1 /*- 2 * Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org> 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 14 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 15 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 23 * POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/cdefs.h> 27 __FBSDID("$FreeBSD$"); 28 29 #include <sys/param.h> 30 #include <sys/socket.h> 31 #include <netinet/in.h> 32 #include <arpa/inet.h> 33 34 #include <errno.h> 35 #include <netdb.h> 36 37 #include <atf-c.h> 38 39 #include <libcasper.h> 40 #include <casper/cap_net.h> 41 42 #define TEST_DOMAIN_0 "example.com" 43 #define TEST_DOMAIN_1 "freebsd.org" 44 #define TEST_IPV4 "1.1.1.1" 45 #define TEST_IPV6 "2001:4860:4860::8888" 46 #define TEST_BIND_IPV4 "127.0.0.1" 47 #define TEST_PORT 80 48 #define TEST_PORT_STR "80" 49 50 static cap_channel_t * 51 create_network_service(void) 52 { 53 cap_channel_t *capcas, *capnet; 54 55 capcas = cap_init(); 56 ATF_REQUIRE(capcas != NULL); 57 58 capnet = cap_service_open(capcas, "system.net"); 59 ATF_REQUIRE(capnet != NULL); 60 61 cap_close(capcas); 62 return (capnet); 63 } 64 65 static int 66 test_getnameinfo_v4(cap_channel_t *chan, int family, const char *ip) 67 { 68 struct sockaddr_in ipaddr; 69 char capfn[MAXHOSTNAMELEN]; 70 char origfn[MAXHOSTNAMELEN]; 71 int ret; 72 73 memset(&ipaddr, 0, sizeof(ipaddr)); 74 ipaddr.sin_family = family; 75 inet_pton(family, ip, &ipaddr.sin_addr); 76 77 ret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 78 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 79 if (ret != 0) { 80 return (ret); 81 } 82 83 ret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 84 sizeof(origfn), NULL, 0, NI_NAMEREQD); 85 ATF_REQUIRE(ret == 0); 86 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 87 88 return (0); 89 } 90 91 static int 92 test_getnameinfo_v6(cap_channel_t *chan, const char *ip) 93 { 94 struct sockaddr_in6 ipaddr; 95 char capfn[MAXHOSTNAMELEN]; 96 char origfn[MAXHOSTNAMELEN]; 97 int ret; 98 99 memset(&ipaddr, 0, sizeof(ipaddr)); 100 ipaddr.sin6_family = AF_INET6; 101 inet_pton(AF_INET6, ip, &ipaddr.sin6_addr); 102 103 ret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 104 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 105 if (ret != 0) { 106 return (ret); 107 } 108 109 ret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 110 sizeof(origfn), NULL, 0, NI_NAMEREQD); 111 ATF_REQUIRE(ret == 0); 112 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 113 114 return (0); 115 } 116 117 static int 118 test_getnameinfo(cap_channel_t *chan, int family, const char *ip) 119 { 120 121 if (family == AF_INET6) { 122 return (test_getnameinfo_v6(chan, ip)); 123 } 124 125 return (test_getnameinfo_v4(chan, family, ip)); 126 } 127 128 static int 129 test_gethostbyaddr_v4(cap_channel_t *chan, int family, const char *ip) 130 { 131 struct in_addr ipaddr; 132 struct hostent *caphp, *orighp; 133 134 memset(&ipaddr, 0, sizeof(ipaddr)); 135 inet_pton(AF_INET, ip, &ipaddr); 136 137 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), family); 138 if (caphp == NULL) { 139 return (h_errno); 140 } 141 142 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), family); 143 ATF_REQUIRE(orighp != NULL); 144 ATF_REQUIRE(strcmp(caphp->h_name, caphp->h_name) == 0); 145 146 return (0); 147 } 148 149 static int 150 test_gethostbyaddr_v6(cap_channel_t *chan, const char *ip) 151 { 152 struct in6_addr ipaddr; 153 struct hostent *caphp, *orighp; 154 155 memset(&ipaddr, 0, sizeof(ipaddr)); 156 inet_pton(AF_INET6, ip, &ipaddr); 157 158 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), AF_INET6); 159 if (caphp == NULL) 160 return (h_errno); 161 162 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), AF_INET6); 163 ATF_REQUIRE(orighp != NULL); 164 ATF_REQUIRE(strcmp(caphp->h_name, caphp->h_name) == 0); 165 166 return (0); 167 } 168 169 static int 170 test_gethostbyaddr(cap_channel_t *chan, int family, const char *ip) 171 { 172 173 if (family == AF_INET6) { 174 return (test_gethostbyaddr_v6(chan, ip)); 175 } else { 176 return (test_gethostbyaddr_v4(chan, family, ip)); 177 } 178 } 179 180 static int 181 test_getaddrinfo(cap_channel_t *chan, int family, const char *domain, 182 const char *servname) 183 { 184 struct addrinfo hints, *capres, *origres, *res0, *res1; 185 bool found; 186 int ret; 187 188 memset(&hints, 0, sizeof(hints)); 189 hints.ai_family = family; 190 hints.ai_socktype = SOCK_STREAM; 191 192 ret = cap_getaddrinfo(chan, domain, servname, &hints, &capres); 193 if (ret != 0) { 194 return (ret); 195 } 196 197 ret = getaddrinfo(domain, servname, &hints, &origres); 198 ATF_REQUIRE(ret == 0); 199 200 for (res0 = capres; res0 != NULL; res0 = res0->ai_next) { 201 found = false; 202 for (res1 = origres; res1 != NULL; res1 = res1->ai_next) { 203 if (res1->ai_addrlen == res0->ai_addrlen && 204 memcmp(res1->ai_addr, res0->ai_addr, 205 res0->ai_addrlen) == 0) { 206 found = true; 207 break; 208 } 209 } 210 ATF_REQUIRE(found); 211 } 212 213 freeaddrinfo(capres); 214 freeaddrinfo(origres); 215 return (0); 