@@ -8,9 +8,6 @@ import { promises as fs } from 'fs';
88import path from 'path' ;
99import os from 'os' ;
1010
11- import http from 'http' ;
12- import https from 'https' ;
13-
1411/**
1512 * @securityTest Enhanced Network Isolation Tests
1613 *
@@ -58,7 +55,12 @@ describe('networkTraffic: false / Isolated Edition', function () {
5855 const outfile = path . join ( tmpdir , 'strace-out.log' ) ;
5956 async function wrapBinary ( binary : string ) : Promise < string > {
6057 const wrapperFile = path . join ( tmpdir , 'wrap.sh' ) ;
61- const str = `#!/bin/bash\nulimit -c 0; '${ binary } ' "$@"\n` ;
58+ let str ;
59+ if ( process . platform === 'linux' ) {
60+ str = `#!/bin/bash\nulimit -c 0; exec strace -f -e connect -qqq -o '${ outfile } ' '${ binary } ' "$@"\n` ;
61+ } else {
62+ str = `#!/bin/bash\nulimit -c 0; '${ binary } ' "$@"\n` ;
63+ }
6264 console . log ( 'contents of wrapped file will be ' , str ) ;
6365 await fs . writeFile ( wrapperFile , str ) ;
6466 await fs . chmod ( wrapperFile , 0o755 ) ;
@@ -99,41 +101,45 @@ describe('networkTraffic: false / Isolated Edition', function () {
99101 await cleanup ( compass ) ;
100102 }
101103
102- // const straceLog = await fs.readFile(outfile, 'utf8');
103- // const connectCalls = straceLog.matchAll(/\bconnect\s*\((?<args>.*)\) =/g);
104- // const connectTargets = new Set<string>();
105- // for (const { groups } of connectCalls) {
106- // const args = groups!.args;
107- // // Possible format for the address argument in 'args':
108- // // sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"
109- // // sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("127.0.0.1")
110- // // sa_family=AF_INET6, sin6_port=htons(80), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "2606:2800:220:1:248:1893:25c8:1946", &sin6_addr), sin6_scope_id=0
111- // if (!args.includes('AF_INET')) continue;
112- // const match = args.match(
113- // /sa_family=AF_INET6?.*sin6?_port=htons\((?<port>\d+)\).*inet_(addr\("(?<ipv4>[^"]+)"\)|pton\(AF_INET6,\s*"(?<ipv6>[^"]+)")/
114- // )?.groups;
115- // if (!match) {
116- // throw new Error(`Unknown traced connect() target: ${args}`);
117- // }
118- // connectTargets.add(
119- // match.ipv4
120- // ? `${match.ipv4}:${match.port}`
121- // : `[${match.ipv6}]:${match.port}`
122- // );
123- // }
104+ if ( process . platform !== 'linux' ) {
105+ return ;
106+ }
124107
125- // const unexpectedHosts = [...connectTargets].filter(
126- // (target) => !/^127.0.0.1:|^\[::1\]:/.test(target)
127- // );
128- // if (unexpectedHosts.length > 0) {
129- // throw new Error(`Connected to unexpected host! ${[...unexpectedHosts]}`);
130- // }
131- // if (![...connectTargets].some((target) => /:27091$/.test(target))) {
132- // throw new Error(
133- // `Missed connection to database server in connect trace! ${[
134- // ...connectTargets,
135- // ]}`
136- // );
137- // }
108+ const straceLog = await fs . readFile ( outfile , 'utf8' ) ;
109+ const connectCalls = straceLog . matchAll ( / \b c o n n e c t \s * \( (?< args > .* ) \) = / g) ;
110+ const connectTargets = new Set < string > ( ) ;
111+ for ( const { groups } of connectCalls ) {
112+ const args = groups ! . args ;
113+ // Possible format for the address argument in 'args':
114+ // sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"
115+ // sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("127.0.0.1")
116+ // sa_family=AF_INET6, sin6_port=htons(80), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "2606:2800:220:1:248:1893:25c8:1946", &sin6_addr), sin6_scope_id=0
117+ if ( ! args . includes ( 'AF_INET' ) ) continue ;
118+ const match = args . match (
119+ / s a _ f a m i l y = A F _ I N E T 6 ? .* s i n 6 ? _ p o r t = h t o n s \( (?< port > \d + ) \) .* i n e t _ ( a d d r \( " (?< ipv4 > [ ^ " ] + ) " \) | p t o n \( A F _ I N E T 6 , \s * " (?< ipv6 > [ ^ " ] + ) " ) /
120+ ) ?. groups ;
121+ if ( ! match ) {
122+ throw new Error ( `Unknown traced connect() target: ${ args } ` ) ;
123+ }
124+ connectTargets . add (
125+ match . ipv4
126+ ? `${ match . ipv4 } :${ match . port } `
127+ : `[${ match . ipv6 } ]:${ match . port } `
128+ ) ;
129+ }
130+
131+ const unexpectedHosts = [ ...connectTargets ] . filter (
132+ ( target ) => ! / ^ 1 2 7 .0 .0 .1 : | ^ \[ : : 1 \] : / . test ( target )
133+ ) ;
134+ if ( unexpectedHosts . length > 0 ) {
135+ throw new Error ( `Connected to unexpected host! ${ [ ...unexpectedHosts ] } ` ) ;
136+ }
137+ if ( ! [ ...connectTargets ] . some ( ( target ) => / : 2 7 0 9 1 $ / . test ( target ) ) ) {
138+ throw new Error (
139+ `Missed connection to database server in connect trace! ${ [
140+ ...connectTargets ,
141+ ] } `
142+ ) ;
143+ }
138144 } ) ;
139145} ) ;
0 commit comments