matteo/malcontent-dns-parental-controls
matteo/malcontent-dns-parental-controls
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Finish implementation of gethostbyname

Browse source
This commit is contained in:
Matteo Settenvini 2022-09-05 23:15:29 +02:00
parent 9978bfd783
commit 571aa90d6a
Signed by: matteo
GPG key ID: 8576CC1AD97D42DF
8 changed files with 105 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

34
tests/common/dbus.rs
View file

@ -6,17 +6,12 @@ include!(concat!(
"/src/policy_checker/dbus.rs"
));
use {
event_listener::{Event, EventListener},
nix::unistd::Uid,
std::collections::HashMap,
zbus::dbus_interface,
};
use {std::collections::HashMap, zbus::dbus_interface};
#[derive(Debug)]
pub struct MalcontentDBusMock {
responses: HashMap<Uid, Vec<Restrictions>>,
invocations_left: usize,
finished: Event,
}
#[dbus_interface(name = "com.endlessm.ParentalControls.Dns")]
@ -33,17 +28,23 @@ impl MalcontentDBusMock {
"MockError: DBus mock is saturated for user with id {}",
user_id
));
self.invocations_left -= 1;
if self.invocations_left == 0 {
self.finished.notify(1);
}
restrictions
}
}
impl MalcontentDBusMock {
pub fn new(mut responses: HashMap<Uid, Vec<Restrictions>>) -> Self {
let responses_size: usize = responses.values().map(|v| v.len()).sum();
let responses_size: usize = responses
.values()
.map(|v| {
std::cmp::max(
v.len(),
1, /* 'No restrictions' still counts as one message */
)
})
.sum();
for r in responses.values_mut() {
r.reverse(); // we pop responses from the back, so...
}
@ -51,19 +52,10 @@ impl MalcontentDBusMock {
let ret = Self {
responses,
invocations_left: responses_size,
finished: Event::new(),
};
if ret.invocations_left == 0 {
ret.finished.notify(1);
}
ret
}
pub fn waiter(&self) -> EventListener {
self.finished.listen()
}
}
impl Drop for MalcontentDBusMock {
@ -73,8 +65,6 @@ impl Drop for MalcontentDBusMock {
"MockError: During teardown, {} invocations are still left on the mock object",
self.invocations_left
);
self.finished.notify(1);
}
}

39
tests/common/mod.rs
View file

@ -91,6 +91,8 @@ static SETUP: Once = Once::new();
pub fn setup() -> Result<()> {
SETUP.call_once(|| {
env_logger::init();
let nss_config_status = unsafe {
let db = CString::new("hosts").unwrap();
let resolvers = CString::new("malcontent dns").unwrap();
@ -130,7 +132,7 @@ pub fn resolve_with_system(family: libc::c_int, host: &str) -> Result<IpAddr> {
Ok(IpAddr::from_str(&addr_string)?)
}
pub fn resolve_with_module(family: libc::c_int, hostname: &str) -> Result<IpAddr> {
pub fn resolve_with_module(family: libc::c_int, hostname: &str) -> Result<Vec<IpAddr>> {
assert!(
SETUP.is_completed(),
"Forgot to call common::setup() at beginning of test?"
@ -159,20 +161,33 @@ pub fn resolve_with_module(family: libc::c_int, hostname: &str) -> Result<IpAddr
hostname,
error.to_str().unwrap()
);
let addr_storage = SockaddrStorage::from_raw((*addr).ai_addr, Some((*addr).ai_addrlen))
.ok_or(anyhow!("Garbled addrinfo from getaddrinfo()"))?;
let ip = convert_addrinfo(&addr_storage)?;
let ips = convert_addrinfo(addr)?;
freeaddrinfo(addr);
Ok(ip)
Ok(ips)
}
}
fn convert_addrinfo(sa: &SockaddrStorage) -> Result<IpAddr> {
if let Some(addr) = sa.as_sockaddr_in() {
Ok(IpAddr::V4(Ipv4Addr::from(addr.ip())))
} else if let Some(addr) = sa.as_sockaddr_in6() {
Ok(IpAddr::V6(Ipv6Addr::from(addr.ip())))
} else {
bail!("addrinfo is not either an IPv4 or IPv6 address")
unsafe fn convert_addrinfo(addrs: *const libc::addrinfo) -> Result<Vec<IpAddr>> {
let mut ips = vec![];
let mut addr = addrs;
while addr != std::ptr::null() {
let addr_storage = SockaddrStorage::from_raw((*addr).ai_addr, Some((*addr).ai_addrlen))
.ok_or(anyhow!("Garbled addrinfo from getaddrinfo()"))?;
if let Some(addr) = addr_storage.as_sockaddr_in() {
ips.push(IpAddr::V4(Ipv4Addr::from(addr.ip())));
} else if let Some(addr) = addr_storage.as_sockaddr_in6() {
ips.push(IpAddr::V6(Ipv6Addr::from(addr.ip())));
} else {
bail!("addrinfo is not either an IPv4 or IPv6 address")
}
addr = (*addr).ai_next;
}
ips.sort();
ips.dedup();
Ok(ips)
}

