1 /*- 2 * Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org> 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 14 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 15 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 23 * POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/cdefs.h> 27 __FBSDID("$FreeBSD$"); 28 29 #include <sys/param.h> 30 #include <sys/socket.h> 31 #include <netinet/in.h> 32 #include <arpa/inet.h> 33 34 #include <errno.h> 35 #include <netdb.h> 36 37 #include <atf-c.h> 38 39 #include <libcasper.h> 40 #include <casper/cap_net.h> 41 42 #define TEST_DOMAIN_0 "example.com" 43 #define TEST_DOMAIN_1 "freebsd.org" 44 #define TEST_IPV4 "1.1.1.1" 45 #define TEST_IPV6 "2001:4860:4860::8888" 46 #define TEST_BIND_IPV4 "127.0.0.1" 47 #define TEST_PORT 80 48 #define TEST_PORT_STR "80" 49 50 static cap_channel_t * 51 create_network_service(void) 52 { 53 cap_channel_t *capcas, *capnet; 54 55 capcas = cap_init(); 56 ATF_REQUIRE(capcas != NULL); 57 58 capnet = cap_service_open(capcas, "system.net"); 59 ATF_REQUIRE(capnet != NULL); 60 61 cap_close(capcas); 62 return (capnet); 63 } 64 65 static int 66 test_getnameinfo_v4(cap_channel_t *chan, int family, const char *ip) 67 { 68 struct sockaddr_in ipaddr; 69 char capfn[MAXHOSTNAMELEN]; 70 char origfn[MAXHOSTNAMELEN]; 71 int capret, sysret; 72 73 memset(&ipaddr, 0, sizeof(ipaddr)); 74 ipaddr.sin_family = family; 75 inet_pton(family, ip, &ipaddr.sin_addr); 76 77 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 78 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 79 if (capret != 0 && capret == ENOTCAPABLE) 80 return (ENOTCAPABLE); 81 82 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 83 sizeof(origfn), NULL, 0, NI_NAMEREQD); 84 if (sysret != 0) { 85 atf_tc_skip("getnameinfo(%s) failed: %s", 86 ip, gai_strerror(sysret)); 87 } 88 ATF_REQUIRE(capret == 0); 89 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 90 91 return (0); 92 } 93 94 static int 95 test_getnameinfo_v6(cap_channel_t *chan, const char *ip) 96 { 97 struct sockaddr_in6 ipaddr; 98 char capfn[MAXHOSTNAMELEN]; 99 char origfn[MAXHOSTNAMELEN]; 100 int capret, sysret; 101 102 memset(&ipaddr, 0, sizeof(ipaddr)); 103 ipaddr.sin6_family = AF_INET6; 104 inet_pton(AF_INET6, ip, &ipaddr.sin6_addr); 105 106 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 107 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 108 if (capret != 0 && capret == ENOTCAPABLE) 109 return (ENOTCAPABLE); 110 111 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 112 sizeof(origfn), NULL, 0, NI_NAMEREQD); 113 if (sysret != 0) { 114 atf_tc_skip("getnameinfo(%s) failed: %s", 115 ip, gai_strerror(sysret)); 116 } 117 ATF_REQUIRE(capret == 0); 118 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 119 120 return (0); 121 } 122 123 static int 124 test_getnameinfo(cap_channel_t *chan, int family, const char *ip) 125 { 126 127 if (family == AF_INET6) { 128 return (test_getnameinfo_v6(chan, ip)); 129 } 130 131 return (test_getnameinfo_v4(chan, family, ip)); 132 } 133 134 static int 135 test_gethostbyaddr_v4(cap_channel_t *chan, int family, const char *ip) 136 { 137 struct in_addr ipaddr; 138 struct hostent *caphp, *orighp; 139 140 memset(&ipaddr, 0, sizeof(ipaddr)); 141 inet_pton(AF_INET, ip, &ipaddr); 142 143 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), family); 144 if (caphp == NULL && h_errno == ENOTCAPABLE) 145 return (ENOTCAPABLE); 146 147 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), family); 148 if (orighp == NULL) 149 atf_tc_skip("gethostbyaddr(%s) failed", ip); 150 ATF_REQUIRE(caphp != NULL); 151 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0); 152 153 return (0); 154 } 155 156 static int 157 test_gethostbyaddr_v6(cap_channel_t *chan, const char *ip) 158 { 159 struct in6_addr ipaddr; 160 struct hostent *caphp, *orighp; 161 162 memset(&ipaddr, 0, sizeof(ipaddr)); 163 inet_pton(AF_INET6, ip, &ipaddr); 164 165 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), AF_INET6); 166 if (caphp == NULL && h_errno == ENOTCAPABLE) 167 return (ENOTCAPABLE); 168 169 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), AF_INET6); 170 if (orighp == NULL) 171 atf_tc_skip("gethostbyaddr(%s) failed", ip); 172 ATF_REQUIRE(caphp != NULL); 173 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0); 174 175 return (0); 176 } 177 178 static int 179 test_gethostbyaddr(cap_channel_t *chan, int family, const char *ip) 180 { 181 182 if (family == AF_INET6) { 183 return (test_gethostbyaddr_v6(chan, ip)); 184 } else { 185 return (test_gethostbyaddr_v4(chan, family, ip)); 186 } 187 } 188 189 static int 190 test_getaddrinfo(cap_channel_t *chan, int family, const char *domain, 191 const char *servname) 192 { 193 struct addrinfo hints, *capres, *origres, *res0, *res1; 194 bool found; 195 int capret, sysret; 196 197 memset(&hints, 0, sizeof(hints)); 198 hints.ai_family = family; 199 hints.ai_socktype = SOCK_STREAM; 200 201 capret = cap_getaddrinfo(chan, domain, servname, &hints, &capres); 202 if (capret != 0 && capret == ENOTCAPABLE) 203 return (capret); 204 205 sysret = getaddrinfo(domain, servname, &hints, &origres); 206 if (sysret != 0) 207 atf_tc_skip("getaddrinfo(%s) failed: %s", 208 domain, gai_strerror(sysret)); 209 ATF_REQUIRE(capret == 0); 210 211 for (res0 = capres; res0 != NULL; res0 = res0->ai_next) { 212 found = false; 213 for (res1 = origres; res1 != NULL; res1 = res1->ai_next) { 214 if (res1->ai_addrlen == res0->ai_addrlen && 215 memcmp(res1->ai_addr, res0->ai_addr, 216 res0->ai_addrlen) == 0) { 217 found = true; 218 break; 219 } 220 } 221 ATF_REQUIRE(found); 222 } 223 224 freeaddrinfo(capres); 225 freeaddrinfo(origres); 226 return (0); 227 } 228 229 static int 230 test_gethostbyname(cap_channel_t *chan, int family, const char *domain) 231 { 232 struct hostent *caphp, *orighp; 233 234 caphp = cap_gethostbyname2(chan, domain, family); 235 if (caphp == NULL && h_errno == ENOTCAPABLE) 236 return (h_errno); 237 238 orighp = gethostbyname2(domain, family); 239 if (orighp == NULL) 240 atf_tc_skip("gethostbyname2(%s) failed", domain); 241 242 ATF_REQUIRE(caphp != NULL); 243 ATF_REQUIRE(strcmp(caphp->h_name, orighp->h_name) == 0); 244 return (0); 245 } 246 247 static int 248 test_bind(cap_channel_t *chan, const char *ip) 249 { 250 struct sockaddr_in ipv4; 251 int capfd, ret, serrno; 252 253 capfd = socket(AF_INET, SOCK_STREAM, 0); 254 ATF_REQUIRE(capfd > 0); 255 256 memset(&ipv4, 0, sizeof(ipv4)); 257 ipv4.sin_family = AF_INET; 258 inet_pton(AF_INET, ip, &ipv4.sin_addr); 259 260 ret = cap_bind(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 261 serrno = errno; 262 close(capfd); 263 264 return (ret < 0 ? serrno : 0); 265 } 266 267 static int 268 test_connect(cap_channel_t *chan, const char *ip, unsigned short port) 269 { 270 struct sockaddr_in ipv4; 271 int capfd, ret, serrno; 272 273 capfd = socket(AF_INET, SOCK_STREAM, 0); 274 ATF_REQUIRE(capfd >= 0); 275 276 memset(&ipv4, 0, sizeof(ipv4)); 277 ipv4.sin_family = AF_INET; 278 ipv4.sin_port = htons(port); 279 inet_pton(AF_INET, ip, &ipv4.sin_addr); 280 281 ret = cap_connect(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 282 serrno = errno; 283 ATF_REQUIRE(close(capfd) == 0); 284 285 if (ret < 0 && serrno != ENOTCAPABLE) { 286 int sd; 287 288 /* 289 * If the connection failed, it might be because we can't reach 290 * the destination host. To check, try a plain connect() and 291 * see if it fails with the same error. 292 */ 293 sd = socket(AF_INET, SOCK_STREAM, 0); 294 ATF_REQUIRE(sd >= 0); 295 296 memset(&ipv4, 0, sizeof(ipv4)); 297 ipv4.sin_family = AF_INET; 298 ipv4.sin_port = htons(port); 299 inet_pton(AF_INET, ip, &ipv4.sin_addr); 300 ret = connect(sd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 301 ATF_REQUIRE(ret < 0); 302 ATF_REQUIRE_MSG(errno == serrno, "errno %d != serrno %d", 303 errno, serrno); 304 ATF_REQUIRE(close(sd) == 0); 305 atf_tc_skip("connect(%s:%d) failed: %s", 306 ip, port, strerror(serrno)); 307 } 308 309 return (ret < 0 ? serrno : 0); 310 } 311 312 static void 313 test_extend_mode(cap_channel_t *capnet, int current) 314 { 315 cap_net_limit_t *limit; 316 const int rights[] = { 317 CAPNET_ADDR2NAME, 318 CAPNET_NAME2ADDR, 319 CAPNET_DEPRECATED_ADDR2NAME, 320 CAPNET_DEPRECATED_NAME2ADDR, 321 CAPNET_CONNECT, 322 CAPNET_BIND, 323 CAPNET_CONNECTDNS 324 }; 325 size_t i; 326 327 for (i = 0; i < nitems(rights); i++) { 328 if (current == rights[i]) 329 continue; 330 331 limit = cap_net_limit_init(capnet, current | rights[i]); 332 ATF_REQUIRE(limit != NULL); 333 ATF_REQUIRE(cap_net_limit(limit) != 0); 334 } 335 } 336 337 ATF_TC_WITHOUT_HEAD(capnet__getnameinfo); 338 ATF_TC_BODY(capnet__getnameinfo, tc) 339 { 340 cap_channel_t *capnet; 341 342 capnet = create_network_service(); 343 344 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 345 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 346 347 cap_close(capnet); 348 } 349 350 ATF_TC_WITHOUT_HEAD(capnet__connect); 351 ATF_TC_BODY(capnet__connect, tc) 352 { 353 cap_channel_t *capnet; 354 355 capnet = create_network_service(); 356 357 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 358 359 cap_close(capnet); 360 } 361 362 ATF_TC_WITHOUT_HEAD(capnet__bind); 363 ATF_TC_BODY(capnet__bind, tc) 364 { 365 cap_channel_t *capnet; 366 367 capnet = create_network_service(); 368 369 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 370 371 cap_close(capnet); 372 } 373 374 ATF_TC_WITHOUT_HEAD(capnet__getaddrinfo); 375 ATF_TC_BODY(capnet__getaddrinfo, tc) 376 { 377 cap_channel_t *capnet; 378 struct addrinfo hints, *capres; 379 380 capnet = create_network_service(); 381 382 memset(&hints, 0, sizeof(hints)); 383 hints.ai_family = AF_INET; 384 hints.ai_socktype = SOCK_STREAM; 385 386 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 387 0); 388 389 cap_close(capnet); 390 } 391 392 ATF_TC_WITHOUT_HEAD(capnet__gethostbyname); 393 ATF_TC_BODY(capnet__gethostbyname, tc) 394 { 395 cap_channel_t *capnet; 396 397 capnet = create_network_service(); 398 399 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 400 401 cap_close(capnet); 402 } 403 404 ATF_TC_WITHOUT_HEAD(capnet__gethostbyaddr); 405 ATF_TC_BODY(capnet__gethostbyaddr, tc) 406 { 407 cap_channel_t *capnet; 408 409 capnet = create_network_service(); 410 411 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 412 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 413 414 cap_close(capnet); 415 } 416 417 ATF_TC_WITHOUT_HEAD(capnet__getnameinfo_buffer); 418 ATF_TC_BODY(capnet__getnameinfo_buffer, tc) 419 { 420 cap_channel_t *chan; 421 struct sockaddr_in sin; 422 int ret; 423 struct { 424 char host[sizeof(TEST_IPV4)]; 425 char host_canary; 426 char serv[sizeof(TEST_PORT_STR)]; 427 char serv_canary; 428 } buffers; 429 430 memset(&sin, 0, sizeof(sin)); 431 sin.sin_family = AF_INET; 432 sin.sin_port = htons(TEST_PORT); 433 ret = inet_pton(AF_INET, TEST_IPV4, &sin.sin_addr); 434 ATF_REQUIRE_EQ(1, ret); 435 436 memset(&buffers, '!', sizeof(buffers)); 437 438 chan = create_network_service(); 439 ret = cap_getnameinfo(chan, (struct sockaddr *)&sin, sizeof(sin), 440 buffers.host, sizeof(buffers.host), 441 buffers.serv, sizeof(buffers.serv), 442 NI_NUMERICHOST | NI_NUMERICSERV); 443 ATF_REQUIRE_EQ_MSG(0, ret, "%d", ret); 444 445 // Verify that cap_getnameinfo worked with minimally sized buffers. 