out-of-tree kernel {module, exploit} development tool
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

main.go 11KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360
  1. // Copyright 2018 Mikhail Klementev. All rights reserved.
  2. // Use of this source code is governed by a AGPLv3 license
  3. // (or later) that can be found in the LICENSE file.
  4. package main
  5. import (
  6. "fmt"
  7. "log"
  8. "math/rand"
  9. "os"
  10. "os/exec"
  11. "os/user"
  12. "runtime"
  13. "sort"
  14. "strconv"
  15. "time"
  16. kingpin "gopkg.in/alecthomas/kingpin.v2"
  17. "code.dumpstack.io/tools/out-of-tree/config"
  18. )
  19. func findFallback(kcfg config.KernelConfig, ki config.KernelInfo) (rootfs string) {
  20. for _, k := range kcfg.Kernels {
  21. if !exists(k.RootFS) || k.DistroType != ki.DistroType {
  22. continue
  23. }
  24. if k.RootFS < ki.RootFS {
  25. rootfs = k.RootFS
  26. return
  27. }
  28. }
  29. return
  30. }
  31. func handleFallbacks(kcfg config.KernelConfig) {
  32. sort.Sort(sort.Reverse(config.ByRootFS(kcfg.Kernels)))
  33. for i, k := range kcfg.Kernels {
  34. if !exists(k.RootFS) {
  35. newRootFS := findFallback(kcfg, k)
  36. s := k.RootFS + " does not exists "
  37. if newRootFS != "" {
  38. s += "(fallback to " + newRootFS + ")"
  39. } else {
  40. s += "(no fallback found)"
  41. }
  42. kcfg.Kernels[i].RootFS = newRootFS
  43. log.Println(s)
  44. }
  45. }
  46. }
  47. func checkRequiredUtils() (err error) {
  48. // Check for required commands
  49. for _, cmd := range []string{"docker", "qemu-system-x86_64"} {
  50. _, err := exec.Command("which", cmd).CombinedOutput()
  51. if err != nil {
  52. return fmt.Errorf("Command not found: %s", cmd)
  53. }
  54. }
  55. return
  56. }
  57. func checkDockerPermissions() (err error) {
  58. output, err := exec.Command("docker", "ps").CombinedOutput()
  59. if err != nil {
  60. err = fmt.Errorf("%s", output)
  61. }
  62. return
  63. }
  64. func main() {
  65. log.SetFlags(log.Lshortfile)
  66. rand.Seed(time.Now().UnixNano())
  67. app := kingpin.New(
  68. "out-of-tree",
  69. "kernel {module, exploit} development tool",
  70. )
  71. app.Author("Mikhail Klementev <root@dumpstack.io>")
  72. app.Version("1.4.0")
  73. pathFlag := app.Flag("path", "Path to work directory")
  74. path := pathFlag.Default(".").ExistingDir()
  75. usr, err := user.Current()
  76. if err != nil {
  77. return
  78. }
  79. os.MkdirAll(usr.HomeDir+"/.out-of-tree", os.ModePerm)
  80. confPath := usr.HomeDir + "/.out-of-tree/out-of-tree.toml"
  81. conf, err := config.ReadOutOfTreeConf(confPath)
  82. if err != nil {
  83. return
  84. }
  85. kcfgPathFlag := app.Flag("kernels", "Path to main kernels config")
  86. kcfgPath := kcfgPathFlag.Default(conf.Kernels).String()
  87. dbPathFlag := app.Flag("db", "Path to database")
  88. dbPath := dbPathFlag.Default(conf.Database).String()
  89. userKcfgPathFlag := app.Flag("user-kernels", "User kernels config")
  90. userKcfgPathEnv := userKcfgPathFlag.Envar("OUT_OF_TREE_KCFG")
  91. userKcfgPath := userKcfgPathEnv.Default(conf.UserKernels).String()
  92. timeoutFlag := app.Flag("timeout", "Timeout after tool will not spawn new tests")
  93. timeout := timeoutFlag.Duration()
  94. qemuTimeoutFlag := app.Flag("qemu-timeout", "Timeout for qemu")
  95. qemuTimeout := qemuTimeoutFlag.Default(conf.Qemu.Timeout).Duration()
  96. dockerTimeoutFlag := app.Flag("docker-timeout", "Timeout for docker")
  97. dockerTimeout := dockerTimeoutFlag.Default(conf.Docker.Timeout).Duration()
  98. dockerRegistryFlag := app.Flag("docker-registry", "Registry for docker")
  99. dockerRegistry := dockerRegistryFlag.Default(conf.Docker.Registry).String()
  100. thresholdFlag := app.Flag("threshold", "Reliablity threshold for exit code")
  101. threshold := thresholdFlag.Default("1.00").Float64()
  102. disablePreloadFlag := app.Flag("disable-preload", "Disable module preload")
  103. disablePreload = disablePreloadFlag.Bool()
  104. pewCommand := app.Command("pew", "Build, run and test module/exploit")
  105. pewMax := pewCommand.Flag("max", "Test no more than X kernels").
