Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2016 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | * |
| 16 | * FirewallControllerTest.cpp - unit tests for FirewallController.cpp |
| 17 | */ |
| 18 | |
| 19 | #include <string> |
| 20 | #include <vector> |
| 21 | #include <stdio.h> |
| 22 | |
| 23 | #include <gtest/gtest.h> |
| 24 | |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 25 | #include <android-base/strings.h> |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 26 | #include <android-base/stringprintf.h> |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 27 | |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 28 | #include "FirewallController.h" |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 29 | #include "IptablesBaseTest.h" |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 30 | |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 31 | using android::base::Join; |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 32 | using android::base::StringPrintf; |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 33 | |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 34 | class FirewallControllerTest : public IptablesBaseTest { |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 35 | protected: |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 36 | FirewallControllerTest() { |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 37 | FirewallController::execIptablesRestore = fakeExecIptablesRestore; |
| 38 | } |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 39 | FirewallController mFw; |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 40 | |
Lorenzo Colitti | f157caf | 2016-05-13 11:25:54 +0900 | [diff] [blame] | 41 | std::string makeUidRules(IptablesTarget a, const char* b, bool c, |
| 42 | const std::vector<int32_t>& d) { |
| 43 | return mFw.makeUidRules(a, b, c, d); |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 44 | } |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 45 | |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 46 | int createChain(const char* a, FirewallType b) { |
| 47 | return mFw.createChain(a, b); |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 48 | } |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 49 | }; |
| 50 | |
| 51 | |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 52 | TEST_F(FirewallControllerTest, TestCreateWhitelistChain) { |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 53 | std::vector<std::string> expectedRestore4 = { |
| 54 | "*filter", |
| 55 | ":fw_whitelist -", |
Lorenzo Colitti | 8bcb1f4 | 2017-04-25 00:17:48 +0900 | [diff] [blame] | 56 | "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN", |
Benedict Wong | b2daefb | 2017-12-06 22:05:46 -0800 | [diff] [blame^] | 57 | "-A fw_whitelist -m owner ! --uid-owner 0-4294967294 -j RETURN", |
| 58 | "-A fw_whitelist -p esp -j RETURN", |
Lorenzo Colitti | 50b198a | 2017-03-30 02:50:09 +0900 | [diff] [blame] | 59 | "-A fw_whitelist -i lo -j RETURN", |
| 60 | "-A fw_whitelist -o lo -j RETURN", |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 61 | "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN", |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 62 | "-A fw_whitelist -j DROP", |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 63 | "COMMIT\n" |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 64 | }; |
| 65 | std::vector<std::string> expectedRestore6 = { |
| 66 | "*filter", |
| 67 | ":fw_whitelist -", |
Lorenzo Colitti | 8bcb1f4 | 2017-04-25 00:17:48 +0900 | [diff] [blame] | 68 | "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN", |
Benedict Wong | b2daefb | 2017-12-06 22:05:46 -0800 | [diff] [blame^] | 69 | "-A fw_whitelist -m owner ! --uid-owner 0-4294967294 -j RETURN", |
| 70 | "-A fw_whitelist -p esp -j RETURN", |
Lorenzo Colitti | 50b198a | 2017-03-30 02:50:09 +0900 | [diff] [blame] | 71 | "-A fw_whitelist -i lo -j RETURN", |
| 72 | "-A fw_whitelist -o lo -j RETURN", |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 73 | "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN", |
| 74 | "-A fw_whitelist -p icmpv6 --icmpv6-type packet-too-big -j RETURN", |
| 75 | "-A fw_whitelist -p icmpv6 --icmpv6-type router-solicitation -j RETURN", |
| 76 | "-A fw_whitelist -p icmpv6 --icmpv6-type router-advertisement -j RETURN", |
| 77 | "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN", |
| 78 | "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN", |
| 79 | "-A fw_whitelist -p icmpv6 --icmpv6-type redirect -j RETURN", |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 80 | "-A fw_whitelist -j DROP", |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 81 | "COMMIT\n" |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 82 | }; |
