1 /*-
2 * Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org>
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
14 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
15 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
23 * POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include <sys/param.h>
27 #include <sys/nv.h>
28 #include <sys/socket.h>
29 #include <netinet/in.h>
30 #include <arpa/inet.h>
31
32 #include <errno.h>
33 #include <netdb.h>
34
35 #include <atf-c.h>
36
37 #include <libcasper.h>
38 #include <casper/cap_net.h>
39
40 #define TEST_DOMAIN_0 "example.com"
41 #define TEST_DOMAIN_1 "freebsd.org"
42 #define TEST_IPV4 "1.1.1.1"
43 #define TEST_IPV6 "2001:4860:4860::8888"
44 #define TEST_BIND_IPV4 "127.0.0.1"
45 #define TEST_PORT 80
46 #define TEST_PORT_STR "80"
47
48 static cap_channel_t *
create_network_service(void)49 create_network_service(void)
50 {
51 cap_channel_t *capcas, *capnet;
52
53 capcas = cap_init();
54 ATF_REQUIRE(capcas != NULL);
55
56 capnet = cap_service_open(capcas, "system.net");
57 ATF_REQUIRE(capnet != NULL);
58
59 cap_close(capcas);
60 return (capnet);
61 }
62
63 static int
test_getnameinfo_v4(cap_channel_t * chan,int family,const char * ip)64 test_getnameinfo_v4(cap_channel_t *chan, int family, const char *ip)
65 {
66 struct sockaddr_in ipaddr;
67 char capfn[MAXHOSTNAMELEN];
68 char origfn[MAXHOSTNAMELEN];
69 int capret, sysret;
70
71 memset(&ipaddr, 0, sizeof(ipaddr));
72 ipaddr.sin_family = family;
73 inet_pton(family, ip, &ipaddr.sin_addr);
74
75 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr),
76 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD);
77 if (capret == EAI_SYSTEM && errno == ENOTCAPABLE)
78 return (ENOTCAPABLE);
79
80 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn,
81 sizeof(origfn), NULL, 0, NI_NAMEREQD);
82 if (sysret != 0) {
83 atf_tc_skip("getnameinfo(%s) failed: %s",
84 ip, gai_strerror(sysret));
85 }
86 ATF_REQUIRE(capret == 0);
87 ATF_REQUIRE(strcmp(origfn, capfn) == 0);
88
89 return (0);
90 }
91
92 static int
test_getnameinfo_v6(cap_channel_t * chan,const char * ip)93 test_getnameinfo_v6(cap_channel_t *chan, const char *ip)
94 {
95 struct sockaddr_in6 ipaddr;
96 char capfn[MAXHOSTNAMELEN];
97 char origfn[MAXHOSTNAMELEN];
98 int capret, sysret;
99
100 memset(&ipaddr, 0, sizeof(ipaddr));
101 ipaddr.sin6_family = AF_INET6;
102 inet_pton(AF_INET6, ip, &ipaddr.sin6_addr);
103
104 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr),
105 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD);
106 if (capret == EAI_SYSTEM && errno == ENOTCAPABLE)
107 return (ENOTCAPABLE);
108
109 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn,
110 sizeof(origfn), NULL, 0, NI_NAMEREQD);
111 if (sysret != 0) {
112 atf_tc_skip("getnameinfo(%s) failed: %s",
113 ip, gai_strerror(sysret));
114 }
115 ATF_REQUIRE(capret == 0);
116 ATF_REQUIRE(strcmp(origfn, capfn) == 0);
117
118 return (0);
119 }
120
121 static int
test_getnameinfo(cap_channel_t * chan,int family,const char * ip)122 test_getnameinfo(cap_channel_t *chan, int family, const char *ip)
123 {
124
125 if (family == AF_INET6) {
126 return (test_getnameinfo_v6(chan, ip));
127 }
128
129 return (test_getnameinfo_v4(chan, family, ip));
130 }
131
132 static int
test_gethostbyaddr_v4(cap_channel_t * chan,int family,const char * ip)133 test_gethostbyaddr_v4(cap_channel_t *chan, int family, const char *ip)
134 {
135 struct in_addr ipaddr;
136 struct hostent *caphp, *orighp;
137
138 memset(&ipaddr, 0, sizeof(ipaddr));
139 inet_pton(AF_INET, ip, &ipaddr);
140
141 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), family);
142 if (caphp == NULL && h_errno == ENOTCAPABLE)
143 return (ENOTCAPABLE);
144
145 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), family);
146 if (orighp == NULL)
147 atf_tc_skip("gethostbyaddr(%s) failed", ip);
148 ATF_REQUIRE(caphp != NULL);
149 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0);
150
151 return (0);
152 }
153
154 static int
test_gethostbyaddr_v6(cap_channel_t * chan,const char * ip)155 test_gethostbyaddr_v6(cap_channel_t *chan, const char *ip)
156 {
157 struct in6_addr ipaddr;
158 struct hostent *caphp, *orighp;
159
160 memset(&ipaddr, 0, sizeof(ipaddr));
161 inet_pton(AF_INET6, ip, &ipaddr);
162
163 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), AF_INET6);
164 if (caphp == NULL && h_errno == ENOTCAPABLE)
165 return (ENOTCAPABLE);
166
167 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), AF_INET6);
168 if (orighp == NULL)
169 atf_tc_skip("gethostbyaddr(%s) failed", ip);
170 ATF_REQUIRE(caphp != NULL);
171 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0);
172
173 return (0);
174 }
175
176 static int
test_gethostbyaddr(cap_channel_t * chan,int family,const char * ip)177 test_gethostbyaddr(cap_channel_t *chan, int family, const char *ip)
178 {
179
180 if (family == AF_INET6) {
181 return (test_gethostbyaddr_v6(chan, ip));
182 } else {
183 return (test_gethostbyaddr_v4(chan, family, ip));
184 }
185 }
186
187 static int
test_getaddrinfo(cap_channel_t * chan,int family,const char * domain,const char * servname)188 test_getaddrinfo(cap_channel_t *chan, int family, const char *domain,
189 const char *servname)
190 {
191 struct addrinfo hints, *capres, *origres, *res0, *res1;
192 bool found;
193 int capret, sysret;
194
195 memset(&hints, 0, sizeof(hints));
196 hints.ai_family = family;
197 hints.ai_socktype = SOCK_STREAM;
198
199 capret = cap_getaddrinfo(chan, domain, servname, &hints, &capres);
200 if (capret == EAI_SYSTEM && errno == ENOTCAPABLE)
201 return (ENOTCAPABLE);
202
203 sysret = getaddrinfo(domain, servname, &hints, &origres);
204 if (sysret != 0)
205 atf_tc_skip("getaddrinfo(%s) failed: %s",
206 domain, gai_strerror(sysret));
207 ATF_REQUIRE(capret == 0);
208
209 for (res0 = capres; res0 != NULL; res0 = res0->ai_next) {
210 found = false;
211 for (res1 = origres; res1 != NULL; res1 = res1->ai_next) {
212 if (res1->ai_addrlen == res0->ai_addrlen &&
213 memcmp(res1->ai_addr, res0->ai_addr,
214 res0->ai_addrlen) == 0) {
215 found = true;
216 break;
217 }
218 }
219 ATF_REQUIRE(found);
220 }
221
222 freeaddrinfo(capres);
223 freeaddrinfo(origres);
224 return (0);
225 }
226
227 static int
test_gethostbyname(cap_channel_t * chan,int family,const char * domain)228 test_gethostbyname(cap_channel_t *chan, int family, const char *domain)
229 {
230 struct hostent *caphp, *orighp;
231
232 caphp = cap_gethostbyname2(chan, domain, family);
233 if (caphp == NULL && h_errno == ENOTCAPABLE)
234 return (h_errno);
235
236 orighp = gethostbyname2(domain, family);
237 if (orighp == NULL)
238 atf_tc_skip("gethostbyname2(%s) failed", domain);
239
240 ATF_REQUIRE(caphp != NULL);
241 ATF_REQUIRE(strcmp(caphp->h_name, orighp->h_name) == 0);
242 return (0);
243 }
244
245 static int
test_bind(cap_channel_t * chan,const char * ip)246 test_bind(cap_channel_t *chan, const char *ip)
247 {
248 struct sockaddr_in ipv4;
249 int capfd, ret, serrno;
250
251 capfd = socket(AF_INET, SOCK_STREAM, 0);
252 ATF_REQUIRE(capfd > 0);
253
254 memset(&ipv4, 0, sizeof(ipv4));
255 ipv4.sin_family = AF_INET;
256 inet_pton(AF_INET, ip, &ipv4.sin_addr);
257
258 ret = cap_bind(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4));
259 serrno = errno;
260 close(capfd);
261
262 return (ret < 0 ? serrno : 0);
263 }
264
265 static int
test_connect(cap_channel_t * chan,const char * ip,unsigned short port)266 test_connect(cap_channel_t *chan, const char *ip, unsigned short port)
267 {
268 struct sockaddr_in ipv4;
269 int capfd, ret, serrno;
270
271 capfd = socket(AF_INET, SOCK_STREAM, 0);
272 ATF_REQUIRE(capfd >= 0);
273
274 memset(&ipv4, 0, sizeof(ipv4));
275 ipv4.sin_family = AF_INET;
276 ipv4.sin_port = htons(port);
277 inet_pton(AF_INET, ip, &ipv4.sin_addr);
278
279 ret = cap_connect(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4));
280 serrno = errno;
281 ATF_REQUIRE(close(capfd) == 0);
282
283 if (ret < 0 && serrno != ENOTCAPABLE) {
284 int sd;
285
286 /*
287 * If the connection failed, it might be because we can't reach
288 * the destination host. To check, try a plain connect() and
289 * see if it fails with the same error.
