1832dc76bSMariusz Zaborski /*-
2832dc76bSMariusz Zaborski * Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org>
3832dc76bSMariusz Zaborski *
4832dc76bSMariusz Zaborski * Redistribution and use in source and binary forms, with or without
5832dc76bSMariusz Zaborski * modification, are permitted provided that the following conditions
6832dc76bSMariusz Zaborski * are met:
7832dc76bSMariusz Zaborski * 1. Redistributions of source code must retain the above copyright
8832dc76bSMariusz Zaborski * notice, this list of conditions and the following disclaimer.
9832dc76bSMariusz Zaborski * 2. Redistributions in binary form must reproduce the above copyright
10832dc76bSMariusz Zaborski * notice, this list of conditions and the following disclaimer in the
11832dc76bSMariusz Zaborski * documentation and/or other materials provided with the distribution.
12832dc76bSMariusz Zaborski *
13832dc76bSMariusz Zaborski * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
14832dc76bSMariusz Zaborski * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
15832dc76bSMariusz Zaborski * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16832dc76bSMariusz Zaborski * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
17832dc76bSMariusz Zaborski * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
18832dc76bSMariusz Zaborski * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19832dc76bSMariusz Zaborski * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20832dc76bSMariusz Zaborski * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21832dc76bSMariusz Zaborski * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22832dc76bSMariusz Zaborski * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
23832dc76bSMariusz Zaborski * POSSIBILITY OF SUCH DAMAGE.
24832dc76bSMariusz Zaborski */
25832dc76bSMariusz Zaborski
26832dc76bSMariusz Zaborski #include <sys/param.h>
27832dc76bSMariusz Zaborski #include <sys/socket.h>
28832dc76bSMariusz Zaborski #include <netinet/in.h>
29832dc76bSMariusz Zaborski #include <arpa/inet.h>
30832dc76bSMariusz Zaborski
31832dc76bSMariusz Zaborski #include <errno.h>
32832dc76bSMariusz Zaborski #include <netdb.h>
33832dc76bSMariusz Zaborski
34832dc76bSMariusz Zaborski #include <atf-c.h>
35832dc76bSMariusz Zaborski
36832dc76bSMariusz Zaborski #include <libcasper.h>
37832dc76bSMariusz Zaborski #include <casper/cap_net.h>
38832dc76bSMariusz Zaborski
39832dc76bSMariusz Zaborski #define TEST_DOMAIN_0 "example.com"
40832dc76bSMariusz Zaborski #define TEST_DOMAIN_1 "freebsd.org"
41832dc76bSMariusz Zaborski #define TEST_IPV4 "1.1.1.1"
42832dc76bSMariusz Zaborski #define TEST_IPV6 "2001:4860:4860::8888"
43832dc76bSMariusz Zaborski #define TEST_BIND_IPV4 "127.0.0.1"
44179bffddSEric van Gyzen #define TEST_PORT 80
45179bffddSEric van Gyzen #define TEST_PORT_STR "80"
46832dc76bSMariusz Zaborski
47832dc76bSMariusz Zaborski static cap_channel_t *
create_network_service(void)48832dc76bSMariusz Zaborski create_network_service(void)
49832dc76bSMariusz Zaborski {
50832dc76bSMariusz Zaborski cap_channel_t *capcas, *capnet;
51832dc76bSMariusz Zaborski
52832dc76bSMariusz Zaborski capcas = cap_init();
53832dc76bSMariusz Zaborski ATF_REQUIRE(capcas != NULL);
54832dc76bSMariusz Zaborski
55832dc76bSMariusz Zaborski capnet = cap_service_open(capcas, "system.net");
56832dc76bSMariusz Zaborski ATF_REQUIRE(capnet != NULL);
57832dc76bSMariusz Zaborski
58832dc76bSMariusz Zaborski cap_close(capcas);
59832dc76bSMariusz Zaborski return (capnet);
60832dc76bSMariusz Zaborski }
61832dc76bSMariusz Zaborski
62832dc76bSMariusz Zaborski static int
test_getnameinfo_v4(cap_channel_t * chan,int family,const char * ip)63832dc76bSMariusz Zaborski test_getnameinfo_v4(cap_channel_t *chan, int family, const char *ip)
64832dc76bSMariusz Zaborski {
65832dc76bSMariusz Zaborski struct sockaddr_in ipaddr;
66832dc76bSMariusz Zaborski char capfn[MAXHOSTNAMELEN];
67832dc76bSMariusz Zaborski char origfn[MAXHOSTNAMELEN];
687ee4066dSMark Johnston int capret, sysret;
69832dc76bSMariusz Zaborski
70832dc76bSMariusz Zaborski memset(&ipaddr, 0, sizeof(ipaddr));
71832dc76bSMariusz Zaborski ipaddr.sin_family = family;
72832dc76bSMariusz Zaborski inet_pton(family, ip, &ipaddr.sin_addr);
73832dc76bSMariusz Zaborski
747ee4066dSMark Johnston capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr),
75832dc76bSMariusz Zaborski capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD);
767ee4066dSMark Johnston if (capret != 0 && capret == ENOTCAPABLE)
777ee4066dSMark Johnston return (ENOTCAPABLE);
78832dc76bSMariusz Zaborski
797ee4066dSMark Johnston sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn,
80832dc76bSMariusz Zaborski sizeof(origfn), NULL, 0, NI_NAMEREQD);
817ee4066dSMark Johnston if (sysret != 0) {
827ee4066dSMark Johnston atf_tc_skip("getnameinfo(%s) failed: %s",
837ee4066dSMark Johnston ip, gai_strerror(sysret));
847ee4066dSMark Johnston }
857ee4066dSMark Johnston ATF_REQUIRE(capret == 0);
86832dc76bSMariusz Zaborski ATF_REQUIRE(strcmp(origfn, capfn) == 0);
87832dc76bSMariusz Zaborski
88832dc76bSMariusz Zaborski return (0);
89832dc76bSMariusz Zaborski }
90832dc76bSMariusz Zaborski
91832dc76bSMariusz Zaborski static int
test_getnameinfo_v6(cap_channel_t * chan,const char * ip)92832dc76bSMariusz Zaborski test_getnameinfo_v6(cap_channel_t *chan, const char *ip)
93832dc76bSMariusz Zaborski {
94832dc76bSMariusz Zaborski struct sockaddr_in6 ipaddr;
95832dc76bSMariusz Zaborski char capfn[MAXHOSTNAMELEN];
96832dc76bSMariusz Zaborski char origfn[MAXHOSTNAMELEN];
977ee4066dSMark Johnston int capret, sysret;
98832dc76bSMariusz Zaborski
99832dc76bSMariusz Zaborski memset(&ipaddr, 0, sizeof(ipaddr));
100832dc76bSMariusz Zaborski ipaddr.sin6_family = AF_INET6;
101832dc76bSMariusz Zaborski inet_pton(AF_INET6, ip, &ipaddr.sin6_addr);
102832dc76bSMariusz Zaborski
1037ee4066dSMark Johnston capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr),
104832dc76bSMariusz Zaborski capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD);
1057ee4066dSMark Johnston if (capret != 0 && capret == ENOTCAPABLE)
1067ee4066dSMark Johnston return (ENOTCAPABLE);
107832dc76bSMariusz Zaborski
1087ee4066dSMark Johnston sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn,
109832dc76bSMariusz Zaborski sizeof(origfn), NULL, 0, NI_NAMEREQD);
1107ee4066dSMark Johnston if (sysret != 0) {
1117ee4066dSMark Johnston atf_tc_skip("getnameinfo(%s) failed: %s",
1127ee4066dSMark Johnston ip, gai_strerror(sysret));
1137ee4066dSMark Johnston }
1147ee4066dSMark Johnston ATF_REQUIRE(capret == 0);
115832dc76bSMariusz Zaborski ATF_REQUIRE(strcmp(origfn, capfn) == 0);
116832dc76bSMariusz Zaborski
117832dc76bSMariusz Zaborski return (0);
118832dc76bSMariusz Zaborski }
119832dc76bSMariusz Zaborski
120832dc76bSMariusz Zaborski static int
test_getnameinfo(cap_channel_t * chan,int family,const char * ip)121832dc76bSMariusz Zaborski test_getnameinfo(cap_channel_t *chan, int family, const char *ip)
122832dc76bSMariusz Zaborski {
123832dc76bSMariusz Zaborski
124832dc76bSMariusz Zaborski if (family == AF_INET6) {
125832dc76bSMariusz Zaborski return (test_getnameinfo_v6(chan, ip));
126832dc76bSMariusz Zaborski }
127832dc76bSMariusz Zaborski
128832dc76bSMariusz Zaborski return (test_getnameinfo_v4(chan, family, ip));
129832dc76bSMariusz Zaborski }
130832dc76bSMariusz Zaborski
131832dc76bSMariusz Zaborski static int
test_gethostbyaddr_v4(cap_channel_t * chan,int family,const char * ip)132832dc76bSMariusz Zaborski test_gethostbyaddr_v4(cap_channel_t *chan, int family, const char *ip)
133832dc76bSMariusz Zaborski {
134832dc76bSMariusz Zaborski struct in_addr ipaddr;
135832dc76bSMariusz Zaborski struct hostent *caphp, *orighp;
136832dc76bSMariusz Zaborski
137832dc76bSMariusz Zaborski memset(&ipaddr, 0, sizeof(ipaddr));
138832dc76bSMariusz Zaborski inet_pton(AF_INET, ip, &ipaddr);
139832dc76bSMariusz Zaborski
140832dc76bSMariusz Zaborski caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), family);
1417ee4066dSMark Johnston if (caphp == NULL && h_errno == ENOTCAPABLE)
