]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/test/test-socket-bind.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
3 #include "bpf-socket-bind.h"
4 #include "load-fragment.h"
6 #include "process-util.h"
7 #include "rlimit-util.h"
15 static int find_netcat_executable(char **ret_path
) {
16 char **candidates
= STRV_MAKE("ncat", "nc", "netcat");
19 STRV_FOREACH(c
, candidates
) {
20 r
= find_executable(*c
, ret_path
);
28 static int test_socket_bind(
30 const char *unit_name
,
31 const char *netcat_path
,
35 _cleanup_free_
char *exec_start
= NULL
;
36 _cleanup_(unit_freep
) Unit
*u
= NULL
;
37 CGroupContext
*cc
= NULL
;
40 assert_se(u
= unit_new(m
, sizeof(Service
)));
41 assert_se(unit_add_name(u
, unit_name
) == 0);
42 assert_se(cc
= unit_get_cgroup_context(u
));
44 STRV_FOREACH(rule
, allow_rules
) {
45 r
= config_parse_cgroup_socket_bind(
46 u
->id
, "filename", 1, "Service", 1, "SocketBindAllow", 0,
47 *rule
, &cc
->socket_bind_allow
, u
);
49 return log_unit_error_errno(u
, r
, "Failed to parse SocketBindAllow: %m");
52 fprintf(stderr
, "SocketBindAllow:");
53 LIST_FOREACH(socket_bind_items
, bi
, cc
->socket_bind_allow
)
54 cgroup_context_dump_socket_bind_item(bi
, stderr
);
57 STRV_FOREACH(rule
, deny_rules
) {
58 r
= config_parse_cgroup_socket_bind(
59 u
->id
, "filename", 1, "Service", 1, "SocketBindDeny", 0,
60 *rule
, &cc
->socket_bind_deny
, u
);
62 return log_unit_error_errno(u
, r
, "Failed to parse SocketBindDeny: %m");
65 fprintf(stderr
, "SocketBindDeny:");
66 LIST_FOREACH(socket_bind_items
, bi
, cc
->socket_bind_deny
)
67 cgroup_context_dump_socket_bind_item(bi
, stderr
);
70 exec_start
= strjoin("-timeout --preserve-status -sSIGTERM 1s ", netcat_path
, " -l ", port
, " -vv");
71 assert_se(exec_start
!= NULL
);
73 r
= config_parse_exec(u
->id
, "filename", 1, "Service", 1, "ExecStart",
74 SERVICE_EXEC_START
, exec_start
, SERVICE(u
)->exec_command
, u
);
76 return log_error_errno(r
, "Failed to parse ExecStart");
78 SERVICE(u
)->type
= SERVICE_ONESHOT
;
79 u
->load_state
= UNIT_LOADED
;
83 return log_error_errno(r
, "Unit start failed %m");
85 while (!IN_SET(SERVICE(u
)->state
, SERVICE_DEAD
, SERVICE_FAILED
)) {
86 r
= sd_event_run(m
->event
, UINT64_MAX
);
88 return log_error_errno(errno
, "Event run failed %m");
91 cld_code
= SERVICE(u
)->exec_command
[SERVICE_EXEC_START
]->exec_status
.code
;
92 if (cld_code
!= CLD_EXITED
)
93 return log_error_errno(SYNTHETIC_ERRNO(EBUSY
), "ExecStart didn't exited, code='%s'", sigchld_code_to_string(cld_code
));
95 if (SERVICE(u
)->state
!= SERVICE_DEAD
)
96 return log_error_errno(SYNTHETIC_ERRNO(EBUSY
), "Service is not dead");
101 int main(int argc
, char *argv
[]) {
102 _cleanup_free_
char *unit_dir
= NULL
, *netcat_path
= NULL
;
103 _cleanup_(rm_rf_physical_and_freep
) char *runtime_dir
= NULL
;
104 _cleanup_(manager_freep
) Manager
*m
= NULL
;
108 test_setup_logging(LOG_DEBUG
);
110 if (detect_container() > 0)
111 return log_tests_skipped("test-bpf fails inside LXC and Docker containers: https://github.com/systemd/systemd/issues/9666");
114 return log_tests_skipped("not running as root");
116 assert_se(getrlimit(RLIMIT_MEMLOCK
, &rl
) >= 0);
117 rl
.rlim_cur
= rl
.rlim_max
= MAX(rl
.rlim_max
, CAN_MEMLOCK_SIZE
);
118 (void) setrlimit_closest(RLIMIT_MEMLOCK
, &rl
);
121 return log_tests_skipped("Can't use mlock()");
123 r
= bpf_socket_bind_supported();
125 return log_tests_skipped("socket-bind is not supported");
127 if (find_netcat_executable(&netcat_path
) != 0)
128 return log_tests_skipped("Can not find netcat executable");
130 r
= enter_cgroup_subroot(NULL
);
132 return log_tests_skipped("cgroupfs not available");
134 assert_se(get_testdata_dir("units", &unit_dir
) >= 0);
135 assert_se(set_unit_path(unit_dir
) >= 0);
136 assert_se(runtime_dir
= setup_fake_runtime_dir());
138 assert_se(manager_new(UNIT_FILE_USER
, MANAGER_TEST_RUN_BASIC
, &m
) >= 0);
139 assert_se(manager_startup(m
, NULL
, NULL
, NULL
) >= 0);
141 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "2000", STRV_MAKE("2000"), STRV_MAKE("any")) >= 0);
142 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "2000", STRV_MAKE("ipv6:2001-2002"), STRV_MAKE("any")) >= 0);
143 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "6666", STRV_MAKE("ipv4:6666", "6667"), STRV_MAKE("any")) >= 0);
144 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "6666", STRV_MAKE("6667", "6668", ""), STRV_MAKE("any")) >= 0);
145 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "7777", STRV_MAKE_EMPTY
, STRV_MAKE_EMPTY
) >= 0);
146 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "8888", STRV_MAKE("any"), STRV_MAKE("any")) >= 0);
147 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "8888", STRV_MAKE("ipv6:tcp:8888-8889"), STRV_MAKE("any")) >= 0);
148 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "10000", STRV_MAKE("ipv6:udp:9999-10000"), STRV_MAKE("any")) >= 0);
149 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "6666", STRV_MAKE("ipv4:tcp:6666"), STRV_MAKE("any")) >= 0);
150 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "6666", STRV_MAKE("ipv4:udp:6666"), STRV_MAKE("any")) >= 0);
151 assert_se(test_socket_bind(m
, "socket_bind_test.service", netcat_path
, "6666", STRV_MAKE("tcp:6666"), STRV_MAKE("any")) >= 0);