCommand.Flag("no-download",
  177. "Do not download qemu image while kernel generation").Bool()
  178. packExploitRuns := packCommand.Flag("exploit-runs",
  179. "Amount of runs of each exploit").Default("4").Int64()
  180. packKernelRuns := packCommand.Flag("kernel-runs",
  181. "Amount of runs of each kernel").Default("1").Int64()
  182. err = checkRequiredUtils()
  183. if err != nil {
  184. log.Fatalln(err)
  185. }
  186. err = checkDockerPermissions()
  187. if err != nil {
  188. log.Println(err)
  189. log.Println("You have two options:")
  190. log.Println("\t1. Add user to group docker;")
  191. log.Println("\t2. Run out-of-tree with sudo.")
  192. os.Exit(1)
  193. }
  194. if !exists(usr.HomeDir + "/.out-of-tree/kernels.toml") {
  195. log.Println("No ~/.out-of-tree/kernels.toml: Probably you " +
  196. "need to run `out-of-tree kernel autogen` in " +
  197. "directory that contains .out-of-tree.toml " +
  198. "with defined kernel masks " +
  199. "(see docs at https://out-of-tree.io)")
  200. }
  201. kingpin.MustParse(app.Parse(os.Args[1:]))
  202. if *yekaslr && *nokaslr {
  203. log.Fatalln("Only one of disable/enable can be used at once")
  204. }
  205. if *yesmep && *nosmep {
  206. log.Fatalln("Only one of disable/enable can be used at once")
  207. }
  208. if *yesmap && *nosmap {
  209. log.Fatalln("Only one of disable/enable can be used at once")
  210. }
  211. if *yekpti && *nokpti {
  212. log.Fatalln("Only one of disable/enable can be used at once")
  213. }
  214. kcfg, err := config.ReadKernelConfig(*kcfgPath)
  215. if err != nil {
  216. log.Println(err)
  217. }
  218. if exists(*userKcfgPath) {
  219. userKcfg, err := config.ReadKernelConfig(*userKcfgPath)
  220. if err != nil {
  221. log.Fatalln(err)
  222. }
  223. for _, nk := range userKcfg.Kernels {
  224. if !hasKernel(nk, kcfg) {
  225. kcfg.Kernels = append(kcfg.Kernels, nk)
  226. }
  227. }
  228. }
  229. handleFallbacks(kcfg)
  230. db, err := openDatabase(*dbPath)
  231. if err != nil {
  232. log.Fatalln(err)
  233. }
  234. defer db.Close()
  235. stop := time.Time{} // never stop
  236. if *timeout != 0 {
  237. stop = time.Now().Add(*timeout)
  238. }
  239. switch kingpin.MustParse(app.Parse(os.Args[1:])) {
  240. case pewCommand.FullCommand():
  241. err = pewHandler(kcfg, *path, *pewKernel, *pewBinary,
  242. *pewTest, *pewGuess, stop, *qemuTimeout, *dockerTimeout,
  243. *pewMax, *pewRuns, *pewDist, *pewTag, *pewThreads,
  244. db, *pewVerbose)
  245. case kernelListCommand.FullCommand():
  246. err = kernelListHandler(kcfg)
  247. case kernelAutogenCommand.FullCommand():
  248. err = kernelAutogenHandler(*path, *dockerRegistry,
  249. conf.Docker.Commands, *kernelAutogenMax,
  250. *kernelUseHost, !*kernelNoDownload)
  251. case kernelDockerRegenCommand.FullCommand():
  252. err = kernelDockerRegenHandler(*kernelUseHost, !*kernelNoDownload)
  253. case kernelGenallCommand.FullCommand():
  254. err = kernelGenallHandler(*distro, *version,
  255. *dockerRegistry, conf.Docker.Commands,
  256. *kernelUseHost, !*kernelNoDownload)
  257. case genModuleCommand.FullCommand():
  258. err = genConfig(config.KernelModule)
  259. case genExploitCommand.FullCommand():
  260. err = genConfig(config.KernelExploit)
  261. case debugCommand.FullCommand():
  262. err = debugHandler(kcfg, *path, *debugKernel, *debugGDB,
  263. *dockerTimeout, *yekaslr, *yesmep, *yesmap, *yekpti,
  264. *nokaslr, *nosmep, *nosmap, *nokpti)
  265. case bootstrapCommand.FullCommand():
  266. fmt.Println("bootstrap is no more required, " +
  267. "now images downloading on-demand")
  268. fmt.Println("please, remove it from any automation scripts, " +
  269. "because it'll be removed in the next release")
  270. case logQueryCommand.FullCommand():
  271. err = logHandler(db, *path, *logTag, *logNum, *logRate)
  272. case logDumpCommand.FullCommand():
  273. err = logDumpHandler(db, *logDumpID)
  274. case logJSONCommand.FullCommand():
  275. err = logJSONHandler(db, *path, *logJSONTag)
  276. case logMarkdownCommand.FullCommand():
  277. err = logMarkdownHandler(db, *path, *logMarkdownTag)
  278. case packCommand.FullCommand():
  279. err = packHandler(db, *path, *dockerRegistry, stop,
  280. conf.Docker.Commands, kcfg, *packAutogen,
  281. !*packNoDownload, *packExploitRuns, *packKernelRuns)
  282. }
  283. if err != nil {
  284. log.Fatalln(err)
  285. }
  286. if successRate(state) < *threshold {
  287. os.Exit(1)
  288. }
  289. }