Skip to content

Commit 97bf745

Browse files
WOnder93WOnder93
committed
tests: enable running with IPv6 disabled
Detect if IPv6 is disabled and only test IPv6 stuff if it is enabled. This allows to run the testsuite also on machines where IPv6 is disabled via kernel command line (ipv6.disable=1). Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
1 parent e03c12c commit 97bf745

4 files changed

Lines changed: 145 additions & 80 deletions

File tree

‎tests/extended_socket_class/test‎

Lines changed: 41 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,17 @@
11
#!/usr/bin/perl
22

33
use Test;
4-
BEGIN { plan tests => 16 }
4+
5+
BEGIN {
6+
if ( system("test -f /proc/net/if_inet6") eq 0 ) {
7+
$test_ipv6 = 1;
8+
plan tests => 16;
9+
}
10+
else {
11+
$test_ipv6 = 0;
12+
plan tests => 10;
13+
}
14+
}
515

616
$basedir = $0;
717
$basedir =~ s|(.*)/[^/]*|$1|;
@@ -20,17 +30,20 @@ $result = system(
2030
);
2131
ok($result);
2232

23-
# Verify that test_icmp_socket_t can create an ICMPv6 socket.
24-
$result = system(
33+
if ($test_ipv6) {
34+
35+
# Verify that test_icmp_socket_t can create an ICMPv6 socket.
36+
$result = system(
2537
"runcon -t test_icmp_socket_t -- $basedir/sockcreate inet6 dgram icmpv6 2>&1"
26-
);
27-
ok( $result, 0 );
38+
);
39+
ok( $result, 0 );
2840

29-
# Verify that test_no_icmp_socket_t cannot create an ICMPv6 socket.
30-
$result = system(
41+
# Verify that test_no_icmp_socket_t cannot create an ICMPv6 socket.
42+
$result = system(
3143
"runcon -t test_no_icmp_socket_t -- $basedir/sockcreate inet6 dgram icmpv6 2>&1"
32-
);
33-
ok($result);
44+
);
45+
ok($result);
46+
}
3447

3548
# Restore to the kernel defaults - no one allowed to create ICMP sockets.
3649
system("echo 1 0 > /proc/sys/net/ipv4/ping_group_range");
@@ -59,29 +72,32 @@ $result = system(
5972
);
6073
ok($result);
6174

62-
# Verify that test_sctp_socket_t can create an IPv6 stream SCTP socket.
63-
$result = system(
64-
"runcon -t test_sctp_socket_t -- $basedir/sockcreate inet6 stream sctp 2>&1"
65-
);
66-
ok( $result, 0 );
75+
if ($test_ipv6) {
6776

68-
# Verify that test_no_sctp_socket_t cannot create an IPv6 stream SCTP socket.
69-
$result = system(
77+
# Verify that test_sctp_socket_t can create an IPv6 stream SCTP socket.
78+
$result = system(
79+
"runcon -t test_sctp_socket_t -- $basedir/sockcreate inet6 stream sctp 2>&1"
80+
);
81+
ok( $result, 0 );
82+
83+
# Verify that test_no_sctp_socket_t cannot create an IPv6 stream SCTP socket.
84+
$result = system(
7085
"runcon -t test_no_sctp_socket_t -- $basedir/sockcreate inet6 stream sctp 2>&1"
71-
);
72-
ok($result);
86+
);
87+
ok($result);
7388

74-
# Verify that test_sctp_socket_t can create an IPv6 seqpacket SCTP socket.
75-
$result = system(
89+
# Verify that test_sctp_socket_t can create an IPv6 seqpacket SCTP socket.
90+
$result = system(
7691
"runcon -t test_sctp_socket_t -- $basedir/sockcreate inet6 seqpacket sctp 2>&1"
77-
);
78-
ok( $result, 0 );
92+
);
93+
ok( $result, 0 );
7994

8095
# Verify that test_no_sctp_socket_t cannot create an IPv6 seqpacket SCTP socket.
81-
$result = system(
96+
$result = system(
8297
"runcon -t test_no_sctp_socket_t -- $basedir/sockcreate inet6 seqpacket sctp 2>&1"
83-
);
84-
ok($result);
98+
);
99+
ok($result);
100+
}
85101

