Use nix crate instead of interacting with libc directly, drop privileges

This commit is contained in:
B. Blechschmidt 2023-04-01 02:19:20 +02:00
parent 3dc7fde5e9
commit 15703a4823
6 changed files with 232 additions and 127 deletions

View file

@ -64,28 +64,29 @@ mod tests {
continue;
}
let mut setup = Setup::new(
TUN_TEST_DEVICE,
&test.proxy.addr.ip(),
get_default_cidrs(),
false,
);
setup.configure().unwrap();
match fork::fork() {
Ok(Fork::Parent(child)) => {
test_function();
signal::kill(Pid::from_raw(child), signal::SIGINT)
.expect("failed to kill child");
nix::sys::wait::waitpid(Pid::from_raw(child), None)
.expect("failed to wait for child");
setup.restore().unwrap();
}
Ok(Fork::Child) => {
prctl::set_death_signal(signal::SIGKILL as isize).unwrap(); // 9 == SIGKILL
let _setup = Setup::new(
TUN_TEST_DEVICE,
&test.proxy.addr.ip(),
get_default_cidrs(),
false,
);
prctl::set_death_signal(signal::SIGINT as isize).unwrap();
let _ = main_entry(
TUN_TEST_DEVICE,
test.proxy,
&test.proxy,
Options::new().with_virtual_dns(),
);
std::process::exit(0);
}
Err(_) => panic!(),
}