1 /*
2 * Copyright 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * TrafficControllerTest.cpp - unit tests for TrafficController.cpp
17 */
18
19 #include <string>
20 #include <vector>
21
22 #include <fcntl.h>
23 #include <inttypes.h>
24 #include <linux/inet_diag.h>
25 #include <linux/sock_diag.h>
26 #include <sys/socket.h>
27 #include <sys/types.h>
28 #include <unistd.h>
29
30 #include <gtest/gtest.h>
31
32 #include <android-base/stringprintf.h>
33 #include <android-base/strings.h>
34
35 #include <netdutils/MockSyscalls.h>
36
37 #include "FirewallController.h"
38 #include "TrafficController.h"
39 #include "bpf/BpfUtils.h"
40
41 using namespace android::bpf; // NOLINT(google-build-using-namespace): grandfathered
42
43 namespace android {
44 namespace net {
45
46 using base::Result;
47 using netdutils::isOk;
48
49 constexpr int TEST_MAP_SIZE = 10;
50 constexpr int TEST_COOKIE = 1;
51 constexpr uid_t TEST_UID = 10086;
52 constexpr uid_t TEST_UID2 = 54321;
53 constexpr uid_t TEST_UID3 = 98765;
54 constexpr uint32_t TEST_TAG = 42;
55 constexpr uint32_t TEST_COUNTERSET = 1;
56 constexpr uint32_t DEFAULT_COUNTERSET = 0;
57 constexpr uint32_t TEST_PER_UID_STATS_ENTRIES_LIMIT = 3;
58 constexpr uint32_t TEST_TOTAL_UID_STATS_ENTRIES_LIMIT = 7;
59
60 #define ASSERT_VALID(x) ASSERT_TRUE((x).isValid())
61
62 class TrafficControllerTest : public ::testing::Test {
63 protected:
TrafficControllerTest()64 TrafficControllerTest()
65 : mTc(TEST_PER_UID_STATS_ENTRIES_LIMIT, TEST_TOTAL_UID_STATS_ENTRIES_LIMIT) {}
66 TrafficController mTc;
67 BpfMap<uint64_t, UidTagValue> mFakeCookieTagMap;
68 BpfMap<uint32_t, uint8_t> mFakeUidCounterSetMap;
69 BpfMap<uint32_t, StatsValue> mFakeAppUidStatsMap;
70 BpfMap<StatsKey, StatsValue> mFakeStatsMapA;
71 BpfMap<uint32_t, uint8_t> mFakeConfigurationMap;
72 BpfMap<uint32_t, UidOwnerValue> mFakeUidOwnerMap;
73 BpfMap<uint32_t, uint8_t> mFakeUidPermissionMap;
74
SetUp()75 void SetUp() {
76 std::lock_guard guard(mTc.mMutex);
77 SKIP_IF_BPF_NOT_SUPPORTED;
78 ASSERT_EQ(0, setrlimitForTest());
79
80 mFakeCookieTagMap.reset(createMap(BPF_MAP_TYPE_HASH, sizeof(uint64_t), sizeof(UidTagValue),
81 TEST_MAP_SIZE, 0));
82 ASSERT_VALID(mFakeCookieTagMap);
83
84 mFakeUidCounterSetMap.reset(
85 createMap(BPF_MAP_TYPE_HASH, sizeof(uint32_t), sizeof(uint8_t), TEST_MAP_SIZE, 0));
86 ASSERT_VALID(mFakeUidCounterSetMap);
87
88 mFakeAppUidStatsMap.reset(createMap(BPF_MAP_TYPE_HASH, sizeof(uint32_t), sizeof(StatsValue),
89 TEST_MAP_SIZE, 0));
90 ASSERT_VALID(mFakeAppUidStatsMap);
91
92 mFakeStatsMapA.reset(createMap(BPF_MAP_TYPE_HASH, sizeof(StatsKey), sizeof(StatsValue),
93 TEST_MAP_SIZE, 0));
94 ASSERT_VALID(mFakeStatsMapA);
95
96 mFakeConfigurationMap.reset(
97 createMap(BPF_MAP_TYPE_HASH, sizeof(uint32_t), sizeof(uint8_t), 1, 0));
98 ASSERT_VALID(mFakeConfigurationMap);
99
100 mFakeUidOwnerMap.reset(createMap(BPF_MAP_TYPE_HASH, sizeof(uint32_t), sizeof(UidOwnerValue),
101 TEST_MAP_SIZE, 0));
102 ASSERT_VALID(mFakeUidOwnerMap);
103 mFakeUidPermissionMap.reset(
104 createMap(BPF_MAP_TYPE_HASH, sizeof(uint32_t), sizeof(uint8_t), TEST_MAP_SIZE, 0));
105 ASSERT_VALID(mFakeUidPermissionMap);
106
107 mTc.mCookieTagMap.reset(dupFd(mFakeCookieTagMap.getMap()));
108 ASSERT_VALID(mTc.mCookieTagMap);
109 mTc.mUidCounterSetMap.reset(dupFd(mFakeUidCounterSetMap.getMap()));
110 ASSERT_VALID(mTc.mUidCounterSetMap);
111 mTc.mAppUidStatsMap.reset(dupFd(mFakeAppUidStatsMap.getMap()));
112 ASSERT_VALID(mTc.mAppUidStatsMap);
113 mTc.mStatsMapA.reset(dupFd(mFakeStatsMapA.getMap()));
114 ASSERT_VALID(mTc.mStatsMapA);
115 mTc.mConfigurationMap.reset(dupFd(mFakeConfigurationMap.getMap()));
116 ASSERT_VALID(mTc.mConfigurationMap);
117
118 // Always write to stats map A by default.
