src/test/test-socket-bind.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include "bpf-socket-bind.h"
   4 #include "load-fragment.h"
   5 #include "manager.h"
   6 #include "process-util.h"
   7 #include "rlimit-util.h"
   8 #include "rm-rf.h"
   9 #include "service.h"
  10 #include "strv.h"
  11 #include "tests.h"
  12 #include "unit.h"
  13 #include "virt.h"
  14
  15 static int find_netcat_executable(char **ret_path) {
  16         char **candidates = STRV_MAKE("ncat", "nc", "netcat"), **c;
  17         int r = 0;
  18
  19         STRV_FOREACH(c, candidates) {
  20                 r = find_executable(*c, ret_path);
  21                 if (r == 0)
  22                         break;
  23         }
  24
  25         return r;
  26 }
  27
  28 static int test_socket_bind(
  29                 Manager *m,
  30                 const char *unit_name,
  31                 const char *netcat_path,
  32                 const char *port,
  33                 char **allow_rules,
  34                 char **deny_rules) {
  35         _cleanup_free_ char *exec_start = NULL;
  36         _cleanup_(unit_freep) Unit *u = NULL;
  37         CGroupSocketBindItem *bi;
  38         CGroupContext *cc = NULL;
  39         char **rule;
  40         int cld_code, r;
  41
  42         assert_se(u = unit_new(m, sizeof(Service)));
  43         assert_se(unit_add_name(u, unit_name) == 0);
  44         assert_se(cc = unit_get_cgroup_context(u));
  45
  46         STRV_FOREACH(rule, allow_rules) {
  47                 r = config_parse_cgroup_socket_bind(
  48                                 u->id, "filename", 1, "Service", 1, "SocketBindAllow", 0,
  49                                 *rule, &cc->socket_bind_allow, u);
  50                 if (r < 0)
  51                         return log_unit_error_errno(u, r, "Failed to parse SocketBindAllow: %m");
  52         }
  53
  54         fprintf(stderr, "SocketBindAllow:");
  55         LIST_FOREACH(socket_bind_items, bi, cc->socket_bind_allow)
  56                 cgroup_context_dump_socket_bind_item(bi, stderr);
  57         fputc('\n', stderr);
  58
  59         STRV_FOREACH(rule, deny_rules) {
  60                 r = config_parse_cgroup_socket_bind(
  61                                 u->id, "filename", 1, "Service", 1, "SocketBindDeny", 0,
  62                                 *rule, &cc->socket_bind_deny, u);
  63                 if (r < 0)
  64                         return log_unit_error_errno(u, r, "Failed to parse SocketBindDeny: %m");
  65         }
  66
  67         fprintf(stderr, "SocketBindDeny:");
  68         LIST_FOREACH(socket_bind_items, bi, cc->socket_bind_deny)
  69                 cgroup_context_dump_socket_bind_item(bi, stderr);
  70         fputc('\n', stderr);
  71
  72         exec_start = strjoin("-timeout --preserve-status -sSIGTERM 1s ", netcat_path, " -l ", port, " -vv");
  73         assert_se(exec_start != NULL);
  74
  75         r = config_parse_exec(u->id, "filename", 1, "Service", 1, "ExecStart",
  76                         SERVICE_EXEC_START, exec_start, SERVICE(u)->exec_command, u);
  77         if (r < 0)
  78                 return log_error_errno(r, "Failed to parse ExecStart");
  79
  80         SERVICE(u)->type = SERVICE_ONESHOT;
  81         u->load_state = UNIT_LOADED;
  82
  83         r = unit_start(u);
  84         if (r < 0)
  85                 return log_error_errno(r, "Unit start failed %m");
  86
  87         while (!IN_SET(SERVICE(u)->state, SERVICE_DEAD, SERVICE_FAILED)) {
  88                 r = sd_event_run(m->event, UINT64_MAX);
  89                 if (r < 0)
  90                         return log_error_errno(errno, "Event run failed %m");
  91         }
  92
  93         cld_code = SERVICE(u)->exec_command[SERVICE_EXEC_START]->exec_status.code;
  94         if (cld_code != CLD_EXITED)
  95                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY), "ExecStart didn't exited, code='%s'", sigchld_code_to_string(cld_code));
  96
  97         if (SERVICE(u)->state != SERVICE_DEAD)
  98                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY), "Service is not dead");
  99
 100         return 0;
 101 }
 102
 103 int main(int argc, char *argv[]) {
 104         _cleanup_free_ char *unit_dir = NULL, *netcat_path = NULL;
 105         _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL;
 106         _cleanup_(manager_freep) Manager *m = NULL;
 107         struct rlimit rl;
 108         int r;
 109
 110         test_setup_logging(LOG_DEBUG);
 111
 112         if (detect_container() > 0)
 113                 return log_tests_skipped("test-bpf fails inside LXC and Docker containers: https://github.com/systemd/systemd/issues/9666");
 114
 115         if (getuid() != 0)
 116                 return log_tests_skipped("not running as root");
 117
 118         assert_se(getrlimit(RLIMIT_MEMLOCK, &rl) >= 0);
 119         rl.rlim_cur = rl.rlim_max = MAX(rl.rlim_max, CAN_MEMLOCK_SIZE);
 120         (void) setrlimit_closest(RLIMIT_MEMLOCK, &rl);
 121
 122         if (!can_memlock())
 123                 return log_tests_skipped("Can't use mlock()");
 124
 125         r = bpf_socket_bind_supported();
 126         if (r <= 0)
 127                 return log_tests_skipped("socket-bind is not supported");
 128
 129         if (find_netcat_executable(&netcat_path) != 0)
 130                 return log_tests_skipped("Can not find netcat executable");
 131
 132         r = enter_cgroup_subroot(NULL);
 133         if (r == -ENOMEDIUM)
 134                 return log_tests_skipped("cgroupfs not available");
 135
 136         assert_se(get_testdata_dir("units", &unit_dir) >= 0);
 137         assert_se(set_unit_path(unit_dir) >= 0);
 138         assert_se(runtime_dir = setup_fake_runtime_dir());
 139
 140         assert_se(manager_new(UNIT_FILE_USER, MANAGER_TEST_RUN_BASIC, &m) >= 0);
 141         assert_se(manager_startup(m, NULL, NULL, NULL) >= 0);
 142
 143         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "2000", STRV_MAKE("2000"), STRV_MAKE("any")) >= 0);
 144         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "2000", STRV_MAKE("ipv6:2001-2002"), STRV_MAKE("any")) >= 0);
 145         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "6666", STRV_MAKE("ipv4:6666", "6667"), STRV_MAKE("any")) >= 0);
 146         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "6666", STRV_MAKE("6667", "6668", ""), STRV_MAKE("any")) >= 0);
 147         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "7777", STRV_MAKE_EMPTY, STRV_MAKE_EMPTY) >= 0);
 148         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "8888", STRV_MAKE("any"), STRV_MAKE("any")) >= 0);
 149         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "8888", STRV_MAKE("ipv6:tcp:8888-8889"), STRV_MAKE("any")) >= 0);
 150         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "10000", STRV_MAKE("ipv6:udp:9999-10000"), STRV_MAKE("any")) >= 0);
 151         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "6666", STRV_MAKE("ipv4:tcp:6666"), STRV_MAKE("any")) >= 0);
 152         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "6666", STRV_MAKE("ipv4:udp:6666"), STRV_MAKE("any")) >= 0);
 153         assert_se(test_socket_bind(m, "socket_bind_test.service", netcat_path, "6666", STRV_MAKE("tcp:6666"), STRV_MAKE("any")) >= 0);
 154
 155         return 0;
 156 }