1 /*- 2 * Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org> 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 14 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 15 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 23 * POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/param.h> 27 #include <sys/nv.h> 28 #include <sys/socket.h> 29 #include <netinet/in.h> 30 #include <arpa/inet.h> 31 32 #include <errno.h> 33 #include <netdb.h> 34 35 #include <atf-c.h> 36 37 #include <libcasper.h> 38 #include <casper/cap_net.h> 39 40 #define TEST_DOMAIN_0 "example.com" 41 #define TEST_DOMAIN_1 "freebsd.org" 42 #define TEST_IPV4 "1.1.1.1" 43 #define TEST_IPV6 "2001:4860:4860::8888" 44 #define TEST_BIND_IPV4 "127.0.0.1" 45 #define TEST_PORT 80 46 #define TEST_PORT_STR "80" 47 48 static cap_channel_t * 49 create_network_service(void) 50 { 51 cap_channel_t *capcas, *capnet; 52 53 capcas = cap_init(); 54 ATF_REQUIRE(capcas != NULL); 55 56 capnet = cap_service_open(capcas, "system.net"); 57 ATF_REQUIRE(capnet != NULL); 58 59 cap_close(capcas); 60 return (capnet); 61 } 62 63 static int 64 test_getnameinfo_v4(cap_channel_t *chan, int family, const char *ip) 65 { 66 struct sockaddr_in ipaddr; 67 char capfn[MAXHOSTNAMELEN]; 68 char origfn[MAXHOSTNAMELEN]; 69 int capret, sysret; 70 71 memset(&ipaddr, 0, sizeof(ipaddr)); 72 ipaddr.sin_family = family; 73 inet_pton(family, ip, &ipaddr.sin_addr); 74 75 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 76 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 77 if (capret == EAI_SYSTEM && errno == ENOTCAPABLE) 78 return (ENOTCAPABLE); 79 80 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 81 sizeof(origfn), NULL, 0, NI_NAMEREQD); 82 if (sysret != 0) { 83 atf_tc_skip("getnameinfo(%s) failed: %s", 84 ip, gai_strerror(sysret)); 85 } 86 ATF_REQUIRE(capret == 0); 87 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 88 89 return (0); 90 } 91 92 static int 93 test_getnameinfo_v6(cap_channel_t *chan, const char *ip) 94 { 95 struct sockaddr_in6 ipaddr; 96 char capfn[MAXHOSTNAMELEN]; 97 char origfn[MAXHOSTNAMELEN]; 98 int capret, sysret; 99 100 memset(&ipaddr, 0, sizeof(ipaddr)); 101 ipaddr.sin6_family = AF_INET6; 102 inet_pton(AF_INET6, ip, &ipaddr.sin6_addr); 103 104 capret = cap_getnameinfo(chan, (struct sockaddr *)&ipaddr, sizeof(ipaddr), 105 capfn, sizeof(capfn), NULL, 0, NI_NAMEREQD); 106 if (capret == EAI_SYSTEM && errno == ENOTCAPABLE) 107 return (ENOTCAPABLE); 108 109 sysret = getnameinfo((struct sockaddr *)&ipaddr, sizeof(ipaddr), origfn, 110 sizeof(origfn), NULL, 0, NI_NAMEREQD); 111 if (sysret != 0) { 112 atf_tc_skip("getnameinfo(%s) failed: %s", 113 ip, gai_strerror(sysret)); 114 } 115 ATF_REQUIRE(capret == 0); 116 ATF_REQUIRE(strcmp(origfn, capfn) == 0); 117 118 return (0); 119 } 120 121 static int 122 test_getnameinfo(cap_channel_t *chan, int family, const char *ip) 123 { 124 125 if (family == AF_INET6) { 126 return (test_getnameinfo_v6(chan, ip)); 127 } 128 129 return (test_getnameinfo_v4(chan, family, ip)); 130 } 131 132 static int 133 test_gethostbyaddr_v4(cap_channel_t *chan, int family, const char *ip) 134 { 135 struct in_addr ipaddr; 136 struct hostent *caphp, *orighp; 137 138 memset(&ipaddr, 0, sizeof(ipaddr)); 139 inet_pton(AF_INET, ip, &ipaddr); 140 141 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), family); 142 if (caphp == NULL && h_errno == ENOTCAPABLE) 143 return (ENOTCAPABLE); 144 145 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), family); 146 if (orighp == NULL) 147 atf_tc_skip("gethostbyaddr(%s) failed", ip); 148 ATF_REQUIRE(caphp != NULL); 149 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0); 150 151 return (0); 152 } 153 154 static int 155 test_gethostbyaddr_v6(cap_channel_t *chan, const char *ip) 156 { 157 struct in6_addr ipaddr; 158 struct hostent *caphp, *orighp; 159 160 memset(&ipaddr, 0, sizeof(ipaddr)); 161 inet_pton(AF_INET6, ip, &ipaddr); 162 163 caphp = cap_gethostbyaddr(chan, &ipaddr, sizeof(ipaddr), AF_INET6); 164 if (caphp == NULL && h_errno == ENOTCAPABLE) 165 return (ENOTCAPABLE); 166 167 orighp = gethostbyaddr(&ipaddr, sizeof(ipaddr), AF_INET6); 168 if (orighp == NULL) 169 atf_tc_skip("gethostbyaddr(%s) failed", ip); 170 ATF_REQUIRE(caphp != NULL); 171 ATF_REQUIRE(strcmp(orighp->h_name, caphp->h_name) == 0); 172 173 return (0); 174 } 175 176 static int 177 test_gethostbyaddr(cap_channel_t *chan, int family, const char *ip) 178 { 179 180 if (family == AF_INET6) { 181 return (test_gethostbyaddr_v6(chan, ip)); 182 } else { 183 return (test_gethostbyaddr_v4(chan, family, ip)); 184 } 185 } 186 187 static int 188 test_getaddrinfo(cap_channel_t *chan, int family, const char *domain, 189 const char *servname) 190 { 191 struct addrinfo hints, *capres, *origres, *res0, *res1; 192 bool found; 193 int capret, sysret; 194 195 memset(&hints, 0, sizeof(hints)); 196 hints.ai_family = family; 197 hints.ai_socktype = SOCK_STREAM; 198 199 capret = cap_getaddrinfo(chan, domain, servname, &hints, &capres); 200 if (capret == EAI_SYSTEM && errno == ENOTCAPABLE) 201 return (ENOTCAPABLE); 202 203 sysret = getaddrinfo(domain, servname, &hints, &origres); 204 if (sysret != 0) 205 atf_tc_skip("getaddrinfo(%s) failed: %s", 206 domain, gai_strerror(sysret)); 207 ATF_REQUIRE(capret == 0); 208 209 for (res0 = capres; res0 != NULL; res0 = res0->ai_next) { 210 found = false; 211 for (res1 = origres; res1 != NULL; res1 = res1->ai_next) { 212 if (res1->ai_addrlen == res0->ai_addrlen && 213 memcmp(res1->ai_addr, res0->ai_addr, 214 res0->ai_addrlen) == 0) { 215 found = true; 216 break; 217 } 218 } 219 ATF_REQUIRE(found); 220 } 221 222 freeaddrinfo(capres); 223 freeaddrinfo(origres); 224 return (0); 225 } 226 227 static int 228 test_gethostbyname(cap_channel_t *chan, int family, const char *domain) 229 { 230 struct hostent *caphp, *orighp; 231 232 caphp = cap_gethostbyname2(chan, domain, family); 233 if (caphp == NULL && h_errno == ENOTCAPABLE) 234 return (h_errno); 235 236 orighp = gethostbyname2(domain, family); 237 if (orighp == NULL) 238 atf_tc_skip("gethostbyname2(%s) failed", domain); 239 240 ATF_REQUIRE(caphp != NULL); 241 ATF_REQUIRE(strcmp(caphp->h_name, orighp->h_name) == 0); 242 return (0); 243 } 244 245 static int 246 test_bind(cap_channel_t *chan, const char *ip) 247 { 248 struct sockaddr_in ipv4; 249 int capfd, ret, serrno; 250 251 capfd = socket(AF_INET, SOCK_STREAM, 0); 252 ATF_REQUIRE(capfd > 0); 253 254 memset(&ipv4, 0, sizeof(ipv4)); 255 ipv4.sin_family = AF_INET; 256 inet_pton(AF_INET, ip, &ipv4.sin_addr); 257 258 ret = cap_bind(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 259 serrno = errno; 260 close(capfd); 261 262 return (ret < 0 ? serrno : 0); 263 } 264 265 static int 266 test_connect(cap_channel_t *chan, const char *ip, unsigned short port) 267 { 268 struct sockaddr_in ipv4; 269 int capfd, ret, serrno; 270 271 capfd = socket(AF_INET, SOCK_STREAM, 0); 272 ATF_REQUIRE(capfd >= 0); 273 274 memset(&ipv4, 0, sizeof(ipv4)); 275 ipv4.sin_family = AF_INET; 276 ipv4.sin_port = htons(port); 277 inet_pton(AF_INET, ip, &ipv4.sin_addr); 278 279 ret = cap_connect(chan, capfd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 280 serrno = errno; 281 ATF_REQUIRE(close(capfd) == 0); 282 283 if (ret < 0 && serrno != ENOTCAPABLE) { 284 int sd; 285 286 /* 287 * If the connection failed, it might be because we can't reach 288 * the destination host. To check, try a plain connect() and 289 * see if it fails with the same error. 