blob: f709cda7a2945d8125cbc084ccbf290a085a20a5 [file] [log] [blame]
Lorenzo Colitti89faa342016-02-26 11:38:47 +09001/*
2 * Copyright 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * FirewallControllerTest.cpp - unit tests for FirewallController.cpp
17 */
18
19#include <string>
20#include <vector>
21#include <stdio.h>
22
23#include <gtest/gtest.h>
24
Lorenzo Colittia55388e2016-05-13 17:03:42 +090025#include <android-base/strings.h>
26
Lorenzo Colitti89faa342016-02-26 11:38:47 +090027#include "FirewallController.h"
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090028#include "IptablesBaseTest.h"
Lorenzo Colitti89faa342016-02-26 11:38:47 +090029
30
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090031class FirewallControllerTest : public IptablesBaseTest {
Lorenzo Colitti89faa342016-02-26 11:38:47 +090032protected:
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090033 FirewallControllerTest() {
34 FirewallController::execIptables = fakeExecIptables;
35 FirewallController::execIptablesSilently = fakeExecIptables;
36 FirewallController::execIptablesRestore = fakeExecIptablesRestore;
37 }
Lorenzo Colitti89faa342016-02-26 11:38:47 +090038 FirewallController mFw;
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090039
Lorenzo Colittif157caf2016-05-13 11:25:54 +090040 std::string makeUidRules(IptablesTarget a, const char* b, bool c,
41 const std::vector<int32_t>& d) {
42 return mFw.makeUidRules(a, b, c, d);
Lorenzo Colitti89faa342016-02-26 11:38:47 +090043 }
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090044
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090045 int createChain(const char* a, FirewallType b) {
46 return mFw.createChain(a, b);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090047 }
Lorenzo Colitti89faa342016-02-26 11:38:47 +090048};
49
50
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090051TEST_F(FirewallControllerTest, TestCreateWhitelistChain) {
Lorenzo Colittia55388e2016-05-13 17:03:42 +090052 std::vector<std::string> expectedRestore4 = {
53 "*filter",
54 ":fw_whitelist -",
Lorenzo Colitti50b198a2017-03-30 02:50:09 +090055 "-A fw_whitelist -i lo -j RETURN",
56 "-A fw_whitelist -o lo -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090057 "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
58 "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
59 "-A fw_whitelist -j DROP",
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090060 "COMMIT\n"
Lorenzo Colittia55388e2016-05-13 17:03:42 +090061 };
62 std::vector<std::string> expectedRestore6 = {
63 "*filter",
64 ":fw_whitelist -",
Lorenzo Colitti50b198a2017-03-30 02:50:09 +090065 "-A fw_whitelist -i lo -j RETURN",
66 "-A fw_whitelist -o lo -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090067 "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
68 "-A fw_whitelist -p icmpv6 --icmpv6-type packet-too-big -j RETURN",
69 "-A fw_whitelist -p icmpv6 --icmpv6-type router-solicitation -j RETURN",
70 "-A fw_whitelist -p icmpv6 --icmpv6-type router-advertisement -j RETURN",
71 "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN",
72 "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN",
73 "-A fw_whitelist -p icmpv6 --icmpv6-type redirect -j RETURN",
74 "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
75 "-A fw_whitelist -j DROP",
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090076 "COMMIT\n"
Lorenzo Colittia55388e2016-05-13 17:03:42 +090077 };
78 std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
79 { V4, android::base::Join(expectedRestore4, '\n') },
80 { V6, android::base::Join(expectedRestore6, '\n') },
81 };
82
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090083 createChain("fw_whitelist", WHITELIST);
Lorenzo Colittia55388e2016-05-13 17:03:42 +090084 expectIptablesRestoreCommands(expectedRestoreCommands);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090085}
86
87TEST_F(FirewallControllerTest, TestCreateBlacklistChain) {
Lorenzo Colittia55388e2016-05-13 17:03:42 +090088 std::vector<std::string> expectedRestore = {
89 "*filter",
90 ":fw_blacklist -",
Lorenzo Colitti50b198a2017-03-30 02:50:09 +090091 "-A fw_blacklist -i lo -j RETURN",
92 "-A fw_blacklist -o lo -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090093 "-A fw_blacklist -p tcp --tcp-flags RST RST -j RETURN",
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090094 "COMMIT\n"
