ipc_leak_test.cc 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stdlib.h>
  5. #include <windows.h>
  6. #include <memory>
  7. #include "base/memory/page_size.h"
  8. #include "base/win/win_util.h"
  9. #include "sandbox/win/src/crosscall_client.h"
  10. #include "sandbox/win/src/filesystem_interception.h"
  11. #include "sandbox/win/src/ipc_tags.h"
  12. #include "sandbox/win/src/named_pipe_interception.h"
  13. #include "sandbox/win/src/policy_engine_processor.h"
  14. #include "sandbox/win/src/policy_low_level.h"
  15. #include "sandbox/win/src/policy_params.h"
  16. #include "sandbox/win/src/process_thread_interception.h"
  17. #include "sandbox/win/src/sandbox.h"
  18. #include "sandbox/win/src/sandbox_nt_util.h"
  19. #include "sandbox/win/src/sharedmem_ipc_client.h"
  20. #include "sandbox/win/tests/common/controller.h"
  21. #include "testing/gtest/include/gtest/gtest.h"
  22. #define BINDNTDLL(name) \
  23. name##Function name = reinterpret_cast<name##Function>( \
  24. ::GetProcAddress(::GetModuleHandle(L"ntdll.dll"), #name));
  25. namespace sandbox {
  26. namespace {
  27. enum TestId {
  28. TESTIPC_NTOPENFILE,
  29. TESTIPC_NTCREATEFILE,
  30. TESTIPC_CREATETHREAD,
  31. TESTIPC_CREATENAMEDPIPEW,
  32. TESTIPC_LAST
  33. };
  34. // Helper function to allocate space (on the heap) for policy.
  35. PolicyGlobal* MakePolicyMemory() {
  36. // Should not exceed kPolMemSize from |sandbox_policy_base.cc|.
  37. const size_t kTotalPolicySz = 4096 * 6;
  38. char* mem = new char[kTotalPolicySz];
  39. memset(mem, 0, kTotalPolicySz);
  40. PolicyGlobal* policy = reinterpret_cast<PolicyGlobal*>(mem);
  41. policy->data_size = kTotalPolicySz - sizeof(PolicyGlobal);
  42. return policy;
  43. }
  44. // CreateNamedPipeW
  45. HANDLE WINAPI DummyCreateNamedPipeW(LPCWSTR pipe_name,
  46. DWORD open_mode,
  47. DWORD pipe_mode,
  48. DWORD max_instance,
  49. DWORD out_buffer_size,
  50. DWORD in_buffer_size,
  51. DWORD default_timeout,
  52. LPSECURITY_ATTRIBUTES security_attributes) {
  53. return INVALID_HANDLE_VALUE;
  54. }
  55. void TestCreateNamedPipeW() {
  56. HANDLE handle;
  57. handle = TargetCreateNamedPipeW(
  58. reinterpret_cast<CreateNamedPipeWFunction>(DummyCreateNamedPipeW),
  59. L"\\??\\leak", PIPE_ACCESS_DUPLEX,
  60. PIPE_TYPE_MESSAGE | PIPE_WAIT | PIPE_REJECT_REMOTE_CLIENTS, 1, 0x1000,
  61. 0x1000, 100, nullptr);
  62. if (handle != INVALID_HANDLE_VALUE)
  63. CloseHandle(handle);
  64. }
  65. // NtCreateFile
  66. NTSTATUS WINAPI DummyNtCreateFile(PHANDLE file,
  67. ACCESS_MASK desired_access,
  68. POBJECT_ATTRIBUTES object_attributes,
  69. PIO_STATUS_BLOCK io_status,
  70. PLARGE_INTEGER allocation_size,
  71. ULONG file_attributes,
  72. ULONG sharing,
  73. ULONG disposition,
  74. ULONG options,
  75. PVOID ea_buffer,
  76. ULONG ea_length) {
  77. return STATUS_ACCESS_DENIED;
  78. }
