1 /*- 2 * Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org> 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 14 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 15 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 23 * POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/cdefs.h> 27 __FBSDID("$FreeBSD$"); 28 29 #include <sys/param.h> 30 #include <sys/socket.h> 31 #include <netinet/in.h> 32 #include <arpa/inet.h> 33 34 #include <errno.h> 35 #include <netdb.h> 36 37 #include <atf-c.h> 38 39 #include <libcasper.h> 40 #include <casper/cap_net.h> 41 42 #define TEST_DOMAIN_0 "example.com" 43 #define TEST_DOMAIN_1 "freebsd.org" 44 #define TEST_IPV4 "1.1.1.1" 45 #define TEST_IPV6 "2001:4860:4860::8888" 46 #define TEST_BIND_IPV4 "127.0.0.1" 47 48 static cap_channel_t * 49 create_network_service(void) 50 { 51 cap_channel_t *capcas, *capnet; 52 53 capcas = cap_init(); 54 ATF_REQUIRE(capcas != NULL); 55 56 capnet = cap_service_open(capcas, "system.net"); 57 ATF_REQUIRE(capnet != NULL); 58 59 cap_close(capcas); 60 return (capnet); 61 } 62 63 static int 64 test_getnameinfo_v4(cap_channel_t *chan, int family, const char *ip) 65 { 66 struct sockaddr_in ipaddr; 67 char capfn[MAXHOSTNAMELEN]; 68 char origfn[MAXHOSTNAMELEN]; 69 int ret; 70 71 memset(&ipaddr, 0, sizeof(ipaddr)); 72 ipaddr.sin_family = family; 73 inet_pton(family, ip, &ipaddr.sin_addr); 74 75 ret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 76 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 77 if (ret != 0) { 78 return (ret); 79 } 80 81 ret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 82 sizeof(origfn), NULL, 0, NI_NAMEREQD); 83 ATF_REQUIRE(ret == 0); 84 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 85 86 return (0); 87 } 88 89 static int 90 test_getnameinfo_v6(cap_channel_t *chan, const char *ip) 91 { 92 struct sockaddr_in6 ipaddr; 93 char capfn[MAXHOSTNAMELEN]; 94 char origfn[MAXHOSTNAMELEN]; 95 int ret; 96 97 memset(&ipaddr, 0, sizeof(ipaddr)); 98 ipaddr.sin6_family = AF_INET6; 99 inet_pton(AF_INET6, ip, &ipaddr.sin6_addr); 100 101 ret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 102 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 103 if (ret != 0) { 104 return (ret); 105 } 106 107 ret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 108 sizeof(origfn), NULL, 0, NI_NAMEREQD); 109 ATF_REQUIRE(ret == 0); 110 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 111 112 return (0); 113 } 114 115 static int 116 test_getnameinfo(cap_channel_t *chan, int family, const char *ip) 117 { 118 119 if (family == AF_INET6) { 120 return (test_getnameinfo_v6(chan, ip)); 121 } 122 123 return (test_getnameinfo_v4(chan, family, ip)); 124 } 125 126 static int 127 test_gethostbyaddr_v4(cap_channel_t *chan, int family, const char *ip) 128 { 129 struct in_addr ipaddr; 130 struct hostent *caphp, *orighp; 131 132 memset(&ipaddr, 0, sizeof(ipaddr)); 133 inet_pton(AF_INET, ip, &ipaddr); 134 135 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), family); 136 if (caphp == NULL) { 137 return (h_errno); 138 } 139 140 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), family); 141 ATF_REQUIRE(orighp != NULL); 142 ATF_REQUIRE(strcmp(caphp->h_name, caphp->h_name) == 0); 143 144 return (0); 145 } 146 147 static int 148 test_gethostbyaddr_v6(cap_channel_t *chan, const char *ip) 149 { 150 struct in6_addr ipaddr; 151 struct hostent *caphp, *orighp; 152 153 memset(&ipaddr, 0, sizeof(ipaddr)); 154 inet_pton(AF_INET6, ip, &ipaddr); 155 156 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), AF_INET6); 157 if (caphp == NULL) 158 return (h_errno); 159 160 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), AF_INET6); 161 ATF_REQUIRE(orighp != NULL); 162 ATF_REQUIRE(strcmp(caphp->h_name, caphp->h_name) == 0); 163 164 return (0); 165 } 166 167 static int 168 test_gethostbyaddr(cap_channel_t *chan, int family, const char *ip) 169 { 170 171 if (family == AF_INET6) { 172 return (test_gethostbyaddr_v6(chan, ip)); 173 } else { 174 return (test_gethostbyaddr_v4(chan, family, ip)); 175 } 176 } 177 178 static int 179 test_getaddrinfo(cap_channel_t *chan, int family, const char *domain, 180 const char *servname) 181 { 182 struct addrinfo hints, *capres, *origres, *res0, *res1; 183 bool found; 184 int ret; 185 186 memset(&hints, 0, sizeof(hints)); 187 hints.ai_family = family; 188 hints.ai_socktype = SOCK_STREAM; 189 190 ret = cap_getaddrinfo(chan, domain, servname, &hints, &capres); 191 if (ret != 0) { 192 return (ret); 193 } 194 195 ret = getaddrinfo(domain, servname, &hints, &origres); 196 ATF_REQUIRE(ret == 0); 197 198 for (res0 = capres; res0 != NULL; res0 = res0->ai_next) { 199 found = false; 200 for (res1 = origres; res1 != NULL; res1 = res1->ai_next) { 201 if (res1->ai_addrlen == res0->ai_addrlen && 202 memcmp(res1->ai_addr, res0->ai_addr, 203 res0->ai_addrlen) == 0) { 204 found = true; 205 break; 