blob: c1f43eb79a01d4021b2fa13e499492c192824b5b [file] [log] [blame]
Lorenzo Colitti89faa342016-02-26 11:38:47 +09001/*
2 * Copyright 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * FirewallControllerTest.cpp - unit tests for FirewallController.cpp
17 */
18
19#include <string>
20#include <vector>
21#include <stdio.h>
22
23#include <gtest/gtest.h>
24
Lorenzo Colittia55388e2016-05-13 17:03:42 +090025#include <android-base/strings.h>
Lorenzo Colitti6324b182017-07-17 21:48:14 +090026#include <android-base/stringprintf.h>
Lorenzo Colittia55388e2016-05-13 17:03:42 +090027
Lorenzo Colitti89faa342016-02-26 11:38:47 +090028#include "FirewallController.h"
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090029#include "IptablesBaseTest.h"
Lorenzo Colitti89faa342016-02-26 11:38:47 +090030
Lorenzo Colittid351bea2017-07-16 22:52:30 +090031using android::base::Join;
Lorenzo Colitti6324b182017-07-17 21:48:14 +090032using android::base::StringPrintf;
Lorenzo Colitti89faa342016-02-26 11:38:47 +090033
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090034class FirewallControllerTest : public IptablesBaseTest {
Lorenzo Colitti89faa342016-02-26 11:38:47 +090035protected:
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090036 FirewallControllerTest() {
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090037 FirewallController::execIptablesRestore = fakeExecIptablesRestore;
38 }
Lorenzo Colitti89faa342016-02-26 11:38:47 +090039 FirewallController mFw;
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090040
Lorenzo Colittif157caf2016-05-13 11:25:54 +090041 std::string makeUidRules(IptablesTarget a, const char* b, bool c,
42 const std::vector<int32_t>& d) {
43 return mFw.makeUidRules(a, b, c, d);
Lorenzo Colitti89faa342016-02-26 11:38:47 +090044 }
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090045
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090046 int createChain(const char* a, FirewallType b) {
47 return mFw.createChain(a, b);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090048 }
Lorenzo Colitti89faa342016-02-26 11:38:47 +090049};
50
51
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090052TEST_F(FirewallControllerTest, TestCreateWhitelistChain) {
Lorenzo Colittia55388e2016-05-13 17:03:42 +090053 std::vector<std::string> expectedRestore4 = {
54 "*filter",
55 ":fw_whitelist -",
Lorenzo Colitti8bcb1f42017-04-25 00:17:48 +090056 "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
Benedict Wongb2daefb2017-12-06 22:05:46 -080057 "-A fw_whitelist -m owner ! --uid-owner 0-4294967294 -j RETURN",
58 "-A fw_whitelist -p esp -j RETURN",
Lorenzo Colitti50b198a2017-03-30 02:50:09 +090059 "-A fw_whitelist -i lo -j RETURN",
60 "-A fw_whitelist -o lo -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090061 "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090062 "-A fw_whitelist -j DROP",
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090063 "COMMIT\n"
Lorenzo Colittia55388e2016-05-13 17:03:42 +090064 };
65 std::vector<std::string> expectedRestore6 = {
66 "*filter",
67 ":fw_whitelist -",
Lorenzo Colitti8bcb1f42017-04-25 00:17:48 +090068 "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
Benedict Wongb2daefb2017-12-06 22:05:46 -080069 "-A fw_whitelist -m owner ! --uid-owner 0-4294967294 -j RETURN",
70 "-A fw_whitelist -p esp -j RETURN",
Lorenzo Colitti50b198a2017-03-30 02:50:09 +090071 "-A fw_whitelist -i lo -j RETURN",
72 "-A fw_whitelist -o lo -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090073 "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
74 "-A fw_whitelist -p icmpv6 --icmpv6-type packet-too-big -j RETURN",
75 "-A fw_whitelist -p icmpv6 --icmpv6-type router-solicitation -j RETURN",
76 "-A fw_whitelist -p icmpv6 --icmpv6-type router-advertisement -j RETURN",
77 "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN",
78 "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN",
79 "-A fw_whitelist -p icmpv6 --icmpv6-type redirect -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090080 "-A fw_whitelist -j DROP",