290 */
291 sd = socket(AF_INET, SOCK_STREAM, 0);
292 ATF_REQUIRE(sd >= 0);
293
294 memset(&ipv4, 0, sizeof(ipv4));
295 ipv4.sin_family = AF_INET;
296 ipv4.sin_port = htons(port);
297 inet_pton(AF_INET, ip, &ipv4.sin_addr);
298 ret = connect(sd, (struct sockaddr *)&ipv4, sizeof(ipv4));
299 ATF_REQUIRE(ret < 0);
300 ATF_REQUIRE_MSG(errno == serrno, "errno %d != serrno %d",
301 errno, serrno);
302 ATF_REQUIRE(close(sd) == 0);
303 atf_tc_skip("connect(%s:%d) failed: %s",
304 ip, port, strerror(serrno));
305 }
306
307 return (ret < 0 ? serrno : 0);
308 }
309
310 static void
test_extend_mode(cap_channel_t * capnet,int current)311 test_extend_mode(cap_channel_t *capnet, int current)
312 {
313 cap_net_limit_t *limit;
314 const int rights[] = {
315 CAPNET_ADDR2NAME,
316 CAPNET_NAME2ADDR,
317 CAPNET_DEPRECATED_ADDR2NAME,
318 CAPNET_DEPRECATED_NAME2ADDR,
319 CAPNET_CONNECT,
320 CAPNET_BIND,
321 CAPNET_CONNECTDNS
322 };
323 size_t i;
324
325 for (i = 0; i < nitems(rights); i++) {
326 if (current == rights[i])
327 continue;
328
329 limit = cap_net_limit_init(capnet, current | rights[i]);
330 ATF_REQUIRE(limit != NULL);
331 ATF_REQUIRE(cap_net_limit(limit) != 0);
332 }
333 }
334
335 ATF_TC(capnet__getnameinfo);
ATF_TC_HEAD(capnet__getnameinfo,tc)336 ATF_TC_HEAD(capnet__getnameinfo, tc)
337 {
338 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
339 }
ATF_TC_BODY(capnet__getnameinfo,tc)340 ATF_TC_BODY(capnet__getnameinfo, tc)
341 {
342 cap_channel_t *capnet;
343
344 capnet = create_network_service();
345
346 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
347 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
348
349 cap_close(capnet);
350 }
351
352 ATF_TC(capnet__connect);
ATF_TC_HEAD(capnet__connect,tc)353 ATF_TC_HEAD(capnet__connect, tc)
354 {
355 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
356 }
ATF_TC_BODY(capnet__connect,tc)357 ATF_TC_BODY(capnet__connect, tc)
358 {
359 cap_channel_t *capnet;
360
361 capnet = create_network_service();
362
363 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
364
365 cap_close(capnet);
366 }
367
368 ATF_TC(capnet__bind);
ATF_TC_HEAD(capnet__bind,tc)369 ATF_TC_HEAD(capnet__bind, tc)
370 {
371 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
372 }
ATF_TC_BODY(capnet__bind,tc)373 ATF_TC_BODY(capnet__bind, tc)
374 {
375 cap_channel_t *capnet;
376
377 capnet = create_network_service();
378
379 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
380
381 cap_close(capnet);
382 }
383
384 ATF_TC(capnet__getaddrinfo);
ATF_TC_HEAD(capnet__getaddrinfo,tc)385 ATF_TC_HEAD(capnet__getaddrinfo, tc)
386 {
387 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
388 }
ATF_TC_BODY(capnet__getaddrinfo,tc)389 ATF_TC_BODY(capnet__getaddrinfo, tc)
390 {
391 cap_channel_t *capnet;
392 struct addrinfo hints, *capres;
393
394 capnet = create_network_service();
395
396 memset(&hints, 0, sizeof(hints));
397 hints.ai_family = AF_INET;
398 hints.ai_socktype = SOCK_STREAM;
399
400 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) ==
401 0);
402
403 cap_close(capnet);
404 }
405
406 ATF_TC(capnet__gethostbyname);
ATF_TC_HEAD(capnet__gethostbyname,tc)407 ATF_TC_HEAD(capnet__gethostbyname, tc)
408 {
409 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
410 }
ATF_TC_BODY(capnet__gethostbyname,tc)411 ATF_TC_BODY(capnet__gethostbyname, tc)
412 {
413 cap_channel_t *capnet;
414
415 capnet = create_network_service();
416
417 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
418
419 cap_close(capnet);
420 }
421
422 ATF_TC(capnet__gethostbyaddr);
ATF_TC_HEAD(capnet__gethostbyaddr,tc)423 ATF_TC_HEAD(capnet__gethostbyaddr, tc)
424 {
425 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
426 }
ATF_TC_BODY(capnet__gethostbyaddr,tc)427 ATF_TC_BODY(capnet__gethostbyaddr, tc)
428 {
429 cap_channel_t *capnet;
430
431 capnet = create_network_service();
432
433 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
434 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
435
436 cap_close(capnet);
437 }
438
439 ATF_TC(capnet__getnameinfo_buffer);
ATF_TC_HEAD(capnet__getnameinfo_buffer,tc)440 ATF_TC_HEAD(capnet__getnameinfo_buffer, tc)
441 {
442 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
443 }
ATF_TC_BODY(capnet__getnameinfo_buffer,tc)444 ATF_TC_BODY(capnet__getnameinfo_buffer, tc)
445 {
446 cap_channel_t *chan;
447 struct sockaddr_in sin;
448 int ret;
449 struct {
450 char host[sizeof(TEST_IPV4)];
451 char host_canary;
452 char serv[sizeof(TEST_PORT_STR)];
453 char serv_canary;
454 } buffers;
455
456 memset(&sin, 0, sizeof(sin));
457 sin.sin_family = AF_INET;
458 sin.sin_port = htons(TEST_PORT);
459 ret = inet_pton(AF_INET, TEST_IPV4, &sin.sin_addr);
460 ATF_REQUIRE_EQ(1, ret);
461
462 memset(&buffers, '!', sizeof(buffers));
463
464 chan = create_network_service();
465 ret = cap_getnameinfo(chan, (struct sockaddr *)&sin, sizeof(sin),
466 buffers.host, sizeof(buffers.host),
467 buffers.serv, sizeof(buffers.serv),
468 NI_NUMERICHOST | NI_NUMERICSERV);
469 ATF_REQUIRE_EQ_MSG(0, ret, "%d", ret);
470
471 // Verify that cap_getnameinfo worked with minimally sized buffers.