| 83 | std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = { |
| 84 | { V4, android::base::Join(expectedRestore4, '\n') }, |
| 85 | { V6, android::base::Join(expectedRestore6, '\n') }, |
| 86 | }; |
| 87 | |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 88 | createChain("fw_whitelist", WHITELIST); |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 89 | expectIptablesRestoreCommands(expectedRestoreCommands); |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 90 | } |
| 91 | |
| 92 | TEST_F(FirewallControllerTest, TestCreateBlacklistChain) { |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 93 | std::vector<std::string> expectedRestore = { |
| 94 | "*filter", |
| 95 | ":fw_blacklist -", |
Lorenzo Colitti | 50b198a | 2017-03-30 02:50:09 +0900 | [diff] [blame] | 96 | "-A fw_blacklist -i lo -j RETURN", |
| 97 | "-A fw_blacklist -o lo -j RETURN", |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 98 | "-A fw_blacklist -p tcp --tcp-flags RST RST -j RETURN", |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 99 | "COMMIT\n" |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 100 | }; |
| 101 | std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = { |
| 102 | { V4, android::base::Join(expectedRestore, '\n') }, |
| 103 | { V6, android::base::Join(expectedRestore, '\n') }, |
| 104 | }; |
| 105 | |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 106 | createChain("fw_blacklist", BLACKLIST); |
Lorenzo Colitti | a55388e | 2016-05-13 17:03:42 +0900 | [diff] [blame] | 107 | expectIptablesRestoreCommands(expectedRestoreCommands); |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 108 | } |
| 109 | |
| 110 | TEST_F(FirewallControllerTest, TestSetStandbyRule) { |
| 111 | ExpectedIptablesCommands expected = { |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 112 | { V4V6, "*filter\n-D fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" } |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 113 | }; |
| 114 | mFw.setUidRule(STANDBY, 12345, ALLOW); |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 115 | expectIptablesRestoreCommands(expected); |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 116 | |
| 117 | expected = { |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 118 | { V4V6, "*filter\n-A fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" } |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 119 | }; |
| 120 | mFw.setUidRule(STANDBY, 12345, DENY); |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 121 | expectIptablesRestoreCommands(expected); |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 122 | } |
| 123 | |
| 124 | TEST_F(FirewallControllerTest, TestSetDozeRule) { |
| 125 | ExpectedIptablesCommands expected = { |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 126 | { V4V6, "*filter\n-I fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" } |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 127 | }; |
| 128 | mFw.setUidRule(DOZABLE, 54321, ALLOW); |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 129 | expectIptablesRestoreCommands(expected); |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 130 | |
| 131 | expected = { |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 132 | { V4V6, "*filter\n-D fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" } |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 133 | }; |
| 134 | mFw.setUidRule(DOZABLE, 54321, DENY); |
Lorenzo Colitti | a735765 | 2017-04-25 00:16:36 +0900 | [diff] [blame] | 135 | expectIptablesRestoreCommands(expected); |
| 136 | } |
| 137 | |
| 138 | TEST_F(FirewallControllerTest, TestSetFirewallRule) { |
| 139 | ExpectedIptablesCommands expected = { |
| 140 | { V4V6, "*filter\n" |
| 141 | "-A fw_INPUT -m owner --uid-owner 54321 -j DROP\n" |
| 142 | "-A fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n" |
| 143 | "COMMIT\n" } |
| 144 | }; |
| 145 | mFw.setUidRule(NONE, 54321, DENY); |
| 146 | expectIptablesRestoreCommands(expected); |
| 147 | |
| 148 | expected = { |
| 149 | { V4V6, "*filter\n" |
| 150 | "-D fw_INPUT -m owner --uid-owner 54321 -j DROP\n" |
| 151 | "-D fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n" |
| 152 | "COMMIT\n" } |
| 153 | }; |
| 154 | mFw.setUidRule(NONE, 54321, ALLOW); |
| 155 | expectIptablesRestoreCommands(expected); |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 156 | } |
| 157 | |
| 158 | TEST_F(FirewallControllerTest, TestReplaceWhitelistUidRule) { |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 159 | std::string expected = |
| 160 | "*filter\n" |
| 161 | ":FW_whitechain -\n" |
