tools/testing/selftests/landlock/net_test.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Landlock tests - Network
 *
 * Copyright © 2022-2023 Huawei Tech. Co., Ltd.
 * Copyright © 2023 Microsoft Corporation
 */

#define _GNU_SOURCE
#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <linux/in.h>
#include <linux/landlock.h>
#include <sched.h>
#include <stdint.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/un.h>

#include "audit.h"
#include "common.h"
#include "trace.h"

#define TRACE_TASK "net_test"

const short sock_port_start = (1 << 10);

static const char loopback_ipv4[] = "127.0.0.1";
static const char loopback_ipv6[] = "::1";

/* Number pending connections queue to be hold. */
const short backlog = 10;

enum sandbox_type {
	NO_SANDBOX,
	/* This may be used to test rules that allow *and* deny accesses. */
	TCP_SANDBOX,
	UDP_SANDBOX,
};

static int set_service(struct service_fixture *const srv,
		       const struct protocol_variant prot,
		       const unsigned short index)
{
	memset(srv, 0, sizeof(*srv));

	/*
	 * Copies all protocol properties in case of the variant only contains
	 * a subset of them.
	 */
	srv->protocol = prot;

	/* Checks for port overflow. */
	if (index > 2)
		return 1;
	srv->port = sock_port_start << (2 * index);

	switch (prot.domain) {
	case AF_UNSPEC:
	case AF_INET:
		srv->ipv4_addr.sin_family = prot.domain;
		srv->ipv4_addr.sin_port = htons(srv->port);
		srv->ipv4_addr.sin_addr.s_addr = inet_addr(loopback_ipv4);
		return 0;

	case AF_INET6:
		srv->ipv6_addr.sin6_family = prot.domain;
		srv->ipv6_addr.sin6_port = htons(srv->port);
		inet_pton(AF_INET6, loopback_ipv6, &srv->ipv6_addr.sin6_addr);
		return 0;

	case AF_UNIX:
		set_unix_address(srv, index);
		return 0;
	}
	return 1;
}

static void setup_loopback(struct __test_metadata *const _metadata)
{
	set_cap(_metadata, CAP_SYS_ADMIN);
	ASSERT_EQ(0, unshare(CLONE_NEWNET));
	clear_cap(_metadata, CAP_SYS_ADMIN);

	set_ambient_cap(_metadata, CAP_NET_ADMIN);
	ASSERT_EQ(0, system("ip link set dev lo up"));
	clear_ambient_cap(_metadata, CAP_NET_ADMIN);
}

static bool prot_is_tcp(const struct protocol_variant *const prot)
{
	return (prot->domain == AF_INET || prot->domain == AF_INET6) &&
	       prot->type == SOCK_STREAM &&
	       (prot->protocol == IPPROTO_TCP || prot->protocol == IPPROTO_IP);
}

static bool prot_is_udp(const struct protocol_variant *const prot)
{
	return (prot->domain == AF_INET || prot->domain == AF_INET6) &&
	       prot->type == SOCK_DGRAM &&
	       (prot->protocol == IPPROTO_UDP || prot->protocol == IPPROTO_IP);
}

static bool is_restricted(const struct protocol_variant *const prot,
			  const enum sandbox_type sandbox)
{
	if (sandbox == TCP_SANDBOX)
		return prot_is_tcp(prot);
	else if (sandbox == UDP_SANDBOX)
		return prot_is_udp(prot);
	return false;
}

static int socket_variant(const struct service_fixture *const srv)
{
	/* Arbitrary value just to not block other tests indefinitely. */
	const struct timeval timeout = {
		.tv_sec = 0,
		.tv_usec = 100000,
	};
	int sockfd;
	int ret;

	sockfd = socket(srv->protocol.domain, srv->protocol.type | SOCK_CLOEXEC,
			srv->protocol.protocol);
	if (sockfd < 0)
		return -errno;

	ret = setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout,
			 sizeof(timeout));
	if (ret != 0) {
		ret = -errno;
		close(sockfd);
		return ret;
	}
	ret = setsockopt(sockfd, SOL_SOCKET, SO_SNDTIMEO, &timeout,
			 sizeof(timeout));
	if (ret != 0) {
		ret = -errno;
		close(sockfd);
		return ret;
	}
	return sockfd;
}

#ifndef SIN6_LEN_RFC2133
#define SIN6_LEN_RFC2133 24
#endif

static socklen_t get_addrlen(const struct service_fixture *const srv,
			     const bool minimal)
{
	switch (srv->protocol.domain) {
	case AF_UNSPEC:
		if (minimal)
			return sizeof(sa_family_t);
		return sizeof(struct sockaddr_storage);

	case AF_INET:
		return sizeof(srv->ipv4_addr);

	case AF_INET6:
		if (minimal)
			return SIN6_LEN_RFC2133;
		return sizeof(srv->ipv6_addr);

	case AF_UNIX:
		if (minimal)
			return sizeof(srv->unix_addr) -
			       sizeof(srv->unix_addr.sun_path);
		return srv->unix_addr_len;

	default:
		return 0;
	}
}

static void set_port(struct service_fixture *const srv, uint16_t port)
{
	switch (srv->protocol.domain) {
	case AF_UNSPEC:
	case AF_INET:
		srv->ipv4_addr.sin_port = htons(port);
		return;

	case AF_INET6:
		srv->ipv6_addr.sin6_port = htons(port);
		return;

	default:
		return;
	}
}

static uint16_t get_binded_port(int socket_fd,
				const struct protocol_variant *const prot)
{
	struct sockaddr_in ipv4_addr;
	struct sockaddr_in6 ipv6_addr;
	socklen_t ipv4_addr_len, ipv6_addr_len;

	/* Gets binded port. */
	switch (prot->domain) {
	case AF_UNSPEC:
	case AF_INET:
		ipv4_addr_len = sizeof(ipv4_addr);
		getsockname(socket_fd, &ipv4_addr, &ipv4_addr_len);
		return ntohs(ipv4_addr.sin_port);

	case AF_INET6:
		ipv6_addr_len = sizeof(ipv6_addr);
		getsockname(socket_fd, &ipv6_addr, &ipv6_addr_len);
		return ntohs(ipv6_addr.sin6_port);

	default:
		return 0;
	}
}

static int bind_variant_addrlen(const int sock_fd,
				const struct service_fixture *const srv,
				const socklen_t addrlen)
{
	int ret;

	switch (srv->protocol.domain) {
	case AF_UNSPEC:
	case AF_INET:
		ret = bind(sock_fd, &srv->ipv4_addr, addrlen);
		break;

	case AF_INET6:
		ret = bind(sock_fd, &srv->ipv6_addr, addrlen);
		break;

	case AF_UNIX:
		ret = bind(sock_fd, &srv->unix_addr, addrlen);
		break;

	default:
		errno = EAFNOSUPPORT;
		return -errno;
	}

	if (ret < 0)
		return -errno;
	return ret;
}

static int bind_variant(const int sock_fd,
			const struct service_fixture *const srv)
{
	return bind_variant_addrlen(sock_fd, srv, get_addrlen(srv, false));
}

static int connect_variant_addrlen(const int sock_fd,
				   const struct service_fixture *const srv,
				   const socklen_t addrlen)
{
	int ret;

	switch (srv->protocol.domain) {
	case AF_UNSPEC:
	case AF_INET:
		ret = connect(sock_fd, &srv->ipv4_addr, addrlen);
		break;

	case AF_INET6:
		ret = connect(sock_fd, &srv->ipv6_addr, addrlen);
		break;

	case AF_UNIX:
		ret = connect(sock_fd, &srv->unix_addr, addrlen);
		break;

	default:
		errno = -EAFNOSUPPORT;
		return -errno;
	}

	if (ret < 0)
		return -errno;
	return ret;
}

static int connect_variant(const int sock_fd,
			   const struct service_fixture *const srv)
{
	return connect_variant_addrlen(sock_fd, srv, get_addrlen(srv, false));
}

static int sendto_variant_addrlen(const int sock_fd,
				  const struct service_fixture *const srv,
				  const socklen_t addrlen, void *buf,
				  size_t len, size_t flags)
{
	const struct sockaddr *dst = NULL;
	ssize_t ret;

	/*
	 * We never want our processes to be killed by SIGPIPE: we check return
	 * codes and errno, so that we have actual error messages.
	 */
	flags |= MSG_NOSIGNAL;

	if (srv != NULL) {
		switch (srv->protocol.domain) {
		case AF_UNSPEC:
		case AF_INET:
			dst = (const struct sockaddr *)&srv->ipv4_addr;
			break;

		case AF_INET6:
			dst = (const struct sockaddr *)&srv->ipv6_addr;
			break;

		case AF_UNIX:
			dst = (const struct sockaddr *)&srv->unix_addr;
			break;

		default:
			errno = EAFNOSUPPORT;
			return -errno;
		}
	}

	ret = sendto(sock_fd, buf, len, flags, dst, addrlen);
	if (ret < 0)
		return -errno;

	/* errno is not set in cases of partial writes. */
	if (ret != len)
		return -EINTR;

	return 0;
}

static int sendto_variant(const int sock_fd,
			  const struct service_fixture *const srv, void *buf,
			  size_t len, size_t flags)
{
	socklen_t addrlen = 0;

	if (srv != NULL)
		addrlen = get_addrlen(srv, false);

	return sendto_variant_addrlen(sock_fd, srv, addrlen, buf, len, flags);
}

static int test_sendmsg(struct __test_metadata *const _metadata,
			const struct protocol_variant *prot, int client_fd,
			int server_fd, const struct service_fixture *srv,
			bool bind_denied, bool send_denied)
{
	int ret;
	socklen_t opt_len;
	int sock_type;
	int addr_family;
	struct sockaddr_storage peer_addr = { 0 };
	bool has_remote_port;
	bool needs_autobind;
	char read_buf[1] = { 0 };

	/*
	 * Prepare the test by inspecting the socket type and whether it has a
	 * local/remote address set (all of which determine the expected
	 * outcomes).
	 */
	opt_len = sizeof(sock_type);
	ASSERT_EQ(0, getsockopt(client_fd, SOL_SOCKET, SO_TYPE, &sock_type,
				&opt_len));
	opt_len = sizeof(addr_family);
	ASSERT_EQ(0, getsockopt(client_fd, SOL_SOCKET, SO_DOMAIN, &addr_family,
				&opt_len));
	opt_len = sizeof(peer_addr);
	has_remote_port = (getpeername(client_fd, (struct sockaddr *)&peer_addr,
				       &opt_len) == 0);
	needs_autobind = (addr_family == AF_INET || addr_family == AF_INET6) &&
			 get_binded_port(client_fd, prot) == 0;

	/* First, check error code with truncated explicit address. */
	if (srv != NULL) {
		ret = sendto_variant_addrlen(
			client_fd, srv, get_addrlen(srv, true) - 1, "A", 1, 0);
		if (sock_type == SOCK_STREAM && !has_remote_port) {
			EXPECT_EQ(-EPIPE, ret)
			{
				return -1;
			}
		} else if (bind_denied && needs_autobind) {
			EXPECT_EQ(-EACCES, ret)
			{
				return -1;
			}
		} else {
			EXPECT_EQ(-EINVAL, ret)
			{
				return -1;
			}
		}
	}

	/* With or without explicit destination address (srv can be NULL). */
	ret = sendto_variant(client_fd, srv, "B", 1, 0);
	if (sock_type == SOCK_STREAM && !has_remote_port) {
		EXPECT_EQ(-EPIPE, ret)
		{
			return -1;
		}
	} else if ((send_denied && srv != NULL) ||
		   (bind_denied && needs_autobind)) {
		ASSERT_EQ(-EACCES, ret)
		{
			return -1;
		}
	} else if (srv == NULL && !has_remote_port) {
		if (addr_family == AF_UNIX) {
			ASSERT_EQ(-ENOTCONN, ret)
			{
				return -1;
			}
		} else if (sock_type == SOCK_STREAM) {
			ASSERT_EQ(-EPIPE, ret)
			{
				return -1;
			}
		} else {
			ASSERT_EQ(-EDESTADDRREQ, ret)
			{
				return -1;
			}
		}
	} else {
		ASSERT_EQ(0, ret);
		ASSERT_EQ(1, recv(server_fd, read_buf, 1, 0));
		ASSERT_EQ(read_buf[0], 'B')
		{
			return -1;
		}
	}

	return 0;
}

FIXTURE(protocol)
{
	struct service_fixture srv0, srv1, srv2;
	struct service_fixture unspec_any0, unspec_srv0, unspec_srv1;
};

FIXTURE_VARIANT(protocol)
{
	const enum sandbox_type sandbox;
	const struct protocol_variant prot;
};

FIXTURE_SETUP(protocol)
{
	struct protocol_variant prot_unspec = variant->prot;

	prot_unspec.domain = AF_UNSPEC;

	disable_caps(_metadata);

	ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0));
	ASSERT_EQ(0, set_service(&self->srv1, variant->prot, 1));
	ASSERT_EQ(0, set_service(&self->srv2, variant->prot, 2));

