1 /*- 2 * Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org> 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 14 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 15 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 23 * POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/cdefs.h> 27 #include <sys/param.h> 28 #include <sys/socket.h> 29 #include <netinet/in.h> 30 #include <arpa/inet.h> 31 32 #include <errno.h> 33 #include <netdb.h> 34 35 #include <atf-c.h> 36 37 #include <libcasper.h> 38 #include <casper/cap_net.h> 39 40 #define TEST_DOMAIN_0 "example.com" 41 #define TEST_DOMAIN_1 "freebsd.org" 42 #define TEST_IPV4 "1.1.1.1" 43 #define TEST_IPV6 "2001:4860:4860::8888" 44 #define TEST_BIND_IPV4 "127.0.0.1" 45 #define TEST_PORT 80 46 #define TEST_PORT_STR "80" 47 48 static cap_channel_t * 49 create_network_service(void) 50 { 51 cap_channel_t *capcas, *capnet; 52 53 capcas = cap_init(); 54 ATF_REQUIRE(capcas != NULL); 55 56 capnet = cap_service_open(capcas, "system.net"); 57 ATF_REQUIRE(capnet != NULL); 58 59 cap_close(capcas); 60 return (capnet); 61 } 62 63 static int 64 test_getnameinfo_v4(cap_channel_t *chan, int family, const char *ip) 65 { 66 struct sockaddr_in ipaddr; 67 char capfn[MAXHOSTNAMELEN]; 68 char origfn[MAXHOSTNAMELEN]; 69 int capret, sysret; 70 71 memset(&ipaddr, 0, sizeof(ipaddr)); 72 ipaddr.sin_family = family; 73 inet_pton(family, ip, &ipaddr.sin_addr); 74 75 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 76 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 77 if (capret != 0 && capret == ENOTCAPABLE) 78 return (ENOTCAPABLE); 79 80 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 81 sizeof(origfn), NULL, 0, NI_NAMEREQD); 82 if (sysret != 0) { 83 atf_tc_skip("getnameinfo(%s) failed: %s", 84 ip, gai_strerror(sysret)); 85 } 86 ATF_REQUIRE(capret == 0); 87 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 88 89 return (0); 90 } 91 92 static int 93 test_getnameinfo_v6(cap_channel_t *chan, const char *ip) 94 { 95 struct sockaddr_in6 ipaddr; 96 char capfn[MAXHOSTNAMELEN]; 97 char origfn[MAXHOSTNAMELEN]; 98 int capret, sysret; 99 100 memset(&ipaddr, 0, sizeof(ipaddr)); 101 ipaddr.sin6_family = AF_INET6; 102 inet_pton(AF_INET6, ip, &ipaddr.sin6_addr); 103 104 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 105 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 106 if (capret != 0 && capret == ENOTCAPABLE) 107 return (ENOTCAPABLE); 108 109 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 110 sizeof(origfn), NULL, 0, NI_NAMEREQD); 111 if (sysret != 0) { 112 atf_tc_skip("getnameinfo(%s) failed: %s", 113 ip, gai_strerror(sysret)); 114 } 115 ATF_REQUIRE(capret == 0); 116 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 117 118 return (0); 119 } 120 121 static int 122 test_getnameinfo(cap_channel_t *chan, int family, const char *ip) 123 { 124 125 if (family == AF_INET6) { 126 return (test_getnameinfo_v6(chan, ip)); 127 } 128 129 return (test_getnameinfo_v4(chan, family, ip)); 130 } 131 132 static int 133 test_gethostbyaddr_v4(cap_channel_t *chan, int family, const char *ip) 134 { 135 struct in_addr ipaddr; 136 struct hostent *caphp, *orighp; 137 138 memset(&ipaddr, 0, sizeof(ipaddr)); 139 inet_pton(AF_INET, ip, &ipaddr); 140 141 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), family); 142 if (caphp == NULL && h_errno == ENOTCAPABLE) 143 return (ENOTCAPABLE); 144 145 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), family); 146 if (orighp == NULL) 147 atf_tc_skip("gethostbyaddr(%s) failed", ip); 148 ATF_REQUIRE(caphp != NULL); 149 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0); 150 151 return (0); 152 } 153 154 static int 155 test_gethostbyaddr_v6(cap_channel_t *chan, const char *ip) 156 { 157 struct in6_addr ipaddr; 158 struct hostent *caphp, *orighp; 159 160 memset(&ipaddr, 0, sizeof(ipaddr)); 161 inet_pton(AF_INET6, ip, &ipaddr); 162 163 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), AF_INET6); 164 if (caphp == NULL && h_errno == ENOTCAPABLE) 165 return (ENOTCAPABLE); 166 167 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), AF_INET6); 168 if (orighp == NULL) 169 atf_tc_skip("gethostbyaddr(%s) failed", ip); 170 ATF_REQUIRE(caphp != NULL); 171 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0); 172 173 return (0); 174 } 175 176 static int 177 test_gethostbyaddr(cap_channel_t *chan, int family, const char *ip) 178 { 179 180 if (family == AF_INET6) { 181 return (test_gethostbyaddr_v6(chan, ip)); 182 } else { 183 return (test_gethostbyaddr_v4(chan, family, ip)); 184 } 185 } 186 187 static int 188 test_getaddrinfo(cap_channel_t *chan, int family, const char *domain, 189 const char *servname) 190 { 191 struct addrinfo hints, *capres, *origres, *res0, *res1; 192 bool found; 193 int capret, sysret; 194 195 memset(&hints, 0, sizeof(hints)); 196 hints.ai_family = family; 197 hints.ai_socktype = SOCK_STREAM; 198 199 capret = cap_getaddrinfo(chan, domain, servname, &hints, &capres); 200 if (capret != 0 && capret == ENOTCAPABLE) 201 return (capret); 202 203 sysret = getaddrinfo(domain, servname, &hints, &origres); 204 if (sysret != 0) 205 atf_tc_skip("getaddrinfo(%s) failed: %s", 206 domain, gai_strerror(sysret)); 207 ATF_REQUIRE(capret == 0); 208 209 for (res0 = capres; res0 != NULL; res0 = res0->ai_next) { 210 found = false; 211 for (res1 = origres; res1 != NULL; res1 = res1->ai_next) { 212 if (res1->ai_addrlen == res0->ai_addrlen && 213 memcmp(res1->ai_addr, res0->ai_addr, 214 res0->ai_addrlen) == 0) { 215 found = true; 216 break; 217 } 218 } 219 ATF_REQUIRE(found); 220 } 221 222 freeaddrinfo(capres); 223 freeaddrinfo(origres); 224 return (0); 225 } 226 227 static int 228 test_gethostbyname(cap_channel_t *chan, int family, const char *domain) 229 { 230 struct hostent *caphp, *orighp; 231 232 caphp = cap_gethostbyname2(chan, domain, family); 233 if (caphp == NULL && h_errno == ENOTCAPABLE) 234 return (h_errno); 235 236 orighp = gethostbyname2(domain, family); 237 if (orighp == NULL) 238 atf_tc_skip("gethostbyname2(%s) failed", domain); 239 240 ATF_REQUIRE(caphp != NULL); 241 ATF_REQUIRE(strcmp(caphp->h_name, orighp->h_name) == 0); 242 return (0); 243 } 244 245 static int 246 test_bind(cap_channel_t *chan, const char *ip) 247 { 248 struct sockaddr_in ipv4; 249 int capfd, ret, serrno; 250 251 capfd = socket(AF_INET, SOCK_STREAM, 0); 252 ATF_REQUIRE(capfd > 0); 253 254 memset(&ipv4, 0, sizeof(ipv4)); 255 ipv4.sin_family = AF_INET; 256 inet_pton(AF_INET, ip, &ipv4.sin_addr); 257 258 ret = cap_bind(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 259 serrno = errno; 260 close(capfd); 261 262 return (ret < 0 ? serrno : 0); 263 } 264 265 static int 266 test_connect(cap_channel_t *chan, const char *ip, unsigned short port) 267 { 268 struct sockaddr_in ipv4; 269 int capfd, ret, serrno; 270 271 capfd = socket(AF_INET, SOCK_STREAM, 0); 272 ATF_REQUIRE(capfd >= 0); 273 274 memset(&ipv4, 0, sizeof(ipv4)); 275 ipv4.sin_family = AF_INET; 276 ipv4.sin_port = htons(port); 277 inet_pton(AF_INET, ip, &ipv4.sin_addr); 278 279 ret = cap_connect(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 280 serrno = errno; 281 ATF_REQUIRE(close(capfd) == 0); 282 283 if (ret < 0 && serrno != ENOTCAPABLE) { 284 int sd; 285 286 /* 287 * If the connection failed, it might be because we can't reach 288 * the destination host. To check, try a plain connect() and 289 * see if it fails with the same error. 290 */ 291 sd = socket(AF_INET, SOCK_STREAM, 0); 292 ATF_REQUIRE(sd >= 0); 293 294 memset(&ipv4, 0, sizeof(ipv4)); 295 ipv4.sin_family = AF_INET; 296 ipv4.sin_port = htons(port); 297 inet_pton(AF_INET, ip, &ipv4.sin_addr); 298 ret = connect(sd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 299 ATF_REQUIRE(ret < 0); 300 ATF_REQUIRE_MSG(errno == serrno, "errno %d != serrno %d", 301 errno, serrno); 302 ATF_REQUIRE(close(sd) == 0); 303 atf_tc_skip("connect(%s:%d) failed: %s", 304 ip, port, strerror(serrno)); 305 } 306 307 return (ret < 0 ? serrno : 0); 308 } 309 310 static void 311 test_extend_mode(cap_channel_t *capnet, int current) 312 { 313 cap_net_limit_t *limit; 314 const int rights[] = { 315 CAPNET_ADDR2NAME, 316 CAPNET_NAME2ADDR, 317 CAPNET_DEPRECATED_ADDR2NAME, 318 CAPNET_DEPRECATED_NAME2ADDR, 319 CAPNET_CONNECT, 320 CAPNET_BIND, 321 CAPNET_CONNECTDNS 322 }; 323 size_t i; 324 325 for (i = 0; i < nitems(rights); i++) { 326 if (current == rights[i]) 327 continue; 328 329 limit = cap_net_limit_init(capnet, current | rights[i]); 330 ATF_REQUIRE(limit != NULL); 331 ATF_REQUIRE(cap_net_limit(limit) != 0); 332 } 333 } 334 335 ATF_TC_WITHOUT_HEAD(capnet__getnameinfo); 336 ATF_TC_BODY(capnet__getnameinfo, tc) 337 { 338 cap_channel_t *capnet; 339 340 capnet = create_network_service(); 341 342 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 343 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 344 345 cap_close(capnet); 346 } 347 348 ATF_TC_WITHOUT_HEAD(capnet__connect); 349 ATF_TC_BODY(capnet__connect, tc) 350 { 351 cap_channel_t *capnet; 352 353 capnet = create_network_service(); 354 355 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 356 357 cap_close(capnet); 358 } 359 360 ATF_TC_WITHOUT_HEAD(capnet__bind); 361 ATF_TC_BODY(capnet__bind, tc) 362 { 363 cap_channel_t *capnet; 364 365 capnet = create_network_service(); 366 367 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 368 369 cap_close(capnet); 370 } 371 372 ATF_TC_WITHOUT_HEAD(capnet__getaddrinfo); 373 ATF_TC_BODY(capnet__getaddrinfo, tc) 374 { 375 cap_channel_t *capnet; 376 struct addrinfo hints, *capres; 377 378 capnet = create_network_service(); 379 380 memset(&hints, 0, sizeof(hints)); 381 hints.ai_family = AF_INET; 382 hints.ai_socktype = SOCK_STREAM; 383 384 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 385 0); 386 387 cap_close(capnet); 388 } 389 390 ATF_TC_WITHOUT_HEAD(capnet__gethostbyname); 391 ATF_TC_BODY(capnet__gethostbyname, tc) 392 { 393 cap_channel_t *capnet; 394 395 capnet = create_network_service(); 396 397 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 398 399 cap_close(capnet); 400 } 401 402 ATF_TC_WITHOUT_HEAD(capnet__gethostbyaddr); 403 ATF_TC_BODY(capnet__gethostbyaddr, tc) 404 { 405 cap_channel_t *capnet; 406 407 capnet = create_network_service(); 408 409 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 410 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 411 412 cap_close(capnet); 413 } 414 415 ATF_TC_WITHOUT_HEAD(capnet__getnameinfo_buffer); 416 ATF_TC_BODY(capnet__getnameinfo_buffer, tc) 417 { 418 cap_channel_t *chan; 419 struct sockaddr_in sin; 420 int ret; 421 struct { 422 char host[sizeof(TEST_IPV4)]; 423 char host_canary; 424 char serv[sizeof(TEST_PORT_STR)]; 425 char serv_canary; 426 } buffers; 427 428 memset(&sin, 0, sizeof(sin)); 429 sin.sin_family = AF_INET; 430 sin.sin_port = htons(TEST_PORT); 431 ret = inet_pton(AF_INET, TEST_IPV4, &sin.sin_addr); 432 ATF_REQUIRE_EQ(1, ret); 433 434 memset(&buffers, '!', sizeof(buffers)); 435 436 chan = create_network_service(); 437 ret = cap_getnameinfo(chan, (struct sockaddr *)&sin, sizeof(sin), 438 buffers.host, sizeof(buffers.host), 439 buffers.serv, sizeof(buffers.serv), 440 NI_NUMERICHOST | NI_NUMERICSERV); 441 ATF_REQUIRE_EQ_MSG(0, ret, "%d", ret); 442 443 // Verify that cap_getnameinfo worked with minimally sized buffers. 