From ccfcb05ab0fe506bfb79db57f2dda27b3cb9ce59 Mon Sep 17 00:00:00 2001 From: KiriAky 107 Date: Tue, 8 Sep 2026 22:44:33 +0800 Subject: [PATCH] =?UTF-8?q?test(sandbox):=20=E9=AA=8C=E8=AF=81=E5=8E=9F?= =?UTF-8?q?=E7=94=9F=20TCP=20=E4=B8=8E=20UDP=20=E5=9B=9E=E7=8E=AF=E9=9A=94?= =?UTF-8?q?=E7=A6=BB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- frontend/src-tauri/src/extension_container.rs | 125 ++++++++++++++++-- .../tests/fixtures/sandbox_network_probe.rs | 27 ++++ 2 files changed, 144 insertions(+), 8 deletions(-) create mode 100644 frontend/src-tauri/tests/fixtures/sandbox_network_probe.rs diff --git a/frontend/src-tauri/src/extension_container.rs b/frontend/src-tauri/src/extension_container.rs index 0f2b6a2..587e792 100644 --- a/frontend/src-tauri/src/extension_container.rs +++ b/frontend/src-tauri/src/extension_container.rs @@ -304,6 +304,20 @@ mod tests { // Only tests use cmd.exe, with fixed commands and controlled temporary paths. // A production extension launcher must use a verified entry, never a shell. fn checked_process(profile: &Profile, command: Option<&str>) -> Option { + let executable = std::path::PathBuf::from(std::env::var_os("SystemRoot").unwrap()) + .join("System32/cmd.exe"); + checked_executable( + profile, + &executable, + command.map(|c| format!("cmd.exe /d /c {c}")), + ) + } + + fn checked_executable( + profile: &Profile, + executable: &std::path::Path, + command: Option, + ) -> Option { let mut attributes = Attributes::new(); let caps = SECURITY_CAPABILITIES { AppContainerSid: profile.sid(), @@ -328,8 +342,6 @@ mod tests { let mut startup = STARTUPINFOEXW::default(); startup.StartupInfo.cb = size_of::() as u32; startup.lpAttributeList = attributes.buffer.as_mut_ptr().cast(); - let executable = std::path::PathBuf::from(std::env::var_os("SystemRoot").unwrap()) - .join("System32/cmd.exe"); let executable: Vec = executable .as_os_str() .encode_wide() @@ -346,12 +358,8 @@ mod tests { .encode_utf16() .collect(); let mut command_line: Vec = command - .map(|command| { - format!("cmd.exe /d /c {command}") - .encode_utf16() - .chain(Some(0)) - .collect() - }) + .as_ref() + .map(|command| command.encode_utf16().chain(Some(0)).collect()) .unwrap_or_default(); let mut info = PROCESS_INFORMATION::default(); assert_ne!( @@ -581,4 +589,105 @@ mod tests { drop(handle); profile.remove().unwrap(); } + #[test] + fn real_container_cannot_reach_ipv4_or_ipv6_loopback_listeners() { + use std::{ + net::{TcpListener, UdpSocket}, + os::windows::fs::OpenOptionsExt, + }; + use windows_sys::Win32::Storage::FileSystem::*; + let profile = Profile::create().unwrap(); + let package = tempfile::tempdir().unwrap(); + let executable = package.path().join("network-probe.exe"); + let fixture = std::path::Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/sandbox_network_probe.rs"); + let compile = std::process::Command::new("rustc") + .arg("--edition=2021") + .arg(&fixture) + .arg("-o") + .arg(&executable) + .output() + .unwrap(); + assert!