216 } 217 218 static int 219 test_gethostbyname(cap_channel_t *chan, int family, const char *domain) 220 { 221 struct hostent *caphp, *orighp; 222 223 caphp = cap_gethostbyname2(chan, domain, family); 224 if (caphp == NULL) { 225 return (h_errno); 226 } 227 228 orighp = gethostbyname2(domain, family); 229 ATF_REQUIRE(orighp != NULL); 230 ATF_REQUIRE(strcmp(caphp->h_name, orighp->h_name) == 0); 231 232 return (0); 233 } 234 235 static int 236 test_bind(cap_channel_t *chan, const char *ip) 237 { 238 struct sockaddr_in ipv4; 239 int capfd, ret, serrno; 240 241 capfd = socket(AF_INET, SOCK_STREAM, 0); 242 ATF_REQUIRE(capfd > 0); 243 244 memset(&ipv4, 0, sizeof(ipv4)); 245 ipv4.sin_family = AF_INET; 246 inet_pton(AF_INET, ip, &ipv4.sin_addr); 247 248 ret = cap_bind(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 249 serrno = errno; 250 close(capfd); 251 252 return (ret < 0 ? serrno : 0); 253 } 254 255 static int 256 test_connect(cap_channel_t *chan, const char *ip, unsigned short port) 257 { 258 struct sockaddr_in ipv4; 259 int capfd, ret, serrno; 260 261 capfd = socket(AF_INET, SOCK_STREAM, 0); 262 ATF_REQUIRE(capfd > 0); 263 264 memset(&ipv4, 0, sizeof(ipv4)); 265 ipv4.sin_family = AF_INET; 266 ipv4.sin_port = htons(port); 267 inet_pton(AF_INET, ip, &ipv4.sin_addr); 268 269 ret = cap_connect(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 270 serrno = errno; 271 close(capfd); 272 273 return (ret < 0 ? serrno : 0); 274 } 275 276 static void 277 test_extend_mode(cap_channel_t *capnet, int current) 278 { 279 cap_net_limit_t *limit; 280 const int rights[] = { 281 CAPNET_ADDR2NAME, 282 CAPNET_NAME2ADDR, 283 CAPNET_DEPRECATED_ADDR2NAME, 284 CAPNET_DEPRECATED_NAME2ADDR, 285 CAPNET_CONNECT, 286 CAPNET_BIND, 287 CAPNET_CONNECTDNS 288 }; 289 size_t i; 290 291 for (i = 0; i < nitems(rights); i++) { 292 if (current == rights[i]) 293 continue; 294 295 limit = cap_net_limit_init(capnet, current | rights[i]); 296 ATF_REQUIRE(limit != NULL); 297 ATF_REQUIRE(cap_net_limit(limit) != 0); 298 } 299 } 300 301 ATF_TC_WITHOUT_HEAD(capnet__getnameinfo); 302 ATF_TC_BODY(capnet__getnameinfo, tc) 303 { 304 cap_channel_t *capnet; 305 306 capnet = create_network_service(); 307 308 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 309 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 310 311 cap_close(capnet); 312 } 313 314 ATF_TC_WITHOUT_HEAD(capnet__connect); 315 ATF_TC_BODY(capnet__connect, tc) 316 { 317 cap_channel_t *capnet; 318 319 capnet = create_network_service(); 320 321 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 322 323 cap_close(capnet); 324 } 325 326 ATF_TC_WITHOUT_HEAD(capnet__bind); 327 ATF_TC_BODY(capnet__bind, tc) 328 { 329 cap_channel_t *capnet; 330 331 capnet = create_network_service(); 332 333 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 334 335 cap_close(capnet); 336 } 337 338 ATF_TC_WITHOUT_HEAD(capnet__getaddrinfo); 339 ATF_TC_BODY(capnet__getaddrinfo, tc) 340 { 341 cap_channel_t *capnet; 342 struct addrinfo hints, *capres; 343 344 capnet = create_network_service(); 345 346 memset(&hints, 0, sizeof(hints)); 347 hints.ai_family = AF_INET; 348 hints.ai_socktype = SOCK_STREAM; 349 350 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 351 0); 352 353 cap_close(capnet); 354 } 355 356 ATF_TC_WITHOUT_HEAD(capnet__gethostbyname); 357 ATF_TC_BODY(capnet__gethostbyname, tc) 358 { 359 cap_channel_t *capnet; 360 361 capnet = create_network_service(); 362 363 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 364 365 cap_close(capnet); 366 } 367 368 ATF_TC_WITHOUT_HEAD(capnet__gethostbyaddr); 369 ATF_TC_BODY(capnet__gethostbyaddr, tc) 370 { 371 cap_channel_t *capnet; 372 373 capnet = create_network_service(); 374 375 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 376 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 377 378 cap_close(capnet); 379 } 380 381 ATF_TC_WITHOUT_HEAD(capnet__getnameinfo_buffer); 382 ATF_TC_BODY(capnet__getnameinfo_buffer, tc) 383 { 384 cap_channel_t *chan; 385 struct sockaddr_in sin; 386 int ret; 387 struct { 388 char host[sizeof(TEST_IPV4)]; 389 char host_canary; 390 char serv[sizeof(TEST_PORT_STR)]; 391 char serv_canary; 392 } buffers; 393 394 memset(&sin, 0, sizeof(sin)); 395 sin.sin_family = AF_INET; 396 sin.sin_port = htons(TEST_PORT); 397 ret = inet_pton(AF_INET, TEST_IPV4, &sin.sin_addr); 398 ATF_REQUIRE_EQ(1, ret); 399 400 memset(&buffers, '!', sizeof(buffers)); 401 402 chan = create_network_service(); 403 ret = cap_getnameinfo(chan, (struct sockaddr *)&sin, sizeof(sin), 404 buffers.host, sizeof(buffers.host), 405 buffers.serv, sizeof(buffers.serv), 406 NI_NUMERICHOST | NI_NUMERICSERV); 407 ATF_REQUIRE_EQ_MSG(0, ret, "%d", ret); 408 409 // Verify that cap_getnameinfo worked with minimally sized buffers. 410 ATF_CHECK_EQ(0, strcmp(TEST_IPV4, buffers.host)); 411 ATF_CHECK_EQ(0, strcmp(TEST_PORT_STR, buffers.serv)); 412 413 // Verify that cap_getnameinfo did not overflow the buffers. 