commit cc1bb82f2e4edc987579655dc1babab5e721a126
author Lorenzo Colitti <lorenzo@google.com> Sun Jul 16 21:08:54 2017 +0900
committer Lorenzo Colitti <lorenzo@google.com> Mon Jul 17 00:58:01 2017 +0900
tree ecb2359fc2b99a34cde72ffcbe22d714cda4a5e7
parent 5935238a27ac4f7df2ec40b6ad30d86d3f2c326c

Add a unit test for FirewallController::{enable,disable}Firewall

Bug: 28362720
Test: new unit test passes
Change-Id: If15a46e98318d8f10acd860f00547048027c7d0a

server/FirewallControllerTest.cpp

diff --git a/server/FirewallControllerTest.cpp b/server/FirewallControllerTest.cpp
index 7f6f0ae..65576a7 100644
--- a/server/FirewallControllerTest.cpp
+++ b/server/FirewallControllerTest.cpp
@@ -213,3 +213,49 @@
     EXPECT_EQ(0, mFw.enableChildChains(POWERSAVE, false));
     expectIptablesRestoreCommands(expected);
 }
+
+TEST_F(FirewallControllerTest, TestEnableDisableFirewall) {
+    std::vector<std::string> enableCommands = {
+        "-A fw_INPUT -j DROP",
+        "-A fw_OUTPUT -j REJECT",
+        "-A fw_FORWARD -j REJECT",
+    };
+    std::vector<std::string> disableCommands = {
+        "-F fw_INPUT",
+        "-F fw_OUTPUT",
+        "-F fw_FORWARD",
+    };
+    std::vector<std::string> noCommands = {};
+
+    EXPECT_EQ(0, mFw.disableFirewall());
+    expectIptablesCommands(disableCommands);
+
+    EXPECT_EQ(0, mFw.disableFirewall());
+    expectIptablesCommands(disableCommands);
+
+    EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST));
+    expectIptablesCommands(disableCommands);
+
+    EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST));
+    expectIptablesCommands(noCommands);
+
+    std::vector<std::string> disableEnableCommands;
+    disableEnableCommands.insert(
+            disableEnableCommands.end(), disableCommands.begin(), disableCommands.end());
+    disableEnableCommands.insert(
+            disableEnableCommands.end(), enableCommands.begin(), enableCommands.end());
+
+    EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
+    expectIptablesCommands(disableEnableCommands);
+
+    EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
+    expectIptablesCommands(noCommands);
+
+    EXPECT_EQ(0, mFw.disableFirewall());
+    expectIptablesCommands(disableCommands);
+
+    // TODO: calling disableFirewall and then enableFirewall(WHITELIST) does
+    // nothing. This seems like a clear bug.
+    EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
+    expectIptablesCommands(noCommands);
+}