446 ATF_CHECK_EQ(0, strcmp(TEST_IPV4, buffers.host)); 447 ATF_CHECK_EQ(0, strcmp(TEST_PORT_STR, buffers.serv)); 448 449 // Verify that cap_getnameinfo did not overflow the buffers. 450 ATF_CHECK_EQ('!', buffers.host_canary); 451 ATF_CHECK_EQ('!', buffers.serv_canary); 452 453 cap_close(chan); 454 } 455 456 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode); 457 ATF_TC_BODY(capnet__limits_addr2name_mode, tc) 458 { 459 cap_channel_t *capnet; 460 cap_net_limit_t *limit; 461 462 capnet = create_network_service(); 463 464 /* LIMIT */ 465 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 466 ATF_REQUIRE(limit != NULL); 467 ATF_REQUIRE(cap_net_limit(limit) == 0); 468 469 /* ALLOWED */ 470 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 471 472 /* DISALLOWED */ 473 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 474 ENOTCAPABLE); 475 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 476 ENOTCAPABLE); 477 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 478 ENOTCAPABLE); 479 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 480 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 481 482 test_extend_mode(capnet, CAPNET_ADDR2NAME); 483 484 cap_close(capnet); 485 } 486 487 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_family); 488 ATF_TC_BODY(capnet__limits_addr2name_family, tc) 489 { 490 cap_channel_t *capnet; 491 cap_net_limit_t *limit; 492 int family[] = { AF_INET6, AF_INET }; 493 494 capnet = create_network_service(); 495 496 /* Limit to AF_INET6 and AF_INET. */ 497 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 498 ATF_REQUIRE(limit != NULL); 499 cap_net_limit_addr2name_family(limit, family, nitems(family)); 500 ATF_REQUIRE(cap_net_limit(limit) == 0); 501 502 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 503 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 504 505 /* Limit to AF_INET6 and AF_INET. */ 506 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 507 ATF_REQUIRE(limit != NULL); 508 cap_net_limit_addr2name_family(limit, &family[0], 1); 509 cap_net_limit_addr2name_family(limit, &family[1], 1); 510 ATF_REQUIRE(cap_net_limit(limit) == 0); 511 512 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 513 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 514 515 /* Limit to AF_INET6. */ 516 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 517 ATF_REQUIRE(limit != NULL); 518 cap_net_limit_addr2name_family(limit, family, 1); 519 ATF_REQUIRE(cap_net_limit(limit) == 0); 520 521 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 522 ENOTCAPABLE); 523 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 524 525 /* Unable to set empty limits. Empty limits means full access. */ 526 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 527 ATF_REQUIRE(cap_net_limit(limit) != 0); 528 529 cap_close(capnet); 530 } 531 532 ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name); 533 ATF_TC_BODY(capnet__limits_addr2name, tc) 534 { 535 cap_channel_t *capnet; 536 cap_net_limit_t *limit; 537 struct sockaddr_in ipaddrv4; 538 struct sockaddr_in6 ipaddrv6; 539 540 capnet = create_network_service(); 541 542 /* Limit to TEST_IPV4 and TEST_IPV6. */ 543 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 544 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 545 546 ipaddrv4.sin_family = AF_INET; 547 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr); 548 549 ipaddrv6.sin6_family = AF_INET6; 550 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr); 551 552 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 553 ATF_REQUIRE(limit != NULL); 554 555 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 556 sizeof(ipaddrv4)); 557 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 558 sizeof(ipaddrv6)); 559 ATF_REQUIRE(cap_net_limit(limit) == 0); 560 561 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 562 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 563 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 564 ENOTCAPABLE); 565 566 /* Limit to AF_INET. */ 567 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 568 ATF_REQUIRE(limit != NULL); 569 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 570 sizeof(ipaddrv4)); 571 ATF_REQUIRE(cap_net_limit(limit) == 0); 572 573 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 574 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 575 ENOTCAPABLE); 576 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 577 ENOTCAPABLE); 578 579 /* Unable to set empty limits. Empty limits means full access. */ 580 