From owner-dev-commits-src-main@freebsd.org Sun Jan 3 16:09:46 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 6BE994D5D00; Sun, 3 Jan 2021 16:09:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4D83cV2Ztjz3LXr; Sun, 3 Jan 2021 16:09:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4B8EF227A; Sun, 3 Jan 2021 16:09:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 103G9kBe040124; Sun, 3 Jan 2021 16:09:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 103G9kEI040123; Sun, 3 Jan 2021 16:09:46 GMT (envelope-from git) Date: Sun, 3 Jan 2021 16:09:46 GMT Message-Id: <202101031609.103G9kEI040123@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mariusz Zaborski Subject: git: b7876aec957e - main - cap_net: allow to use the service without setting the limits MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: oshogbo X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b7876aec957e5b9378c61fbaa7fb286285a5f1de Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Jan 2021 16:09:46 -0000 The branch main has been updated by oshogbo: URL: https://cgit.FreeBSD.org/src/commit/?id=b7876aec957e5b9378c61fbaa7fb286285a5f1de commit b7876aec957e5b9378c61fbaa7fb286285a5f1de Author: Mariusz Zaborski AuthorDate: 2021-01-03 16:09:20 +0000 Commit: Mariusz Zaborski CommitDate: 2021-01-03 16:09:20 +0000 cap_net: allow to use the service without setting the limits Add test to ensure that this is possible. --- lib/libcasper/services/cap_net/cap_net.c | 32 +++++++-- lib/libcasper/services/cap_net/tests/net_test.c | 87 +++++++++++++++++++++++++ 2 files changed, 113 insertions(+), 6 deletions(-) diff --git a/lib/libcasper/services/cap_net/cap_net.c b/lib/libcasper/services/cap_net/cap_net.c index a2078b3335de..a963c753494b 100644 --- a/lib/libcasper/services/cap_net/cap_net.c +++ b/lib/libcasper/services/cap_net/cap_net.c @@ -795,7 +795,11 @@ net_gethostbyname(const nvlist_t *limits, const nvlist_t *nvlin, return (ENOTCAPABLE); dnscache = net_allowed_mode(limits, CAPNET_CONNECTDNS); - funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR, NULL); + funclimit = NULL; + if (limits != NULL) { + funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR, + NULL); + } family = (int)nvlist_get_number(nvlin, "family"); if (!net_allowed_family(funclimit, family)) @@ -825,7 +829,11 @@ net_gethostbyaddr(const nvlist_t *limits, const nvlist_t *nvlin, if (!net_allowed_mode(limits, CAPNET_DEPRECATED_ADDR2NAME)) return (ENOTCAPABLE); - funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME, NULL); + funclimit = NULL; + if (limits != NULL) { + funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME, + NULL); + } family = (int)nvlist_get_number(nvlin, "family"); if (!net_allowed_family(funclimit, family)) @@ -855,7 +863,11 @@ net_getnameinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) if (!net_allowed_mode(limits, CAPNET_ADDR2NAME)) return (ENOTCAPABLE); - funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME, NULL); + funclimit = NULL; + if (limits != NULL) { + funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_ADDR2NAME, + NULL); + } error = 0; host = serv = NULL; @@ -954,7 +966,11 @@ net_getaddrinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) if (!net_allowed_mode(limits, CAPNET_NAME2ADDR)) return (ENOTCAPABLE); dnscache = net_allowed_mode(limits, CAPNET_CONNECTDNS); - funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR, NULL); + funclimit = NULL; + if (limits != NULL) { + funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_NAME2ADDR, + NULL); + } hostname = dnvlist_get_string(nvlin, "hostname", NULL); servname = dnvlist_get_string(nvlin, "servname", NULL); @@ -1014,7 +1030,9 @@ net_bind(const nvlist_t *limits, nvlist_t *nvlin, nvlist_t *nvlout) if (!net_allowed_mode(limits, CAPNET_BIND)) return (ENOTCAPABLE); - funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_BIND, NULL); + funclimit = NULL; + if (limits != NULL) + funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_BIND, NULL); saddr = nvlist_get_binary(nvlin, "saddr", &len); @@ -1048,7 +1066,9 @@ net_connect(const nvlist_t *limits, nvlist_t *nvlin, nvlist_t *nvlout) if (!conn && !conndns) return (ENOTCAPABLE); - funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_CONNECT, NULL); + funclimit = NULL; + if (limits != NULL) + funclimit = dnvlist_get_nvlist(limits, LIMIT_NV_CONNECT, NULL); saddr = nvlist_get_binary(nvlin, "saddr", &len); if (conn && !net_allowed_bsaddr(funclimit, saddr, len)) { diff --git a/lib/libcasper/services/cap_net/tests/net_test.c b/lib/libcasper/services/cap_net/tests/net_test.c index d73270095e17..c2dce467ef3b 100644 --- a/lib/libcasper/services/cap_net/tests/net_test.c +++ b/lib/libcasper/services/cap_net/tests/net_test.c @@ -296,6 +296,86 @@ test_extend_mode(cap_channel_t *capnet, int current) } } +ATF_TC_WITHOUT_HEAD(capnet__getnameinfo); +ATF_TC_BODY(capnet__getnameinfo, tc) +{ + cap_channel_t *capnet; + + capnet = create_network_service(); + + ATF_REQUIRE(test_getnameinfo(capnet, AF_INET, TEST_IPV4) == 0); + ATF_REQUIRE(test_getnameinfo(capnet, AF_INET6, TEST_IPV6) == 0); + + cap_close(capnet); +} + +ATF_TC_WITHOUT_HEAD(capnet__connect); +ATF_TC_BODY(capnet__connect, tc) +{ + cap_channel_t *capnet; + + capnet = create_network_service(); + + ATF_REQUIRE(test_connect(capnet, TEST_IPV4, 80) == 0); + + cap_close(capnet); +} + +ATF_TC_WITHOUT_HEAD(capnet__bind); +ATF_TC_BODY(capnet__bind, tc) +{ + cap_channel_t *capnet; + + capnet = create_network_service(); + + ATF_REQUIRE(test_bind(capnet, TEST_BIND_IPV4) == 0); + + cap_close(capnet); +} + +ATF_TC_WITHOUT_HEAD(capnet__getaddrinfo); +ATF_TC_BODY(capnet__getaddrinfo, tc) +{ + cap_channel_t *capnet; + struct addrinfo hints, *capres; + + capnet = create_network_service(); + + memset(&hints, 0, sizeof(hints)); + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_STREAM; + + ATF_REQUIRE(cap_getaddrinfo(capnet, TEST_IPV4, "80", &hints, &capres) == + 0); + + cap_close(capnet); +} + +ATF_TC_WITHOUT_HEAD(capnet__gethostbyname); +ATF_TC_BODY(capnet__gethostbyname, tc) +{ + cap_channel_t *capnet; + + capnet = create_network_service(); + + ATF_REQUIRE(test_gethostbyname(capnet, AF_INET, TEST_DOMAIN_0) == 0); + + cap_close(capnet); +} + +ATF_TC_WITHOUT_HEAD(capnet__gethostbyaddr); +ATF_TC_BODY(capnet__gethostbyaddr, tc) +{ + cap_channel_t *capnet; + + capnet = create_network_service(); + + ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET, TEST_IPV4) == 0); + ATF_REQUIRE(test_gethostbyaddr(capnet, AF_INET6, TEST_IPV6) == 0); + + cap_close(capnet); +} + ATF_TC_WITHOUT_HEAD(capnet__limits_addr2name_mode); ATF_TC_BODY(capnet__limits_addr2name_mode, tc) { @@ -1129,6 +1209,13 @@ ATF_TC_BODY(capnet__limits_deprecated_connecttodns, tc) ATF_TP_ADD_TCS(tp) { + ATF_TP_ADD_TC(tp, capnet__connect); + ATF_TP_ADD_TC(tp, capnet__bind); + ATF_TP_ADD_TC(tp, capnet__getnameinfo); + ATF_TP_ADD_TC(tp, capnet__getaddrinfo); + ATF_TP_ADD_TC(tp, capnet__gethostbyname); + ATF_TP_ADD_TC(tp, capnet__gethostbyaddr); + ATF_TP_ADD_TC(tp, capnet__limits_addr2name_mode); ATF_TP_ADD_TC(tp, capnet__limits_addr2name_family); ATF_TP_ADD_TC(tp, capnet__limits_addr2name);