206 } 207 } 208 ATF_REQUIRE(found); 209 } 210 211 freeaddrinfo(capres); 212 freeaddrinfo(origres); 213 return (0); 214 } 215 216 static int 217 test_gethostbyname(cap_channel_t *chan, int family, const char *domain) 218 { 219 struct hostent *caphp, *orighp; 220 221 caphp = cap_gethostbyname2(chan, domain, family); 222 if (caphp == NULL) { 223 return (h_errno); 224 } 225 226 orighp = gethostbyname2(domain, family); 227 ATF_REQUIRE(orighp != NULL); 228 ATF_REQUIRE(strcmp(caphp->h_name, orighp->h_name) == 0); 229 230 return (0); 231 } 232 233 static int 234 test_bind(cap_channel_t *chan, const char *ip) 235 { 236 struct sockaddr_in ipv4; 237 int capfd, ret, serrno; 238 239 capfd = socket(AF_INET, SOCK_STREAM, 0); 240 ATF_REQUIRE(capfd > 0); 241 242 memset(&ipv4, 0, sizeof(ipv4)); 243 ipv4.sin_family = AF_INET; 244 inet_pton(AF_INET, ip, &ipv4.sin_addr); 245 246 ret = cap_bind(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 247 serrno = errno; 248 close(capfd); 249 250 return (ret < 0 ? serrno : 0); 251 } 252 253 static int 254 test_connect(cap_channel_t *chan, const char *ip, unsigned short port) 255 { 256 struct sockaddr_in ipv4; 257 int capfd, ret, serrno; 258 259 capfd = socket(AF_INET, SOCK_STREAM, 0); 260 ATF_REQUIRE(capfd > 0); 261 262 memset(&ipv4, 0, sizeof(ipv4)); 263 ipv4.sin_family = AF_INET; 264 ipv4.sin_port = htons(port); 265 inet_pton(AF_INET, ip, &ipv4.sin_addr); 266 267 ret = cap_connect(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 268 serrno = errno; 269 close(capfd); 270 271 return (ret < 0 ? serrno : 0); 272 } 273 274 static void 275 test_extend_mode(cap_channel_t *capnet, int current) 276 { 277 cap_net_limit_t *limit; 278 const int rights[] = { 279 CAPNET_ADDR2NAME, 280 CAPNET_NAME2ADDR, 281 CAPNET_DEPRECATED_ADDR2NAME, 282 CAPNET_DEPRECATED_NAME2ADDR, 283 CAPNET_CONNECT, 284 CAPNET_BIND, 285 CAPNET_CONNECTDNS 286 }; 287 size_t i; 288 289 for (i = 0; i < nitems(rights); i++) { 290 if (current == rights[i]) 291 continue; 292 293 limit = cap_net_limit_init(capnet, current | rights[i]); 294 ATF_REQUIRE(limit != NULL); 295 ATF_REQUIRE(cap_net_limit(limit) != 0); 296 } 297 } 298 299 ATF_TC_WITHOUT_HEAD(capnet__getnameinfo); 300 ATF_TC_BODY(capnet__getnameinfo, tc) 301 { 302 cap_channel_t *capnet; 303 304 capnet = create_network_service(); 305 306 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 307 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 308 309 cap_close(capnet); 310 } 311 312 ATF_TC_WITHOUT_HEAD(capnet__connect); 313 ATF_TC_BODY(capnet__connect, tc) 314 { 315 cap_channel_t *capnet; 316 317 capnet = create_network_service(); 318 319 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 320 321 cap_close(capnet); 322 } 323 324 ATF_TC_WITHOUT_HEAD(capnet__bind); 325 ATF_TC_BODY(capnet__bind, tc) 326 { 327 cap_channel_t *capnet; 328 329 capnet = create_network_service(); 330 331 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 332 333 cap_close(capnet); 334 } 335 336 ATF_TC_WITHOUT_HEAD(capnet__getaddrinfo); 337 ATF_TC_BODY(capnet__getaddrinfo, tc) 338 { 339 cap_channel_t *capnet; 340 struct addrinfo hints, *capres; 341 342 capnet = create_network_service(); 343 344 memset(&hints, 0, sizeof(hints)); 345 hints.ai_family = AF_INET; 346 hints.ai_socktype = SOCK_STREAM; 347 348 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 349 0); 350 351 cap_close(capnet); 352 } 353 354 ATF_TC_WITHOUT_HEAD(capnet__gethostbyname); 355 ATF_TC_BODY(capnet__gethostbyname, tc) 356 { 357 cap_channel_t *capnet; 358 359 capnet = create_network_service(); 360 361 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 362 363 cap_close(capnet); 364 } 365 366 ATF_TC_WITHOUT_HEAD(capnet__gethostbyaddr); 367 ATF_TC_BODY(capnet__gethostbyaddr, tc) 368 { 369 cap_channel_t *capnet; 370 371 capnet = create_network_service(); 372 373 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 374 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 375 376 cap_close(capnet); 377 } 378 379 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode); 380 ATF_TC_BODY(capnet__limits_addr2name_mode, tc) 381 { 382 cap_channel_t *capnet; 383 cap_net_limit_t *limit; 384 385 capnet = create_network_service(); 386 387 /* LIMIT */ 388 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 389 ATF_REQUIRE(limit != NULL); 390 ATF_REQUIRE(cap_net_limit(limit) == 0); 391 392 /* ALLOWED */ 393 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 394 395 /* DISALLOWED */ 396 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 397 ENOTCAPABLE); 398 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 399 ENOTCAPABLE); 400 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 401 ENOTCAPABLE); 402 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 403 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 404 405 test_extend_mode(capnet, CAPNET_ADDR2NAME); 406 407 cap_close(capnet); 408 } 409 