Split network_proxy example to 2 examples: with automatic handler, and without.

Created documentation for network proxy. fixed 2 things in documentation (namespaces are enabled by default for a while).

PiperOrigin-RevId: 300321016
Change-Id: Id9c54b29551e8d3b70e814e2fdbfee594126aa90

sandboxed_api/sandbox2/examples/network_proxy/BUILD.bazel

@@ -45,6 +45,10 @@ cc_binary(
         "//sandboxed_api/sandbox2:comms",
         "//sandboxed_api/sandbox2/network_proxy:client",
         "//sandboxed_api/sandbox2/util:fileops",
+        "//sandboxed_api/sandbox2/util:strerror",
+        "//sandboxed_api/util:flags",
+        "//sandboxed_api/util:status",
+        "//sandboxed_api/util:statusor",
         "@com_google_absl//absl/strings:str_format",
     ],
 )

sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt

@@ -31,12 +31,13 @@ target_link_libraries(sandbox2_networkproxy_sandbox PRIVATE
   sapi::flags
 )
 
-# sandboxed_api/sandbox2/examples/networkproxy_bin:networkproxy_bin
+
-add_executable(networkproxy_bin
+# sandboxed_api/sandbox2/examples/networkproxy:networkproxy_bin
+add_executable(sandbox2_networkproxy_bin
   networkproxy_bin.cc
 )
-add_executable(sandbox2::networkproxy_bin ALIAS networkproxy_bin)
+add_executable(sandbox2::networkproxy_bin ALIAS sandbox2_networkproxy_bin)
-target_link_libraries(networkproxy_bin PRIVATE
+target_link_libraries(sandbox2_networkproxy_bin PRIVATE
   absl::str_format
   glog::glog
   gflags::gflags
@@ -45,4 +46,8 @@ target_link_libraries(networkproxy_bin PRIVATE
   sandbox2::fileops
   sandbox2::network_proxy_client
   sapi::base
+  sapi::flags
+  sapi::status
+  sapi::statusor
 )
+

sandboxed_api/sandbox2/examples/network_proxy/networkproxy_bin.cc

@@ -11,13 +11,24 @@
 
 #include <cstring>
 
+#include "sandboxed_api/util/flag.h"
 #include "absl/strings/str_format.h"
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/network_proxy/client.h"
 #include "sandboxed_api/sandbox2/util/fileops.h"
+#include "sandboxed_api/sandbox2/util/strerror.h"
+#include "sandboxed_api/util/status.h"
+#include "sandboxed_api/util/status_macros.h"
+#include "sandboxed_api/util/statusor.h"
 
-static ssize_t ReadFromFd(int fd, uint8_t* buf, size_t size) {
+ABSL_FLAG(bool, connect_with_handler, true, "Connect using automatic mode.");
+
+namespace {
+
+sandbox2::NetworkProxyClient* proxy_client;
+
+ssize_t ReadFromFd(int fd, uint8_t* buf, size_t size) {
   ssize_t received = 0;
   while (received < size) {
     ssize_t read_status =
@@ -33,58 +44,72 @@ static ssize_t ReadFromFd(int fd, uint8_t* buf, size_t size) {
   return received;
 }
 
-static bool CommunicationTest(int sock) {
+absl::Status CommunicationTest(int sock) {
   char received[1025] = {0};
 
   if (ReadFromFd(sock, reinterpret_cast<uint8_t*>(received),
                  sizeof(received) - 1) <= 0) {
-    LOG(ERROR) << "Data receiving error";
+    return absl::InternalError("Data receiving error");
-    return false;
   }
   absl::PrintF("Sandboxee received data from the server:\n\n%s\n", received);
   if (strcmp(received, "Hello World\n")) {
-    LOG(ERROR) << "Data receiving error";
+    return absl::InternalError("Data receiving error");
-    return false;
+  }
+  return absl::OkStatus();
 }
 
-  return true;
+sapi::StatusOr<struct sockaddr_in6> CreateAddres(int port) {
-}
+  static struct sockaddr_in6 saddr {};
-
-static int ConnectToServer(int port) {
-  int s = socket(AF_INET6, SOCK_STREAM, 0);
-  if (s < 0) {
-    PLOG(ERROR) << "socket() failed";
-    return -1;
-  }
-
-  struct sockaddr_in6 saddr {};
   saddr.sin6_family = AF_INET6;
   saddr.sin6_port = htons(port);
 
   int err = inet_pton(AF_INET6, "::1", &saddr.sin6_addr);
-  if (err == 0) {
+  if (err <= 0) {
-    LOG(ERROR) << "inet_pton() failed";
+    return absl::InternalError(
-    close(s);
+        absl::StrCat("socket() failed: ", sandbox2::StrError(errno)));
-    return -1;
+  }
-  } else if (err == -1) {
+  return saddr;
-    PLOG(ERROR) << "inet_pton() failed";
-    close(s);
-    return -1;
 }
 
