After commit c018f5fd29 Fenrir is being switched over to go. If you do not want to be part of the testing process, please switch to master.

internal/control/handoff_test.go

@@ -0,0 +1,87 @@
+// Copyright (c) 2026 Storm Dragon
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package control
+
+import (
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func socket_pair(t *testing.T, path string) (*net.UnixConn, *net.UnixConn) {
+	t.Helper()
+	listener, err := net.ListenUnix("unix", &net.UnixAddr{Name: path, Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { listener.Close() })
+	client := connect_remote(t, path)
+	server, err := listener.AcceptUnix()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { server.Close() })
+	return client, server
+}
+
+func TestHandoffReadsOriginalCallerBytesAndRejectsInvalidDescriptors(t *testing.T) {
+	options := private_options(t)
+	caller, original := socket_pair(t, filepath.Join(options.Directory, "caller.sock"))
+	if _, err := io.WriteString(caller, "COMMAND SAY original\n"); err != nil {
+		t.Fatal(err)
+	}
+	file, err := original.File()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	ordinary, err := os.CreateTemp(options.Directory, "ordinary-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ordinary.Close()
+	for _, trial := range []struct {
+		name, header string
+		fds          []int
+		valid        bool
+	}{
+		{"original", handoffMarker + "COMMAND SAY substituted\n", []int{int(file.Fd())}, true},
+		{"file", handoffMarker, []int{int(ordinary.Fd())}, false},
+		{"multiple", handoffMarker, []int{int(file.Fd()), int(file.Fd())}, false},
+		{"header", "INVALID\n", []int{int(file.Fd())}, false},
+	} {
+		t.Run(trial.name, func(t *testing.T) {
+			sender, receiver := socket_pair(t, filepath.Join(options.Directory, trial.name+".sock"))
+			if _, _, err := sender.WriteMsgUnix([]byte(trial.header), syscall.UnixRights(trial.fds...), nil); err != nil {
+				t.Fatal(err)
+			}
+			_ = sender.CloseWrite()
+			_, forwarded, err := receive_request(receiver)
+			if !trial.valid {
+				if forwarded != nil {
+					forwarded.Close()
+				}
+				if err == nil {
+					t.Fatal("accepted malformed handoff")
+				}
+				return
+			}
+			if err != nil || forwarded == nil {
+				t.Fatal("valid handoff rejected", err)
+			}
+			defer forwarded.Close()
+			pid, uid, err := peer(forwarded)
+			if err != nil || pid != os.Getpid() || uid != os.Geteuid() {
+				t.Fatal("caller credentials changed", pid, uid, err)
+			}
+			text, err := read_request(forwarded, nil)
+			if err != nil || text != "COMMAND SAY original" {
+				t.Fatal("handoff substituted caller bytes", text, err)
+			}
+		})
+	}
+}