444 ATF_CHECK_EQ(0, strcmp(TEST_IPV4, buffers.host)); 445 ATF_CHECK_EQ(0, strcmp(TEST_PORT_STR, buffers.serv)); 446 447 // Verify that cap_getnameinfo did not overflow the buffers. 448 ATF_CHECK_EQ('!', buffers.host_canary); 449 ATF_CHECK_EQ('!', buffers.serv_canary); 450 451 cap_close(chan); 452 } 453 454 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode); 455 ATF_TC_BODY(capnet__limits_addr2name_mode, tc) 456 { 457 cap_channel_t *capnet; 458 cap_net_limit_t *limit; 459 460 capnet = create_network_service(); 461 462 /* LIMIT */ 463 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 464 ATF_REQUIRE(limit != NULL); 465 ATF_REQUIRE(cap_net_limit(limit) == 0); 466 467 /* ALLOWED */ 468 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 469 470 /* DISALLOWED */ 471 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 472 ENOTCAPABLE); 473 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 474 ENOTCAPABLE); 475 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 476 ENOTCAPABLE); 477 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 478 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 479 480 test_extend_mode(capnet, CAPNET_ADDR2NAME); 481 482 cap_close(capnet); 483 } 484 485 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_family); 486 ATF_TC_BODY(capnet__limits_addr2name_family, tc) 487 { 488 cap_channel_t *capnet; 489 cap_net_limit_t *limit; 490 int family[] = { AF_INET6, AF_INET }; 491 492 capnet = create_network_service(); 493 494 /* Limit to AF_INET6 and AF_INET. */ 495 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 496 ATF_REQUIRE(limit != NULL); 497 cap_net_limit_addr2name_family(limit, family, nitems(family)); 498 ATF_REQUIRE(cap_net_limit(limit) == 0); 499 500 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 501 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 502 503 /* Limit to AF_INET6 and AF_INET. */ 504 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 505 ATF_REQUIRE(limit != NULL); 506 cap_net_limit_addr2name_family(limit, &family[0], 1); 507 cap_net_limit_addr2name_family(limit, &family[1], 1); 508 ATF_REQUIRE(cap_net_limit(limit) == 0); 509 510 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 511 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 512 513 /* Limit to AF_INET6. */ 514 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 515 ATF_REQUIRE(limit != NULL); 516 cap_net_limit_addr2name_family(limit, family, 1); 517 ATF_REQUIRE(cap_net_limit(limit) == 0); 518 519 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 520 ENOTCAPABLE); 521 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 522 523 /* Unable to set empty limits. Empty limits means full access. */ 524 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 525 ATF_REQUIRE(cap_net_limit(limit) != 0); 526 527 cap_close(capnet); 528 } 529 530 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name); 531 ATF_TC_BODY(capnet__limits_addr2name, tc) 532 { 533 cap_channel_t *capnet; 534 cap_net_limit_t *limit; 535 struct sockaddr_in ipaddrv4; 536 struct sockaddr_in6 ipaddrv6; 537 538 capnet = create_network_service(); 539 540 /* Limit to TEST_IPV4 and TEST_IPV6. */ 541 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 542 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 543 544 ipaddrv4.sin_family = AF_INET; 545 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr); 546 547 ipaddrv6.sin6_family = AF_INET6; 548 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr); 549 550 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 551 ATF_REQUIRE(limit != NULL); 552 553 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 554 sizeof(ipaddrv4)); 555 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 556 sizeof(ipaddrv6)); 557 ATF_REQUIRE(cap_net_limit(limit) == 0); 558 559 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 560 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 561 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 562 ENOTCAPABLE); 563 564 /* Limit to AF_INET. */ 565 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 566 ATF_REQUIRE(limit != NULL); 567 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 568 sizeof(ipaddrv4)); 569 ATF_REQUIRE(cap_net_limit(limit) == 0); 570 571 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 572 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 573 ENOTCAPABLE); 574 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 575 ENOTCAPABLE); 576 577 /* Unable to set empty limits. Empty limits means full access. */ 578 