290 */ 291 sd = socket(AF_INET, SOCK_STREAM, 0); 292 ATF_REQUIRE(sd >= 0); 293 294 memset(&ipv4, 0, sizeof(ipv4)); 295 ipv4.sin_family = AF_INET; 296 ipv4.sin_port = htons(port); 297 inet_pton(AF_INET, ip, &ipv4.sin_addr); 298 ret = connect(sd, (struct sockaddr *)&ipv4, sizeof(ipv4)); 299 ATF_REQUIRE(ret < 0); 300 ATF_REQUIRE_MSG(errno == serrno, "errno %d != serrno %d", 301 errno, serrno); 302 ATF_REQUIRE(close(sd) == 0); 303 atf_tc_skip("connect(%s:%d) failed: %s", 304 ip, port, strerror(serrno)); 305 } 306 307 return (ret < 0 ? serrno : 0); 308 } 309 310 static void 311 test_extend_mode(cap_channel_t *capnet, int current) 312 { 313 cap_net_limit_t *limit; 314 const int rights[] = { 315 CAPNET_ADDR2NAME, 316 CAPNET_NAME2ADDR, 317 CAPNET_DEPRECATED_ADDR2NAME, 318 CAPNET_DEPRECATED_NAME2ADDR, 319 CAPNET_CONNECT, 320 CAPNET_BIND, 321 CAPNET_CONNECTDNS 322 }; 323 size_t i; 324 325 for (i = 0; i < nitems(rights); i++) { 326 if (current == rights[i]) 327 continue; 328 329 limit = cap_net_limit_init(capnet, current | rights[i]); 330 ATF_REQUIRE(limit != NULL); 331 ATF_REQUIRE(cap_net_limit(limit) != 0); 332 } 333 } 334 335 ATF_TC(capnet__getnameinfo); 336 ATF_TC_HEAD(capnet__getnameinfo, tc) 337 { 338 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 339 } 340 ATF_TC_BODY(capnet__getnameinfo, tc) 341 { 342 cap_channel_t *capnet; 343 344 capnet = create_network_service(); 345 346 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 347 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 348 349 cap_close(capnet); 350 } 351 352 ATF_TC(capnet__connect); 353 ATF_TC_HEAD(capnet__connect, tc) 354 { 355 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 356 } 357 ATF_TC_BODY(capnet__connect, tc) 358 { 359 cap_channel_t *capnet; 360 361 capnet = create_network_service(); 362 363 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 364 365 cap_close(capnet); 366 } 367 368 ATF_TC(capnet__bind); 369 ATF_TC_HEAD(capnet__bind, tc) 370 { 371 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 372 } 373 ATF_TC_BODY(capnet__bind, tc) 374 { 375 cap_channel_t *capnet; 376 377 capnet = create_network_service(); 378 379 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 380 381 cap_close(capnet); 382 } 383 384 ATF_TC(capnet__getaddrinfo); 385 ATF_TC_HEAD(capnet__getaddrinfo, tc) 386 { 387 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 388 } 389 ATF_TC_BODY(capnet__getaddrinfo, tc) 390 { 391 cap_channel_t *capnet; 392 struct addrinfo hints, *capres; 393 394 capnet = create_network_service(); 395 396 memset(&hints, 0, sizeof(hints)); 397 hints.ai_family = AF_INET; 398 hints.ai_socktype = SOCK_STREAM; 399 400 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 401 0); 402 403 cap_close(capnet); 404 } 405 406 ATF_TC(capnet__gethostbyname); 407 ATF_TC_HEAD(capnet__gethostbyname, tc) 408 { 409 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 410 } 411 ATF_TC_BODY(capnet__gethostbyname, tc) 412 { 413 cap_channel_t *capnet; 414 415 capnet = create_network_service(); 416 417 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 418 419 cap_close(capnet); 420 } 421 422 ATF_TC(capnet__gethostbyaddr); 423 ATF_TC_HEAD(capnet__gethostbyaddr, tc) 424 { 425 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 426 } 427 ATF_TC_BODY(capnet__gethostbyaddr, tc) 428 { 429 cap_channel_t *capnet; 430 431 capnet = create_network_service(); 432 433 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 434 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 435 436 cap_close(capnet); 437 } 438 439 ATF_TC(capnet__getnameinfo_buffer); 440 ATF_TC_HEAD(capnet__getnameinfo_buffer, tc) 441 { 442 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 443 } 444 ATF_TC_BODY(capnet__getnameinfo_buffer, tc) 445 { 446 cap_channel_t *chan; 447 struct sockaddr_in sin; 448 int ret; 449 struct { 450 char host[sizeof(TEST_IPV4)]; 451 char host_canary; 452 char serv[sizeof(TEST_PORT_STR)]; 453 char serv_canary; 454 } buffers; 455 456 memset(&sin, 0, sizeof(sin)); 457 sin.sin_family = AF_INET; 458 sin.sin_port = htons(TEST_PORT); 459 ret = inet_pton(AF_INET, TEST_IPV4, &sin.sin_addr); 460 ATF_REQUIRE_EQ(1, ret); 461 462 memset(&buffers, '!', sizeof(buffers)); 463 464 chan = create_network_service(); 465 ret = cap_getnameinfo(chan, (struct sockaddr *)&sin, sizeof(sin), 466 buffers.host, sizeof(buffers.host), 467 buffers.serv, sizeof(buffers.serv), 468 NI_NUMERICHOST | NI_NUMERICSERV); 469 ATF_REQUIRE_EQ_MSG(0, ret, "%d", ret); 470 471 // Verify that cap_getnameinfo worked with minimally sized buffers. 472 ATF_CHECK_EQ(0, strcmp(TEST_IPV4, buffers.host)); 473 ATF_CHECK_EQ(0, strcmp(TEST_PORT_STR, buffers.serv)); 474 475 // Verify that cap_getnameinfo did not overflow the buffers. 476 ATF_CHECK_EQ('!', buffers.host_canary); 477 ATF_CHECK_EQ('!', buffers.serv_canary); 478 479 cap_close(chan); 480 } 481 482 ATF_TC(capnet__limits_addr2name_mode); 483 ATF_TC_HEAD(capnet__limits_addr2name_mode, tc) 484 { 485 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 486 } 487 ATF_TC_BODY(capnet__limits_addr2name_mode, tc) 488 { 489 cap_channel_t *capnet; 490 cap_net_limit_t *limit; 491 492 capnet = create_network_service(); 493 494 /* LIMIT */ 495 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 496 ATF_REQUIRE(limit != NULL); 497 ATF_REQUIRE(cap_net_limit(limit) == 0); 498 499 /* ALLOWED */ 500 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 501 502 /* DISALLOWED */ 503 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 504 ENOTCAPABLE); 505 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 506 ENOTCAPABLE); 507 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 508 ENOTCAPABLE); 509 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 510 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 511 512 test_extend_mode(capnet, CAPNET_ADDR2NAME); 513 514 cap_close(capnet); 515 } 516 517 ATF_TC(capnet__limits_addr2name_family); 518 ATF_TC_HEAD(capnet__limits_addr2name_family, tc) 519 { 520 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 521 } 522 ATF_TC_BODY(capnet__limits_addr2name_family, tc) 523 { 524 cap_channel_t *capnet; 525 cap_net_limit_t *limit; 526 int family[] = { AF_INET6, AF_INET }; 527 528 capnet = create_network_service(); 529 530 /* Limit to AF_INET6 and AF_INET. */ 531 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 532 ATF_REQUIRE(limit != NULL); 533 cap_net_limit_addr2name_family(limit, family, nitems(family)); 534 ATF_REQUIRE(cap_net_limit(limit) == 0); 535 536 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 537 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 538 539 /* Limit to AF_INET6 and AF_INET. */ 540 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 541 ATF_REQUIRE(limit != NULL); 542 cap_net_limit_addr2name_family(limit, &family[0], 1); 543 cap_net_limit_addr2name_family(limit, &family[1], 1); 544 ATF_REQUIRE(cap_net_limit(limit) == 0); 545 546 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 547 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 548 549 /* Limit to AF_INET6. */ 550 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 551 ATF_REQUIRE(limit != NULL); 552 cap_net_limit_addr2name_family(limit, family, 1); 553 ATF_REQUIRE(cap_net_limit(limit) == 0); 554 555 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 556 ENOTCAPABLE); 557 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 558 559 /* Unable to set empty limits. Empty limits means full access. */ 560 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 561 ATF_REQUIRE(cap_net_limit(limit) != 0); 562 563 cap_close(capnet); 564 } 565 566 ATF_TC(capnet__limits_addr2name); 567 ATF_TC_HEAD(capnet__limits_addr2name, tc) 568 { 569 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 570 } 571 ATF_TC_BODY(capnet__limits_addr2name, tc) 572 { 573 cap_channel_t *capnet; 574 cap_net_limit_t *limit; 575 struct sockaddr_in ipaddrv4; 576 struct sockaddr_in6 ipaddrv6; 577 578 capnet = create_network_service(); 579 580 /* Limit to TEST_IPV4 and TEST_IPV6. */ 581 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 582 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 583 584 ipaddrv4.sin_family = AF_INET; 585 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr); 586 587 ipaddrv6.sin6_family = AF_INET6; 588 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr); 589 590 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 591 ATF_REQUIRE(limit != NULL); 592 593 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 594 sizeof(ipaddrv4)); 595 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 596 sizeof(ipaddrv6)); 597 ATF_REQUIRE(cap_net_limit(limit) == 0); 598 599 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 600 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); 601 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 602 ENOTCAPABLE); 603 604 /* Limit to AF_INET. */ 605 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 606 ATF_REQUIRE(limit != NULL); 607 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 608 sizeof(ipaddrv4)); 609 ATF_REQUIRE(cap_net_limit(limit) == 0); 610 611 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); 612 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 613 ENOTCAPABLE); 614 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, "127.0.0.1") == 615 ENOTCAPABLE); 616 617 /* Unable to set empty limits. Empty limits means full access. */ 618 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 619 ATF_REQUIRE(cap_net_limit(limit) != 0); 620 621 cap_close(capnet); 622 } 623 624 ATF_TC(capnet__limits_deprecated_addr2name_mode); 625 ATF_TC_HEAD(capnet__limits_deprecated_addr2name_mode, tc) 626 { 627 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 628 } 629 ATF_TC_BODY(capnet__limits_deprecated_addr2name_mode, tc) 630 { 631 cap_channel_t *capnet; 632 cap_net_limit_t *limit; 633 634 capnet = create_network_service(); 635 636 /* LIMIT */ 637 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 638 ATF_REQUIRE(limit != NULL); 639 ATF_REQUIRE(cap_net_limit(limit) == 0); 640 641 /* ALLOWED */ 642 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 643 644 /* DISALLOWED */ 645 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 646 ENOTCAPABLE); 647 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 648 ENOTCAPABLE); 649 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 650 ENOTCAPABLE); 651 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 652 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 653 654 cap_close(capnet); 655 } 656 657 ATF_TC(capnet__limits_deprecated_addr2name_family); 658 ATF_TC_HEAD(capnet__limits_deprecated_addr2name_family, tc) 659 { 660 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 661 } 662 ATF_TC_BODY(capnet__limits_deprecated_addr2name_family, tc) 663 { 664 cap_channel_t *capnet; 665 cap_net_limit_t *limit; 666 int family[] = { AF_INET6, AF_INET }; 667 668 capnet = create_network_service(); 669 670 /* Limit to AF_INET6 and AF_INET. */ 671 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 672 ATF_REQUIRE(limit != NULL); 673 cap_net_limit_addr2name_family(limit, family, nitems(family)); 674 ATF_REQUIRE(cap_net_limit(limit) == 0); 675 676 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 677 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 678 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 679 ENOTCAPABLE); 680 681 /* Limit to AF_INET6 and AF_INET. */ 682 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 683 ATF_REQUIRE(limit != NULL); 684 cap_net_limit_addr2name_family(limit, &family[0], 1); 685 cap_net_limit_addr2name_family(limit, &family[1], 1); 686 ATF_REQUIRE(cap_net_limit(limit) == 0); 687 688 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 689 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 690 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 691 ENOTCAPABLE); 692 693 /* Limit to AF_INET6. */ 694 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 695 ATF_REQUIRE(limit != NULL); 696 cap_net_limit_addr2name_family(limit, family, 1); 697 ATF_REQUIRE(cap_net_limit(limit) == 0); 698 699 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 700 ENOTCAPABLE); 701 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 702 ATF_REQUIRE(test_gethostbyaddr(capnet, PF_LINK, TEST_IPV4) == 703 ENOTCAPABLE); 704 705 /* Unable to set empty limits. Empty limits means full access. */ 706 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 707 ATF_REQUIRE(cap_net_limit(limit) != 0); 708 709 cap_close(capnet); 710 } 711 712 ATF_TC(capnet__limits_deprecated_addr2name); 713 ATF_TC_HEAD(capnet__limits_deprecated_addr2name, tc) 714 { 715 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 716 } 717 ATF_TC_BODY(capnet__limits_deprecated_addr2name, tc) 718 { 719 cap_channel_t *capnet; 720 cap_net_limit_t *limit; 721 struct in_addr ipaddrv4; 722 struct in6_addr ipaddrv6; 723 724 capnet = create_network_service(); 725 726 /* Limit to TEST_IPV4 and TEST_IPV6. */ 727 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 