472 ATF_CHECK_EQ(0, strcmp(TEST_IPV4, buffers.host));
473 ATF_CHECK_EQ(0, strcmp(TEST_PORT_STR, buffers.serv));
474
475 // Verify that cap_getnameinfo did not overflow the buffers.
476 ATF_CHECK_EQ('!', buffers.host_canary);
477 ATF_CHECK_EQ('!', buffers.serv_canary);
478
479 cap_close(chan);
480 }
481
482 ATF_TC(capnet__limits_addr2name_mode);
ATF_TC_HEAD(capnet__limits_addr2name_mode,tc)483 ATF_TC_HEAD(capnet__limits_addr2name_mode, tc)
484 {
485 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
486 }
ATF_TC_BODY(capnet__limits_addr2name_mode,tc)487 ATF_TC_BODY(capnet__limits_addr2name_mode, tc)
488 {
489 cap_channel_t *capnet;
490 cap_net_limit_t *limit;
491
492 capnet = create_network_service();
493
494 /* LIMIT */
495 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
496 ATF_REQUIRE(limit != NULL);
497 ATF_REQUIRE(cap_net_limit(limit) == 0);
498
499 /* ALLOWED */
500 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
501
502 /* DISALLOWED */
503 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) ==
504 ENOTCAPABLE);
505 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
506 ENOTCAPABLE);
507 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
508 ENOTCAPABLE);
509 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
510 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
511
512 test_extend_mode(capnet, CAPNET_ADDR2NAME);
513
514 cap_close(capnet);
515 }
516
517 ATF_TC(capnet__limits_addr2name_family);
ATF_TC_HEAD(capnet__limits_addr2name_family,tc)518 ATF_TC_HEAD(capnet__limits_addr2name_family, tc)
519 {
520 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
521 }
ATF_TC_BODY(capnet__limits_addr2name_family,tc)522 ATF_TC_BODY(capnet__limits_addr2name_family, tc)
523 {
524 cap_channel_t *capnet;
525 cap_net_limit_t *limit;
526 int family[] = { AF_INET6, AF_INET };
527
528 capnet = create_network_service();
529
530 /* Limit to AF_INET6 and AF_INET. */
531 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
532 ATF_REQUIRE(limit != NULL);
533 cap_net_limit_addr2name_family(limit, family, nitems(family));
534 ATF_REQUIRE(cap_net_limit(limit) == 0);
535
536 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
537 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
538
539 /* Limit to AF_INET6 and AF_INET. */
540 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
541 ATF_REQUIRE(limit != NULL);
542 cap_net_limit_addr2name_family(limit, &family[0], 1);
543 cap_net_limit_addr2name_family(limit, &family[1], 1);
544 ATF_REQUIRE(cap_net_limit(limit) == 0);
545
546 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
547 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
548
549 /* Limit to AF_INET6. */
550 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
551 ATF_REQUIRE(limit != NULL);
552 cap_net_limit_addr2name_family(limit, family, 1);
553 ATF_REQUIRE(cap_net_limit(limit) == 0);
554
555 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
556 ENOTCAPABLE);
557 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
558
559 /* Unable to set empty limits. Empty limits means full access. */
560 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
561 ATF_REQUIRE(cap_net_limit(limit) != 0);
562
563 cap_close(capnet);
564 }
565
566 ATF_TC(capnet__limits_addr2name);
ATF_TC_HEAD(capnet__limits_addr2name,tc)567 ATF_TC_HEAD(capnet__limits_addr2name, tc)
568 {
569 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
570 }
ATF_TC_BODY(capnet__limits_addr2name,tc)571 ATF_TC_BODY(capnet__limits_addr2name, tc)
572 {
573 cap_channel_t *capnet;
574 cap_net_limit_t *limit;
575 struct sockaddr_in ipaddrv4;
576 struct sockaddr_in6 ipaddrv6;
577
578 capnet = create_network_service();
579
580 /* Limit to TEST_IPV4 and TEST_IPV6. */
581 memset(&ipaddrv4, 0, sizeof(ipaddrv4));
582 memset(&ipaddrv6, 0, sizeof(ipaddrv6));
583
584 ipaddrv4.sin_family = AF_INET;
585 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr);
586
587 ipaddrv6.sin6_family = AF_INET6;
588 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr);
589
590 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
591 ATF_REQUIRE(limit != NULL);
592
593 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
594 sizeof(ipaddrv4));
595 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6,
596 sizeof(ipaddrv6));
597 ATF_REQUIRE(cap_net_limit(limit) == 0);
598
599 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
600 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
601 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") ==
602 ENOTCAPABLE);
603
604 /* Limit to AF_INET. */
605 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
606 ATF_REQUIRE(limit != NULL);
607 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
608 sizeof(ipaddrv4));
609 ATF_REQUIRE(cap_net_limit(limit) == 0);
610
611 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
612 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) ==
613 ENOTCAPABLE);
614 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") ==
615 ENOTCAPABLE);
616
617 /* Unable to set empty limits. Empty limits means full access. */
618 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
619 ATF_REQUIRE(cap_net_limit(limit) != 0);
620
621 cap_close(capnet);
622 }
623
624 ATF_TC(capnet__limits_deprecated_addr2name_mode);
ATF_TC_HEAD(capnet__limits_deprecated_addr2name_mode,tc)625 ATF_TC_HEAD(capnet__limits_deprecated_addr2name_mode, tc)
626 {
627 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
628 }
ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode,tc)629 ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode, tc)
630 {
631 cap_channel_t *capnet;
632 cap_net_limit_t *limit;
633
634 capnet = create_network_service();
635
636 /* LIMIT */
637 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
638 ATF_REQUIRE(limit != NULL);
639 ATF_REQUIRE(cap_net_limit(limit) == 0);
640
641 /* ALLOWED */
642 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
643
644 /* DISALLOWED */
645 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) ==
646 ENOTCAPABLE);
647 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
648 ENOTCAPABLE);
649 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
650 ENOTCAPABLE);
651 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
652 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
653
654 cap_close(capnet);
655 }
656
657 ATF_TC(capnet__limits_deprecated_addr2name_family);
ATF_TC_HEAD(capnet__limits_deprecated_addr2name_family,tc)658 ATF_TC_HEAD(capnet__limits_deprecated_addr2name_family, tc)
659 {
660 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
661 }
ATF_TC_BODY(capnet__limits_deprecated_addr2name_family,tc)662 ATF_TC_BODY(capnet__limits_deprecated_addr2name_family, tc)
663 {
664 cap_channel_t *capnet;
665 cap_net_limit_t *limit;
666 int family[] = { AF_INET6, AF_INET };
667
668 capnet = create_network_service();
669
670 /* Limit to AF_INET6 and AF_INET. */
671 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
672 ATF_REQUIRE(limit != NULL);
673 cap_net_limit_addr2name_family(limit, family, nitems(family));
674 ATF_REQUIRE(cap_net_limit(limit) == 0);
675
676 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
677 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
678 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) ==
679 ENOTCAPABLE);
680
681 /* Limit to AF_INET6 and AF_INET. */
682 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
683 ATF_REQUIRE(limit != NULL);
684 cap_net_limit_addr2name_family(limit, &family[0], 1);
685 cap_net_limit_addr2name_family(limit, &family[1], 1);
686 ATF_REQUIRE(cap_net_limit(limit) == 0);
687
688 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
689 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
690 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) ==