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090081 "COMMIT\n"
Lorenzo Colittia55388e2016-05-13 17:03:42 +090082 };
83 std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
84 { V4, android::base::Join(expectedRestore4, '\n') },
85 { V6, android::base::Join(expectedRestore6, '\n') },
86 };
87
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090088 createChain("fw_whitelist", WHITELIST);
Lorenzo Colittia55388e2016-05-13 17:03:42 +090089 expectIptablesRestoreCommands(expectedRestoreCommands);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +090090}
91
92TEST_F(FirewallControllerTest, TestCreateBlacklistChain) {
Lorenzo Colittia55388e2016-05-13 17:03:42 +090093 std::vector<std::string> expectedRestore = {
94 "*filter",
95 ":fw_blacklist -",
Lorenzo Colitti50b198a2017-03-30 02:50:09 +090096 "-A fw_blacklist -i lo -j RETURN",
97 "-A fw_blacklist -o lo -j RETURN",
Lorenzo Colittia55388e2016-05-13 17:03:42 +090098 "-A fw_blacklist -p tcp --tcp-flags RST RST -j RETURN",
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +090099 "COMMIT\n"
Lorenzo Colittia55388e2016-05-13 17:03:42 +0900100 };
101 std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
102 { V4, android::base::Join(expectedRestore, '\n') },
103 { V6, android::base::Join(expectedRestore, '\n') },
104 };
105
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +0900106 createChain("fw_blacklist", BLACKLIST);
Lorenzo Colittia55388e2016-05-13 17:03:42 +0900107 expectIptablesRestoreCommands(expectedRestoreCommands);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900108}
109
110TEST_F(FirewallControllerTest, TestSetStandbyRule) {
111 ExpectedIptablesCommands expected = {
Lorenzo Colittia7357652017-04-25 00:16:36 +0900112 { V4V6, "*filter\n-D fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" }
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900113 };
114 mFw.setUidRule(STANDBY, 12345, ALLOW);
Lorenzo Colittia7357652017-04-25 00:16:36 +0900115 expectIptablesRestoreCommands(expected);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900116
117 expected = {
Lorenzo Colittia7357652017-04-25 00:16:36 +0900118 { V4V6, "*filter\n-A fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" }
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900119 };
120 mFw.setUidRule(STANDBY, 12345, DENY);
Lorenzo Colittia7357652017-04-25 00:16:36 +0900121 expectIptablesRestoreCommands(expected);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900122}
123
124TEST_F(FirewallControllerTest, TestSetDozeRule) {
125 ExpectedIptablesCommands expected = {
Lorenzo Colittia7357652017-04-25 00:16:36 +0900126 { V4V6, "*filter\n-I fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" }
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900127 };
128 mFw.setUidRule(DOZABLE, 54321, ALLOW);
Lorenzo Colittia7357652017-04-25 00:16:36 +0900129 expectIptablesRestoreCommands(expected);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900130
131 expected = {
Lorenzo Colittia7357652017-04-25 00:16:36 +0900132 { V4V6, "*filter\n-D fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" }
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900133 };
134 mFw.setUidRule(DOZABLE, 54321, DENY);
Lorenzo Colittia7357652017-04-25 00:16:36 +0900135 expectIptablesRestoreCommands(expected);
136}
137
138TEST_F(FirewallControllerTest, TestSetFirewallRule) {
139 ExpectedIptablesCommands expected = {
140 { V4V6, "*filter\n"
141 "-A fw_INPUT -m owner --uid-owner 54321 -j DROP\n"
142 "-A fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n"
143 "COMMIT\n" }
144 };
145 mFw.setUidRule(NONE, 54321, DENY);
146 expectIptablesRestoreCommands(expected);
147
148 expected = {
149 { V4V6, "*filter\n"
150 "-D fw_INPUT -m owner --uid-owner 54321 -j DROP\n"
151 "-D fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n"
152 "COMMIT\n" }
153 };
154 mFw.setUidRule(NONE, 54321, ALLOW);
155 expectIptablesRestoreCommands(expected);
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900156}
157
158TEST_F(FirewallControllerTest, TestReplaceWhitelistUidRule) {