728 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 729 730 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4); 731 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6); 732 733 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 734 ATF_REQUIRE(limit != NULL); 735 736 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 737 sizeof(ipaddrv4)); 738 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 739 sizeof(ipaddrv6)); 740 ATF_REQUIRE(cap_net_limit(limit) == 0); 741 742 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 743 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); 744 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 745 ENOTCAPABLE); 746 747 /* Limit to AF_INET. */ 748 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 749 ATF_REQUIRE(limit != NULL); 750 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 751 sizeof(ipaddrv4)); 752 ATF_REQUIRE(cap_net_limit(limit) == 0); 753 754 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); 755 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 756 ENOTCAPABLE); 757 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, "127.0.0.1") == 758 ENOTCAPABLE); 759 760 /* Unable to set empty limits. Empty limits means full access. */ 761 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_ADDR2NAME); 762 ATF_REQUIRE(cap_net_limit(limit) != 0); 763 764 cap_close(capnet); 765 } 766 767 768 ATF_TC(capnet__limits_name2addr_mode); 769 ATF_TC_HEAD(capnet__limits_name2addr_mode, tc) 770 { 771 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 772 } 773 ATF_TC_BODY(capnet__limits_name2addr_mode, tc) 774 { 775 cap_channel_t *capnet; 776 cap_net_limit_t *limit; 777 778 capnet = create_network_service(); 779 780 /* LIMIT */ 781 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 782 ATF_REQUIRE(limit != NULL); 783 ATF_REQUIRE(cap_net_limit(limit) == 0); 784 785 /* ALLOWED */ 786 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 787 0); 788 789 /* DISALLOWED */ 790 ATF_REQUIRE( 791 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 792 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 793 ENOTCAPABLE); 794 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 795 ENOTCAPABLE); 796 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 797 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 798 799 test_extend_mode(capnet, CAPNET_ADDR2NAME); 800 801 cap_close(capnet); 802 } 803 804 ATF_TC(capnet__limits_name2addr_hosts); 805 ATF_TC_HEAD(capnet__limits_name2addr_hosts, tc) 806 { 807 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 808 } 809 ATF_TC_BODY(capnet__limits_name2addr_hosts, tc) 810 { 811 cap_channel_t *capnet; 812 cap_net_limit_t *limit; 813 814 capnet = create_network_service(); 815 816 /* Limit to TEST_DOMAIN_0 and localhost only. */ 817 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 818 ATF_REQUIRE(limit != NULL); 819 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 820 cap_net_limit_name2addr(limit, "localhost", NULL); 821 ATF_REQUIRE(cap_net_limit(limit) == 0); 822 823 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 824 0); 825 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 0); 826 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 827 ENOTCAPABLE); 828 829 /* Limit to TEST_DOMAIN_0 only. */ 830 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 831 ATF_REQUIRE(limit != NULL); 832 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 833 ATF_REQUIRE(cap_net_limit(limit) == 0); 834 835 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, "localhost", NULL) == 836 ENOTCAPABLE); 837 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 838 ENOTCAPABLE); 839 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 840 0); 841 842 /* Unable to set empty limits. Empty limits means full access. */ 843 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 844 ATF_REQUIRE(cap_net_limit(limit) != 0); 845 846 /* Try to extend the limit. */ 847 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 848 ATF_REQUIRE(limit != NULL); 849 cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL); 850 ATF_REQUIRE(cap_net_limit(limit) != 0); 851 852 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 853 ATF_REQUIRE(limit != NULL); 854 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 855 cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL); 856 ATF_REQUIRE(cap_net_limit(limit) != 0); 857 858 cap_close(capnet); 859 } 860 861 ATF_TC(capnet__limits_name2addr_hosts_servnames_strict); 862 ATF_TC_HEAD(capnet__limits_name2addr_hosts_servnames_strict, tc) 863 { 864 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 865 } 866 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_strict, tc) 867 { 868 cap_channel_t *capnet; 869 cap_net_limit_t *limit; 870 871 capnet = create_network_service(); 872 873 /* 874 * Limit to TEST_DOMAIN_0 and HTTP service. 875 */ 876 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 877 ATF_REQUIRE(limit != NULL); 878 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, "http"); 879 ATF_REQUIRE(cap_net_limit(limit) == 0); 880 881 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 882 0); 883 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 884 ENOTCAPABLE); 885 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "snmp") == 886 ENOTCAPABLE); 887 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 888 ENOTCAPABLE); 889 890 /* Unable to set empty limits. Empty limits means full access. */ 891 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 892 ATF_REQUIRE(cap_net_limit(limit) != 0); 893 894 cap_close(capnet); 895 } 896 897 ATF_TC(capnet__limits_name2addr_hosts_servnames_mix); 898 ATF_TC_HEAD(capnet__limits_name2addr_hosts_servnames_mix, tc) 899 { 900 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 901 } 902 ATF_TC_BODY(capnet__limits_name2addr_hosts_servnames_mix, tc) 903 { 904 cap_channel_t *capnet; 905 cap_net_limit_t *limit; 906 907 capnet = create_network_service(); 908 909 /* 910 * Limit to TEST_DOMAIN_0 and any servnamex, and any domain with 911 * servname HTTP. 912 */ 913 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 914 ATF_REQUIRE(limit != NULL); 915 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 916 cap_net_limit_name2addr(limit, NULL, "http"); 917 ATF_REQUIRE(cap_net_limit(limit) == 0); 918 919 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 920 0); 921 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 922 0); 923 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 924 0); 925 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 926 0); 927 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 928 ENOTCAPABLE); 929 930 /* Limit to HTTP servname only. */ 931 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 932 ATF_REQUIRE(limit != NULL); 933 