1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <unistd.h>
4 #include <darwintest.h>
5 #include <spawn.h>
6 #include <mach/mach.h>
7 #include <sys/sysctl.h>
8 #include <sys/csr.h>
9 #include <signal.h>
10 #include "excserver_protect_state.h"
11 #include "../osfmk/mach/port.h"
12 #include "../osfmk/kern/exc_guard.h"
13 #include "exc_helpers.h"
14 #include <sys/code_signing.h>
15 #include "cs_helpers.h"
16 #include <TargetConditionals.h>
17
18 #define MAX_ARGV 3
19
20 extern char **environ;
21 static mach_exception_data_type_t received_exception_code = 0;
22 static exception_type_t exception_taken = 0;
23
24 /*
25 * This test infrastructure is inspired from imm_pinned_control_port.c.
26 * It verifies no reply port security semantics are violated.
27 *
28 * 1. The rcv right of the port would be marked immovable.
29 */
30 T_GLOBAL_META(
31 T_META_NAMESPACE("xnu.ipc"),
32 T_META_RADAR_COMPONENT_NAME("xnu"),
33 T_META_RADAR_COMPONENT_VERSION("IPC"),
34 T_META_TIMEOUT(10),
35 T_META_RUN_CONCURRENTLY(TRUE));
36
37 static bool
check_current_cs_flags(code_signing_config_t expected_cs_config)38 check_current_cs_flags(code_signing_config_t expected_cs_config)
39 {
40 code_signing_config_t cur_cs_config = 0;
41 size_t cs_config_size = sizeof(cur_cs_config);
42 sysctlbyname("security.codesigning.config", &cur_cs_config, &cs_config_size, NULL, 0);
43 return cur_cs_config & expected_cs_config;
44 }
45
46 static bool
unrestricted_debugging()47 unrestricted_debugging()
48 {
49 /* AMFI often disables security features if debugging is unrestricted */
50 bool unrestricted_debugging = check_current_cs_flags(CS_CONFIG_UNRESTRICTED_DEBUGGING);
51 if (unrestricted_debugging) {
52 T_LOG("UNRESTRICTED DEBUGGING");
53 }
54 return unrestricted_debugging;
55 }
56
57 static bool
sip_disabled()58 sip_disabled()
59 {
60 #if XNU_TARGET_OS_OSX || XNU_TARGET_OS_BRIDGE
61 /* SIP can only be disabled on macOS */
62 bool sip_disabled = csr_check(CSR_ALLOW_UNRESTRICTED_FS) != 0;
63 if (sip_disabled) {
64 T_LOG("SIP DISABLED");
65 }
66 return sip_disabled;
67 #else
68 return false;
69 #endif
70 }
71
72 static bool
ipc_hardening_disabled()73 ipc_hardening_disabled()
74 {
75 #if TARGET_OS_OSX || TARGET_OS_BRIDGE
76 /*
77 * CS_CONFIG_GET_OUT_OF_MY_WAY (enabled via AMFI boot-args)
78 * disables IPC security features. This boot-arg previously
79 * caused a headache for developers on macos, who frequently use it for
80 * testing purposes, because all of their 3rd party apps will
81 * crash due to being treated as platform code. Unfortunately
82 * BATS runs with this boot-arg enabled very frequently.