Lorenzo Colittia55388e2016-05-13 17:03:42 +090095 };
96 std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
97 { V4, android::base::Join(expectedRestore, '\n') },
98 { V6, android::base::Join(expectedRestore, '\n') },
99 };
100
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +0900101 createChain("fw_blacklist", BLACKLIST);
Lorenzo Colittia55388e2016-05-13 17:03:42 +0900102 expectIptablesRestoreCommands(expectedRestoreCommands);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900103}
104
105TEST_F(FirewallControllerTest, TestSetStandbyRule) {
106 ExpectedIptablesCommands expected = {
107 { V4V6, "-D fw_standby -m owner --uid-owner 12345 -j DROP" }
108 };
109 mFw.setUidRule(STANDBY, 12345, ALLOW);
110 expectIptablesCommands(expected);
111
112 expected = {
113 { V4V6, "-A fw_standby -m owner --uid-owner 12345 -j DROP" }
114 };
115 mFw.setUidRule(STANDBY, 12345, DENY);
116 expectIptablesCommands(expected);
117}
118
119TEST_F(FirewallControllerTest, TestSetDozeRule) {
120 ExpectedIptablesCommands expected = {
121 { V4V6, "-I fw_dozable -m owner --uid-owner 54321 -j RETURN" }
122 };
123 mFw.setUidRule(DOZABLE, 54321, ALLOW);
124 expectIptablesCommands(expected);
125
126 expected = {
127 { V4V6, "-D fw_dozable -m owner --uid-owner 54321 -j RETURN" }
128 };
129 mFw.setUidRule(DOZABLE, 54321, DENY);
130 expectIptablesCommands(expected);
131}
132
133TEST_F(FirewallControllerTest, TestReplaceWhitelistUidRule) {
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900134 std::string expected =
135 "*filter\n"
136 ":FW_whitechain -\n"
Lorenzo Colitti50b198a2017-03-30 02:50:09 +0900137 "-A FW_whitechain -i lo -j RETURN\n"
138 "-A FW_whitechain -o lo -j RETURN\n"
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900139 "-A FW_whitechain -p tcp --tcp-flags RST RST -j RETURN\n"
140 "-A FW_whitechain -p icmpv6 --icmpv6-type packet-too-big -j RETURN\n"
141 "-A FW_whitechain -p icmpv6 --icmpv6-type router-solicitation -j RETURN\n"
142 "-A FW_whitechain -p icmpv6 --icmpv6-type router-advertisement -j RETURN\n"
143 "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN\n"
144 "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN\n"
145 "-A FW_whitechain -p icmpv6 --icmpv6-type redirect -j RETURN\n"
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900146 "-A FW_whitechain -m owner --uid-owner 0-9999 -j RETURN\n"
147 "-A FW_whitechain -m owner --uid-owner 10023 -j RETURN\n"
148 "-A FW_whitechain -m owner --uid-owner 10059 -j RETURN\n"
149 "-A FW_whitechain -m owner --uid-owner 10124 -j RETURN\n"
150 "-A FW_whitechain -m owner --uid-owner 10111 -j RETURN\n"
151 "-A FW_whitechain -m owner --uid-owner 110122 -j RETURN\n"
152 "-A FW_whitechain -m owner --uid-owner 210153 -j RETURN\n"
153 "-A FW_whitechain -m owner --uid-owner 210024 -j RETURN\n"
154 "-A FW_whitechain -j DROP\n"
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +0900155 "COMMIT\n";
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900156
157 std::vector<int32_t> uids = { 10023, 10059, 10124, 10111, 110122, 210153, 210024 };
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900158 EXPECT_EQ(expected, makeUidRules(V6, "FW_whitechain", true, uids));
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900159}
160
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900161TEST_F(FirewallControllerTest, TestReplaceBlacklistUidRule) {
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900162 std::string expected =
163 "*filter\n"
164 ":FW_blackchain -\n"
Lorenzo Colitti50b198a2017-03-30 02:50:09 +0900165 "-A FW_blackchain -i lo -j RETURN\n"
166 "-A FW_blackchain -o lo -j RETURN\n"
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900167 "-A FW_blackchain -p tcp --tcp-flags RST RST -j RETURN\n"
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900168 "-A FW_blackchain -m owner --uid-owner 10023 -j DROP\n"
169 "-A FW_blackchain -m owner --uid-owner 10059 -j DROP\n"
170 "-A FW_blackchain -m owner --uid-owner 10124 -j DROP\n"
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +0900171 "COMMIT\n";
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900172
173 std::vector<int32_t> uids = { 10023, 10059, 10124 };
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900174 EXPECT_EQ(expected, makeUidRules(V4 ,"FW_blackchain", false, uids));
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900175}