86102
# Verify that test_bluetooth_socket_t can create a Bluetooth socket.
87103
$result = system(

‎tests/inet_socket/ipsec-load‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ ip xfrm policy add src 127.0.0.1 dst 127.0.0.1 proto tcp dir out ctx "system_u:o
1111
ip xfrm policy add src 127.0.0.1 dst 127.0.0.1 proto udp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required
1212

1313
# IPv6 loopback
14-
ip xfrm state add src ::1 dst ::1 proto ah spi 0x200 ctx $goodclientcon auth sha1 0123456789012345
15-
ip xfrm state add src ::1 dst ::1 proto ah spi 0x250 ctx $badclientcon auth sha1 0123456789012345
16-
ip xfrm policy add src ::1 dst ::1 proto tcp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required
17-
ip xfrm policy add src ::1 dst ::1 proto udp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required
14+
if test -f /proc/net/if_inet6; then
15+
ip xfrm state add src ::1 dst ::1 proto ah spi 0x200 ctx $goodclientcon auth sha1 0123456789012345
16+
ip xfrm state add src ::1 dst ::1 proto ah spi 0x250 ctx $badclientcon auth sha1 0123456789012345
17+
ip xfrm policy add src ::1 dst ::1 proto tcp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required
18+
ip xfrm policy add src ::1 dst ::1 proto udp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required
19+
fi

‎tests/inet_socket/server.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,12 +39,16 @@ int main(int argc, char **argv)
3939
socklen_t sinlen;
4040
struct sockaddr_storage sin;
4141
struct addrinfo hints, *res;
42+
sa_family_t family = AF_INET;
4243
char byte;
4344
bool nopeer = false;
4445
char *flag_file = NULL;
4546

46-
while ((opt = getopt(argc, argv, "f:n")) != -1) {
47+
while ((opt = getopt(argc, argv, "6f:n")) != -1) {
4748
switch (opt) {
49+
case '6':
50+
family = AF_INET6;
51+
break;
4852
case 'f':
4953
flag_file = optarg;
5054
break;
@@ -61,7 +65,7 @@ int main(int argc, char **argv)
6165

6266
memset(&hints, 0, sizeof(struct addrinfo));
6367
hints.ai_flags = AI_PASSIVE;
64-
hints.ai_family = AF_INET6;
68+
hints.ai_family = family;
6569

6670
if (!strcmp(argv[optind], "stream")) {
6771
hints.ai_socktype = SOCK_STREAM;

‎tests/inet_socket/test‎

Lines changed: 92 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,13 @@ BEGIN {
55
$basedir = $0;
66
$basedir =~ s|(.*)/[^/]*|$1|;
77

8-
$test_count = 38;
8+
$test_count_ipv4 = 34;
9+
$test_count_ipv6 = 4;
910

1011
$test_ipsec = 0;
1112
if ( system("ip xfrm policy help 2>&1 | grep -q ctx") eq 0 ) {
12-
$test_count += 8;
13+
$test_count_ipv4 += 4;
14+
$test_count_ipv6 += 4;
1315
$test_ipsec = 1;
1416
}
1517

@@ -23,10 +25,17 @@ BEGIN {
2325

2426
$rc = `$basedir/../kvercmp $kvercur $kverminstream`;
2527
if ( $netlabelctl gt "021" and $rc > 0 ) {
26-
$test_count += 3;
28+
$test_count_ipv6 += 3;
2729
$test_calipso_stream = 1;
2830
}
2931

32+
$test_count = $test_count_ipv4;
33+
$test_ipv6 = 0;
34+
if ( system("test -f /proc/net/if_inet6") eq 0 ) {
35+
$test_count += $test_count_ipv6;
36+
$test_ipv6 = 1;
37+
}
38+
3039
plan tests => $test_count;
3140
}
3241