1427ee4066dSMark Johnston return (ENOTCAPABLE);
143832dc76bSMariusz Zaborski
144832dc76bSMariusz Zaborski orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), family);
1457ee4066dSMark Johnston if (orighp == NULL)
1467ee4066dSMark Johnston atf_tc_skip("gethostbyaddr(%s) failed", ip);
1477ee4066dSMark Johnston ATF_REQUIRE(caphp != NULL);
1487ee4066dSMark Johnston ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0);
149832dc76bSMariusz Zaborski
150832dc76bSMariusz Zaborski return (0);
151832dc76bSMariusz Zaborski }
152832dc76bSMariusz Zaborski
153832dc76bSMariusz Zaborski static int
test_gethostbyaddr_v6(cap_channel_t * chan,const char * ip)154832dc76bSMariusz Zaborski test_gethostbyaddr_v6(cap_channel_t *chan, const char *ip)
155832dc76bSMariusz Zaborski {
156832dc76bSMariusz Zaborski struct in6_addr ipaddr;
157832dc76bSMariusz Zaborski struct hostent *caphp, *orighp;
158832dc76bSMariusz Zaborski
159832dc76bSMariusz Zaborski memset(&ipaddr, 0, sizeof(ipaddr));
160832dc76bSMariusz Zaborski inet_pton(AF_INET6, ip, &ipaddr);
161832dc76bSMariusz Zaborski
162832dc76bSMariusz Zaborski caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), AF_INET6);
1637ee4066dSMark Johnston if (caphp == NULL && h_errno == ENOTCAPABLE)
1647ee4066dSMark Johnston return (ENOTCAPABLE);
165832dc76bSMariusz Zaborski
166832dc76bSMariusz Zaborski orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), AF_INET6);
1677ee4066dSMark Johnston if (orighp == NULL)
1687ee4066dSMark Johnston atf_tc_skip("gethostbyaddr(%s) failed", ip);
1697ee4066dSMark Johnston ATF_REQUIRE(caphp != NULL);
1707ee4066dSMark Johnston ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0);
171832dc76bSMariusz Zaborski
172832dc76bSMariusz Zaborski return (0);
173832dc76bSMariusz Zaborski }
174832dc76bSMariusz Zaborski
175832dc76bSMariusz Zaborski static int
test_gethostbyaddr(cap_channel_t * chan,int family,const char * ip)176832dc76bSMariusz Zaborski test_gethostbyaddr(cap_channel_t *chan, int family, const char *ip)
177832dc76bSMariusz Zaborski {
178832dc76bSMariusz Zaborski
179832dc76bSMariusz Zaborski if (family == AF_INET6) {
180832dc76bSMariusz Zaborski return (test_gethostbyaddr_v6(chan, ip));
181832dc76bSMariusz Zaborski } else {
182832dc76bSMariusz Zaborski return (test_gethostbyaddr_v4(chan, family, ip));
183832dc76bSMariusz Zaborski }
184832dc76bSMariusz Zaborski }
185832dc76bSMariusz Zaborski
186832dc76bSMariusz Zaborski static int
test_getaddrinfo(cap_channel_t * chan,int family,const char * domain,const char * servname)187832dc76bSMariusz Zaborski test_getaddrinfo(cap_channel_t *chan, int family, const char *domain,
188832dc76bSMariusz Zaborski const char *servname)
189832dc76bSMariusz Zaborski {
190832dc76bSMariusz Zaborski struct addrinfo hints, *capres, *origres, *res0, *res1;
191832dc76bSMariusz Zaborski bool found;
1927ee4066dSMark Johnston int capret, sysret;
193832dc76bSMariusz Zaborski
194832dc76bSMariusz Zaborski memset(&hints, 0, sizeof(hints));
195832dc76bSMariusz Zaborski hints.ai_family = family;
196832dc76bSMariusz Zaborski hints.ai_socktype = SOCK_STREAM;
197832dc76bSMariusz Zaborski
1987ee4066dSMark Johnston capret = cap_getaddrinfo(chan, domain, servname, &hints, &capres);
1997ee4066dSMark Johnston if (capret != 0 && capret == ENOTCAPABLE)
2007ee4066dSMark Johnston return (capret);
201832dc76bSMariusz Zaborski
2027ee4066dSMark Johnston sysret = getaddrinfo(domain, servname, &hints, &origres);
2037ee4066dSMark Johnston if (sysret != 0)
2047ee4066dSMark Johnston atf_tc_skip("getaddrinfo(%s) failed: %s",
2057ee4066dSMark Johnston domain, gai_strerror(sysret));
2067ee4066dSMark Johnston ATF_REQUIRE(capret == 0);
207832dc76bSMariusz Zaborski
208832dc76bSMariusz Zaborski for (res0 = capres; res0 != NULL; res0 = res0->ai_next) {
209832dc76bSMariusz Zaborski found = false;
210832dc76bSMariusz Zaborski for (res1 = origres; res1 != NULL; res1 = res1->ai_next) {
211832dc76bSMariusz Zaborski if (res1->ai_addrlen == res0->ai_addrlen &&
212832dc76bSMariusz Zaborski memcmp(res1->ai_addr, res0->ai_addr,
213832dc76bSMariusz Zaborski res0->ai_addrlen) == 0) {
214832dc76bSMariusz Zaborski found = true;
215832dc76bSMariusz Zaborski break;
216832dc76bSMariusz Zaborski }
217832dc76bSMariusz Zaborski }
218832dc76bSMariusz Zaborski ATF_REQUIRE(found);
219832dc76bSMariusz Zaborski }
220832dc76bSMariusz Zaborski
221832dc76bSMariusz Zaborski freeaddrinfo(capres);
222832dc76bSMariusz Zaborski freeaddrinfo(origres);
223832dc76bSMariusz Zaborski return (0);
224832dc76bSMariusz Zaborski }
225832dc76bSMariusz Zaborski
226832dc76bSMariusz Zaborski static int
test_gethostbyname(cap_channel_t * chan,int family,const char * domain)227832dc76bSMariusz Zaborski test_gethostbyname(cap_channel_t *chan, int family, const char *domain)
228832dc76bSMariusz Zaborski {
229832dc76bSMariusz Zaborski struct hostent *caphp, *orighp;
230832dc76bSMariusz Zaborski
231832dc76bSMariusz Zaborski caphp = cap_gethostbyname2(chan, domain, family);
2327ee4066dSMark Johnston if (caphp == NULL && h_errno == ENOTCAPABLE)
233832dc76bSMariusz Zaborski return (h_errno);
234832dc76bSMariusz Zaborski
235832dc76bSMariusz Zaborski orighp = gethostbyname2(domain, family);
2367ee4066dSMark Johnston if (orighp == NULL)
2377ee4066dSMark Johnston atf_tc_skip("gethostbyname2(%s) failed", domain);
238832dc76bSMariusz Zaborski
2397ee4066dSMark Johnston ATF_REQUIRE(caphp != NULL);
2407ee4066dSMark Johnston ATF_REQUIRE(strcmp(caphp->h_name, orighp->h_name) == 0);
241832dc76bSMariusz Zaborski return (0);
242832dc76bSMariusz Zaborski }
243832dc76bSMariusz Zaborski
244832dc76bSMariusz Zaborski static int
test_bind(cap_channel_t * chan,const char * ip)245832dc76bSMariusz Zaborski test_bind(cap_channel_t *chan, const char *ip)
246832dc76bSMariusz Zaborski {
247832dc76bSMariusz Zaborski struct sockaddr_in ipv4;
248832dc76bSMariusz Zaborski int capfd, ret, serrno;
249832dc76bSMariusz Zaborski
250832dc76bSMariusz Zaborski capfd = socket(AF_INET, SOCK_STREAM, 0);
251832dc76bSMariusz Zaborski ATF_REQUIRE(capfd > 0);
252832dc76bSMariusz Zaborski
253832dc76bSMariusz Zaborski memset(&ipv4, 0, sizeof(ipv4));
254832dc76bSMariusz Zaborski ipv4.sin_family = AF_INET;
255832dc76bSMariusz Zaborski inet_pton(AF_INET, ip, &ipv4.sin_addr);
256832dc76bSMariusz Zaborski
257832dc76bSMariusz Zaborski ret = cap_bind(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4));
258832dc76bSMariusz Zaborski serrno = errno;
259832dc76bSMariusz Zaborski close(capfd);
260832dc76bSMariusz Zaborski
261832dc76bSMariusz Zaborski return (ret < 0 ? serrno : 0);
262832dc76bSMariusz Zaborski }
263832dc76bSMariusz Zaborski
264832dc76bSMariusz Zaborski static int
test_connect(cap_channel_t * chan,const char * ip,unsigned short port)265832dc76bSMariusz Zaborski test_connect(cap_channel_t *chan, const char *ip, unsigned short port)
266832dc76bSMariusz Zaborski {
267832dc76bSMariusz Zaborski struct sockaddr_in ipv4;
268832dc76bSMariusz Zaborski int capfd, ret, serrno;
269832dc76bSMariusz Zaborski
270832dc76bSMariusz Zaborski capfd = socket(AF_INET, SOCK_STREAM, 0);
2717ee4066dSMark Johnston ATF_REQUIRE(capfd >= 0);
272832dc76bSMariusz Zaborski
273832dc76bSMariusz Zaborski memset(&ipv4, 0, sizeof(ipv4));
274832dc76bSMariusz Zaborski ipv4.sin_family = AF_INET;
275832dc76bSMariusz Zaborski ipv4.sin_port = htons(port);
276832dc76bSMariusz Zaborski inet_pton(AF_INET, ip, &ipv4.sin_addr);
277832dc76bSMariusz Zaborski
278832dc76bSMariusz Zaborski ret = cap_connect(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4));
279832dc76bSMariusz Zaborski serrno = errno;
2807ee4066dSMark Johnston ATF_REQUIRE(close(capfd) == 0);
2817ee4066dSMark Johnston
2827ee4066dSMark Johnston if (ret < 0 && serrno != ENOTCAPABLE) {
2837ee4066dSMark Johnston int sd;
2847ee4066dSMark Johnston
2857ee4066dSMark Johnston /*
2867ee4066dSMark Johnston * If the connection failed, it might be because we can't reach
2877ee4066dSMark Johnston * the destination host. To check, try a plain connect() and
2887ee4066dSMark Johnston * see if it fails with the same error.
