wt/cpp-httplib
1
0
Fork 0
mirror of https://github.com/yhirose/cpp-httplib.git synced 2026-09-30 20:52:31 +07:00
Code Issues Packages Projects Releases Wiki Activity

Use iptables to disable network (#2363)

Browse Source 
* Use iptables to disable network

* Fix race condition problem

* Enable network after test finishes
This commit is contained in:
yhirose
2026-02-12 22:46:26 -05:00
committed by GitHub
parent 14e37bd75b
commit c1ee85d89e
2 changed files with 34 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/test_offline.yaml
+12 -1
View File
@@ -40,7 +40,13 @@ jobs:
if: matrix.tls_backend == 'openssl'
run: sudo apt-get install -y libssl-dev
- name: disable network
run: sudo sh -c 'echo > /etc/resolv.conf'
run: |
sudo iptables -A OUTPUT -o lo -j ACCEPT
sudo iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A OUTPUT -j REJECT
sudo ip6tables -A OUTPUT -o lo -j ACCEPT
sudo ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo ip6tables -A OUTPUT -j REJECT
- name: build and run tests (OpenSSL)
if: matrix.tls_backend == 'openssl'
run: cd test && make
@@ -49,3 +55,8 @@ jobs:
- name: build and run tests (No TLS)
if: matrix.tls_backend == 'no-tls'
run: cd test && make test_no_tls && ./test_no_tls
- name: restore network
if: always()
run: |
sudo iptables -F OUTPUT
sudo ip6tables -F OUTPUT
test/test.cc
+9 -7
View File
@@ -9114,7 +9114,8 @@ TEST(ClientVulnerabilityTest, ZipBombWithoutContentLength) {
signal(SIGPIPE, SIG_IGN);
#endif
auto server_thread = std::thread([&compressed] {
// Set up the listening socket in the main thread so the server is guaranteed
// to be ready before the client connects (eliminates race condition).
auto srv = ::socket(AF_INET, SOCK_STREAM, 0);
default_socket_options(srv);
detail::set_socket_opt_time(srv, SOL_SOCKET, SO_RCVTIMEO, 5, 0);
@@ -9134,9 +9135,10 @@ TEST(ClientVulnerabilityTest, ZipBombWithoutContentLength) {
#endif
sizeof(opt));
::bind(srv, reinterpret_cast<sockaddr *>(&addr), sizeof(addr));
::listen(srv, 1);
ASSERT_EQ(0, ::bind(srv, reinterpret_cast<sockaddr *>(&addr), sizeof(addr)));
ASSERT_EQ(0, ::listen(srv, 1));
auto server_thread = std::thread([&compressed, srv] {
sockaddr_in cli_addr{};
socklen_t cli_len = sizeof(cli_addr);
auto cli = ::accept(srv, reinterpret_cast<sockaddr *>(&cli_addr), &cli_len);
@@ -9180,10 +9182,12 @@ TEST(ClientVulnerabilityTest, ZipBombWithoutContentLength) {
detail::close_socket(cli);
}
detail::close_socket(srv);
});
std::this_thread::sleep_for(std::chrono::milliseconds(200));
auto se = detail::scope_exit([&] {
detail::close_socket(srv);
server_thread.join();
});
size_t total_decompressed = 0;
@@ -9204,8 +9208,6 @@ TEST(ClientVulnerabilityTest, ZipBombWithoutContentLength) {
}
}
server_thread.join();
// The decompressed size must be capped by payload_max_length. Without
// protection, the client would decompress the full 10MB from a tiny
// compressed payload, enabling a zip bomb DoS attack.