0aa9ecf1e3
- edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Apply-uncrustify-changes.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852] - Resolves: RHEL-21840 (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]) - Resolves: RHEL-21844 (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]) - Resolves: RHEL-21846 (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]) - Resolves: RHEL-21848 (CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]) - Resolves: RHEL-21850 (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]) - Resolves: RHEL-21852 (CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8])
278 lines
8.7 KiB
Diff
278 lines
8.7 KiB
Diff
From e8200dda7752d21794b2268efe9e957958ffef29 Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Wed, 14 Feb 2024 12:24:44 -0500
|
|
Subject: [PATCH 03/15] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit
|
|
Tests
|
|
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
|
|
RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
|
|
RH-Acked-by: Gerd Hoffmann <None>
|
|
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
|
RH-Commit: [3/15] ca554677a3397423073d3bb4774f856b2329ae9c
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-21844
|
|
CVE: CVE-2022-45231
|
|
Upstream: Merged
|
|
|
|
commit 6f77463d72807ec7f4ed6518c3dac29a1040df9f
|
|
Author: Doug Flick <dougflick@microsoft.com>
|
|
Date: Fri Jan 26 05:54:49 2024 +0800
|
|
|
|
NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit Tests
|
|
|
|
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536
|
|
|
|
Validates that the patch for...
|
|
|
|
Out-of-bounds read when handling a ND Redirect message with truncated
|
|
options
|
|
|
|
.. has been fixed
|
|
|
|
Tests the following function to ensure that an out of bounds read does
|
|
not occur
|
|
Ip6OptionValidation
|
|
|
|
Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
|
|
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
|
|
|
|
Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
|
|
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
---
|
|
.../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp | 20 +++
|
|
.../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf | 42 ++++++
|
|
.../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp | 129 ++++++++++++++++++
|
|
NetworkPkg/Test/NetworkPkgHostTest.dsc | 1 +
|
|
4 files changed, 192 insertions(+)
|
|
create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
|
|
create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
|
|
create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
|
|
|
|
diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
|
|
new file mode 100644
|
|
index 0000000000..6ebfd5fdfb
|
|
--- /dev/null
|
|
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
|
|
@@ -0,0 +1,20 @@
|
|
+/** @file
|
|
+ Acts as the main entry point for the tests for the Ip6Dxe module.
|
|
+
|
|
+ Copyright (c) Microsoft Corporation
|
|
+ SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
+**/
|
|
+#include <gtest/gtest.h>
|
|
+
|
|
+////////////////////////////////////////////////////////////////////////////////
|
|
+// Run the tests
|
|
+////////////////////////////////////////////////////////////////////////////////
|
|
+int
|
|
+main (
|
|
+ int argc,
|
|
+ char *argv[]
|
|
+ )
|
|
+{
|
|
+ testing::InitGoogleTest (&argc, argv);
|
|
+ return RUN_ALL_TESTS ();
|
|
+}
|
|
diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
|
|
new file mode 100644
|
|
index 0000000000..6e4de0745f
|
|
--- /dev/null
|
|
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
|
|
@@ -0,0 +1,42 @@
|
|
+## @file
|
|
+# Unit test suite for the Ip6Dxe using Google Test
|
|
+#
|
|
+# Copyright (c) Microsoft Corporation.<BR>
|
|
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
+##
|
|
+[Defines]
|
|
+ INF_VERSION = 0x00010017
|
|
+ BASE_NAME = Ip6DxeUnitTest
|
|
+ FILE_GUID = 4F05D17D-D3E7-4AAE-820C-576D46D2D34A
|
|
+ VERSION_STRING = 1.0
|
|
+ MODULE_TYPE = HOST_APPLICATION
|
|
+#
|
|
+# The following information is for reference only and not required by the build tools.
|
|
+#
|
|
+# VALID_ARCHITECTURES = IA32 X64 AARCH64
|
|
+#
|
|
+[Sources]
|
|
+ Ip6DxeGoogleTest.cpp
|
|
+ Ip6OptionGoogleTest.cpp
|
|
+ ../Ip6Option.c
|
|
+
|
|
+[Packages]
|
|
+ MdePkg/MdePkg.dec
|
|
+ MdeModulePkg/MdeModulePkg.dec
|
|
+ UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
|
|
+ NetworkPkg/NetworkPkg.dec
|
|
+
|
|
+[LibraryClasses]
|
|
+ GoogleTestLib
|
|
+ DebugLib
|
|
+ NetLib
|
|
+ PcdLib
|
|
+
|
|
+[Protocols]
|
|
+ gEfiDhcp6ServiceBindingProtocolGuid
|
|
+
|
|
+[Pcd]
|
|
+ gEfiNetworkPkgTokenSpaceGuid.PcdDhcp6UidType
|
|
+
|
|
+[Guids]
|
|
+ gZeroGuid
|
|
diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
|
|
new file mode 100644
|
|
index 0000000000..f2cd90e1a9
|
|
--- /dev/null
|
|
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
|
|
@@ -0,0 +1,129 @@
|
|
+/** @file
|
|
+ Tests for Ip6Option.c.