2897ee4066dSMark Johnston */
2907ee4066dSMark Johnston sd = socket(AF_INET, SOCK_STREAM, 0);
2917ee4066dSMark Johnston ATF_REQUIRE(sd >= 0);
2927ee4066dSMark Johnston
2937ee4066dSMark Johnston memset(&ipv4, 0, sizeof(ipv4));
2947ee4066dSMark Johnston ipv4.sin_family = AF_INET;
2957ee4066dSMark Johnston ipv4.sin_port = htons(port);
2967ee4066dSMark Johnston inet_pton(AF_INET, ip, &ipv4.sin_addr);
2977ee4066dSMark Johnston ret = connect(sd, (struct sockaddr *)&ipv4, sizeof(ipv4));
2987ee4066dSMark Johnston ATF_REQUIRE(ret < 0);
2997ee4066dSMark Johnston ATF_REQUIRE_MSG(errno == serrno, "errno %d != serrno %d",
3007ee4066dSMark Johnston errno, serrno);
3017ee4066dSMark Johnston ATF_REQUIRE(close(sd) == 0);
3027ee4066dSMark Johnston atf_tc_skip("connect(%s:%d) failed: %s",
3037ee4066dSMark Johnston ip, port, strerror(serrno));
3047ee4066dSMark Johnston }
305832dc76bSMariusz Zaborski
306832dc76bSMariusz Zaborski return (ret < 0 ? serrno : 0);
307832dc76bSMariusz Zaborski }
308832dc76bSMariusz Zaborski
309832dc76bSMariusz Zaborski static void
test_extend_mode(cap_channel_t * capnet,int current)310832dc76bSMariusz Zaborski test_extend_mode(cap_channel_t *capnet, int current)
311832dc76bSMariusz Zaborski {
312832dc76bSMariusz Zaborski cap_net_limit_t *limit;
313832dc76bSMariusz Zaborski const int rights[] = {
314832dc76bSMariusz Zaborski CAPNET_ADDR2NAME,
315832dc76bSMariusz Zaborski CAPNET_NAME2ADDR,
316832dc76bSMariusz Zaborski CAPNET_DEPRECATED_ADDR2NAME,
317832dc76bSMariusz Zaborski CAPNET_DEPRECATED_NAME2ADDR,
318832dc76bSMariusz Zaborski CAPNET_CONNECT,
319832dc76bSMariusz Zaborski CAPNET_BIND,
320832dc76bSMariusz Zaborski CAPNET_CONNECTDNS
321832dc76bSMariusz Zaborski };
322832dc76bSMariusz Zaborski size_t i;
323832dc76bSMariusz Zaborski
324832dc76bSMariusz Zaborski for (i = 0; i < nitems(rights); i++) {
325832dc76bSMariusz Zaborski if (current == rights[i])
326832dc76bSMariusz Zaborski continue;
327832dc76bSMariusz Zaborski
328832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, current | rights[i]);
329832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
330832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
331832dc76bSMariusz Zaborski }
332832dc76bSMariusz Zaborski }
333832dc76bSMariusz Zaborski
334b7876aecSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__getnameinfo);
ATF_TC_BODY(capnet__getnameinfo,tc)335b7876aecSMariusz Zaborski ATF_TC_BODY(capnet__getnameinfo, tc)
336b7876aecSMariusz Zaborski {
337b7876aecSMariusz Zaborski cap_channel_t *capnet;
338b7876aecSMariusz Zaborski
339b7876aecSMariusz Zaborski capnet = create_network_service();
340b7876aecSMariusz Zaborski
341b7876aecSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
342b7876aecSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
343b7876aecSMariusz Zaborski
344b7876aecSMariusz Zaborski cap_close(capnet);
345b7876aecSMariusz Zaborski }
346b7876aecSMariusz Zaborski
347b7876aecSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__connect);
ATF_TC_BODY(capnet__connect,tc)348b7876aecSMariusz Zaborski ATF_TC_BODY(capnet__connect, tc)
349b7876aecSMariusz Zaborski {
350b7876aecSMariusz Zaborski cap_channel_t *capnet;
351b7876aecSMariusz Zaborski
352b7876aecSMariusz Zaborski capnet = create_network_service();
353b7876aecSMariusz Zaborski
354b7876aecSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
355b7876aecSMariusz Zaborski
356b7876aecSMariusz Zaborski cap_close(capnet);
357b7876aecSMariusz Zaborski }
358b7876aecSMariusz Zaborski
359b7876aecSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__bind);
ATF_TC_BODY(capnet__bind,tc)360b7876aecSMariusz Zaborski ATF_TC_BODY(capnet__bind, tc)
361b7876aecSMariusz Zaborski {
362b7876aecSMariusz Zaborski cap_channel_t *capnet;
363b7876aecSMariusz Zaborski
364b7876aecSMariusz Zaborski capnet = create_network_service();
365b7876aecSMariusz Zaborski
366b7876aecSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
367b7876aecSMariusz Zaborski
368b7876aecSMariusz Zaborski cap_close(capnet);
369b7876aecSMariusz Zaborski }
370b7876aecSMariusz Zaborski
371b7876aecSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__getaddrinfo);
ATF_TC_BODY(capnet__getaddrinfo,tc)372b7876aecSMariusz Zaborski ATF_TC_BODY(capnet__getaddrinfo, tc)
373b7876aecSMariusz Zaborski {
374b7876aecSMariusz Zaborski cap_channel_t *capnet;
375b7876aecSMariusz Zaborski struct addrinfo hints, *capres;
376b7876aecSMariusz Zaborski
377b7876aecSMariusz Zaborski capnet = create_network_service();
378b7876aecSMariusz Zaborski
379b7876aecSMariusz Zaborski memset(&hints, 0, sizeof(hints));
380b7876aecSMariusz Zaborski hints.ai_family = AF_INET;
381b7876aecSMariusz Zaborski hints.ai_socktype = SOCK_STREAM;
382b7876aecSMariusz Zaborski
383b7876aecSMariusz Zaborski ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) ==
384b7876aecSMariusz Zaborski 0);
385b7876aecSMariusz Zaborski
386b7876aecSMariusz Zaborski cap_close(capnet);
387b7876aecSMariusz Zaborski }
388b7876aecSMariusz Zaborski
389b7876aecSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__gethostbyname);
ATF_TC_BODY(capnet__gethostbyname,tc)390b7876aecSMariusz Zaborski ATF_TC_BODY(capnet__gethostbyname, tc)
391b7876aecSMariusz Zaborski {
392b7876aecSMariusz Zaborski cap_channel_t *capnet;
393b7876aecSMariusz Zaborski
394b7876aecSMariusz Zaborski capnet = create_network_service();
395b7876aecSMariusz Zaborski
396b7876aecSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
397b7876aecSMariusz Zaborski
398b7876aecSMariusz Zaborski cap_close(capnet);
399b7876aecSMariusz Zaborski }
400b7876aecSMariusz Zaborski
401b7876aecSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__gethostbyaddr);
ATF_TC_BODY(capnet__gethostbyaddr,tc)402b7876aecSMariusz Zaborski ATF_TC_BODY(capnet__gethostbyaddr, tc)
403b7876aecSMariusz Zaborski {
404b7876aecSMariusz Zaborski cap_channel_t *capnet;
405b7876aecSMariusz Zaborski
406b7876aecSMariusz Zaborski capnet = create_network_service();
407b7876aecSMariusz Zaborski
408b7876aecSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
409b7876aecSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
410b7876aecSMariusz Zaborski
411b7876aecSMariusz Zaborski cap_close(capnet);
412b7876aecSMariusz Zaborski }
413b7876aecSMariusz Zaborski
414179bffddSEric van Gyzen ATF_TC_WITHOUT_HEAD(capnet__getnameinfo_buffer);
ATF_TC_BODY(capnet__getnameinfo_buffer,tc)415179bffddSEric van Gyzen ATF_TC_BODY(capnet__getnameinfo_buffer, tc)
416179bffddSEric van Gyzen {
417179bffddSEric van Gyzen cap_channel_t *chan;
418179bffddSEric van Gyzen struct sockaddr_in sin;
419179bffddSEric van Gyzen int ret;
420179bffddSEric van Gyzen struct {
421179bffddSEric van Gyzen char host[sizeof(TEST_IPV4)];
422179bffddSEric van Gyzen char host_canary;
423179bffddSEric van Gyzen char serv[sizeof(TEST_PORT_STR)];
424179bffddSEric van Gyzen char serv_canary;
425179bffddSEric van Gyzen } buffers;
426179bffddSEric van Gyzen
427179bffddSEric van Gyzen memset(&sin, 0, sizeof(sin));
428179bffddSEric van Gyzen sin.sin_family = AF_INET;
429179bffddSEric van Gyzen sin.sin_port = htons(TEST_PORT);
430179bffddSEric van Gyzen ret = inet_pton(AF_INET, TEST_IPV4, &sin.sin_addr);
431179bffddSEric van Gyzen ATF_REQUIRE_EQ(1, ret);
432179bffddSEric van Gyzen
433179bffddSEric van Gyzen memset(&buffers, '!', sizeof(buffers));
434179bffddSEric van Gyzen
435179bffddSEric van Gyzen chan = create_network_service();
436179bffddSEric van Gyzen ret = cap_getnameinfo(chan, (struct sockaddr *)&sin, sizeof(sin),
437179bffddSEric van Gyzen buffers.host, sizeof(buffers.host),
438179bffddSEric van Gyzen buffers.serv, sizeof(buffers.serv),
439179bffddSEric van Gyzen NI_NUMERICHOST | NI_NUMERICSERV);
440179bffddSEric van Gyzen ATF_REQUIRE_EQ_MSG(0, ret, "%d", ret);
441179bffddSEric van Gyzen
442179bffddSEric van Gyzen // Verify that cap_getnameinfo worked with minimally sized buffers.