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 579 ATF_REQUIRE(cap_net_limit(limit) != 0); 580 581 cap_close(capnet); 582 } 583 584 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_mode); 585 ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode, tc) 586 { 587 cap_channel_t *capnet; 588 cap_net_limit_t *limit; 589 590 capnet = create_network_service(); 591 592 /* LIMIT */ 593 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 594 ATF_REQUIRE(limit != NULL); 595 ATF_REQUIRE(cap_net_limit(limit) == 0); 596 597 /* ALLOWED */ 598 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 599 600 /* DISALLOWED */ 601 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 602 ENOTCAPABLE); 603 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 604 ENOTCAPABLE); 605 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 606 ENOTCAPABLE); 607 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 608 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 609 610 cap_close(capnet); 611 } 612 613 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_family); 614 ATF_TC_BODY(capnet__limits_deprecated_addr2name_family, tc) 615 { 616 cap_channel_t *capnet; 617 cap_net_limit_t *limit; 618 int family[] = { AF_INET6, AF_INET }; 619 620 capnet = create_network_service(); 621 622 /* Limit to AF_INET6 and AF_INET. */ 623 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 624 ATF_REQUIRE(limit != NULL); 625 cap_net_limit_addr2name_family(limit, family, nitems(family)); 626 ATF_REQUIRE(cap_net_limit(limit) == 0); 627 628 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 629 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 630 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 631 ENOTCAPABLE); 632 633 /* Limit to AF_INET6 and AF_INET. */ 634 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 635 ATF_REQUIRE(limit != NULL); 636 cap_net_limit_addr2name_family(limit, &family[0], 1); 637 cap_net_limit_addr2name_family(limit, &family[1], 1); 638 ATF_REQUIRE(cap_net_limit(limit) == 0); 639 640 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 641 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 642 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 643 ENOTCAPABLE); 644 645 /* Limit to AF_INET6. */ 646 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 647 ATF_REQUIRE(limit != NULL); 648 cap_net_limit_addr2name_family(limit, family, 1); 649 ATF_REQUIRE(cap_net_limit(limit) == 0); 650 651 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 652 ENOTCAPABLE); 653 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 654 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 655 ENOTCAPABLE); 656 657 /* Unable to set empty limits. Empty limits means full access. */ 658 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 659 ATF_REQUIRE(cap_net_limit(limit) != 0); 660 661 cap_close(capnet); 662 } 663 664 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name); 665 ATF_TC_BODY(capnet__limits_deprecated_addr2name, tc) 666 { 667 cap_channel_t *capnet; 668 cap_net_limit_t *limit; 669 struct in_addr ipaddrv4; 670 struct in6_addr ipaddrv6; 671 672 capnet = create_network_service(); 673 674 /* Limit to TEST_IPV4 and TEST_IPV6. */ 675 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 676 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 677 678 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4); 679 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6); 680 681 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 682 ATF_REQUIRE(limit != NULL); 683 684 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 685 sizeof(ipaddrv4)); 686 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 687 sizeof(ipaddrv6)); 688 ATF_REQUIRE(cap_net_limit(limit) == 0); 689 690 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 691 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 692 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 693 ENOTCAPABLE); 694 695 /* Limit to AF_INET. */ 696 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 697 ATF_REQUIRE(limit != NULL); 698 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 699 sizeof(ipaddrv4)); 700 ATF_REQUIRE(cap_net_limit(limit) == 0); 701 702 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 703 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 704 ENOTCAPABLE); 705 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 706 ENOTCAPABLE); 707 708 /* Unable to set empty limits. Empty limits means full access. */ 709 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 710 ATF_REQUIRE(cap_net_limit(limit) != 0); 711 712 cap_close(capnet); 713 } 714 715 716 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_mode); 717 ATF_TC_BODY(capnet__limits_name2addr_mode, tc) 718 { 719 cap_channel_t *capnet; 720 cap_net_limit_t *limit; 721 722 capnet = create_network_service(); 723 724 /* LIMIT */ 725 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 726 ATF_REQUIRE(limit != NULL); 727 ATF_REQUIRE(cap_net_limit(limit) == 0); 728 729 /* ALLOWED */ 730 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 731 0); 732 733 /* DISALLOWED */ 734 ATF_REQUIRE( 735 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 736 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 737 ENOTCAPABLE); 738 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 