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 581 ATF_REQUIRE(cap_net_limit(limit) != 0); 582 583 cap_close(capnet); 584 } 585 586 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_mode); 587 ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode, tc) 588 { 589 cap_channel_t *capnet; 590 cap_net_limit_t *limit; 591 592 capnet = create_network_service(); 593 594 /* LIMIT */ 595 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 596 ATF_REQUIRE(limit != NULL); 597 ATF_REQUIRE(cap_net_limit(limit) == 0); 598 599 /* ALLOWED */ 600 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 601 602 /* DISALLOWED */ 603 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 604 ENOTCAPABLE); 605 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 606 ENOTCAPABLE); 607 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 608 ENOTCAPABLE); 609 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 610 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 611 612 cap_close(capnet); 613 } 614 615 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name_family); 616 ATF_TC_BODY(capnet__limits_deprecated_addr2name_family, tc) 617 { 618 cap_channel_t *capnet; 619 cap_net_limit_t *limit; 620 int family[] = { AF_INET6, AF_INET }; 621 622 capnet = create_network_service(); 623 624 /* Limit to AF_INET6 and AF_INET. */ 625 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 626 ATF_REQUIRE(limit != NULL); 627 cap_net_limit_addr2name_family(limit, family, nitems(family)); 628 ATF_REQUIRE(cap_net_limit(limit) == 0); 629 630 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 631 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 632 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 633 ENOTCAPABLE); 634 635 /* Limit to AF_INET6 and AF_INET. */ 636 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 637 ATF_REQUIRE(limit != NULL); 638 cap_net_limit_addr2name_family(limit, &family[0], 1); 639 cap_net_limit_addr2name_family(limit, &family[1], 1); 640 ATF_REQUIRE(cap_net_limit(limit) == 0); 641 642 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 643 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 644 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 645 ENOTCAPABLE); 646 647 /* Limit to AF_INET6. */ 648 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 649 ATF_REQUIRE(limit != NULL); 650 cap_net_limit_addr2name_family(limit, family, 1); 651 ATF_REQUIRE(cap_net_limit(limit) == 0); 652 653 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 654 ENOTCAPABLE); 655 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 656 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 657 ENOTCAPABLE); 658 659 /* Unable to set empty limits. Empty limits means full access. */ 660 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 661 ATF_REQUIRE(cap_net_limit(limit) != 0); 662 663 cap_close(capnet); 664 } 665 666 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_addr2name); 667 ATF_TC_BODY(capnet__limits_deprecated_addr2name, tc) 668 { 669 cap_channel_t *capnet; 670 cap_net_limit_t *limit; 671 struct in_addr ipaddrv4; 672 struct in6_addr ipaddrv6; 673 674 capnet = create_network_service(); 675 676 /* Limit to TEST_IPV4 and TEST_IPV6. */ 677 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 678 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 679 680 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4); 681 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6); 682 683 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 684 ATF_REQUIRE(limit != NULL); 685 686 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 687 sizeof(ipaddrv4)); 688 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 689 sizeof(ipaddrv6)); 690 ATF_REQUIRE(cap_net_limit(limit) == 0); 691 692 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 693 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 694 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 695 ENOTCAPABLE); 696 697 /* Limit to AF_INET. */ 698 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 699 ATF_REQUIRE(limit != NULL); 700 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 701 sizeof(ipaddrv4)); 702 ATF_REQUIRE(cap_net_limit(limit) == 0); 703 704 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 705 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 706 ENOTCAPABLE); 707 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 708 ENOTCAPABLE); 709 710 /* Unable to set empty limits. Empty limits means full access. */ 711 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 712 ATF_REQUIRE(cap_net_limit(limit) != 0); 713 714 cap_close(capnet); 715 } 716 717 718 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_mode); 719 ATF_TC_BODY(capnet__limits_name2addr_mode, tc) 720 { 721 cap_channel_t *capnet; 722 cap_net_limit_t *limit; 723 724 capnet = create_network_service(); 725 726 /* LIMIT */ 727 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 728 ATF_REQUIRE(limit != NULL); 729 ATF_REQUIRE(cap_net_limit(limit) == 0); 730 731 /* ALLOWED */ 732 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 733 0); 734 735 /* DISALLOWED */ 736 ATF_REQUIRE( 737 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 738 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 739 ENOTCAPABLE); 740 