410 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_family); 411 ATF_TC_BODY(capnet__limits_addr2name_family, tc) 412 { 413 cap_channel_t *capnet; 414 cap_net_limit_t *limit; 415 int family[] = { AF_INET6, AF_INET }; 416 417 capnet = create_network_service(); 418 419 /* Limit to AF_INET6 and AF_INET. */ 420 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 421 ATF_REQUIRE(limit != NULL); 422 cap_net_limit_addr2name_family(limit, family, nitems(family)); 423 ATF_REQUIRE(cap_net_limit(limit) == 0); 424 425 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 426 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 427 428 /* Limit to AF_INET6 and AF_INET. */ 429 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 430 ATF_REQUIRE(limit != NULL); 431 cap_net_limit_addr2name_family(limit, &family[0], 1); 432 cap_net_limit_addr2name_family(limit, &family[1], 1); 433 ATF_REQUIRE(cap_net_limit(limit) == 0); 434 435 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 436 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 437 438 /* Limit to AF_INET6. */ 439 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 440 ATF_REQUIRE(limit != NULL); 441 cap_net_limit_addr2name_family(limit, family, 1); 442 ATF_REQUIRE(cap_net_limit(limit) == 0); 443 444 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 445 ENOTCAPABLE); 446 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 447 448 /* Unable to set empty limits. Empty limits means full access. */ 449 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 450 ATF_REQUIRE(cap_net_limit(limit) != 0); 451 452 cap_close(capnet); 453 } 454 455 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name); 456 ATF_TC_BODY(capnet__limits_addr2name, tc) 457 { 458 cap_channel_t *capnet; 459 cap_net_limit_t *limit; 460 struct sockaddr_in ipaddrv4; 461 struct sockaddr_in6 ipaddrv6; 462 463 capnet = create_network_service(); 464 465 /* Limit to TEST_IPV4 and TEST_IPV6. */ 466 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 467 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 468 469 ipaddrv4.sin_family = AF_INET; 470 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr); 471 472 ipaddrv6.sin6_family = AF_INET6; 473 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr); 474 475 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 476 ATF_REQUIRE(limit != NULL); 477 478 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 479 sizeof(ipaddrv4)); 480 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 481 sizeof(ipaddrv6)); 482 ATF_REQUIRE(cap_net_limit(limit) == 0); 483 484 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 485 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 486 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 487 ENOTCAPABLE); 488 489 /* Limit to AF_INET. */ 490 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 491 ATF_REQUIRE(limit != NULL); 492 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 493 sizeof(ipaddrv4)); 494 ATF_REQUIRE(cap_net_limit(limit) == 0); 495 496 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 497 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 498 ENOTCAPABLE); 499 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 500 ENOTCAPABLE); 501 502 /* Unable to set empty limits. Empty limits means full access. */ 503 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 504 ATF_REQUIRE(cap_net_limit(limit) != 0); 505 506 cap_close(capnet); 507 } 508 509 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_mode); 510 ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode, tc) 511 { 512 cap_channel_t *capnet; 513 cap_net_limit_t *limit; 514 515 capnet = create_network_service(); 516 517 /* LIMIT */ 518 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 519 ATF_REQUIRE(limit != NULL); 520 ATF_REQUIRE(cap_net_limit(limit) == 0); 521 522 /* ALLOWED */ 523 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 524 525 /* DISALLOWED */ 526 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 527 ENOTCAPABLE); 528 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 529 ENOTCAPABLE); 530 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 531 ENOTCAPABLE); 532 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 533 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 534 535 cap_close(capnet); 536 } 537 538 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_family); 539 ATF_TC_BODY(capnet__limits_deprecated_addr2name_family, tc) 540 { 541 cap_channel_t *capnet; 542 cap_net_limit_t *limit; 543 int family[] = { AF_INET6, AF_INET }; 544 545 capnet = create_network_service(); 546 547 /* Limit to AF_INET6 and AF_INET. */ 548 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 549 ATF_REQUIRE(limit != NULL); 550 cap_net_limit_addr2name_family(limit, family, nitems(family)); 551 ATF_REQUIRE(cap_net_limit(limit) == 0); 552 553 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 