Lorenzo Colitti | 8bcb1f4 | 2017-04-25 00:17:48 +0900 | [diff] [blame] | 162 | "-A FW_whitechain -m owner --uid-owner 10023 -j RETURN\n" |
| 163 | "-A FW_whitechain -m owner --uid-owner 10059 -j RETURN\n" |
| 164 | "-A FW_whitechain -m owner --uid-owner 10124 -j RETURN\n" |
| 165 | "-A FW_whitechain -m owner --uid-owner 10111 -j RETURN\n" |
| 166 | "-A FW_whitechain -m owner --uid-owner 110122 -j RETURN\n" |
| 167 | "-A FW_whitechain -m owner --uid-owner 210153 -j RETURN\n" |
| 168 | "-A FW_whitechain -m owner --uid-owner 210024 -j RETURN\n" |
| 169 | "-A FW_whitechain -m owner --uid-owner 0-9999 -j RETURN\n" |
Benedict Wong | b2daefb | 2017-12-06 22:05:46 -0800 | [diff] [blame^] | 170 | "-A FW_whitechain -m owner ! --uid-owner 0-4294967294 -j RETURN\n" |
| 171 | "-A FW_whitechain -p esp -j RETURN\n" |
Lorenzo Colitti | 50b198a | 2017-03-30 02:50:09 +0900 | [diff] [blame] | 172 | "-A FW_whitechain -i lo -j RETURN\n" |
| 173 | "-A FW_whitechain -o lo -j RETURN\n" |
Lorenzo Colitti | f157caf | 2016-05-13 11:25:54 +0900 | [diff] [blame] | 174 | "-A FW_whitechain -p tcp --tcp-flags RST RST -j RETURN\n" |
| 175 | "-A FW_whitechain -p icmpv6 --icmpv6-type packet-too-big -j RETURN\n" |
| 176 | "-A FW_whitechain -p icmpv6 --icmpv6-type router-solicitation -j RETURN\n" |
| 177 | "-A FW_whitechain -p icmpv6 --icmpv6-type router-advertisement -j RETURN\n" |
| 178 | "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN\n" |
| 179 | "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN\n" |
| 180 | "-A FW_whitechain -p icmpv6 --icmpv6-type redirect -j RETURN\n" |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 181 | "-A FW_whitechain -j DROP\n" |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 182 | "COMMIT\n"; |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 183 | |
| 184 | std::vector<int32_t> uids = { 10023, 10059, 10124, 10111, 110122, 210153, 210024 }; |
Lorenzo Colitti | f157caf | 2016-05-13 11:25:54 +0900 | [diff] [blame] | 185 | EXPECT_EQ(expected, makeUidRules(V6, "FW_whitechain", true, uids)); |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 186 | } |
| 187 | |
Lorenzo Colitti | 932c44c | 2016-04-24 16:58:02 +0900 | [diff] [blame] | 188 | TEST_F(FirewallControllerTest, TestReplaceBlacklistUidRule) { |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 189 | std::string expected = |
| 190 | "*filter\n" |
| 191 | ":FW_blackchain -\n" |
Lorenzo Colitti | 50b198a | 2017-03-30 02:50:09 +0900 | [diff] [blame] | 192 | "-A FW_blackchain -i lo -j RETURN\n" |
| 193 | "-A FW_blackchain -o lo -j RETURN\n" |
Lorenzo Colitti | f157caf | 2016-05-13 11:25:54 +0900 | [diff] [blame] | 194 | "-A FW_blackchain -p tcp --tcp-flags RST RST -j RETURN\n" |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 195 | "-A FW_blackchain -m owner --uid-owner 10023 -j DROP\n" |
| 196 | "-A FW_blackchain -m owner --uid-owner 10059 -j DROP\n" |
| 197 | "-A FW_blackchain -m owner --uid-owner 10124 -j DROP\n" |
Lorenzo Colitti | 03b23fe | 2017-02-03 18:46:53 +0900 | [diff] [blame] | 198 | "COMMIT\n"; |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 199 | |
| 200 | std::vector<int32_t> uids = { 10023, 10059, 10124 }; |
Lorenzo Colitti | f157caf | 2016-05-13 11:25:54 +0900 | [diff] [blame] | 201 | EXPECT_EQ(expected, makeUidRules(V4 ,"FW_blackchain", false, uids)); |
Lorenzo Colitti | 89faa34 | 2016-02-26 11:38:47 +0900 | [diff] [blame] | 202 | } |
Lorenzo Colitti | dd9a54b | 2017-04-26 16:13:22 +0900 | [diff] [blame] | 203 | |
| 204 | TEST_F(FirewallControllerTest, TestEnableChildChains) { |
| 205 | std::vector<std::string> expected = { |
Lorenzo Colitti | a161196 | 2017-04-26 16:30:39 +0900 | [diff] [blame] | 206 | "*filter\n" |
| 207 | "-A fw_INPUT -j fw_dozable\n" |
| 208 | "-A fw_OUTPUT -j fw_dozable\n" |
| 209 | "COMMIT\n" |
Lorenzo Colitti | dd9a54b | 2017-04-26 16:13:22 +0900 | [diff] [blame] | 210 | }; |
| 211 | EXPECT_EQ(0, mFw.enableChildChains(DOZABLE, true)); |
Lorenzo Colitti | a161196 | 2017-04-26 16:30:39 +0900 | [diff] [blame] | 212 | expectIptablesRestoreCommands(expected); |
Lorenzo Colitti | dd9a54b | 2017-04-26 16:13:22 +0900 | [diff] [blame] | 213 | |
| 214 | expected = { |
Lorenzo Colitti | a161196 | 2017-04-26 16:30:39 +0900 | [diff] [blame] | 215 | "*filter\n" |
| 216 | "-D fw_INPUT -j fw_powersave\n" |
| 217 | "-D fw_OUTPUT -j fw_powersave\n" |
| 218 | "COMMIT\n" |
Lorenzo Colitti | dd9a54b | 2017-04-26 16:13:22 +0900 | [diff] [blame] | 219 | }; |
| 220 | EXPECT_EQ(0, mFw.enableChildChains(POWERSAVE, false)); |
Lorenzo Colitti | a161196 | 2017-04-26 16:30:39 +0900 | [diff] [blame] | 221 | expectIptablesRestoreCommands(expected); |
