bsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gb4yH4CCSz6g4Cb for ; Wed, 10 Jun 2026 12:36:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gb4yH1wwRz438B for ; Wed, 10 Jun 2026 12:36:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781094967; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Hdmf0eJ9++0e4VZ2w084m7w/cjcmrJXIcNY6MKRMF5o=; b=QaK4YEVUWeehhooZaO96MdvnyeDBevkhGsCVYLGo3AK7vfDsCKgBYYwZ1y3H8STCpC2rOU bMcpKMQIGD+Ytwl0fAW6uZmkMWU1dCrmVufi9VbGewz21YsbtGmJPqjdkedVdGmS9FxtgU UzAqTW7G25burrd+wwbQKp8/kHQ+M48EarWbrjQaM6ZP5tkWAaQBkvs2LWxrW3UyqOk2oQ jmpYC40p+5qK7ejdi8cg1I7oLWPRy+XfN1VWtktd5pzpM4VRExLcPaq7ldBikj+LvH0jep uFpfC8ZgGNcvNegLgrSVEAKpnQHTfPLfapqdFVFpzTGNISEiAnP+yIdhoQGHaw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781094967; a=rsa-sha256; cv=none; b=pkz2Bskg2HbWxZwkHlyOWGLveZwz4NoUpGQ5hIaewH4NCAf8XJTwEZfkzYPGD5xI9/SqLK 6Z8mGNwbmZvZHxGorzDSQUc6lHoNDBxqpN7+YdB3M2nO6u4BB3gsA/cX0tCiosO0h46PlO A0MWimgOioIYi2NhfYNSRSUK1dvckO7l6CZU8vaNveGiwq57SlXXu2UhCH+Irhaxf2kLl0 1je6tLYYpXD2YjmhkZy8MhDjQsORpkkte5p0j0GrSukVJKfevHQlZbLJ0DQ/ipu3siFJNB 9Ou0VChY3kInheuBHQfS3J90oWrMJGCJ0JvGnz+uBvLGv7fcjPbZYNWoK80BaA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781094967; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Hdmf0eJ9++0e4VZ2w084m7w/cjcmrJXIcNY6MKRMF5o=; b=Gr4pxEpkfHrpR6Wiho0W9KbtgI1shfNJGL5qUGKkqjgzItdiyK6vp33zy6guVqNCIaBicg PL6n9q+Af4WQnsk1IeAOtpP06vH7uo1oh8fyM8hkwvFaXazzRu6BX8x8GKritY2drYK0T6 w0/42bxcMcrA14Kn1Grw0Am1ngk09jiTc710tJfzb2GeMNGhp7x9ljayYAOUsR28DcANiC z3lPsn54ogkkL5pvkdAI90m68RL9MF2c5rFlxTmWbA030PW9jklO6tEqaHaGrpl+1PEIZv rnwW9rcdw8xEDW7cbP7aWUmt4h90YEzpOnQ/28EvTj5LfI7WERpO3OQiTI0zSQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gb4yH1PvBz1KXp for ; Wed, 10 Jun 2026 12:36:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c925 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 10 Jun 2026 12:36:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: K Rin From: Warner Losh Subject: git: ce08af63788d - main - mac_portacl tests: rewrite the test program and test unspecific family. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: imp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ce08af63788da219c0c5826fc3f2345fb2ce29f4 Auto-Submitted: auto-generated Date: Wed, 10 Jun 2026 12:36:07 +0000 Message-Id: <6a295a37.3c925.67cb7b66@gitrepo.freebsd.org> The branch main has been updated by imp: URL: https://cgit.FreeBSD.org/src/commit/?id=ce08af63788da219c0c5826fc3f2345fb2ce29f4 commit ce08af63788da219c0c5826fc3f2345fb2ce29f4 Author: K Rin AuthorDate: 2025-04-12 03:05:47 +0000 Commit: Warner Losh CommitDate: 2026-06-10 12:35:03 +0000 mac_portacl tests: rewrite the test program and test unspecific family. Reviewed by: imp,emaste Pull Request: https://github.com/freebsd/freebsd-src/pull/1659 --- tests/sys/mac/portacl/Makefile | 2 ++ tests/sys/mac/portacl/bind.c | 60 ++++++++++++++++++++++++++++++++++++++++++ tests/sys/mac/portacl/misc.sh | 55 ++++++++++++++++++++++---------------- 3 files changed, 94 insertions(+), 23 deletions(-) diff --git a/tests/sys/mac/portacl/Makefile b/tests/sys/mac/portacl/Makefile index 2b0f4634c802..2ae55d30f7fc 100644 --- a/tests/sys/mac/portacl/Makefile +++ b/tests/sys/mac/portacl/Makefile @@ -1,9 +1,11 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/mac/portacl +BINDIR= ${TESTSDIR} ${PACKAGE}FILES+= misc.sh +PROGS+= bind