	ASSERT_EQ(0, set_service(&self->unspec_srv0, prot_unspec, 0));
	ASSERT_EQ(0, set_service(&self->unspec_srv1, prot_unspec, 1));

	ASSERT_EQ(0, set_service(&self->unspec_any0, prot_unspec, 0));
	self->unspec_any0.ipv4_addr.sin_addr.s_addr = htonl(INADDR_ANY);

	setup_loopback(_metadata);
};

FIXTURE_TEARDOWN(protocol)
{
}

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_tcp1) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
		/* IPPROTO_IP == 0 */
		.protocol = IPPROTO_IP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_tcp2) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_TCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_mptcp) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_MPTCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_tcp1) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
		/* IPPROTO_IP == 0 */
		.protocol = IPPROTO_IP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_tcp2) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_TCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_mptcp) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_MPTCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_udp) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_udp) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_unix_stream) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_UNIX,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_unix_datagram) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_UNIX,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_tcp1) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
		/* IPPROTO_IP == 0 */
		.protocol = IPPROTO_IP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_tcp2) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_TCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_mptcp) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_MPTCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_tcp1) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
		/* IPPROTO_IP == 0 */
		.protocol = IPPROTO_IP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_tcp2) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_TCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_mptcp) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
		.protocol = IPPROTO_MPTCP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_udp) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_udp) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_unix_stream) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_UNIX,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_unix_datagram) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_UNIX,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv4_udp1) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_DGRAM,
		.protocol = IPPROTO_UDP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv4_udp2) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_DGRAM,
		/* IPPROTO_IP == 0 */
		.protocol = IPPROTO_IP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv6_udp1) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_DGRAM,
		.protocol = IPPROTO_UDP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv6_udp2) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_DGRAM,
		/* IPPROTO_IP == 0 */
		.protocol = IPPROTO_IP,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv4_tcp) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv6_tcp) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_unix_stream) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_UNIX,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_unix_datagram) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_UNIX,
		.type = SOCK_DGRAM,
	},
};

static void test_bind_and_connect(struct __test_metadata *const _metadata,
				  const struct service_fixture *const srv,
				  const bool deny_bind, const bool deny_connect)
{
	char buf = '\0';
	int inval_fd, bind_fd, client_fd, status, ret;
	pid_t child;

	/* Starts invalid addrlen tests with bind. */
	inval_fd = socket_variant(srv);
	ASSERT_LE(0, inval_fd)
	{
		TH_LOG("Failed to create socket: %s", strerror(errno));
	}

	/* Tries to bind with zero as addrlen. */
	EXPECT_EQ(-EINVAL, bind_variant_addrlen(inval_fd, srv, 0));

	/* Tries to bind with too small addrlen. */
	EXPECT_EQ(-EINVAL, bind_variant_addrlen(inval_fd, srv,
						get_addrlen(srv, true) - 1));

	/* Tries to bind with minimal addrlen. */
	ret = bind_variant_addrlen(inval_fd, srv, get_addrlen(srv, true));
	if (deny_bind) {
		EXPECT_EQ(-EACCES, ret);
	} else {
		EXPECT_EQ(0, ret)
		{
			TH_LOG("Failed to bind to socket: %s", strerror(errno));
		}
	}
	EXPECT_EQ(0, close(inval_fd));

	/* Starts invalid addrlen tests with connect. */
	inval_fd = socket_variant(srv);
	ASSERT_LE(0, inval_fd);

	/* Tries to connect with zero as addrlen. */
	EXPECT_EQ(-EINVAL, connect_variant_addrlen(inval_fd, srv, 0));

	/* Tries to connect with too small addrlen. */
	EXPECT_EQ(-EINVAL, connect_variant_addrlen(inval_fd, srv,
						   get_addrlen(srv, true) - 1));

	/* Tries to connect with minimal addrlen. */
	ret = connect_variant_addrlen(inval_fd, srv, get_addrlen(srv, true));
	if (srv->protocol.domain == AF_UNIX) {
		EXPECT_EQ(-EINVAL, ret);
	} else if (deny_connect) {
		EXPECT_EQ(-EACCES, ret);
	} else if (srv->protocol.type == SOCK_STREAM) {
		/* No listening server, whatever the value of deny_bind. */
		EXPECT_EQ(-ECONNREFUSED, ret);
	} else {
		EXPECT_EQ(0, ret)
		{
			TH_LOG("Failed to connect to socket: %s",
			       strerror(errno));
		}
	}
	EXPECT_EQ(0, close(inval_fd));

	/* Starts connection tests. */
	bind_fd = socket_variant(srv);
	ASSERT_LE(0, bind_fd);

	ret = bind_variant(bind_fd, srv);
	if (deny_bind) {
		EXPECT_EQ(-EACCES, ret);
	} else {
		EXPECT_EQ(0, ret);

		/* Creates a listening socket. */
		if (srv->protocol.type == SOCK_STREAM)
			EXPECT_EQ(0, listen(bind_fd, backlog));
	}

	child = fork();
	ASSERT_LE(0, child);
	if (child == 0) {
		int connect_fd, ret;

		/* Closes listening socket for the child. */
		EXPECT_EQ(0, close(bind_fd));

		/* Starts connection tests. */
		connect_fd = socket_variant(srv);
		ASSERT_LE(0, connect_fd);
		ret = connect_variant(connect_fd, srv);
		if (deny_connect) {
			EXPECT_EQ(-EACCES, ret);
		} else if (deny_bind && srv->protocol.type == SOCK_STREAM) {
			/* No listening server. */
			EXPECT_EQ(-ECONNREFUSED, ret);
		} else {
			EXPECT_EQ(0, ret);
			EXPECT_EQ(1, write(connect_fd, ".", 1));
		}

		EXPECT_EQ(0, close(connect_fd));
		_exit(_metadata->exit_code);
		return;
	}

	/* Accepts connection from the child. */
	client_fd = bind_fd;
	if (!deny_bind && !deny_connect) {
		if (srv->protocol.type == SOCK_STREAM) {
			client_fd = accept(bind_fd, NULL, 0);
			ASSERT_LE(0, client_fd);
		}

		EXPECT_EQ(1, read(client_fd, &buf, 1));
		EXPECT_EQ('.', buf);
	}

	EXPECT_EQ(child, waitpid(child, &status, 0));
	EXPECT_EQ(1, WIFEXITED(status));
	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));

	/* Closes connection, if any. */
	if (client_fd != bind_fd)
		EXPECT_LE(0, close(client_fd));

	/* Closes listening socket. */
	EXPECT_EQ(0, close(bind_fd));
}

TEST_F(protocol, bind)
{
	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const __u64 bind_access =
			(variant->sandbox == TCP_SANDBOX ?
				 LANDLOCK_ACCESS_NET_BIND_TCP :
				 LANDLOCK_ACCESS_NET_BIND_UDP);
		const __u64 conn_access =
			(variant->sandbox == TCP_SANDBOX ?
				 LANDLOCK_ACCESS_NET_CONNECT_TCP :
				 LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = bind_access | conn_access,
		};
		const struct landlock_net_port_attr bind_connect_p0 = {
			.allowed_access = bind_access | conn_access,
			.port = self->srv0.port,
		};
		const struct landlock_net_port_attr connect_p1 = {
			.allowed_access = conn_access,
			.port = self->srv1.port,
		};
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Allows connect and bind for the first port.  */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &bind_connect_p0, 0));

		/* Allows connect and denies bind for the second port. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &connect_p1, 0));

		/*
		 * For UDP sockets, allows binding to ephemeral ports (required
		 * to connect or send a first datagram)
		 */
		if (variant->sandbox == UDP_SANDBOX) {
			const struct landlock_net_port_attr bind_ephemeral = {
				.allowed_access = bind_access,
				.port = 0,
			};
			ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
						       LANDLOCK_RULE_NET_PORT,
						       &bind_ephemeral, 0));
		}

		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	/* Binds a socket to the first port. */
	test_bind_and_connect(_metadata, &self->srv0, false, false);

	/* Binds a socket to the second port. */
	test_bind_and_connect(_metadata, &self->srv1,
			      is_restricted(&variant->prot, variant->sandbox),
			      false);

	/* Binds a socket to the third port. */
	test_bind_and_connect(_metadata, &self->srv2,
			      is_restricted(&variant->prot, variant->sandbox),
			      is_restricted(&variant->prot, variant->sandbox));
}

TEST_F(protocol, connect)
{
	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const __u64 bind_access =
			(variant->sandbox == TCP_SANDBOX ?
				 LANDLOCK_ACCESS_NET_BIND_TCP :
				 LANDLOCK_ACCESS_NET_BIND_UDP);
		const __u64 conn_access =
			(variant->sandbox == TCP_SANDBOX ?
				 LANDLOCK_ACCESS_NET_CONNECT_TCP :
				 LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = bind_access | conn_access,
		};
		const struct landlock_net_port_attr bind_connect_p0 = {
			.allowed_access = bind_access | conn_access,
			.port = self->srv0.port,
		};
		const struct landlock_net_port_attr bind_p1 = {
			.allowed_access = bind_access,
			.port = self->srv1.port,
		};
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Allows connect and bind for the first port. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &bind_connect_p0, 0));

		/* Allows bind and denies connect for the second port. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &bind_p1, 0));

		/*
		 * For UDP sockets, allows binding to ephemeral ports (required
		 * to connect or send a first datagram)
		 */
		if (variant->sandbox == UDP_SANDBOX) {
			const struct landlock_net_port_attr bind_ephemeral = {
				.allowed_access = bind_access,
				.port = 0,
			};
			ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
						       LANDLOCK_RULE_NET_PORT,
						       &bind_ephemeral, 0));
		}

		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	test_bind_and_connect(_metadata, &self->srv0, false, false);

	test_bind_and_connect(_metadata, &self->srv1, false,
			      is_restricted(&variant->prot, variant->sandbox));

	test_bind_and_connect(_metadata, &self->srv2,
			      is_restricted(&variant->prot, variant->sandbox),
			      is_restricted(&variant->prot, variant->sandbox));
}

TEST_F(protocol, bind_unspec)
{
	const __u64 bind_access = (variant->sandbox == TCP_SANDBOX ?
					   LANDLOCK_ACCESS_NET_BIND_TCP :
					   LANDLOCK_ACCESS_NET_BIND_UDP);
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = bind_access,
	};
	const struct landlock_net_port_attr rule_bind = {
		.allowed_access = bind_access,
		.port = self->srv0.port,
	};
	int bind_fd, ret;

	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const int ruleset_fd = landlock_create_ruleset(
			&ruleset_attr, sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Allows bind. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &rule_bind, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);

	/* Tries to bind with too small addrlen. */
	EXPECT_EQ(-EINVAL, bind_variant_addrlen(
				   bind_fd, &self->unspec_any0,
				   get_addrlen(&self->unspec_any0, true) - 1));

	/* Allowed bind on AF_UNSPEC/INADDR_ANY. */
	ret = bind_variant(bind_fd, &self->unspec_any0);
	if (variant->prot.domain == AF_INET) {
		EXPECT_EQ(0, ret)
		{
			TH_LOG("Failed to bind to unspec/any socket: %s",
			       strerror(errno));
		}
	} else if (variant->prot.domain == AF_INET6) {
		EXPECT_EQ(-EAFNOSUPPORT, ret);
	} else {
		EXPECT_EQ(-EINVAL, ret);
	}
	EXPECT_EQ(0, close(bind_fd));

	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const int ruleset_fd = landlock_create_ruleset(
			&ruleset_attr, sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Denies bind. */
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);

	/* Denied bind on AF_UNSPEC/INADDR_ANY. */
	ret = bind_variant(bind_fd, &self->unspec_any0);
	if (variant->prot.domain == AF_INET) {
		if (is_restricted(&variant->prot, variant->sandbox)) {
			EXPECT_EQ(-EACCES, ret);
		} else {
			EXPECT_EQ(0, ret);
		}
	} else if (variant->prot.domain == AF_INET6) {
		EXPECT_EQ(-EAFNOSUPPORT, ret);
	} else {
		EXPECT_EQ(-EINVAL, ret);
	}
	EXPECT_EQ(0, close(bind_fd));

	/* Checks bind with AF_UNSPEC and the loopback address. */
	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);
	ret = bind_variant(bind_fd, &self->unspec_srv0);
	if (variant->prot.domain == AF_INET ||
	    variant->prot.domain == AF_INET6) {
		EXPECT_EQ(-EAFNOSUPPORT, ret);
	} else {
		EXPECT_EQ(-EINVAL, ret)
		{
			TH_LOG("Wrong bind error: %s", strerror(errno));
		}
	}
	EXPECT_EQ(0, close(bind_fd));
}