Lorenzo Colitti | dd9a54b | 2017-04-26 16:13:22 +0900 | [diff] [blame] | 222 | } |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 223 | |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 224 | TEST_F(FirewallControllerTest, TestFirewall) { |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 225 | std::vector<std::string> enableCommands = { |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 226 | "*filter\n" |
| 227 | "-A fw_INPUT -j DROP\n" |
| 228 | "-A fw_OUTPUT -j REJECT\n" |
| 229 | "-A fw_FORWARD -j REJECT\n" |
| 230 | "COMMIT\n" |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 231 | }; |
| 232 | std::vector<std::string> disableCommands = { |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 233 | "*filter\n" |
| 234 | ":fw_INPUT -\n" |
| 235 | ":fw_OUTPUT -\n" |
| 236 | ":fw_FORWARD -\n" |
| 237 | "COMMIT\n" |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 238 | }; |
| 239 | std::vector<std::string> noCommands = {}; |
| 240 | |
| 241 | EXPECT_EQ(0, mFw.disableFirewall()); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 242 | expectIptablesRestoreCommands(disableCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 243 | |
| 244 | EXPECT_EQ(0, mFw.disableFirewall()); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 245 | expectIptablesRestoreCommands(disableCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 246 | |
| 247 | EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST)); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 248 | expectIptablesRestoreCommands(disableCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 249 | |
| 250 | EXPECT_EQ(0, mFw.enableFirewall(BLACKLIST)); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 251 | expectIptablesRestoreCommands(noCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 252 | |
| 253 | std::vector<std::string> disableEnableCommands; |
| 254 | disableEnableCommands.insert( |
| 255 | disableEnableCommands.end(), disableCommands.begin(), disableCommands.end()); |
| 256 | disableEnableCommands.insert( |
| 257 | disableEnableCommands.end(), enableCommands.begin(), enableCommands.end()); |
| 258 | |
| 259 | EXPECT_EQ(0, mFw.enableFirewall(WHITELIST)); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 260 | expectIptablesRestoreCommands(disableEnableCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 261 | |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 262 | std::vector<std::string> ifaceCommands = { |
Lorenzo Colitti | 1411d45 | 2017-07-17 22:12:15 +0900 | [diff] [blame] | 263 | "*filter\n" |
| 264 | "-I fw_INPUT -i rmnet_data0 -j RETURN\n" |
| 265 | "-I fw_OUTPUT -o rmnet_data0 -j RETURN\n" |
| 266 | "COMMIT\n" |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 267 | }; |
| 268 | EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", ALLOW)); |
Lorenzo Colitti | 1411d45 | 2017-07-17 22:12:15 +0900 | [diff] [blame] | 269 | expectIptablesRestoreCommands(ifaceCommands); |
| 270 | |
| 271 | EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", ALLOW)); |
| 272 | expectIptablesRestoreCommands(noCommands); |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 273 | |
| 274 | ifaceCommands = { |
Lorenzo Colitti | 1411d45 | 2017-07-17 22:12:15 +0900 | [diff] [blame] | 275 | "*filter\n" |
| 276 | "-D fw_INPUT -i rmnet_data0 -j RETURN\n" |
| 277 | "-D fw_OUTPUT -o rmnet_data0 -j RETURN\n" |
| 278 | "COMMIT\n" |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 279 | }; |
| 280 | EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", DENY)); |
Lorenzo Colitti | 1411d45 | 2017-07-17 22:12:15 +0900 | [diff] [blame] | 281 | expectIptablesRestoreCommands(ifaceCommands); |
| 282 | |
| 283 | EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", DENY)); |
| 284 | expectIptablesRestoreCommands(noCommands); |
Lorenzo Colitti | 6324b18 | 2017-07-17 21:48:14 +0900 | [diff] [blame] | 285 | |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 286 | EXPECT_EQ(0, mFw.enableFirewall(WHITELIST)); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 287 | expectIptablesRestoreCommands(noCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 288 | |
| 289 | EXPECT_EQ(0, mFw.disableFirewall()); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 290 | expectIptablesRestoreCommands(disableCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 291 | |
| 292 | // TODO: calling disableFirewall and then enableFirewall(WHITELIST) does |
| 293 | // nothing. This seems like a clear bug. |
| 294 | EXPECT_EQ(0, mFw.enableFirewall(WHITELIST)); |
Lorenzo Colitti | d351bea | 2017-07-16 22:52:30 +0900 | [diff] [blame] | 295 | expectIptablesRestoreCommands(noCommands); |
Lorenzo Colitti | cc1bb82 | 2017-07-16 21:08:54 +0900 | [diff] [blame] | 296 | } |