554 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 555 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 556 ENOTCAPABLE); 557 558 /* Limit to AF_INET6 and AF_INET. */ 559 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 560 ATF_REQUIRE(limit != NULL); 561 cap_net_limit_addr2name_family(limit, &family[0], 1); 562 cap_net_limit_addr2name_family(limit, &family[1], 1); 563 ATF_REQUIRE(cap_net_limit(limit) == 0); 564 565 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 566 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 567 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 568 ENOTCAPABLE); 569 570 /* Limit to AF_INET6. */ 571 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 572 ATF_REQUIRE(limit != NULL); 573 cap_net_limit_addr2name_family(limit, family, 1); 574 ATF_REQUIRE(cap_net_limit(limit) == 0); 575 576 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 577 ENOTCAPABLE); 578 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 579 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 580 ENOTCAPABLE); 581 582 /* Unable to set empty limits. Empty limits means full access. */ 583 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 584 ATF_REQUIRE(cap_net_limit(limit) != 0); 585 586 cap_close(capnet); 587 } 588 589 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name); 590 ATF_TC_BODY(capnet__limits_deprecated_addr2name, tc) 591 { 592 cap_channel_t *capnet; 593 cap_net_limit_t *limit; 594 struct in_addr ipaddrv4; 595 struct in6_addr ipaddrv6; 596 597 capnet = create_network_service(); 598 599 /* Limit to TEST_IPV4 and TEST_IPV6. */ 600 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 601 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 602 603 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4); 604 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6); 605 606 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 607 ATF_REQUIRE(limit != NULL); 608 609 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 610 sizeof(ipaddrv4)); 611 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 612 sizeof(ipaddrv6)); 613 ATF_REQUIRE(cap_net_limit(limit) == 0); 614 615 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 616 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 617 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 618 ENOTCAPABLE); 619 620 /* Limit to AF_INET. */ 621 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 622 ATF_REQUIRE(limit != NULL); 623 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 624 sizeof(ipaddrv4)); 625 ATF_REQUIRE(cap_net_limit(limit) == 0); 626 627 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 628 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 629 ENOTCAPABLE); 630 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 631 ENOTCAPABLE); 632 633 /* Unable to set empty limits. Empty limits means full access. */ 634 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 635 ATF_REQUIRE(cap_net_limit(limit) != 0); 636 637 cap_close(capnet); 638 } 639 640 641 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_mode); 642 ATF_TC_BODY(capnet__limits_name2addr_mode, tc) 643 { 644 cap_channel_t *capnet; 645 cap_net_limit_t *limit; 646 647 capnet = create_network_service(); 648 649 /* LIMIT */ 650 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 651 ATF_REQUIRE(limit != NULL); 652 ATF_REQUIRE(cap_net_limit(limit) == 0); 653 654 /* ALLOWED */ 655 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 656 0); 657 658 /* DISALLOWED */ 659 ATF_REQUIRE( 660 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 661 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 662 ENOTCAPABLE); 663 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 664 ENOTCAPABLE); 665 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 666 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 667 668 test_extend_mode(capnet, CAPNET_ADDR2NAME); 669 670 cap_close(capnet); 671 } 672 673 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts); 674 ATF_TC_BODY(capnet__limits_name2addr_hosts, tc) 675 { 676 cap_channel_t *capnet; 677 cap_net_limit_t *limit; 678 679 capnet = create_network_service(); 680 681 /* Limit to TEST_DOMAIN_0 and localhost only. */ 682 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 683 ATF_REQUIRE(limit != NULL); 684 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 685 cap_net_limit_name2addr(limit, "localhost", NULL); 686 ATF_REQUIRE(cap_net_limit(limit) == 0); 687 688 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 689 0); 690 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 0); 691 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 692 ENOTCAPABLE); 693 694 /* Limit to TEST_DOMAIN_0 only. */ 695 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 696 ATF_REQUIRE(limit != NULL); 697 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 