739 ENOTCAPABLE); 740 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 741 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 742 743 test_extend_mode(capnet, CAPNET_ADDR2NAME); 744 745 cap_close(capnet); 746 } 747 748 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts); 749 ATF_TC_BODY(capnet__limits_name2addr_hosts, tc) 750 { 751 cap_channel_t *capnet; 752 cap_net_limit_t *limit; 753 754 capnet = create_network_service(); 755 756 /* Limit to TEST_DOMAIN_0 and localhost only. */ 757 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 758 ATF_REQUIRE(limit != NULL); 759 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 760 cap_net_limit_name2addr(limit, "localhost", NULL); 761 ATF_REQUIRE(cap_net_limit(limit) == 0); 762 763 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 764 0); 765 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 0); 766 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 767 ENOTCAPABLE); 768 769 /* Limit to TEST_DOMAIN_0 only. */ 770 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 771 ATF_REQUIRE(limit != NULL); 772 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 773 ATF_REQUIRE(cap_net_limit(limit) == 0); 774 775 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 776 ENOTCAPABLE); 777 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 778 ENOTCAPABLE); 779 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 780 0); 781 782 /* Unable to set empty limits. Empty limits means full access. */ 783 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 784 ATF_REQUIRE(cap_net_limit(limit) != 0); 785 786 cap_close(capnet); 787 } 788 789 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_strict); 790 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict, tc) 791 { 792 cap_channel_t *capnet; 793 cap_net_limit_t *limit; 794 795 capnet = create_network_service(); 796 797 /* 798 * Limit to TEST_DOMAIN_0 and HTTP service. 799 */ 800 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 801 ATF_REQUIRE(limit != NULL); 802 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, "http"); 803 ATF_REQUIRE(cap_net_limit(limit) == 0); 804 805 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 806 0); 807 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 808 ENOTCAPABLE); 809 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "snmp") == 810 ENOTCAPABLE); 811 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 812 ENOTCAPABLE); 813 814 /* Unable to set empty limits. Empty limits means full access. */ 815 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 816 ATF_REQUIRE(cap_net_limit(limit) != 0); 817 818 cap_close(capnet); 819 } 820 821 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_mix); 822 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix, tc) 823 { 824 cap_channel_t *capnet; 825 cap_net_limit_t *limit; 826 827 capnet = create_network_service(); 828 829 /* 830 * Limit to TEST_DOMAIN_0 and any servnamex, and any domain with 831 * servname HTTP. 832 */ 833 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 834 ATF_REQUIRE(limit != NULL); 835 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 836 cap_net_limit_name2addr(limit, NULL, "http"); 837 ATF_REQUIRE(cap_net_limit(limit) == 0); 838 839 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 840 0); 841 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 842 0); 843 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 844 0); 845 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 846 0); 847 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 848 ENOTCAPABLE); 849 850 /* Limit to HTTTP servname only. */ 851 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 852 ATF_REQUIRE(limit != NULL); 853 cap_net_limit_name2addr(limit, NULL, "http"); 854 ATF_REQUIRE(cap_net_limit(limit) == 0); 855 856 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 857 0); 858 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 859 ENOTCAPABLE); 860 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 861 0); 862 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 863 ENOTCAPABLE); 864 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 865 ENOTCAPABLE); 866 867 /* Unable to set empty limits. Empty limits means full access. */ 868 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 869 ATF_REQUIRE(cap_net_limit(limit) != 0); 870 871 cap_close(capnet); 872 } 873 874 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_family); 875 ATF_TC_BODY(capnet__limits_name2addr_family, tc) 876 { 877 cap_channel_t *capnet; 878 cap_net_limit_t *limit; 879 int family[] = { AF_INET6, AF_INET }; 880 881 capnet = create_network_service(); 882 883 /* Limit to AF_INET and AF_INET6. */ 884 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 885 ATF_REQUIRE(limit != NULL); 886 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 887 cap_net_limit_name2addr_family(limit, family, nitems(family)); 888 ATF_REQUIRE(cap_net_limit(limit) == 0); 889 890 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 891 0); 892 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 893 0); 894 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 895 ENOTCAPABLE); 896 897 /* Limit to AF_INET and AF_INET6. */ 898 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 