netfilter integration: add netfilter contexts sorting test case

PATCH In review Christopher J. PeBenito 1 participant 1 message Jul 17, 2006 SELinux security module

lore

Share & tools

lore

Christopher J. PeBenito

author

2006-07-17 20:31 UTC #0 lore raw

PATCH 6/6 netfilter integration: add netfilter contexts sorting test case

Add unit test for netfilter contexts sorting.

 libsemanage/tests/Makefile              |    6 +-
 libsemanage/tests/nc_sort_malformed     |   25 ++++++++++
 libsemanage/tests/nc_sort_sorted        |   25 ++++++++++
 libsemanage/tests/nc_sort_unsorted      |   27 +++++++++++
 libsemanage/tests/test_semanage_store.c |   73 ++++++++++++++++++++++++++++++++
 libsemanage/tests/test_semanage_store.h |    2
 6 files changed, 155 insertions(+), 3 deletions(-)

libsemanage/tests/Makefile +3 -3

diff --exclude .svn -purN trunk/libsemanage/tests/Makefile netfilter-integration/libsemanage/tests/Makefile
@@ -5,7 +5,7 @@ SOURCES = $(wildcard *.c)
 TESTSRC=../src
 
 # Add the required external object files here:
-LIBSEMANAGE = ../src/libsemanage.a
+LIBS = ../src/libsemanage.a ../../libselinux/src/libselinux.a ../../libsepol/src/libsepol.a
 
 ###########################################################################

@@ -13,13 +13,13 @@ EXECUTABLE = libsemanage-tests
 CC = gcc
 CFLAGS = -c -g -o0 -Wall -W -Wundef -Wmissing-noreturn -Wmissing-format-attribute -Wno-unused-parameter
 INCLUDE = -I$(TESTSRC) -I$(TESTSRC)/../include/semanage
-LDFLAGS = -lcunit -lsemanage
+LDFLAGS = -lcunit
 OBJECTS = $(SOURCES:.c=.o) 
 
 all: $(EXECUTABLE) 
 
 $(EXECUTABLE): $(OBJECTS) 
-	$(CC) $(OBJECTS) $(LIBSEMANAGE) $(LDFLAGS) -o $@
+	$(CC) $(OBJECTS) $(LIBS) $(LDFLAGS) -o $@
 
 %.o: %.c
 	$(CC) $(CFLAGS) $(INCLUDE) $*.c -o $*.o

libsemanage/tests/nc_sort_malformed +25 -0

diff --exclude .svn -purN trunk/libsemanage/tests/nc_sort_malformed netfilter-integration/libsemanage/tests/nc_sort_malformed
@@ -0,0 +1,25 @@
+1 *mangle
+1 :PREROUTING ACCEPT [0:0]
+1 :INPUT ACCEPT [0:0]
+1 :FORWARD ACCEPT [0:0]
+1 :OUTPUT ACCEPT [0:0]
+1 :POSTROUTING ACCEPT [0:0]
+1 :selinux_input - [0:0]
+1 :selinux_output - [0:0]
+1 :selinux_new_input - [0:0]
+1 :selinux_new_output - [0:0]
+1 -A INPUT -j selinux_input
+1 -A OUTPUT -j selinux_output
+1 -A selinux_input -m state --state NEW -j selinux_new_input
+1 -A selinux_input -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore
+1 -A selinux_output -m state --state NEW -j selinux_new_output
+1 -A selinux_output -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore
+1 -A selinux_new_input -j SECMARK --selctx system_u:object_r:server_packet_t
+5 -A selinux_new_input -p tcp --dport 80 -j SECMARK --selctx system_u:object_r:http_server_packet_t
+-A selinux_new_input -j CONNSECMARK --save
+9 -A selinux_new_input -j RETURN
+1 -A selinux_new_output -j SECMARK --selctx system_u:object_r:client_packet_t
+5 -A selinux_new_output -p tcp --dport 80 -j SECMARK --selctx system_u:object_r:http_client_packet_t
+9 -A selinux_new_output -j CONNSECMARK --save
+9 -A selinux_new_output -j RETURN
+9 COMMIT