698 ATF_REQUIRE(cap_net_limit(limit) == 0); 699 700 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 701 ENOTCAPABLE); 702 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 703 ENOTCAPABLE); 704 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 705 0); 706 707 /* Unable to set empty limits. Empty limits means full access. */ 708 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 709 ATF_REQUIRE(cap_net_limit(limit) != 0); 710 711 cap_close(capnet); 712 } 713 714 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_strict); 715 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict, tc) 716 { 717 cap_channel_t *capnet; 718 cap_net_limit_t *limit; 719 720 capnet = create_network_service(); 721 722 /* 723 * Limit to TEST_DOMAIN_0 and HTTP service. 724 */ 725 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 726 ATF_REQUIRE(limit != NULL); 727 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, "http"); 728 ATF_REQUIRE(cap_net_limit(limit) == 0); 729 730 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 731 0); 732 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 733 ENOTCAPABLE); 734 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "snmp") == 735 ENOTCAPABLE); 736 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 737 ENOTCAPABLE); 738 739 /* Unable to set empty limits. Empty limits means full access. */ 740 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 741 ATF_REQUIRE(cap_net_limit(limit) != 0); 742 743 cap_close(capnet); 744 } 745 746 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_mix); 747 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix, tc) 748 { 749 cap_channel_t *capnet; 750 cap_net_limit_t *limit; 751 752 capnet = create_network_service(); 753 754 /* 755 * Limit to TEST_DOMAIN_0 and any servnamex, and any domain with 756 * servname HTTP. 757 */ 758 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 759 ATF_REQUIRE(limit != NULL); 760 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 761 cap_net_limit_name2addr(limit, NULL, "http"); 762 ATF_REQUIRE(cap_net_limit(limit) == 0); 763 764 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 765 0); 766 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 767 0); 768 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 769 0); 770 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 771 0); 772 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 773 ENOTCAPABLE); 774 775 /* Limit to HTTTP servname only. */ 776 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 777 ATF_REQUIRE(limit != NULL); 778 cap_net_limit_name2addr(limit, NULL, "http"); 779 ATF_REQUIRE(cap_net_limit(limit) == 0); 780 781 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 782 0); 783 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 784 ENOTCAPABLE); 785 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 786 0); 787 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 788 ENOTCAPABLE); 789 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 790 ENOTCAPABLE); 791 792 /* Unable to set empty limits. Empty limits means full access. */ 793 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 794 ATF_REQUIRE(cap_net_limit(limit) != 0); 795 796 cap_close(capnet); 797 } 798 799 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_family); 800 ATF_TC_BODY(capnet__limits_name2addr_family, tc) 801 { 802 cap_channel_t *capnet; 803 cap_net_limit_t *limit; 804 int family[] = { AF_INET6, AF_INET }; 805 806 capnet = create_network_service(); 807 808 /* Limit to AF_INET and AF_INET6. */ 809 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 810 ATF_REQUIRE(limit != NULL); 811 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 812 cap_net_limit_name2addr_family(limit, family, nitems(family)); 813 ATF_REQUIRE(cap_net_limit(limit) == 0); 814 815 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 816 0); 817 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 818 0); 819 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 820 ENOTCAPABLE); 821 822 /* Limit to AF_INET and AF_INET6. */ 823 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 824 ATF_REQUIRE(limit != NULL); 825 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 826 cap_net_limit_name2addr_family(limit, &family[0], 1); 827 cap_net_limit_name2addr_family(limit, &family[1], 1); 828 ATF_REQUIRE(cap_net_limit(limit) == 0); 829 830 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 831 0); 832 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 833 0); 834 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 835 ENOTCAPABLE); 836 837 /* Limit to AF_INET6 only. */ 838 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 839 ATF_REQUIRE(limit != NULL); 840 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 841 cap_net_limit_name2addr_family(limit, family, 1); 842 ATF_REQUIRE(cap_net_limit(limit) == 0); 843 844 