cap_net_limit_name2addr(limit, NULL, "http"); 934 ATF_REQUIRE(cap_net_limit(limit) == 0); 935 936 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, "http") == 937 0); 938 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 939 ENOTCAPABLE); 940 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "http") == 941 0); 942 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 943 ENOTCAPABLE); 944 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, "snmp") == 945 ENOTCAPABLE); 946 947 /* Unable to set empty limits. Empty limits means full access. */ 948 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 949 ATF_REQUIRE(cap_net_limit(limit) != 0); 950 951 cap_close(capnet); 952 } 953 954 ATF_TC(capnet__limits_name2addr_family); 955 ATF_TC_HEAD(capnet__limits_name2addr_family, tc) 956 { 957 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 958 } 959 ATF_TC_BODY(capnet__limits_name2addr_family, tc) 960 { 961 cap_channel_t *capnet; 962 cap_net_limit_t *limit; 963 int family[] = { AF_INET6, AF_INET }; 964 965 capnet = create_network_service(); 966 967 /* Limit to AF_INET and AF_INET6. */ 968 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 969 ATF_REQUIRE(limit != NULL); 970 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 971 cap_net_limit_name2addr_family(limit, family, nitems(family)); 972 ATF_REQUIRE(cap_net_limit(limit) == 0); 973 974 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 975 0); 976 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 977 0); 978 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 979 ENOTCAPABLE); 980 981 /* Limit to AF_INET and AF_INET6. */ 982 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 983 ATF_REQUIRE(limit != NULL); 984 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 985 cap_net_limit_name2addr_family(limit, &family[0], 1); 986 cap_net_limit_name2addr_family(limit, &family[1], 1); 987 ATF_REQUIRE(cap_net_limit(limit) == 0); 988 989 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 990 0); 991 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 992 0); 993 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 994 ENOTCAPABLE); 995 996 /* Limit to AF_INET6 only. */ 997 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 998 ATF_REQUIRE(limit != NULL); 999 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1000 cap_net_limit_name2addr_family(limit, family, 1); 1001 ATF_REQUIRE(cap_net_limit(limit) == 0); 1002 1003 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1004 ENOTCAPABLE); 1005 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET6, TEST_DOMAIN_0, NULL) == 1006 0); 1007 ATF_REQUIRE(test_getaddrinfo(capnet, PF_LINK, TEST_DOMAIN_0, NULL) == 1008 ENOTCAPABLE); 1009 1010 /* Unable to set empty limits. Empty limits means full access. */ 1011 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 1012 ATF_REQUIRE(cap_net_limit(limit) != 0); 1013 1014 cap_close(capnet); 1015 } 1016 1017 ATF_TC(capnet__limits_deprecated_name2addr_mode); 1018 ATF_TC_HEAD(capnet__limits_deprecated_name2addr_mode, tc) 1019 { 1020 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1021 } 1022 ATF_TC_BODY(capnet__limits_deprecated_name2addr_mode, tc) 1023 { 1024 cap_channel_t *capnet; 1025 cap_net_limit_t *limit; 1026 1027 capnet = create_network_service(); 1028 1029 /* LIMIT */ 1030 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1031 ATF_REQUIRE(limit != NULL); 1032 ATF_REQUIRE(cap_net_limit(limit) == 0); 1033 1034 /* ALLOWED */ 1035 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1036 1037 /* DISALLOWED */ 1038 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1039 ENOTCAPABLE); 1040 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1041 ENOTCAPABLE); 1042 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1043 ENOTCAPABLE); 1044 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1045 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 1046 1047 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1048 1049 cap_close(capnet); 1050 } 1051 1052 ATF_TC(capnet__limits_deprecated_name2addr_hosts); 1053 ATF_TC_HEAD(capnet__limits_deprecated_name2addr_hosts, tc) 1054 { 1055 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1056 } 1057 ATF_TC_BODY(capnet__limits_deprecated_name2addr_hosts, tc) 1058 { 1059 cap_channel_t *capnet; 1060 cap_net_limit_t *limit; 1061 1062 capnet = create_network_service(); 1063 1064 /* Limit to TEST_DOMAIN_0 and localhost only. */ 1065 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1066 ATF_REQUIRE(limit != NULL); 1067 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1068 cap_net_limit_name2addr(limit, "localhost", NULL); 1069 ATF_REQUIRE(cap_net_limit(limit) == 0); 1070 1071 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1072 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, "localhost") == 0); 1073 ATF_REQUIRE( 1074 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 1075 1076 /* Limit to TEST_DOMAIN_0 only. */ 1077 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1078 ATF_REQUIRE(limit != NULL); 1079 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1080 ATF_REQUIRE(cap_net_limit(limit) == 0); 1081 1082 ATF_REQUIRE( 1083 test_gethostbyname(capnet, AF_INET, "localhost") == ENOTCAPABLE); 1084 ATF_REQUIRE( 1085 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_1) == ENOTCAPABLE); 1086 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1087 1088 /* Unable to set empty limits. Empty limits means full access. */ 1089 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1090 ATF_REQUIRE(cap_net_limit(limit) != 0); 1091 1092 cap_close(capnet); 1093 } 1094 1095 ATF_TC(capnet__limits_deprecated_name2addr_family); 1096 ATF_TC_HEAD(capnet__limits_deprecated_name2addr_family, tc) 1097 { 1098 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1099 } 1100 ATF_TC_BODY(capnet__limits_deprecated_name2addr_family, tc) 1101 { 1102 cap_channel_t *capnet; 1103 cap_net_limit_t *limit; 1104 int family[] = { AF_INET6, AF_INET }; 1105 1106 capnet = create_network_service(); 1107 1108 /* Limit to AF_INET and AF_INET6. */ 1109 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1110 ATF_REQUIRE(limit != NULL); 1111 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1112 cap_net_limit_name2addr_family(limit, family, nitems(family)); 1113 ATF_REQUIRE(cap_net_limit(limit) == 0); 1114 1115 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1116 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1117 ATF_REQUIRE( 1118 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1119 1120 /* Limit to AF_INET and AF_INET6. */ 1121 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1122 ATF_REQUIRE(limit != NULL); 1123 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1124 cap_net_limit_name2addr_family(limit, &family[0], 1); 1125 cap_net_limit_name2addr_family(limit, &family[1], 