83 */
84 bool enforcement_disabled = check_current_cs_flags(CS_CONFIG_GET_OUT_OF_MY_WAY);
85 if (enforcement_disabled) {
86 T_LOG("IPC HARDENING ENFORCEMENT IS DISABLED");
87 } else {
88 T_LOG("IPC HARDENING ENABLED");
89 }
90 return enforcement_disabled;
91 #else /* TARGET_OS_OSX || TARGET_OS_BRIDGE */
92 /* mach hardening is only disabled by boot-args on macOS */
93 return false;
94 #endif
95 }
96
97 static bool
is_release_kernel()98 is_release_kernel()
99 {
100 int kernel_type = 0;
101 size_t kernel_type_size = sizeof(kernel_type);
102 int r;
103 r = sysctlbyname("kern.development", &kernel_type, &kernel_type_size, NULL, 0);
104 if (r < 0) {
105 T_WITH_ERRNO;
106 T_SKIP("could not find \"kern.development\" sysctl");
107 }
108 return kernel_type == 0;
109 }
110
111
112
113 static mach_port_t
alloc_exception_port(void)114 alloc_exception_port(void)
115 {
116 kern_return_t kret;
117 mach_port_t exc_port = MACH_PORT_NULL;
118 mach_port_t task = mach_task_self();
119
120 kret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
121 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_allocate exc_port");
122
123 kret = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
124 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_insert_right exc_port");
125
126 return exc_port;
127 }
128
129 kern_return_t
catch_mach_exception_raise_state(mach_port_t exception_port,exception_type_t exception,const mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,const thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)130 catch_mach_exception_raise_state(mach_port_t exception_port,
131 exception_type_t exception,
132 const mach_exception_data_t code,
133 mach_msg_type_number_t code_count,
134 int * flavor,
135 const thread_state_t old_state,
136 mach_msg_type_number_t old_state_count,
137 thread_state_t new_state,
138 mach_msg_type_number_t * new_state_count)
139 {
140 #pragma unused(exception_port, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
141 T_FAIL("Unsupported catch_mach_exception_raise_state");
142 return KERN_NOT_SUPPORTED;
143 }
144
145 kern_return_t
catch_mach_exception_raise_state_identity(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)146 catch_mach_exception_raise_state_identity(mach_port_t exception_port,
147 mach_port_t thread,
148 mach_port_t task,
149 exception_type_t exception,
150 mach_exception_data_t code,
151 mach_msg_type_number_t code_count,
152 int * flavor,
153 thread_state_t old_state,
154 mach_msg_type_number_t old_state_count,
155 thread_state_t new_state,
156 mach_msg_type_number_t * new_state_count)
157 {
158 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
159 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
160 return KERN_NOT_SUPPORTED;
161 }
162
163 kern_return_t
catch_mach_exception_raise_state_identity_protected(__unused mach_port_t exception_port,uint64_t thread_id,mach_port_t task_id_token,exception_type_t exception,mach_exception_data_t codes,mach_msg_type_number_t codeCnt,__unused int * flavor,__unused thread_state_t old_state,__unused mach_msg_type_number_t old_state_count,__unused thread_state_t new_state,__unused mach_msg_type_number_t * new_state_count)164 catch_mach_exception_raise_state_identity_protected(
165 __unused mach_port_t exception_port,
166 uint64_t thread_id,
167 mach_port_t task_id_token,
168 exception_type_t exception,
169 mach_exception_data_t codes,
170 mach_msg_type_number_t codeCnt,
171 __unused int * flavor,
172 __unused thread_state_t old_state,
173 __unused mach_msg_type_number_t old_state_count,
174 __unused thread_state_t new_state,
175 __unused mach_msg_type_number_t * new_state_count)
176 {
177 #pragma unused(exception_port, thread_id, task_id_token, exception, codes, codeCnt)
178
179 T_FAIL("Unsupported catch_mach_exception_raise_state_identity_protected");
180 return KERN_NOT_SUPPORTED;
181 }
182
183 kern_return_t
catch_mach_exception_raise_identity_protected(__unused mach_port_t exception_port,uint64_t thread_id,mach_port_t task_id_token,exception_type_t exception,mach_exception_data_t codes,mach_msg_type_number_t codeCnt)184 catch_mach_exception_raise_identity_protected(
185 __unused mach_port_t exception_port,
186 uint64_t thread_id,
187 mach_port_t task_id_token,
188 exception_type_t exception,
189 mach_exception_data_t codes,
190 mach_msg_type_number_t codeCnt)
191 {
192 #pragma unused(exception_port, thread_id, task_id_token)
193
194 T_ASSERT_GT_UINT(codeCnt, 1, "CodeCnt");
195
196 T_LOG("Caught %d codes", codeCnt);
197 T_LOG("Caught exception type: %d code[0]: 0x%llx code[1]:0x%llx", exception, codes[0], codes[1]);
198 exception_taken = exception;
199 if (exception == EXC_GUARD) {