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 845 ENOTCAPABLE); 846 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 847 0); 848 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 849 ENOTCAPABLE); 850 851 /* Unable to set empty limits. Empty limits means full access. */ 852 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 853 ATF_REQUIRE(cap_net_limit(limit) != 0); 854 855 cap_close(capnet); 856 } 857 858 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_mode); 859 ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode, tc) 860 { 861 cap_channel_t *capnet; 862 cap_net_limit_t *limit; 863 864 capnet = create_network_service(); 865 866 /* LIMIT */ 867 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 868 ATF_REQUIRE(limit != NULL); 869 ATF_REQUIRE(cap_net_limit(limit) == 0); 870 871 /* ALLOWED */ 872 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 873 874 /* DISALLOWED */ 875 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 876 ENOTCAPABLE); 877 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 878 ENOTCAPABLE); 879 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 880 ENOTCAPABLE); 881 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 882 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 883 884 test_extend_mode(capnet, CAPNET_ADDR2NAME); 885 886 cap_close(capnet); 887 } 888 889 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_hosts); 890 ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts, tc) 891 { 892 cap_channel_t *capnet; 893 cap_net_limit_t *limit; 894 895 capnet = create_network_service(); 896 897 /* Limit to TEST_DOMAIN_0 and localhost only. */ 898 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 899 ATF_REQUIRE(limit != NULL); 900 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 901 cap_net_limit_name2addr(limit, "localhost", NULL); 902 ATF_REQUIRE(cap_net_limit(limit) == 0); 903 904 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 905 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, "localhost") == 0); 906 ATF_REQUIRE( 907 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 908 909 /* Limit to TEST_DOMAIN_0 only. */ 910 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 911 ATF_REQUIRE(limit != NULL); 912 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 913 ATF_REQUIRE(cap_net_limit(limit) == 0); 914 915 ATF_REQUIRE( 916 test_gethostbyname(capnet, AF_INET, "localhost") == ENOTCAPABLE); 917 ATF_REQUIRE( 918 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 919 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 920 921 /* Unable to set empty limits. Empty limits means full access. */ 922 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 923 ATF_REQUIRE(cap_net_limit(limit) != 0); 924 925 cap_close(capnet); 926 } 927 928 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_family); 929 ATF_TC_BODY(capnet__limits_deprecated_name2addr_family, tc) 930 { 931 cap_channel_t *capnet; 932 cap_net_limit_t *limit; 933 int family[] = { AF_INET6, AF_INET }; 934 935 capnet = create_network_service(); 936 937 /* Limit to AF_INET and AF_INET6. */ 938 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 939 ATF_REQUIRE(limit != NULL); 940 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 941 cap_net_limit_name2addr_family(limit, family, nitems(family)); 942 ATF_REQUIRE(cap_net_limit(limit) == 0); 943 944 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 945 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 946 ATF_REQUIRE( 947 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 948 949 /* Limit to AF_INET and AF_INET6. */ 950 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 951 ATF_REQUIRE(limit != NULL); 952 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 953 cap_net_limit_name2addr_family(limit, &family[0], 1); 954 cap_net_limit_name2addr_family(limit, &family[1], 1); 955 ATF_REQUIRE(cap_net_limit(limit) == 0); 956 957 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 958 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 959 ATF_REQUIRE( 960 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 961 962 /* Limit to AF_INET6 only. */ 963 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 964 ATF_REQUIRE(limit != NULL); 965 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 966 cap_net_limit_name2addr_family(limit, family, 1); 967 ATF_REQUIRE(cap_net_limit(limit) == 0); 968 969 ATF_REQUIRE( 970 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 971 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 972 ATF_REQUIRE( 973 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 974 975 /* Unable to set empty limits. Empty limits means full access. */ 976 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 977 ATF_REQUIRE(cap_net_limit(limit) != 0); 978 979 cap_close(capnet); 980 } 981 982 ATF_TC_WITHOUT_HEAD(capnet__limits_bind_mode); 983 