1); 1126 ATF_REQUIRE(cap_net_limit(limit) == 0); 1127 1128 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); 1129 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1130 ATF_REQUIRE( 1131 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1132 1133 /* Limit to AF_INET6 only. */ 1134 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1135 ATF_REQUIRE(limit != NULL); 1136 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1137 cap_net_limit_name2addr_family(limit, family, 1); 1138 ATF_REQUIRE(cap_net_limit(limit) == 0); 1139 1140 ATF_REQUIRE( 1141 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1142 ATF_REQUIRE(test_gethostbyname(capnet, AF_INET6, TEST_DOMAIN_0) == 0); 1143 ATF_REQUIRE( 1144 test_gethostbyname(capnet, PF_LINK, TEST_DOMAIN_0) == ENOTCAPABLE); 1145 1146 /* Unable to set empty limits. Empty limits means full access. */ 1147 limit = cap_net_limit_init(capnet, CAPNET_DEPRECATED_NAME2ADDR); 1148 ATF_REQUIRE(cap_net_limit(limit) != 0); 1149 1150 cap_close(capnet); 1151 } 1152 1153 ATF_TC(capnet__limits_bind_mode); 1154 ATF_TC_HEAD(capnet__limits_bind_mode, tc) 1155 { 1156 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1157 } 1158 ATF_TC_BODY(capnet__limits_bind_mode, tc) 1159 { 1160 cap_channel_t *capnet; 1161 cap_net_limit_t *limit; 1162 1163 capnet = create_network_service(); 1164 1165 /* LIMIT */ 1166 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1167 ATF_REQUIRE(limit != NULL); 1168 ATF_REQUIRE(cap_net_limit(limit) == 0); 1169 1170 /* ALLOWED */ 1171 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1172 1173 /* DISALLOWED */ 1174 ATF_REQUIRE( 1175 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1176 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1177 ENOTCAPABLE); 1178 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1179 ENOTCAPABLE); 1180 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1181 ENOTCAPABLE); 1182 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == ENOTCAPABLE); 1183 1184 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1185 1186 cap_close(capnet); 1187 } 1188 1189 ATF_TC(capnet__limits_bind); 1190 ATF_TC_HEAD(capnet__limits_bind, tc) 1191 { 1192 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1193 } 1194 ATF_TC_BODY(capnet__limits_bind, tc) 1195 { 1196 cap_channel_t *capnet; 1197 cap_net_limit_t *limit; 1198 struct sockaddr_in ipv4; 1199 1200 capnet = create_network_service(); 1201 1202 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1203 ATF_REQUIRE(limit != NULL); 1204 1205 memset(&ipv4, 0, sizeof(ipv4)); 1206 ipv4.sin_family = AF_INET; 1207 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr); 1208 1209 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1210 ATF_REQUIRE(cap_net_limit(limit) == 0); 1211 1212 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1213 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE); 1214 1215 cap_close(capnet); 1216 } 1217 1218 ATF_TC(capnet__limits_connect_mode); 1219 ATF_TC_HEAD(capnet__limits_connect_mode, tc) 1220 { 1221 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1222 } 1223 ATF_TC_BODY(capnet__limits_connect_mode, tc) 1224 { 1225 cap_channel_t *capnet; 1226 cap_net_limit_t *limit; 1227 1228 capnet = create_network_service(); 1229 1230 /* LIMIT */ 1231 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1232 ATF_REQUIRE(limit != NULL); 1233 ATF_REQUIRE(cap_net_limit(limit) == 0); 1234 1235 /* ALLOWED */ 1236 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1237 1238 /* DISALLOWED */ 1239 ATF_REQUIRE( 1240 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1241 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1242 ENOTCAPABLE); 1243 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1244 ENOTCAPABLE); 1245 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1246 ENOTCAPABLE); 1247 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1248 1249 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1250 1251 cap_close(capnet); 1252 } 1253 1254 ATF_TC(capnet__limits_connect_dns_mode); 1255 ATF_TC_HEAD(capnet__limits_connect_dns_mode, tc) 1256 { 1257 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1258 } 1259 ATF_TC_BODY(capnet__limits_connect_dns_mode, tc) 1260 { 1261 cap_channel_t *capnet; 1262 cap_net_limit_t *limit; 1263 1264 capnet = create_network_service(); 1265 1266 /* LIMIT */ 1267 limit = cap_net_limit_init(capnet, CAPNET_CONNECT | CAPNET_CONNECTDNS); 1268 ATF_REQUIRE(limit != NULL); 1269 ATF_REQUIRE(cap_net_limit(limit) == 0); 1270 1271 /* ALLOWED */ 1272 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1273 1274 /* DISALLOWED */ 1275 ATF_REQUIRE( 1276 test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == ENOTCAPABLE); 1277 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1278 ENOTCAPABLE); 1279 ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 1280 ENOTCAPABLE); 1281 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1282 ENOTCAPABLE); 1283 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == ENOTCAPABLE); 1284 1285 test_extend_mode(capnet, CAPNET_ADDR2NAME); 1286 1287 cap_close(capnet); 1288 } 1289 1290 ATF_TC(capnet__limits_connect); 1291 ATF_TC_HEAD(capnet__limits_connect, tc) 1292 { 1293 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1294 } 1295 ATF_TC_BODY(capnet__limits_connect, tc) 1296 { 1297 cap_channel_t *capnet; 1298 cap_net_limit_t *limit; 1299 struct sockaddr_in ipv4; 1300 1301 capnet = create_network_service(); 1302 1303 /* Limit only to TEST_IPV4 on port 80 and 443. */ 1304 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1305 ATF_REQUIRE(limit != NULL); 1306 memset(&ipv4, 0, sizeof(ipv4)); 1307 ipv4.sin_family = AF_INET; 1308 ipv4.sin_port = htons(80); 1309 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr); 1310 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1311 1312 ipv4.sin_port = htons(443); 1313 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1314 ATF_REQUIRE(cap_net_limit(limit) == 0); 1315 1316 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); 1317 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1318 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1319 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1320 1321 /* Limit only to TEST_IPV4 on port 443. */ 1322 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1323 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1324 ATF_REQUIRE(cap_net_limit(limit) == 0); 1325 1326 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 433) == ENOTCAPABLE); 1327 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 80) == ENOTCAPABLE); 1328 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1329 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 443) == 0); 1330 1331 /* Unable to set empty limits. Empty limits means full access. */ 1332 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1333 