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 741 ENOTCAPABLE); 742 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 743 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 744 745 test_extend_mode(capnet, CAPNET_ADDR2NAME); 746 747 cap_close(capnet); 748 } 749 750 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts); 751 ATF_TC_BODY(capnet__limits_name2addr_hosts, tc) 752 { 753 cap_channel_t *capnet; 754 cap_net_limit_t *limit; 755 756 capnet = create_network_service(); 757 758 /* Limit to TEST_DOMAIN_0 and localhost only. */ 759 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 760 ATF_REQUIRE(limit != NULL); 761 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 762 cap_net_limit_name2addr(limit, "localhost", NULL); 763 ATF_REQUIRE(cap_net_limit(limit) == 0); 764 765 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 766 0); 767 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 0); 768 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 769 ENOTCAPABLE); 770 771 /* Limit to TEST_DOMAIN_0 only. */ 772 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 773 ATF_REQUIRE(limit != NULL); 774 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 775 ATF_REQUIRE(cap_net_limit(limit) == 0); 776 777 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 778 ENOTCAPABLE); 779 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 780 ENOTCAPABLE); 781 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 782 0); 783 784 /* Unable to set empty limits. Empty limits means full access. */ 785 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 786 ATF_REQUIRE(cap_net_limit(limit) != 0); 787 788 cap_close(capnet); 789 } 790 791 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_strict); 792 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict, tc) 793 { 794 cap_channel_t *capnet; 795 cap_net_limit_t *limit; 796 797 capnet = create_network_service(); 798 799 /* 800 * Limit to TEST_DOMAIN_0 and HTTP service. 801 */ 802 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 803 ATF_REQUIRE(limit != NULL); 804 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, "http"); 805 ATF_REQUIRE(cap_net_limit(limit) == 0); 806 807 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 808 0); 809 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 810 ENOTCAPABLE); 811 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "snmp") == 812 ENOTCAPABLE); 813 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 814 ENOTCAPABLE); 815 816 /* Unable to set empty limits. Empty limits means full access. */ 817 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 818 ATF_REQUIRE(cap_net_limit(limit) != 0); 819 820 cap_close(capnet); 821 } 822 823 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_hosts_servnames_mix); 824 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix, tc) 825 { 826 cap_channel_t *capnet; 827 cap_net_limit_t *limit; 828 829 capnet = create_network_service(); 830 831 /* 832 * Limit to TEST_DOMAIN_0 and any servnamex, and any domain with 833 * servname HTTP. 834 */ 835 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 836 ATF_REQUIRE(limit != NULL); 837 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 838 cap_net_limit_name2addr(limit, NULL, "http"); 839 ATF_REQUIRE(cap_net_limit(limit) == 0); 840 841 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 842 0); 843 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 844 0); 845 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 846 0); 847 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 848 0); 849 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 850 ENOTCAPABLE); 851 852 /* Limit to HTTTP servname only. */ 853 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 854 ATF_REQUIRE(limit != NULL); 855 cap_net_limit_name2addr(limit, NULL, "http"); 856 ATF_REQUIRE(cap_net_limit(limit) == 0); 857 858 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 859 0); 860 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 861 ENOTCAPABLE); 862 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 863 0); 864 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 865 ENOTCAPABLE); 866 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 867 ENOTCAPABLE); 868 869 /* Unable to set empty limits. Empty limits means full access. */ 870 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 871 ATF_REQUIRE(cap_net_limit(limit) != 0); 872 873 cap_close(capnet); 874 } 875 876 ATF_TC_WITHOUT_HEAD(capnet__limits_name2addr_family); 877 ATF_TC_BODY(capnet__limits_name2addr_family, tc) 878 { 879 cap_channel_t *capnet; 880 cap_net_limit_t *limit; 881 int family[] = { AF_INET6, AF_INET }; 882 883 capnet = create_network_service(); 884 885 /* Limit to AF_INET and AF_INET6. */ 886 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 887 ATF_REQUIRE(limit != NULL); 888 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 889 cap_net_limit_name2addr_family(limit, family, nitems(family)); 890 ATF_REQUIRE(cap_net_limit(limit) == 0); 891 892 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 893 0); 894 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 895 0); 896 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 897 ENOTCAPABLE); 898 899 /* Limit to AF_INET and AF_INET6. */ 900 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 