TEST_F(protocol, connect_unspec)
{
	const __u64 connect_right =
		(variant->sandbox == TCP_SANDBOX ?
			 LANDLOCK_ACCESS_NET_CONNECT_TCP :
			 LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
	const __u64 bind_right = (variant->sandbox == TCP_SANDBOX ?
					  LANDLOCK_ACCESS_NET_BIND_TCP :
					  LANDLOCK_ACCESS_NET_BIND_UDP);
	const struct landlock_ruleset_attr ruleset_conn = {
		.handled_access_net = connect_right,
	};
	const struct landlock_ruleset_attr ruleset_conn_bind = {
		.handled_access_net = connect_right | bind_right,
	};
	const struct landlock_net_port_attr rule_connect = {
		.allowed_access = connect_right,
		.port = self->srv0.port,
	};
	int bind_fd, client_fd, status;
	pid_t child;

	/* Specific connection tests. */
	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);
	EXPECT_EQ(0, bind_variant(bind_fd, &self->srv0));
	if (self->srv0.protocol.type == SOCK_STREAM)
		EXPECT_EQ(0, listen(bind_fd, backlog));

	child = fork();
	ASSERT_LE(0, child);
	if (child == 0) {
		int connect_fd, ret;

		/* Closes listening socket for the child. */
		EXPECT_EQ(0, close(bind_fd));

		connect_fd = socket_variant(&self->srv0);
		ASSERT_LE(0, connect_fd);
		EXPECT_EQ(0, connect_variant(connect_fd, &self->srv0));

		/* Tries to connect again, or set peer. */
		ret = connect_variant(connect_fd, &self->srv0);
		if (self->srv0.protocol.type == SOCK_STREAM) {
			EXPECT_EQ(-EISCONN, ret);
		} else {
			EXPECT_EQ(0, ret);
		}

		if (variant->sandbox == TCP_SANDBOX ||
		    variant->sandbox == UDP_SANDBOX) {
			const int ruleset_fd = landlock_create_ruleset(
				&ruleset_conn, sizeof(ruleset_conn), 0);
			ASSERT_LE(0, ruleset_fd);

			/* Allows connect. */
			ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
						       LANDLOCK_RULE_NET_PORT,
						       &rule_connect, 0));
			enforce_ruleset(_metadata, ruleset_fd);
			EXPECT_EQ(0, close(ruleset_fd));
		}

		/* Disconnects already connected socket, or set peer. */
		ret = connect_variant(connect_fd, &self->unspec_any0);
		if (self->srv0.protocol.domain == AF_UNIX &&
		    self->srv0.protocol.type == SOCK_STREAM) {
			EXPECT_EQ(-EINVAL, ret);
		} else {
			EXPECT_EQ(0, ret);
		}

		/* Tries to reconnect, or set peer. */
		ret = connect_variant(connect_fd, &self->srv0);
		if (self->srv0.protocol.domain == AF_UNIX &&
		    self->srv0.protocol.type == SOCK_STREAM) {
			EXPECT_EQ(-EISCONN, ret);
		} else {
			EXPECT_EQ(0, ret);
		}

		if (variant->sandbox == TCP_SANDBOX ||
		    variant->sandbox == UDP_SANDBOX) {
			const int ruleset_fd = landlock_create_ruleset(
				&ruleset_conn_bind, sizeof(ruleset_conn_bind),
				0);
			ASSERT_LE(0, ruleset_fd);

			/* Denies connect and bind. */
			enforce_ruleset(_metadata, ruleset_fd);
			EXPECT_EQ(0, close(ruleset_fd));
		}

		/* Try to re-disconnect with a truncated address struct. */
		EXPECT_EQ(-EINVAL,
			  connect_variant_addrlen(
				  connect_fd, &self->unspec_any0,
				  get_addrlen(&self->unspec_any0, true) - 1));

		/*
		 * Re-disconnect, with a minimal sockaddr struct (just a
		 * bare af_family=AF_UNSPEC field).
		 */
		ret = connect_variant_addrlen(connect_fd, &self->unspec_any0,
					      get_addrlen(&self->unspec_any0,
							  true));
		if (self->srv0.protocol.domain == AF_UNIX &&
		    self->srv0.protocol.type == SOCK_STREAM) {
			EXPECT_EQ(-EINVAL, ret);
		} else {
			/* Always allowed to disconnect. */
			EXPECT_EQ(0, ret);
		}

		EXPECT_EQ(0, close(connect_fd));
		_exit(_metadata->exit_code);
		return;
	}

	client_fd = bind_fd;
	if (self->srv0.protocol.type == SOCK_STREAM) {
		client_fd = accept(bind_fd, NULL, 0);
		ASSERT_LE(0, client_fd);
	}

	EXPECT_EQ(child, waitpid(child, &status, 0));
	EXPECT_EQ(1, WIFEXITED(status));
	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));

	/* Closes connection, if any. */
	if (client_fd != bind_fd)
		EXPECT_LE(0, close(client_fd));

	/* Closes listening socket. */
	EXPECT_EQ(0, close(bind_fd));
}

TEST_F(protocol, tcp_fastopen)
{
	const bool restricted = variant->sandbox == TCP_SANDBOX &&
				variant->prot.type == SOCK_STREAM &&
				(variant->prot.protocol == IPPROTO_TCP ||
				 variant->prot.protocol == IPPROTO_IP) &&
				(variant->prot.domain == AF_INET ||
				 variant->prot.domain == AF_INET6);
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = LANDLOCK_ACCESS_NET_CONNECT_TCP,
	};
	int bind_fd, client_fd, status;
	char buf;
	pid_t child;

	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);
	EXPECT_EQ(0, bind_variant(bind_fd, &self->srv0));
	if (self->srv0.protocol.type == SOCK_STREAM)
		EXPECT_EQ(0, listen(bind_fd, backlog));

	child = fork();
	ASSERT_LE(0, child);
	if (child == 0) {
		int connect_fd, ret;

		/* Closes listening socket for the child. */
		EXPECT_EQ(0, close(bind_fd));

		connect_fd = socket_variant(&self->srv0);
		ASSERT_LE(0, connect_fd);

		if (variant->sandbox == TCP_SANDBOX) {
			const int ruleset_fd = landlock_create_ruleset(
				&ruleset_attr, sizeof(ruleset_attr), 0);
			ASSERT_LE(0, ruleset_fd);

			enforce_ruleset(_metadata, ruleset_fd);
			EXPECT_EQ(0, close(ruleset_fd));
		}

		/* Fast Open with no address. */
		ret = sendto_variant(connect_fd, NULL, NULL, 0, MSG_FASTOPEN);
		if (self->srv0.protocol.domain == AF_UNIX) {
			EXPECT_EQ(-ENOTCONN, ret);
		} else if (self->srv0.protocol.type == SOCK_DGRAM) {
			EXPECT_EQ(-EDESTADDRREQ, ret);
		} else {
			EXPECT_EQ(-EINVAL, ret);
		}

		/* Fast Open to a denied address. */
		ret = sendto_variant(connect_fd, &self->srv0, "A", 1,
				     MSG_FASTOPEN);
		if (restricted) {
			EXPECT_EQ(-EACCES, ret);
		} else if (self->srv0.protocol.domain == AF_UNIX &&
			   self->srv0.protocol.type == SOCK_STREAM) {
			EXPECT_EQ(-EOPNOTSUPP, ret);
		} else {
			EXPECT_EQ(0, ret);
		}

		EXPECT_EQ(0, close(connect_fd));
		_exit(_metadata->exit_code);
		return;
	}

	client_fd = bind_fd;
	if (!restricted && self->srv0.protocol.type == SOCK_STREAM &&
	    self->srv0.protocol.domain != AF_UNIX) {
		client_fd = accept(bind_fd, NULL, 0);
		ASSERT_LE(0, client_fd);
	}

	if (restricted) {
		EXPECT_EQ(-1, read(client_fd, &buf, 1));
		EXPECT_EQ(ENOTCONN, errno);
	} else if (self->srv0.protocol.domain == AF_UNIX &&
		   self->srv0.protocol.type == SOCK_STREAM) {
		EXPECT_EQ(-1, read(client_fd, &buf, 1));
		EXPECT_EQ(EINVAL, errno);
	} else {
		EXPECT_EQ(1, read(client_fd, &buf, 1));
		EXPECT_EQ('A', buf);
	}

	EXPECT_EQ(child, waitpid(child, &status, 0));
	EXPECT_EQ(1, WIFEXITED(status));
	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));

	if (client_fd != bind_fd)
		EXPECT_LE(0, close(client_fd));

	EXPECT_EQ(0, close(bind_fd));
}

TEST_F(protocol, sendmsg_stream)
{
	int srv0_fd, tmp_fd, client_fd, res;
	char read_buf[1] = { 0 };

	/*
	 * Simple test for stream sockets: just deny all connect()/
	 * send(explicit addr)/bind(), and make sure we don't interfere with any
	 * operation.
	 */
	if (variant->prot.type != SOCK_STREAM)
		return;

	if (variant->sandbox == UDP_SANDBOX) {
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net =
				LANDLOCK_ACCESS_NET_BIND_UDP |
				LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
		};
		const int ruleset_fd = landlock_create_ruleset(
			&ruleset_attr, sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	ASSERT_LE(0, client_fd = socket_variant(&self->srv0));
	ASSERT_LE(0, srv0_fd = socket_variant(&self->srv0));
	ASSERT_EQ(0, bind_variant(srv0_fd, &self->srv0));
	ASSERT_EQ(0, listen(srv0_fd, backlog));

	/* Send on a non-connected socket. */
	res = sendto_variant(client_fd, NULL, "A", 1, 0);
	if (variant->prot.domain == AF_UNIX) {
		EXPECT_EQ(-ENOTCONN, res);
	} else {
		EXPECT_EQ(-EPIPE, res);
	}

	/* Send to a truncated (invalid) address on a non-connected socket. */
	res = sendto_variant_addrlen(client_fd, &self->srv0,
				     get_addrlen(&self->srv0, true) - 1, "B", 1,
				     0);
	if (variant->prot.domain == AF_UNIX) {
		EXPECT_EQ(-EOPNOTSUPP, res);
	} else {
		EXPECT_EQ(-EPIPE, res);
	}

	/* Connect. */
	ASSERT_EQ(0, connect_variant(client_fd, &self->srv0));
	tmp_fd = accept(srv0_fd, NULL, 0);
	ASSERT_LE(0, tmp_fd);
	EXPECT_EQ(0, close(srv0_fd));
	srv0_fd = tmp_fd;

	/* Send without an explicit address. */
	EXPECT_EQ(0, sendto_variant(client_fd, NULL, "C", 1, 0));
	EXPECT_EQ(1, recv(srv0_fd, read_buf, 1, 0))
	{
		TH_LOG("recv() failed: %s", strerror(errno));
	}
	EXPECT_EQ(read_buf[0], 'C');

	/* Send to a truncated (invalid) address. */
	res = sendto_variant_addrlen(client_fd, &self->srv0,
				     get_addrlen(&self->srv0, true) - 1, "D", 1,
				     0);
	if (variant->prot.domain == AF_UNIX) {
		EXPECT_EQ(-EISCONN, res);
	} else {
		ASSERT_EQ(0, res);
		EXPECT_EQ(1, recv(srv0_fd, read_buf, 1, 0))
		{
			TH_LOG("recv() failed: %s", strerror(errno));
		}
		EXPECT_EQ(read_buf[0], 'D');
	}

	/* Send to a valid but different address. */
	res = sendto_variant(client_fd, &self->srv1, "E", 1, 0);
	if (variant->prot.domain == AF_UNIX) {
		EXPECT_EQ(-EISCONN, res);
	} else {
		ASSERT_EQ(0, res);
		EXPECT_EQ(1, recv(srv0_fd, read_buf, 1, 0))
		{
			TH_LOG("recv() failed: %s", strerror(errno));
		}
		EXPECT_EQ(read_buf[0], 'E');
	}

	EXPECT_EQ(0, close(client_fd));
}

TEST_F(protocol, sendmsg_dgram)
{
	const bool restricted = is_restricted(&variant->prot, variant->sandbox);
	int srv0_fd, srv1_fd, client_fd, child, status, res;

	if (variant->prot.type != SOCK_DGRAM)
		return;

	/* Prepare server on port #0 to be allowed. */
	ASSERT_LE(0, srv0_fd = socket_variant(&self->srv0));
	ASSERT_EQ(0, bind_variant(srv0_fd, &self->srv0));

	/* And another server on port #1 to be denied. */
	ASSERT_LE(0, srv1_fd = socket_variant(&self->srv1));
	ASSERT_EQ(0, bind_variant(srv1_fd, &self->srv1));