ATF_REQUIRE(cap_net_limit(limit) != 0); 1334 1335 cap_close(capnet); 1336 } 1337 1338 ATF_TC(capnet__limits_connecttodns); 1339 ATF_TC_HEAD(capnet__limits_connecttodns, tc) 1340 { 1341 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1342 } 1343 ATF_TC_BODY(capnet__limits_connecttodns, tc) 1344 { 1345 cap_channel_t *capnet; 1346 cap_net_limit_t *limit; 1347 struct addrinfo hints, *capres, *res; 1348 int family[] = { AF_INET }; 1349 int error; 1350 1351 capnet = create_network_service(); 1352 1353 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1354 CAPNET_NAME2ADDR); 1355 ATF_REQUIRE(limit != NULL); 1356 cap_net_limit_name2addr(limit, TEST_IPV4, "80"); 1357 cap_net_limit_name2addr_family(limit, family, 1); 1358 ATF_REQUIRE(cap_net_limit(limit) == 0); 1359 1360 memset(&hints, 0, sizeof(hints)); 1361 hints.ai_family = AF_INET; 1362 hints.ai_socktype = SOCK_STREAM; 1363 1364 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1365 ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == 1366 0); 1367 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1368 1369 for (res = capres; res != NULL; res = res->ai_next) { 1370 int s; 1371 1372 ATF_REQUIRE(res->ai_family == AF_INET); 1373 ATF_REQUIRE(res->ai_socktype == SOCK_STREAM); 1374 1375 s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); 1376 ATF_REQUIRE(s >= 0); 1377 1378 error = cap_connect(capnet, s, res->ai_addr, 1379 res->ai_addrlen); 1380 if (error != 0 && errno != ENOTCAPABLE) 1381 atf_tc_skip("unable to connect: %s", strerror(errno)); 1382 ATF_REQUIRE(error == 0); 1383 ATF_REQUIRE(close(s) == 0); 1384 } 1385 1386 freeaddrinfo(capres); 1387 cap_close(capnet); 1388 } 1389 1390 1391 ATF_TC(capnet__limits_deprecated_connecttodns); 1392 ATF_TC_HEAD(capnet__limits_deprecated_connecttodns, tc) 1393 { 1394 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1395 } 1396 ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc) 1397 { 1398 cap_channel_t *capnet; 1399 cap_net_limit_t *limit; 1400 struct hostent *caphp; 1401 struct in_addr ipaddr; 1402 struct sockaddr_in connaddr; 1403 int family[] = { AF_INET }; 1404 int error, i; 1405 1406 capnet = create_network_service(); 1407 1408 limit = cap_net_limit_init(capnet, CAPNET_CONNECTDNS | 1409 CAPNET_DEPRECATED_NAME2ADDR); 1410 ATF_REQUIRE(limit != NULL); 1411 cap_net_limit_name2addr(limit, TEST_IPV4, NULL); 1412 cap_net_limit_name2addr_family(limit, family, 1); 1413 ATF_REQUIRE(cap_net_limit(limit) == 0); 1414 1415 memset(&ipaddr, 0, sizeof(ipaddr)); 1416 inet_pton(AF_INET, TEST_IPV4, &ipaddr); 1417 1418 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1419 caphp = cap_gethostbyname2(capnet, TEST_IPV4, AF_INET); 1420 ATF_REQUIRE(caphp != NULL); 1421 ATF_REQUIRE(caphp->h_addrtype == AF_INET); 1422 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", 433) == ENOTCAPABLE); 1423 1424 for (i = 0; caphp->h_addr_list[i] != NULL; i++) { 1425 int s; 1426 1427 s = socket(AF_INET, SOCK_STREAM, 0); 1428 ATF_REQUIRE(s >= 0); 1429 1430 memset(&connaddr, 0, sizeof(connaddr)); 1431 connaddr.sin_family = AF_INET; 1432 memcpy((char *)&connaddr.sin_addr.s_addr, 1433 (char *)caphp->h_addr_list[i], caphp->h_length); 1434 connaddr.sin_port = htons(80); 1435 1436 error = cap_connect(capnet, s, (struct sockaddr *)&connaddr, 1437 sizeof(connaddr)); 1438 if (error != 0 && errno != ENOTCAPABLE) 1439 atf_tc_skip("unable to connect: %s", strerror(errno)); 1440 ATF_REQUIRE(error == 0); 1441 ATF_REQUIRE(close(s) == 0); 1442 } 1443 1444 cap_close(capnet); 1445 } 1446 1447 ATF_TC(capnet__limits_name2addr_partial_drops_family); 1448 ATF_TC_HEAD(capnet__limits_name2addr_partial_drops_family, tc) 1449 { 1450 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1451 } 1452 ATF_TC_BODY(capnet__limits_name2addr_partial_drops_family, tc) 1453 { 1454 cap_channel_t *capnet; 1455 cap_net_limit_t *limit; 1456 int family = AF_INET6; 1457 1458 capnet = create_network_service(); 1459 1460 /* Tighten: only AF_INET6 allowed under name2addr. */ 1461 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 1462 ATF_REQUIRE(limit != NULL); 1463 cap_net_limit_name2addr_family(limit, &family, 1); 1464 ATF_REQUIRE(cap_net_limit(limit) == 0); 1465 1466 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1467 ENOTCAPABLE); 1468 1469 /* Replacement omits "family"; must be rejected. */ 1470 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 1471 ATF_REQUIRE(limit != NULL); 1472 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1473 ATF_REQUIRE(cap_net_limit(limit) != 0); 1474 1475 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_0, NULL) == 1476 ENOTCAPABLE); 1477 1478 cap_close(capnet); 1479 } 1480 1481 ATF_TC(capnet__limits_name2addr_partial_drops_hosts); 1482 ATF_TC_HEAD(capnet__limits_name2addr_partial_drops_hosts, tc) 1483 { 1484 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1485 } 1486 ATF_TC_BODY(capnet__limits_name2addr_partial_drops_hosts, tc) 1487 { 1488 cap_channel_t *capnet; 1489 cap_net_limit_t *limit; 1490 int family = AF_INET; 1491 1492 capnet = create_network_service(); 1493 1494 /* Tighten: only TEST_DOMAIN_0 allowed. */ 1495 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 1496 ATF_REQUIRE(limit != NULL); 1497 cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL); 1498 ATF_REQUIRE(cap_net_limit(limit) == 0); 1499 1500 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 1501 ENOTCAPABLE); 1502 1503 /* Replacement omits "hosts"; must be rejected. */ 1504 limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR); 1505 ATF_REQUIRE(limit != NULL); 1506 cap_net_limit_name2addr_family(limit, &family, 1); 1507 ATF_REQUIRE(cap_net_limit(limit) != 0); 1508 1509 ATF_REQUIRE(test_getaddrinfo(capnet, AF_INET, TEST_DOMAIN_1, NULL) == 1510 ENOTCAPABLE); 1511 1512 cap_close(capnet); 1513 } 1514 1515 ATF_TC(capnet__limits_addr2name_partial_drops_family); 1516 ATF_TC_HEAD(capnet__limits_addr2name_partial_drops_family, tc) 1517 { 1518 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1519 } 1520 ATF_TC_BODY(capnet__limits_addr2name_partial_drops_family, tc) 1521 { 1522 cap_channel_t *capnet; 1523 cap_net_limit_t *limit; 1524 struct sockaddr_in ipaddrv4; 1525 int family = AF_INET6; 1526 1527 capnet = create_network_service(); 1528 1529 memset(&ipaddrv4, 0, sizeof(ipaddrv4)); 1530 ipaddrv4.sin_family = AF_INET; 1531 inet_pton(AF_INET, TEST_IPV4, &ipaddrv4.sin_addr); 1532 1533 /* Tighten: only AF_INET6 allowed under addr2name. */ 1534 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 1535 ATF_REQUIRE(limit != NULL); 1536 cap_net_limit_addr2name_family(limit, &family, 1); 1537 ATF_REQUIRE(cap_net_limit(limit) == 0); 1538 1539 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1540 ENOTCAPABLE); 1541 1542 /* Replacement omits "family". Must be rejected. */ 1543 