691 ENOTCAPABLE);
692
693 /* Limit to AF_INET6. */
694 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
695 ATF_REQUIRE(limit != NULL);
696 cap_net_limit_addr2name_family(limit, family, 1);
697 ATF_REQUIRE(cap_net_limit(limit) == 0);
698
699 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
700 ENOTCAPABLE);
701 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
702 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) ==
703 ENOTCAPABLE);
704
705 /* Unable to set empty limits. Empty limits means full access. */
706 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
707 ATF_REQUIRE(cap_net_limit(limit) != 0);
708
709 cap_close(capnet);
710 }
711
712 ATF_TC(capnet__limits_deprecated_addr2name);
ATF_TC_HEAD(capnet__limits_deprecated_addr2name,tc)713 ATF_TC_HEAD(capnet__limits_deprecated_addr2name, tc)
714 {
715 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
716 }
ATF_TC_BODY(capnet__limits_deprecated_addr2name,tc)717 ATF_TC_BODY(capnet__limits_deprecated_addr2name, tc)
718 {
719 cap_channel_t *capnet;
720 cap_net_limit_t *limit;
721 struct in_addr ipaddrv4;
722 struct in6_addr ipaddrv6;
723
724 capnet = create_network_service();
725
726 /* Limit to TEST_IPV4 and TEST_IPV6. */
727 memset(&ipaddrv4, 0, sizeof(ipaddrv4));
728 memset(&ipaddrv6, 0, sizeof(ipaddrv6));
729
730 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4);
731 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6);
732
733 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
734 ATF_REQUIRE(limit != NULL);
735
736 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
737 sizeof(ipaddrv4));
738 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6,
739 sizeof(ipaddrv6));
740 ATF_REQUIRE(cap_net_limit(limit) == 0);
741
742 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
743 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
744 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") ==
745 ENOTCAPABLE);
746
747 /* Limit to AF_INET. */
748 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
749 ATF_REQUIRE(limit != NULL);
750 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
751 sizeof(ipaddrv4));
752 ATF_REQUIRE(cap_net_limit(limit) == 0);
753
754 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
755 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) ==
756 ENOTCAPABLE);
757 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") ==
758 ENOTCAPABLE);
759
760 /* Unable to set empty limits. Empty limits means full access. */
761 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME);
762 ATF_REQUIRE(cap_net_limit(limit) != 0);
763
764 cap_close(capnet);
765 }
766
767
768 ATF_TC(capnet__limits_name2addr_mode);
ATF_TC_HEAD(capnet__limits_name2addr_mode,tc)769 ATF_TC_HEAD(capnet__limits_name2addr_mode, tc)
770 {
771 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
772 }
ATF_TC_BODY(capnet__limits_name2addr_mode,tc)773 ATF_TC_BODY(capnet__limits_name2addr_mode, tc)
774 {
775 cap_channel_t *capnet;
776 cap_net_limit_t *limit;
777
778 capnet = create_network_service();
779
780 /* LIMIT */
781 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
782 ATF_REQUIRE(limit != NULL);
783 ATF_REQUIRE(cap_net_limit(limit) == 0);
784
785 /* ALLOWED */
786 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
787 0);
788
789 /* DISALLOWED */
790 ATF_REQUIRE(
791 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
792 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
793 ENOTCAPABLE);
794 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
795 ENOTCAPABLE);
796 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
797 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
798
799 test_extend_mode(capnet, CAPNET_ADDR2NAME);
800
801 cap_close(capnet);
802 }
803
804 ATF_TC(capnet__limits_name2addr_hosts);
ATF_TC_HEAD(capnet__limits_name2addr_hosts,tc)805 ATF_TC_HEAD(capnet__limits_name2addr_hosts, tc)
806 {
807 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
808 }
ATF_TC_BODY(capnet__limits_name2addr_hosts,tc)809 ATF_TC_BODY(capnet__limits_name2addr_hosts, tc)
810 {
811 cap_channel_t *capnet;
812 cap_net_limit_t *limit;
813
814 capnet = create_network_service();
815
816 /* Limit to TEST_DOMAIN_0 and localhost only. */
817 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
818 ATF_REQUIRE(limit != NULL);
819 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
820 cap_net_limit_name2addr(limit, "localhost", NULL);
821 ATF_REQUIRE(cap_net_limit(limit) == 0);
822
823 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
824 0);
825 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 0);
826 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) ==
827 ENOTCAPABLE);
828
829 /* Limit to TEST_DOMAIN_0 only. */
830 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
831 ATF_REQUIRE(limit != NULL);
832 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
833 ATF_REQUIRE(cap_net_limit(limit) == 0);
834
835 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) ==
836 ENOTCAPABLE);
837 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) ==
838 ENOTCAPABLE);
839 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
840 0);
841
842 /* Unable to set empty limits. Empty limits means full access. */
843 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
844 ATF_REQUIRE(cap_net_limit(limit) != 0);
845
846 /* Try to extend the limit. */
847 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
848 ATF_REQUIRE(limit != NULL);
849 cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
850 ATF_REQUIRE(cap_net_limit(limit) != 0);
851
852 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
853 ATF_REQUIRE(limit != NULL);
854 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
855 cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
856 ATF_REQUIRE(cap_net_limit(limit) != 0);
857
858 cap_close(capnet);
859 }
860
861 ATF_TC(capnet__limits_name2addr_hosts_servnames_strict);
ATF_TC_HEAD(capnet__limits_name2addr_hosts_servnames_strict,tc)862 ATF_TC_HEAD(capnet__limits_name2addr_hosts_servnames_strict, tc)
863 {
864 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
865 }
ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict,tc)866 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict, tc)
867 {
868 cap_channel_t *capnet;
869 cap_net_limit_t *limit;
870
871 capnet = create_network_service();
872
873 /*
874 * Limit to TEST_DOMAIN_0 and HTTP service.
875 */
876 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
877 ATF_REQUIRE(limit != NULL);
878 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, "http");
879 ATF_REQUIRE(cap_net_limit(limit) == 0);
880
881 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") ==
882 0);
883 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
884 ENOTCAPABLE);
885 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "snmp") ==
886 ENOTCAPABLE);
887 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") ==
888 ENOTCAPABLE);
889
890 /* Unable to set empty limits. Empty limits means full access. */
891 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
892 ATF_REQUIRE(cap_net_limit(limit) != 0);
893
894 cap_close(capnet);
895 }
896
897 ATF_TC(capnet__limits_name2addr_hosts_servnames_mix);
ATF_TC_HEAD(capnet__limits_name2addr_hosts_servnames_mix,tc)898 ATF_TC_HEAD(capnet__limits_name2addr_hosts_servnames_mix, tc)
899 {
900 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
901 }
ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix,tc)902 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix, tc)
903 {
904 cap_channel_t *capnet;
905 cap_net_limit_t *limit;
906
907 capnet = create_network_service();
908
909 /*
910 * Limit to TEST_DOMAIN_0 and any servnamex, and any domain with
911 * servname HTTP.