414 ATF_CHECK_EQ('!', buffers.host_canary); 415 ATF_CHECK_EQ('!', buffers.serv_canary); 416 417 cap_close(chan); 418 } 419 420 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode); 421 ATF_TC_BODY(capnet__limits_addr2name_mode, tc) 422 { 423 cap_channel_t *capnet; 424 cap_net_limit_t *limit; 425 426 capnet = create_network_service(); 427 428 /* LIMIT */ 429 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 430 ATF_REQUIRE(limit != NULL); 431 ATF_REQUIRE(cap_net_limit(limit) == 0); 432 433 /* ALLOWED */ 434 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 435 436 /* DISALLOWED */ 437 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 438 ENOTCAPABLE); 439 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 440 ENOTCAPABLE); 441 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 442 ENOTCAPABLE); 443 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 444 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 445 446 test_extend_mode(capnet, CAPNET_ADDR2NAME); 447 448 cap_close(capnet); 449 } 450 451 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_family); 452 ATF_TC_BODY(capnet__limits_addr2name_family, tc) 453 { 454 cap_channel_t *capnet; 455 cap_net_limit_t *limit; 456 int family[] = { AF_INET6, AF_INET }; 457 458 capnet = create_network_service(); 459 460 /* Limit to AF_INET6 and AF_INET. */ 461 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 462 ATF_REQUIRE(limit != NULL); 463 cap_net_limit_addr2name_family(limit, family, nitems(family)); 464 ATF_REQUIRE(cap_net_limit(limit) == 0); 465 466 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 467 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 468 469 /* Limit to AF_INET6 and AF_INET. */ 470 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 471 ATF_REQUIRE(limit != NULL); 472 cap_net_limit_addr2name_family(limit, &family[0], 1); 473 cap_net_limit_addr2name_family(limit, &family[1], 1); 474 ATF_REQUIRE(cap_net_limit(limit) == 0); 475 476 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 477 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 478 479 /* Limit to AF_INET6. */ 480 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 481 ATF_REQUIRE(limit != NULL); 482 cap_net_limit_addr2name_family(limit, family, 1); 483 ATF_REQUIRE(cap_net_limit(limit) == 0); 484 485 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 486 ENOTCAPABLE); 487 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 488 489 /* Unable to set empty limits. Empty limits means full access. */ 490 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 491 ATF_REQUIRE(cap_net_limit(limit) != 0); 492 493 cap_close(capnet); 494 } 495 496 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name); 497 ATF_TC_BODY(capnet__limits_addr2name, tc) 498 { 499 cap_channel_t *capnet; 500 cap_net_limit_t *limit; 501 struct sockaddr_in ipaddrv4; 502 struct sockaddr_in6 ipaddrv6; 503 504 capnet = create_network_service(); 505 506 /* Limit to TEST_IPV4 and TEST_IPV6. */ 507 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 508 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 509 510 ipaddrv4.sin_family = AF_INET; 511 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr); 512 513 ipaddrv6.sin6_family = AF_INET6; 514 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr); 515 516 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 517 ATF_REQUIRE(limit != NULL); 518 519 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 520 sizeof(ipaddrv4)); 521 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 522 sizeof(ipaddrv6)); 523 ATF_REQUIRE(cap_net_limit(limit) == 0); 524 525 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 526 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 527 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 528 ENOTCAPABLE); 529 530 /* Limit to AF_INET. */ 531 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 532 ATF_REQUIRE(limit != NULL); 533 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 534 sizeof(ipaddrv4)); 535 ATF_REQUIRE(cap_net_limit(limit) == 0); 536 537 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 538 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 539 ENOTCAPABLE); 540 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 541 ENOTCAPABLE); 542 543 /* Unable to set empty limits. Empty limits means full access. */ 544 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 545 ATF_REQUIRE(cap_net_limit(limit) != 0); 546 547 cap_close(capnet); 548 } 549 550 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_mode); 551 ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode, tc) 552 { 553 cap_channel_t *capnet; 554 cap_net_limit_t *limit; 555 556 capnet = create_network_service(); 557 558 /* LIMIT */ 559 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 560 ATF_REQUIRE(limit != NULL); 561 ATF_REQUIRE(cap_net_limit(limit) == 0); 562 563 /* ALLOWED */ 564 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 565 566 /* DISALLOWED */ 567 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 568 ENOTCAPABLE); 569 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 570 ENOTCAPABLE); 571 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 