|
|
+
|
|
+ Copyright (c) Microsoft Corporation
|
|
+ SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
+**/
|
|
+#include <gtest/gtest.h>
|
|
+
|
|
+extern "C" {
|
|
+ #include <Uefi.h>
|
|
+ #include <Library/BaseLib.h>
|
|
+ #include <Library/DebugLib.h>
|
|
+ #include "../Ip6Impl.h"
|
|
+ #include "../Ip6Option.h"
|
|
+}
|
|
+
|
|
+/////////////////////////////////////////////////////////////////////////
|
|
+// Defines
|
|
+///////////////////////////////////////////////////////////////////////
|
|
+
|
|
+#define IP6_PREFIX_INFO_OPTION_DATA_LEN 32
|
|
+#define OPTION_HEADER_IP6_PREFIX_DATA_LEN (sizeof (IP6_OPTION_HEADER) + IP6_PREFIX_INFO_OPTION_DATA_LEN)
|
|
+
|
|
+////////////////////////////////////////////////////////////////////////
|
|
+// Symbol Definitions
|
|
+// These functions are not directly under test - but required to compile
|
|
+////////////////////////////////////////////////////////////////////////
|
|
+UINT32 mIp6Id;
|
|
+
|
|
+EFI_STATUS
|
|
+Ip6SendIcmpError (
|
|
+ IN IP6_SERVICE *IpSb,
|
|
+ IN NET_BUF *Packet,
|
|
+ IN EFI_IPv6_ADDRESS *SourceAddress OPTIONAL,
|
|
+ IN EFI_IPv6_ADDRESS *DestinationAddress,
|
|
+ IN UINT8 Type,
|
|
+ IN UINT8 Code,
|
|
+ IN UINT32 *Pointer OPTIONAL
|
|
+ )
|
|
+{
|
|
+ // ..
|
|
+ return EFI_SUCCESS;
|
|
+}
|
|
+
|
|
+////////////////////////////////////////////////////////////////////////
|
|
+// Ip6OptionValidation Tests
|
|
+////////////////////////////////////////////////////////////////////////
|
|
+
|
|
+// Define a fixture for your tests if needed
|
|
+class Ip6OptionValidationTest : public ::testing::Test {
|
|
+protected:
|
|
+ // Add any setup code if needed
|
|
+ virtual void
|
|
+ SetUp (
|
|
+ )
|
|
+ {
|
|
+ // Initialize any resources or variables
|
|
+ }
|
|
+
|
|
+ // Add any cleanup code if needed
|
|
+ virtual void
|
|
+ TearDown (
|
|
+ )
|
|
+ {
|
|
+ // Clean up any resources or variables
|
|
+ }
|
|
+};
|
|
+
|
|
+// Test Description:
|
|
+// Null option should return false
|
|
+TEST_F (Ip6OptionValidationTest, NullOptionShouldReturnFalse) {
|
|
+ UINT8 *option = nullptr;
|
|
+ UINT16 optionLen = 10; // Provide a suitable length
|
|
+
|
|
+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
|
|
+}
|
|
+
|
|
+// Test Description:
|
|
+// Truncated option should return false
|
|
+TEST_F (Ip6OptionValidationTest, TruncatedOptionShouldReturnFalse) {
|
|
+ UINT8 option[] = { 0x01 }; // Provide a truncated option
|
|
+ UINT16 optionLen = 1;
|
|
+
|
|
+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
|
|
+}
|
|
+
|
|
+// Test Description:
|
|
+// Ip6OptionPrefixInfo Option with zero length should return false
|
|
+TEST_F (Ip6OptionValidationTest, OptionWithZeroLengthShouldReturnFalse) {
|
|
+ IP6_OPTION_HEADER optionHeader;
|
|
+
|
|
+ optionHeader.Type = Ip6OptionPrefixInfo;
|
|
+ optionHeader.Length = 0;
|
|
+ UINT8 option[sizeof (IP6_OPTION_HEADER)];
|
|
+
|
|
+ CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
|
|
+ UINT16 optionLen = sizeof (IP6_OPTION_HEADER);
|
|
+
|
|
+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
|
|
+}
|
|
+
|
|
+// Test Description:
|
|
+// Ip6OptionPrefixInfo Option with valid length should return true
|
|
+TEST_F (Ip6OptionValidationTest, ValidPrefixInfoOptionShouldReturnTrue) {
|
|
+ IP6_OPTION_HEADER optionHeader;
|
|
+
|
|
+ optionHeader.Type = Ip6OptionPrefixInfo;
|
|
+ optionHeader.Length = 4; // Length 4 * 8 = 32
|
|
+ UINT8 option[OPTION_HEADER_IP6_PREFIX_DATA_LEN];
|
|
+
|
|
+ CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
|
|
+
|
|
+ EXPECT_TRUE (Ip6IsNDOptionValid (option, IP6_PREFIX_INFO_OPTION_DATA_LEN));
|
|
+}
|
|
+
|
|
+// Test Description:
|
|
+// Ip6OptionPrefixInfo Option with invalid length should return false
|
|
+TEST_F (Ip6OptionValidationTest, InvalidPrefixInfoOptionLengthShouldReturnFalse) {
|
|
+ IP6_OPTION_HEADER optionHeader;
|
|
+
|
|
+ optionHeader.Type = Ip6OptionPrefixInfo;
|
|
+ optionHeader.Length = 3; // Length 3 * 8 = 24 (Invalid)
|
|
+ UINT8 option[sizeof (IP6_OPTION_HEADER)];
|
|
+
|
|
+ CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
|
|
+ UINT16 optionLen = sizeof (IP6_OPTION_HEADER);
|
|
+
|
|
+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
|
|
+}
|
|
diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
|
|
index 20bc90b172..ab7c2857b6 100644
|
|
--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
|
|
+++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
|
|
@@ -25,6 +25,7 @@
|
|
# Build HOST_APPLICATION that tests NetworkPkg
|
|
#
|
|
NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
|
|
+ NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
|
|
|
|
# Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
|
|
[LibraryClasses]
|
|
--
|
|
2.39.3
|
|
|