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 1544 ATF_REQUIRE(limit != NULL); 1545 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv4, 1546 sizeof(ipaddrv4)); 1547 ATF_REQUIRE(cap_net_limit(limit) != 0); 1548 1549 ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 1550 ENOTCAPABLE); 1551 1552 cap_close(capnet); 1553 } 1554 1555 ATF_TC(capnet__limits_addr2name_partial_drops_sockaddr); 1556 ATF_TC_HEAD(capnet__limits_addr2name_partial_drops_sockaddr, tc) 1557 { 1558 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1559 } 1560 ATF_TC_BODY(capnet__limits_addr2name_partial_drops_sockaddr, tc) 1561 { 1562 cap_channel_t *capnet; 1563 cap_net_limit_t *limit; 1564 struct sockaddr_in6 ipaddrv6; 1565 int family = AF_INET6; 1566 1567 capnet = create_network_service(); 1568 1569 memset(&ipaddrv6, 0, sizeof(ipaddrv6)); 1570 ipaddrv6.sin6_family = AF_INET6; 1571 inet_pton(AF_INET6, TEST_IPV6, &ipaddrv6.sin6_addr); 1572 1573 /* Tighten: only TEST_IPV6 allowed under addr2name. */ 1574 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 1575 ATF_REQUIRE(limit != NULL); 1576 cap_net_limit_addr2name(limit, (struct sockaddr *)&ipaddrv6, 1577 sizeof(ipaddrv6)); 1578 ATF_REQUIRE(cap_net_limit(limit) == 0); 1579 1580 /* Replacement omits "sockaddr". Must be rejected. */ 1581 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 1582 ATF_REQUIRE(limit != NULL); 1583 cap_net_limit_addr2name_family(limit, &family, 1); 1584 ATF_REQUIRE(cap_net_limit(limit) != 0); 1585 1586 cap_close(capnet); 1587 } 1588 1589 /* 1590 * The public helpers drop empty sublimits during pack, so the empty-{} 1591 * variant is only reachable via libnv + cap_limit_set() directly. 1592 */ 1593 ATF_TC(capnet__limits_connect_partial_drops_sockaddr); 1594 ATF_TC_HEAD(capnet__limits_connect_partial_drops_sockaddr, tc) 1595 { 1596 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1597 } 1598 ATF_TC_BODY(capnet__limits_connect_partial_drops_sockaddr, tc) 1599 { 1600 cap_channel_t *capnet; 1601 cap_net_limit_t *limit; 1602 struct sockaddr_in ipv4; 1603 nvlist_t *lnvl; 1604 1605 capnet = create_network_service(); 1606 1607 memset(&ipv4, 0, sizeof(ipv4)); 1608 ipv4.sin_family = AF_INET; 1609 ipv4.sin_port = htons(TEST_PORT); 1610 inet_pton(AF_INET, TEST_IPV4, &ipv4.sin_addr); 1611 1612 /* Tighten: only TEST_IPV4:TEST_PORT allowed under connect. */ 1613 limit = cap_net_limit_init(capnet, CAPNET_CONNECT); 1614 ATF_REQUIRE(limit != NULL); 1615 cap_net_limit_connect(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1616 ATF_REQUIRE(cap_net_limit(limit) == 0); 1617 1618 ATF_REQUIRE(test_connect(capnet, TEST_IPV4, TEST_PORT) == 0); 1619 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", TEST_PORT) == ENOTCAPABLE); 1620 1621 /* Build connect={} (no sockaddr subkey) directly. Must be rejected. */ 1622 lnvl = nvlist_create(0); 1623 nvlist_add_number(lnvl, "mode", CAPNET_CONNECT); 1624 nvlist_add_nvlist(lnvl, "connect", nvlist_create(0)); 1625 ATF_REQUIRE(cap_limit_set(capnet, lnvl) != 0); 1626 1627 ATF_REQUIRE(test_connect(capnet, "8.8.8.8", TEST_PORT) == ENOTCAPABLE); 1628 1629 cap_close(capnet); 1630 } 1631 1632 /* 1633 * The public helpers drop empty sublimits during pack, so the empty-{} 1634 * variant is only reachable via libnv + cap_limit_set() directly. 1635 */ 1636 ATF_TC(capnet__limits_bind_partial_drops_sockaddr); 1637 ATF_TC_HEAD(capnet__limits_bind_partial_drops_sockaddr, tc) 1638 { 1639 atf_tc_set_md_var(tc, "require.config", "allow_network_access"); 1640 } 1641 ATF_TC_BODY(capnet__limits_bind_partial_drops_sockaddr, tc) 1642 { 1643 cap_channel_t *capnet; 1644 cap_net_limit_t *limit; 1645 struct sockaddr_in ipv4; 1646 nvlist_t *lnvl; 1647 1648 capnet = create_network_service(); 1649 1650 memset(&ipv4, 0, sizeof(ipv4)); 1651 ipv4.sin_family = AF_INET; 1652 inet_pton(AF_INET, TEST_BIND_IPV4, &ipv4.sin_addr); 1653 1654 /* Tighten: only TEST_BIND_IPV4 allowed under bind. */ 1655 limit = cap_net_limit_init(capnet, CAPNET_BIND); 1656 ATF_REQUIRE(limit != NULL); 1657 cap_net_limit_bind(limit, (struct sockaddr *)&ipv4, sizeof(ipv4)); 1658 ATF_REQUIRE(cap_net_limit(limit) == 0); 1659 1660 ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); 1661 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE); 1662 1663 /* Build bind={} (no sockaddr subkey) directly. Must be rejected. */ 1664 lnvl = nvlist_create(0); 1665 nvlist_add_number(lnvl, "mode", CAPNET_BIND); 1666 nvlist_add_nvlist(lnvl, "bind", nvlist_create(0)); 1667 ATF_REQUIRE(cap_limit_set(capnet, lnvl) != 0); 1668 1669 ATF_REQUIRE(test_bind(capnet, "127.0.0.2") == ENOTCAPABLE); 1670 1671 cap_close(capnet); 1672 } 1673 1674 ATF_TP_ADD_TCS(tp) 1675 { 1676 1677 ATF_TP_ADD_TC(tp, capnet__connect); 1678 ATF_TP_ADD_TC(tp, capnet__bind); 1679 ATF_TP_ADD_TC(tp, capnet__getnameinfo); 1680 ATF_TP_ADD_TC(tp, capnet__getaddrinfo); 1681 ATF_TP_ADD_TC(tp, capnet__gethostbyname); 1682 ATF_TP_ADD_TC(tp, capnet__gethostbyaddr); 1683 1684 ATF_TP_ADD_TC(tp, capnet__getnameinfo_buffer); 1685 1686 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode); 1687 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family); 1688 ATF_TP_ADD_TC(tp, capnet__limits_addr2name); 1689 1690 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_mode); 1691 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name_family); 1692 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_addr2name); 1693 1694 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_mode); 1695 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts); 1696 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_strict); 1697 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_hosts_servnames_mix); 1698 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_family); 1699 1700 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_mode); 1701 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_hosts); 1702 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_name2addr_family); 1703 1704 ATF_TP_ADD_TC(tp, capnet__limits_bind_mode); 1705 ATF_TP_ADD_TC(tp, capnet__limits_bind); 1706 1707 ATF_TP_ADD_TC(tp, capnet__limits_connect_mode); 1708 ATF_TP_ADD_TC(tp, capnet__limits_connect_dns_mode); 1709 ATF_TP_ADD_TC(tp, capnet__limits_connect); 1710 1711 ATF_TP_ADD_TC(tp, capnet__limits_connecttodns); 1712 ATF_TP_ADD_TC(tp, capnet__limits_deprecated_connecttodns); 1713 1714 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_partial_drops_family); 1715 ATF_TP_ADD_TC(tp, capnet__limits_name2addr_partial_drops_hosts); 1716 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_partial_drops_family); 1717 ATF_TP_ADD_TC(tp, capnet__limits_addr2name_partial_drops_sockaddr); 1718 ATF_TP_ADD_TC(tp, capnet__limits_connect_partial_drops_sockaddr); 1719 ATF_TP_ADD_TC(tp, capnet__limits_bind_partial_drops_sockaddr); 1720 1721 return (atf_no_error()); 1722 } 1723