ATF_TC_BODY(capnet__limits_bind_mode, tc) 984 { 985 cap_channel_t *capnet; 986 cap_net_limit_t *limit; 987 988 capnet = create_network_service(); 989 990 /* LIMIT */ 991 limit = cap_net_limit_init(capnet, CAPNET_BIND); 992 ATF_REQUIRE(limit != NULL); 993 ATF_REQUIRE(cap_net_limit(limit) == 0); 994 995 /* ALLOWED */ 996 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 997 998 /* DISALLOWED */ 999 ATF_REQUIRE( 1000 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1001 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1002 ENOTCAPABLE); 1003 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1004 ENOTCAPABLE); 1005 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1006 ENOTCAPABLE); 1007 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 1008 1009 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1010 1011 cap_close(capnet); 1012 } 1013 1014 ATF_TC_WITHOUT_HEAD(capnet__limits_bind); 1015 ATF_TC_BODY(capnet__limits_bind, tc) 1016 { 1017 cap_channel_t *capnet; 1018 cap_net_limit_t *limit; 1019 struct sockaddr_in ipv4; 1020 1021 capnet = create_network_service(); 1022 1023 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1024 ATF_REQUIRE(limit != NULL); 1025 1026 memset(&ipv4, 0, sizeof(ipv4)); 1027 ipv4.sin_family = AF_INET; 1028 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr); 1029 1030 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1031 ATF_REQUIRE(cap_net_limit(limit) == 0); 1032 1033 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1034 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE); 1035 1036 cap_close(capnet); 1037 } 1038 1039 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_mode); 1040 ATF_TC_BODY(capnet__limits_connect_mode, tc) 1041 { 1042 cap_channel_t *capnet; 1043 cap_net_limit_t *limit; 1044 1045 capnet = create_network_service(); 1046 1047 /* LIMIT */ 1048 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1049 ATF_REQUIRE(limit != NULL); 1050 ATF_REQUIRE(cap_net_limit(limit) == 0); 1051 1052 /* ALLOWED */ 1053 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1054 1055 /* DISALLOWED */ 1056 ATF_REQUIRE( 1057 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1058 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1059 ENOTCAPABLE); 1060 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1061 ENOTCAPABLE); 1062 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1063 ENOTCAPABLE); 1064 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1065 1066 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1067 1068 cap_close(capnet); 1069 } 1070 1071 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_dns_mode); 1072 ATF_TC_BODY(capnet__limits_connect_dns_mode, tc) 1073 { 1074 cap_channel_t *capnet; 1075 cap_net_limit_t *limit; 1076 1077 capnet = create_network_service(); 1078 1079 /* LIMIT */ 1080 limit = cap_net_limit_init(capnet, CAPNET_CONNECT | CAPNET_CONNECTDNS); 1081 ATF_REQUIRE(limit != NULL); 1082 ATF_REQUIRE(cap_net_limit(limit) == 0); 1083 1084 /* ALLOWED */ 1085 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1086 1087 /* DISALLOWED */ 1088 ATF_REQUIRE( 1089 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1090 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1091 ENOTCAPABLE); 1092 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1093 ENOTCAPABLE); 1094 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1095 ENOTCAPABLE); 1096 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1097 1098 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1099 1100 cap_close(capnet); 1101 } 1102 1103 ATF_TC_WITHOUT_HEAD(capnet__limits_connect); 1104 ATF_TC_BODY(capnet__limits_connect, tc) 1105 { 1106 cap_channel_t *capnet; 1107 cap_net_limit_t *limit; 1108 struct sockaddr_in ipv4; 1109 1110 capnet = create_network_service(); 1111 1112 /* Limit only to TEST_IPV4 on port 80 and 443. */ 1113 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1114 ATF_REQUIRE(limit != NULL); 1115 memset(&ipv4, 0, sizeof(ipv4)); 1116 ipv4.sin_family = AF_INET; 1117 ipv4.sin_port = htons(80); 1118 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr); 1119 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1120 1121 ipv4.sin_port = htons(443); 1122 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1123 ATF_REQUIRE(cap_net_limit(limit) == 0); 1124 1125 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1126 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1127 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1128 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1129 1130 /* Limit only to TEST_IPV4 on port 443. */ 1131 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1132 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1133 ATF_REQUIRE(cap_net_limit(limit) == 0); 1134 1135 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 433) == ENOTCAPABLE); 1136 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1137 