TAP_TESTS_SH+= nobody_test TAP_TESTS_SH+= root_test diff --git a/tests/sys/mac/portacl/bind.c b/tests/sys/mac/portacl/bind.c new file mode 100644 index 000000000000..1cb64ba23b81 --- /dev/null +++ b/tests/sys/mac/portacl/bind.c @@ -0,0 +1,60 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +int main(int argc, char *argv[]) +{ + if (argc < 5) { + fprintf(stderr, "Usage: %s family host protocol port\n", argv[0]); + return 1; + } + int family = atoi(argv[1]); + const char *host = argv[2]; + const char *protocol = argv[3]; + const char *port = argv[4]; + int sock_type; + if (strcmp(protocol, "tcp") == 0) + sock_type = SOCK_STREAM; + else if (strcmp(protocol, "udp") == 0) + sock_type = SOCK_DGRAM; + else { + fprintf(stderr, "Unsupported protocol: %s\n", protocol); + return 1; + } + struct addrinfo hints, *res; + memset(&hints, 0, sizeof(hints)); + hints.ai_family = family; + hints.ai_socktype = sock_type; + hints.ai_flags = AI_PASSIVE; + int err = getaddrinfo(host, port, &hints, &res); + if (err != 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(err)); + return 1; + } + int sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol); + if (sock < 0) { + freeaddrinfo(res); + return 1; + } + int opt = 1; + setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); + if (bind(sock, res->ai_addr, res->ai_addrlen) < 0) { + if (errno == EACCES || errno == EPERM) + printf("bind_error: permission denied.\n"); + else + printf("bind error: %s\n", strerror(errno)); + close(sock); + freeaddrinfo(res); + return 1; + } + printf("ok\n"); + close(sock); + freeaddrinfo(res); + return 0; +} + diff --git a/tests/sys/mac/portacl/misc.sh b/tests/sys/mac/portacl/misc.sh index 4d3f18fce1c1..da022556a854 100644 --- a/tests/sys/mac/portacl/misc.sh +++ b/tests/sys/mac/portacl/misc.sh @@ -1,5 +1,17 @@ #!/bin/sh +dir=`dirname $0` + +sysctl security.mac.portacl >/dev/null 2>&1 +if [ $? -ne 0 ]; then + echo "1..0 # SKIP MAC_PORTACL is unavailable." + exit 0 +fi +if [ $(id -u) -ne 0 ]; then + echo "1..0 # SKIP testcases must be run as root" + exit 0 +fi + ntest=1 check_bind() { @@ -15,32 +27,29 @@ check_bind() { [ "${proto}" = "udp" ] && udpflag="-u" - out=$( - case "${idtype}" in - uid|gid) - ( echo -n | su -m ${name} -c "nc ${udpflag} -l -w ${timeout} $host $port" 2>&1 ) & - ;; - jail) - kill $$ - ;; - *) - kill $$ - esac - sleep 0.3 - echo | nc ${udpflag} -w ${timeout} $host $port >/dev/null 2>&1 - wait - ) - case "${out}" in - "nc: Permission denied"*|"nc: Operation not permitted"*) - echo fl + case "${idtype}" in + uid|gid) + su -m ${name} -c "${dir}/bind 0 ${host} ${proto} ${port}" > /dev/null # unspec + retval1=$? + su -m ${name} -c "${dir}/bind 2 ${host} ${proto} ${port}" > /dev/null # inet + retval2=$? + if [ $retval1 -ne $retval2 ]; then + echo inconsistent + return + fi + if [ $retval1 -ne 0 ]; then + echo fl + return + fi ;; - "") - echo ok + jail) + kill $$ ;; *) - echo ${out} - ;; + kill $$ esac + + echo ok } bind_test() { @@ -57,7 +66,7 @@ bind_test() { out=$(check_bind ${idtype} ${name} ${proto} ${port}) if [ "${out}" = "${expect_without_rule}" ]; then echo "ok ${ntest}" - elif [ "${out}" = "ok" -o "${out}" = "fl" ]; then + elif [ "${out}" = "ok" -o "${out}" = "fl" -o "${out}" = "inconsistent" ]; then echo "not ok ${ntest} # '${out}' != '${expect_without_rule}'" else echo "not ok ${ntest} # unexpected output: '${out}'"