mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 17:18:32 +00:00
libcasper: Introduce cap_net a network service for Casper.
Reviewed by: emaste, markj (previous version), bcr (man page) Differential Revision: https://reviews.freebsd.org/D24688
This commit is contained in:
parent
f1780be99c
commit
832dc76b63
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=364276
|
@ -5,6 +5,7 @@
|
|||
SUBDIR= cap_dns
|
||||
SUBDIR+= cap_fileargs
|
||||
SUBDIR+= cap_grp
|
||||
SUBDIR+= cap_net
|
||||
SUBDIR+= cap_pwd
|
||||
SUBDIR+= cap_sysctl
|
||||
SUBDIR+= cap_syslog
|
||||
|
|
|
@ -27,11 +27,6 @@ SUBDIR.${MK_TESTS}+= tests
|
|||
MAN+= cap_dns.3
|
||||
|
||||
MLINKS+=cap_dns.3 libcap_dns.3
|
||||
MLINKS+=cap_dns.3 cap_gethostbyname.3
|
||||
MLINKS+=cap_dns.3 cap_gethostbyname2.3
|
||||
MLINKS+=cap_dns.3 cap_gethostbyaddr.3
|
||||
MLINKS+=cap_dns.3 cap_getaddrinfo.3
|
||||
MLINKS+=cap_dns.3 cap_getnameinfo.3
|
||||
MLINKS+=cap_dns.3 cap_dns_type_limit.3
|
||||
MLINKS+=cap_dns.3 cap_dns_family_limit.3
|
||||
|
||||
|
|
|
@ -24,7 +24,7 @@
|
|||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd May 5, 2020
|
||||
.Dd August 15, 2020
|
||||
.Dt CAP_DNS 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
@ -58,6 +58,9 @@
|
|||
.Fn cap_dns_family_limit "const cap_channel_t *chan" "const int *families" "size_t nfamilies"
|
||||
.Sh DESCRIPTION
|
||||
.Bf -symbolic
|
||||
This service is obsolete and
|
||||
.Xr cap_net 3
|
||||
should be used instead.
|
||||
The
|
||||
.Fn cap_getaddrinfo ,
|
||||
and
|
||||
|
|
48
lib/libcasper/services/cap_net/Makefile
Normal file
48
lib/libcasper/services/cap_net/Makefile
Normal file
|
@ -0,0 +1,48 @@
|
|||
# $FreeBSD$
|
||||
|
||||
SHLIBDIR?= /lib/casper
|
||||
|
||||
.include <src.opts.mk>
|
||||
|
||||
PACKAGE=libcasper
|
||||
|
||||
SHLIB_MAJOR= 1
|
||||
INCSDIR?= ${INCLUDEDIR}/casper
|
||||
|
||||
.if ${MK_CASPER} != "no"
|
||||
SHLIB= cap_net
|
||||
|
||||
SRCS= cap_net.c
|
||||
.endif
|
||||
|
||||
INCS= cap_net.h
|
||||
|
||||
LIBADD= nv
|
||||
|
||||
CFLAGS+=-I${.CURDIR}
|
||||
CFLAGS+=-DWITH_CASPER
|
||||
|
||||
HAS_TESTS=
|
||||
SUBDIR.${MK_TESTS}+= tests
|
||||
|
||||
MAN+= cap_net.3
|
||||
|
||||
MLINKS+=cap_net.3 libcap_net.3
|
||||
MLINKS+=cap_net.3 cap_bind.3
|
||||
MLINKS+=cap_net.3 cap_connect.3
|
||||
MLINKS+=cap_net.3 cap_net_free.3
|
||||
MLINKS+=cap_net.3 cap_net_limit.3
|
||||
MLINKS+=cap_net.3 cap_net_limit_addr2name.3
|
||||
MLINKS+=cap_net.3 cap_net_limit_addr2name_family.3
|
||||
MLINKS+=cap_net.3 cap_net_limit_bind.3
|
||||
MLINKS+=cap_net.3 cap_net_limit_connect.3
|
||||
MLINKS+=cap_net.3 cap_net_limit_init.3
|
||||
MLINKS+=cap_net.3 cap_net_limit_name2addr.3
|
||||
MLINKS+=cap_net.3 cap_net_limit_name2addr_family.3
|
||||
MLINKS+=cap_net.3 cap_getaddrinfo.3
|
||||