443179bffddSEric van Gyzen ATF_CHECK_EQ(0, strcmp(TEST_IPV4, buffers.host));
444179bffddSEric van Gyzen ATF_CHECK_EQ(0, strcmp(TEST_PORT_STR, buffers.serv));
445179bffddSEric van Gyzen
446179bffddSEric van Gyzen // Verify that cap_getnameinfo did not overflow the buffers.
447179bffddSEric van Gyzen ATF_CHECK_EQ('!', buffers.host_canary);
448179bffddSEric van Gyzen ATF_CHECK_EQ('!', buffers.serv_canary);
449179bffddSEric van Gyzen
450179bffddSEric van Gyzen cap_close(chan);
451179bffddSEric van Gyzen }
452179bffddSEric van Gyzen
453832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode);
ATF_TC_BODY(capnet__limits_addr2name_mode,tc)454832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_addr2name_mode, tc)
455832dc76bSMariusz Zaborski {
456832dc76bSMariusz Zaborski cap_channel_t *capnet;
457832dc76bSMariusz Zaborski cap_net_limit_t *limit;
458832dc76bSMariusz Zaborski
459832dc76bSMariusz Zaborski capnet = create_network_service();
460832dc76bSMariusz Zaborski
461832dc76bSMariusz Zaborski /* LIMIT */
462832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
463832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
464832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
465832dc76bSMariusz Zaborski
466832dc76bSMariusz Zaborski /* ALLOWED */
467832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
468832dc76bSMariusz Zaborski
469832dc76bSMariusz Zaborski /* DISALLOWED */
470832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) ==
471832dc76bSMariusz Zaborski ENOTCAPABLE);
472832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
473832dc76bSMariusz Zaborski ENOTCAPABLE);
474832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
475832dc76bSMariusz Zaborski ENOTCAPABLE);
476832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
477832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
478832dc76bSMariusz Zaborski
479832dc76bSMariusz Zaborski test_extend_mode(capnet, CAPNET_ADDR2NAME);
480832dc76bSMariusz Zaborski
481832dc76bSMariusz Zaborski cap_close(capnet);
482832dc76bSMariusz Zaborski }
483832dc76bSMariusz Zaborski
484832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_family);
ATF_TC_BODY(capnet__limits_addr2name_family,tc)485832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_addr2name_family, tc)
486832dc76bSMariusz Zaborski {
487832dc76bSMariusz Zaborski cap_channel_t *capnet;
488832dc76bSMariusz Zaborski cap_net_limit_t *limit;
489832dc76bSMariusz Zaborski int family[] = { AF_INET6, AF_INET };
490832dc76bSMariusz Zaborski
491832dc76bSMariusz Zaborski capnet = create_network_service();
492832dc76bSMariusz Zaborski
493832dc76bSMariusz Zaborski /* Limit to AF_INET6 and AF_INET. */
494832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
495832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
496832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, family, nitems(family));
497832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
498832dc76bSMariusz Zaborski
499832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
500832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
501832dc76bSMariusz Zaborski
502832dc76bSMariusz Zaborski /* Limit to AF_INET6 and AF_INET. */
503832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
504832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
505832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, &family[0], 1);
506832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, &family[1], 1);
507832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
508832dc76bSMariusz Zaborski
509832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
510832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
511832dc76bSMariusz Zaborski
512832dc76bSMariusz Zaborski /* Limit to AF_INET6. */
513832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
514832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
515832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, family, 1);
516832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
517832dc76bSMariusz Zaborski
518832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
519832dc76bSMariusz Zaborski ENOTCAPABLE);
520832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
521832dc76bSMariusz Zaborski
522832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
523832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
524832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
525832dc76bSMariusz Zaborski
526832dc76bSMariusz Zaborski cap_close(capnet);
527832dc76bSMariusz Zaborski }
528832dc76bSMariusz Zaborski
529832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name);
ATF_TC_BODY(capnet__limits_addr2name,tc)530832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_addr2name, tc)
531832dc76bSMariusz Zaborski {
532832dc76bSMariusz Zaborski cap_channel_t *capnet;
533832dc76bSMariusz Zaborski cap_net_limit_t *limit;
534832dc76bSMariusz Zaborski struct sockaddr_in ipaddrv4;
535832dc76bSMariusz Zaborski struct sockaddr_in6 ipaddrv6;
536832dc76bSMariusz Zaborski
537832dc76bSMariusz Zaborski capnet = create_network_service();
538832dc76bSMariusz Zaborski
539832dc76bSMariusz Zaborski /* Limit to TEST_IPV4 and TEST_IPV6. */
540832dc76bSMariusz Zaborski memset(&ipaddrv4, 0, sizeof(ipaddrv4));
541832dc76bSMariusz Zaborski memset(&ipaddrv6, 0, sizeof(ipaddrv6));
542832dc76bSMariusz Zaborski
543832dc76bSMariusz Zaborski ipaddrv4.sin_family = AF_INET;
544832dc76bSMariusz Zaborski inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr);
545832dc76bSMariusz Zaborski
546832dc76bSMariusz Zaborski ipaddrv6.sin6_family = AF_INET6;
547832dc76bSMariusz Zaborski inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr);
548832dc76bSMariusz Zaborski
549832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
550832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
551832dc76bSMariusz Zaborski
552832dc76bSMariusz Zaborski cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
553832dc76bSMariusz Zaborski sizeof(ipaddrv4));
554832dc76bSMariusz Zaborski cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6,
555832dc76bSMariusz Zaborski sizeof(ipaddrv6));
556832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
557832dc76bSMariusz Zaborski
558832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
559832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
560832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") ==
561832dc76bSMariusz Zaborski ENOTCAPABLE);
562832dc76bSMariusz Zaborski
563832dc76bSMariusz Zaborski /* Limit to AF_INET. */
564832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
565832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
566832dc76bSMariusz Zaborski cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
567832dc76bSMariusz Zaborski sizeof(ipaddrv4));
568832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
569832dc76bSMariusz Zaborski
570832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
571832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) ==
572832dc76bSMariusz Zaborski ENOTCAPABLE);
573832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") ==
574832dc76bSMariusz Zaborski ENOTCAPABLE);
575832dc76bSMariusz Zaborski
576832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
577832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
578832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
579832dc76bSMariusz Zaborski
580832dc76bSMariusz Zaborski cap_close(capnet);
581832dc76bSMariusz Zaborski }
582832dc76bSMariusz Zaborski
583832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_mode);
ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode,tc)584832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode, tc)
585832dc76bSMariusz Zaborski {
586832dc76bSMariusz Zaborski cap_channel_t *capnet;
587832dc76bSMariusz Zaborski cap_net_limit_t *limit;
588832dc76bSMariusz Zaborski
589832dc76bSMariusz Zaborski capnet = create_network_service();
590832dc76bSMariusz Zaborski
591832dc76bSMariusz Zaborski /* LIMIT */
592832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
593832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
594832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
595832dc76bSMariusz Zaborski
596832dc76bSMariusz Zaborski /* ALLOWED */
597832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
598832dc76bSMariusz Zaborski
599832dc76bSMariusz Zaborski /* DISALLOWED */
600832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) ==
601832dc76bSMariusz Zaborski ENOTCAPABLE);
602832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
603832dc76bSMariusz Zaborski ENOTCAPABLE);
604832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
605832dc76bSMariusz Zaborski ENOTCAPABLE);
606832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
607832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
608832dc76bSMariusz Zaborski
609832dc76bSMariusz Zaborski cap_close(capnet);
610832dc76bSMariusz Zaborski }
611832dc76bSMariusz Zaborski
612832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_family);
ATF_TC_BODY(capnet__limits_deprecated_addr2name_family,tc)613832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_deprecated_addr2name_family, tc)
614832dc76bSMariusz Zaborski {
615832dc76bSMariusz Zaborski cap_channel_t *capnet;
616832dc76bSMariusz Zaborski cap_net_limit_t *limit;
617832dc76bSMariusz Zaborski int family[] = { AF_INET6, AF_INET };
618832dc76bSMariusz Zaborski
619832dc76bSMariusz Zaborski capnet = create_network_service();
620832dc76bSMariusz Zaborski
621832dc76bSMariusz Zaborski /* Limit to AF_INET6 and AF_INET. */
622832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
623832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
624832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, family, nitems(family));
625832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