	/*
	 * Check that sockets connected before restrictions are not impacted in
	 * any way.
	 */
	child = fork();
	ASSERT_LE(0, child);
	if (child == 0) {
		ASSERT_LE(0, client_fd = socket_variant(&self->srv0));
		ASSERT_EQ(0, connect_variant(client_fd, &self->srv0));
		if (variant->sandbox == UDP_SANDBOX) {
			/* Deny all connect()/send(explicit addr)/bind(). */
			const struct landlock_ruleset_attr ruleset_attr = {
				.handled_access_net =
					LANDLOCK_ACCESS_NET_BIND_UDP |
					LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
			};
			const int ruleset_fd = landlock_create_ruleset(
				&ruleset_attr, sizeof(ruleset_attr), 0);
			ASSERT_LE(0, ruleset_fd);
			enforce_ruleset(_metadata, ruleset_fd);
			EXPECT_EQ(0, close(ruleset_fd));
		}
		EXPECT_EQ(0,
			  test_sendmsg(_metadata, &variant->prot, client_fd,
				       srv0_fd, NULL, restricted, restricted));
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  srv0_fd, &self->srv0, restricted,
					  restricted));
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  srv1_fd, &self->srv1, restricted,
					  restricted));
		EXPECT_EQ(0, close(client_fd));
		_exit(_metadata->exit_code);
	}
	EXPECT_EQ(child, waitpid(child, &status, 0));
	EXPECT_EQ(1, WIFEXITED(status));
	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));

	/*
	 * Restrict connect/send, but not bind(). Then try sending with no
	 * destination (and no remote peer set), an allowed destination, then a
	 * denied destination.
	 */
	child = fork();
	ASSERT_LE(0, child);
	if (child == 0) {
		if (variant->sandbox == UDP_SANDBOX) {
			const struct landlock_ruleset_attr ruleset_attr = {
				.handled_access_net =
					LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
			};
			const struct landlock_net_port_attr send_p0 = {
				.allowed_access =
					LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
				.port = self->srv0.port,
			};
			const int ruleset_fd = landlock_create_ruleset(
				&ruleset_attr, sizeof(ruleset_attr), 0);
			ASSERT_LE(0, ruleset_fd);
			ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
						       LANDLOCK_RULE_NET_PORT,
						       &send_p0, 0));
			enforce_ruleset(_metadata, ruleset_fd);
			EXPECT_EQ(0, close(ruleset_fd));
		}
		ASSERT_LE(0, client_fd = socket_variant(&self->srv0));
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  -1, NULL, false, false));
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  srv0_fd, &self->srv0, false, false));
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  srv1_fd, &self->srv1, false,
					  restricted));
		EXPECT_EQ(0, close(client_fd));
		_exit(_metadata->exit_code);
		return;
	}
	EXPECT_EQ(child, waitpid(child, &status, 0));
	EXPECT_EQ(1, WIFEXITED(status));
	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));

	/*
	 * Rest of this test is just for autobind enforcement, which only exists
	 * in IP sockets.
	 */
	if (variant->prot.domain != AF_INET && variant->prot.domain != AF_INET6)
		return;

	/* Restrict bind() to explicit calls with an arbitrary (non-0) port. */
	child = fork();
	ASSERT_LE(0, child);
	if (child == 0) {
		const uint16_t allowed_src_port = 42424;
		struct service_fixture allowed_src;

		allowed_src = self->srv0;
		set_port(&allowed_src, allowed_src_port);
		if (variant->sandbox == UDP_SANDBOX) {
			const struct landlock_ruleset_attr ruleset_attr = {
				.handled_access_net =
					LANDLOCK_ACCESS_NET_BIND_UDP,
			};
			const struct landlock_net_port_attr rule = {
				.allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP,
				.port = allowed_src_port,
			};
			const int ruleset_fd = landlock_create_ruleset(
				&ruleset_attr, sizeof(ruleset_attr), 0);
			ASSERT_LE(0, ruleset_fd);
			ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
						       LANDLOCK_RULE_NET_PORT,
						       &rule, 0));
			enforce_ruleset(_metadata, ruleset_fd);
			EXPECT_EQ(0, close(ruleset_fd));
		}
		ASSERT_LE(0, client_fd = socket_variant(&self->srv0));

		/* Check that implicit bind(0) in sendmsg() is denied. */
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  srv0_fd, &self->srv0, restricted,
					  false));

		/* Same thing for autobind in connect(). */
		res = connect_variant(client_fd, &self->srv0);
		if (restricted) {
			EXPECT_EQ(-EACCES, res);
		} else {
			EXPECT_EQ(0, res);
		}
		EXPECT_EQ(0, close(client_fd));

		/* Make sendmsg() work by explicitly binding to the only allowed port. */
		ASSERT_LE(0, client_fd = socket_variant(&self->srv0));
		EXPECT_EQ(0, bind_variant(client_fd, &allowed_src));
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  srv0_fd, &self->srv0, restricted,
					  false));
		EXPECT_EQ(0, close(client_fd));

		/* Make connect() work by explicitly binding to the only allowed port. */
		ASSERT_LE(0, client_fd = socket_variant(&self->srv0));
		EXPECT_EQ(0, bind_variant(client_fd, &allowed_src));
		EXPECT_EQ(0, connect_variant(client_fd, &self->srv0));
		EXPECT_EQ(0, close(client_fd));

		_exit(_metadata->exit_code);
		return;
	}
	EXPECT_EQ(child, waitpid(child, &status, 0));
	EXPECT_EQ(1, WIFEXITED(status));
	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));

	/*
	 * Check that %LANDLOCK_ACCESS_NET_BIND_UDP on port 0 allows implicit
	 * autobinds.
	 */
	child = fork();
	ASSERT_LE(0, child);
	if (child == 0) {
		if (variant->sandbox == UDP_SANDBOX) {
			const struct landlock_ruleset_attr ruleset_attr = {
				.handled_access_net =
					LANDLOCK_ACCESS_NET_BIND_UDP,
			};
			const struct landlock_net_port_attr rule = {
				.allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP,
				.port = 0,
			};
			const int ruleset_fd = landlock_create_ruleset(
				&ruleset_attr, sizeof(ruleset_attr), 0);
			ASSERT_LE(0, ruleset_fd);
			ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
						       LANDLOCK_RULE_NET_PORT,
						       &rule, 0));
			enforce_ruleset(_metadata, ruleset_fd);
			EXPECT_EQ(0, close(ruleset_fd));
		}
		ASSERT_LE(0, client_fd = socket_variant(&self->srv0));
		EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd,
					  srv0_fd, &self->srv0, false, false));
		EXPECT_EQ(0, close(client_fd));
		_exit(_metadata->exit_code);
	}
	EXPECT_EQ(child, waitpid(child, &status, 0));
	EXPECT_EQ(1, WIFEXITED(status));
	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
}

TEST_F(protocol, sendmsg_unspec)
{
	const bool restricted = is_restricted(&variant->prot, variant->sandbox);
	int client_fd, srv0_fd, srv1_fd, res;
	char read_buf[1] = { 0 };

	/*
	 * We already test for the absence of influence on sendmsg for other
	 * socket types and other address families, there's no point in adapting
	 * this test for stream sockets too.
	 */
	if (variant->prot.type != SOCK_DGRAM)
		return;

	/* Prepare client of the right family. */
	ASSERT_LE(0, client_fd = socket_variant(&self->srv0));

	/* Prepare server on port #0 to be allowed. */
	ASSERT_LE(0, srv0_fd = socket_variant(&self->srv0));
	ASSERT_EQ(0, bind_variant(srv0_fd, &self->srv0));

	/* And another server on port #1 to be denied. */
	ASSERT_LE(0, srv1_fd = socket_variant(&self->srv1));
	ASSERT_EQ(0, bind_variant(srv1_fd, &self->srv1));

	if (variant->sandbox == UDP_SANDBOX) {
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net =
				LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
		};
		const struct landlock_net_port_attr rule = {
			.allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
			.port = self->srv0.port,
		};
		const int ruleset_fd = landlock_create_ruleset(
			&ruleset_attr, sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &rule, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	/* Explicit AF_UNSPEC address but truncated. */
	EXPECT_EQ(-EINVAL, sendto_variant_addrlen(
				   client_fd, &self->unspec_srv0,
				   get_addrlen(&self->unspec_srv0, true) - 1,
				   "A", 1, 0));

	/*
	 * Explicit AF_UNSPEC address, should be treated as AF_INET by IPv4
	 * sockets (and thus map to srv0, allowed), but be denied by IPv6
	 * sockets.
	 */
	res = sendto_variant(client_fd, &self->unspec_srv0, "B", 1, 0);
	if (variant->prot.domain == AF_INET6) {
		if (restricted) {
			/* Always denied on IPv6 socket. */
			EXPECT_EQ(-EACCES, res);
		} else {
			/* IPv6 sockets treat AF_UNSPEC as a NULL address. */
			EXPECT_EQ(-EDESTADDRREQ, res);
		}
	} else if (variant->prot.domain == AF_INET) {
		ASSERT_EQ(0, res);
		EXPECT_EQ(1, read(srv0_fd, read_buf, 1))
		{
			TH_LOG("read() failed: %s", strerror(errno));
		}
		EXPECT_EQ(read_buf[0], 'B');
	} else {
		/* Unix sockets don't accept AF_UNSPEC. */
		EXPECT_EQ(-EINVAL, res);
	}

	/*
	 * Explicit AF_UNSPEC address, should be treated as AF_INET on IPv4
	 * sockets (and thus map to srv1, denied), and be denied on IPv6 sockets
	 * as always.
	 */
	res = sendto_variant(client_fd, &self->unspec_srv1, "C", 1, 0);
	if (variant->prot.domain == AF_INET6) {
		if (restricted) {
			/* Always denied on IPv6 socket. */
			EXPECT_EQ(-EACCES, res);
		} else {
			/* IPv6 sockets treat AF_UNSPEC as a NULL address. */
			EXPECT_EQ(-EDESTADDRREQ, res);
		}
	} else if (variant->prot.domain == AF_INET) {
		if (restricted) {
			/* Sending to srv1 is not allowed, only srv0. */
			EXPECT_EQ(-EACCES, res);
		} else {
			ASSERT_EQ(0, res);
			EXPECT_EQ(1, read(srv1_fd, read_buf, 1))
			{
				TH_LOG("read() failed: %s", strerror(errno));
			}
			EXPECT_EQ(read_buf[0], 'C');
		}
	} else {
		/* Unix sockets don't accept AF_UNSPEC. */
		EXPECT_EQ(-EINVAL, res);
	}

	ASSERT_EQ(0, connect_variant(client_fd, &self->srv0));

	/* Minimal explicit AF_UNSPEC address (just the sa_family_t field) */
	res = sendto_variant_addrlen(client_fd, &self->unspec_srv0,
				     get_addrlen(&self->unspec_srv0, true), "D",
				     1, 0);
	if (variant->prot.domain == AF_INET6) {
		if (restricted) {
			/* AF_UNSPEC is always denied in IPv6. */
			EXPECT_EQ(-EACCES, res);
		} else {
			/*
			 * IPv6 sockets treat AF_UNSPEC as a NULL address,
			 * falling back to the connected address.
			 */
			ASSERT_EQ(0, res);
			EXPECT_EQ(1, read(srv0_fd, read_buf, 1));
			EXPECT_EQ(read_buf[0], 'D');
		}
	} else {
		/*
		 * IPv4 socket will expect a struct sockaddr_in, our address is
		 * considered truncated.  And Unix sockets don't accept
		 * AF_UNSPEC at all.
		 */
		EXPECT_EQ(-EINVAL, res);
	}
}

FIXTURE(ipv4)
{
	struct service_fixture srv0, srv1;
};

FIXTURE_VARIANT(ipv4)
{
	const enum sandbox_type sandbox;
	const int type;
};

/* clang-format off */
FIXTURE_VARIANT_ADD(ipv4, no_sandbox_with_tcp) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.type = SOCK_STREAM,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(ipv4, tcp_sandbox_with_tcp) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.type = SOCK_STREAM,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(ipv4, udp_sandbox_with_tcp) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.type = SOCK_STREAM,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(ipv4, no_sandbox_with_udp) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.type = SOCK_DGRAM,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(ipv4, tcp_sandbox_with_udp) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.type = SOCK_DGRAM,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(ipv4, udp_sandbox_with_udp) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.type = SOCK_DGRAM,
};

FIXTURE_SETUP(ipv4)
{
	const struct protocol_variant prot = {
		.domain = AF_INET,
		.type = variant->type,
	};

	disable_caps(_metadata);

	set_service(&self->srv0, prot, 0);
	set_service(&self->srv1, prot, 1);

	setup_loopback(_metadata);
};

FIXTURE_TEARDOWN(ipv4)
{
}

TEST_F(ipv4, from_unix_to_inet)
{
	int unix_stream_fd, unix_dgram_fd;

	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const __u64 access_rights =
			(variant->sandbox == TCP_SANDBOX ?
				 LANDLOCK_ACCESS_NET_BIND_TCP |
					 LANDLOCK_ACCESS_NET_CONNECT_TCP :
				 LANDLOCK_ACCESS_NET_BIND_UDP |
					 LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = access_rights,
		};
		const struct landlock_net_port_attr tcp_bind_connect_p0 = {
			.allowed_access = access_rights,
			.port = self->srv0.port,
		};
		int ruleset_fd;

		/* Denies connect and bind to check errno value. */
		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Allows connect and bind for srv0.  */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind_connect_p0, 0));

