<commit_before>package lifecycle_test

import (
	"fmt"
	"strings"

	"github.com/cloudfoundry-incubator/gordon"
	"github.com/cloudfoundry-incubator/gordon/warden"
	. "github.com/onsi/ginkgo"
	. "github.com/onsi/gomega"
)

var _ = Describe("Placing limits on containers", func() {
	Describe("denying access to network ranges", func() {
		var (
			blockedListenerHandle string
			blockedListenerIP     string

			unblockedListenerHandle string
			unblockedListenerIP     string

			allowedListenerHandle string
			allowedListenerIP     string

			senderHandle string
		)

		BeforeEach(func() {
			var err error

			// create a listener to which we deny network access
			res, err := client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			blockedListenerHandle = res.GetHandle()
			infoRes, err := client.Info(blockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
			blockedListenerIP = infoRes.GetContainerIp()

			// create a listener to which we do not deny access
			res, err = client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			unblockedListenerHandle = res.GetHandle()
			infoRes, err = client.Info(unblockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
			unblockedListenerIP = infoRes.GetContainerIp()

			// create a listener to which we exclicitly allow access
			res, err = client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			allowedListenerHandle = res.GetHandle()
			infoRes, err = client.Info(allowedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
			allowedListenerIP = infoRes.GetContainerIp()

			runner.Stop()
			runner.Start(
				"-denyNetworks", strings.Join([]string{
					blockedListenerIP + "/32",
					allowedListenerIP + "/32",
				}, ","),
				"-allowNetworks", allowedListenerIP+"/32",
			)

			// create a container with the new deny network configuration
			res, err = client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			senderHandle = res.GetHandle()
		})

		AfterEach(func() {
			_, err := client.Destroy(senderHandle)
			Expect(err).ToNot(HaveOccurred())

			_, err = client.Destroy(blockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())

			_, err = client.Destroy(unblockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())

			_, err = client.Destroy(allowedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
		})

		expectStreamToExitWith := func(stream <-chan *warden.ProcessPayload, status int) {
			for chunk := range stream {
				if chunk.ExitStatus != nil {
					Expect(chunk.GetExitStatus()).To(Equal(uint32(status)))
				}
			}
		}

		runWithHandle := func(handle, script string) <-chan *warden.ProcessPayload {
			_, stream, err := client.Run(handle, script, gordon.ResourceLimits{})
			Expect(err).ToNot(HaveOccurred())
			return stream
		}

		It("makes that block of ip addresses inaccessible to the container", func() {
			runWithHandle(blockedListenerHandle, "nc -l 12345")<commit_msg>fix security test .Run usage<commit_after>package lifecycle_test

import (
	"fmt"
	"strings"

	"github.com/cloudfoundry-incubator/gordon"
	"github.com/cloudfoundry-incubator/gordon/warden"
	. "github.com/onsi/ginkgo"
	. "github.com/onsi/gomega"
)

var _ = Describe("Placing limits on containers", func() {
	Describe("denying access to network ranges", func() {
		var (
			blockedListenerHandle string
			blockedListenerIP     string

			unblockedListenerHandle string
			unblockedListenerIP     string

			allowedListenerHandle string
			allowedListenerIP     string

			senderHandle string
		)

		BeforeEach(func() {
			var err error

			// create a listener to which we deny network access
			res, err := client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			blockedListenerHandle = res.GetHandle()
			infoRes, err := client.Info(blockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
			blockedListenerIP = infoRes.GetContainerIp()

			// create a listener to which we do not deny access
			res, err = client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			unblockedListenerHandle = res.GetHandle()
			infoRes, err = client.Info(unblockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
			unblockedListenerIP = infoRes.GetContainerIp()

			// create a listener to which we exclicitly allow access
			res, err = client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			allowedListenerHandle = res.GetHandle()
			infoRes, err = client.Info(allowedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
			allowedListenerIP = infoRes.GetContainerIp()

			runner.Stop()
			runner.Start(
				"-denyNetworks", strings.Join([]string{
					blockedListenerIP + "/32",
					allowedListenerIP + "/32",
				}, ","),
				"-allowNetworks", allowedListenerIP+"/32",
			)

			// create a container with the new deny network configuration
			res, err = client.Create(nil)
			Expect(err).ToNot(HaveOccurred())
			senderHandle = res.GetHandle()
		})

		AfterEach(func() {
			_, err := client.Destroy(senderHandle)
			Expect(err).ToNot(HaveOccurred())

			_, err = client.Destroy(blockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())

			_, err = client.Destroy(unblockedListenerHandle)
			Expect(err).ToNot(HaveOccurred())

			_, err = client.Destroy(allowedListenerHandle)
			Expect(err).ToNot(HaveOccurred())
		})

		expectStreamToExitWith := func(stream <-chan *warden.ProcessPayload, status int) {
			for chunk := range stream {
				if chunk.ExitStatus != nil {
					Expect(chunk.GetExitStatus()).To(Equal(uint32(status)))
				}
			}
		}

		runWithHandle := func(handle, script string) <-chan *warden.ProcessPayload {
			_, stream, err := client.Run(handle, script, gordon.ResourceLimits{}, nil)
			Expect(err).ToNot(HaveOccurred())
			return stream
		}

		It("makes that block of ip addresses inaccessible to the container", func() {
			runWithHandle(blockedListenerHandle, "nc -l 12345")
{'fraction_non_alphanumeric': 0.12136929460580913, 'fraction_numerical': 0.004495159059474412, 'mean_word_length': 4.114942528735632, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4109192', 'n_tokens_mistral': 2132, 'n_tokens_neox': 1773, 'n_words': 374}