119 ASSERT_RESULT_OK(mTc.mConfigurationMap.writeValue(CURRENT_STATS_MAP_CONFIGURATION_KEY,
120 SELECT_MAP_A, BPF_ANY));
121 mTc.mUidOwnerMap.reset(dupFd(mFakeUidOwnerMap.getMap()));
122 ASSERT_VALID(mTc.mUidOwnerMap);
123 mTc.mUidPermissionMap.reset(dupFd(mFakeUidPermissionMap.getMap()));
124 ASSERT_VALID(mTc.mUidPermissionMap);
125 mTc.mPrivilegedUser.clear();
126 }
127
dupFd(const android::base::unique_fd & mapFd)128 int dupFd(const android::base::unique_fd& mapFd) {
129 return fcntl(mapFd.get(), F_DUPFD_CLOEXEC, 0);
130 }
131
setUpSocketAndTag(int protocol,uint64_t * cookie,uint32_t tag,uid_t uid,uid_t callingUid)132 int setUpSocketAndTag(int protocol, uint64_t* cookie, uint32_t tag, uid_t uid,
133 uid_t callingUid) {
134 int sock = socket(protocol, SOCK_STREAM | SOCK_CLOEXEC, 0);
135 EXPECT_LE(0, sock);
136 *cookie = getSocketCookie(sock);
137 EXPECT_NE(NONEXISTENT_COOKIE, *cookie);
138 EXPECT_EQ(0, mTc.tagSocket(sock, tag, uid, callingUid));
139 return sock;
140 }
141
expectUidTag(uint64_t cookie,uid_t uid,uint32_t tag)142 void expectUidTag(uint64_t cookie, uid_t uid, uint32_t tag) {
143 Result<UidTagValue> tagResult = mFakeCookieTagMap.readValue(cookie);
144 ASSERT_RESULT_OK(tagResult);
145 EXPECT_EQ(uid, tagResult.value().uid);
146 EXPECT_EQ(tag, tagResult.value().tag);
147 }
148
expectNoTag(uint64_t cookie)149 void expectNoTag(uint64_t cookie) { EXPECT_FALSE(mFakeCookieTagMap.readValue(cookie).ok()); }
150
populateFakeStats(uint64_t cookie,uint32_t uid,uint32_t tag,StatsKey * key)151 void populateFakeStats(uint64_t cookie, uint32_t uid, uint32_t tag, StatsKey* key) {
152 UidTagValue cookieMapkey = {.uid = (uint32_t)uid, .tag = tag};
153 EXPECT_RESULT_OK(mFakeCookieTagMap.writeValue(cookie, cookieMapkey, BPF_ANY));
154 *key = {.uid = uid, .tag = tag, .counterSet = TEST_COUNTERSET, .ifaceIndex = 1};
155 StatsValue statsMapValue = {.rxPackets = 1, .rxBytes = 100};
156 uint8_t counterSet = TEST_COUNTERSET;
157 EXPECT_RESULT_OK(mFakeUidCounterSetMap.writeValue(uid, counterSet, BPF_ANY));
158 EXPECT_RESULT_OK(mFakeStatsMapA.writeValue(*key, statsMapValue, BPF_ANY));
159 key->tag = 0;
160 EXPECT_RESULT_OK(mFakeStatsMapA.writeValue(*key, statsMapValue, BPF_ANY));
161 EXPECT_RESULT_OK(mFakeAppUidStatsMap.writeValue(uid, statsMapValue, BPF_ANY));
162 // put tag information back to statsKey
163 key->tag = tag;
164 }
165
checkUidOwnerRuleForChain(ChildChain chain,UidOwnerMatchType match)166 void checkUidOwnerRuleForChain(ChildChain chain, UidOwnerMatchType match) {
167 uint32_t uid = TEST_UID;
168 EXPECT_EQ(0, mTc.changeUidOwnerRule(chain, uid, DENY, BLACKLIST));
169 Result<UidOwnerValue> value = mFakeUidOwnerMap.readValue(uid);
170 EXPECT_RESULT_OK(value);
171 EXPECT_TRUE(value.value().rule & match);
172
173 uid = TEST_UID2;
174 EXPECT_EQ(0, mTc.changeUidOwnerRule(chain, uid, ALLOW, WHITELIST));