572 ENOTCAPABLE); 573 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 574 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 575 576 cap_close(capnet); 577 } 578 579 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_family); 580 ATF_TC_BODY(capnet__limits_deprecated_addr2name_family, tc) 581 { 582 cap_channel_t *capnet; 583 cap_net_limit_t *limit; 584 int family[] = { AF_INET6, AF_INET }; 585 586 capnet = create_network_service(); 587 588 /* Limit to AF_INET6 and AF_INET. */ 589 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 590 ATF_REQUIRE(limit != NULL); 591 cap_net_limit_addr2name_family(limit, family, nitems(family)); 592 ATF_REQUIRE(cap_net_limit(limit) == 0); 593 594 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 595 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 596 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 597 ENOTCAPABLE); 598 599 /* Limit to AF_INET6 and AF_INET. */ 600 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 601 ATF_REQUIRE(limit != NULL); 602 cap_net_limit_addr2name_family(limit, &family[0], 1); 603 cap_net_limit_addr2name_family(limit, &family[1], 1); 604 ATF_REQUIRE(cap_net_limit(limit) == 0); 605 606 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 607 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 608 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 609 ENOTCAPABLE); 610 611 /* Limit to AF_INET6. */ 612 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 613 ATF_REQUIRE(limit != NULL); 614 cap_net_limit_addr2name_family(limit, family, 1); 615 ATF_REQUIRE(cap_net_limit(limit) == 0); 616 617 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 618 ENOTCAPABLE); 619 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 620 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 621 ENOTCAPABLE); 622 623 /* Unable to set empty limits. Empty limits means full access. */ 624 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 625 ATF_REQUIRE(cap_net_limit(limit) != 0); 626 627 cap_close(capnet); 628 } 629 630 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name); 631 ATF_TC_BODY(capnet__limits_deprecated_addr2name, tc) 632 { 633 cap_channel_t *capnet; 634 cap_net_limit_t *limit; 635 struct in_addr ipaddrv4; 636 struct in6_addr ipaddrv6; 637 638 capnet = create_network_service(); 639 640 /* Limit to TEST_IPV4 and TEST_IPV6. */ 641 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 642 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 643 644 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4); 645 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6); 646 647 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 648 ATF_REQUIRE(limit != NULL); 649 650 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 651 sizeof(ipaddrv4)); 652 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 653 sizeof(ipaddrv6)); 654 ATF_REQUIRE(cap_net_limit(limit) == 0); 655 656 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 657 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 658 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 659 ENOTCAPABLE); 660 661 /* Limit to AF_INET. */ 662 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 663 ATF_REQUIRE(limit != NULL); 664 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 665 sizeof(ipaddrv4)); 666 ATF_REQUIRE(cap_net_limit(limit) == 0); 667 668 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 669 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 670 ENOTCAPABLE); 671 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 672 ENOTCAPABLE); 673 674 /* Unable to set empty limits. Empty limits means full access. */ 675 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 676 ATF_REQUIRE(cap_net_limit(limit) != 0); 677 678 cap_close(capnet); 679 } 680 681 682 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_mode); 683 ATF_TC_BODY(capnet__limits_name2addr_mode, tc) 684 { 685 cap_channel_t *capnet; 686 cap_net_limit_t *limit; 687 688 capnet = create_network_service(); 689 690 /* LIMIT */ 691 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 692 ATF_REQUIRE(limit != NULL); 693 ATF_REQUIRE(cap_net_limit(limit) == 0); 694 695 /* ALLOWED */ 696 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 697 0); 698 699 /* DISALLOWED */ 700 ATF_REQUIRE( 701 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 702 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 703 ENOTCAPABLE); 704 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 705 ENOTCAPABLE); 706 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 707 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 708 709 test_extend_mode(capnet, CAPNET_ADDR2NAME); 710 711 cap_close(capnet); 712 } 713 714 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts); 715 ATF_TC_BODY(capnet__limits_name2addr_hosts, tc) 716 { 717 cap_channel_t *capnet; 718 cap_net_limit_t *limit; 719 720 capnet = create_network_service(); 721 722 /* Limit to TEST_DOMAIN_0 and localhost only. */ 723 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 