912 */
913 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
914 ATF_REQUIRE(limit != NULL);
915 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
916 cap_net_limit_name2addr(limit, NULL, "http");
917 ATF_REQUIRE(cap_net_limit(limit) == 0);
918
919 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") ==
920 0);
921 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
922 0);
923 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") ==
924 0);
925 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
926 0);
927 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") ==
928 ENOTCAPABLE);
929
930 /* Limit to HTTP servname only. */
931 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
932 ATF_REQUIRE(limit != NULL);
933 cap_net_limit_name2addr(limit, NULL, "http");
934 ATF_REQUIRE(cap_net_limit(limit) == 0);
935
936 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") ==
937 0);
938 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
939 ENOTCAPABLE);
940 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") ==
941 0);
942 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
943 ENOTCAPABLE);
944 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") ==
945 ENOTCAPABLE);
946
947 /* Unable to set empty limits. Empty limits means full access. */
948 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
949 ATF_REQUIRE(cap_net_limit(limit) != 0);
950
951 cap_close(capnet);
952 }
953
954 ATF_TC(capnet__limits_name2addr_family);
ATF_TC_HEAD(capnet__limits_name2addr_family,tc)955 ATF_TC_HEAD(capnet__limits_name2addr_family, tc)
956 {
957 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
958 }
ATF_TC_BODY(capnet__limits_name2addr_family,tc)959 ATF_TC_BODY(capnet__limits_name2addr_family, tc)
960 {
961 cap_channel_t *capnet;
962 cap_net_limit_t *limit;
963 int family[] = { AF_INET6, AF_INET };
964
965 capnet = create_network_service();
966
967 /* Limit to AF_INET and AF_INET6. */
968 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
969 ATF_REQUIRE(limit != NULL);
970 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
971 cap_net_limit_name2addr_family(limit, family, nitems(family));
972 ATF_REQUIRE(cap_net_limit(limit) == 0);
973
974 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
975 0);
976 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) ==
977 0);
978 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) ==
979 ENOTCAPABLE);
980
981 /* Limit to AF_INET and AF_INET6. */
982 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
983 ATF_REQUIRE(limit != NULL);
984 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
985 cap_net_limit_name2addr_family(limit, &family[0], 1);
986 cap_net_limit_name2addr_family(limit, &family[1], 1);
987 ATF_REQUIRE(cap_net_limit(limit) == 0);
988
989 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
990 0);
991 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) ==
992 0);
993 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) ==
994 ENOTCAPABLE);
995
996 /* Limit to AF_INET6 only. */
997 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
998 ATF_REQUIRE(limit != NULL);
999 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1000 cap_net_limit_name2addr_family(limit, family, 1);
1001 ATF_REQUIRE(cap_net_limit(limit) == 0);
1002
1003 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1004 ENOTCAPABLE);
1005 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) ==
1006 0);
1007 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) ==
1008 ENOTCAPABLE);
1009
1010 /* Unable to set empty limits. Empty limits means full access. */
1011 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
1012 ATF_REQUIRE(cap_net_limit(limit) != 0);
1013
1014 cap_close(capnet);
1015 }
1016
1017 ATF_TC(capnet__limits_deprecated_name2addr_mode);
ATF_TC_HEAD(capnet__limits_deprecated_name2addr_mode,tc)1018 ATF_TC_HEAD(capnet__limits_deprecated_name2addr_mode, tc)
1019 {
1020 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1021 }
ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode,tc)1022 ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode, tc)
1023 {
1024 cap_channel_t *capnet;
1025 cap_net_limit_t *limit;
1026
1027 capnet = create_network_service();
1028
1029 /* LIMIT */
1030 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1031 ATF_REQUIRE(limit != NULL);
1032 ATF_REQUIRE(cap_net_limit(limit) == 0);
1033
1034 /* ALLOWED */
1035 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1036
1037 /* DISALLOWED */
1038 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1039 ENOTCAPABLE);
1040 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
1041 ENOTCAPABLE);
1042 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1043 ENOTCAPABLE);
1044 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
1045 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
1046
1047 test_extend_mode(capnet, CAPNET_ADDR2NAME);
1048
1049 cap_close(capnet);
1050 }
1051
1052 ATF_TC(capnet__limits_deprecated_name2addr_hosts);
ATF_TC_HEAD(capnet__limits_deprecated_name2addr_hosts,tc)1053 ATF_TC_HEAD(capnet__limits_deprecated_name2addr_hosts, tc)
1054 {
1055 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1056 }
ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts,tc)1057 ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts, tc)
1058 {
1059 cap_channel_t *capnet;
1060 cap_net_limit_t *limit;
1061
1062 capnet = create_network_service();
1063
1064 /* Limit to TEST_DOMAIN_0 and localhost only. */
1065 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1066 ATF_REQUIRE(limit != NULL);
1067 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1068 cap_net_limit_name2addr(limit, "localhost", NULL);
1069 ATF_REQUIRE(cap_net_limit(limit) == 0);
1070
1071 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1072 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, "localhost") == 0);
1073 ATF_REQUIRE(
1074 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE);
1075
1076 /* Limit to TEST_DOMAIN_0 only. */
1077 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1078 ATF_REQUIRE(limit != NULL);
1079 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1080 ATF_REQUIRE(cap_net_limit(limit) == 0);
1081
1082 ATF_REQUIRE(
1083 test_gethostbyname(capnet, AF_INET, "localhost") == ENOTCAPABLE);
1084 ATF_REQUIRE(
1085 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE);
1086 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1087
1088 /* Unable to set empty limits. Empty limits means full access. */
1089 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1090 ATF_REQUIRE(cap_net_limit(limit) != 0);
1091
1092 cap_close(capnet);
1093 }
1094
1095 ATF_TC(capnet__limits_deprecated_name2addr_family);
ATF_TC_HEAD(capnet__limits_deprecated_name2addr_family,tc)1096 ATF_TC_HEAD(capnet__limits_deprecated_name2addr_family, tc)
1097 {
1098 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1099 }
ATF_TC_BODY(capnet__limits_deprecated_name2addr_family,tc)1100 ATF_TC_BODY(capnet__limits_deprecated_name2addr_family, tc)
1101 {
1102 cap_channel_t *capnet;
1103 cap_net_limit_t *limit;
1104 int family[] = { AF_INET6, AF_INET };
1105
1106 capnet = create_network_service();
1107
1108 /* Limit to AF_INET and AF_INET6. */
1109 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1110 ATF_REQUIRE(limit != NULL);
1111 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1112 cap_net_limit_name2addr_family(limit, family, nitems(family));
1113 ATF_REQUIRE(cap_net_limit(limit) == 0);
1114
1115 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1116 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0);
1117 ATF_REQUIRE(
1118 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE);
1119
1120 /* Limit to AF_INET and AF_INET6. */
1121 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1122 ATF_REQUIRE(limit != NULL);
1123 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1124 cap_net_limit_name2addr_family(limit, &family[0], 1);
1125 cap_net_limit_name2addr_family(limit, &family[1], 1);
1126 ATF_REQUIRE(cap_net_limit(limit) == 0);
1127
1128 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