200 received_exception_code = EXC_GUARD_DECODE_GUARD_FLAVOR((uint64_t)codes[0]);
201 } else {
202 T_FAIL("Unexpected exception");
203 }
204 return KERN_SUCCESS;
205 }
206
207 kern_return_t
catch_mach_exception_raise(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count)208 catch_mach_exception_raise(mach_port_t exception_port,
209 mach_port_t thread,
210 mach_port_t task,
211 exception_type_t exception,
212 mach_exception_data_t code,
213 mach_msg_type_number_t code_count)
214 {
215 #pragma unused(exception_port, thread, task, exception, code, code_count)
216 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
217 return KERN_NOT_SUPPORTED;
218 }
219
220 static void *
exception_server_thread(void * arg)221 exception_server_thread(void *arg)
222 {
223 kern_return_t kr;
224 mach_port_t exc_port = *(mach_port_t *)arg;
225
226 /* Handle exceptions on exc_port */
227 kr = mach_msg_server_once(mach_exc_server, 4096, exc_port, 0);
228 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_msg_server_once");
229
230 return NULL;
231 }
232
233 static void
reply_port_defense(const bool thirdparty_hardened,int test_index,mach_exception_data_type_t expected_exception_code,bool triggers_exception)234 reply_port_defense(const bool thirdparty_hardened, int test_index, mach_exception_data_type_t expected_exception_code, bool triggers_exception)
235 {
236 /* reset exception code before running this test */
237 received_exception_code = 0;
238 int ret = 0;
239
240 uint32_t task_exc_guard = 0;
241 size_t te_size = sizeof(&task_exc_guard);
242
243 /* Test that the behavior is the same between these two */
244 char *test_prog_name = thirdparty_hardened ?
245 "./reply_port_defense_client_3P_hardened" : "./reply_port_defense_client";
246 char *child_args[MAX_ARGV];
247 pid_t client_pid = 0;
248 posix_spawnattr_t attrs;
249
250 pthread_t s_exc_thread;
251 mach_port_t exc_port;
252
253 T_LOG("Check if task_exc_guard exception has been enabled\n");
254 ret = sysctlbyname("kern.task_exc_guard_default", &task_exc_guard, &te_size, NULL, 0);
255 T_ASSERT_EQ(ret, 0, "sysctlbyname");
256
257 if (!(task_exc_guard & TASK_EXC_GUARD_MP_DELIVER)) {
258 T_SKIP("task_exc_guard exception is not enabled");
259 }
260
261 exc_port = alloc_exception_port();
262 T_QUIET; T_ASSERT_NE(exc_port, MACH_PORT_NULL, "Create a new exception port");
263
264 /* Create exception serving thread */
265 ret = pthread_create(&s_exc_thread, NULL, exception_server_thread, &exc_port);
266 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_create exception_server_thread");
267
268 /* Initialize posix_spawn attributes */
269 posix_spawnattr_init(&attrs);
270
271 /*
272 * It is allowed for us to set an exception port because we are entitled test process.
273 * If you are using this code as an example for platform binaries,
274 * use `EXCEPTION_IDENTITY_PROTECTED` instead of `EXCEPTION_DEFAULT`
275 */
276 int err = posix_spawnattr_setexceptionports_np(&attrs, EXC_MASK_GUARD, exc_port,
277 (exception_behavior_t) (EXCEPTION_IDENTITY_PROTECTED | MACH_EXCEPTION_CODES), 0);
278 T_QUIET; T_ASSERT_POSIX_SUCCESS(err, "posix_spawnattr_setflags");
279
280 child_args[0] = test_prog_name;
281 char test_num[10];
282 sprintf(test_num, "%d", test_index);
283 child_args[1] = test_num;
284 child_args[2] = NULL;
285
286 T_LOG("========== Spawning new child ==========");
287 err = posix_spawn(&client_pid, child_args[0], NULL, &attrs, &child_args[0], environ);
288 T_ASSERT_POSIX_SUCCESS(err, "posix_spawn reply_port_defense_client = %d", client_pid);
289
290 int child_status;
291 /* Wait for child and check for exception */
292 if (-1 == waitpid(-1, &child_status, 0)) {
293 T_FAIL("%s waitpid: child", strerror(errno));
294 }
295 if (WIFEXITED(child_status) && WEXITSTATUS(child_status)) {
296 T_FAIL("Child exited with status = 0x%x", child_status);
297 }
298 sleep(1);
299 kill(1, SIGKILL);
300 if (triggers_exception) {
301 ret = pthread_join(s_exc_thread, NULL);
302 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_join");
303 }
304
305 mach_port_deallocate(mach_task_self(), exc_port);
306
307 T_LOG("Exception code: Received code = 0x%llx Expected code = 0x%llx", received_exception_code, expected_exception_code);
308 T_EXPECT_EQ(received_exception_code, expected_exception_code, "Exception code: Received == Expected");
309 }
310
311 T_DECL(reply_port_defense,
312 "Test reply port semantics violations",
313 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
314 T_META_CHECK_LEAKS(false),
315 T_META_TAG_VM_PREFERRED,
316 T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) {
317 if (ipc_hardening_disabled()) {