46
tests/integration_test.rs
View file

@ -17,29 +17,34 @@ static CLOUDFLARE_PARENTALCONTROL_ADDRS: Lazy<Restrictions> = Lazy::new(|| {
vec![
Restriction {
ip: IpAddr::V4(Ipv4Addr::new(1, 1, 1, 3)),
hostname: "cloudflare-dns.com".into(),
hostname: "family.cloudflare-dns.com".into(),
},
Restriction {
ip: IpAddr::V4(Ipv4Addr::new(1, 0, 0, 3)),
hostname: "cloudflare-dns.com".into(),
hostname: "family.cloudflare-dns.com".into(),
},
Restriction {
ip: IpAddr::V6(Ipv6Addr::new(2606, 4700, 4700, 0, 0, 0, 0, 1113)),
hostname: "cloudflare-dns.com".into(),
ip: IpAddr::V6(Ipv6Addr::new(0x2606, 0x4700, 0x4700, 0, 0, 0, 0, 0x1113)),
hostname: "family.cloudflare-dns.com".into(),
},
Restriction {
ip: IpAddr::V6(Ipv6Addr::new(2606, 4700, 4700, 0, 0, 0, 0, 1003)),
hostname: "cloudflare-dns.com".into(),
ip: IpAddr::V6(Ipv6Addr::new(0x2606, 0x4700, 0x4700, 0, 0, 0, 0, 0x1003)),
hostname: "family.cloudflare-dns.com".into(),
},
]
});
static NO_RESTRICTIONS: Lazy<Restrictions> = Lazy::new(|| vec![]);
fork_test! {
#[test]
fn nss_module_is_loaded() -> Result<()> {
common::setup()?;
common::resolve_with_module(libc::AF_INET, "gnome.org")?;
Ok(())
tokio::runtime::Runtime::new().unwrap().block_on(async {
let _dbus = common::mock_dbus(HashMap::from([(getuid(), vec![NO_RESTRICTIONS.clone()])])).await?;
common::resolve_with_module(libc::AF_INET, "gnome.org")?;
Ok(())
})
}
#[test]
@ -124,8 +129,8 @@ fork_test! {
)])).await?;
let system_addr = common::resolve_with_system(family, HOSTNAME)?;
let our_addr = common::resolve_with_module(family, HOSTNAME)?;
assert_eq!(system_addr, our_addr);
let our_addrs = common::resolve_with_module(family, HOSTNAME)?;
assert!(our_addrs.contains(&system_addr));
}
Ok(())
})
@ -144,10 +149,9 @@ fork_test! {
)])).await?;
let system_addr = common::resolve_with_system(libc::AF_INET, HOSTNAME)?;
let our_addr = common::resolve_with_module(libc::AF_INET, HOSTNAME)?;
assert_ne!(system_addr, our_addr);
assert_eq!(our_addr, IpAddr::V4(Ipv4Addr::UNSPECIFIED));
let our_addrs = common::resolve_with_module(libc::AF_INET, HOSTNAME)?;
assert!(!our_addrs.contains(&system_addr));
assert_eq!(our_addrs, [IpAddr::V4(Ipv4Addr::UNSPECIFIED)]);
Ok(())
})
}
@ -165,9 +169,9 @@ fork_test! {
)])).await;
let system_addr = common::resolve_with_system(libc::AF_INET6, HOSTNAME)?;
let our_addr = common::resolve_with_module(libc::AF_INET6, HOSTNAME)?;
assert_ne!(system_addr, our_addr);
assert_eq!(our_addr, IpAddr::V6(Ipv6Addr::UNSPECIFIED));
let our_addrs = common::resolve_with_module(libc::AF_INET6, HOSTNAME)?;
assert!(!our_addrs.contains(&system_addr));
assert_eq!(our_addrs, [IpAddr::V6(Ipv6Addr::UNSPECIFIED)]);
Ok(())
})
}
@ -176,14 +180,14 @@ fork_test! {
fn privileged_user_bypasses_restrictions() -> Result<()> {
common::setup()?;
const HOSTNAME: &str = "nudity.testcategory.com";
const HOSTNAME: &str = "malware.testcategory.com";
tokio::runtime::Runtime::new().unwrap().block_on(async {
for family in [libc::AF_INET, libc::AF_INET6] {
let _dbus = common::mock_dbus(HashMap::from([(getuid(), vec![ /* no restriction */])])).await?;
let _dbus = common::mock_dbus(HashMap::from([(getuid(), vec![NO_RESTRICTIONS.clone()])])).await?;
let system_addr = common::resolve_with_system(family, HOSTNAME)?;
let our_addr = common::resolve_with_module(family, HOSTNAME)?;
assert_eq!(system_addr, our_addr);
let our_addrs = common::resolve_with_module(family, HOSTNAME)?;
assert!(our_addrs.contains(&system_addr));
}
Ok(())
})