MLINKS+=cap_net.3 cap_gethostbyaddr.3
|
||||
MLINKS+=cap_net.3 cap_gethostbyname.3
|
||||
MLINKS+=cap_net.3 cap_gethostbyname2.3
|
||||
MLINKS+=cap_net.3 cap_getnameinfo.3
|
||||
|
||||
.include <bsd.lib.mk>
|
287
lib/libcasper/services/cap_net/cap_net.3
Normal file
287
lib/libcasper/services/cap_net/cap_net.3
Normal file
|
@ -0,0 +1,287 @@
|
|||
.\" Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org>
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
|
||||
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
|
||||
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
.\" SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd August 15, 2020
|
||||
.Dt CAP_NET 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm cap_bind ,
|
||||
.Nm cap_connect ,
|
||||
.Nm cap_getaddrinfo ,
|
||||
.Nm cap_gethostbyaddr ,
|
||||
.Nm cap_gethostbyname ,
|
||||
.Nm cap_gethostbyname2 ,
|
||||
.Nm cap_getnameinfo ,
|
||||
.Nm cap_net_free ,
|
||||
.Nm cap_net_limit ,
|
||||
.Nm cap_net_limit_addr2name ,
|
||||
.Nm cap_net_limit_addr2name_family ,
|
||||
.Nm cap_net_limit_bind ,
|
||||
.Nm cap_net_limit_connect ,
|
||||
.Nm cap_net_limit_init ,
|
||||
.Nm cap_net_limit_name2addr ,
|
||||
.Nm cap_net_limit_name2addr_family ,
|
||||
.Nd "library for networking in capability mode"
|
||||
.Sh LIBRARY
|
||||
.Lb libcap_net
|
||||
.Sh SYNOPSIS
|
||||
.In sys/nv.h
|
||||
.In libcasper.h
|
||||
.In casper/cap_net.h
|
||||
.Ft int
|
||||
.Fn cap_bind "cap_channel_t *chan" "int s" "const struct sockaddr *addr" "socklen_t addrlen"
|
||||
.Ft int
|
||||
.Fn cap_connect "cap_channel_t *chan" "int s" "const struct sockaddr *name" "socklen_t namelen"
|
||||
.Ft int
|
||||
.Fn cap_getaddrinfo "cap_channel_t *chan" "const char *hostname" "const char *servname" "const struct addrinfo *hints" "struct addrinfo **res"
|
||||
.Ft int
|
||||
.Fn cap_getnameinfo "cap_channel_t *chan" "const struct sockaddr *sa" "socklen_t salen" "char *host" "size_t hostlen" "char *serv" "size_t servlen" "int flags"
|
||||
.Ft "struct hostent *"
|
||||
.Fn cap_gethostbyname "const cap_channel_t *chan" "const char *name"
|
||||
.Ft "struct hostent *"
|
||||
.Fn cap_gethostbyname2 "const cap_channel_t *chan" "const char *name" "int af"
|
||||
.Ft "struct hostent *"
|
||||
.Fn cap_gethostbyaddr "const cap_channel_t *chan" "const void *addr" "socklen_t len" "int af"
|
||||
.Ft "cap_net_limit_t *"
|
||||
.Fn cap_net_limit_init "cap_channel_t *chan" "uint64_t mode"
|
||||
.Ft int
|
||||
.Fn cap_net_limit "cap_net_limit_t *limit"
|
||||
.Ft void
|
||||
.Fn cap_net_free "cap_net_limit_t *limit"
|
||||
.Ft "cap_net_limit_t *"
|
||||
.Fn cap_net_limit_addr2name_family "cap_net_limit_t *limit" "int *family" "size_t size"
|
||||
.Ft "cap_net_limit_t *"
|
||||