( + compile.status.success(), + "{}", + String::from_utf8_lossy(&compile.stderr) + ); + let open = |path: &std::path::Path| { + std::fs::OpenOptions::new() + .access_mode(READ_CONTROL | WRITE_DAC) + .share_mode(FILE_SHARE_READ | FILE_SHARE_WRITE) + .custom_flags(FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT) + .open(path) + .unwrap() + }; + let root = open(package.path()); + let entry = open(&executable); + profile.grant_package_read_execute(&root).unwrap(); + profile.grant_package_read_execute(&entry).unwrap(); + for ip in ["127.0.0.1:0", "[::1]:0"] { + let tcp = TcpListener::bind(ip).unwrap(); + let udp = UdpSocket::bind(ip).unwrap(); + for (mode, address) in [ + ("tcp", tcp.local_addr().unwrap()), + ("udp", udp.local_addr().unwrap()), + ] { + let address = address.to_string(); + // The exact executable and target work outside containment. + assert!(std::process::Command::new(&executable) + .args([mode, &address]) + .status() + .unwrap() + .success()); + if mode == "tcp" { + tcp.set_nonblocking(true).unwrap(); + tcp.accept().unwrap(); + } else { + udp.set_read_timeout(Some(std::time::Duration::from_secs(2))) + .unwrap(); + let mut bytes = [0u8; 8]; + assert_eq!(udp.recv(&mut bytes).unwrap(), 5); + assert_eq!(&bytes[..5], b"probe"); + udp.set_nonblocking(true).unwrap(); + } + let command = format!("\"{}\" {mode} {address}", executable.display()); + // Loopback isolation can silently drop packets. TCP must + // explicitly report denial or timeout; UDP send may succeed, + // but no datagram may reach the controlled listener below. + let exit = checked_executable(&profile, &executable, Some(command)); + eprintln!("container network probe {mode} {address}: {exit:?}"); + if mode == "tcp" { + assert!(matches!(exit, Some(77 | 80)), "{mode} {address}: {exit:?}"); + } else { + assert!(matches!(exit, Some(0 | 77)), "{mode} {address}: {exit:?}"); + std::thread::sleep(std::time::Duration::from_millis(200)); + } + if mode == "tcp" { + assert_eq!( + tcp.accept().unwrap_err().kind(), + std::io::ErrorKind::WouldBlock + ); + } else { + assert_eq!( + udp.recv(&mut [0u8; 8]).unwrap_err().kind(), + std::io::ErrorKind::WouldBlock + ); + } + assert!(std::process::Command::new(&executable) + .args([mode, &address]) + .status() + .unwrap() + .success()); + if mode == "tcp" { + tcp.accept().unwrap(); + } else { + udp.set_nonblocking(false).unwrap(); + assert_eq!(udp.recv(&mut [0u8; 8]).unwrap(), 5); + } + } + } + drop(entry); + drop(root); + profile.remove().unwrap(); + } } diff --git a/frontend/src-tauri/tests/fixtures/sandbox_network_probe.rs b/frontend/src-tauri/tests/fixtures/sandbox_network_probe.rs new file mode 100644 index 0000000..0ba4668 --- /dev/null +++ b/frontend/src-tauri/tests/fixtures/sandbox_network_probe.rs @@ -0,0 +1,27 @@ +//! Standalone native test probe; never shipped or used to launch extensions. +use std::net::{SocketAddr, TcpStream, UdpSocket}; +use std::time::Duration; +fn main() { + let args: Vec<_> = std::env::args().collect(); + if args.len() != 3 { + std::process::exit(79); + } + let address: SocketAddr = args[2].parse().unwrap(); + let result = match args[1].as_str() { + "tcp" => TcpStream::connect_timeout(&address, Duration::from_secs(2)).map(|_| ()), + "udp" => UdpSocket::bind(if address.is_ipv4() { + "0.0.0.0:0" + } else { + "[::]:0" + }) + .and_then(|socket| socket.send_to(b"probe", address)) + .map(|_| ()), + _ => std::process::exit(79), + }; + std::process::exit(match result { + Ok(()) => 0, + Err(error) if error.raw_os_error() == Some(10013) => 77, + Err(error) if error.kind() == std::io::ErrorKind::TimedOut => 80, + Err(_) => 81, + }); +}