-  err = connect(s, reinterpret_cast<const struct sockaddr*>(&saddr),
+absl::Status ConnectManually(int s, const struct sockaddr_in6& saddr) {
+  return proxy_client->Connect(
+      s, reinterpret_cast<const struct sockaddr*>(&saddr), sizeof(saddr));
+}
+
+absl::Status ConnectWithHandler(int s, const struct sockaddr_in6& saddr) {
+  int err = connect(s, reinterpret_cast<const struct sockaddr*>(&saddr),
                     sizeof(saddr));
   if (err != 0) {
-    LOG(ERROR) << "connect() failed";
+    return absl::InternalError("connect() failed");
-    close(s);
+  }
-    return -1;
+
+  return absl::OkStatus();
+}
+
+sapi::StatusOr<int> ConnectToServer(int port) {
+  SAPI_ASSIGN_OR_RETURN(struct sockaddr_in6 saddr, CreateAddres(port));
+
+  sandbox2::file_util::fileops::FDCloser s(socket(AF_INET6, SOCK_STREAM, 0));
+  if (s.get() < 0) {
+    return absl::InternalError(
+        absl::StrCat("socket() failed: ", sandbox2::StrError(errno)));
+  }
+
+  if (absl::GetFlag(FLAGS_connect_with_handler)) {
+    SAPI_RETURN_IF_ERROR(ConnectWithHandler(s.get(), saddr));
+  } else {
+    SAPI_RETURN_IF_ERROR(ConnectManually(s.get(), saddr));
   }
 
   LOG(INFO) << "Connected to the server";
-  return s;
+  return s.Release();
 }
 
+}  // namespace
+
 int main(int argc, char** argv) {
+  gflags::ParseCommandLineFlags(&argc, &argv, false);
+
   // Set-up the sandbox2::Client object, using a file descriptor (1023).
   sandbox2::Comms comms(sandbox2::Comms::kSandbox2ClientCommsFD);
   sandbox2::Client sandbox2_client(&comms);
@@ -92,11 +117,15 @@ int main(int argc, char** argv) {
   // Enable sandboxing from here.
   sandbox2_client.SandboxMeHere();
 
+  if (absl::GetFlag(FLAGS_connect_with_handler)) {
     absl::Status status = sandbox2_client.InstallNetworkProxyHandler();
     if (!status.ok()) {
       LOG(ERROR) << "InstallNetworkProxyHandler() failed: " << status.message();
       return 1;
     }
+  } else {
+    proxy_client = sandbox2_client.GetNetworkProxyClient();
+  }
 
   // Receive port number of the server
   int port;
@@ -105,12 +134,16 @@ int main(int argc, char** argv) {
     return 2;
   }
 
-  sandbox2::file_util::fileops::FDCloser client{ConnectToServer(port)};
+  sapi::StatusOr<int> sock_s = ConnectToServer(port);
-  if (client.get() == -1) {
+  if (!sock_s.ok()) {
+    LOG(ERROR) << sock_s.status().message();
     return 3;
   }
+  sandbox2::file_util::fileops::FDCloser client{sock_s.ValueOrDie()};
 
-  if (!CommunicationTest(client.get())) {
+  absl::Status status = CommunicationTest(client.get());
+  if (!status.ok()) {
+    LOG(ERROR) << sock_s.status().message();
     return 4;
   }
 

sandboxed_api/sandbox2/examples/network_proxy/networkproxy_sandbox.cc

@@ -27,11 +27,16 @@
 #include "sandboxed_api/sandbox2/util/fileops.h"
 #include "sandboxed_api/sandbox2/util/runfiles.h"
 
+ABSL_FLAG(bool, connect_with_handler, true, "Connect using automatic mode.");
+
 namespace {
 
+constexpr char kSandboxeePath[] =
+    "sandbox2/examples/network_proxy/networkproxy_bin";
+
 std::unique_ptr<sandbox2::Policy> GetPolicy(absl::string_view sandboxee_path) {
-  return sandbox2::PolicyBuilder()
+  sandbox2::PolicyBuilder policy;
-      .AllowExit()
+  policy.AllowExit()
       .AllowMmap()
       .AllowRead()
       .AllowWrite()
@@ -41,11 +46,14 @@ std::unique_ptr<sandbox2::Policy> GetPolicy(absl::string_view sandboxee_path) {
       .AllowSyscall(__NR_lseek)
       .AllowSyscall(__NR_munmap)
       .AllowSyscall(__NR_getpid)
-      .AddNetworkProxyHandlerPolicy()
       .AllowTcMalloc()
-      .AllowIPv6("::1")
+      .AddLibrariesForBinary(sandboxee_path);
-      .AddLibrariesForBinary(sandboxee_path)
+  if (absl::GetFlag(FLAGS_connect_with_handler)) {
-      .BuildOrDie();
+    policy.AddNetworkProxyHandlerPolicy();
+  } else {
+    policy.AddNetworkProxyPolicy();
+  }
+  return policy.AllowIPv6("::1").BuildOrDie();
 }
 
 void Server(int port) {
@@ -119,9 +127,12 @@ int main(int argc, char** argv) {
   std::thread server_thread{Server,port};
   server_thread.detach();
 
-  std::string path = sandbox2::GetInternalDataDependencyFilePath(
+  std::string path =
-      "sandbox2/examples/network_proxy/networkproxy_bin");
+      sandbox2::GetInternalDataDependencyFilePath(kSandboxeePath);
   std::vector<std::string> args = {path};
+  if (!absl::GetFlag(FLAGS_connect_with_handler)) {
+    args.push_back("--noconnect_with_handler");
+  }
   std::vector<std::string> envs = {};
 
   auto executor = absl::make_unique<sandbox2::Executor>(path, args, envs);