@@ -85,18 +85,18 @@ static void setup_loopback(struct __test_metadata *const _metadata)
85
85
clear_ambient_cap (_metadata , CAP_NET_ADMIN );
86
86
}
87
87
88
+ static bool prot_is_tcp (const struct protocol_variant * const prot )
89
+ {
90
+ return (prot -> domain == AF_INET || prot -> domain == AF_INET6 ) &&
91
+ prot -> type == SOCK_STREAM &&
92
+ (prot -> protocol == IPPROTO_TCP || prot -> protocol == IPPROTO_IP );
93
+ }
94
+
88
95
static bool is_restricted (const struct protocol_variant * const prot ,
89
96
const enum sandbox_type sandbox )
90
97
{
91
- switch (prot -> domain ) {
92
- case AF_INET :
93
- case AF_INET6 :
94
- switch (prot -> type ) {
95
- case SOCK_STREAM :
96
- return sandbox == TCP_SANDBOX ;
97
- }
98
- break ;
99
- }
98
+ if (sandbox == TCP_SANDBOX )
99
+ return prot_is_tcp (prot );
100
100
return false;
101
101
}
102
102
@@ -105,7 +105,7 @@ static int socket_variant(const struct service_fixture *const srv)
105
105
int ret ;
106
106
107
107
ret = socket (srv -> protocol .domain , srv -> protocol .type | SOCK_CLOEXEC ,
108
- 0 );
108
+ srv -> protocol . protocol );
109
109
if (ret < 0 )
110
110
return - errno ;
111
111
return ret ;
@@ -290,22 +290,48 @@ FIXTURE_TEARDOWN(protocol)
290
290
}
291
291
292
292
/* clang-format off */
293
- FIXTURE_VARIANT_ADD (protocol , no_sandbox_with_ipv4_tcp ) {
293
+ FIXTURE_VARIANT_ADD (protocol , no_sandbox_with_ipv4_tcp1 ) {
294
294
/* clang-format on */
295
295
.sandbox = NO_SANDBOX ,
296
296
.prot = {
297
297
.domain = AF_INET ,
298
298
.type = SOCK_STREAM ,
299
+ /* IPPROTO_IP == 0 */
300
+ .protocol = IPPROTO_IP ,
299
301
},
300
302
};
301
303
302
304
/* clang-format off */
303
- FIXTURE_VARIANT_ADD (protocol , no_sandbox_with_ipv6_tcp ) {
305
+ FIXTURE_VARIANT_ADD (protocol , no_sandbox_with_ipv4_tcp2 ) {
306
+ /* clang-format on */
307
+ .sandbox = NO_SANDBOX ,
308
+ .prot = {
309
+ .domain = AF_INET ,
310
+ .type = SOCK_STREAM ,
311
+ .protocol = IPPROTO_TCP ,
312
+ },
313
+ };
314
+
315
+ /* clang-format off */
316
+ FIXTURE_VARIANT_ADD (protocol , no_sandbox_with_ipv6_tcp1 ) {
304
317
/* clang-format on */
305
318
.sandbox = NO_SANDBOX ,
306
319
.prot = {
307
320
.domain = AF_INET6 ,
308
321
.type = SOCK_STREAM ,
322
+ /* IPPROTO_IP == 0 */
323
+ .protocol = IPPROTO_IP ,
324
+ },
325
+ };
326
+
327
+ /* clang-format off */
328
+ FIXTURE_VARIANT_ADD (protocol , no_sandbox_with_ipv6_tcp2 ) {
329
+ /* clang-format on */
330
+ .sandbox = NO_SANDBOX ,
331
+ .prot = {
332
+ .domain = AF_INET6 ,
333
+ .type = SOCK_STREAM ,
334
+ .protocol = IPPROTO_TCP ,
309
335
},
310
336
};
311
337
@@ -350,22 +376,48 @@ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_unix_datagram) {
350
376
};
351
377
352
378
/* clang-format off */
353
- FIXTURE_VARIANT_ADD (protocol , tcp_sandbox_with_ipv4_tcp ) {
379
+ FIXTURE_VARIANT_ADD (protocol , tcp_sandbox_with_ipv4_tcp1 ) {
380
+ /* clang-format on */
381
+ .sandbox = TCP_SANDBOX ,
382
+ .prot = {
383
+ .domain = AF_INET ,
384
+ .type = SOCK_STREAM ,
385
+ /* IPPROTO_IP == 0 */
386
+ .protocol = IPPROTO_IP ,
387
+ },
388
+ };
389
+
390
+ /* clang-format off */
391
+ FIXTURE_VARIANT_ADD (protocol , tcp_sandbox_with_ipv4_tcp2 ) {
354
392
/* clang-format on */
355
393
.sandbox = TCP_SANDBOX ,
356
394
.prot = {
357
395
.domain = AF_INET ,
358
396
.type = SOCK_STREAM ,
397
+ .protocol = IPPROTO_TCP ,
398
+ },
399
+ };
400
+
401
+ /* clang-format off */
402
+ FIXTURE_VARIANT_ADD (protocol , tcp_sandbox_with_ipv6_tcp1 ) {
403
+ /* clang-format on */
404
+ .sandbox = TCP_SANDBOX ,
405
+ .prot = {
406
+ .domain = AF_INET6 ,
407
+ .type = SOCK_STREAM ,
408
+ /* IPPROTO_IP == 0 */
409
+ .protocol = IPPROTO_IP ,
359
410
},
360
411
};
361
412
362
413
/* clang-format off */
363
- FIXTURE_VARIANT_ADD (protocol , tcp_sandbox_with_ipv6_tcp ) {
414
+ FIXTURE_VARIANT_ADD (protocol , tcp_sandbox_with_ipv6_tcp2 ) {
364
415
/* clang-format on */
365
416
.sandbox = TCP_SANDBOX ,
366
417
.prot = {
367
418
.domain = AF_INET6 ,
368
419
.type = SOCK_STREAM ,
420
+ .protocol = IPPROTO_TCP ,
369
421
},
370
422
};
371
423
0 commit comments