blob: b909833b0e06d48168e55db897fa8594356cb48c [file] [log] [blame]
Lorenzo Colitti89faa342016-02-26 11:38:47 +09001/*
2 * Copyright 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * FirewallControllerTest.cpp - unit tests for FirewallController.cpp
17 */
18
19#include <string>
20#include <vector>
21#include <stdio.h>
22
23#include <gtest/gtest.h>
24
25#include "FirewallController.h"
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090026#include "IptablesBaseTest.h"
Lorenzo Colitti89faa342016-02-26 11:38:47 +090027
28
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090029class FirewallControllerTest : public IptablesBaseTest {
Lorenzo Colitti89faa342016-02-26 11:38:47 +090030protected:
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090031 FirewallControllerTest() {
32 FirewallController::execIptables = fakeExecIptables;
33 FirewallController::execIptablesSilently = fakeExecIptables;
34 FirewallController::execIptablesRestore = fakeExecIptablesRestore;
35 }
Lorenzo Colitti89faa342016-02-26 11:38:47 +090036 FirewallController mFw;
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090037
Lorenzo Colitti89faa342016-02-26 11:38:47 +090038 std::string makeUidRules(const char *a, bool b, const std::vector<int32_t>& c) {
39 return mFw.makeUidRules(a, b, c);
40 }
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090041
42 int createChain(const char* a, const char*b , FirewallType c) {
43 return mFw.createChain(a, b, c);
44 }
Lorenzo Colitti89faa342016-02-26 11:38:47 +090045};
46
47
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090048TEST_F(FirewallControllerTest, TestCreateWhitelistChain) {
49 ExpectedIptablesCommands expected = {
50 { V4V6, "-t filter -D INPUT -j fw_whitelist" },
51 { V4V6, "-t filter -F fw_whitelist" },
52 { V4V6, "-t filter -X fw_whitelist" },
53 { V4V6, "-t filter -N fw_whitelist" },
54 { V4V6, "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN" },
55 { V6, "-A fw_whitelist -p icmpv6 --icmpv6-type packet-too-big -j RETURN" },
56 { V6, "-A fw_whitelist -p icmpv6 --icmpv6-type router-solicitation -j RETURN" },
57 { V6, "-A fw_whitelist -p icmpv6 --icmpv6-type router-advertisement -j RETURN" },
58 { V6, "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN" },
59 { V6, "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN" },
60 { V6, "-A fw_whitelist -p icmpv6 --icmpv6-type redirect -j RETURN" },
61 { V4V6, "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN" },
62 { V4V6, "-A fw_whitelist -j DROP" },
63 };
64 createChain("fw_whitelist", "INPUT", WHITELIST);
65 expectIptablesCommands(expected);
66}
67
68TEST_F(FirewallControllerTest, TestCreateBlacklistChain) {
69 ExpectedIptablesCommands expected = {
70 { V4V6, "-t filter -D INPUT -j fw_blacklist" },
71 { V4V6, "-t filter -F fw_blacklist" },
72 { V4V6, "-t filter -X fw_blacklist" },
73 { V4V6, "-t filter -N fw_blacklist" },
74 { V4V6, "-A fw_blacklist -p tcp --tcp-flags RST RST -j RETURN" },
75 };
76 createChain("fw_blacklist", "INPUT", BLACKLIST);
77 expectIptablesCommands(expected);
78}
79
80TEST_F(FirewallControllerTest, TestSetStandbyRule) {
81 ExpectedIptablesCommands expected = {
82 { V4V6, "-D fw_standby -m owner --uid-owner 12345 -j DROP" }
83 };
84 mFw.setUidRule(STANDBY, 12345, ALLOW);
85 expectIptablesCommands(expected);
86
87 expected = {
88 { V4V6, "-A fw_standby -m owner --uid-owner 12345 -j DROP" }
89 };
90 mFw.setUidRule(STANDBY, 12345, DENY);
91 expectIptablesCommands(expected);
92}
93
94TEST_F(FirewallControllerTest, TestSetDozeRule) {
95 ExpectedIptablesCommands expected = {
96 { V4V6, "-I fw_dozable -m owner --uid-owner 54321 -j RETURN" }
97 };
98 mFw.setUidRule(DOZABLE, 54321, ALLOW);
99 expectIptablesCommands(expected);
100
101 expected = {
102 { V4V6, "-D fw_dozable -m owner --uid-owner 54321 -j RETURN" }
103 };
104 mFw.setUidRule(DOZABLE, 54321, DENY);
105 expectIptablesCommands(expected);
106}
107
108TEST_F(FirewallControllerTest, TestReplaceWhitelistUidRule) {
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900109 std::string expected =
110 "*filter\n"
111 ":FW_whitechain -\n"
112 "-A FW_whitechain -m owner --uid-owner 0-9999 -j RETURN\n"
113 "-A FW_whitechain -m owner --uid-owner 10023 -j RETURN\n"
114 "-A FW_whitechain -m owner --uid-owner 10059 -j RETURN\n"
115 "-A FW_whitechain -m owner --uid-owner 10124 -j RETURN\n"
116 "-A FW_whitechain -m owner --uid-owner 10111 -j RETURN\n"
117 "-A FW_whitechain -m owner --uid-owner 110122 -j RETURN\n"
118 "-A FW_whitechain -m owner --uid-owner 210153 -j RETURN\n"
119 "-A FW_whitechain -m owner --uid-owner 210024 -j RETURN\n"
120 "-A FW_whitechain -j DROP\n"
121 "COMMIT\n\x04";
122
123 std::vector<int32_t> uids = { 10023, 10059, 10124, 10111, 110122, 210153, 210024 };
124 EXPECT_EQ(expected, makeUidRules("FW_whitechain", true, uids));
125}
126
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900127TEST_F(FirewallControllerTest, TestReplaceBlacklistUidRule) {
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900128 std::string expected =
129 "*filter\n"
130 ":FW_blackchain -\n"
131 "-A FW_blackchain -m owner --uid-owner 10023 -j DROP\n"
132 "-A FW_blackchain -m owner --uid-owner 10059 -j DROP\n"
133 "-A FW_blackchain -m owner --uid-owner 10124 -j DROP\n"
134 "-A FW_blackchain -j RETURN\n"
135 "COMMIT\n\x04";
136
137 std::vector<int32_t> uids = { 10023, 10059, 10124 };
138 EXPECT_EQ(expected, makeUidRules("FW_blackchain", false, uids));
139}