318 T_SKIP("hardening disabled due to boot-args");
319 }
320 bool triggers_exception = true;
321 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_IMMOVABLE;
322 int test_num = 0;
323 int rp_defense_max_test_idx = 3;
324 /* Run the reply_port_defense tests 0, 1, 2 */
325 for (int i = test_num; i < rp_defense_max_test_idx; i++) {
326 reply_port_defense(true, i, expected_exception_code, triggers_exception);
327 reply_port_defense(false, i, expected_exception_code, triggers_exception);
328 }
329 reply_port_defense(true, 3, kGUARD_EXC_INVALID_RIGHT, triggers_exception);
330 reply_port_defense(false, 3, kGUARD_EXC_INVALID_RIGHT, triggers_exception);
331 }
332
333 T_DECL(test_unentitled_thread_set_exception_ports,
334 "thread_set_exception_ports should fail without an entitlement",
335 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
336 T_META_CHECK_LEAKS(false)) {
337 int test_num = 5;
338 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_EXCEPTION_BEHAVIOR_ENFORCE;
339 bool triggers_exception = true;
340
341 if (ipc_hardening_disabled()) {
342 T_SKIP("hardening disabled due to boot-args");
343 }
344
345 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
346 // reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
347 }
348
349 T_DECL(test_unentitled_thread_set_state,
350 "thread_set_state should fail without an entitlement",
351 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
352 T_META_CHECK_LEAKS(false),
353 T_META_ENABLED(false /* rdar://133955889 */))
354 {
355 int test_num = 6;
356 if (ipc_hardening_disabled()) {
357 T_SKIP("hardening disabled due to boot-args");
358 }
359 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_THREAD_SET_STATE;
360 bool triggers_exception = true;
361
362 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
363 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
364 }
365
366 T_DECL(unentitled_set_exception_ports_pass,
367 "set_exception_ports should succeed",
368 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
369 T_META_CHECK_LEAKS(false)) {
370 int test_num = 7;
371 if (ipc_hardening_disabled()) {
372 T_SKIP("hardening disabled due to boot-args");
373 }
374 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_NONE;
375 bool triggers_exception = false;
376 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
377 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
378 }
379
380
381 T_DECL(kobject_reply_port_defense,
382 "sending messages to kobjects without a proper reply port should crash",
383 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
384 T_META_TAG_VM_PREFERRED,
385 T_META_CHECK_LEAKS(false),
386 T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) { /* disable on macOS due to BATS boot-args */
387 if (ipc_hardening_disabled()) {
388 T_SKIP("hardening disabled due to boot-args");
389 }
390 int test_num = 9;
391 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_KOBJECT_REPLY_PORT_SEMANTICS;
392 bool triggers_exception = true;
393
394 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
395 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
396 }
397
398 T_DECL(test_alloc_weak_reply_port,
399 "1p is not allowed to create weak reply ports",
400 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
401 T_META_CHECK_LEAKS(false)) {
402 if (ipc_hardening_disabled()) {
403 T_SKIP("hardening disabled due to boot-args");
404 }
405
406 int test_num = 10;
407 mach_exception_data_type_t expected_exception_code;
408 bool triggers_exception = true;
409
410 #if TARGET_OS_OSX || TARGET_OS_BRIDGE
411 expected_exception_code = kGUARD_EXC_PROVISIONAL_REPLY_PORT;
412 #else
413 expected_exception_code = kGUARD_EXC_INVALID_MPO_ENTITLEMENT;
414 #endif /* TARGET_OS_OSX || TARGET_OS_BRIDGE */
415
416 /* rdar://136996362 (iOS+ telemetry for restricting 1P usage of provisional reply port) */
417 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
418 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
419 }
420
421 T_DECL(test_move_service_port,
422 "service ports are immovable",
423 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
424 T_META_CHECK_LEAKS(false)) {
425 int test_num = 11;
426 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_SERVICE_PORT_VIOLATION_FATAL;
427 bool triggers_exception = true;
428
429 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
430 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
431 }
432
433
434 T_DECL(test_notification_policy,
435 "registering notifications on an mktimer crashes",
436 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
437 T_META_CHECK_LEAKS(false),
438 T_META_TAG_VM_PREFERRED,
439 T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) { /* disable on macOS due to BATS boot-args */