		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	unix_stream_fd = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
	ASSERT_LE(0, unix_stream_fd);

	unix_dgram_fd = socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0);
	ASSERT_LE(0, unix_dgram_fd);

	/* Checks unix stream bind and connect for srv0. */
	EXPECT_EQ(-EINVAL, bind_variant(unix_stream_fd, &self->srv0));
	EXPECT_EQ(-EINVAL, connect_variant(unix_stream_fd, &self->srv0));

	/* Checks unix stream bind and connect for srv1. */
	EXPECT_EQ(-EINVAL, bind_variant(unix_stream_fd, &self->srv1))
	{
		TH_LOG("Wrong bind error: %s", strerror(errno));
	}
	EXPECT_EQ(-EINVAL, connect_variant(unix_stream_fd, &self->srv1));

	/* Checks unix datagram bind and connect for srv0. */
	EXPECT_EQ(-EINVAL, bind_variant(unix_dgram_fd, &self->srv0));
	EXPECT_EQ(-EINVAL, connect_variant(unix_dgram_fd, &self->srv0));

	/* Checks unix datagram bind and connect for srv1. */
	EXPECT_EQ(-EINVAL, bind_variant(unix_dgram_fd, &self->srv1));
	EXPECT_EQ(-EINVAL, connect_variant(unix_dgram_fd, &self->srv1));
}

FIXTURE(tcp_layers)
{
	struct service_fixture srv0, srv1;
};

FIXTURE_VARIANT(tcp_layers)
{
	const size_t num_layers;
	const int domain;
};

FIXTURE_SETUP(tcp_layers)
{
	const struct protocol_variant prot = {
		.domain = variant->domain,
		.type = SOCK_STREAM,
	};

	disable_caps(_metadata);

	ASSERT_EQ(0, set_service(&self->srv0, prot, 0));
	ASSERT_EQ(0, set_service(&self->srv1, prot, 1));

	setup_loopback(_metadata);
};

FIXTURE_TEARDOWN(tcp_layers)
{
}

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, no_sandbox_with_ipv4) {
	/* clang-format on */
	.domain = AF_INET,
	.num_layers = 0,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, one_sandbox_with_ipv4) {
	/* clang-format on */
	.domain = AF_INET,
	.num_layers = 1,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, two_sandboxes_with_ipv4) {
	/* clang-format on */
	.domain = AF_INET,
	.num_layers = 2,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, three_sandboxes_with_ipv4) {
	/* clang-format on */
	.domain = AF_INET,
	.num_layers = 3,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, no_sandbox_with_ipv6) {
	/* clang-format on */
	.domain = AF_INET6,
	.num_layers = 0,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, one_sandbox_with_ipv6) {
	/* clang-format on */
	.domain = AF_INET6,
	.num_layers = 1,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, two_sandboxes_with_ipv6) {
	/* clang-format on */
	.domain = AF_INET6,
	.num_layers = 2,
};

/* clang-format off */
FIXTURE_VARIANT_ADD(tcp_layers, three_sandboxes_with_ipv6) {
	/* clang-format on */
	.domain = AF_INET6,
	.num_layers = 3,
};

TEST_F(tcp_layers, ruleset_overlap)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
				      LANDLOCK_ACCESS_NET_CONNECT_TCP,
	};
	const struct landlock_net_port_attr tcp_bind = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = self->srv0.port,
	};
	const struct landlock_net_port_attr tcp_bind_connect = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP |
				  LANDLOCK_ACCESS_NET_CONNECT_TCP,
		.port = self->srv0.port,
	};

	if (variant->num_layers >= 1) {
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Allows bind. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind, 0));
		/* Also allows bind, but allows connect too. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind_connect, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	if (variant->num_layers >= 2) {
		int ruleset_fd;

		/* Creates another ruleset layer. */
		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Only allows bind. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	if (variant->num_layers >= 3) {
		int ruleset_fd;

		/* Creates another ruleset layer. */
		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Try to allow bind and connect. */
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind_connect, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	/*
	 * Forbids to connect to the socket because only one ruleset layer
	 * allows connect.
	 */
	test_bind_and_connect(_metadata, &self->srv0, false,
			      variant->num_layers >= 2);
}

TEST_F(tcp_layers, ruleset_expand)
{
	if (variant->num_layers >= 1) {
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
		};
		/* Allows bind for srv0. */
		const struct landlock_net_port_attr bind_srv0 = {
			.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
			.port = self->srv0.port,
		};
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &bind_srv0, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	if (variant->num_layers >= 2) {
		/* Expands network mask with connect action. */
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
					      LANDLOCK_ACCESS_NET_CONNECT_TCP,
		};
		/* Allows bind for srv0 and connect to srv0. */
		const struct landlock_net_port_attr tcp_bind_connect_p0 = {
			.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP |
					  LANDLOCK_ACCESS_NET_CONNECT_TCP,
			.port = self->srv0.port,
		};
		/* Try to allow bind for srv1. */
		const struct landlock_net_port_attr tcp_bind_p1 = {
			.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
			.port = self->srv1.port,
		};
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind_connect_p0, 0));
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind_p1, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	if (variant->num_layers >= 3) {
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
					      LANDLOCK_ACCESS_NET_CONNECT_TCP,
		};
		/* Allows connect to srv0, without bind rule. */
		const struct landlock_net_port_attr tcp_bind_p0 = {
			.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
			.port = self->srv0.port,
		};
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &tcp_bind_p0, 0));
		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	test_bind_and_connect(_metadata, &self->srv0, false,
			      variant->num_layers >= 3);

	test_bind_and_connect(_metadata, &self->srv1, variant->num_layers >= 1,
			      variant->num_layers >= 2);
}

/* clang-format off */
FIXTURE(mini) {};
/* clang-format on */

FIXTURE_SETUP(mini)
{
	disable_caps(_metadata);

	setup_loopback(_metadata);
};

FIXTURE_TEARDOWN(mini)
{
}

/* clang-format off */

#define ACCESS_LAST LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP

#define ACCESS_ALL ( \
	LANDLOCK_ACCESS_NET_BIND_TCP | \
	LANDLOCK_ACCESS_NET_CONNECT_TCP | \
	LANDLOCK_ACCESS_NET_BIND_UDP | \
	LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP)

/* clang-format on */

TEST_F(mini, network_access_rights)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = ACCESS_ALL,
	};
	struct landlock_net_port_attr net_port = {
		.port = sock_port_start,
	};
	int ruleset_fd;
	__u64 access;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);

	for (access = 1; access <= ACCESS_LAST; access <<= 1) {
		net_port.allowed_access = access;
		EXPECT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &net_port, 0))
		{
			TH_LOG("Failed to add rule with access 0x%llx: %s",
			       (unsigned long long)access, strerror(errno));
		}
	}
	EXPECT_EQ(0, close(ruleset_fd));
}

/* Checks invalid attribute, out of landlock network access range. */
TEST_F(mini, ruleset_with_unknown_access)
{
	__u64 access_mask;

	for (access_mask = 1ULL << 63; access_mask != ACCESS_LAST;
	     access_mask >>= 1) {
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = access_mask,
		};

		EXPECT_EQ(-1, landlock_create_ruleset(&ruleset_attr,
						      sizeof(ruleset_attr), 0));
		EXPECT_EQ(EINVAL, errno);
	}
}

TEST_F(mini, rule_with_unknown_access)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = ACCESS_ALL,
	};
	struct landlock_net_port_attr net_port = {
		.port = sock_port_start,
	};
	int ruleset_fd;
	__u64 access;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);

	for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) {
		net_port.allowed_access = access;
		EXPECT_EQ(-1,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &net_port, 0));
		EXPECT_EQ(EINVAL, errno);
	}
	EXPECT_EQ(0, close(ruleset_fd));
}

TEST_F(mini, rule_with_unhandled_access)
{
	struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
	};
	struct landlock_net_port_attr net_port = {
		.port = sock_port_start,
	};
	int ruleset_fd;
	__u64 access;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);

	for (access = 1; access > 0; access <<= 1) {
		int err;

		net_port.allowed_access = access;
		err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					&net_port, 0);
		if (access == ruleset_attr.handled_access_net) {
			EXPECT_EQ(0, err);
		} else {
			EXPECT_EQ(-1, err);
			EXPECT_EQ(EINVAL, errno);
		}
	}

	EXPECT_EQ(0, close(ruleset_fd));
}

TEST_F(mini, inval)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP
	};
	const struct landlock_net_port_attr tcp_bind_connect = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP |
				  LANDLOCK_ACCESS_NET_CONNECT_TCP,
		.port = sock_port_start,
	};
	const struct landlock_net_port_attr tcp_denied = {
		.allowed_access = 0,
		.port = sock_port_start,
	};
	const struct landlock_net_port_attr tcp_bind = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = sock_port_start,
	};
	int ruleset_fd;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);

	/* Checks unhandled allowed_access. */
	EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					&tcp_bind_connect, 0));
	EXPECT_EQ(EINVAL, errno);

	/* Checks zero access value. */
	EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					&tcp_denied, 0));
	EXPECT_EQ(ENOMSG, errno);

	/* Adds with legitimate values. */
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &tcp_bind, 0));
}

TEST_F(mini, tcp_port_overflow)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
				      LANDLOCK_ACCESS_NET_CONNECT_TCP,
	};
	const struct landlock_net_port_attr port_max_bind = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = UINT16_MAX,
	};
	const struct landlock_net_port_attr port_max_connect = {
		.allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP,
		.port = UINT16_MAX,
	};
	const struct landlock_net_port_attr port_overflow1 = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = UINT16_MAX + 1,
	};
	const struct landlock_net_port_attr port_overflow2 = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = UINT16_MAX + 2,
	};
	const struct landlock_net_port_attr port_overflow3 = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = UINT32_MAX + 1UL,
	};
	const struct landlock_net_port_attr port_overflow4 = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = UINT32_MAX + 2UL,
	};
	const struct protocol_variant ipv4_tcp = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
	};
	struct service_fixture srv_denied, srv_max_allowed;
	int ruleset_fd;

	ASSERT_EQ(0, set_service(&srv_denied, ipv4_tcp, 0));

	/* Be careful to avoid port inconsistencies. */
	srv_max_allowed = srv_denied;
	srv_max_allowed.port = port_max_bind.port;
	srv_max_allowed.ipv4_addr.sin_port = htons(port_max_bind.port);

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);

	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &port_max_bind, 0));

	EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					&port_overflow1, 0));
	EXPECT_EQ(EINVAL, errno);

	EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					&port_overflow2, 0));
	EXPECT_EQ(EINVAL, errno);

	EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					&port_overflow3, 0));
	EXPECT_EQ(EINVAL, errno);

	/* Interleaves with invalid rule additions. */
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &port_max_connect, 0));

	EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					&port_overflow4, 0));
	EXPECT_EQ(EINVAL, errno);

	enforce_ruleset(_metadata, ruleset_fd);

	test_bind_and_connect(_metadata, &srv_denied, true, true);
	test_bind_and_connect(_metadata, &srv_max_allowed, false, false);
}

FIXTURE(ipv4_tcp)
{
	struct service_fixture srv0, srv1;
};

FIXTURE_SETUP(ipv4_tcp)
{
	const struct protocol_variant ipv4_tcp = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
	};

	disable_caps(_metadata);

	ASSERT_EQ(0, set_service(&self->srv0, ipv4_tcp, 0));
	ASSERT_EQ(0, set_service(&self->srv1, ipv4_tcp, 1));

	setup_loopback(_metadata);
};

FIXTURE_TEARDOWN(ipv4_tcp)
{
}

TEST_F(ipv4_tcp, port_endianness)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
				      LANDLOCK_ACCESS_NET_CONNECT_TCP,
	};
	const struct landlock_net_port_attr bind_host_endian_p0 = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		/* Host port format. */
		.port = self->srv0.port,
	};
	const struct landlock_net_port_attr connect_big_endian_p0 = {
		.allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP,
		/* Big endian port format. */
		.port = htons(self->srv0.port),
	};
	const struct landlock_net_port_attr bind_connect_host_endian_p1 = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP |
				  LANDLOCK_ACCESS_NET_CONNECT_TCP,
		/* Host port format. */
		.port = self->srv1.port,
	};
	const unsigned int one = 1;
	const char little_endian = *(const char *)&one;
	int ruleset_fd;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &bind_host_endian_p0, 0));
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &connect_big_endian_p0, 0));
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &bind_connect_host_endian_p1, 0));
	enforce_ruleset(_metadata, ruleset_fd);

	/* No restriction for big endinan CPU. */
	test_bind_and_connect(_metadata, &self->srv0, false, little_endian);

	/* No restriction for any CPU. */
	test_bind_and_connect(_metadata, &self->srv1, false, false);
}