724 ATF_REQUIRE(limit != NULL); 725 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 726 cap_net_limit_name2addr(limit, "localhost", NULL); 727 ATF_REQUIRE(cap_net_limit(limit) == 0); 728 729 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 730 0); 731 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 0); 732 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 733 ENOTCAPABLE); 734 735 /* Limit to TEST_DOMAIN_0 only. */ 736 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 737 ATF_REQUIRE(limit != NULL); 738 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 739 ATF_REQUIRE(cap_net_limit(limit) == 0); 740 741 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 742 ENOTCAPABLE); 743 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 744 ENOTCAPABLE); 745 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 746 0); 747 748 /* Unable to set empty limits. Empty limits means full access. */ 749 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 750 ATF_REQUIRE(cap_net_limit(limit) != 0); 751 752 cap_close(capnet); 753 } 754 755 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_strict); 756 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict, tc) 757 { 758 cap_channel_t *capnet; 759 cap_net_limit_t *limit; 760 761 capnet = create_network_service(); 762 763 /* 764 * Limit to TEST_DOMAIN_0 and HTTP service. 765 */ 766 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 767 ATF_REQUIRE(limit != NULL); 768 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, "http"); 769 ATF_REQUIRE(cap_net_limit(limit) == 0); 770 771 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 772 0); 773 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 774 ENOTCAPABLE); 775 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "snmp") == 776 ENOTCAPABLE); 777 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 778 ENOTCAPABLE); 779 780 /* Unable to set empty limits. Empty limits means full access. */ 781 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 782 ATF_REQUIRE(cap_net_limit(limit) != 0); 783 784 cap_close(capnet); 785 } 786 787 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_mix); 788 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix, tc) 789 { 790 cap_channel_t *capnet; 791 cap_net_limit_t *limit; 792 793 capnet = create_network_service(); 794 795 /* 796 * Limit to TEST_DOMAIN_0 and any servnamex, and any domain with 797 * servname HTTP. 798 */ 799 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 800 ATF_REQUIRE(limit != NULL); 801 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 802 cap_net_limit_name2addr(limit, NULL, "http"); 803 ATF_REQUIRE(cap_net_limit(limit) == 0); 804 805 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 806 0); 807 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 808 0); 809 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 810 0); 811 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 812 0); 813 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 814 ENOTCAPABLE); 815 816 /* Limit to HTTTP servname only. */ 817 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 818 ATF_REQUIRE(limit != NULL); 819 cap_net_limit_name2addr(limit, NULL, "http"); 820 ATF_REQUIRE(cap_net_limit(limit) == 0); 821 822 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 823 0); 824 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 825 ENOTCAPABLE); 826 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 827 0); 828 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 829 ENOTCAPABLE); 830 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 831 ENOTCAPABLE); 832 833 /* Unable to set empty limits. Empty limits means full access. */ 834 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 835 ATF_REQUIRE(cap_net_limit(limit) != 0); 836 837 cap_close(capnet); 838 } 839 840 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_family); 841 ATF_TC_BODY(capnet__limits_name2addr_family, tc) 842 { 843 cap_channel_t *capnet; 844 cap_net_limit_t *limit; 845 int family[] = { AF_INET6, AF_INET }; 846 847 capnet = create_network_service(); 848 849 /* Limit to AF_INET and AF_INET6. */ 850 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 851 ATF_REQUIRE(limit != NULL); 852 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 853 cap_net_limit_name2addr_family(limit, family, nitems(family)); 854 ATF_REQUIRE(cap_net_limit(limit) == 0); 855 856 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 857 0); 858 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 859 0); 860 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 861 ENOTCAPABLE); 862 863 /* Limit to AF_INET and AF_INET6. */ 864 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 865 ATF_REQUIRE(limit != NULL); 866 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 867 cap_net_limit_name2addr_family(limit, &family[0], 1); 868 cap_net_limit_name2addr_family(limit, &family[1], 1); 869 ATF_REQUIRE(cap_net_limit(limit) == 0); 870 871 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 872 0); 873 