@@ -298,16 +307,6 @@ if ($test_ipsec) {
298307
"runcon -t test_inet_bad_client_t -- $basedir/client stream 127.0.0.1 65535 2>&1";
299308
ok( $result >> 8 eq 5 );
300309

301-
# Verify that authorized client can communicate with the server.
302-
$result =
303-
system "runcon -t test_inet_client_t $basedir/client stream ::1 65535";
304-
ok( $result eq 0 );
305-
306-
# Verify that unauthorized client cannot communicate with the server.
307-
$result = system
308-
"runcon -t test_inet_bad_client_t -- $basedir/client stream ::1 65535 2>&1";
309-
ok( $result >> 8 eq 5 );
310-
311310
# Kill the server.
312311
server_end($pid);
313312

@@ -325,24 +324,50 @@ if ($test_ipsec) {
325324
"runcon -t test_inet_bad_client_t -- $basedir/client dgram 127.0.0.1 65535 2>&1";
326325
ok( $result >> 8 eq 8 );
327326

328-
# Verify that unauthorized client cannot communicate with the server.
329-
$result = system
330-
"runcon -t test_inet_bad_client_t -- $basedir/client dgram ::1 65535 2>&1";
331-
ok( $result >> 8 eq 8 );
332-
333327
# Kill the server.
334328
server_end($pid);
335329

336-
# Start the dgram server for IPSEC test using IPv6 but do not request peer context.
337-
$pid = server_start( "-t test_inet_server_t", "-n dgram 65535" );
330+
if ($test_ipv6) {
338331

339-
# This test now passes.
340-
$result = system
341-
"runcon -t test_inet_client_t $basedir/client -e nopeer dgram ::1 65535";
342-
ok( $result eq 0 );
332+
# Start the IPv6 stream server.
333+
$pid = server_start( "-t test_inet_server_t", "-6 stream 65535" );
343334

344-
# Kill the server.
345-
server_end($pid);
335+
# Verify that authorized client can communicate with the server.
336+
$result = system
337+
"runcon -t test_inet_client_t $basedir/client stream ::1 65535";
338+
ok( $result eq 0 );
339+
340+
# Verify that unauthorized client cannot communicate with the server.
341+
$result = system
342+
"runcon -t test_inet_bad_client_t -- $basedir/client stream ::1 65535 2>&1";
343+
ok( $result >> 8 eq 5 );
344+
345+
# Kill the server.
346+
server_end($pid);
347+
348+
# Start the IPv6 dgram server.
349+
$pid = server_start( "-t test_inet_server_t", "-6 dgram 65535" );
350+
351+
# Verify that unauthorized client cannot communicate with the server.
352+
$result = system
353+
"runcon -t test_inet_bad_client_t -- $basedir/client dgram ::1 65535 2>&1";
354+
ok( $result >> 8 eq 8 );
355+
356+
# Kill the server.
357+
server_end($pid);
358+
359+
# Start the dgram server for IPSEC test using IPv6 but do not request
360+
# peer context.
361+
$pid = server_start( "-t test_inet_server_t", "-6n dgram 65535" );
362+
363+
# This test now passes.
364+
$result = system
365+
"runcon -t test_inet_client_t $basedir/client -e nopeer dgram ::1 65535";
366+
ok( $result eq 0 );
367+
368+
# Kill the server.
369+
server_end($pid);
370+
}
346371

347372
# Flush IPSEC configuration.
348373
system "/bin/sh $basedir/ipsec-flush";
@@ -364,16 +389,6 @@ $result = system
364389
"runcon -t test_inet_bad_client_t -- $basedir/client -e nopeer stream 127.0.0.1 65535 2>&1";
365390
ok( $result >> 8 eq 5 );
366391

367-
# Verify that authorized client can communicate with the server.
368-
$result = system
369-
"runcon -t test_inet_client_t -- $basedir/client -e nopeer stream ::1 65535";
370-
ok( $result eq 0 );
371-
372-
# Verify that unauthorized client cannot communicate with the server.
373-
$result = system
374-
"runcon -t test_inet_bad_client_t -- $basedir/client -e nopeer stream ::1 65535 2>&1";
375-
ok( $result >> 8 eq 5 );
376-
377392
# Kill the server.
378393
server_end($pid);
379394