.Fn cap_net_limit_addr2name "cap_net_limit_t *limit" "const struct sockaddr *sa" "socklen_t salen"
|
||||
.Ft "cap_net_limit_t *"
|
||||
.Fn cap_net_limit_name2addr_family "cap_net_limit_t *limit" "int *family" "size_t size"
|
||||
.Ft "cap_net_limit_t *"
|
||||
.Fn cap_net_limit_name2addr "cap_net_limit_t *limit" "const char *name" "const char *serv"
|
||||
.Ft "cap_net_limit_t *"
|
||||
.Fn cap_net_limit_connect "cap_net_limit_t *limit" "const struct sockaddr *sa" "socklen_t salen"
|
||||
.Ft "cap_net_limit_t *"
|
||||
.Fn cap_net_limit_bind "cap_net_limit_t *limit" "const struct sockaddr *sa" "socklen_t salen"
|
||||
.Sh DESCRIPTION
|
||||
.Pp
|
||||
The functions
|
||||
.Fn cap_bind,
|
||||
.Fn cap_connect,
|
||||
.Fn cap_gethostbyname ,
|
||||
.Fn cap_gethostbyname2 ,
|
||||
.Fn cap_gethostbyaddr
|
||||
and
|
||||
.Fn cap_getnameinfo
|
||||
are respectively equivalent to
|
||||
.Xr bind 2 ,
|
||||
.Xr connect 2 ,
|
||||
.Xr gethostbyname 3 ,
|
||||
.Xr gethostbyname2 3 ,
|
||||
.Xr gethostbyaddr 3
|
||||
and
|
||||
.Xr getnameinfo 3
|
||||
except that the connection to the
|
||||
.Nm system.net
|
||||
service needs to be provided.
|
||||
.Sh LIMITS
|
||||
By default, the cap_net capability provides unrestricted access to the network
|
||||
namespace.
|
||||
Applications typically only require access to a small portion of the network
|
||||
namespace:
|
||||
.Fn cap_net_limit
|
||||
interface can be used to restrict access to the network.
|
||||
.Fn cap_net_limit_init
|
||||
returns an opaque limit handle used to store a list of capabilities.
|
||||
The
|
||||
.Fv mode
|
||||
restricts the functionality of the service.
|
||||
Modes are encoded using the following flags:
|
||||
.Pp
|
||||
.Bd -literal -offset indent -compact
|
||||
CAPNET_ADDR2NAME reverse DNS lookups are allowed with
|
||||
cap_getnameinfo
|
||||
CAPNET_NAME2ADDR name resolution is allowed with
|
||||
cap_getaddrinfo
|
||||
CAPNET_DEPRECATED_ADDR2NAME reverse DNS lookups are allowed with
|
||||
cap_gethostbyaddr
|
||||
CAPNET_DEPRECATED_NAME2ADDR name resolution is allowed with
|
||||
cap_gethostbyname and cap_gethostbyname2
|
||||
CAPNET_BIND bind syscall is allowed
|
||||
CAPNET_CONNECT connect syscall is allowed
|
||||
CAPNET_CONNECTDNS connect syscall is allowed to the values
|
||||
returned from privies call to
|
||||
the cap_getaddrinfo or cap_gethostbyname
|
||||
.Ed
|
||||
.Pp
|
||||
.Fn cap_net_limit_addr2name_family
|
||||
limits the
|
||||
.Fn cap_getnameinfo
|
||||
and
|
||||
.Fn cap_gethostbyaddr
|
||||
to do reverse DNS lookups to specific family (AF_INET, AF_INET6, etc.)
|
||||
.Pp
|
||||
.Fn cap_net_limit_addr2name
|
||||
limits the
|
||||
.Fn cap_getnameinfo
|
||||
and
|
||||
.Fn cap_gethostbyaddr
|
||||
to do reverse DNS lookups only on those specific structures.