TEST_F(ipv4_tcp, with_fs)
{
	const struct landlock_ruleset_attr ruleset_attr_fs_net = {
		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
	};
	struct landlock_path_beneath_attr path_beneath = {
		.allowed_access = LANDLOCK_ACCESS_FS_READ_DIR,
		.parent_fd = -1,
	};
	struct landlock_net_port_attr tcp_bind = {
		.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
		.port = self->srv0.port,
	};
	int ruleset_fd, bind_fd, dir_fd;

	/* Creates ruleset both for filesystem and network access. */
	ruleset_fd = landlock_create_ruleset(&ruleset_attr_fs_net,
					     sizeof(ruleset_attr_fs_net), 0);
	ASSERT_LE(0, ruleset_fd);

	/* Adds a filesystem rule. */
	path_beneath.parent_fd = open("/dev", O_PATH | O_DIRECTORY | O_CLOEXEC);
	ASSERT_LE(0, path_beneath.parent_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
				       &path_beneath, 0));
	EXPECT_EQ(0, close(path_beneath.parent_fd));

	/* Adds a network rule. */
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &tcp_bind, 0));

	enforce_ruleset(_metadata, ruleset_fd);
	EXPECT_EQ(0, close(ruleset_fd));

	/* Tests file access. */
	dir_fd = open("/dev", O_RDONLY);
	EXPECT_LE(0, dir_fd);
	EXPECT_EQ(0, close(dir_fd));

	dir_fd = open("/", O_RDONLY);
	EXPECT_EQ(-1, dir_fd);
	EXPECT_EQ(EACCES, errno);

	/* Tests port binding. */
	bind_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
	ASSERT_LE(0, bind_fd);
	EXPECT_EQ(0, bind_variant(bind_fd, &self->srv0));
	EXPECT_EQ(0, close(bind_fd));

	bind_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
	ASSERT_LE(0, bind_fd);
	EXPECT_EQ(-EACCES, bind_variant(bind_fd, &self->srv1));
}

FIXTURE(port_specific)
{
	struct service_fixture srv0;
	struct service_fixture cli1;
};

FIXTURE_VARIANT(port_specific)
{
	const enum sandbox_type sandbox;
	const struct protocol_variant prot;
};

/* clang-format off */
FIXTURE_VARIANT_ADD(port_specific, no_sandbox_with_ipv4) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(port_specific, tcp_sandbox_with_ipv4) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(port_specific, udp_sandbox_with_ipv4) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(port_specific, no_sandbox_with_ipv6) {
	/* clang-format on */
	.sandbox = NO_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(port_specific, tcp_sandbox_with_ipv6) {
	/* clang-format on */
	.sandbox = TCP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(port_specific, udp_sandbox_with_ipv6) {
	/* clang-format on */
	.sandbox = UDP_SANDBOX,
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_DGRAM,
	},
};

FIXTURE_SETUP(port_specific)
{
	disable_caps(_metadata);

	ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0));
	ASSERT_EQ(0, set_service(&self->cli1, variant->prot, 1));

	setup_loopback(_metadata);
};

FIXTURE_TEARDOWN(port_specific)
{
}

TEST_F(port_specific, bind_connect_zero)
{
	int bind_fd, connect_fd, ret;
	uint16_t port;

	/* Adds a rule layer with bind and connect actions. */
	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const __u64 access_rights =
			(variant->sandbox == TCP_SANDBOX ?
				 LANDLOCK_ACCESS_NET_BIND_TCP |
					 LANDLOCK_ACCESS_NET_CONNECT_TCP :
				 LANDLOCK_ACCESS_NET_BIND_UDP |
					 LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = access_rights,
		};
		const struct landlock_net_port_attr bind_connect_zero = {
			.allowed_access = access_rights,
			.port = 0,
		};
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		/* Checks zero port value on bind and connect actions. */
		EXPECT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &bind_connect_zero, 0));

		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);

	connect_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, connect_fd);

	/* Sets address port to 0 for both protocol families. */
	set_port(&self->srv0, 0);
	/*
	 * Binds on port 0, which selects a random port within
	 * ip_local_port_range.
	 */
	ret = bind_variant(bind_fd, &self->srv0);
	EXPECT_EQ(0, ret);

	if (variant->prot.type == SOCK_STREAM)
		EXPECT_EQ(0, listen(bind_fd, backlog));

	/* Connects on port 0. */
	ret = connect_variant(connect_fd, &self->srv0);
	if (variant->prot.type == SOCK_STREAM) {
		EXPECT_EQ(-ECONNREFUSED, ret);
	} else {
		EXPECT_EQ(0, ret);
	}

	/* Sets binded port for both protocol families. */
	port = get_binded_port(bind_fd, &variant->prot);
	EXPECT_NE(0, port);
	set_port(&self->srv0, port);
	/* Connects on the binded port. */
	ret = connect_variant(connect_fd, &self->srv0);
	if (is_restricted(&variant->prot, variant->sandbox)) {
		/* Denied by Landlock. */
		EXPECT_EQ(-EACCES, ret);
	} else {
		EXPECT_EQ(0, ret);
	}

	EXPECT_EQ(0, close(connect_fd));
	EXPECT_EQ(0, close(bind_fd));
}

TEST_F(port_specific, bind_connect_1023)
{
	int bind_fd, connect_fd, ret;

	/* Adds a rule layer with bind and connect actions. */
	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const __u64 bind_right = (variant->sandbox == TCP_SANDBOX ?
						  LANDLOCK_ACCESS_NET_BIND_TCP :
						  LANDLOCK_ACCESS_NET_BIND_UDP);
		const __u64 access_rights =
			(variant->sandbox == TCP_SANDBOX ?
				 (LANDLOCK_ACCESS_NET_BIND_TCP |
				  LANDLOCK_ACCESS_NET_CONNECT_TCP) :
				 (LANDLOCK_ACCESS_NET_BIND_UDP |
				  LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP));
		const struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = access_rights,
		};
		/* A rule with port value less than 1024. */
		const struct landlock_net_port_attr bind_connect_low_range = {
			.allowed_access = access_rights,
			.port = 1023,
		};
		/* A rule with 1024 port. */
		const struct landlock_net_port_attr bind_connect = {
			.allowed_access = access_rights,
			.port = 1024,
		};
		/* A rule with cli1's port, to use as source port. */
		const struct landlock_net_port_attr srcport = {
			.allowed_access = bind_right,
			.port = self->cli1.port,
		};
		int ruleset_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		ASSERT_LE(0, ruleset_fd);

		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &bind_connect_low_range, 0));
		ASSERT_EQ(0,
			  landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
					    &bind_connect, 0));
		if (variant->sandbox == UDP_SANDBOX) {
			ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
						       LANDLOCK_RULE_NET_PORT,
						       &srcport, 0));
		}

		enforce_ruleset(_metadata, ruleset_fd);
		EXPECT_EQ(0, close(ruleset_fd));
	}

	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);

	/* Sets address port to 1023 for both protocol families. */
	set_port(&self->srv0, 1023);
	/* Binds on port 1023. */
	ret = bind_variant(bind_fd, &self->srv0);
	/* Denied by the system. */
	EXPECT_EQ(-EACCES, ret);

	/* Binds on port 1023. */
	set_cap(_metadata, CAP_NET_BIND_SERVICE);
	ret = bind_variant(bind_fd, &self->srv0);
	clear_cap(_metadata, CAP_NET_BIND_SERVICE);
	EXPECT_EQ(0, ret);
	if (variant->prot.type == SOCK_STREAM)
		EXPECT_EQ(0, listen(bind_fd, backlog));

	connect_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, connect_fd);
	if (variant->prot.type == SOCK_DGRAM) {
		/*
		 * We are about to connect(), but bind() is restricted, so for
		 * UDP sockets we need to use cli1's port as source port (the
		 * only one we are allowed to use).
		 */
		EXPECT_EQ(0, bind_variant(connect_fd, &self->cli1));
	}
	/* Connects on the binded port 1023. */
	ret = connect_variant(connect_fd, &self->srv0);
	EXPECT_EQ(0, ret);

	EXPECT_EQ(0, close(connect_fd));
	EXPECT_EQ(0, close(bind_fd));

	bind_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, bind_fd);

	connect_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, connect_fd);

	/* Sets address port to 1024 for both protocol families. */
	set_port(&self->srv0, 1024);
	/* Binds on port 1024. */
	ret = bind_variant(bind_fd, &self->srv0);
	EXPECT_EQ(0, ret);
	if (variant->prot.type == SOCK_STREAM)
		EXPECT_EQ(0, listen(bind_fd, backlog));
	if (variant->prot.type == SOCK_DGRAM)
		EXPECT_EQ(0, bind_variant(connect_fd, &self->cli1));

	/* Connects on the binded port 1024. */
	ret = connect_variant(connect_fd, &self->srv0);
	EXPECT_EQ(0, ret);

	EXPECT_EQ(0, close(connect_fd));
	EXPECT_EQ(0, close(bind_fd));
}

/**
 * matches_auditlog - Check audit log for a network access denial
 *
 * @audit_fd:   Audit file descriptor.
 * @blockers:   A regex-escaped blocker string, e.g., "net\.bind_tcp".
 * @dir_addr:   Either "saddr" or "daddr", ignored if addr is NULL.
 * @addr:       A regex-escaped IP address string, or NULL.
 * @dir_port:   Either "src" or "dest", ignored if addr is NULL.
 * @port:       A port number, ignored if addr is NULL.
 */
static int matches_auditlog(const int audit_fd, const char *const blockers,
			    const char *const dir_addr, const char *const addr,
			    const char *const dir_port, const __u16 port)
{
	static const char log_with_addrport_tmpl[] = REGEX_LANDLOCK_PREFIX
		" blockers=%s %s=%s %s=%u$";
	static const char log_without_addrport_tmpl[] = REGEX_LANDLOCK_PREFIX
		" blockers=%s";
	/*
	 * Max strlen(blockers): 16
	 * Max strlen(dir_addr): 5
	 * Max strlen(addr): 12
	 * Max strlen(dir_port): 4
	 * Max strlen(%u port): 5
	 */
	char log_match[sizeof(log_with_addrport_tmpl) + 42];
	int log_match_len;

	if (addr == NULL)
		log_match_len = snprintf(log_match, sizeof(log_match),
					 log_without_addrport_tmpl, blockers);
	else
		log_match_len = snprintf(log_match, sizeof(log_match),
					 log_with_addrport_tmpl, blockers,
					 dir_addr, addr, dir_port, port);
	if (log_match_len > sizeof(log_match))
		return -E2BIG;

	return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
				  NULL);
}

FIXTURE(audit)
{
	struct service_fixture srv0;
	struct service_fixture srv1;
	/* srv2 has a rule with no access but quiet bit set. */
	struct service_fixture srv2;
	struct service_fixture unspec_srv0;
	struct audit_filter audit_filter;
	int audit_fd;
};

FIXTURE_VARIANT(audit)
{
	const char *const addr;
	const struct protocol_variant prot;
};

/* clang-format off */
FIXTURE_VARIANT_ADD(audit, ipv4_tcp) {
	/* clang-format on */
	.addr = "127\\.0\\.0\\.1",
	.prot = {
		.domain = AF_INET,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(audit, ipv4_udp) {
	/* clang-format on */
	.addr = "127\\.0\\.0\\.1",
	.prot = {
		.domain = AF_INET,
		.type = SOCK_DGRAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(audit, ipv6_tcp) {
	/* clang-format on */
	.addr = "::1",
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_STREAM,
	},
};

/* clang-format off */
FIXTURE_VARIANT_ADD(audit, ipv6_udp) {
	/* clang-format on */
	.addr = "::1",
	.prot = {
		.domain = AF_INET6,
		.type = SOCK_DGRAM,
	},
};

FIXTURE_SETUP(audit)
{
	struct protocol_variant prot_unspec = variant->prot;

	prot_unspec.domain = AF_UNSPEC;

	ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0));
	ASSERT_EQ(0, set_service(&self->srv1, variant->prot, 1));
	ASSERT_EQ(0, set_service(&self->srv2, variant->prot, 2));
	ASSERT_EQ(0, set_service(&self->unspec_srv0, prot_unspec, 0));

	setup_loopback(_metadata);

	set_cap(_metadata, CAP_AUDIT_CONTROL);
	self->audit_fd = audit_init_with_exe_filter(&self->audit_filter);
	EXPECT_LE(0, self->audit_fd);
	disable_caps(_metadata);
};

FIXTURE_TEARDOWN(audit)
{
	set_cap(_metadata, CAP_AUDIT_CONTROL);
	EXPECT_EQ(0, audit_cleanup(self->audit_fd, &self->audit_filter));
	clear_cap(_metadata, CAP_AUDIT_CONTROL);
}