@@ -390,41 +405,69 @@ $result = system
390405
"runcon -t test_inet_bad_client_t -- $basedir/client -e nopeer dgram 127.0.0.1 65535 2>&1";
391406
ok( $result >> 8 eq 8 );
392407

393-
# Verify that authorized client can communicate with the server.
394-
$result = system
395-
"runcon -t test_inet_client_t $basedir/client -e nopeer dgram ::1 65535";
396-
ok( $result eq 0 );
408+
# Kill the server.
409+
server_end($pid);
397410

398-
# Verify that unauthorized client cannot communicate with the server.
399-
$result = system
411+
if ($test_ipv6) {
412+
413+
# Start the IPv6 stream server.
414+
$pid = server_start( "-t test_inet_server_t", "-6n stream 65535" );
415+
416+
# Verify that authorized client can communicate with the server.
417+
$result = system
418+
"runcon -t test_inet_client_t -- $basedir/client -e nopeer stream ::1 65535";
419+
ok( $result eq 0 );
420+
421+
# Verify that unauthorized client cannot communicate with the server.
422+
$result = system
423+
"runcon -t test_inet_bad_client_t -- $basedir/client -e nopeer stream ::1 65535 2>&1";
424+
ok( $result >> 8 eq 5 );
425+
426+
# Kill the server.
427+
server_end($pid);
428+
429+
# Start the IPv6 dgram server.
430+
$pid = server_start( "-t test_inet_server_t", "-6n dgram 65535" );
431+
432+
# Verify that authorized client can communicate with the server.
433+
$result = system
434+
"runcon -t test_inet_client_t $basedir/client -e nopeer dgram ::1 65535";
435+
ok( $result eq 0 );
436+
437+
# Verify that unauthorized client cannot communicate with the server.
438+
$result = system
400439
"runcon -t test_inet_bad_client_t -- $basedir/client -e nopeer dgram ::1 65535 2>&1";
401-
ok( $result >> 8 eq 8 );
440+
ok( $result >> 8 eq 8 );
402441

403-
# Kill the server.
404-
server_end($pid);
442+
# Kill the server.
443+
server_end($pid);
444+
}
405445

406446
# Flush iptables configuration.
407447
system "/bin/sh $basedir/iptables-flush";
408448

409-
if ($test_calipso_stream) {
449+
if ( $test_ipv6 and $test_calipso_stream ) {
410450

411451
# Load NetLabel configuration for CALIPSO/IPv6 labeling over loopback.
412452
system "/bin/sh $basedir/calipso-load";
413453

414454
# Start the stream server.
415-
$pid = server_start( "-t test_inet_server_t -l s0:c0.c10", "stream 65535" );
455+
$pid =
456+
server_start( "-t test_inet_server_t -l s0:c0.c10", "-6 stream 65535" );
416457

417458
# Verify that authorized client can communicate with the server.
418459
$result = system
419460
"runcon -t test_inet_client_t -l s0:c0.c10 $basedir/client -e system_u:object_r:netlabel_peer_t:s0:c0.c10 stream ::1 65535";
420461
ok( $result eq 0 );
421462

422-
# Verify that authorized client can communicate with the server using different valid level.
463+
# Verify that authorized client can communicate with the server using
464+
# different valid level.
423465
$result = system
424466
"runcon -t test_inet_client_t -l s0:c8.c10 $basedir/client -e system_u:object_r:netlabel_peer_t:s0:c8.c10 stream ::1 65535";
425467
ok( $result eq 0 );
426468

427-
# Verify that authorized client cannot communicate with the server using invalid level.
469+
# Verify that authorized client cannot communicate with the server using
470+
# invalid level.
428471
$result = system
429472
"runcon -t test_inet_client_t -l s0:c8.c12 -- $basedir/client stream ::1 65535 2>&1";
430473
ok( $result >> 8 eq 5 );

0 commit comments

Comments
 (0)