901 ATF_REQUIRE(limit != NULL); 902 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 903 cap_net_limit_name2addr_family(limit, &family[0], 1); 904 cap_net_limit_name2addr_family(limit, &family[1], 1); 905 ATF_REQUIRE(cap_net_limit(limit) == 0); 906 907 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 908 0); 909 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 910 0); 911 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 912 ENOTCAPABLE); 913 914 /* Limit to AF_INET6 only. */ 915 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 916 ATF_REQUIRE(limit != NULL); 917 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 918 cap_net_limit_name2addr_family(limit, family, 1); 919 ATF_REQUIRE(cap_net_limit(limit) == 0); 920 921 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 922 ENOTCAPABLE); 923 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 924 0); 925 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 926 ENOTCAPABLE); 927 928 /* Unable to set empty limits. Empty limits means full access. */ 929 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 930 ATF_REQUIRE(cap_net_limit(limit) != 0); 931 932 cap_close(capnet); 933 } 934 935 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_mode); 936 ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode, tc) 937 { 938 cap_channel_t *capnet; 939 cap_net_limit_t *limit; 940 941 capnet = create_network_service(); 942 943 /* LIMIT */ 944 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 945 ATF_REQUIRE(limit != NULL); 946 ATF_REQUIRE(cap_net_limit(limit) == 0); 947 948 /* ALLOWED */ 949 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 950 951 /* DISALLOWED */ 952 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 953 ENOTCAPABLE); 954 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 955 ENOTCAPABLE); 956 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 957 ENOTCAPABLE); 958 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 959 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 960 961 test_extend_mode(capnet, CAPNET_ADDR2NAME); 962 963 cap_close(capnet); 964 } 965 966 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_hosts); 967 ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts, tc) 968 { 969 cap_channel_t *capnet; 970 cap_net_limit_t *limit; 971 972 capnet = create_network_service(); 973 974 /* Limit to TEST_DOMAIN_0 and localhost only. */ 975 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 976 ATF_REQUIRE(limit != NULL); 977 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 978 cap_net_limit_name2addr(limit, "localhost", NULL); 979 ATF_REQUIRE(cap_net_limit(limit) == 0); 980 981 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 982 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, "localhost") == 0); 983 ATF_REQUIRE( 984 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 985 986 /* Limit to TEST_DOMAIN_0 only. */ 987 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 988 ATF_REQUIRE(limit != NULL); 989 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 990 ATF_REQUIRE(cap_net_limit(limit) == 0); 991 992 ATF_REQUIRE( 993 test_gethostbyname(capnet, AF_INET, "localhost") == ENOTCAPABLE); 994 ATF_REQUIRE( 995 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 996 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 997 998 /* Unable to set empty limits. Empty limits means full access. */ 999 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1000 ATF_REQUIRE(cap_net_limit(limit) != 0); 1001 1002 cap_close(capnet); 1003 } 1004 1005 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_name2addr_family); 1006 ATF_TC_BODY(capnet__limits_deprecated_name2addr_family, tc) 1007 { 1008 cap_channel_t *capnet; 1009 cap_net_limit_t *limit; 1010 int family[] = { AF_INET6, AF_INET }; 1011 1012 capnet = create_network_service(); 1013 1014 /* Limit to AF_INET and AF_INET6. */ 1015 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1016 ATF_REQUIRE(limit != NULL); 1017 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1018 cap_net_limit_name2addr_family(limit, family, nitems(family)); 1019 ATF_REQUIRE(cap_net_limit(limit) == 0); 1020 1021 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1022 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1023 ATF_REQUIRE( 1024 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1025 1026 /* Limit to AF_INET and AF_INET6. */ 1027 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1028 ATF_REQUIRE(limit != NULL); 1029 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1030 cap_net_limit_name2addr_family(limit, &family[0], 1); 1031 cap_net_limit_name2addr_family(limit, &family[1], 1); 1032 ATF_REQUIRE(cap_net_limit(limit) == 0); 1033 1034 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1035 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1036 ATF_REQUIRE( 1037 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1038 1039 /* Limit to AF_INET6 only. */ 1040 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1041 ATF_REQUIRE(limit != NULL); 1042 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1043 cap_net_limit_name2addr_family(limit, family, 1); 1044 ATF_REQUIRE(cap_net_limit(limit) == 0); 1045 1046 ATF_REQUIRE( 1047 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1048 