malcontent-dns-parental-controls/tests/integration_test.rs

// SPDX-FileCopyrightText: 2022 Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
// SPDX-License-Identifier: GPL-3.0-or-later

mod common;

use {
    crate::common::{Eai, Restriction, Restrictions},
    anyhow::Result,
    libc::{freeaddrinfo, gai_strerror, getaddrinfo},
    nix::unistd::getuid,
    once_cell::sync::Lazy,
    std::collections::HashMap,
    std::net::{IpAddr, Ipv4Addr, Ipv6Addr},
};

static CLOUDFLARE_PARENTALCONTROL_ADDRS: Lazy<Restrictions> = Lazy::new(|| {
    vec![
        Restriction {
            ip: IpAddr::V4(Ipv4Addr::new(1, 1, 1, 3)),
            hostname: "cloudflare-dns.com".into(),
        },
        Restriction {
            ip: IpAddr::V4(Ipv4Addr::new(1, 0, 0, 3)),
            hostname: "cloudflare-dns.com".into(),
        },
        Restriction {
            ip: IpAddr::V6(Ipv6Addr::new(2606, 4700, 4700, 0, 0, 0, 0, 1113)),
            hostname: "cloudflare-dns.com".into(),
        },
        Restriction {
            ip: IpAddr::V6(Ipv6Addr::new(2606, 4700, 4700, 0, 0, 0, 0, 1003)),
            hostname: "cloudflare-dns.com".into(),
        },
    ]
});

fork_test! {
    #[test]
    fn nss_module_is_loaded() -> Result<()> {
        common::setup()?;
        common::resolve_with_module(libc::AF_INET, "gnome.org")?;
        Ok(())
    }

    #[test]
    fn application_dns_is_nxdomain() -> Result<()> {
        common::setup()?;
        tokio::runtime::Runtime::new().unwrap().block_on(async {
            let _dbus = common::mock_dbus(HashMap::from([(
                getuid(),
                vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()],
            )])).await?;

            let hostname = std::ffi::CString::new("use-application-dns.net").unwrap();
            unsafe {
                let mut addr = std::ptr::null_mut();
                let getaddrinfo_status = getaddrinfo(
                    hostname.as_ptr(),
                    std::ptr::null(),
                    std::ptr::null(),
                    &mut addr,
                );

                let error = std::ffi::CStr::from_ptr(gai_strerror(getaddrinfo_status));
                assert_eq!(
                    getaddrinfo_status,
                    Eai::NoName.0,
                    "Should have gotten no hostname (NXDOMAIN), instead got {}",
                    error.to_str().unwrap()
                );
                freeaddrinfo(addr);
            };

            Ok(())
        })
    }

    #[test]
    fn getaddrinfo_resolution() -> Result<()> {
        common::setup()?;

        const HOSTNAME: &str = "gnome.org";

        tokio::runtime::Runtime::new().unwrap().block_on(async {
            let _dbus = common::mock_dbus(HashMap::from([(
                getuid(),
                vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()],
            )])).await?;

            unsafe {
                let mut addr = std::ptr::null_mut();
                let getaddrinfo_status = getaddrinfo(
                    std::ffi::CString::new(HOSTNAME)?.as_ptr(),
                    std::ptr::null(),
                    std::ptr::null(),
                    &mut addr,
                );

                let error = std::ffi::CStr::from_ptr(gai_strerror(getaddrinfo_status));
                assert_eq!(
                    getaddrinfo_status,
                    Eai::Success.0,
                    "Should have gotten an hostname, instead got {}",
                    error.to_str().unwrap()
                );
                freeaddrinfo(addr);
            };

            Ok(())
        })
    }

    #[test]
    fn wikipedia_is_unrestricted() -> Result<()> {
        common::setup()?;

        const HOSTNAME: &str = "wikipedia.org";

        tokio::runtime::Runtime::new().unwrap().block_on(async {
            for family in [libc::AF_INET, libc::AF_INET6] {
                let _dbus = common::mock_dbus(HashMap::from([(
                    getuid(),
                    vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()],
                )])).await?;

                let system_addr = common::resolve_with_system(family, HOSTNAME)?;
                let our_addr = common::resolve_with_module(family, HOSTNAME)?;
                assert_eq!(system_addr, our_addr);
            }
            Ok(())
        })
    }

    #[test]
    fn adultsite_is_restricted_ipv4() -> Result<()> {
        common::setup()?;

        const HOSTNAME: &str = "nudity.testcategory.com";

        tokio::runtime::Runtime::new().unwrap().block_on(async {
            let _dbus = common::mock_dbus(HashMap::from([(
                getuid(),
                vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()],
            )])).await?;

            let system_addr = common::resolve_with_system(libc::AF_INET, HOSTNAME)?;
            let our_addr = common::resolve_with_module(libc::AF_INET, HOSTNAME)?;
            assert_ne!(system_addr, our_addr);
            assert_eq!(our_addr, IpAddr::V4(Ipv4Addr::UNSPECIFIED));

            Ok(())
        })
    }

    #[test]
    fn adultsite_is_restricted_ipv6() -> Result<()> {
        common::setup()?;

        const HOSTNAME: &str = "nudity.testcategory.com";

        tokio::runtime::Runtime::new().unwrap().block_on(async {
            let _dbus = common::mock_dbus(HashMap::from([(
                getuid(),
                vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()],
            )])).await;

            let system_addr = common::resolve_with_system(libc::AF_INET6, HOSTNAME)?;
            let our_addr = common::resolve_with_module(libc::AF_INET6, HOSTNAME)?;
            assert_ne!(system_addr, our_addr);
            assert_eq!(our_addr, IpAddr::V6(Ipv6Addr::UNSPECIFIED));
            Ok(())
        })
    }

    #[test]
    fn privileged_user_bypasses_restrictions() -> Result<()> {
        common::setup()?;

        const HOSTNAME: &str = "nudity.testcategory.com";

        tokio::runtime::Runtime::new().unwrap().block_on(async {
            for family in [libc::AF_INET, libc::AF_INET6] {
                let _dbus = common::mock_dbus(HashMap::from([(getuid(), vec![ /* no restriction */])])).await?;
                let system_addr = common::resolve_with_system(family, HOSTNAME)?;
                let our_addr = common::resolve_with_module(family, HOSTNAME)?;
                assert_eq!(system_addr, our_addr);
            }
            Ok(())
        })
    }
}