  79. void TestNtCreateFile() {
  80. UNICODE_STRING path_str;
  81. OBJECT_ATTRIBUTES attr;
  82. IO_STATUS_BLOCK iosb;
  83. HANDLE handle = INVALID_HANDLE_VALUE;
  84. BINDNTDLL(RtlInitUnicodeString);
  85. RtlInitUnicodeString(&path_str, L"\\??\\leak");
  86. InitializeObjectAttributes(&attr, &path_str, OBJ_CASE_INSENSITIVE, nullptr,
  87. nullptr);
  88. NTSTATUS ret = TargetNtCreateFile(
  89. reinterpret_cast<NtCreateFileFunction>(DummyNtCreateFile), &handle,
  90. FILE_READ_DATA, &attr, &iosb, 0, 0,
  91. FILE_SHARE_WRITE | FILE_SHARE_READ | FILE_SHARE_DELETE, FILE_OPEN, 0,
  92. nullptr, 0);
  93. if (NT_SUCCESS(ret))
  94. CloseHandle(handle);
  95. }
  96. // NtOpenFile
  97. NTSTATUS WINAPI DummyNtOpenFile(PHANDLE file,
  98. ACCESS_MASK desired_access,
  99. POBJECT_ATTRIBUTES object_attributes,
  100. PIO_STATUS_BLOCK io_status,
  101. ULONG sharing,
  102. ULONG options) {
  103. return STATUS_ACCESS_DENIED;
  104. }
  105. void TestNtOpenFile() {
  106. UNICODE_STRING path_str;
  107. OBJECT_ATTRIBUTES attr;
  108. IO_STATUS_BLOCK iosb;
  109. HANDLE handle = INVALID_HANDLE_VALUE;
  110. BINDNTDLL(RtlInitUnicodeString);
  111. RtlInitUnicodeString(&path_str, L"\\??\\leak");
  112. InitializeObjectAttributes(&attr, &path_str, OBJ_CASE_INSENSITIVE, nullptr,
  113. nullptr);
  114. NTSTATUS ret = TargetNtOpenFile(
  115. reinterpret_cast<NtOpenFileFunction>(DummyNtOpenFile), &handle,
  116. FILE_READ_DATA | SYNCHRONIZE, &attr, &iosb, FILE_SHARE_READ, FILE_OPEN);
  117. if (NT_SUCCESS(ret))
  118. CloseHandle(handle);
  119. }
  120. // CreateThread
  121. HANDLE WINAPI DummyCreateThread(LPSECURITY_ATTRIBUTES thread_attributes,
  122. SIZE_T stack_size,
  123. LPTHREAD_START_ROUTINE start_address,
  124. LPVOID parameter,
  125. DWORD creation_flags,
  126. LPDWORD thread_id) {
  127. return nullptr;
  128. }
  129. DWORD WINAPI ThreadEntry(LPVOID) {
  130. return 0;
  131. }
  132. void TestCreateThread() {
  133. HANDLE handle = TargetCreateThread(
  134. reinterpret_cast<CreateThreadFunction>(DummyCreateThread), nullptr,
  135. SIZE_MAX, ThreadEntry, nullptr, 0, nullptr);
  136. if (handle) {
  137. WaitForSingleObject(handle, INFINITE);
  138. CloseHandle(handle);
  139. }
  140. }
  141. // Generates a blank policy where all the rules are ASK_BROKER.
  142. PolicyGlobal* GenerateBlankPolicy() {
  143. PolicyGlobal* policy = MakePolicyMemory();
  144. LowLevelPolicy policy_maker(policy);
  145. for (int i = static_cast<int>(IpcTag::UNUSED);
  146. i < static_cast<int>(IpcTag::LAST); i++) {
  147. IpcTag service = static_cast<IpcTag>(i);
  148. PolicyRule ask_broker(ASK_BROKER);
  149. ask_broker.Done();
  150. policy_maker.AddRule(service, &ask_broker);
  151. }
  152. policy_maker.Done();
  153. return policy;
  154. }
  155. // The Policy structure must be flattened before placing into the policy buffer.
