@push.rocks/smartnftables 1.2.1 → 1.4.0

package/rust/src/owner_namespace_tests.rs

@@ -0,0 +1,242 @@
+use super::{empty, in_namespace, ip, isolated, options};
+use crate::owner::{Applied, Owner, Transition};
+use serde_json::{json, Value};
+use std::fs::{self, File};
+use std::io::{BufRead, BufReader, Read, Write};
+use std::os::fd::AsRawFd;
+use std::os::unix::fs::MetadataExt;
+use std::os::unix::process::CommandExt;
+use std::process::{Child, Command, Stdio};
+use std::sync::mpsc::{self, Receiver};
+use std::thread::{self, JoinHandle};
+use std::time::{Duration, Instant};
+
+fn command(namespace: &File) -> Command {
+    let fd = namespace.as_raw_fd();
+    let mut command = Command::new("/bin/managed");
+    command
+        .args(["--management", "--network-namespace-fd", "3"])
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::inherit());
+    unsafe {
+        command.pre_exec(move || {
+            if libc::dup2(fd, 3) < 0 || libc::fcntl(3, libc::F_SETFD, 0) < 0 {
+                return Err(std::io::Error::last_os_error());
+            }
+            Ok(())
+        });
+    }
+    command
+}
+
+struct NativeOwner {
+    child: Child,
+    messages: Receiver<Value>,
+    reader: Option<JoinHandle<()>>,
+}
+impl NativeOwner {
+    fn start(namespace: &File) -> Self {
+        let mut child = command(namespace).spawn().unwrap();
+        let output = child.stdout.take().unwrap();
+        let (send, messages) = mpsc::channel();
+        let reader = thread::spawn(move || {
+            for line in BufReader::new(output.take(1024 * 1024)).lines() {
+                let Ok(line) = line else { break };
+                if line.len() > 262_144 {
+                    break;
+                }
+                let Ok(value) = serde_json::from_str(&line) else {
+                    break;
+                };
+                if send.send(value).is_err() {
+                    break;
+                }
+            }
+        });
+        let owner = Self {
+            child,
+            messages,
+            reader: Some(reader),
+        };
+        assert_eq!(
+            owner.messages.recv_timeout(Duration::from_secs(5)).unwrap()["event"],
+            "ready"
+        );
+        owner
+    }
+    fn response(&mut self, method: &str, params: Value) -> Value {
+        writeln!(
+            self.child.stdin.as_mut().unwrap(),
+            "{}",
+            json!({"id":method,"method":method,"params":params})
+        )
+        .unwrap();
+        let response = self.messages.recv_timeout(Duration::from_secs(5)).unwrap();
+        assert_eq!(response["id"], method);
+        response
+    }
+    fn call(&mut self, method: &str, params: Value) -> Value {
+        let response = self.response(method, params);
+        assert_eq!(response["success"], true, "{response}");
+        response["result"].clone()
+    }
+}
+impl Drop for NativeOwner {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+        if let Some(reader) = self.reader.take() {
+            let _ = reader.join();
+        }
+    }
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn inherited_namespace_binds_policy_and_persistent_recovery() {
+    isolated();
+    ip(&["netns", "add", "fdtarget"]);
+    let namespace = File::open("/run/netns/fdtarget").unwrap();
+    let metadata = namespace.metadata().unwrap();
+    let initial = fs::metadata("/proc/thread-self/ns/net").unwrap();
+    assert_ne!(metadata.ino(), initial.ino());
+    let mut child = NativeOwner::start(&namespace);
+    let pid = child.child.id();
+    let status = child.call("openOwner", serde_json::to_value(options("nsfd")).unwrap());
+    assert_eq!(
+        status["identity"]["namespaceDevice"],
+        metadata.dev().to_string()
+    );
+    assert_eq!(
+        status["identity"]["namespaceInode"],
+        metadata.ino().to_string()
+    );
+    assert_eq!(
+        fs::read_dir(format!("/proc/{pid}/task")).unwrap().count(),
+        1
+    );
+    let target_link = fs::read_link(format!("/proc/{pid}/ns/net")).unwrap();
+    for fd in fs::read_dir(format!("/proc/{pid}/fd")).unwrap() {
+        if let Ok(target) = fs::read_link(fd.unwrap().path()) {
+            assert_ne!(
+                target, target_link,
+                "child namespace descriptor must be closed"
+            );
+        }
+    }
+    let first = child.call(
+        "reconcilePolicy",
+        serde_json::to_value(Transition {
+            previous: None,
+            target: empty(1),
+        })
+        .unwrap(),
+    );
+    assert!(Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none());
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_some()));
+    assert_eq!(
+        unsafe { libc::ioctl(namespace.as_raw_fd(), libc::NS_GET_NSTYPE) },
+        libc::CLONE_NEWNET
+    );
+    drop(child); // PERSIST must retain the target graph after native process loss.
+    assert!(!std::path::Path::new(&format!("/proc/{pid}")).exists());
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_some()));
+
+    let previous: Applied = serde_json::from_value(first).unwrap();
+    let transition = serde_json::to_value(Transition {
+        previous: Some(previous),
+        target: empty(2),
+    })
+    .unwrap();
+    let wrong_namespace = File::open("/proc/thread-self/ns/net").unwrap();
+    let mut wrong = NativeOwner::start(&wrong_namespace);
+    wrong.call("openOwner", serde_json::to_value(options("nsfd")).unwrap());
+    let denied = wrong.response("reconcilePolicy", transition.clone());
+    assert_eq!(denied["success"], false);
+    assert_eq!(denied["errorCode"], "CONFLICT");
+    assert!(Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none());
+    drop(wrong);
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_some()));
+
+    let mut recovered = NativeOwner::start(&namespace);
+    recovered.call("openOwner", serde_json::to_value(options("nsfd")).unwrap());
+    drop(namespace); // The entered child keeps membership; caller capability is not consumed by it.
+    let applied = recovered.call("reconcilePolicy", transition);
+    assert_eq!(applied["receipt"]["revision"], 2);
+    assert_eq!(
+        applied["receipt"]["identity"]["namespaceInode"],
+        metadata.ino().to_string()
+    );
+    assert_eq!(recovered.call("inspectPolicy", json!({}))["enforced"], true);
+    assert_eq!(recovered.call("closeOwner", json!({}))["released"], true);
+    drop(recovered);
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none()));
+    assert!(Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none());
+    assert_eq!(
+        fs::metadata("/proc/thread-self/ns/net").unwrap().ino(),
+        initial.ino()
+    );
+    ip(&["netns", "delete", "fdtarget"]);
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn valid_descriptor_without_entry_permission_never_becomes_ready() {
+    isolated();
+    let namespace = File::open("/proc/thread-self/ns/net").unwrap();
+    let mut child = command(&namespace)
+        .uid(65534)
+        .gid(65534)
+        .stdin(Stdio::null())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let deadline = Instant::now() + Duration::from_secs(5);
+    while child.try_wait().unwrap().is_none() {
+        if Instant::now() >= deadline {
+            let _ = child.kill();
+            let _ = child.wait();
+            panic!("denied namespace entry did not exit");
+        }
+        thread::sleep(Duration::from_millis(10));
+    }
+    let output = child.wait_with_output().unwrap();
+    assert_eq!(output.status.code(), Some(1));
+    assert!(output.stdout.is_empty());
+    assert!(String::from_utf8(output.stderr)
+        .unwrap()
+        .contains("network namespace entry failed"));
+    assert_eq!(
+        unsafe { libc::ioctl(namespace.as_raw_fd(), libc::NS_GET_NSTYPE) },
+        libc::CLONE_NEWNET
+    );
+}