Testing on hosts with firewalls

[Mike Frysinger]

On 29 Dec 2016 20:47, Florian Weimer wrote:
> On 12/29/2016 07:08 PM, Mike Frysinger wrote:
> > does it help if you run all the tests in a unique net namespace ?
> > i think our skel test framework should set up unique namespaces
> > all the time anyways to prevent inadvertent leakage, and to handle
> > issues like port collisions.
> 
> This is an interesting idea.
> 
> I don't see how I can set up interfaces in a network namespace as an 
> unprivileged user.

it's trivial:
- create a new user namespace
- map current id to root
- create all the namespaces you want (like net)
- set up the loopback interface as needed
- create a new user namespace (or not if you want to run as "root")
- map root back to current id
- run all tests against loopback

the `unshare` program can be used to experiment (but it wouldn't be
used by tests themselves).  just run:
$ id
uid=8282(vapier) gid=100(users) groups=100(users)
$ unshare -Urn
# id
uid=0(root) gid=0(root) groups=0(root)
# ip a s dev lo
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
# ip link set up dev lo
# ip a s dev lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever

here's some code below that i've written that should show how to do
all of this.  you can do:
$ gcc -Wall quick-unshare.c -o quick-unshare
$ ./quick-unshare -Un bash

it would mean you don't have access to the network if you want to hit
external services, but i don't think tests should be written in general
to require a working network connection.
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: quick-unshare.c
Type: text/x-c
Size: 2605 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20161229/9a8888d7/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Digital signature
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20161229/9a8888d7/attachment.sig>