mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 12:54:27 +00:00
cap_net: allow to use the service without setting the limits
Add test to ensure that this is possible.
This commit is contained in:
parent
4084669d18
commit
b7876aec95
|
@ -795,7 +795,11 @@ net_gethostbyname(const nvlist_t *limits, const nvlist_t *nvlin,
|
||||||
return (ENOTCAPABLE);
|
return (ENOTCAPABLE);
|
||||||
|
|
||||||
dnscache = net_allowed_mode(limits, CAPNET_CONNECTDNS);
|
dnscache = net_allowed_mode(limits, CAPNET_CONNECTDNS);
|
||||||
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR, NULL);
|
funclimit = NULL;
|
||||||
|
if (limits != NULL) {
|
||||||
|
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR,
|
||||||
|
NULL);
|
||||||
|
}
|
||||||
|
|
||||||
family = (int)nvlist_get_number(nvlin, "family");
|
family = (int)nvlist_get_number(nvlin, "family");
|
||||||
if (!net_allowed_family(funclimit, family))
|
if (!net_allowed_family(funclimit, family))
|
||||||
|
@ -825,7 +829,11 @@ net_gethostbyaddr(const nvlist_t *limits, const nvlist_t *nvlin,
|
||||||
if (!net_allowed_mode(limits, CAPNET_DEPRECATED_ADDR2NAME))
|
if (!net_allowed_mode(limits, CAPNET_DEPRECATED_ADDR2NAME))
|
||||||
return (ENOTCAPABLE);
|
return (ENOTCAPABLE);
|
||||||
|
|
||||||
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME, NULL);
|
funclimit = NULL;
|
||||||
|
if (limits != NULL) {
|
||||||
|
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME,
|
||||||
|
NULL);
|
||||||
|
}
|
||||||
|
|
||||||
family = (int)nvlist_get_number(nvlin, "family");
|
family = (int)nvlist_get_number(nvlin, "family");
|
||||||
if (!net_allowed_family(funclimit, family))
|
if (!net_allowed_family(funclimit, family))
|
||||||
|
@ -855,7 +863,11 @@ net_getnameinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout)
|
||||||
|
|
||||||
if (!net_allowed_mode(limits, CAPNET_ADDR2NAME))
|
if (!net_allowed_mode(limits, CAPNET_ADDR2NAME))
|
||||||
return (ENOTCAPABLE);
|
return (ENOTCAPABLE);
|
||||||
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME, NULL);
|
funclimit = NULL;
|
||||||
|
if (limits != NULL) {
|
||||||
|
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME,
|
||||||
|
NULL);
|
||||||
|
}
|
||||||
|
|
||||||
error = 0;
|
error = 0;
|
||||||
host = serv = NULL;
|
host = serv = NULL;
|
||||||
|
@ -954,7 +966,11 @@ net_getaddrinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout)
|
||||||
if (!net_allowed_mode(limits, CAPNET_NAME2ADDR))
|
if (!net_allowed_mode(limits, CAPNET_NAME2ADDR))
|
||||||
return (ENOTCAPABLE);
|
return (ENOTCAPABLE);
|
||||||
dnscache = net_allowed_mode(limits, CAPNET_CONNECTDNS);
|
dnscache = net_allowed_mode(limits, CAPNET_CONNECTDNS);
|
||||||
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR, NULL);
|
funclimit = NULL;
|
||||||
|
if (limits != NULL) {
|
||||||
|
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR,
|
||||||
|
NULL);
|
||||||
|
}
|
||||||
|
|
||||||
hostname = dnvlist_get_string(nvlin, "hostname", NULL);
|
hostname = dnvlist_get_string(nvlin, "hostname", NULL);
|
||||||
servname = dnvlist_get_string(nvlin, "servname", NULL);
|
servname = dnvlist_get_string(nvlin, "servname", NULL);
|
||||||
|
@ -1014,7 +1030,9 @@ net_bind(const nvlist_t *limits, nvlist_t *nvlin, nvlist_t *nvlout)
|
||||||
|
|
||||||
if (!net_allowed_mode(limits, CAPNET_BIND))
|
if (!net_allowed_mode(limits, CAPNET_BIND))
|
||||||
return (ENOTCAPABLE);
|
return (ENOTCAPABLE);
|
||||||
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_BIND, NULL);
|
funclimit = NULL;
|
||||||
|
if (limits != NULL)
|
||||||
|
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_BIND, NULL);
|
||||||
|
|
||||||
saddr = nvlist_get_binary(nvlin, "saddr", &len);
|
saddr = nvlist_get_binary(nvlin, "saddr", &len);
|
||||||
|
|
||||||
|
@ -1048,7 +1066,9 @@ net_connect(const nvlist_t *limits, nvlist_t *nvlin, nvlist_t *nvlout)
|
||||||
if (!conn && !conndns)
|
if (!conn && !conndns)
|
||||||
return (ENOTCAPABLE);
|
return (ENOTCAPABLE);
|
||||||
|
|
||||||
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_CONNECT, NULL);