  106. PlaceHolder("X").Default(fmt.Sprint(kernelsAll)).Int64()
  107. pewRuns := pewCommand.Flag("runs", "Runs per each kernel").
  108. Default("1").Int64()
  109. pewKernelFlag := pewCommand.Flag("kernel", "Override kernel regex")
  110. pewKernel := pewKernelFlag.String()
  111. pewGuessFlag := pewCommand.Flag("guess", "Try all defined kernels")
  112. pewGuess := pewGuessFlag.Bool()
  113. pewBinaryFlag := pewCommand.Flag("binary", "Use binary, do not build")
  114. pewBinary := pewBinaryFlag.String()
  115. pewTestFlag := pewCommand.Flag("test", "Override path test")
  116. pewTest := pewTestFlag.String()
  117. pewDistFlag := pewCommand.Flag("dist", "Build result path")
  118. pewDist := pewDistFlag.Default(pathDevNull).String()
  119. pewThreadsFlag := pewCommand.Flag("threads", "Build result path")
  120. pewThreads := pewThreadsFlag.Default(strconv.Itoa(runtime.NumCPU())).Int()
  121. pewTagFlag := pewCommand.Flag("tag", "Log tagging")
  122. pewTag := pewTagFlag.String()
  123. pewVerboseFlag := pewCommand.Flag("verbose", "Show more information")
  124. pewVerbose := pewVerboseFlag.Bool()
  125. kernelCommand := app.Command("kernel", "Manipulate kernels")
  126. kernelNoDownload := kernelCommand.Flag("no-download",
  127. "Do not download qemu image while kernel generation").Bool()
  128. kernelUseHost := kernelCommand.Flag("host", "Use also host kernels").Bool()
  129. kernelListCommand := kernelCommand.Command("list", "List kernels")
  130. kernelAutogenCommand := kernelCommand.Command("autogen",
  131. "Generate kernels based on a current config")
  132. kernelAutogenMax := kernelAutogenCommand.Flag("max",
  133. "Download random kernels from set defined by regex in "+
  134. "release_mask, but no more than X for each of "+
  135. "release_mask").PlaceHolder("X").Default(
  136. fmt.Sprint(kernelsAll)).Int64()
  137. kernelDockerRegenCommand := kernelCommand.Command("docker-regen",
  138. "Regenerate kernels config from out_of_tree_* docker images")
  139. kernelGenallCommand := kernelCommand.Command("genall",
  140. "Generate all kernels for distro")
  141. genallDistroFlag := kernelGenallCommand.Flag("distro", "Distributive")
  142. distro := genallDistroFlag.Required().String()
  143. genallVerFlag := kernelGenallCommand.Flag("ver", "Distro version")
  144. version := genallVerFlag.Required().String()
  145. genCommand := app.Command("gen", "Generate .out-of-tree.toml skeleton")
  146. genModuleCommand := genCommand.Command("module",
  147. "Generate .out-of-tree.toml skeleton for kernel module")
  148. genExploitCommand := genCommand.Command("exploit",
  149. "Generate .out-of-tree.toml skeleton for kernel exploit")