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900159 std::string expected =
160 "*filter\n"
161 ":FW_whitechain -\n"
Lorenzo Colitti8bcb1f42017-04-25 00:17:48 +0900162 "-A FW_whitechain -m owner --uid-owner 10023 -j RETURN\n"
163 "-A FW_whitechain -m owner --uid-owner 10059 -j RETURN\n"
164 "-A FW_whitechain -m owner --uid-owner 10124 -j RETURN\n"
165 "-A FW_whitechain -m owner --uid-owner 10111 -j RETURN\n"
166 "-A FW_whitechain -m owner --uid-owner 110122 -j RETURN\n"
167 "-A FW_whitechain -m owner --uid-owner 210153 -j RETURN\n"
168 "-A FW_whitechain -m owner --uid-owner 210024 -j RETURN\n"
169 "-A FW_whitechain -m owner --uid-owner 0-9999 -j RETURN\n"
Benedict Wongb2daefb2017-12-06 22:05:46 -0800170 "-A FW_whitechain -m owner ! --uid-owner 0-4294967294 -j RETURN\n"
171 "-A FW_whitechain -p esp -j RETURN\n"
Lorenzo Colitti50b198a2017-03-30 02:50:09 +0900172 "-A FW_whitechain -i lo -j RETURN\n"
173 "-A FW_whitechain -o lo -j RETURN\n"
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900174 "-A FW_whitechain -p tcp --tcp-flags RST RST -j RETURN\n"
175 "-A FW_whitechain -p icmpv6 --icmpv6-type packet-too-big -j RETURN\n"
176 "-A FW_whitechain -p icmpv6 --icmpv6-type router-solicitation -j RETURN\n"
177 "-A FW_whitechain -p icmpv6 --icmpv6-type router-advertisement -j RETURN\n"
178 "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN\n"
179 "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN\n"
180 "-A FW_whitechain -p icmpv6 --icmpv6-type redirect -j RETURN\n"
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900181 "-A FW_whitechain -j DROP\n"
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +0900182 "COMMIT\n";
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900183
184 std::vector<int32_t> uids = { 10023, 10059, 10124, 10111, 110122, 210153, 210024 };
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900185 EXPECT_EQ(expected, makeUidRules(V6, "FW_whitechain", true, uids));
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900186}
187
Lorenzo Colitti932c44c2016-04-24 16:58:02 +0900188TEST_F(FirewallControllerTest, TestReplaceBlacklistUidRule) {
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900189 std::string expected =
190 "*filter\n"
191 ":FW_blackchain -\n"
Lorenzo Colitti50b198a2017-03-30 02:50:09 +0900192 "-A FW_blackchain -i lo -j RETURN\n"
193 "-A FW_blackchain -o lo -j RETURN\n"
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900194 "-A FW_blackchain -p tcp --tcp-flags RST RST -j RETURN\n"
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900195 "-A FW_blackchain -m owner --uid-owner 10023 -j DROP\n"
196 "-A FW_blackchain -m owner --uid-owner 10059 -j DROP\n"
197 "-A FW_blackchain -m owner --uid-owner 10124 -j DROP\n"
Lorenzo Colitti03b23fe2017-02-03 18:46:53 +0900198 "COMMIT\n";
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900199
200 std::vector<int32_t> uids = { 10023, 10059, 10124 };
Lorenzo Colittif157caf2016-05-13 11:25:54 +0900201 EXPECT_EQ(expected, makeUidRules(V4 ,"FW_blackchain", false, uids));
Lorenzo Colitti89faa342016-02-26 11:38:47 +0900202}
Lorenzo Colittidd9a54b2017-04-26 16:13:22 +0900203
204TEST_F(FirewallControllerTest, TestEnableChildChains) {
205 std::vector<std::string> expected = {
Lorenzo Colittia1611962017-04-26 16:30:39 +0900206 "*filter\n"
207 "-A fw_INPUT -j fw_dozable\n"
208 "-A fw_OUTPUT -j fw_dozable\n"
209 "COMMIT\n"
Lorenzo Colittidd9a54b2017-04-26 16:13:22 +0900210 };
211 EXPECT_EQ(0, mFw.enableChildChains(DOZABLE, true));
Lorenzo Colittia1611962017-04-26 16:30:39 +0900212 expectIptablesRestoreCommands(expected);
Lorenzo Colittidd9a54b2017-04-26 16:13:22 +0900213
214 expected = {
Lorenzo Colittia1611962017-04-26 16:30:39 +0900215 "*filter\n"
216 "-D fw_INPUT -j fw_powersave\n"
217 "-D fw_OUTPUT -j fw_powersave\n"
218 "COMMIT\n"
Lorenzo Colittidd9a54b2017-04-26 16:13:22 +0900219 };
220 EXPECT_EQ(0, mFw.enableChildChains(POWERSAVE, false));
Lorenzo Colittia1611962017-04-26 16:30:39 +0900221 expectIptablesRestoreCommands(expected);
Lorenzo Colittidd9a54b2017-04-26 16:13:22 +0900222}