  156. // This code is taken from target_process.cc
  157. void CopyPolicyToTarget(const void* source, size_t size, void* dest) {
  158. if (!source || !size)
  159. return;
  160. memcpy(dest, source, size);
  161. sandbox::PolicyGlobal* policy =
  162. reinterpret_cast<sandbox::PolicyGlobal*>(dest);
  163. size_t offset = reinterpret_cast<size_t>(source);
  164. for (size_t i = 0; i < sandbox::kMaxServiceCount; i++) {
  165. size_t buffer = reinterpret_cast<size_t>(policy->entry[i]);
  166. if (buffer) {
  167. buffer -= offset;
  168. policy->entry[i] = reinterpret_cast<sandbox::PolicyBuffer*>(buffer);
  169. }
  170. }
  171. }
  172. } // namespace
  173. SBOX_TESTS_COMMAND int IPC_Leak(int argc, wchar_t** argv) {
  174. if (argc != 1)
  175. return SBOX_TEST_FAILED;
  176. // Replace current target policy with one that forwards all interceptions to
  177. // broker.
  178. PolicyGlobal* policy = GenerateBlankPolicy();
  179. PolicyGlobal* current_policy =
  180. (PolicyGlobal*)sandbox::GetGlobalPolicyMemory();
  181. CopyPolicyToTarget(policy, policy->data_size + sizeof(PolicyGlobal),
  182. current_policy);
  183. int test = wcstol(argv[0], nullptr, 10);
  184. static_assert(TESTIPC_NTOPENFILE == 0,
  185. "TESTIPC_NTOPENFILE must be first in enum.");
  186. if (test < TESTIPC_NTOPENFILE || test >= TESTIPC_LAST)
  187. return SBOX_TEST_INVALID_PARAMETER;
  188. auto test_id = TestId(test);
  189. switch (test_id) {
  190. case TESTIPC_NTOPENFILE:
  191. TestNtOpenFile();
  192. break;
  193. case TESTIPC_NTCREATEFILE:
  194. TestNtCreateFile();
  195. break;
  196. case TESTIPC_CREATETHREAD:
  197. TestCreateThread();
  198. break;
  199. case TESTIPC_CREATENAMEDPIPEW:
  200. TestCreateNamedPipeW();
  201. break;
  202. case TESTIPC_LAST:
  203. NOTREACHED_NT();
  204. break;
  205. }
  206. // Taken from sandbox_policy_base.cc
  207. size_t shared_size = base::GetPageSize() * 2;
  208. const size_t channel_size = sandbox::kIPCChannelSize;
  209. // Calculate how many channels can fit in the shared memory.
  210. shared_size -= offsetof(IPCControl, channels);
  211. size_t channel_count = shared_size / (sizeof(ChannelControl) + channel_size);
  212. size_t base_start =
  213. (sizeof(ChannelControl) * channel_count) + offsetof(IPCControl, channels);
  214. void* memory = GetGlobalIPCMemory();
  215. if (!memory)
  216. return SBOX_TEST_FAILED;
  217. // structure taken from crosscall_params.h
  218. struct ipc_internal {
  219. uint32_t tag;
  220. uint32_t is_in_out;
  221. CrossCallReturn answer;
  222. };
  223. auto* ipc_data = reinterpret_cast<ipc_internal*>(
  224. reinterpret_cast<char*>(memory) + base_start);
  225. return base::win::HandleToUint32(ipc_data->answer.handle);
  226. }
  227. TEST(IPCTest, IPCLeak) {
  228. struct TestData {
  229. TestId test_id;
  230. const char* test_name;
  231. HANDLE expected_result;
  232. } test_data[] = {{TESTIPC_NTOPENFILE, "TESTIPC_NTOPENFILE", nullptr},
  233. {TESTIPC_NTCREATEFILE, "TESTIPC_NTCREATEFILE", nullptr},
  234. {TESTIPC_CREATETHREAD, "TESTIPC_CREATETHREAD", nullptr},
  235. {TESTIPC_CREATENAMEDPIPEW, "TESTIPC_CREATENAMEDPIPEW",
  236. INVALID_HANDLE_VALUE}};
  237. static_assert(std::size(test_data) == TESTIPC_LAST, "Not enough tests.");
  238. for (auto test : test_data) {
  239. TestRunner runner;
  240. std::wstring command = std::wstring(L"IPC_Leak ");
  241. command += std::to_wstring(test.test_id);
  242. EXPECT_EQ(test.expected_result,
  243. base::win::Uint32ToHandle(runner.RunTest(command.c_str())))
  244. << test.test_name;
  245. }
  246. }
  247. } // namespace sandbox