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1138 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1139 1140 /* Unable to set empty limits. Empty limits means full access. */ 1141 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1142 ATF_REQUIRE(cap_net_limit(limit) != 0); 1143 1144 cap_close(capnet); 1145 } 1146 1147 ATF_TC_WITHOUT_HEAD(capnet__limits_connecttodns); 1148 ATF_TC_BODY(capnet__limits_connecttodns, tc) 1149 { 1150 cap_channel_t *capnet; 1151 cap_net_limit_t *limit; 1152 struct addrinfo hints, *capres, *res; 1153 int family[] = { AF_INET }; 1154 1155 capnet = create_network_service(); 1156 1157 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1158 CAPNET_NAME2ADDR); 1159 ATF_REQUIRE(limit != NULL); 1160 cap_net_limit_name2addr(limit, TEST_IPV4, "80"); 1161 cap_net_limit_name2addr_family(limit, family, 1); 1162 ATF_REQUIRE(cap_net_limit(limit) == 0); 1163 1164 memset(&hints, 0, sizeof(hints)); 1165 hints.ai_family = AF_INET; 1166 hints.ai_socktype = SOCK_STREAM; 1167 1168 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1169 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 1170 0); 1171 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1172 1173 for (res = capres; res != NULL; res = res->ai_next) { 1174 int s; 1175 1176 ATF_REQUIRE(res->ai_family == AF_INET); 1177 ATF_REQUIRE(res->ai_socktype == SOCK_STREAM); 1178 1179 s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); 1180 ATF_REQUIRE(s >= 0); 1181 1182 ATF_REQUIRE(cap_connect(capnet, s, res->ai_addr, 1183 res->ai_addrlen) == 0); 1184 close(s); 1185 } 1186 1187 freeaddrinfo(capres); 1188 cap_close(capnet); 1189 } 1190 1191 1192 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_connecttodns); 1193 ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc) 1194 { 1195 cap_channel_t *capnet; 1196 cap_net_limit_t *limit; 1197 struct hostent *caphp; 1198 struct in_addr ipaddr; 1199 struct sockaddr_in connaddr; 1200 int family[] = { AF_INET }; 1201 int i; 1202 1203 capnet = create_network_service(); 1204 1205 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1206 CAPNET_DEPRECATED_NAME2ADDR); 1207 ATF_REQUIRE(limit != NULL); 1208 cap_net_limit_name2addr(limit, TEST_IPV4, NULL); 1209 cap_net_limit_name2addr_family(limit, family, 1); 1210 ATF_REQUIRE(cap_net_limit(limit) == 0); 1211 1212 memset(&ipaddr, 0, sizeof(ipaddr)); 1213 inet_pton(AF_INET, TEST_IPV4, &ipaddr); 1214 1215 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1216 caphp = cap_gethostbyname2(capnet, TEST_IPV4, AF_INET); 1217 ATF_REQUIRE(caphp != NULL); 1218 ATF_REQUIRE(caphp->h_addrtype == AF_INET); 1219 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1220 1221 for (i = 0; caphp->h_addr_list[i] != NULL; i++) { 1222 int s; 1223 1224 s = socket(AF_INET, SOCK_STREAM, 0); 1225 ATF_REQUIRE(s >= 0); 1226 1227 memset(&connaddr, 0, sizeof(connaddr)); 1228 connaddr.sin_family = AF_INET; 1229 memcpy((char *)&connaddr.sin_addr.s_addr, 1230 (char *)caphp->h_addr_list[i], caphp->h_length); 1231 connaddr.sin_port = htons(80); 1232 1233 ATF_REQUIRE(cap_connect(capnet, s, (struct sockaddr *)&connaddr, 1234 sizeof(connaddr)) == 0); 1235 close(s); 1236 } 1237 1238 cap_close(capnet); 1239 } 1240 1241 ATF_TP_ADD_TCS(tp) 1242 { 1243 1244 ATF_TP_ADD_TC(tp, capnet__connect); 1245 ATF_TP_ADD_TC(tp, capnet__bind); 1246 ATF_TP_ADD_TC(tp, capnet__getnameinfo); 1247 ATF_TP_ADD_TC(tp, capnet__getaddrinfo); 1248 ATF_TP_ADD_TC(tp, capnet__gethostbyname); 1249 ATF_TP_ADD_TC(tp, capnet__gethostbyaddr); 1250 1251 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode); 1252 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family); 1253 ATF_TP_ADD_TC(tp, capnet__limits_addr2name); 1254 1255 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_mode); 1256 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_family); 1257 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name); 1258 1259 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_mode); 1260 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts); 1261 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_strict); 1262 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_mix); 1263 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_family); 1264 1265 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_mode); 1266 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_hosts); 1267 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_family); 1268 1269 ATF_TP_ADD_TC(tp, capnet__limits_bind_mode); 1270 ATF_TP_ADD_TC(tp, capnet__limits_bind); 1271 1272 ATF_TP_ADD_TC(tp, capnet__limits_connect_mode); 1273 ATF_TP_ADD_TC(tp, capnet__limits_connect_dns_mode); 1274 ATF_TP_ADD_TC(tp, capnet__limits_connect); 1275 1276 ATF_TP_ADD_TC(tp, capnet__limits_connecttodns); 1277 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_connecttodns); 1278 1279 return (atf_no_error()); 1280 } 1281