175 value = mFakeUidOwnerMap.readValue(uid);
176 EXPECT_RESULT_OK(value);
177 EXPECT_TRUE(value.value().rule & match);
178
179 EXPECT_EQ(0, mTc.changeUidOwnerRule(chain, uid, DENY, WHITELIST));
180 value = mFakeUidOwnerMap.readValue(uid);
181 EXPECT_FALSE(value.ok());
182 EXPECT_EQ(ENOENT, value.error().code());
183
184 uid = TEST_UID;
185 EXPECT_EQ(0, mTc.changeUidOwnerRule(chain, uid, ALLOW, BLACKLIST));
186 value = mFakeUidOwnerMap.readValue(uid);
187 EXPECT_FALSE(value.ok());
188 EXPECT_EQ(ENOENT, value.error().code());
189
190 uid = TEST_UID3;
191 EXPECT_EQ(-ENOENT, mTc.changeUidOwnerRule(chain, uid, ALLOW, BLACKLIST));
192 value = mFakeUidOwnerMap.readValue(uid);
193 EXPECT_FALSE(value.ok());
194 EXPECT_EQ(ENOENT, value.error().code());
195 }
196
checkEachUidValue(const std::vector<int32_t> & uids,UidOwnerMatchType match)197 void checkEachUidValue(const std::vector<int32_t>& uids, UidOwnerMatchType match) {
198 for (uint32_t uid : uids) {
199 Result<UidOwnerValue> value = mFakeUidOwnerMap.readValue(uid);
200 EXPECT_RESULT_OK(value);
201 EXPECT_TRUE(value.value().rule & match);
202 }
203 std::set<uint32_t> uidSet(uids.begin(), uids.end());
204 const auto checkNoOtherUid = [&uidSet](const int32_t& key,
205 const BpfMap<uint32_t, UidOwnerValue>&) {
206 EXPECT_NE(uidSet.end(), uidSet.find(key));
207 return Result<void>();
208 };
209 EXPECT_RESULT_OK(mFakeUidOwnerMap.iterate(checkNoOtherUid));
210 }
211
checkUidMapReplace(const std::string & name,const std::vector<int32_t> & uids,UidOwnerMatchType match)212 void checkUidMapReplace(const std::string& name, const std::vector<int32_t>& uids,
213 UidOwnerMatchType match) {
214 bool isWhitelist = true;
215 EXPECT_EQ(0, mTc.replaceUidOwnerMap(name, isWhitelist, uids));
216 checkEachUidValue(uids, match);
217
218 isWhitelist = false;
219 EXPECT_EQ(0, mTc.replaceUidOwnerMap(name, isWhitelist, uids));
220 checkEachUidValue(uids, match);
221 }
expectUidOwnerMapValues(const std::vector<std::string> & appStrUids,uint8_t expectedRule,uint32_t expectedIif)222 void expectUidOwnerMapValues(const std::vector<std::string>& appStrUids, uint8_t expectedRule,
223 uint32_t expectedIif) {
224 for (const std::string& strUid : appStrUids) {
225 uint32_t uid = stoi(strUid);
226 Result<UidOwnerValue> value = mFakeUidOwnerMap.readValue(uid);
227 EXPECT_RESULT_OK(value);
228 EXPECT_EQ(expectedRule, value.value().rule)
229 << "Expected rule for UID " << uid << " to be " << expectedRule << ", but was "
230 << value.value().rule;
231 EXPECT_EQ(expectedIif, value.value().iif)
232 << "Expected iif for UID " << uid << " to be " << expectedIif << ", but was "
233 << value.value().iif;
234 }
235 }
236
237 template <class Key, class Value>
expectMapEmpty(BpfMap<Key,Value> & map)238 void expectMapEmpty(BpfMap<Key, Value>& map) {