626832dc76bSMariusz Zaborski
627832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
628832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
629832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) ==
630832dc76bSMariusz Zaborski ENOTCAPABLE);
631832dc76bSMariusz Zaborski
632832dc76bSMariusz Zaborski /* Limit to AF_INET6 and AF_INET. */
633832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
634832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
635832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, &family[0], 1);
636832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, &family[1], 1);
637832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
638832dc76bSMariusz Zaborski
639832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
640832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
641832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) ==
642832dc76bSMariusz Zaborski ENOTCAPABLE);
643832dc76bSMariusz Zaborski
644832dc76bSMariusz Zaborski /* Limit to AF_INET6. */
645832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
646832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
647832dc76bSMariusz Zaborski cap_net_limit_addr2name_family(limit, family, 1);
648832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
649832dc76bSMariusz Zaborski
650832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
651832dc76bSMariusz Zaborski ENOTCAPABLE);
652832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
653832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) ==
654832dc76bSMariusz Zaborski ENOTCAPABLE);
655832dc76bSMariusz Zaborski
656832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
657832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
658832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
659832dc76bSMariusz Zaborski
660832dc76bSMariusz Zaborski cap_close(capnet);
661832dc76bSMariusz Zaborski }
662832dc76bSMariusz Zaborski
663832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name);
ATF_TC_BODY(capnet__limits_deprecated_addr2name,tc)664832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_deprecated_addr2name, tc)
665832dc76bSMariusz Zaborski {
666832dc76bSMariusz Zaborski cap_channel_t *capnet;
667832dc76bSMariusz Zaborski cap_net_limit_t *limit;
668832dc76bSMariusz Zaborski struct in_addr ipaddrv4;
669832dc76bSMariusz Zaborski struct in6_addr ipaddrv6;
670832dc76bSMariusz Zaborski
671832dc76bSMariusz Zaborski capnet = create_network_service();
672832dc76bSMariusz Zaborski
673832dc76bSMariusz Zaborski /* Limit to TEST_IPV4 and TEST_IPV6. */
674832dc76bSMariusz Zaborski memset(&ipaddrv4, 0, sizeof(ipaddrv4));
675832dc76bSMariusz Zaborski memset(&ipaddrv6, 0, sizeof(ipaddrv6));
676832dc76bSMariusz Zaborski
677832dc76bSMariusz Zaborski inet_pton(AF_INET, TEST_IPV4, &ipaddrv4);
678832dc76bSMariusz Zaborski inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6);
679832dc76bSMariusz Zaborski
680832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
681832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
682832dc76bSMariusz Zaborski
683832dc76bSMariusz Zaborski cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
684832dc76bSMariusz Zaborski sizeof(ipaddrv4));
685832dc76bSMariusz Zaborski cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6,
686832dc76bSMariusz Zaborski sizeof(ipaddrv6));
687832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
688832dc76bSMariusz Zaborski
689832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
690832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
691832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") ==
692832dc76bSMariusz Zaborski ENOTCAPABLE);
693832dc76bSMariusz Zaborski
694832dc76bSMariusz Zaborski /* Limit to AF_INET. */
695832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
696832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
697832dc76bSMariusz Zaborski cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
698832dc76bSMariusz Zaborski sizeof(ipaddrv4));
699832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
700832dc76bSMariusz Zaborski
701832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
702832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) ==
703832dc76bSMariusz Zaborski ENOTCAPABLE);
704832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") ==
705832dc76bSMariusz Zaborski ENOTCAPABLE);
706832dc76bSMariusz Zaborski
707832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
708832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
709832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
710832dc76bSMariusz Zaborski
711832dc76bSMariusz Zaborski cap_close(capnet);
712832dc76bSMariusz Zaborski }
713832dc76bSMariusz Zaborski
714832dc76bSMariusz Zaborski
715832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_mode);
ATF_TC_BODY(capnet__limits_name2addr_mode,tc)716832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_name2addr_mode, tc)
717832dc76bSMariusz Zaborski {
718832dc76bSMariusz Zaborski cap_channel_t *capnet;
719832dc76bSMariusz Zaborski cap_net_limit_t *limit;
720832dc76bSMariusz Zaborski
721832dc76bSMariusz Zaborski capnet = create_network_service();
722832dc76bSMariusz Zaborski
723832dc76bSMariusz Zaborski /* LIMIT */
724832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
725832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
726832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
727832dc76bSMariusz Zaborski
728832dc76bSMariusz Zaborski /* ALLOWED */
729832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
730832dc76bSMariusz Zaborski 0);
731832dc76bSMariusz Zaborski
732832dc76bSMariusz Zaborski /* DISALLOWED */
733832dc76bSMariusz Zaborski ATF_REQUIRE(
734832dc76bSMariusz Zaborski test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
735832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
736832dc76bSMariusz Zaborski ENOTCAPABLE);
737832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
738832dc76bSMariusz Zaborski ENOTCAPABLE);
739832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
740832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
741832dc76bSMariusz Zaborski
742832dc76bSMariusz Zaborski test_extend_mode(capnet, CAPNET_ADDR2NAME);
743832dc76bSMariusz Zaborski
744832dc76bSMariusz Zaborski cap_close(capnet);
745832dc76bSMariusz Zaborski }
746832dc76bSMariusz Zaborski
747832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts);
ATF_TC_BODY(capnet__limits_name2addr_hosts,tc)748832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_name2addr_hosts, tc)
749832dc76bSMariusz Zaborski {
750832dc76bSMariusz Zaborski cap_channel_t *capnet;
751832dc76bSMariusz Zaborski cap_net_limit_t *limit;
752832dc76bSMariusz Zaborski
753832dc76bSMariusz Zaborski capnet = create_network_service();
754832dc76bSMariusz Zaborski
755832dc76bSMariusz Zaborski /* Limit to TEST_DOMAIN_0 and localhost only. */
756832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
757832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
758832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
759832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, "localhost", NULL);
760832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
761832dc76bSMariusz Zaborski
762832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
763832dc76bSMariusz Zaborski 0);
764832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 0);
765832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) ==
766832dc76bSMariusz Zaborski ENOTCAPABLE);
767832dc76bSMariusz Zaborski
768832dc76bSMariusz Zaborski /* Limit to TEST_DOMAIN_0 only. */
769832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
770832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
771832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
772832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
773832dc76bSMariusz Zaborski
774832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) ==
775832dc76bSMariusz Zaborski ENOTCAPABLE);
776832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) ==
777832dc76bSMariusz Zaborski ENOTCAPABLE);
778832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
779832dc76bSMariusz Zaborski 0);
780832dc76bSMariusz Zaborski
781832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
782832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
783832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
784832dc76bSMariusz Zaborski
785afd74c40SMariusz Zaborski /* Try to extend the limit. */
786afd74c40SMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
787afd74c40SMariusz Zaborski ATF_REQUIRE(limit != NULL);
788afd74c40SMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
789afd74c40SMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
790afd74c40SMariusz Zaborski
791afd74c40SMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
792afd74c40SMariusz Zaborski ATF_REQUIRE(limit != NULL);
793afd74c40SMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
794afd74c40SMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
795afd74c40SMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
796afd74c40SMariusz Zaborski
797832dc76bSMariusz Zaborski cap_close(capnet);
798832dc76bSMariusz Zaborski }
799832dc76bSMariusz Zaborski
800832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_strict);
ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict,tc)801832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict, tc)
802832dc76bSMariusz Zaborski {
803832dc76bSMariusz Zaborski cap_channel_t *capnet;
804832dc76bSMariusz Zaborski cap_net_limit_t *limit;
805832dc76bSMariusz Zaborski
806832dc76bSMariusz Zaborski capnet = create_network_service();
807832dc76bSMariusz Zaborski
808832dc76bSMariusz Zaborski /*
809832dc76bSMariusz Zaborski * Limit to TEST_DOMAIN_0 and HTTP service.