TEST_F(audit, bind)
{
	const char *audit_evt = (variant->prot.type == SOCK_STREAM ?
					 "net\\.bind_tcp" :
					 "net\\.bind_udp");
	const __u64 access_rights =
		(variant->prot.type == SOCK_STREAM ?
			 LANDLOCK_ACCESS_NET_BIND_TCP |
				 LANDLOCK_ACCESS_NET_CONNECT_TCP :
			 LANDLOCK_ACCESS_NET_BIND_UDP |
				 LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = access_rights,
		.quiet_access_net = access_rights,
	};
	const struct landlock_net_port_attr quiet_rule = {
		.allowed_access = 0,
		.port = self->srv2.port,
	};
	struct audit_records records;
	int ruleset_fd, sock_fd;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &quiet_rule, LANDLOCK_ADD_RULE_QUIET));
	enforce_ruleset(_metadata, ruleset_fd);
	EXPECT_EQ(0, close(ruleset_fd));

	sock_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(-EACCES, bind_variant(sock_fd, &self->srv0));
	EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "saddr",
				      variant->addr, "src", self->srv0.port));

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(1, records.domain);

	EXPECT_EQ(0, close(sock_fd));

	/* Bind to srv2 (with quiet rule): no new audit logs. */
	sock_fd = socket_variant(&self->srv2);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(-EACCES, bind_variant(sock_fd, &self->srv2));

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(0, records.domain);

	EXPECT_EQ(0, close(sock_fd));
}

TEST_F(audit, connect)
{
	const char *audit_evt = (variant->prot.type == SOCK_STREAM ?
					 "net\\.connect_tcp" :
					 "net\\.connect_send_udp");
	const __u64 bind_right = (variant->prot.type == SOCK_STREAM ?
					  LANDLOCK_ACCESS_NET_BIND_TCP :
					  LANDLOCK_ACCESS_NET_BIND_UDP);
	const __u64 conn_right = (variant->prot.type == SOCK_STREAM ?
					  LANDLOCK_ACCESS_NET_CONNECT_TCP :
					  LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
	const __u64 access_rights = bind_right | conn_right;
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = access_rights,
		.quiet_access_net = access_rights,
	};
	const struct landlock_net_port_attr rule_connect_p1 = {
		.allowed_access = conn_right,
		.port = self->srv1.port,
	};
	const struct landlock_net_port_attr quiet_rule = {
		.allowed_access = 0,
		.port = self->srv2.port,
	};
	struct audit_records records;
	int ruleset_fd, sock_fd;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &rule_connect_p1, 0));
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &quiet_rule, LANDLOCK_ADD_RULE_QUIET));
	enforce_ruleset(_metadata, ruleset_fd);
	EXPECT_EQ(0, close(ruleset_fd));

	sock_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv0));
	EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "daddr",
				      variant->addr, "dest", self->srv0.port));

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(1, records.domain);

	if (variant->prot.type == SOCK_DGRAM) {
		/* Check that autobind generates a denied bind event. */
		EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv1));

		EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.bind_udp",
					      NULL, NULL, NULL, 0));
		EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
		EXPECT_EQ(0, records.access);
		EXPECT_EQ(0, records.domain);
	}

	EXPECT_EQ(0, close(sock_fd));

	/* Connect to srv2 (with quiet rule): no new audit logs. */
	sock_fd = socket_variant(&self->srv2);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv2));

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(0, records.domain);

	EXPECT_EQ(0, close(sock_fd));
}

/* Quieting bind access has no effect on connect. */
TEST_F(audit, connect_quiet_bind)
{
	const char *audit_evt = (variant->prot.type == SOCK_STREAM ?
					 "net\\.connect_tcp" :
					 "net\\.connect_send_udp");
	const int bind_right = (variant->prot.type == SOCK_STREAM ?
					LANDLOCK_ACCESS_NET_BIND_TCP :
					LANDLOCK_ACCESS_NET_BIND_UDP);
	const int conn_right = (variant->prot.type == SOCK_STREAM ?
					LANDLOCK_ACCESS_NET_CONNECT_TCP :
					LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
	const int access_rights = bind_right | conn_right;
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = access_rights,
		.quiet_access_net = bind_right,
	};
	const struct landlock_ruleset_attr ruleset_attr_2 = {
		.handled_access_net = access_rights,
		.quiet_access_net = conn_right,
	};
	const struct landlock_net_port_attr quiet_rule = {
		.allowed_access = 0,
		.port = self->srv2.port,
	};
	struct audit_records records;
	int ruleset_fd, sock_fd;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &quiet_rule, LANDLOCK_ADD_RULE_QUIET));
	enforce_ruleset(_metadata, ruleset_fd);
	EXPECT_EQ(0, close(ruleset_fd));

	sock_fd = socket_variant(&self->srv2);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv2));
	EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "daddr",
				      variant->addr, "dest", self->srv2.port));

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);

	EXPECT_EQ(0, close(sock_fd));

	/* New layer that also denies connect but has the correct quiet bit. */
	ruleset_fd = landlock_create_ruleset(&ruleset_attr_2,
					     sizeof(ruleset_attr_2), 0);
	ASSERT_LE(0, ruleset_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &quiet_rule, LANDLOCK_ADD_RULE_QUIET));
	enforce_ruleset(_metadata, ruleset_fd);
	EXPECT_EQ(0, close(ruleset_fd));

	sock_fd = socket_variant(&self->srv2);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv2));

	/* Quieted - no logs expected. */
	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);

	EXPECT_EQ(0, close(sock_fd));
}

static int matches_log_connect_bound(int audit_fd, const char *const blockers,
				     const char *const addr, __u16 lport,
				     __u16 dport)
{
	static const char log_template[] = REGEX_LANDLOCK_PREFIX
		" blockers=%s laddr=%s lport=%u daddr=%s dest=%u$";
	/* Slack for the blockers, two addresses and two port numbers. */
	char log_match[sizeof(log_template) + 60];
	int log_match_len;

	log_match_len = snprintf(log_match, sizeof(log_match), log_template,
				 blockers, addr, lport, addr, dport);
	if (log_match_len > sizeof(log_match))
		return -E2BIG;

	return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
				  NULL);
}

/*
 * After a bind() to an allowed port, a denied connect must report laddr/lport
 * from the bound socket (made available through audit_net.sk) in addition to
 * the connect sockaddr's daddr/dest.
 */
TEST_F(audit, connect_bound)
{
	const __u64 bind_right = (variant->prot.type == SOCK_STREAM ?
					  LANDLOCK_ACCESS_NET_BIND_TCP :
					  LANDLOCK_ACCESS_NET_BIND_UDP);
	const __u64 conn_right = (variant->prot.type == SOCK_STREAM ?
					  LANDLOCK_ACCESS_NET_CONNECT_TCP :
					  LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
	const char *const audit_evt = (variant->prot.type == SOCK_STREAM ?
					       "net\\.connect_tcp" :
					       "net\\.connect_send_udp");
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = bind_right | conn_right,
	};
	const struct landlock_net_port_attr rule_bind = {
		.allowed_access = bind_right,
		.port = self->srv0.port,
	};
	struct service_fixture srv_remote;
	struct audit_records records;
	int ruleset_fd, sock_fd;

	/* Uses a second port as the denied connect target. */
	ASSERT_EQ(0, set_service(&srv_remote, variant->prot, 1));

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &rule_bind, 0));
	enforce_ruleset(_metadata, ruleset_fd);
	EXPECT_EQ(0, close(ruleset_fd));

	sock_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(0, bind_variant(sock_fd, &self->srv0));
	EXPECT_EQ(-EACCES, connect_variant(sock_fd, &srv_remote));
	EXPECT_EQ(0, matches_log_connect_bound(self->audit_fd, audit_evt,
					       variant->addr, self->srv0.port,
					       srv_remote.port));

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(1, records.domain);

	EXPECT_EQ(0, close(sock_fd));
}

TEST_F(audit, sendmsg)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.handled_access_net = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP |
				      LANDLOCK_ACCESS_NET_BIND_UDP,
	};
	const struct landlock_net_port_attr rule = {
		.allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
		.port = self->srv1.port,
	};
	struct audit_records records;
	int ruleset_fd;
	int sock_fd;

	/* Sendmsg on stream sockets is never denied. */
	if (variant->prot.type != SOCK_DGRAM)
		return;

	ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, ruleset_fd);
	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				       &rule, 0));
	enforce_ruleset(_metadata, ruleset_fd);
	EXPECT_EQ(0, close(ruleset_fd));

	sock_fd = socket_variant(&self->srv0);
	ASSERT_LE(0, sock_fd);
	EXPECT_EQ(-EACCES, sendto_variant(sock_fd, &self->srv0, "A", 1, 0));
	EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.connect_send_udp",
				      "daddr", variant->addr, "dest",
				      self->srv0.port));

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(1, records.domain);

	/* Check that autobind generates a denied bind event. */
	EXPECT_EQ(-EACCES, sendto_variant(sock_fd, &self->srv1, "A", 1, 0));
	EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.bind_udp", NULL,
				      NULL, NULL, 0));
	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(0, records.domain);

	EXPECT_EQ(-EACCES,
		  sendto_variant(sock_fd, &self->unspec_srv0, "B", 1, 0));
	EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.connect_send_udp",
				      "daddr", NULL, "dest", 0));
	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
	EXPECT_EQ(0, records.access);
	EXPECT_EQ(0, records.domain);

	EXPECT_EQ(0, close(sock_fd));
}

/* Trace tests */

/* clang-format off */
FIXTURE(trace_net) {
	/* clang-format on */
	int tracefs_ok;
};

FIXTURE_SETUP(trace_net)
{
	int ret;

	/* Isolate the network namespace so the bound port cannot collide. */
	setup_loopback(_metadata);

	set_cap(_metadata, CAP_SYS_ADMIN);
	ASSERT_EQ(0, unshare(CLONE_NEWNS));
	ASSERT_EQ(0, mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL));

	ret = tracefs_fixture_setup();
	if (ret) {
		clear_cap(_metadata, CAP_SYS_ADMIN);
		self->tracefs_ok = 0;
		SKIP(return, "tracefs not available");
	}
	self->tracefs_ok = 1;

	ASSERT_EQ(0,
		  tracefs_enable_event(TRACEFS_DENY_ACCESS_NET_ENABLE, true));
	ASSERT_EQ(0, tracefs_clear());
	clear_cap(_metadata, CAP_SYS_ADMIN);
}

FIXTURE_TEARDOWN(trace_net)
{
	if (!self->tracefs_ok)
		return;

	set_cap(_metadata, CAP_SYS_ADMIN);
	tracefs_enable_event(TRACEFS_DENY_ACCESS_NET_ENABLE, false);
	tracefs_fixture_teardown();
	clear_cap(_metadata, CAP_SYS_ADMIN);
}

/*
 * Baseline: verifies that without Landlock, the bind succeeds and no
 * deny_access_net trace event fires.
 */
/* clang-format off */
FIXTURE_VARIANT(trace_net)
{
	/* clang-format on */
	bool sandbox;
	int bind_port_offset; /* 0 = allowed port, 1 = denied port */
	int expect_denied;
};

/* Unsandboxed: no Landlock, bind should succeed with no events. */
/* clang-format off */
FIXTURE_VARIANT_ADD(trace_net, unsandboxed) {
	/* clang-format on */
	.sandbox = false,
	.bind_port_offset = 0,
	.expect_denied = 0,
};

/* Denied: sandboxed, bind to port not in ruleset. */
/* clang-format off */
FIXTURE_VARIANT_ADD(trace_net, bind_denied) {
	/* clang-format on */
	.sandbox = true,
	.bind_port_offset = 1,
	.expect_denied = 1,
};

/* Allowed: sandboxed, bind to port in ruleset. */
/* clang-format off */
FIXTURE_VARIANT_ADD(trace_net, bind_allowed) {
	/* clang-format on */
	.sandbox = true,
	.bind_port_offset = 0,
	.expect_denied = 0,
};

TEST_F(trace_net, deny_access_net_bind)
{
	char *buf;
	int count, status;
	pid_t child;

	if (!self->tracefs_ok)
		SKIP(return, "tracefs not available");

	ASSERT_EQ(0, tracefs_clear_buf());

	child = fork();
	ASSERT_LE(0, child);

	if (child == 0) {
		struct sockaddr_in addr = {
			.sin_family = AF_INET,
			.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
		};
		int sock_fd;

		if (variant->sandbox) {
			struct landlock_ruleset_attr ruleset_attr = {
				.handled_access_net =
					LANDLOCK_ACCESS_NET_BIND_TCP,
			};
			struct landlock_net_port_attr port_attr = {
				.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
				.port = sock_port_start,
			};
			int ruleset_fd;

			ruleset_fd = landlock_create_ruleset(
				&ruleset_attr, sizeof(ruleset_attr), 0);
			if (ruleset_fd < 0)
				_exit(1);

			if (landlock_add_rule(ruleset_fd,
					      LANDLOCK_RULE_NET_PORT,
					      &port_attr, 0)) {
				close(ruleset_fd);
				_exit(1);
			}

			prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
			if (landlock_restrict_self(ruleset_fd, 0)) {
				close(ruleset_fd);
				_exit(1);
			}
			close(ruleset_fd);
		}

		sock_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
		if (sock_fd < 0)
			_exit(1);

		addr.sin_port =
			htons(sock_port_start + variant->bind_port_offset);
		if (variant->expect_denied) {
			/* Bind should be denied. */
			if (bind(sock_fd, (struct sockaddr *)&addr,
				 sizeof(addr)) == 0) {
				close(sock_fd);
				_exit(2);
			}
			if (errno != EACCES) {
				close(sock_fd);
				_exit(3);
			}
		} else {
			/* Bind should succeed. */
			if (bind(sock_fd, (struct sockaddr *)&addr,
				 sizeof(addr))) {
				close(sock_fd);
				_exit(2);
			}
		}
		close(sock_fd);
		_exit(0);
	}