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 874 0); 875 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 876 ENOTCAPABLE); 877 878 /* Limit to AF_INET6 only. */ 879 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 880 ATF_REQUIRE(limit != NULL); 881 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 882 cap_net_limit_name2addr_family(limit, family, 1); 883 ATF_REQUIRE(cap_net_limit(limit) == 0); 884 885 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 886 ENOTCAPABLE); 887 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 888 0); 889 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 890 ENOTCAPABLE); 891 892 /* Unable to set empty limits. Empty limits means full access. */ 893 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 894 ATF_REQUIRE(cap_net_limit(limit) != 0); 895 896 cap_close(capnet); 897 } 898 899 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_mode); 900 ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode, tc) 901 { 902 cap_channel_t *capnet; 903 cap_net_limit_t *limit; 904 905 capnet = create_network_service(); 906 907 /* LIMIT */ 908 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 909 ATF_REQUIRE(limit != NULL); 910 ATF_REQUIRE(cap_net_limit(limit) == 0); 911 912 /* ALLOWED */ 913 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 914 915 /* DISALLOWED */ 916 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 917 ENOTCAPABLE); 918 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 919 ENOTCAPABLE); 920 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 921 ENOTCAPABLE); 922 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 923 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 924 925 test_extend_mode(capnet, CAPNET_ADDR2NAME); 926 927 cap_close(capnet); 928 } 929 930 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_hosts); 931 ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts, tc) 932 { 933 cap_channel_t *capnet; 934 cap_net_limit_t *limit; 935 936 capnet = create_network_service(); 937 938 /* Limit to TEST_DOMAIN_0 and localhost only. */ 939 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 940 ATF_REQUIRE(limit != NULL); 941 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 942 cap_net_limit_name2addr(limit, "localhost", NULL); 943 ATF_REQUIRE(cap_net_limit(limit) == 0); 944 945 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 946 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, "localhost") == 0); 947 ATF_REQUIRE( 948 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 949 950 /* Limit to TEST_DOMAIN_0 only. */ 951 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 952 ATF_REQUIRE(limit != NULL); 953 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 954 ATF_REQUIRE(cap_net_limit(limit) == 0); 955 956 ATF_REQUIRE( 957 test_gethostbyname(capnet, AF_INET, "localhost") == ENOTCAPABLE); 958 ATF_REQUIRE( 959 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 960 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 961 962 /* Unable to set empty limits. Empty limits means full access. */ 963 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 964 ATF_REQUIRE(cap_net_limit(limit) != 0); 965 966 cap_close(capnet); 967 } 968 969 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_family); 970 ATF_TC_BODY(capnet__limits_deprecated_name2addr_family, tc) 971 { 972 cap_channel_t *capnet; 973 cap_net_limit_t *limit; 974 int family[] = { AF_INET6, AF_INET }; 975 976 capnet = create_network_service(); 977 978 /* Limit to AF_INET and AF_INET6. */ 979 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 980 ATF_REQUIRE(limit != NULL); 981 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 982 cap_net_limit_name2addr_family(limit, family, nitems(family)); 983 ATF_REQUIRE(cap_net_limit(limit) == 0); 984 985 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 986 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 987 ATF_REQUIRE( 988 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 989 990 /* Limit to AF_INET and AF_INET6. */ 991 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 992 ATF_REQUIRE(limit != NULL); 993 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 994 cap_net_limit_name2addr_family(limit, &family[0], 1); 995 cap_net_limit_name2addr_family(limit, &family[1], 1); 996 ATF_REQUIRE(cap_net_limit(limit) == 0); 997 998 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 999 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1000 ATF_REQUIRE( 1001 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1002 1003 /* Limit to AF_INET6 only. */ 1004 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1005 ATF_REQUIRE(limit != NULL); 1006 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1007 cap_net_limit_name2addr_family(limit, family, 1); 1008 ATF_REQUIRE(cap_net_limit(limit) == 0); 1009 1010 ATF_REQUIRE( 1011 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1012 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1013 ATF_REQUIRE( 1014 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1015 1016 /* Unable to set