239 auto isEmpty = map.isEmpty();
240 EXPECT_RESULT_OK(isEmpty);
241 EXPECT_TRUE(isEmpty.value());
242 }
243
expectUidPermissionMapValues(const std::vector<uid_t> & appUids,uint8_t expectedValue)244 void expectUidPermissionMapValues(const std::vector<uid_t>& appUids, uint8_t expectedValue) {
245 for (uid_t uid : appUids) {
246 Result<uint8_t> value = mFakeUidPermissionMap.readValue(uid);
247 EXPECT_RESULT_OK(value);
248 EXPECT_EQ(expectedValue, value.value())
249 << "Expected value for UID " << uid << " to be " << expectedValue
250 << ", but was " << value.value();
251 }
252 }
253
expectPrivilegedUserSet(const std::vector<uid_t> & appUids)254 void expectPrivilegedUserSet(const std::vector<uid_t>& appUids) {
255 std::lock_guard guard(mTc.mMutex);
256 EXPECT_EQ(appUids.size(), mTc.mPrivilegedUser.size());
257 for (uid_t uid : appUids) {
258 EXPECT_NE(mTc.mPrivilegedUser.end(), mTc.mPrivilegedUser.find(uid));
259 }
260 }
261
expectPrivilegedUserSetEmpty()262 void expectPrivilegedUserSetEmpty() {
263 std::lock_guard guard(mTc.mMutex);
264 EXPECT_TRUE(mTc.mPrivilegedUser.empty());
265 }
266
addPrivilegedUid(uid_t uid)267 void addPrivilegedUid(uid_t uid) {
268 std::vector privilegedUid = {uid};
269 mTc.setPermissionForUids(INetd::PERMISSION_UPDATE_DEVICE_STATS, privilegedUid);
270 }
271
removePrivilegedUid(uid_t uid)272 void removePrivilegedUid(uid_t uid) {
273 std::vector privilegedUid = {uid};
274 mTc.setPermissionForUids(INetd::PERMISSION_NONE, privilegedUid);
275 }
276
expectFakeStatsUnchanged(uint64_t cookie,uint32_t tag,uint32_t uid,StatsKey tagStatsMapKey)277 void expectFakeStatsUnchanged(uint64_t cookie, uint32_t tag, uint32_t uid,
278 StatsKey tagStatsMapKey) {
279 Result<UidTagValue> cookieMapResult = mFakeCookieTagMap.readValue(cookie);
280 EXPECT_RESULT_OK(cookieMapResult);
281 EXPECT_EQ(uid, cookieMapResult.value().uid);
282 EXPECT_EQ(tag, cookieMapResult.value().tag);
283 Result<uint8_t> counterSetResult = mFakeUidCounterSetMap.readValue(uid);
284 EXPECT_RESULT_OK(counterSetResult);
285 EXPECT_EQ(TEST_COUNTERSET, counterSetResult.value());
286 Result<StatsValue> statsMapResult = mFakeStatsMapA.readValue(tagStatsMapKey);
287 EXPECT_RESULT_OK(statsMapResult);
288 EXPECT_EQ((uint64_t)1, statsMapResult.value().rxPackets);
289 EXPECT_EQ((uint64_t)100, statsMapResult.value().rxBytes);
290 tagStatsMapKey.tag = 0;
291 statsMapResult = mFakeStatsMapA.readValue(tagStatsMapKey);
292 EXPECT_RESULT_OK(statsMapResult);
293 EXPECT_EQ((uint64_t)1, statsMapResult.value().rxPackets);
294 EXPECT_EQ((uint64_t)100, statsMapResult.value().rxBytes);
295 auto appStatsResult = mFakeAppUidStatsMap.readValue(uid);
296 EXPECT_RESULT_OK(appStatsResult);
297 EXPECT_EQ((uint64_t)1, appStatsResult.value().rxPackets);
298 EXPECT_EQ((uint64_t)100, appStatsResult.value().rxBytes);
299 }