810832dc76bSMariusz Zaborski */
811832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
812832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
813832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, "http");
814832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
815832dc76bSMariusz Zaborski
816832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") ==
817832dc76bSMariusz Zaborski 0);
818832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
819832dc76bSMariusz Zaborski ENOTCAPABLE);
820832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "snmp") ==
821832dc76bSMariusz Zaborski ENOTCAPABLE);
822832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") ==
823832dc76bSMariusz Zaborski ENOTCAPABLE);
824832dc76bSMariusz Zaborski
825832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
826832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
827832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
828832dc76bSMariusz Zaborski
829832dc76bSMariusz Zaborski cap_close(capnet);
830832dc76bSMariusz Zaborski }
831832dc76bSMariusz Zaborski
832832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_mix);
ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix,tc)833832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix, tc)
834832dc76bSMariusz Zaborski {
835832dc76bSMariusz Zaborski cap_channel_t *capnet;
836832dc76bSMariusz Zaborski cap_net_limit_t *limit;
837832dc76bSMariusz Zaborski
838832dc76bSMariusz Zaborski capnet = create_network_service();
839832dc76bSMariusz Zaborski
840832dc76bSMariusz Zaborski /*
841832dc76bSMariusz Zaborski * Limit to TEST_DOMAIN_0 and any servnamex, and any domain with
842832dc76bSMariusz Zaborski * servname HTTP.
843832dc76bSMariusz Zaborski */
844832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
845832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
846832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
847832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, NULL, "http");
848832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
849832dc76bSMariusz Zaborski
850832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") ==
851832dc76bSMariusz Zaborski 0);
852832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
853832dc76bSMariusz Zaborski 0);
854832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") ==
855832dc76bSMariusz Zaborski 0);
856832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
857832dc76bSMariusz Zaborski 0);
858832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") ==
859832dc76bSMariusz Zaborski ENOTCAPABLE);
860832dc76bSMariusz Zaborski
861b9bb04c1SJose Luis Duran /* Limit to HTTP servname only. */
862832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
863832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
864832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, NULL, "http");
865832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
866832dc76bSMariusz Zaborski
867832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") ==
868832dc76bSMariusz Zaborski 0);
869832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
870832dc76bSMariusz Zaborski ENOTCAPABLE);
871832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") ==
872832dc76bSMariusz Zaborski 0);
873832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
874832dc76bSMariusz Zaborski ENOTCAPABLE);
875832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") ==
876832dc76bSMariusz Zaborski ENOTCAPABLE);
877832dc76bSMariusz Zaborski
878832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
879832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
880832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
881832dc76bSMariusz Zaborski
882832dc76bSMariusz Zaborski cap_close(capnet);
883832dc76bSMariusz Zaborski }
884832dc76bSMariusz Zaborski
885832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_family);
ATF_TC_BODY(capnet__limits_name2addr_family,tc)886832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_name2addr_family, tc)
887832dc76bSMariusz Zaborski {
888832dc76bSMariusz Zaborski cap_channel_t *capnet;
889832dc76bSMariusz Zaborski cap_net_limit_t *limit;
890832dc76bSMariusz Zaborski int family[] = { AF_INET6, AF_INET };
891832dc76bSMariusz Zaborski
892832dc76bSMariusz Zaborski capnet = create_network_service();
893832dc76bSMariusz Zaborski
894832dc76bSMariusz Zaborski /* Limit to AF_INET and AF_INET6. */
895832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
896832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
897832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
898832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, family, nitems(family));
899832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
900832dc76bSMariusz Zaborski
901832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
902832dc76bSMariusz Zaborski 0);
903832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) ==
904832dc76bSMariusz Zaborski 0);
905832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) ==
906832dc76bSMariusz Zaborski ENOTCAPABLE);
907832dc76bSMariusz Zaborski
908832dc76bSMariusz Zaborski /* Limit to AF_INET and AF_INET6. */
909832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
910832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
911832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
912832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, &family[0], 1);
913832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, &family[1], 1);
914832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
915832dc76bSMariusz Zaborski
916832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
917832dc76bSMariusz Zaborski 0);
918832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) ==
919832dc76bSMariusz Zaborski 0);
920832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) ==
921832dc76bSMariusz Zaborski ENOTCAPABLE);
922832dc76bSMariusz Zaborski
923832dc76bSMariusz Zaborski /* Limit to AF_INET6 only. */
924832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
925832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
926832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
927832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, family, 1);
928832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
929832dc76bSMariusz Zaborski
930832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
931832dc76bSMariusz Zaborski ENOTCAPABLE);
932832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) ==
933832dc76bSMariusz Zaborski 0);
934832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) ==
935832dc76bSMariusz Zaborski ENOTCAPABLE);
936832dc76bSMariusz Zaborski
937832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
938832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
939832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
940832dc76bSMariusz Zaborski
941832dc76bSMariusz Zaborski cap_close(capnet);
942832dc76bSMariusz Zaborski }
943832dc76bSMariusz Zaborski
944832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_mode);
ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode,tc)945832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode, tc)
946832dc76bSMariusz Zaborski {
947832dc76bSMariusz Zaborski cap_channel_t *capnet;
948832dc76bSMariusz Zaborski cap_net_limit_t *limit;
949832dc76bSMariusz Zaborski
950832dc76bSMariusz Zaborski capnet = create_network_service();
951832dc76bSMariusz Zaborski
952832dc76bSMariusz Zaborski /* LIMIT */
953832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
954832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
955832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
956832dc76bSMariusz Zaborski
957832dc76bSMariusz Zaborski /* ALLOWED */
958832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
959832dc76bSMariusz Zaborski
960832dc76bSMariusz Zaborski /* DISALLOWED */
961832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
962832dc76bSMariusz Zaborski ENOTCAPABLE);
963832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
964832dc76bSMariusz Zaborski ENOTCAPABLE);
965832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
966832dc76bSMariusz Zaborski ENOTCAPABLE);
967832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
968832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
969832dc76bSMariusz Zaborski
970832dc76bSMariusz Zaborski test_extend_mode(capnet, CAPNET_ADDR2NAME);
971832dc76bSMariusz Zaborski
972832dc76bSMariusz Zaborski cap_close(capnet);
973832dc76bSMariusz Zaborski }
974832dc76bSMariusz Zaborski
975832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_hosts);
ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts,tc)976832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts, tc)
977832dc76bSMariusz Zaborski {
978832dc76bSMariusz Zaborski cap_channel_t *capnet;
979832dc76bSMariusz Zaborski cap_net_limit_t *limit;
980832dc76bSMariusz Zaborski
981832dc76bSMariusz Zaborski capnet = create_network_service();
982832dc76bSMariusz Zaborski
983832dc76bSMariusz Zaborski /* Limit to TEST_DOMAIN_0 and localhost only. */
984832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
985832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
986832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
987832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, "localhost", NULL);
988832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
989832dc76bSMariusz Zaborski
990832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
991832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, "localhost") == 0);
992832dc76bSMariusz Zaborski ATF_REQUIRE(
993832dc76bSMariusz Zaborski test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE);
994832dc76bSMariusz Zaborski
995832dc76bSMariusz Zaborski /* Limit to TEST_DOMAIN_0 only. */
996832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
997832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
998832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
999832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1000832dc76bSMariusz Zaborski
1001832dc76bSMariusz Zaborski ATF_REQUIRE(
1002832dc76bSMariusz Zaborski test_gethostbyname(capnet, AF_INET, "localhost") == ENOTCAPABLE);
1003832dc76bSMariusz Zaborski ATF_REQUIRE(
1004832dc76bSMariusz Zaborski test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE);
1005832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1006832dc76bSMariusz Zaborski