899 ATF_REQUIRE(limit != NULL); 900 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 901 cap_net_limit_name2addr_family(limit, &family[0], 1); 902 cap_net_limit_name2addr_family(limit, &family[1], 1); 903 ATF_REQUIRE(cap_net_limit(limit) == 0); 904 905 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 906 0); 907 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 908 0); 909 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 910 ENOTCAPABLE); 911 912 /* Limit to AF_INET6 only. */ 913 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 914 ATF_REQUIRE(limit != NULL); 915 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 916 cap_net_limit_name2addr_family(limit, family, 1); 917 ATF_REQUIRE(cap_net_limit(limit) == 0); 918 919 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 920 ENOTCAPABLE); 921 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 922 0); 923 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 924 ENOTCAPABLE); 925 926 /* Unable to set empty limits. Empty limits means full access. */ 927 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 928 ATF_REQUIRE(cap_net_limit(limit) != 0); 929 930 cap_close(capnet); 931 } 932 933 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_mode); 934 ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode, tc) 935 { 936 cap_channel_t *capnet; 937 cap_net_limit_t *limit; 938 939 capnet = create_network_service(); 940 941 /* LIMIT */ 942 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 943 ATF_REQUIRE(limit != NULL); 944 ATF_REQUIRE(cap_net_limit(limit) == 0); 945 946 /* ALLOWED */ 947 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 948 949 /* DISALLOWED */ 950 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 951 ENOTCAPABLE); 952 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 953 ENOTCAPABLE); 954 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 955 ENOTCAPABLE); 956 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 957 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 958 959 test_extend_mode(capnet, CAPNET_ADDR2NAME); 960 961 cap_close(capnet); 962 } 963 964 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_hosts); 965 ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts, tc) 966 { 967 cap_channel_t *capnet; 968 cap_net_limit_t *limit; 969 970 capnet = create_network_service(); 971 972 /* Limit to TEST_DOMAIN_0 and localhost only. */ 973 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 974 ATF_REQUIRE(limit != NULL); 975 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 976 cap_net_limit_name2addr(limit, "localhost", NULL); 977 ATF_REQUIRE(cap_net_limit(limit) == 0); 978 979 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 980 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, "localhost") == 0); 981 ATF_REQUIRE( 982 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 983 984 /* Limit to TEST_DOMAIN_0 only. */ 985 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 986 ATF_REQUIRE(limit != NULL); 987 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 988 ATF_REQUIRE(cap_net_limit(limit) == 0); 989 990 ATF_REQUIRE( 991 test_gethostbyname(capnet, AF_INET, "localhost") == ENOTCAPABLE); 992 ATF_REQUIRE( 993 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 994 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 995 996 /* Unable to set empty limits. Empty limits means full access. */ 997 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 998 ATF_REQUIRE(cap_net_limit(limit) != 0); 999 1000 cap_close(capnet); 1001 } 1002 1003 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_family); 1004 ATF_TC_BODY(capnet__limits_deprecated_name2addr_family, tc) 1005 { 1006 cap_channel_t *capnet; 1007 cap_net_limit_t *limit; 1008 int family[] = { AF_INET6, AF_INET }; 1009 1010 capnet = create_network_service(); 1011 1012 /* Limit to AF_INET and AF_INET6. */ 1013 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1014 ATF_REQUIRE(limit != NULL); 1015 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1016 cap_net_limit_name2addr_family(limit, family, nitems(family)); 1017 ATF_REQUIRE(cap_net_limit(limit) == 0); 1018 1019 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1020 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1021 ATF_REQUIRE( 1022 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1023 1024 /* Limit to AF_INET and AF_INET6. */ 1025 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1026 ATF_REQUIRE(limit != NULL); 1027 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1028 cap_net_limit_name2addr_family(limit, &family[0], 1); 1029 cap_net_limit_name2addr_family(limit, &family[1], 1); 1030 ATF_REQUIRE(cap_net_limit(limit) == 0); 1031 1032 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1033 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1034 ATF_REQUIRE( 1035 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1036 1037 /* Limit to AF_INET6 only. */ 1038 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1039 ATF_REQUIRE(limit != NULL); 1040 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1041 cap_net_limit_name2addr_family(limit, family, 1); 1042 ATF_REQUIRE(cap_net_limit(limit) == 0); 1043 1044 ATF_REQUIRE( 1045 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1046 