From 77bbd9f1bd2b01bcb2a49ed42c6dc06613532bcf Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 16 Oct 2024 12:45:34 +0900 Subject: [PATCH 1/2] core/cgroup: fix IPAddressAllow=/IPAddressDeny= set through DBus Fixes a regression caused by 84ebe6f01381c21b88e37e856956c9c9ee6781d6 (v250). Fixes #34773. --- src/core/dbus-cgroup.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c index 459fa6f774..a145afab19 100644 --- a/src/core/dbus-cgroup.c +++ b/src/core/dbus-cgroup.c @@ -1977,11 +1977,12 @@ int bus_cgroup_set_property( prefixes = streq(name, "IPAddressAllow") ? &c->ip_address_allow : &c->ip_address_deny; reduced = streq(name, "IPAddressAllow") ? &c->ip_address_allow_reduced : &c->ip_address_deny_reduced; + fputs(name, f); + fputs("=\n", f); + if (n == 0) { *reduced = true; *prefixes = set_free(*prefixes); - fputs(name, f); - fputs("=\n", f); } else { *reduced = false; @@ -1990,7 +1991,7 @@ int bus_cgroup_set_property( return r; const struct in_addr_prefix *p; - SET_FOREACH(p, new_prefixes) + SET_FOREACH(p, *prefixes) fprintf(f, "%s=%s\n", name, IN_ADDR_PREFIX_TO_STRING(p->family, &p->address, p->prefixlen)); } From 5f3cfb9d5ee334c53cc407308ba677401a6ba1cd Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 16 Oct 2024 14:31:16 +0900 Subject: [PATCH 2/2] TEST-19-CGROUP: add test cases for IPAddressAllow=/IPAddressDeny= --- .../TEST-19-CGROUP.IPAddressAllow-Deny.sh | 73 +++++++++++++++++++ test/units/util.sh | 15 +++- 2 files changed, 86 insertions(+), 2 deletions(-) create mode 100755 test/units/TEST-19-CGROUP.IPAddressAllow-Deny.sh diff --git a/test/units/TEST-19-CGROUP.IPAddressAllow-Deny.sh b/test/units/TEST-19-CGROUP.IPAddressAllow-Deny.sh new file mode 100755 index 0000000000..a5c47b7086 --- /dev/null +++ b/test/units/TEST-19-CGROUP.IPAddressAllow-Deny.sh @@ -0,0 +1,73 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -ex +set -o pipefail + +# shellcheck source=test/units/util.sh +. "$(dirname "$0")"/util.sh + +if [[ "$(get_cgroup_hierarchy)" != unified ]]; then + echo "Skipping $0 as we're not running with the unified cgroup hierarchy." + exit 0 +fi + +if systemd-detect-virt --container --quiet; then + echo "Skipping $0 as we're running on container." + exit 0 +fi + +ip netns add test-ns +ip link add test-veth-1 type veth peer test-veth-2 +ip link set test-veth-2 netns test-ns +ip link set test-veth-1 up +ip address add 192.0.2.1/24 dev test-veth-1 +ip address add 2001:db8::1/64 dev test-veth-1 nodad +ip netns exec test-ns ip link set test-veth-2 up +ip netns exec test-ns ip address add 192.0.2.2/24 dev test-veth-2 +ip netns exec test-ns ip address add 2001:db8::2/64 dev test-veth-2 nodad + +ping_ok_one() { + local interface="${1?}" + local target="${2?}" + shift 2 + + assert_ok systemd-run --wait --pipe "$@" ping -c 1 -W 1 -I "$interface" "$target" +} + +ping_fail_one() { + local interface="${1?}" + local target="${2?}" + shift 2 + + assert_fail systemd-run --wait --pipe "$@" ping -c 1 -W 1 -I "$interface" "$target" +} + +ping_ok() { + ping_ok_one lo 127.0.0.1 "$@" + ping_ok_one lo ::1 "$@" + ping_ok_one test-veth-1 192.0.2.2 "$@" + ping_ok_one test-veth-1 2001:db8::2 "$@" +} + +ping_fail() { + ping_fail_one lo 127.0.0.1 "$@" + ping_fail_one lo ::1 "$@" + ping_fail_one test-veth-1 192.0.2.2 "$@" + ping_fail_one test-veth-1 2001:db8::2 "$@" +} + +ping_ok +ping_ok -p IPAddressDeny=any -p IPAddressDeny= +ping_ok -p IPAddressDeny=any -p IPAddressDeny= -p IPAddressDeny=link-local +ping_ok -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 +ping_ok -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 \ + -p IPAddressAllow= -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 + +ping_fail -p IPAddressDeny=any +ping_fail -p IPAddressDeny=any -p IPAddressDeny= -p IPAddressDeny=localhost -p IPAddressDeny=192.0.2.0/24 -p IPAddressDeny=2001:db8::/64 +ping_fail -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 -p IPAddressAllow= +ping_fail -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 -p IPAddressAllow= -p IPAddressAllow=link-local + +ip link del test-veth-1 +ip netns exec test-ns ip link del test-veth-2 || : +ip netns del test-ns diff --git a/test/units/util.sh b/test/units/util.sh index f5f6786d0f..80ae8ffc5b 100755 --- a/test/units/util.sh +++ b/test/units/util.sh @@ -6,19 +6,30 @@ # shellcheck disable=SC2034 [[ -e /var/tmp/.systemd_reboot_count ]] && REBOOT_COUNT="$(&2 exit 1 fi )} +assert_fail() {( + set +ex + + local rc + + if "$@"; then + echo "FAIL: command '$*' unexpectedly succeeded" >&2 + exit 1 + fi +)} + assert_eq() {( set +ex