1129 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0);
1130 ATF_REQUIRE(
1131 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE);
1132
1133 /* Limit to AF_INET6 only. */
1134 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1135 ATF_REQUIRE(limit != NULL);
1136 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1137 cap_net_limit_name2addr_family(limit, family, 1);
1138 ATF_REQUIRE(cap_net_limit(limit) == 0);
1139
1140 ATF_REQUIRE(
1141 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
1142 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0);
1143 ATF_REQUIRE(
1144 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE);
1145
1146 /* Unable to set empty limits. Empty limits means full access. */
1147 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR);
1148 ATF_REQUIRE(cap_net_limit(limit) != 0);
1149
1150 cap_close(capnet);
1151 }
1152
1153 ATF_TC(capnet__limits_bind_mode);
ATF_TC_HEAD(capnet__limits_bind_mode,tc)1154 ATF_TC_HEAD(capnet__limits_bind_mode, tc)
1155 {
1156 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1157 }
ATF_TC_BODY(capnet__limits_bind_mode,tc)1158 ATF_TC_BODY(capnet__limits_bind_mode, tc)
1159 {
1160 cap_channel_t *capnet;
1161 cap_net_limit_t *limit;
1162
1163 capnet = create_network_service();
1164
1165 /* LIMIT */
1166 limit = cap_net_limit_init(capnet, CAPNET_BIND);
1167 ATF_REQUIRE(limit != NULL);
1168 ATF_REQUIRE(cap_net_limit(limit) == 0);
1169
1170 /* ALLOWED */
1171 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
1172
1173 /* DISALLOWED */
1174 ATF_REQUIRE(
1175 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
1176 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1177 ENOTCAPABLE);
1178 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
1179 ENOTCAPABLE);
1180 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1181 ENOTCAPABLE);
1182 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE);
1183
1184 test_extend_mode(capnet, CAPNET_ADDR2NAME);
1185
1186 cap_close(capnet);
1187 }
1188
1189 ATF_TC(capnet__limits_bind);
ATF_TC_HEAD(capnet__limits_bind,tc)1190 ATF_TC_HEAD(capnet__limits_bind, tc)
1191 {
1192 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1193 }
ATF_TC_BODY(capnet__limits_bind,tc)1194 ATF_TC_BODY(capnet__limits_bind, tc)
1195 {
1196 cap_channel_t *capnet;
1197 cap_net_limit_t *limit;
1198 struct sockaddr_in ipv4;
1199
1200 capnet = create_network_service();
1201
1202 limit = cap_net_limit_init(capnet, CAPNET_BIND);
1203 ATF_REQUIRE(limit != NULL);
1204
1205 memset(&ipv4, 0, sizeof(ipv4));
1206 ipv4.sin_family = AF_INET;
1207 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr);
1208
1209 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1210 ATF_REQUIRE(cap_net_limit(limit) == 0);
1211
1212 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
1213 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE);
1214
1215 cap_close(capnet);
1216 }
1217
1218 ATF_TC(capnet__limits_connect_mode);
ATF_TC_HEAD(capnet__limits_connect_mode,tc)1219 ATF_TC_HEAD(capnet__limits_connect_mode, tc)
1220 {
1221 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1222 }
ATF_TC_BODY(capnet__limits_connect_mode,tc)1223 ATF_TC_BODY(capnet__limits_connect_mode, tc)
1224 {
1225 cap_channel_t *capnet;
1226 cap_net_limit_t *limit;
1227
1228 capnet = create_network_service();
1229
1230 /* LIMIT */
1231 limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1232 ATF_REQUIRE(limit != NULL);
1233 ATF_REQUIRE(cap_net_limit(limit) == 0);
1234
1235 /* ALLOWED */
1236 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
1237
1238 /* DISALLOWED */
1239 ATF_REQUIRE(
1240 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
1241 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1242 ENOTCAPABLE);
1243 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
1244 ENOTCAPABLE);
1245 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1246 ENOTCAPABLE);
1247 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
1248
1249 test_extend_mode(capnet, CAPNET_ADDR2NAME);
1250
1251 cap_close(capnet);
1252 }
1253
1254 ATF_TC(capnet__limits_connect_dns_mode);
ATF_TC_HEAD(capnet__limits_connect_dns_mode,tc)1255 ATF_TC_HEAD(capnet__limits_connect_dns_mode, tc)
1256 {
1257 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1258 }
ATF_TC_BODY(capnet__limits_connect_dns_mode,tc)1259 ATF_TC_BODY(capnet__limits_connect_dns_mode, tc)
1260 {
1261 cap_channel_t *capnet;
1262 cap_net_limit_t *limit;
1263
1264 capnet = create_network_service();
1265
1266 /* LIMIT */
1267 limit = cap_net_limit_init(capnet, CAPNET_CONNECT | CAPNET_CONNECTDNS);
1268 ATF_REQUIRE(limit != NULL);
1269 ATF_REQUIRE(cap_net_limit(limit) == 0);
1270
1271 /* ALLOWED */
1272 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
1273
1274 /* DISALLOWED */
1275 ATF_REQUIRE(
1276 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE);
1277 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1278 ENOTCAPABLE);
1279 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) ==
1280 ENOTCAPABLE);
1281 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1282 ENOTCAPABLE);
1283 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE);
1284
1285 test_extend_mode(capnet, CAPNET_ADDR2NAME);
1286
1287 cap_close(capnet);
1288 }
1289
1290 ATF_TC(capnet__limits_connect);
ATF_TC_HEAD(capnet__limits_connect,tc)1291 ATF_TC_HEAD(capnet__limits_connect, tc)
1292 {
1293 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1294 }
ATF_TC_BODY(capnet__limits_connect,tc)1295 ATF_TC_BODY(capnet__limits_connect, tc)
1296 {
1297 cap_channel_t *capnet;
1298 cap_net_limit_t *limit;
1299 struct sockaddr_in ipv4;
1300
1301 capnet = create_network_service();
1302
1303 /* Limit only to TEST_IPV4 on port 80 and 443. */
1304 limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1305 ATF_REQUIRE(limit != NULL);
1306 memset(&ipv4, 0, sizeof(ipv4));
1307 ipv4.sin_family = AF_INET;
1308 ipv4.sin_port = htons(80);
1309 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr);
1310 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1311
1312 ipv4.sin_port = htons(443);
1313 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1314 ATF_REQUIRE(cap_net_limit(limit) == 0);
1315
1316 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
1317 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE);
1318 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1319 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0);
1320
1321 /* Limit only to TEST_IPV4 on port 443. */
1322 limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1323 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1324 ATF_REQUIRE(cap_net_limit(limit) == 0);
1325
1326 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 433) == ENOTCAPABLE);
1327 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE);
1328 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1329 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0);
1330
1331 /* Unable to set empty limits. Empty limits means full access. */
1332 limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1333 ATF_REQUIRE(cap_net_limit(limit) != 0);
1334
1335 cap_close(capnet);
1336 }
1337
1338 ATF_TC(capnet__limits_connecttodns);
ATF_TC_HEAD(capnet__limits_connecttodns,tc)1339 ATF_TC_HEAD(capnet__limits_connecttodns, tc)
1340 {
1341 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1342 }
ATF_TC_BODY(capnet__limits_connecttodns,tc)1343 ATF_TC_BODY(capnet__limits_connecttodns, tc)
1344 {
1345 cap_channel_t *capnet;
1346 cap_net_limit_t *limit;
1347 struct addrinfo hints, *capres, *res;
1348 int family[] = { AF_INET };
1349 int error;
1350
1351 capnet = create_network_service();
1352
1353 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS |
1354 CAPNET_NAME2ADDR);
1355 ATF_REQUIRE(limit != NULL);
1356 cap_net_limit_name2addr(limit, TEST_IPV4, "80");
1357 cap_net_limit_name2addr_family(limit, family, 1);
1358 ATF_REQUIRE(cap_net_limit(limit) == 0);
1359
1360 memset(&hints, 0, sizeof(hints));
1361 hints.ai_family = AF_INET;
1362 hints.ai_socktype = SOCK_STREAM;
1363