empty limits. Empty limits means full access. */ 1017 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1018 ATF_REQUIRE(cap_net_limit(limit) != 0); 1019 1020 cap_close(capnet); 1021 } 1022 1023 ATF_TC_WITHOUT_HEAD(capnet__limits_bind_mode); 1024 ATF_TC_BODY(capnet__limits_bind_mode, tc) 1025 { 1026 cap_channel_t *capnet; 1027 cap_net_limit_t *limit; 1028 1029 capnet = create_network_service(); 1030 1031 /* LIMIT */ 1032 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1033 ATF_REQUIRE(limit != NULL); 1034 ATF_REQUIRE(cap_net_limit(limit) == 0); 1035 1036 /* ALLOWED */ 1037 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1038 1039 /* DISALLOWED */ 1040 ATF_REQUIRE( 1041 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1042 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1043 ENOTCAPABLE); 1044 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1045 ENOTCAPABLE); 1046 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1047 ENOTCAPABLE); 1048 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 1049 1050 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1051 1052 cap_close(capnet); 1053 } 1054 1055 ATF_TC_WITHOUT_HEAD(capnet__limits_bind); 1056 ATF_TC_BODY(capnet__limits_bind, tc) 1057 { 1058 cap_channel_t *capnet; 1059 cap_net_limit_t *limit; 1060 struct sockaddr_in ipv4; 1061 1062 capnet = create_network_service(); 1063 1064 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1065 ATF_REQUIRE(limit != NULL); 1066 1067 memset(&ipv4, 0, sizeof(ipv4)); 1068 ipv4.sin_family = AF_INET; 1069 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr); 1070 1071 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1072 ATF_REQUIRE(cap_net_limit(limit) == 0); 1073 1074 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1075 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE); 1076 1077 cap_close(capnet); 1078 } 1079 1080 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_mode); 1081 ATF_TC_BODY(capnet__limits_connect_mode, tc) 1082 { 1083 cap_channel_t *capnet; 1084 cap_net_limit_t *limit; 1085 1086 capnet = create_network_service(); 1087 1088 /* LIMIT */ 1089 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1090 ATF_REQUIRE(limit != NULL); 1091 ATF_REQUIRE(cap_net_limit(limit) == 0); 1092 1093 /* ALLOWED */ 1094 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1095 1096 /* DISALLOWED */ 1097 ATF_REQUIRE( 1098 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1099 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1100 ENOTCAPABLE); 1101 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1102 ENOTCAPABLE); 1103 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1104 ENOTCAPABLE); 1105 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1106 1107 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1108 1109 cap_close(capnet); 1110 } 1111 1112 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_dns_mode); 1113 ATF_TC_BODY(capnet__limits_connect_dns_mode, tc) 1114 { 1115 cap_channel_t *capnet; 1116 cap_net_limit_t *limit; 1117 1118 capnet = create_network_service(); 1119 1120 /* LIMIT */ 1121 limit = cap_net_limit_init(capnet, CAPNET_CONNECT | CAPNET_CONNECTDNS); 1122 ATF_REQUIRE(limit != NULL); 1123 ATF_REQUIRE(cap_net_limit(limit) == 0); 1124 1125 /* ALLOWED */ 1126 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1127 1128 /* DISALLOWED */ 1129 ATF_REQUIRE( 1130 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1131 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1132 ENOTCAPABLE); 1133 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1134 ENOTCAPABLE); 1135 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1136 ENOTCAPABLE); 1137 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1138 1139 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1140 1141 cap_close(capnet); 1142 } 1143 1144 ATF_TC_WITHOUT_HEAD(capnet__limits_connect); 1145 ATF_TC_BODY(capnet__limits_connect, tc) 1146 { 1147 cap_channel_t *capnet; 1148 cap_net_limit_t *limit; 1149 struct sockaddr_in ipv4; 1150 1151 capnet = create_network_service(); 1152 1153 /* Limit only to TEST_IPV4 on port 80 and 443. */ 1154 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1155 ATF_REQUIRE(limit != NULL); 1156 memset(&ipv4, 0, sizeof(ipv4)); 1157 ipv4.sin_family = AF_INET; 1158 ipv4.sin_port = htons(80); 1159 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr); 1160 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1161 1162 ipv4.sin_port = htons(443); 1163 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1164 ATF_REQUIRE(cap_net_limit(limit) == 0); 1165 1166 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1167 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1168 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1169 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1170 1171 /* Limit only to TEST_IPV4 on port 443. */ 1172 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1173 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1174 ATF_REQUIRE(cap_net_limit(limit) == 0); 1175 1176 