|
||||
.Pp
|
||||
.Fn cap_net_limit_name2addr_family
|
||||
limits the
|
||||
.Fn cap_getaddrinfo ,
|
||||
.Fn cap_gethostbyname
|
||||
and
|
||||
.Fn cap_gethostbyname2
|
||||
to do the name resolution on specific family (AF_INET, AF_INET6, etc.)
|
||||
.Pp
|
||||
.Fn cap_net_limit_addr2name
|
||||
restricts
|
||||
.Fn cap_getaddrinfo ,
|
||||
.Fn cap_gethostbyname
|
||||
and
|
||||
.Fn cap_gethostbyname2
|
||||
to a set of domains.
|
||||
.Pp
|
||||
.Fn cap_net_limit_bind
|
||||
limits
|
||||
.Fn cap_bind
|
||||
to bind only on those specific structures.
|
||||
.Pp
|
||||
.Fn cap_net_limit_connect
|
||||
limits
|
||||
.Fn cap_connect
|
||||
to connect only on those specific structures.
|
||||
If the CAPNET_CONNECTDNS is set the limits are extended to the values returned
|
||||
by
|
||||
.Fn cap_getaddrinfo ,
|
||||
.Fn cap_gethostbyname
|
||||
and
|
||||
.Fn cap_gethostbyname2
|
||||
In case of the
|
||||
.Fn cap_getaddrinfo
|
||||
the restriction is strict.
|
||||
In case of the
|
||||
.Fn cap_gethostbyname
|
||||
and
|
||||
.Fn cap_gethostbyname2
|
||||
any port will be accepted in the
|
||||
.Fn cap_connect
|
||||
function.
|
||||
.Pp
|
||||
.Fn cap_net_limit
|
||||
applies a set of sysctl limits to the capability, denying access to sysctl
|
||||
variables not belonging to the set.
|
||||
.Pp
|
||||
Once a set of limits is applied, subsequent calls to
|
||||
.Fn cap_net_limit
|
||||
will fail unless the new set is a subset of the current set.
|
||||
.Pp
|
||||
The
|
||||
.Fn cap_net_limit
|
||||
will consume the limits.
|
||||
If the
|
||||
.Fn cap_net_limit
|
||||
was not called the rights may be freed using
|
||||
.Fn cap_net_free .
|
||||
Multiple calls to
|
||||
.Fn cap_net_limit_addr2name_family ,
|
||||
.Fn cap_net_limit_addr2name ,
|
||||
.Fn cap_net_limit_name2addr_family ,
|
||||
.Fn cap_net_limit_name2addr ,
|
||||
.Fn cap_net_limit_connect ,
|
||||
and
|
||||
.Fn cap_net_limit_bind
|
||||
is supported, each call is extending preview capabilities.
|
||||
.Sh EXAMPLES
|
||||
The following example first opens a capability to casper and then uses this
|
||||
capability to create the
|
||||
.Nm system.net
|
||||
casper service and uses it to resolve a host and connect to it.