  150. debugCommand := app.Command("debug", "Kernel debug environment")
  151. debugCommandFlag := debugCommand.Flag("kernel", "Regex (first match)")
  152. debugKernel := debugCommandFlag.Required().String()
  153. debugFlagGDB := debugCommand.Flag("gdb", "Set gdb listen address")
  154. debugGDB := debugFlagGDB.Default("tcp::1234").String()
  155. yekaslr := debugCommand.Flag("enable-kaslr", "Enable KASLR").Bool()
  156. yesmep := debugCommand.Flag("enable-smep", "Enable SMEP").Bool()
  157. yesmap := debugCommand.Flag("enable-smap", "Enable SMAP").Bool()
  158. yekpti := debugCommand.Flag("enable-kpti", "Enable KPTI").Bool()
  159. nokaslr := debugCommand.Flag("disable-kaslr", "Disable KASLR").Bool()
  160. nosmep := debugCommand.Flag("disable-smep", "Disable SMEP").Bool()
  161. nosmap := debugCommand.Flag("disable-smap", "Disable SMAP").Bool()
  162. nokpti := debugCommand.Flag("disable-kpti", "Disable KPTI").Bool()
  163. bootstrapCommand := app.Command("bootstrap", "Apparently nothing")
  164. logCommand := app.Command("log", "Logs")
  165. logQueryCommand := logCommand.Command("query", "Query logs")
  166. logNum := logQueryCommand.Flag("num", "How much lines").Default("50").Int()
  167. logRate := logQueryCommand.Flag("rate", "Show artifact success rate").Bool()
  168. logTag := logQueryCommand.Flag("tag", "Filter tag").String()
  169. logDumpCommand := logCommand.Command("dump",
  170. "Show all info for log entry with ID")
  171. logDumpID := logDumpCommand.Arg("ID", "").Default("-1").Int()
  172. logJSONCommand := logCommand.Command("json", "Generate json statistics")
  173. logJSONTag := logJSONCommand.Flag("tag", "Filter tag").Required().String()
  174. logMarkdownCommand := logCommand.Command("markdown", "Generate markdown statistics")
  175. logMarkdownTag := logMarkdownCommand.Flag("tag", "Filter tag").Required().String()
  176. packCommand := app.Command("pack", "Exploit pack test")
  177. packAutogen := packCommand.Flag("autogen", "Kernel autogeneration").Bool()
  178. packNoDownload := packCommand.Flag("no-download",
  179. "Do not download qemu image while kernel generation").Bool()
  180. packExploitRuns := packCommand.Flag("exploit-runs",
  181. "Amount of runs of each exploit").Default("4").Int64()
  182. packKernelRuns := packCommand.Flag("kernel-runs",
  183. "Amount of runs of each kernel").Default("1").Int64()
  184. err = checkRequiredUtils()
  185. if err != nil {
  186. log.Fatalln(err)
  187. }
  188. err = checkDockerPermissions()
  189. if err != nil {
  190. log.Println(err)
  191. log.Println("You have two options:")
  192. log.Println("\t1. Add user to group docker;")
  193. log.Println("\t2. Run out-of-tree with sudo.")