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1049 ATF_REQUIRE( 1050 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1051 1052 /* Unable to set empty limits. Empty limits means full access. */ 1053 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1054 ATF_REQUIRE(cap_net_limit(limit) != 0); 1055 1056 cap_close(capnet); 1057 } 1058 1059 ATF_TC_WITHOUT_HEAD(capnet__limits_bind_mode); 1060 ATF_TC_BODY(capnet__limits_bind_mode, tc) 1061 { 1062 cap_channel_t *capnet; 1063 cap_net_limit_t *limit; 1064 1065 capnet = create_network_service(); 1066 1067 /* LIMIT */ 1068 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1069 ATF_REQUIRE(limit != NULL); 1070 ATF_REQUIRE(cap_net_limit(limit) == 0); 1071 1072 /* ALLOWED */ 1073 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1074 1075 /* DISALLOWED */ 1076 ATF_REQUIRE( 1077 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1078 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1079 ENOTCAPABLE); 1080 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1081 ENOTCAPABLE); 1082 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1083 ENOTCAPABLE); 1084 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 1085 1086 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1087 1088 cap_close(capnet); 1089 } 1090 1091 ATF_TC_WITHOUT_HEAD(capnet__limits_bind); 1092 ATF_TC_BODY(capnet__limits_bind, tc) 1093 { 1094 cap_channel_t *capnet; 1095 cap_net_limit_t *limit; 1096 struct sockaddr_in ipv4; 1097 1098 capnet = create_network_service(); 1099 1100 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1101 ATF_REQUIRE(limit != NULL); 1102 1103 memset(&ipv4, 0, sizeof(ipv4)); 1104 ipv4.sin_family = AF_INET; 1105 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr); 1106 1107 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1108 ATF_REQUIRE(cap_net_limit(limit) == 0); 1109 1110 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1111 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE); 1112 1113 cap_close(capnet); 1114 } 1115 1116 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_mode); 1117 ATF_TC_BODY(capnet__limits_connect_mode, tc) 1118 { 1119 cap_channel_t *capnet; 1120 cap_net_limit_t *limit; 1121 1122 capnet = create_network_service(); 1123 1124 /* LIMIT */ 1125 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1126 ATF_REQUIRE(limit != NULL); 1127 ATF_REQUIRE(cap_net_limit(limit) == 0); 1128 1129 /* ALLOWED */ 1130 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1131 1132 /* DISALLOWED */ 1133 ATF_REQUIRE( 1134 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1135 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1136 ENOTCAPABLE); 1137 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1138 ENOTCAPABLE); 1139 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1140 ENOTCAPABLE); 1141 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1142 1143 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1144 1145 cap_close(capnet); 1146 } 1147 1148 ATF_TC_WITHOUT_HEAD(capnet__limits_connect_dns_mode); 1149 ATF_TC_BODY(capnet__limits_connect_dns_mode, tc) 1150 { 1151 cap_channel_t *capnet; 1152 cap_net_limit_t *limit; 1153 1154 capnet = create_network_service(); 1155 1156 /* LIMIT */ 1157 limit = cap_net_limit_init(capnet, CAPNET_CONNECT | CAPNET_CONNECTDNS); 1158 ATF_REQUIRE(limit != NULL); 1159 ATF_REQUIRE(cap_net_limit(limit) == 0); 1160 1161 /* ALLOWED */ 1162 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1163 1164 /* DISALLOWED */ 1165 ATF_REQUIRE( 1166 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1167 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1168 ENOTCAPABLE); 1169 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1170 ENOTCAPABLE); 1171 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1172 ENOTCAPABLE); 1173 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1174 1175 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1176 1177 cap_close(capnet); 1178 } 1179 1180 ATF_TC_WITHOUT_HEAD(capnet__limits_connect); 1181 ATF_TC_BODY(capnet__limits_connect, tc) 1182 { 1183 cap_channel_t *capnet; 1184 cap_net_limit_t *limit; 1185 struct sockaddr_in ipv4; 1186 1187 capnet = create_network_service(); 1188 1189 /* Limit only to TEST_IPV4 on port 80 and 443. */ 1190 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1191 ATF_REQUIRE(limit != NULL); 1192 memset(&ipv4, 0, sizeof(ipv4)); 1193 ipv4.sin_family = AF_INET; 1194 ipv4.sin_port = htons(80); 1195 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr); 1196 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1197 1198 ipv4.sin_port = htons(443); 1199 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1200 ATF_REQUIRE(cap_net_limit(limit) == 0); 1201 1202 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1203 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1204 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1205 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1206 1207 /* Limit only to TEST_IPV4 on port 443. */ 1208 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1209 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1210 ATF_REQUIRE(cap_net_limit(limit) == 0); 1211 1212 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 433) == ENOTCAPABLE); 1213 