|
||||
.Bd -literal
|
||||
cap_channel_t *capcas, *capnet;
|
||||
cap_net_limit_t *limit;
|
||||
int familylimit, error, s;
|
||||
const char *host = "example.com";
|
||||
struct addrinfo hints, *res;
|
||||
|
||||
/* Open capability to Casper. */
|
||||
capcas = cap_init();
|
||||
if (capcas == NULL)
|
||||
err(1, "Unable to contact Casper");
|
||||
|
||||
/* Cache NLA for gai_strerror. */
|
||||
caph_cache_catpages();
|
||||
|
||||
/* Enter capability mode sandbox. */
|
||||
if (caph_enter_casper() < 0)
|
||||
err(1, "Unable to enter capability mode");
|
||||
|
||||
/* Use Casper capability to create capability to the system.net service. */
|
||||
capnet = cap_service_open(capcas, "system.net");
|
||||
if (capnet == NULL)
|
||||
err(1, "Unable to open system.net service");
|
||||
|
||||
/* Close Casper capability. */
|
||||
cap_close(capcas);
|
||||
|
||||
/* Limit system.net to reserve IPv4 addresses, to host example.com . */
|
||||
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR | CAPNET_CONNECTDNS);
|
||||
if (limit == NULL)
|
||||
err(1, "Unable to create limits.");
|
||||
cap_net_limit_name2addr(limit, host, "80");
|
||||
familylimit = AF_INET;
|
||||
cap_net_limit_name2addr_family(limit, &familylimit, 1);
|
||||
if (cap_net_limit(limit) < 0)
|
||||
err(1, "Unable to apply limits.");
|
||||
|
||||
/* Find IP addresses for the given host. */
|
||||
memset(&hints, 0, sizeof(hints));
|
||||
hints.ai_family = AF_INET;
|
||||
hints.ai_socktype = SOCK_STREAM;
|
||||
|
||||
error = cap_getaddrinfo(capnet, host, "80", &hints, &res);
|
||||
if (error != 0)
|
||||
errx(1, "cap_getaddrinfo(): %s: %s", host, gai_strerror(error));
|
||||
|
||||
s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
|
||||
if (s < 0)
|
||||
err(1, "Unable to create socket");
|
||||
|
||||
if (cap_connect(capnet, s, res->ai_addr, res->ai_addrlen) < 0)
|
||||
err(1, "Unable to connect to host");
|
||||
.Ed
|
||||
.Sh SEE ALSO
|
||||
.Xr bind 2 ,
|
||||
.Xr cap_enter 2 ,
|
||||
.Xr connect 2 ,
|
||||
.Xr caph_enter 3 ,
|
||||
.Xr err 3 ,
|
||||
.Xr gethostbyaddr 3 ,
|
||||
.Xr gethostbyname 3 ,
|
||||
.Xr gethostbyname2 3 ,
|
||||
.Xr getnameinfo 3 ,
|
||||
.Xr capsicum 4 ,
|
||||
.Xr nv 9
|
||||
.Sh AUTHORS
|
||||
.An Mariusz Zaborski Aq Mt oshogbo@FreeBSD.org
|
1385
lib/libcasper/services/cap_net/cap_net.c
Normal file
1385
lib/libcasper/services/cap_net/cap_net.c
Normal file
File diff suppressed because it is too large
Load diff
165
lib/libcasper/services/cap_net/cap_net.h
Normal file
165
lib/libcasper/services/cap_net/cap_net.h
Normal file
|
@ -0,0 +1,165 @@
|
|||
/*-
|
||||
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
||||
*
|
||||
* Copyright (c) 2020 Mariusz Zaborski <oshogbo@FreeBSD.org>
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#ifndef _CAP_NETWORK_H_
|
||||
#define _CAP_NETWORK_H_
|
||||
|
||||
#ifdef HAVE_CASPER
|
||||
#define WITH_CASPER
|
||||
#endif
|
||||
|
||||
#include <sys/dnv.h>
|
||||
#include <sys/nv.h>
|
||||
|
||||
#include <sys/socket.h>