  194. os.Exit(1)
  195. }
  196. if !exists(usr.HomeDir + "/.out-of-tree/kernels.toml") {
  197. log.Println("No ~/.out-of-tree/kernels.toml: Probably you " +
  198. "need to run `out-of-tree kernel autogen` in " +
  199. "directory that contains .out-of-tree.toml " +
  200. "with defined kernel masks " +
  201. "(see docs at https://out-of-tree.io)")
  202. }
  203. kingpin.MustParse(app.Parse(os.Args[1:]))
  204. if *yekaslr && *nokaslr {
  205. log.Fatalln("Only one of disable/enable can be used at once")
  206. }
  207. if *yesmep && *nosmep {
  208. log.Fatalln("Only one of disable/enable can be used at once")
  209. }
  210. if *yesmap && *nosmap {
  211. log.Fatalln("Only one of disable/enable can be used at once")
  212. }
  213. if *yekpti && *nokpti {
  214. log.Fatalln("Only one of disable/enable can be used at once")
  215. }
  216. kcfg, err := config.ReadKernelConfig(*kcfgPath)
  217. if err != nil {
  218. log.Println(err)
  219. }
  220. if exists(*userKcfgPath) {
  221. userKcfg, err := config.ReadKernelConfig(*userKcfgPath)
  222. if err != nil {
  223. log.Fatalln(err)
  224. }
  225. for _, nk := range userKcfg.Kernels {
  226. if !hasKernel(nk, kcfg) {
  227. kcfg.Kernels = append(kcfg.Kernels, nk)
  228. }
  229. }
  230. }
  231. handleFallbacks(kcfg)
  232. db, err := openDatabase(*dbPath)
  233. if err != nil {
  234. log.Fatalln(err)
  235. }
  236. defer db.Close()
  237. stop := time.Time{} // never stop
  238. if *timeout != 0 {
  239. stop = time.Now().Add(*timeout)
  240. }
  241. switch kingpin.MustParse(app.Parse(os.Args[1:])) {
  242. case pewCommand.FullCommand():
  243. err = pewHandler(kcfg, *path, *pewKernel, *pewBinary,
  244. *pewTest, *pewGuess, stop, *qemuTimeout, *dockerTimeout,
  245. *pewMax, *pewRuns, *pewDist, *pewTag, *pewThreads,
  246. db, *pewVerbose)
  247. case kernelListCommand.FullCommand():
  248. err = kernelListHandler(kcfg)
  249. case kernelAutogenCommand.FullCommand():
  250. err = kernelAutogenHandler(*path, *dockerRegistry,
  251. conf.Docker.Commands, *kernelAutogenMax,
  252. *kernelUseHost, !*kernelNoDownload)
  253. case kernelDockerRegenCommand.FullCommand():
  254. err = kernelDockerRegenHandler(*kernelUseHost, !*kernelNoDownload)
  255. case kernelGenallCommand.FullCommand():
  256. err = kernelGenallHandler(*distro, *version,
  257. *dockerRegistry, conf.Docker.Commands,
  258. *kernelUseHost, !*kernelNoDownload)
  259. case genModuleCommand.FullCommand():
  260. err = genConfig(config.KernelModule)
  261. case genExploitCommand.FullCommand():
  262. err = genConfig(config.KernelExploit)
  263. case debugCommand.FullCommand():
  264. err = debugHandler(kcfg, *path, *debugKernel, *debugGDB,
  265. *dockerTimeout, *yekaslr, *yesmep, *yesmap, *yekpti,
  266. *nokaslr, *nosmep, *nosmap, *nokpti)
  267. case bootstrapCommand.FullCommand():
  268. fmt.Println("bootstrap is no more required, " +
  269. "now images downloading on-demand")
  270. fmt.Println("please, remove it from any automation scripts, " +
  271. "because it'll be removed in the next release")
  272. case logQueryCommand.FullCommand():
  273. err = logHandler(db, *path, *logTag, *logNum, *logRate)
  274. case logDumpCommand.FullCommand():
  275. err = logDumpHandler(db, *logDumpID)
  276. case logJSONCommand.FullCommand():
  277. err = logJSONHandler(db, *path, *logJSONTag)
  278. case logMarkdownCommand.FullCommand():
  279. err = logMarkdownHandler(db, *path, *logMarkdownTag)
  280. case packCommand.FullCommand():
  281. err = packHandler(db, *path, *dockerRegistry, stop,
  282. conf.Docker.Commands, kcfg, *packAutogen,
  283. !*packNoDownload, *packExploitRuns, *packKernelRuns)
  284. }
  285. if err != nil {
  286. log.Fatalln(err)
  287. }
  288. if successRate(state) < *threshold {
  289. os.Exit(1)
  290. }
  291. }