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900223
Lorenzo Colitti6324b182017-07-17 21:48:14 +0900224TEST_F(FirewallControllerTest, TestFirewall) {
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900225 std::vector<std::string> enableCommands = {
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900226 "*filter\n"
227 "-A fw_INPUT -j DROP\n"
228 "-A fw_OUTPUT -j REJECT\n"
229 "-A fw_FORWARD -j REJECT\n"
230 "COMMIT\n"
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900231 };
232 std::vector<std::string> disableCommands = {
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900233 "*filter\n"
234 ":fw_INPUT -\n"
235 ":fw_OUTPUT -\n"
236 ":fw_FORWARD -\n"
237 "COMMIT\n"
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900238 };
239 std::vector<std::string> noCommands = {};
240
241 EXPECT_EQ(0, mFw.disableFirewall());
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900242 expectIptablesRestoreCommands(disableCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900243
244 EXPECT_EQ(0, mFw.disableFirewall());
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900245 expectIptablesRestoreCommands(disableCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900246
247 EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST));
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900248 expectIptablesRestoreCommands(disableCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900249
250 EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST));
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900251 expectIptablesRestoreCommands(noCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900252
253 std::vector<std::string> disableEnableCommands;
254 disableEnableCommands.insert(
255 disableEnableCommands.end(), disableCommands.begin(), disableCommands.end());
256 disableEnableCommands.insert(
257 disableEnableCommands.end(), enableCommands.begin(), enableCommands.end());
258
259 EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900260 expectIptablesRestoreCommands(disableEnableCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900261
Lorenzo Colitti6324b182017-07-17 21:48:14 +0900262 std::vector<std::string> ifaceCommands = {
Lorenzo Colitti1411d452017-07-17 22:12:15 +0900263 "*filter\n"
264 "-I fw_INPUT -i rmnet_data0 -j RETURN\n"
265 "-I fw_OUTPUT -o rmnet_data0 -j RETURN\n"
266 "COMMIT\n"
Lorenzo Colitti6324b182017-07-17 21:48:14 +0900267 };
268 EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", ALLOW));
Lorenzo Colitti1411d452017-07-17 22:12:15 +0900269 expectIptablesRestoreCommands(ifaceCommands);
270
271 EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", ALLOW));
272 expectIptablesRestoreCommands(noCommands);
Lorenzo Colitti6324b182017-07-17 21:48:14 +0900273
274 ifaceCommands = {
Lorenzo Colitti1411d452017-07-17 22:12:15 +0900275 "*filter\n"
276 "-D fw_INPUT -i rmnet_data0 -j RETURN\n"
277 "-D fw_OUTPUT -o rmnet_data0 -j RETURN\n"
278 "COMMIT\n"
Lorenzo Colitti6324b182017-07-17 21:48:14 +0900279 };
280 EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", DENY));
Lorenzo Colitti1411d452017-07-17 22:12:15 +0900281 expectIptablesRestoreCommands(ifaceCommands);
282
283 EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", DENY));
284 expectIptablesRestoreCommands(noCommands);
Lorenzo Colitti6324b182017-07-17 21:48:14 +0900285
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900286 EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900287 expectIptablesRestoreCommands(noCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900288
289 EXPECT_EQ(0, mFw.disableFirewall());
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900290 expectIptablesRestoreCommands(disableCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900291
292 // TODO: calling disableFirewall and then enableFirewall(WHITELIST) does
293 // nothing. This seems like a clear bug.
294 EXPECT_EQ(0, mFw.enableFirewall(WHITELIST));
Lorenzo Colittid351bea2017-07-16 22:52:30 +0900295 expectIptablesRestoreCommands(noCommands);
Lorenzo Colitticc1bb822017-07-16 21:08:54 +0900296}