1364 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1365 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) ==
1366 0);
1367 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1368
1369 for (res = capres; res != NULL; res = res->ai_next) {
1370 int s;
1371
1372 ATF_REQUIRE(res->ai_family == AF_INET);
1373 ATF_REQUIRE(res->ai_socktype == SOCK_STREAM);
1374
1375 s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
1376 ATF_REQUIRE(s >= 0);
1377
1378 error = cap_connect(capnet, s, res->ai_addr,
1379 res->ai_addrlen);
1380 if (error != 0 && errno != ENOTCAPABLE)
1381 atf_tc_skip("unable to connect: %s", strerror(errno));
1382 ATF_REQUIRE(error == 0);
1383 ATF_REQUIRE(close(s) == 0);
1384 }
1385
1386 freeaddrinfo(capres);
1387 cap_close(capnet);
1388 }
1389
1390
1391 ATF_TC(capnet__limits_deprecated_connecttodns);
ATF_TC_HEAD(capnet__limits_deprecated_connecttodns,tc)1392 ATF_TC_HEAD(capnet__limits_deprecated_connecttodns, tc)
1393 {
1394 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1395 }
ATF_TC_BODY(capnet__limits_deprecated_connecttodns,tc)1396 ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc)
1397 {
1398 cap_channel_t *capnet;
1399 cap_net_limit_t *limit;
1400 struct hostent *caphp;
1401 struct in_addr ipaddr;
1402 struct sockaddr_in connaddr;
1403 int family[] = { AF_INET };
1404 int error, i;
1405
1406 capnet = create_network_service();
1407
1408 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS |
1409 CAPNET_DEPRECATED_NAME2ADDR);
1410 ATF_REQUIRE(limit != NULL);
1411 cap_net_limit_name2addr(limit, TEST_IPV4, NULL);
1412 cap_net_limit_name2addr_family(limit, family, 1);
1413 ATF_REQUIRE(cap_net_limit(limit) == 0);
1414
1415 memset(&ipaddr, 0, sizeof(ipaddr));
1416 inet_pton(AF_INET, TEST_IPV4, &ipaddr);
1417
1418 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1419 caphp = cap_gethostbyname2(capnet, TEST_IPV4, AF_INET);
1420 ATF_REQUIRE(caphp != NULL);
1421 ATF_REQUIRE(caphp->h_addrtype == AF_INET);
1422 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE);
1423
1424 for (i = 0; caphp->h_addr_list[i] != NULL; i++) {
1425 int s;
1426
1427 s = socket(AF_INET, SOCK_STREAM, 0);
1428 ATF_REQUIRE(s >= 0);
1429
1430 memset(&connaddr, 0, sizeof(connaddr));
1431 connaddr.sin_family = AF_INET;
1432 memcpy((char *)&connaddr.sin_addr.s_addr,
1433 (char *)caphp->h_addr_list[i], caphp->h_length);
1434 connaddr.sin_port = htons(80);
1435
1436 error = cap_connect(capnet, s, (struct sockaddr *)&connaddr,
1437 sizeof(connaddr));
1438 if (error != 0 && errno != ENOTCAPABLE)
1439 atf_tc_skip("unable to connect: %s", strerror(errno));
1440 ATF_REQUIRE(error == 0);
1441 ATF_REQUIRE(close(s) == 0);
1442 }
1443
1444 cap_close(capnet);
1445 }
1446
1447 ATF_TC(capnet__limits_name2addr_partial_drops_family);
ATF_TC_HEAD(capnet__limits_name2addr_partial_drops_family,tc)1448 ATF_TC_HEAD(capnet__limits_name2addr_partial_drops_family, tc)
1449 {
1450 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1451 }
ATF_TC_BODY(capnet__limits_name2addr_partial_drops_family,tc)1452 ATF_TC_BODY(capnet__limits_name2addr_partial_drops_family, tc)
1453 {
1454 cap_channel_t *capnet;
1455 cap_net_limit_t *limit;
1456 int family = AF_INET6;
1457
1458 capnet = create_network_service();
1459
1460 /* Tighten: only AF_INET6 allowed under name2addr. */
1461 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
1462 ATF_REQUIRE(limit != NULL);
1463 cap_net_limit_name2addr_family(limit, &family, 1);
1464 ATF_REQUIRE(cap_net_limit(limit) == 0);
1465
1466 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1467 ENOTCAPABLE);
1468
1469 /* Replacement omits "family"; must be rejected. */
1470 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
1471 ATF_REQUIRE(limit != NULL);
1472 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1473 ATF_REQUIRE(cap_net_limit(limit) != 0);
1474
1475 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) ==
1476 ENOTCAPABLE);
1477
1478 cap_close(capnet);
1479 }
1480
1481 ATF_TC(capnet__limits_name2addr_partial_drops_hosts);
ATF_TC_HEAD(capnet__limits_name2addr_partial_drops_hosts,tc)1482 ATF_TC_HEAD(capnet__limits_name2addr_partial_drops_hosts, tc)
1483 {
1484 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1485 }
ATF_TC_BODY(capnet__limits_name2addr_partial_drops_hosts,tc)1486 ATF_TC_BODY(capnet__limits_name2addr_partial_drops_hosts, tc)
1487 {
1488 cap_channel_t *capnet;
1489 cap_net_limit_t *limit;
1490 int family = AF_INET;
1491
1492 capnet = create_network_service();
1493
1494 /* Tighten: only TEST_DOMAIN_0 allowed. */
1495 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
1496 ATF_REQUIRE(limit != NULL);
1497 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
1498 ATF_REQUIRE(cap_net_limit(limit) == 0);
1499
1500 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) ==
1501 ENOTCAPABLE);
1502
1503 /* Replacement omits "hosts"; must be rejected. */
1504 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
1505 ATF_REQUIRE(limit != NULL);
1506 cap_net_limit_name2addr_family(limit, &family, 1);
1507 ATF_REQUIRE(cap_net_limit(limit) != 0);
1508
1509 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) ==
1510 ENOTCAPABLE);
1511
1512 cap_close(capnet);
1513 }
1514
1515 ATF_TC(capnet__limits_addr2name_partial_drops_family);
ATF_TC_HEAD(capnet__limits_addr2name_partial_drops_family,tc)1516 ATF_TC_HEAD(capnet__limits_addr2name_partial_drops_family, tc)
1517 {
1518 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1519 }
ATF_TC_BODY(capnet__limits_addr2name_partial_drops_family,tc)1520 ATF_TC_BODY(capnet__limits_addr2name_partial_drops_family, tc)
1521 {
1522 cap_channel_t *capnet;
1523 cap_net_limit_t *limit;
1524 struct sockaddr_in ipaddrv4;
1525 int family = AF_INET6;
1526
1527 capnet = create_network_service();
1528
1529 memset(&ipaddrv4, 0, sizeof(ipaddrv4));
1530 ipaddrv4.sin_family = AF_INET;
1531 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr);
1532
1533 /* Tighten: only AF_INET6 allowed under addr2name. */
1534 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
1535 ATF_REQUIRE(limit != NULL);
1536 cap_net_limit_addr2name_family(limit, &family, 1);
1537 ATF_REQUIRE(cap_net_limit(limit) == 0);
1538
1539 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1540 ENOTCAPABLE);
1541
1542 /* Replacement omits "family". Must be rejected. */
1543 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
1544 ATF_REQUIRE(limit != NULL);
1545 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4,
1546 sizeof(ipaddrv4));
1547 ATF_REQUIRE(cap_net_limit(limit) != 0);
1548
1549 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) ==
1550 ENOTCAPABLE);
1551
1552 cap_close(capnet);
1553 }
1554
1555 ATF_TC(capnet__limits_addr2name_partial_drops_sockaddr);
ATF_TC_HEAD(capnet__limits_addr2name_partial_drops_sockaddr,tc)1556 ATF_TC_HEAD(capnet__limits_addr2name_partial_drops_sockaddr, tc)
1557 {
1558 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1559 }
ATF_TC_BODY(capnet__limits_addr2name_partial_drops_sockaddr,tc)1560 ATF_TC_BODY(capnet__limits_addr2name_partial_drops_sockaddr, tc)
1561 {
1562 cap_channel_t *capnet;
1563 cap_net_limit_t *limit;
1564 struct sockaddr_in6 ipaddrv6;
1565 int family = AF_INET6;
1566
1567 capnet = create_network_service();
1568
1569 memset(&ipaddrv6, 0, sizeof(ipaddrv6));
1570 ipaddrv6.sin6_family = AF_INET6;
1571 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr);
1572
1573 /* Tighten: only TEST_IPV6 allowed under addr2name. */
1574 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
1575 ATF_REQUIRE(limit != NULL);
1576 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6,
1577 sizeof(ipaddrv6));
1578 ATF_REQUIRE(cap_net_limit(limit) == 0);
1579
1580 /* Replacement omits "sockaddr". Must be rejected. */
1581 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME);
1582 ATF_REQUIRE(limit != NULL);
1583 cap_net_limit_addr2name_family(limit, &family, 1);
1584 ATF_REQUIRE(cap_net_limit(limit) != 0);
1585
1586 cap_close(capnet);
1587 }
1588
1589 /*
1590 * The public helpers drop empty sublimits during pack, so the empty-{}
1591 * variant is only reachable via libnv + cap_limit_set() directly.