|
||||
|
||||
struct addrinfo;
|
||||
struct hostent;
|
||||
|
||||
struct cap_net_limit;
|
||||
typedef struct cap_net_limit cap_net_limit_t;
|
||||
|
||||
#define CAPNET_ADDR2NAME (0x01)
|
||||
#define CAPNET_NAME2ADDR (0x02)
|
||||
#define CAPNET_DEPRECATED_ADDR2NAME (0x04)
|
||||
#define CAPNET_DEPRECATED_NAME2ADDR (0x08)
|
||||
#define CAPNET_CONNECT (0x10)
|
||||
#define CAPNET_BIND (0x20)
|
||||
#define CAPNET_CONNECTDNS (0x40)
|
||||
|
||||
#ifdef WITH_CASPER
|
||||
/* Capability functions. */
|
||||
int cap_bind(cap_channel_t *chan, int s, const struct sockaddr *addr,
|
||||
socklen_t addrlen);
|
||||
int cap_connect(cap_channel_t *chan, int s, const struct sockaddr *name,
|
||||
socklen_t namelen);
|
||||
|
||||
int cap_getaddrinfo(cap_channel_t *chan, const char *hostname,
|
||||
const char *servname, const struct addrinfo *hints, struct addrinfo **res);
|
||||
int cap_getnameinfo(cap_channel_t *chan, const struct sockaddr *sa,
|
||||
socklen_t salen, char *host, size_t hostlen, char *serv, size_t servlen,
|
||||
int flags);
|
||||
|
||||
/* Limit functions. */
|
||||
cap_net_limit_t *cap_net_limit_init(cap_channel_t *chan, uint64_t mode);
|
||||
int cap_net_limit(cap_net_limit_t *limit);
|
||||
void cap_net_free(cap_net_limit_t *limit);
|
||||
|
||||
cap_net_limit_t *cap_net_limit_addr2name_family(cap_net_limit_t *limit,
|
||||
int *family, size_t size);
|
||||
cap_net_limit_t *cap_net_limit_addr2name(cap_net_limit_t *limit,
|
||||
const struct sockaddr *sa, socklen_t salen);
|
||||
|
||||
cap_net_limit_t *cap_net_limit_name2addr_family(cap_net_limit_t *limit,
|
||||
int *family, size_t size);
|
||||
cap_net_limit_t *cap_net_limit_name2addr(cap_net_limit_t *limit,
|
||||
const char *name, const char *serv);
|
||||
|
||||
cap_net_limit_t *cap_net_limit_connect(cap_net_limit_t *limit,
|
||||
const struct sockaddr *sa, socklen_t salen);
|
||||
|
||||
cap_net_limit_t *cap_net_limit_bind(cap_net_limit_t *limit,
|
||||
const struct sockaddr *sa, socklen_t salen);
|
||||
|
||||
/* Deprecated functions. */
|
||||
struct hostent *cap_gethostbyname(cap_channel_t *chan, const char *name);
|
||||
struct hostent *cap_gethostbyname2(cap_channel_t *chan, const char *name,
|
||||
int af);
|
||||
struct hostent *cap_gethostbyaddr(cap_channel_t *chan, const void *addr,
|
||||
socklen_t len, int af);
|
||||
#else
|
||||
/* Capability functions. */
|
||||
#define cap_bind(chan, s, addr, addrlen) \
|
||||
bind(s, addr, addrlen)
|
||||
#define cap_connect(chan, s, name, namelen) \
|
||||
connect(s, name, namelen)
|
||||
#define cap_getaddrinfo(chan, hostname, servname, hints, res) \
|
||||
getaddrinfo(hostname, servname, hints, res)
|
||||
#define cap_getnameinfo(chan, sa, salen, host, hostlen, serv, servlen, flags) \
|
||||
getnameinfo(sa, salen, host, hostlen, serv, servlen, flags)
|
||||
|
||||
/* Limit functions. */
|
||||
#define cap_net_limit_init(chan, mode) ((cap_net_limit_t *)malloc(8))
|
||||
#define cap_net_free(limit) free(limit)
|
||||
static inline int