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 433) == ENOTCAPABLE); 1177 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1178 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1179 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1180 1181 /* Unable to set empty limits. Empty limits means full access. */ 1182 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1183 ATF_REQUIRE(cap_net_limit(limit) != 0); 1184 1185 cap_close(capnet); 1186 } 1187 1188 ATF_TC_WITHOUT_HEAD(capnet__limits_connecttodns); 1189 ATF_TC_BODY(capnet__limits_connecttodns, tc) 1190 { 1191 cap_channel_t *capnet; 1192 cap_net_limit_t *limit; 1193 struct addrinfo hints, *capres, *res; 1194 int family[] = { AF_INET }; 1195 1196 capnet = create_network_service(); 1197 1198 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1199 CAPNET_NAME2ADDR); 1200 ATF_REQUIRE(limit != NULL); 1201 cap_net_limit_name2addr(limit, TEST_IPV4, "80"); 1202 cap_net_limit_name2addr_family(limit, family, 1); 1203 ATF_REQUIRE(cap_net_limit(limit) == 0); 1204 1205 memset(&hints, 0, sizeof(hints)); 1206 hints.ai_family = AF_INET; 1207 hints.ai_socktype = SOCK_STREAM; 1208 1209 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1210 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 1211 0); 1212 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1213 1214 for (res = capres; res != NULL; res = res->ai_next) { 1215 int s; 1216 1217 ATF_REQUIRE(res->ai_family == AF_INET); 1218 ATF_REQUIRE(res->ai_socktype == SOCK_STREAM); 1219 1220 s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); 1221 ATF_REQUIRE(s >= 0); 1222 1223 ATF_REQUIRE(cap_connect(capnet, s, res->ai_addr, 1224 res->ai_addrlen) == 0); 1225 close(s); 1226 } 1227 1228 freeaddrinfo(capres); 1229 cap_close(capnet); 1230 } 1231 1232 1233 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_connecttodns); 1234 ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc) 1235 { 1236 cap_channel_t *capnet; 1237 cap_net_limit_t *limit; 1238 struct hostent *caphp; 1239 struct in_addr ipaddr; 1240 struct sockaddr_in connaddr; 1241 int family[] = { AF_INET }; 1242 int i; 1243 1244 capnet = create_network_service(); 1245 1246 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1247 CAPNET_DEPRECATED_NAME2ADDR); 1248 ATF_REQUIRE(limit != NULL); 1249 cap_net_limit_name2addr(limit, TEST_IPV4, NULL); 1250 cap_net_limit_name2addr_family(limit, family, 1); 1251 ATF_REQUIRE(cap_net_limit(limit) == 0); 1252 1253 memset(&ipaddr, 0, sizeof(ipaddr)); 1254 inet_pton(AF_INET, TEST_IPV4, &ipaddr); 1255 1256 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1257 caphp = cap_gethostbyname2(capnet, TEST_IPV4, AF_INET); 1258 ATF_REQUIRE(caphp != NULL); 1259 ATF_REQUIRE(caphp->h_addrtype == AF_INET); 1260 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1261 1262 for (i = 0; caphp->h_addr_list[i] != NULL; i++) { 1263 int s; 1264 1265 s = socket(AF_INET, SOCK_STREAM, 0); 1266 ATF_REQUIRE(s >= 0); 1267 1268 memset(&connaddr, 0, sizeof(connaddr)); 1269 connaddr.sin_family = AF_INET; 1270 memcpy((char *)&connaddr.sin_addr.s_addr, 1271 (char *)caphp->h_addr_list[i], caphp->h_length); 1272 connaddr.sin_port = htons(80); 1273 1274 ATF_REQUIRE(cap_connect(capnet, s, (struct sockaddr *)&connaddr, 1275 sizeof(connaddr)) == 0); 1276 close(s); 1277 } 1278 1279 cap_close(capnet); 1280 } 1281 1282 ATF_TP_ADD_TCS(tp) 1283 { 1284 1285 ATF_TP_ADD_TC(tp, capnet__connect); 1286 ATF_TP_ADD_TC(tp, capnet__bind); 1287 ATF_TP_ADD_TC(tp, capnet__getnameinfo); 1288 ATF_TP_ADD_TC(tp, capnet__getaddrinfo); 1289 ATF_TP_ADD_TC(tp, capnet__gethostbyname); 1290 ATF_TP_ADD_TC(tp, capnet__gethostbyaddr); 1291 1292 ATF_TP_ADD_TC(tp, capnet__getnameinfo_buffer); 1293 1294 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode); 1295 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family); 1296 ATF_TP_ADD_TC(tp, capnet__limits_addr2name); 1297 1298 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_mode); 1299 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_family); 1300 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name); 1301 1302 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_mode); 1303 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts); 1304 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_strict); 1305 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_mix); 1306 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_family); 1307 1308 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_mode); 1309 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_hosts); 1310 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_family); 1311 1312 ATF_TP_ADD_TC(tp, capnet__limits_bind_mode); 1313 ATF_TP_ADD_TC(tp, capnet__limits_bind); 1314 1315 ATF_TP_ADD_TC(tp, capnet__limits_connect_mode); 1316 ATF_TP_ADD_TC(tp, capnet__limits_connect_dns_mode); 1317 ATF_TP_ADD_TC(tp, capnet__limits_connect); 1318 1319 ATF_TP_ADD_TC(tp, capnet__limits_connecttodns); 1320 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_connecttodns); 1321 1322 return (atf_no_error()); 1323 } 1324