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1214 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1215 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1216 1217 /* Unable to set empty limits. Empty limits means full access. */ 1218 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1219 ATF_REQUIRE(cap_net_limit(limit) != 0); 1220 1221 cap_close(capnet); 1222 } 1223 1224 ATF_TC_WITHOUT_HEAD(capnet__limits_connecttodns); 1225 ATF_TC_BODY(capnet__limits_connecttodns, tc) 1226 { 1227 cap_channel_t *capnet; 1228 cap_net_limit_t *limit; 1229 struct addrinfo hints, *capres, *res; 1230 int family[] = { AF_INET }; 1231 int error; 1232 1233 capnet = create_network_service(); 1234 1235 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1236 CAPNET_NAME2ADDR); 1237 ATF_REQUIRE(limit != NULL); 1238 cap_net_limit_name2addr(limit, TEST_IPV4, "80"); 1239 cap_net_limit_name2addr_family(limit, family, 1); 1240 ATF_REQUIRE(cap_net_limit(limit) == 0); 1241 1242 memset(&hints, 0, sizeof(hints)); 1243 hints.ai_family = AF_INET; 1244 hints.ai_socktype = SOCK_STREAM; 1245 1246 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1247 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 1248 0); 1249 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1250 1251 for (res = capres; res != NULL; res = res->ai_next) { 1252 int s; 1253 1254 ATF_REQUIRE(res->ai_family == AF_INET); 1255 ATF_REQUIRE(res->ai_socktype == SOCK_STREAM); 1256 1257 s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); 1258 ATF_REQUIRE(s >= 0); 1259 1260 error = cap_connect(capnet, s, res->ai_addr, 1261 res->ai_addrlen); 1262 if (error != 0 && errno != ENOTCAPABLE) 1263 atf_tc_skip("unable to connect: %s", strerror(errno)); 1264 ATF_REQUIRE(error == 0); 1265 ATF_REQUIRE(close(s) == 0); 1266 } 1267 1268 freeaddrinfo(capres); 1269 cap_close(capnet); 1270 } 1271 1272 1273 ATF_TC_WITHOUT_HEAD(capnet__limits_deprecated_connecttodns); 1274 ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc) 1275 { 1276 cap_channel_t *capnet; 1277 cap_net_limit_t *limit; 1278 struct hostent *caphp; 1279 struct in_addr ipaddr; 1280 struct sockaddr_in connaddr; 1281 int family[] = { AF_INET }; 1282 int error, i; 1283 1284 capnet = create_network_service(); 1285 1286 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1287 CAPNET_DEPRECATED_NAME2ADDR); 1288 ATF_REQUIRE(limit != NULL); 1289 cap_net_limit_name2addr(limit, TEST_IPV4, NULL); 1290 cap_net_limit_name2addr_family(limit, family, 1); 1291 ATF_REQUIRE(cap_net_limit(limit) == 0); 1292 1293 memset(&ipaddr, 0, sizeof(ipaddr)); 1294 inet_pton(AF_INET, TEST_IPV4, &ipaddr); 1295 1296 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1297 caphp = cap_gethostbyname2(capnet, TEST_IPV4, AF_INET); 1298 ATF_REQUIRE(caphp != NULL); 1299 ATF_REQUIRE(caphp->h_addrtype == AF_INET); 1300 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1301 1302 for (i = 0; caphp->h_addr_list[i] != NULL; i++) { 1303 int s; 1304 1305 s = socket(AF_INET, SOCK_STREAM, 0); 1306 ATF_REQUIRE(s >= 0); 1307 1308 memset(&connaddr, 0, sizeof(connaddr)); 1309 connaddr.sin_family = AF_INET; 1310 memcpy((char *)&connaddr.sin_addr.s_addr, 1311 (char *)caphp->h_addr_list[i], caphp->h_length); 1312 connaddr.sin_port = htons(80); 1313 1314 error = cap_connect(capnet, s, (struct sockaddr *)&connaddr, 1315 sizeof(connaddr)); 1316 if (error != 0 && errno != ENOTCAPABLE) 1317 atf_tc_skip("unable to connect: %s", strerror(errno)); 1318 ATF_REQUIRE(error == 0); 1319 ATF_REQUIRE(close(s) == 0); 1320 } 1321 1322 cap_close(capnet); 1323 } 1324 1325 ATF_TP_ADD_TCS(tp) 1326 { 1327 1328 ATF_TP_ADD_TC(tp, capnet__connect); 1329 ATF_TP_ADD_TC(tp, capnet__bind); 1330 ATF_TP_ADD_TC(tp, capnet__getnameinfo); 1331 ATF_TP_ADD_TC(tp, capnet__getaddrinfo); 1332 ATF_TP_ADD_TC(tp, capnet__gethostbyname); 1333 ATF_TP_ADD_TC(tp, capnet__gethostbyaddr); 1334 1335 ATF_TP_ADD_TC(tp, capnet__getnameinfo_buffer); 1336 1337 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode); 1338 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family); 1339 ATF_TP_ADD_TC(tp, capnet__limits_addr2name); 1340 1341 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_mode); 1342 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_family); 1343 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name); 1344 1345 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_mode); 1346 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts); 1347 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_strict); 1348 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_mix); 1349 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_family); 1350 1351 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_mode); 1352 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_hosts); 1353 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_family); 1354 1355 ATF_TP_ADD_TC(tp, capnet__limits_bind_mode); 1356 ATF_TP_ADD_TC(tp, capnet__limits_bind); 1357 1358 ATF_TP_ADD_TC(tp, capnet__limits_connect_mode); 1359 ATF_TP_ADD_TC(tp, capnet__limits_connect_dns_mode); 1360 ATF_TP_ADD_TC(tp, capnet__limits_connect); 1361 1362 ATF_TP_ADD_TC(tp, capnet__limits_connecttodns); 1363 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_connecttodns); 1364 1365 return (atf_no_error()); 1366 } 1367