|
||||
cap_net_limit(cap_net_limit_t *limit)
|
||||
{
|
||||
free(limit);
|
||||
return (0);
|
||||
}
|
||||
|
||||
static inline cap_net_limit_t *
|
||||
cap_net_limit_addr2name_family(cap_net_limit_t *limit,
|
||||
int *family __unused, size_t size __unused)
|
||||
{
|
||||
return (limit);
|
||||
}
|
||||
|
||||
static inline cap_net_limit_t *
|
||||
cap_net_limit_addr2name(cap_net_limit_t *limit,
|
||||
const struct sockaddr *sa __unused, socklen_t salen __unused)
|
||||
{
|
||||
return (limit);
|
||||
}
|
||||
|
||||
static inline cap_net_limit_t *
|
||||
cap_net_limit_name2addr_family(cap_net_limit_t *limit,
|
||||
int *family __unused, size_t size __unused)
|
||||
{
|
||||
return (limit);
|
||||
}
|
||||
|
||||
static inline cap_net_limit_t *
|
||||
cap_net_limit_name2addr(cap_net_limit_t *limit,
|
||||
const char *name __unused, const char *serv __unused)
|
||||
{
|
||||
return (limit);
|
||||
}
|
||||
|
||||
static inline cap_net_limit_t *
|
||||
cap_net_limit_connect(cap_net_limit_t *limit,
|
||||
const struct sockaddr *sa __unused, socklen_t salen __unused)
|
||||
{
|
||||
return (limit);
|
||||
}
|
||||
|
||||
static inline cap_net_limit_t *
|
||||
cap_net_limit_bind(cap_net_limit_t *limit,
|
||||
const struct sockaddr *sa __unused, socklen_t salen __unused)
|
||||
{
|
||||
return (limit);
|
||||
}
|
||||
|
||||
/* Deprecated functions. */
|
||||
#define cap_gethostbyname(chan, name) gethostbyname(name)
|
||||
#define cap_gethostbyname2(chan, name, type) gethostbyname2(name, type)
|
||||
#define cap_gethostbyaddr(chan, addr, len, type) gethostbyaddr(addr, len, type)
|
||||
#endif
|
||||
|
||||
#endif /* !_CAP_NETWORK_H_ */
|
16
lib/libcasper/services/cap_net/tests/Makefile
Normal file
16
lib/libcasper/services/cap_net/tests/Makefile
Normal file
|
@ -0,0 +1,16 @@
|
|||
# $FreeBSD$
|
||||
|
||||
.include <src.opts.mk>
|
||||
|
||||
ATF_TESTS_C= net_test
|
||||
|
||||
.if ${MK_CASPER} != "no"
|
||||
LIBADD+= casper
|
||||
LIBADD+= cap_net
|
||||
CFLAGS+=-DWITH_CASPER
|
||||
.endif
|
||||
LIBADD+= nv
|
||||
|
||||
WARNS?= 3
|
||||
|
||||
.include <bsd.test.mk>
|
1160
lib/libcasper/services/cap_net/tests/net_test.c
Normal file
1160
lib/libcasper/services/cap_net/tests/net_test.c
Normal file
File diff suppressed because it is too large
Load diff
|
@ -89,6 +89,7 @@ _LIBRARIES= \
|
|||
cap_dns \
|
||||
cap_fileargs \
|
||||
cap_grp \
|
||||
cap_net \
|
||||
cap_pwd \
|
||||
cap_sysctl \
|
||||
cap_syslog \
|
||||
|
@ -637,6 +638,7 @@ LIBBSNMPDIR= ${OBJTOP}/lib/libbsnmp/libbsnmp
|
|||
LIBCASPERDIR= ${OBJTOP}/lib/libcasper/libcasper
|
||||
LIBCAP_DNSDIR= ${OBJTOP}/lib/libcasper/services/cap_dns
|
||||
LIBCAP_GRPDIR= ${OBJTOP}/lib/libcasper/services/cap_grp
|
||||
LIBCAP_NETDIR= ${OBJTOP}/lib/libcasper/services/cap_net
|
||||
LIBCAP_PWDDIR= ${OBJTOP}/lib/libcasper/services/cap_pwd
|
||||
LIBCAP_SYSCTLDIR= ${OBJTOP}/lib/libcasper/services/cap_sysctl
|
||||
LIBCAP_SYSLOGDIR= ${OBJTOP}/lib/libcasper/services/cap_syslog
|
||||
|
|
Loading…
Reference in a new issue