1007832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
1008832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1009832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
1010832dc76bSMariusz Zaborski
1011832dc76bSMariusz Zaborski cap_close(capnet);
1012832dc76bSMariusz Zaborski }
1013832dc76bSMariusz Zaborski
1014832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_family);
ATF_TC_BODY(capnet__limits_deprecated_name2addr_family,tc)1015832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_deprecated_name2addr_family, tc)
1016832dc76bSMariusz Zaborski {
1017832dc76bSMariusz Zaborski cap_channel_t *capnet;
1018832dc76bSMariusz Zaborski cap_net_limit_t *limit;
1019832dc76bSMariusz Zaborski int family[] = { AF_INET6, AF_INET };
1020832dc76bSMariusz Zaborski
1021832dc76bSMariusz Zaborski capnet = create_network_service();
1022832dc76bSMariusz Zaborski
1023832dc76bSMariusz Zaborski /* Limit to AF_INET and AF_INET6. */
1024832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1025832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1026832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1027832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, family, nitems(family));
1028832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1029832dc76bSMariusz Zaborski
1030832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1031832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0);
1032832dc76bSMariusz Zaborski ATF_REQUIRE(
1033832dc76bSMariusz Zaborski test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE);
1034832dc76bSMariusz Zaborski
1035832dc76bSMariusz Zaborski /* Limit to AF_INET and AF_INET6. */
1036832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1037832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1038832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1039832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, &family[0], 1);
1040832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, &family[1], 1);
1041832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1042832dc76bSMariusz Zaborski
1043832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1044832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0);
1045832dc76bSMariusz Zaborski ATF_REQUIRE(
1046832dc76bSMariusz Zaborski test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE);
1047832dc76bSMariusz Zaborski
1048832dc76bSMariusz Zaborski /* Limit to AF_INET6 only. */
1049832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1050832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1051832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1052832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, family, 1);
1053832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1054832dc76bSMariusz Zaborski
1055832dc76bSMariusz Zaborski ATF_REQUIRE(
1056832dc76bSMariusz Zaborski test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
1057832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0);
1058832dc76bSMariusz Zaborski ATF_REQUIRE(
1059832dc76bSMariusz Zaborski test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE);
1060832dc76bSMariusz Zaborski
1061832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
1062832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1063832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
1064832dc76bSMariusz Zaborski
1065832dc76bSMariusz Zaborski cap_close(capnet);
1066832dc76bSMariusz Zaborski }
1067832dc76bSMariusz Zaborski
1068832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_bind_mode);
ATF_TC_BODY(capnet__limits_bind_mode,tc)1069832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_bind_mode, tc)
1070832dc76bSMariusz Zaborski {
1071832dc76bSMariusz Zaborski cap_channel_t *capnet;
1072832dc76bSMariusz Zaborski cap_net_limit_t *limit;
1073832dc76bSMariusz Zaborski
1074832dc76bSMariusz Zaborski capnet = create_network_service();
1075832dc76bSMariusz Zaborski
1076832dc76bSMariusz Zaborski /* LIMIT */
1077832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_BIND);
1078832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1079832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1080832dc76bSMariusz Zaborski
1081832dc76bSMariusz Zaborski /* ALLOWED */
1082832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
1083832dc76bSMariusz Zaborski
1084832dc76bSMariusz Zaborski /* DISALLOWED */
1085832dc76bSMariusz Zaborski ATF_REQUIRE(
1086832dc76bSMariusz Zaborski test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
1087832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1088832dc76bSMariusz Zaborski ENOTCAPABLE);
1089832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
1090832dc76bSMariusz Zaborski ENOTCAPABLE);
1091832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1092832dc76bSMariusz Zaborski ENOTCAPABLE);
1093832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
1094832dc76bSMariusz Zaborski
1095832dc76bSMariusz Zaborski test_extend_mode(capnet, CAPNET_ADDR2NAME);
1096832dc76bSMariusz Zaborski
1097832dc76bSMariusz Zaborski cap_close(capnet);
1098832dc76bSMariusz Zaborski }
1099832dc76bSMariusz Zaborski
1100832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_bind);
ATF_TC_BODY(capnet__limits_bind,tc)1101832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_bind, tc)
1102832dc76bSMariusz Zaborski {
1103832dc76bSMariusz Zaborski cap_channel_t *capnet;
1104832dc76bSMariusz Zaborski cap_net_limit_t *limit;
1105832dc76bSMariusz Zaborski struct sockaddr_in ipv4;
1106832dc76bSMariusz Zaborski
1107832dc76bSMariusz Zaborski capnet = create_network_service();
1108832dc76bSMariusz Zaborski
1109832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_BIND);
1110832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1111832dc76bSMariusz Zaborski
1112832dc76bSMariusz Zaborski memset(&ipv4, 0, sizeof(ipv4));
1113832dc76bSMariusz Zaborski ipv4.sin_family = AF_INET;
1114832dc76bSMariusz Zaborski inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr);
1115832dc76bSMariusz Zaborski
1116832dc76bSMariusz Zaborski cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1117832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1118832dc76bSMariusz Zaborski
1119832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
1120832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE);
1121832dc76bSMariusz Zaborski
1122832dc76bSMariusz Zaborski cap_close(capnet);
1123832dc76bSMariusz Zaborski }
1124832dc76bSMariusz Zaborski
1125832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_connect_mode);
ATF_TC_BODY(capnet__limits_connect_mode,tc)1126832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_connect_mode, tc)
1127832dc76bSMariusz Zaborski {
1128832dc76bSMariusz Zaborski cap_channel_t *capnet;
1129832dc76bSMariusz Zaborski cap_net_limit_t *limit;
1130832dc76bSMariusz Zaborski
1131832dc76bSMariusz Zaborski capnet = create_network_service();
1132832dc76bSMariusz Zaborski
1133832dc76bSMariusz Zaborski /* LIMIT */
1134832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1135832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1136832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1137832dc76bSMariusz Zaborski
1138832dc76bSMariusz Zaborski /* ALLOWED */
1139832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
1140832dc76bSMariusz Zaborski
1141832dc76bSMariusz Zaborski /* DISALLOWED */
1142832dc76bSMariusz Zaborski ATF_REQUIRE(
1143832dc76bSMariusz Zaborski test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
1144832dc76bSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1145832dc76bSMariusz Zaborski ENOTCAPABLE);
1146832dc76bSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
1147832dc76bSMariusz Zaborski ENOTCAPABLE);
1148832dc76bSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1149832dc76bSMariusz Zaborski ENOTCAPABLE);
1150832dc76bSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
1151832dc76bSMariusz Zaborski
1152832dc76bSMariusz Zaborski test_extend_mode(capnet, CAPNET_ADDR2NAME);
1153832dc76bSMariusz Zaborski
1154832dc76bSMariusz Zaborski cap_close(capnet);
1155832dc76bSMariusz Zaborski }
1156832dc76bSMariusz Zaborski
115734535dacSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_connect_dns_mode);
ATF_TC_BODY(capnet__limits_connect_dns_mode,tc)115834535dacSMariusz Zaborski ATF_TC_BODY(capnet__limits_connect_dns_mode, tc)
115934535dacSMariusz Zaborski {
116034535dacSMariusz Zaborski cap_channel_t *capnet;
116134535dacSMariusz Zaborski cap_net_limit_t *limit;
116234535dacSMariusz Zaborski
116334535dacSMariusz Zaborski capnet = create_network_service();
116434535dacSMariusz Zaborski
116534535dacSMariusz Zaborski /* LIMIT */
116634535dacSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_CONNECT | CAPNET_CONNECTDNS);
116734535dacSMariusz Zaborski ATF_REQUIRE(limit != NULL);
116834535dacSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
116934535dacSMariusz Zaborski
117034535dacSMariusz Zaborski /* ALLOWED */
117134535dacSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
117234535dacSMariusz Zaborski
117334535dacSMariusz Zaborski /* DISALLOWED */
117434535dacSMariusz Zaborski ATF_REQUIRE(
117534535dacSMariusz Zaborski test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
117634535dacSMariusz Zaborski ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
117734535dacSMariusz Zaborski ENOTCAPABLE);
117834535dacSMariusz Zaborski ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
117934535dacSMariusz Zaborski ENOTCAPABLE);
118034535dacSMariusz Zaborski ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
118134535dacSMariusz Zaborski ENOTCAPABLE);
118234535dacSMariusz Zaborski ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
118334535dacSMariusz Zaborski
118434535dacSMariusz Zaborski test_extend_mode(capnet, CAPNET_ADDR2NAME);
118534535dacSMariusz Zaborski
118634535dacSMariusz Zaborski cap_close(capnet);
118734535dacSMariusz Zaborski }
118834535dacSMariusz Zaborski
1189832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_connect);
ATF_TC_BODY(capnet__limits_connect,tc)1190832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_connect, tc)
1191832dc76bSMariusz Zaborski {
1192832dc76bSMariusz Zaborski cap_channel_t *capnet;
1193832dc76bSMariusz Zaborski cap_net_limit_t *limit;
1194832dc76bSMariusz Zaborski struct sockaddr_in ipv4;
1195832dc76bSMariusz Zaborski
1196832dc76bSMariusz Zaborski capnet = create_network_service();
