Convert {enable,disable}Firewall to iptables-restore
Bug: 28362720
Test: netd_{unit,integration}_test pass
Change-Id: I7c3ddf0812f40124ac83f36d3fd3a8c595ce5472
diff --git a/server/FirewallControllerTest.cpp b/server/FirewallControllerTest.cpp
index 65576a7..db9b31e 100644
--- a/server/FirewallControllerTest.cpp
+++ b/server/FirewallControllerTest.cpp
@@ -27,6 +27,7 @@
#include "FirewallController.h"
#include "IptablesBaseTest.h"
+using android::base::Join;
class FirewallControllerTest : public IptablesBaseTest {
protected:
@@ -216,28 +217,32 @@
TEST_F(FirewallControllerTest, TestEnableDisableFirewall) {
std::vector<std::string> enableCommands = {
- "-A fw_INPUT -j DROP",
- "-A fw_OUTPUT -j REJECT",
- "-A fw_FORWARD -j REJECT",
+ "*filter\n"
+ "-A fw_INPUT -j DROP\n"
+ "-A fw_OUTPUT -j REJECT\n"
+ "-A fw_FORWARD -j REJECT\n"
+ "COMMIT\n"
};
std::vector<std::string> disableCommands = {
- "-F fw_INPUT",
- "-F fw_OUTPUT",
- "-F fw_FORWARD",
+ "*filter\n"
+ ":fw_INPUT -\n"
+ ":fw_OUTPUT -\n"
+ ":fw_FORWARD -\n"
+ "COMMIT\n"
};
std::vector<std::string> noCommands = {};
EXPECT_EQ(0, mFw.disableFirewall());
- expectIptablesCommands(disableCommands);
+ expectIptablesRestoreCommands(disableCommands);
EXPECT_EQ(0, mFw.disableFirewall());
- expectIptablesCommands(disableCommands);
+ expectIptablesRestoreCommands(disableCommands);
EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST));
- expectIptablesCommands(disableCommands);
+ expectIptablesRestoreCommands(disableCommands);
EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST));
- expectIptablesCommands(noCommands);
+ expectIptablesRestoreCommands(noCommands);
std::vector<std::string> disableEnableCommands;
disableEnableCommands.insert(
@@ -246,16 +251,16 @@
disableEnableCommands.end(), enableCommands.begin(), enableCommands.end());
EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
- expectIptablesCommands(disableEnableCommands);
+ expectIptablesRestoreCommands(disableEnableCommands);
EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
- expectIptablesCommands(noCommands);
+ expectIptablesRestoreCommands(noCommands);
EXPECT_EQ(0, mFw.disableFirewall());
- expectIptablesCommands(disableCommands);
+ expectIptablesRestoreCommands(disableCommands);
// TODO: calling disableFirewall and then enableFirewall(WHITELIST) does
// nothing. This seems like a clear bug.
EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
- expectIptablesCommands(noCommands);
+ expectIptablesRestoreCommands(noCommands);
}