	ASSERT_EQ(child, waitpid(child, &status, 0));
	ASSERT_TRUE(WIFEXITED(status));
	EXPECT_EQ(0, WEXITSTATUS(status));

	buf = tracefs_read_buf();
	ASSERT_NE(NULL, buf);

	count = tracefs_count_matches(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK));
	if (variant->expect_denied) {
		EXPECT_EQ(variant->expect_denied, count)
		{
			TH_LOG("Expected deny_access_net event, got %d\n%s",
			       count, buf);
		}
	} else {
		EXPECT_EQ(0, count)
		{
			TH_LOG("Expected 0 deny_access_net events, "
			       "got %d\n%s",
			       count, buf);
		}
	}

	free(buf);
}

/*
 * Anchors the denial fields shared by every deny_access_net event so a field
 * test proves more than sport/dport: the denying domain, the same-exec bit, the
 * audit-logging verdict, and the blocked access all stay populated.
 */
static void
expect_net_deny_common_fields(struct __test_metadata *const _metadata,
			      const char *const buf)
{
	char field[64];

	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
					"domain", field, sizeof(field)));
	EXPECT_STRNE("0", field);

	/* Same exec that restricted itself, no exec in between. */
	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
					"same_exec", field, sizeof(field)));
	EXPECT_STREQ("1", field);

	/* Default flags, same exec: audit would log this denial. */
	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
					"logged", field, sizeof(field)));
	EXPECT_STREQ("1", field);

	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
					"blockers", field, sizeof(field)));
	EXPECT_STRNE("", field);
}

/* Connect and field-check tests use a separate fixture without variants. */

/* clang-format off */
FIXTURE(trace_net_connect) {
	/* clang-format on */
	int tracefs_ok;
};

FIXTURE_SETUP(trace_net_connect)
{
	int ret;

	/* Isolate the network namespace so the bound port cannot collide. */
	setup_loopback(_metadata);

	set_cap(_metadata, CAP_SYS_ADMIN);
	ASSERT_EQ(0, unshare(CLONE_NEWNS));
	ASSERT_EQ(0, mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL));

	ret = tracefs_fixture_setup();
	if (ret) {
		clear_cap(_metadata, CAP_SYS_ADMIN);
		self->tracefs_ok = 0;
		SKIP(return, "tracefs not available");
	}
	self->tracefs_ok = 1;

	ASSERT_EQ(0,
		  tracefs_enable_event(TRACEFS_DENY_ACCESS_NET_ENABLE, true));
	ASSERT_EQ(0, tracefs_clear());
	clear_cap(_metadata, CAP_SYS_ADMIN);
}

FIXTURE_TEARDOWN(trace_net_connect)
{
	if (!self->tracefs_ok)
		return;

	set_cap(_metadata, CAP_SYS_ADMIN);
	tracefs_enable_event(TRACEFS_DENY_ACCESS_NET_ENABLE, false);
	tracefs_fixture_teardown();
	clear_cap(_metadata, CAP_SYS_ADMIN);
}

/* clang-format off */
FIXTURE_VARIANT(trace_net_connect) {
	/* clang-format on */
	/* handled_access_net, also the access allowed on the base port. */
	__u64 handled;
	/* Bind the allowed base port before the denied operation. */
	bool bind_base_first;
	/* Denied operation on the next port: connect (true) or bind (false). */
	bool deny_connect;
};

/* clang-format off */

/* Denied connect(): sport=0, dport=<denied port>. */
FIXTURE_VARIANT_ADD(trace_net_connect, connect_denied) {
	.handled = LANDLOCK_ACCESS_NET_CONNECT_TCP,
	.bind_base_first = false,
	.deny_connect = true,
};

/* Denied bind(): sport=<denied port>, dport=0. */
FIXTURE_VARIANT_ADD(trace_net_connect, bind_fields) {
	.handled = LANDLOCK_ACCESS_NET_BIND_TCP,
	.bind_base_first = false,
	.deny_connect = false,
};

/* Denied connect() after an allowed bind(): the connect fields (sport=0). */
FIXTURE_VARIANT_ADD(trace_net_connect, connect_after_bind) {
	.handled = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP,
	.bind_base_first = true,
	.deny_connect = true,
};

/* clang-format on */

/*
 * A denied TCP bind(2) or connect(2) emits one deny_access_net event.  The port
 * is reported in the field matching the denied operation, in host endianness
 * (the UAPI landlock_net_port_attr.port convention): a connect denial reports
 * sport=0 dport=<port>, a bind denial reports sport=<port> dport=0, so a
 * byte-order or field-swap bug is caught.  A prior allowed bind
 * (connect_after_bind) does not change the connect denial's fields.
 */
TEST_F(trace_net_connect, deny_access_net)
{
	pid_t child;
	int status;
	char *buf;
	char field[64], expected[16];

	if (!self->tracefs_ok)
		SKIP(return, "tracefs not available");

	child = fork();
	ASSERT_LE(0, child);

	if (child == 0) {
		struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = variant->handled,
		};
		struct landlock_net_port_attr port_attr = {
			.allowed_access = variant->handled,
			.port = sock_port_start,
		};
		struct sockaddr_in addr = {
			.sin_family = AF_INET,
			.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
		};
		int ruleset_fd, sock_fd, optval = 1, ret;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		if (ruleset_fd < 0)
			_exit(1);
		if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				      &port_attr, 0)) {
			close(ruleset_fd);
			_exit(1);
		}
		prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
		if (landlock_restrict_self(ruleset_fd, 0)) {
			close(ruleset_fd);
			_exit(1);
		}
		close(ruleset_fd);

		sock_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
		if (sock_fd < 0)
			_exit(1);

		/* Bind the allowed base port first (succeeds, no event). */
		if (variant->bind_base_first) {
			setsockopt(sock_fd, SOL_SOCKET, SO_REUSEADDR, &optval,
				   sizeof(optval));
			addr.sin_port = htons(sock_port_start);
			if (bind(sock_fd, (struct sockaddr *)&addr,
				 sizeof(addr))) {
				close(sock_fd);
				_exit(1);
			}
		}

		/* Denied operation on the next port. */
		addr.sin_port = htons(sock_port_start + 1);
		if (variant->deny_connect)
			ret = connect(sock_fd, (struct sockaddr *)&addr,
				      sizeof(addr));
		else
			ret = bind(sock_fd, (struct sockaddr *)&addr,
				   sizeof(addr));
		if (ret == 0) {
			close(sock_fd);
			_exit(2);
		}
		if (errno != EACCES) {
			close(sock_fd);
			_exit(3);
		}
		close(sock_fd);
		_exit(0);
	}

	ASSERT_EQ(child, waitpid(child, &status, 0));
	ASSERT_TRUE(WIFEXITED(status));
	EXPECT_EQ(0, WEXITSTATUS(status));

	buf = tracefs_read_buf();
	ASSERT_NE(NULL, buf);

	EXPECT_EQ(1, tracefs_count_matches(buf,
					   REGEX_DENY_ACCESS_NET(TRACE_TASK)));

	expect_net_deny_common_fields(_metadata, buf);

	/*
	 * The denied operation's port field carries the port; the other is 0.
	 */
	snprintf(expected, sizeof(expected), "%llu",
		 (unsigned long long)(sock_port_start + 1));

	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
					"sport", field, sizeof(field)));
	EXPECT_STREQ(variant->deny_connect ? "0" : expected, field);

	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
					"dport", field, sizeof(field)));
	EXPECT_STREQ(variant->deny_connect ? expected : "0", field);

	free(buf);
}

/* Field verification for the check_rule_net event on an allowed access. */

/* clang-format off */
FIXTURE(trace_net_check_rule) {
	/* clang-format on */
	int tracefs_ok;
};

FIXTURE_SETUP(trace_net_check_rule)
{
	int ret;

	/* Isolate the network namespace so the bound port cannot collide. */
	setup_loopback(_metadata);

	set_cap(_metadata, CAP_SYS_ADMIN);
	ASSERT_EQ(0, unshare(CLONE_NEWNS));
	ASSERT_EQ(0, mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL));

	ret = tracefs_fixture_setup();
	if (ret) {
		clear_cap(_metadata, CAP_SYS_ADMIN);
		self->tracefs_ok = 0;
		SKIP(return, "tracefs not available");
	}
	self->tracefs_ok = 1;

	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, true));
	ASSERT_EQ(0, tracefs_clear());
	clear_cap(_metadata, CAP_SYS_ADMIN);
}

FIXTURE_TEARDOWN(trace_net_check_rule)
{
	if (!self->tracefs_ok)
		return;

	set_cap(_metadata, CAP_SYS_ADMIN);
	tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, false);
	tracefs_fixture_teardown();
	clear_cap(_metadata, CAP_SYS_ADMIN);
}

/*
 * Verifies that an allowed bind matching a net-port rule emits exactly one
 * landlock_check_rule_net event with the enforcing domain, the requested
 * access, the checked port (host endianness), and the per-layer grants.  The
 * whole event is anchored to exact values so a revert of the check_rule_net
 * emit (or a byte-order or field-plumbing regression) fails the test.
 */
TEST_F(trace_net_check_rule, check_rule_net_fields)
{
	pid_t child;
	int status;
	char *buf;
	char field[64], expected[16];

	if (!self->tracefs_ok)
		SKIP(return, "tracefs not available");

	child = fork();
	ASSERT_LE(0, child);

	if (child == 0) {
		struct landlock_ruleset_attr ruleset_attr = {
			.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
		};
		struct landlock_net_port_attr port_attr = {
			.allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
			.port = sock_port_start,
		};
		struct sockaddr_in addr = {
			.sin_family = AF_INET,
			.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
		};
		int ruleset_fd, sock_fd;

		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
						     sizeof(ruleset_attr), 0);
		if (ruleset_fd < 0)
			_exit(1);

		if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
				      &port_attr, 0)) {
			close(ruleset_fd);
			_exit(1);
		}

		prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
		if (landlock_restrict_self(ruleset_fd, 0)) {
			close(ruleset_fd);
			_exit(1);
		}
		close(ruleset_fd);

		/* Bind to the allowed port: succeeds and matches the rule. */
		sock_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
		if (sock_fd < 0)
			_exit(1);

		addr.sin_port = htons(sock_port_start);
		if (bind(sock_fd, (struct sockaddr *)&addr, sizeof(addr))) {
			close(sock_fd);
			_exit(2);
		}
		close(sock_fd);
		_exit(0);
	}

	ASSERT_EQ(child, waitpid(child, &status, 0));
	ASSERT_TRUE(WIFEXITED(status));
	EXPECT_EQ(0, WEXITSTATUS(status));

	buf = tracefs_read_buf();
	ASSERT_NE(NULL, buf);

	/* A single-layer domain matching one port rule emits one event. */
	EXPECT_EQ(1,
		  tracefs_count_matches(buf, REGEX_CHECK_RULE_NET(TRACE_TASK)))
	{
		TH_LOG("Expected 1 check_rule_net event\n%s", buf);
	}

	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_CHECK_RULE_NET(TRACE_TASK),
					"domain", field, sizeof(field)));
	EXPECT_STRNE("0", field);

	ASSERT_EQ(0, tracefs_extract_field(
			     buf, REGEX_CHECK_RULE_NET(TRACE_TASK),
			     "access_request", field, sizeof(field)));
	EXPECT_STREQ("bind_tcp", field);

	/*
	 * The port is reported in host endianness (UAPI convention), so on
	 * little-endian htons(sock_port_start) would print a different value:
	 * the exact match also catches byte-order regressions.
	 */
	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_CHECK_RULE_NET(TRACE_TASK),
					"port", field, sizeof(field)));
	snprintf(expected, sizeof(expected), "%llu",
		 (unsigned long long)sock_port_start);
	EXPECT_STREQ(expected, field);

	/* One layer that fully grants the request: grants={bind_tcp}. */
	ASSERT_EQ(0,
		  tracefs_extract_field(buf, REGEX_CHECK_RULE_NET(TRACE_TASK),
					"grants", field, sizeof(field)));
	EXPECT_STREQ("{bind_tcp}", field);

	free(buf);
}

/*
 * IPv6 network trace tests are intentionally elided.  IPv6 hook dispatch uses
 * the same current_check_access_socket() code path as IPv4, validated by the
 * audit tests in this file.  The trace events use the same blockers/sport/dport
 * fields regardless of address family.
 */

TEST_HARNESS_MAIN