1197832dc76bSMariusz Zaborski
1198832dc76bSMariusz Zaborski /* Limit only to TEST_IPV4 on port 80 and 443. */
1199832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1200832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1201832dc76bSMariusz Zaborski memset(&ipv4, 0, sizeof(ipv4));
1202832dc76bSMariusz Zaborski ipv4.sin_family = AF_INET;
1203832dc76bSMariusz Zaborski ipv4.sin_port = htons(80);
1204832dc76bSMariusz Zaborski inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr);
1205832dc76bSMariusz Zaborski cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1206832dc76bSMariusz Zaborski
1207832dc76bSMariusz Zaborski ipv4.sin_port = htons(443);
1208832dc76bSMariusz Zaborski cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1209832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1210832dc76bSMariusz Zaborski
1211832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
1212832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE);
1213832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1214832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0);
1215832dc76bSMariusz Zaborski
1216832dc76bSMariusz Zaborski /* Limit only to TEST_IPV4 on port 443. */
1217832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1218832dc76bSMariusz Zaborski cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1219832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1220832dc76bSMariusz Zaborski
1221832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 433) == ENOTCAPABLE);
1222832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE);
1223832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1224832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0);
1225832dc76bSMariusz Zaborski
1226832dc76bSMariusz Zaborski /* Unable to set empty limits. Empty limits means full access. */
1227832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1228832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) != 0);
1229832dc76bSMariusz Zaborski
1230832dc76bSMariusz Zaborski cap_close(capnet);
1231832dc76bSMariusz Zaborski }
1232832dc76bSMariusz Zaborski
1233832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_connecttodns);
ATF_TC_BODY(capnet__limits_connecttodns,tc)1234832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_connecttodns, tc)
1235832dc76bSMariusz Zaborski {
1236832dc76bSMariusz Zaborski cap_channel_t *capnet;
1237832dc76bSMariusz Zaborski cap_net_limit_t *limit;
1238832dc76bSMariusz Zaborski struct addrinfo hints, *capres, *res;
1239832dc76bSMariusz Zaborski int family[] = { AF_INET };
12407ee4066dSMark Johnston int error;
1241832dc76bSMariusz Zaborski
1242832dc76bSMariusz Zaborski capnet = create_network_service();
1243832dc76bSMariusz Zaborski
1244832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS |
1245832dc76bSMariusz Zaborski CAPNET_NAME2ADDR);
1246832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1247832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_IPV4, "80");
1248832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, family, 1);
1249832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1250832dc76bSMariusz Zaborski
1251832dc76bSMariusz Zaborski memset(&hints, 0, sizeof(hints));
1252832dc76bSMariusz Zaborski hints.ai_family = AF_INET;
1253832dc76bSMariusz Zaborski hints.ai_socktype = SOCK_STREAM;
1254832dc76bSMariusz Zaborski
1255832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1256832dc76bSMariusz Zaborski ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) ==
1257832dc76bSMariusz Zaborski 0);
1258832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1259832dc76bSMariusz Zaborski
1260832dc76bSMariusz Zaborski for (res = capres; res != NULL; res = res->ai_next) {
1261832dc76bSMariusz Zaborski int s;
1262832dc76bSMariusz Zaborski
1263832dc76bSMariusz Zaborski ATF_REQUIRE(res->ai_family == AF_INET);
1264832dc76bSMariusz Zaborski ATF_REQUIRE(res->ai_socktype == SOCK_STREAM);
1265832dc76bSMariusz Zaborski
1266832dc76bSMariusz Zaborski s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
1267832dc76bSMariusz Zaborski ATF_REQUIRE(s >= 0);
1268832dc76bSMariusz Zaborski
12697ee4066dSMark Johnston error = cap_connect(capnet, s, res->ai_addr,
12707ee4066dSMark Johnston res->ai_addrlen);
12717ee4066dSMark Johnston if (error != 0 && errno != ENOTCAPABLE)
12727ee4066dSMark Johnston atf_tc_skip("unable to connect: %s", strerror(errno));
12737ee4066dSMark Johnston ATF_REQUIRE(error == 0);
12747ee4066dSMark Johnston ATF_REQUIRE(close(s) == 0);
1275832dc76bSMariusz Zaborski }
1276832dc76bSMariusz Zaborski
1277832dc76bSMariusz Zaborski freeaddrinfo(capres);
1278832dc76bSMariusz Zaborski cap_close(capnet);
1279832dc76bSMariusz Zaborski }
1280832dc76bSMariusz Zaborski
1281832dc76bSMariusz Zaborski
1282832dc76bSMariusz Zaborski ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_connecttodns);
ATF_TC_BODY(capnet__limits_deprecated_connecttodns,tc)1283832dc76bSMariusz Zaborski ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc)
1284832dc76bSMariusz Zaborski {
1285832dc76bSMariusz Zaborski cap_channel_t *capnet;
1286832dc76bSMariusz Zaborski cap_net_limit_t *limit;
1287832dc76bSMariusz Zaborski struct hostent *caphp;
1288832dc76bSMariusz Zaborski struct in_addr ipaddr;
1289832dc76bSMariusz Zaborski struct sockaddr_in connaddr;
1290832dc76bSMariusz Zaborski int family[] = { AF_INET };
12917ee4066dSMark Johnston int error, i;
1292832dc76bSMariusz Zaborski
1293832dc76bSMariusz Zaborski capnet = create_network_service();
1294832dc76bSMariusz Zaborski
1295832dc76bSMariusz Zaborski limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS |
1296832dc76bSMariusz Zaborski CAPNET_DEPRECATED_NAME2ADDR);
1297832dc76bSMariusz Zaborski ATF_REQUIRE(limit != NULL);
1298832dc76bSMariusz Zaborski cap_net_limit_name2addr(limit, TEST_IPV4, NULL);
1299832dc76bSMariusz Zaborski cap_net_limit_name2addr_family(limit, family, 1);
1300832dc76bSMariusz Zaborski ATF_REQUIRE(cap_net_limit(limit) == 0);
1301832dc76bSMariusz Zaborski
1302832dc76bSMariusz Zaborski memset(&ipaddr, 0, sizeof(ipaddr));
1303832dc76bSMariusz Zaborski inet_pton(AF_INET, TEST_IPV4, &ipaddr);
1304832dc76bSMariusz Zaborski
1305832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1306832dc76bSMariusz Zaborski caphp = cap_gethostbyname2(capnet, TEST_IPV4, AF_INET);
1307832dc76bSMariusz Zaborski ATF_REQUIRE(caphp != NULL);
1308832dc76bSMariusz Zaborski ATF_REQUIRE(caphp->h_addrtype == AF_INET);
1309832dc76bSMariusz Zaborski ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1310832dc76bSMariusz Zaborski
1311832dc76bSMariusz Zaborski for (i = 0; caphp->h_addr_list[i] != NULL; i++) {
1312832dc76bSMariusz Zaborski int s;
1313832dc76bSMariusz Zaborski
1314832dc76bSMariusz Zaborski s = socket(AF_INET, SOCK_STREAM, 0);
1315832dc76bSMariusz Zaborski ATF_REQUIRE(s >= 0);
1316832dc76bSMariusz Zaborski
1317832dc76bSMariusz Zaborski memset(&connaddr, 0, sizeof(connaddr));
1318832dc76bSMariusz Zaborski connaddr.sin_family = AF_INET;
1319832dc76bSMariusz Zaborski memcpy((char *)&connaddr.sin_addr.s_addr,
1320832dc76bSMariusz Zaborski (char *)caphp->h_addr_list[i], caphp->h_length);
1321832dc76bSMariusz Zaborski connaddr.sin_port = htons(80);
1322832dc76bSMariusz Zaborski
13237ee4066dSMark Johnston error = cap_connect(capnet, s, (struct sockaddr *)&connaddr,
13247ee4066dSMark Johnston sizeof(connaddr));
13257ee4066dSMark Johnston if (error != 0 && errno != ENOTCAPABLE)
13267ee4066dSMark Johnston atf_tc_skip("unable to connect: %s", strerror(errno));
13277ee4066dSMark Johnston ATF_REQUIRE(error == 0);
13287ee4066dSMark Johnston ATF_REQUIRE(close(s) == 0);
1329832dc76bSMariusz Zaborski }
1330832dc76bSMariusz Zaborski
1331832dc76bSMariusz Zaborski cap_close(capnet);
1332832dc76bSMariusz Zaborski }
1333832dc76bSMariusz Zaborski
ATF_TP_ADD_TCS(tp)1334832dc76bSMariusz Zaborski ATF_TP_ADD_TCS(tp)
1335832dc76bSMariusz Zaborski {
1336832dc76bSMariusz Zaborski
1337b7876aecSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__connect);
1338b7876aecSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__bind);
1339b7876aecSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__getnameinfo);
1340b7876aecSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__getaddrinfo);
1341b7876aecSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__gethostbyname);
1342b7876aecSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__gethostbyaddr);
1343b7876aecSMariusz Zaborski
1344179bffddSEric van Gyzen ATF_TP_ADD_TC(tp, capnet__getnameinfo_buffer);
1345179bffddSEric van Gyzen
1346832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode);
1347832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family);
1348832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_addr2name);
1349832dc76bSMariusz Zaborski
1350832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_mode);
1351832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_family);
1352832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name);
1353832dc76bSMariusz Zaborski
1354832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_name2addr_mode);
1355832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts);
1356832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_strict);
1357832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_mix);
1358832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_name2addr_family);
1359832dc76bSMariusz Zaborski
1360832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_mode);
1361832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_hosts);
1362832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_family);
1363832dc76bSMariusz Zaborski
1364832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_bind_mode);
1365832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_bind);
1366832dc76bSMariusz Zaborski
1367832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_connect_mode);
136834535dacSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_connect_dns_mode);
1369832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_connect);
1370832dc76bSMariusz Zaborski
1371832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_connecttodns);
1372832dc76bSMariusz Zaborski ATF_TP_ADD_TC(tp, capnet__limits_deprecated_connecttodns);
1373832dc76bSMariusz Zaborski
1374832dc76bSMariusz Zaborski return (atf_no_error());
1375832dc76bSMariusz Zaborski }
1376