1592 */
1593 ATF_TC(capnet__limits_connect_partial_drops_sockaddr);
ATF_TC_HEAD(capnet__limits_connect_partial_drops_sockaddr,tc)1594 ATF_TC_HEAD(capnet__limits_connect_partial_drops_sockaddr, tc)
1595 {
1596 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1597 }
ATF_TC_BODY(capnet__limits_connect_partial_drops_sockaddr,tc)1598 ATF_TC_BODY(capnet__limits_connect_partial_drops_sockaddr, tc)
1599 {
1600 cap_channel_t *capnet;
1601 cap_net_limit_t *limit;
1602 struct sockaddr_in ipv4;
1603 nvlist_t *lnvl;
1604
1605 capnet = create_network_service();
1606
1607 memset(&ipv4, 0, sizeof(ipv4));
1608 ipv4.sin_family = AF_INET;
1609 ipv4.sin_port = htons(TEST_PORT);
1610 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr);
1611
1612 /* Tighten: only TEST_IPV4:TEST_PORT allowed under connect. */
1613 limit = cap_net_limit_init(capnet, CAPNET_CONNECT);
1614 ATF_REQUIRE(limit != NULL);
1615 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1616 ATF_REQUIRE(cap_net_limit(limit) == 0);
1617
1618 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, TEST_PORT) == 0);
1619 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", TEST_PORT) == ENOTCAPABLE);
1620
1621 /* Build connect={} (no sockaddr subkey) directly. Must be rejected. */
1622 lnvl = nvlist_create(0);
1623 nvlist_add_number(lnvl, "mode", CAPNET_CONNECT);
1624 nvlist_add_nvlist(lnvl, "connect", nvlist_create(0));
1625 ATF_REQUIRE(cap_limit_set(capnet, lnvl) != 0);
1626
1627 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", TEST_PORT) == ENOTCAPABLE);
1628
1629 cap_close(capnet);
1630 }
1631
1632 /*
1633 * The public helpers drop empty sublimits during pack, so the empty-{}
1634 * variant is only reachable via libnv + cap_limit_set() directly.
1635 */
1636 ATF_TC(capnet__limits_bind_partial_drops_sockaddr);
ATF_TC_HEAD(capnet__limits_bind_partial_drops_sockaddr,tc)1637 ATF_TC_HEAD(capnet__limits_bind_partial_drops_sockaddr, tc)
1638 {
1639 atf_tc_set_md_var(tc, "require.config", "allow_network_access");
1640 }
ATF_TC_BODY(capnet__limits_bind_partial_drops_sockaddr,tc)1641 ATF_TC_BODY(capnet__limits_bind_partial_drops_sockaddr, tc)
1642 {
1643 cap_channel_t *capnet;
1644 cap_net_limit_t *limit;
1645 struct sockaddr_in ipv4;
1646 nvlist_t *lnvl;
1647
1648 capnet = create_network_service();
1649
1650 memset(&ipv4, 0, sizeof(ipv4));
1651 ipv4.sin_family = AF_INET;
1652 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr);
1653
1654 /* Tighten: only TEST_BIND_IPV4 allowed under bind. */
1655 limit = cap_net_limit_init(capnet, CAPNET_BIND);
1656 ATF_REQUIRE(limit != NULL);
1657 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4));
1658 ATF_REQUIRE(cap_net_limit(limit) == 0);
1659
1660 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
1661 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE);
1662
1663 /* Build bind={} (no sockaddr subkey) directly. Must be rejected. */
1664 lnvl = nvlist_create(0);
1665 nvlist_add_number(lnvl, "mode", CAPNET_BIND);
1666 nvlist_add_nvlist(lnvl, "bind", nvlist_create(0));
1667 ATF_REQUIRE(cap_limit_set(capnet, lnvl) != 0);
1668
1669 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE);
1670
1671 cap_close(capnet);
1672 }
1673
ATF_TP_ADD_TCS(tp)1674 ATF_TP_ADD_TCS(tp)
1675 {
1676
1677 ATF_TP_ADD_TC(tp, capnet__connect);
1678 ATF_TP_ADD_TC(tp, capnet__bind);
1679 ATF_TP_ADD_TC(tp, capnet__getnameinfo);
1680 ATF_TP_ADD_TC(tp, capnet__getaddrinfo);
1681 ATF_TP_ADD_TC(tp, capnet__gethostbyname);
1682 ATF_TP_ADD_TC(tp, capnet__gethostbyaddr);
1683
1684 ATF_TP_ADD_TC(tp, capnet__getnameinfo_buffer);
1685
1686 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode);
1687 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family);
1688 ATF_TP_ADD_TC(tp, capnet__limits_addr2name);
1689
1690 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_mode);
1691 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_family);
1692 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name);
1693
1694 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_mode);
1695 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts);
1696 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_strict);
1697 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_mix);
1698 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_family);
1699
1700 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_mode);
1701 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_hosts);
1702 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_family);
1703
1704 ATF_TP_ADD_TC(tp, capnet__limits_bind_mode);
1705 ATF_TP_ADD_TC(tp, capnet__limits_bind);
1706
1707 ATF_TP_ADD_TC(tp, capnet__limits_connect_mode);
1708 ATF_TP_ADD_TC(tp, capnet__limits_connect_dns_mode);
1709 ATF_TP_ADD_TC(tp, capnet__limits_connect);
1710
1711 ATF_TP_ADD_TC(tp, capnet__limits_connecttodns);
1712 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_connecttodns);
1713
1714 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_partial_drops_family);
1715 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_partial_drops_hosts);
1716 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_partial_drops_family);
1717 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_partial_drops_sockaddr);
1718 ATF_TP_ADD_TC(tp, capnet__limits_connect_partial_drops_sockaddr);
1719 ATF_TP_ADD_TC(tp, capnet__limits_bind_partial_drops_sockaddr);
1720
1721 return (atf_no_error());
1722 }
1723