libsemanage/tests/nc_sort_sorted +25 -0

diff --exclude .svn -purN trunk/libsemanage/tests/nc_sort_sorted netfilter-integration/libsemanage/tests/nc_sort_sorted
@@ -0,0 +1,25 @@
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+:selinux_input - [0:0]
+:selinux_output - [0:0]
+:selinux_new_input - [0:0]
+:selinux_new_output - [0:0]
+-A INPUT -j selinux_input
+-A OUTPUT -j selinux_output
+-A selinux_input -m state --state NEW -j selinux_new_input
+-A selinux_input -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore
+-A selinux_output -m state --state NEW -j selinux_new_output
+-A selinux_output -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore
+-A selinux_new_input -j SECMARK --selctx system_u:object_r:server_packet_t
+-A selinux_new_output -j SECMARK --selctx system_u:object_r:client_packet_t
+-A selinux_new_input -p tcp --dport 80 -j SECMARK --selctx system_u:object_r:http_server_packet_t
+-A selinux_new_output -p tcp --dport 80 -j SECMARK --selctx system_u:object_r:http_client_packet_t
+-A selinux_new_input -j CONNSECMARK --save
+-A selinux_new_input -j RETURN
+-A selinux_new_output -j CONNSECMARK --save
+-A selinux_new_output -j RETURN
+COMMIT

libsemanage/tests/nc_sort_unsorted +27 -0

diff --exclude .svn -purN trunk/libsemanage/tests/nc_sort_unsorted netfilter-integration/libsemanage/tests/nc_sort_unsorted
@@ -0,0 +1,27 @@
+1 *mangle
+1 :PREROUTING ACCEPT [0:0]
+1 :INPUT ACCEPT [0:0]
+1 :FORWARD ACCEPT [0:0]
+1 :OUTPUT ACCEPT [0:0]
+1 :POSTROUTING ACCEPT [0:0]
+1 :selinux_input - [0:0]
+1 :selinux_output - [0:0]
+1 :selinux_new_input - [0:0]
+1 :selinux_new_output - [0:0]
+# a comment
+1 -A INPUT -j selinux_input
+1 -A OUTPUT -j selinux_output
+1 -A selinux_input -m state --state NEW -j selinux_new_input
+1 -A selinux_input -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore
+1 -A selinux_output -m state --state NEW -j selinux_new_output
+	# another comment
+1 -A selinux_output -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore
+1-A selinux_new_input -j SECMARK --selctx system_u:object_r:server_packet_t
+5 -A selinux_new_input -p tcp --dport 80 -j SECMARK --selctx system_u:object_r:http_server_packet_t
+9 -A selinux_new_input -j CONNSECMARK --save
+9 -A selinux_new_input -j RETURN
+1 -A selinux_new_output -j SECMARK --selctx system_u:object_r:client_packet_t
+5 -A selinux_new_output -p tcp --dport 80 -j SECMARK --selctx system_u:object_r:http_client_packet_t
+9 -A selinux_new_output -j CONNSECMARK --save
+9 -A selinux_new_output -j RETURN
+9 COMMIT

libsemanage/tests/test_semanage_store.c +73 -0

93 lines not on this page · raw message

libsemanage/tests/test_semanage_store.h +2 -0

diff --exclude .svn -purN trunk/libsemanage/tests/test_semanage_store.h netfilter-integration/libsemanage/tests/test_semanage_store.h
@@ -1,4 +1,5 @@
 /* Authors: Christopher Ashworth <[email protected]>
+ *          Chris PeBenito <[email protected]>
  *
  * Copyright (C) 2006 Tresys Technology, LLC
  *

@@ -28,5 +29,6 @@ int semanage_store_add_tests(CU_pSuite s
 
 void test_semanage_store_access_check(void);
 void test_semanage_get_lock(void);
+void test_semanage_nc_sort(void);
 
 #endif

Signature · 9 lines

Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.