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1047 ATF_REQUIRE( 1048 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1049 1050 /* Unable to set empty limits. Empty limits means full access. */ 1051 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1052 ATF_REQUIRE(cap_net_limit(limit) != 0); 1053 1054 cap_close(capnet); 1055 } 1056 1057 ATF_TC_WITHOUT_HEAD(capnet__limits_bind_mode); 1058 ATF_TC_BODY(capnet__limits_bind_mode, tc) 1059 { 1060 cap_channel_t *capnet; 1061 cap_net_limit_t *limit; 1062 1063 capnet = create_network_service(); 1064 1065 /* LIMIT */ 1066 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1067 ATF_REQUIRE(limit != NULL); 1068 ATF_REQUIRE(cap_net_limit(limit) == 0); 1069 1070 /* ALLOWED */ 1071 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1072 1073 /* DISALLOWED */ 1074 ATF_REQUIRE( 1075 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1076 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1077 ENOTCAPABLE); 1078 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1079 ENOTCAPABLE); 1080 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1081 ENOTCAPABLE); 1082 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 1083 1084 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1085 1086 cap_close(capnet); 1087 } 1088 1089 ATF_TC_WITHOUT_HEAD(capnet__limits_bind); 1090 ATF_TC_BODY(capnet__limits_bind, tc) 1091 { 1092 cap_channel_t *capnet; 1093 cap_net_limit_t *limit; 1094 struct sockaddr_in ipv4; 1095 1096 capnet = create_network_service(); 1097 1098 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1099 ATF_REQUIRE(limit != NULL); 1100 1101 memset(&ipv4, 0, sizeof(ipv4)); 1102 ipv4.sin_family = AF_INET; 1103 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr); 1104 1105 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1106 ATF_REQUIRE(cap_net_limit(limit) == 0); 1107 1108 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1109 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE); 1110 1111 cap_close(capnet); 1112 } 1113 1114 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_mode); 1115 ATF_TC_BODY(capnet__limits_connect_mode, tc) 1116 { 1117 cap_channel_t *capnet; 1118 cap_net_limit_t *limit; 1119 1120 capnet = create_network_service(); 1121 1122 /* LIMIT */ 1123 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1124 ATF_REQUIRE(limit != NULL); 1125 ATF_REQUIRE(cap_net_limit(limit) == 0); 1126 1127 /* ALLOWED */ 1128 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1129 1130 /* DISALLOWED */ 1131 ATF_REQUIRE( 1132 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1133 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1134 ENOTCAPABLE); 1135 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1136 ENOTCAPABLE); 1137 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1138 ENOTCAPABLE); 1139 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1140 1141 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1142 1143 cap_close(capnet); 1144 } 1145 1146 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_dns_mode); 1147 ATF_TC_BODY(capnet__limits_connect_dns_mode, tc) 1148 { 1149 cap_channel_t *capnet; 1150 cap_net_limit_t *limit; 1151 1152 capnet = create_network_service(); 1153 1154 /* LIMIT */ 1155 limit = cap_net_limit_init(capnet, CAPNET_CONNECT | CAPNET_CONNECTDNS); 1156 ATF_REQUIRE(limit != NULL); 1157 ATF_REQUIRE(cap_net_limit(limit) == 0); 1158 1159 /* ALLOWED */ 1160 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1161 1162 /* DISALLOWED */ 1163 ATF_REQUIRE( 1164 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1165 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1166 ENOTCAPABLE); 1167 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1168 ENOTCAPABLE); 1169 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1170 ENOTCAPABLE); 1171 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1172 1173 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1174 1175 cap_close(capnet); 1176 } 1177 1178 ATF_TC_WITHOUT_HEAD(capnet__limits_connect); 1179 ATF_TC_BODY(capnet__limits_connect, tc) 1180 { 1181 cap_channel_t *capnet; 1182 cap_net_limit_t *limit; 1183 struct sockaddr_in ipv4; 1184 1185 capnet = create_network_service(); 1186 1187 /* Limit only to TEST_IPV4 on port 80 and 443. */ 1188 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1189 ATF_REQUIRE(limit != NULL); 1190 memset(&ipv4, 0, sizeof(ipv4)); 1191 ipv4.sin_family = AF_INET; 1192 ipv4.sin_port = htons(80); 1193 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr); 1194 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1195 1196 ipv4.sin_port = htons(443); 1197 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1198 ATF_REQUIRE(cap_net_limit(limit) == 0); 1199 1200 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1201 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1202 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1203 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1204 1205 /* Limit only to TEST_IPV4 on port 443. */ 1206 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1207 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1208 ATF_REQUIRE(cap_net_limit(limit) == 0); 1209 1210 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 433) == ENOTCAPABLE); 1211 