440 if (ipc_hardening_disabled()) {
441 T_SKIP("hardening disabled due to boot-args");
442 }
443
444 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_INVALID_NOTIFICATION_REQ;
445 bool triggers_exception = true;
446
447 int test_num = 12;
448 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
449 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
450
451 test_num = 13;
452 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
453 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
454
455 test_num = 14;
456 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
457 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
458 }
459
460
461 T_DECL(test_reply_port_extract_right_disallowed,
462 "mach_port_extract_right disallowed on reply port",
463 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
464 T_META_CHECK_LEAKS(false)) {
465 if (ipc_hardening_disabled()) {
466 T_SKIP("hardening disabled due to boot-args");
467 }
468
469 int test_num = 15;
470 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_INVALID_RIGHT;
471 bool triggers_exception = true;
472
473 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
474 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
475 }
476
477 T_DECL(test_mach_task_self_send_movability,
478 "mach_task_self is immovable unless you have called ",
479 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
480 T_META_CHECK_LEAKS(false)) {
481 if (ipc_hardening_disabled()) {
482 T_SKIP("hardening disabled due to boot-args");
483 }
484
485 int test_num = 16;
486 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_IMMOVABLE;
487 bool triggers_exception = true;
488
489 if (sip_disabled() || unrestricted_debugging()) {
490 /*
491 * see `proc_check_get_movable_control_port`:
492 * enforcement is always controlled by entitlements and
493 * unrestricted debugging boot-arg
494 * or if SIP is disabled
495 */
496 expected_exception_code = 0;
497 triggers_exception = false;
498 }
499
500 /*
501 * it should fail on reply_port_defense_client_3P_hardened because it doesn't
502 * have com.apple.security.get-movable-control-port
503 */
504 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
505 test_num = 17; /* These tests crash the same way */
506 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
507
508 /*
509 * it should succeed on reply_port_defense_client because it
510 * has com.apple.security.get-movable-control-port
511 */
512 test_num = 16;
513 expected_exception_code = 0;
514 triggers_exception = false;
515 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
516 test_num = 17;
517 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
518 }
519
520
521 T_DECL(test_send_immovability,
522 "ensure that send immovability is set on ports, even if they are not copied out",
523 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
524 T_META_CHECK_LEAKS(false)) {
525 /* attempt to move ports created by mach port construct */
526
527
528 /* test_move_newly_constructed_port_immovable_send */
529 int test_num = 18;
530 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_IMMOVABLE;
531 bool triggers_exception = true;
532 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
533 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
534
535 /* test_move_special_reply_port */
536 test_num = 19;
537 expected_exception_code = kGUARD_EXC_IMMOVABLE;
538 triggers_exception = true;
539 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
540 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
541 }
542
543 T_DECL(test_reply_port_header_disposition,
544 "Ensure only make_send_once is allowed for reply port",
545 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
546 T_META_CHECK_LEAKS(false),
547 T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) {
548 #if TARGET_OS_OSX || TARGET_OS_BRIDGE
549 T_SKIP("disabled on macos");
550 #endif
551 int test_num = 20;
552 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_SEND_INVALID_REPLY;
553 bool triggers_exception = true;
554
555 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
556 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
557 }
558
559 T_DECL(test_service_port_as_exception_port,
560 "Ensure both service and weak service port can be used as exception port",
561 T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
562 T_META_CHECK_LEAKS(false)) {
563 int test_num = 21;
564 mach_exception_data_type_t expected_exception_code = kGUARD_EXC_NONE;
565 bool triggers_exception = false;
566
567 reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
568 reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
569 }
570