|
funclimit = NULL;
|
||||||
|
if (limits != NULL)
|
||||||
|
funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_CONNECT, NULL);
|
||||||
|
|
||||||
saddr = nvlist_get_binary(nvlin, "saddr", &len);
|
saddr = nvlist_get_binary(nvlin, "saddr", &len);
|
||||||
if (conn && !net_allowed_bsaddr(funclimit, saddr, len)) {
|
if (conn && !net_allowed_bsaddr(funclimit, saddr, len)) {
|
||||||
|
|
|
@ -296,6 +296,86 @@ test_extend_mode(cap_channel_t *capnet, int current)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ATF_TC_WITHOUT_HEAD(capnet__getnameinfo);
|
||||||
|
ATF_TC_BODY(capnet__getnameinfo, tc)
|
||||||
|
{
|
||||||
|
cap_channel_t *capnet;
|
||||||
|
|
||||||
|
capnet = create_network_service();
|
||||||
|
|
||||||
|
ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0);
|
||||||
|
ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0);
|
||||||
|
|
||||||
|
cap_close(capnet);
|
||||||
|
}
|
||||||
|
|
||||||
|
ATF_TC_WITHOUT_HEAD(capnet__connect);
|
||||||
|
ATF_TC_BODY(capnet__connect, tc)
|
||||||
|
{
|
||||||
|
cap_channel_t *capnet;
|
||||||
|
|
||||||
|
capnet = create_network_service();
|
||||||
|
|
||||||
|
ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0);
|
||||||
|
|
||||||
|
cap_close(capnet);
|
||||||
|
}
|
||||||
|
|
||||||
|
ATF_TC_WITHOUT_HEAD(capnet__bind);
|
||||||
|
ATF_TC_BODY(capnet__bind, tc)
|
||||||
|
{
|
||||||
|
cap_channel_t *capnet;
|
||||||
|
|
||||||
|
capnet = create_network_service();
|
||||||
|
|
||||||
|
ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0);
|
||||||
|
|
||||||
|
cap_close(capnet);
|
||||||
|
}
|
||||||
|
|
||||||
|
ATF_TC_WITHOUT_HEAD(capnet__getaddrinfo);
|
||||||
|
ATF_TC_BODY(capnet__getaddrinfo, tc)
|
||||||
|
{
|
||||||
|
cap_channel_t *capnet;
|
||||||
|
struct addrinfo hints, *capres;
|
||||||
|
|
||||||
|
capnet = create_network_service();
|
||||||
|
|
||||||
|
memset(&hints, 0, sizeof(hints));
|
||||||
|
hints.ai_family = AF_INET;
|
||||||
|
hints.ai_socktype = SOCK_STREAM;
|
||||||
|
|
||||||
|
ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) ==
|
||||||
|
0);
|
||||||
|
|
||||||
|
cap_close(capnet);
|
||||||
|
}
|
||||||
|
|
||||||
|
ATF_TC_WITHOUT_HEAD(capnet__gethostbyname);
|
||||||
|
ATF_TC_BODY(capnet__gethostbyname, tc)
|
||||||
|
{
|
||||||
|
cap_channel_t *capnet;
|
||||||
|
|
||||||
|
capnet = create_network_service();
|
||||||
|
|
||||||
|
ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0);
|
||||||
|
|
||||||
|
cap_close(capnet);
|
||||||
|
}
|
||||||
|
|
||||||
|
ATF_TC_WITHOUT_HEAD(capnet__gethostbyaddr);
|
||||||
|
ATF_TC_BODY(capnet__gethostbyaddr, tc)
|
||||||
|
{
|
||||||
|
cap_channel_t *capnet;
|
||||||
|
|
||||||
|
capnet = create_network_service();
|
||||||
|
|
||||||
|
ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0);
|
||||||
|
ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0);
|
||||||
|
|
||||||
|
cap_close(capnet);
|
||||||
|
}
|
||||||
|
|
||||||
ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode);
|
ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode);
|
||||||
ATF_TC_BODY(capnet__limits_addr2name_mode, tc)
|
ATF_TC_BODY(capnet__limits_addr2name_mode, tc)
|
||||||
{
|
{
|
||||||
|
@ -1129,6 +1209,13 @@ ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc)
|
||||||
ATF_TP_ADD_TCS(tp)
|
ATF_TP_ADD_TCS(tp)
|
||||||
{
|
{
|
||||||
|
|
||||||
|
ATF_TP_ADD_TC(tp, capnet__connect);
|
||||||
|
ATF_TP_ADD_TC(tp, capnet__bind);
|
||||||
|
ATF_TP_ADD_TC(tp, capnet__getnameinfo);
|
||||||
|
ATF_TP_ADD_TC(tp, capnet__getaddrinfo);
|
||||||
|
ATF_TP_ADD_TC(tp, capnet__gethostbyname);
|
||||||
|
ATF_TP_ADD_TC(tp, capnet__gethostbyaddr);
|
||||||
|
|
||||||
ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode);
|
ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode);
|
||||||
ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family);
|
ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family);
|
||||||
ATF_TP_ADD_TC(tp, capnet__limits_addr2name);
|
ATF_TP_ADD_TC(tp, capnet__limits_addr2name);
|
||||||
|
|
Loading…
Reference in a new issue