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1212 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1213 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1214 1215 /* Unable to set empty limits. Empty limits means full access. */ 1216 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1217 ATF_REQUIRE(cap_net_limit(limit) != 0); 1218 1219 cap_close(capnet); 1220 } 1221 1222 ATF_TC_WITHOUT_HEAD(capnet__limits_connecttodns); 1223 ATF_TC_BODY(capnet__limits_connecttodns, tc) 1224 { 1225 cap_channel_t *capnet; 1226 cap_net_limit_t *limit; 1227 struct addrinfo hints, *capres, *res; 1228 int family[] = { AF_INET }; 1229 int error; 1230 1231 capnet = create_network_service(); 1232 1233 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1234 CAPNET_NAME2ADDR); 1235 ATF_REQUIRE(limit != NULL); 1236 cap_net_limit_name2addr(limit, TEST_IPV4, "80"); 1237 cap_net_limit_name2addr_family(limit, family, 1); 1238 ATF_REQUIRE(cap_net_limit(limit) == 0); 1239 1240 memset(&hints, 0, sizeof(hints)); 1241 hints.ai_family = AF_INET; 1242 hints.ai_socktype = SOCK_STREAM; 1243 1244 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1245 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 1246 0); 1247 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1248 1249 for (res = capres; res != NULL; res = res->ai_next) { 1250 int s; 1251 1252 ATF_REQUIRE(res->ai_family == AF_INET); 1253 ATF_REQUIRE(res->ai_socktype == SOCK_STREAM); 1254 1255 s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); 1256 ATF_REQUIRE(s >= 0); 1257 1258 error = cap_connect(capnet, s, res->ai_addr, 1259 res->ai_addrlen); 1260 if (error != 0 && errno != ENOTCAPABLE) 1261 atf_tc_skip("unable to connect: %s", strerror(errno)); 1262 ATF_REQUIRE(error == 0); 1263 ATF_REQUIRE(close(s) == 0); 1264 } 1265 1266 freeaddrinfo(capres); 1267 cap_close(capnet); 1268 } 1269 1270 1271 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_connecttodns); 1272 ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc) 1273 { 1274 cap_channel_t *capnet; 1275 cap_net_limit_t *limit; 1276 struct hostent *caphp; 1277 struct in_addr ipaddr; 1278 struct sockaddr_in connaddr; 1279 int family[] = { AF_INET }; 1280 int error, i; 1281 1282 capnet = create_network_service(); 1283 1284 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1285 CAPNET_DEPRECATED_NAME2ADDR); 1286 ATF_REQUIRE(limit != NULL); 1287 cap_net_limit_name2addr(limit, TEST_IPV4, NULL); 1288 cap_net_limit_name2addr_family(limit, family, 1); 1289 ATF_REQUIRE(cap_net_limit(limit) == 0); 1290 1291 memset(&ipaddr, 0, sizeof(ipaddr)); 1292 inet_pton(AF_INET, TEST_IPV4, &ipaddr); 1293 1294 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1295 caphp = cap_gethostbyname2(capnet, TEST_IPV4, AF_INET); 1296 ATF_REQUIRE(caphp != NULL); 1297 ATF_REQUIRE(caphp->h_addrtype == AF_INET); 1298 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1299 1300 for (i = 0; caphp->h_addr_list[i] != NULL; i++) { 1301 int s; 1302 1303 s = socket(AF_INET, SOCK_STREAM, 0); 1304 ATF_REQUIRE(s >= 0); 1305 1306 memset(&connaddr, 0, sizeof(connaddr)); 1307 connaddr.sin_family = AF_INET; 1308 memcpy((char *)&connaddr.sin_addr.s_addr, 1309 (char *)caphp->h_addr_list[i], caphp->h_length); 1310 connaddr.sin_port = htons(80); 1311 1312 error = cap_connect(capnet, s, (struct sockaddr *)&connaddr, 1313 sizeof(connaddr)); 1314 if (error != 0 && errno != ENOTCAPABLE) 1315 atf_tc_skip("unable to connect: %s", strerror(errno)); 1316 ATF_REQUIRE(error == 0); 1317 ATF_REQUIRE(close(s) == 0); 1318 } 1319 1320 cap_close(capnet); 1321 } 1322 1323 ATF_TP_ADD_TCS(tp) 1324 { 1325 1326 ATF_TP_ADD_TC(tp, capnet__connect); 1327 ATF_TP_ADD_TC(tp, capnet__bind); 1328 ATF_TP_ADD_TC(tp, capnet__getnameinfo); 1329 ATF_TP_ADD_TC(tp, capnet__getaddrinfo); 1330 ATF_TP_ADD_TC(tp, capnet__gethostbyname); 1331 ATF_TP_ADD_TC(tp, capnet__gethostbyaddr); 1332 1333 ATF_TP_ADD_TC(tp, capnet__getnameinfo_buffer); 1334 1335 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode); 1336 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family); 1337 ATF_TP_ADD_TC(tp, capnet__limits_addr2name); 1338 1339 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_mode); 1340 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_family); 1341 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name); 1342 1343 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_mode); 1344 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts); 1345 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_strict); 1346 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_mix); 1347 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_family); 1348 1349 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_mode); 1350 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_hosts); 1351 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_family); 1352 1353 ATF_TP_ADD_TC(tp, capnet__limits_bind_mode); 1354 ATF_TP_ADD_TC(tp, capnet__limits_bind); 1355 1356 ATF_TP_ADD_TC(tp, capnet__limits_connect_mode); 1357 ATF_TP_ADD_TC(tp, capnet__limits_connect_dns_mode); 1358 ATF_TP_ADD_TC(tp, capnet__limits_connect); 1359 1360 ATF_TP_ADD_TC(tp, capnet__limits_connecttodns); 1361 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_connecttodns); 1362 1363 return (atf_no_error()); 1364 } 1365