300
expectTagSocketReachLimit(uint32_t tag,uint32_t uid)301 void expectTagSocketReachLimit(uint32_t tag, uint32_t uid) {
302 int sock = socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0);
303 EXPECT_LE(0, sock);
304 if (sock < 0) return;
305 uint64_t sockCookie = getSocketCookie(sock);
306 EXPECT_NE(NONEXISTENT_COOKIE, sockCookie);
307 EXPECT_EQ(-EMFILE, mTc.tagSocket(sock, tag, uid, uid));
308 expectNoTag(sockCookie);
309
310 // Delete stats entries then tag socket success
311 EXPECT_EQ(0, mTc.deleteTagData(0, uid, 0));
312 EXPECT_EQ(0, mTc.tagSocket(sock, tag, uid, uid));
313 expectUidTag(sockCookie, uid, tag);
314 }
315 };
316
TEST_F(TrafficControllerTest,TestTagSocketV4)317 TEST_F(TrafficControllerTest, TestTagSocketV4) {
318 SKIP_IF_BPF_NOT_SUPPORTED;
319
320 uint64_t sockCookie;
321 int v4socket = setUpSocketAndTag(AF_INET, &sockCookie, TEST_TAG, TEST_UID, TEST_UID);
322 expectUidTag(sockCookie, TEST_UID, TEST_TAG);
323 ASSERT_EQ(0, mTc.untagSocket(v4socket));
324 expectNoTag(sockCookie);
325 expectMapEmpty(mFakeCookieTagMap);
326 }
327
TEST_F(TrafficControllerTest,TestReTagSocket)328 TEST_F(TrafficControllerTest, TestReTagSocket) {
329 SKIP_IF_BPF_NOT_SUPPORTED;
330
331 uint64_t sockCookie;
332 int v4socket = setUpSocketAndTag(AF_INET, &sockCookie, TEST_TAG, TEST_UID, TEST_UID);
333 expectUidTag(sockCookie, TEST_UID, TEST_TAG);
334 ASSERT_EQ(0, mTc.tagSocket(v4socket, TEST_TAG + 1, TEST_UID + 1, TEST_UID + 1));
335 expectUidTag(sockCookie, TEST_UID + 1, TEST_TAG + 1);
336 }
337
TEST_F(TrafficControllerTest,TestTagTwoSockets)338 TEST_F(TrafficControllerTest, TestTagTwoSockets) {
339 SKIP_IF_BPF_NOT_SUPPORTED;
340
341 uint64_t sockCookie1;
342 uint64_t sockCookie2;
343 int v4socket1 = setUpSocketAndTag(AF_INET, &sockCookie1, TEST_TAG, TEST_UID, TEST_UID);
344 setUpSocketAndTag(AF_INET, &sockCookie2, TEST_TAG, TEST_UID, TEST_UID);
345 expectUidTag(sockCookie1, TEST_UID, TEST_TAG);
346 expectUidTag(sockCookie2, TEST_UID, TEST_TAG);
347 ASSERT_EQ(0, mTc.untagSocket(v4socket1));
348 expectNoTag(sockCookie1);
349 expectUidTag(sockCookie2, TEST_UID, TEST_TAG);
350 ASSERT_FALSE(mFakeCookieTagMap.getNextKey(sockCookie2).ok());
351 }
352
TEST_F(TrafficControllerTest,TestTagSocketV6)353 TEST_F(TrafficControllerTest, TestTagSocketV6) {
354 SKIP_IF_BPF_NOT_SUPPORTED;
355
356 uint64_t sockCookie;
357 int v6socket = setUpSocketAndTag(AF_INET6, &sockCookie, TEST_TAG, TEST_UID, TEST_UID);
358 expectUidTag(sockCookie, TEST_UID, TEST_TAG);
359 ASSERT_EQ(0, mTc.untagSocket(v6socket));
360 expectNoTag(sockCookie);
361 expectMapEmpty(mFakeCookieTagMap);
362 }
363
TEST_F(TrafficControllerTest,TestTagInvalidSocket)364 TEST_F(TrafficControllerTest, TestTagInvalidSocket) {
365 SKIP_IF_BPF_NOT_SUPPORTED;
366
367 int invalidSocket = -1;
368 ASSERT_GT(0, mTc.tagSocket(invalidSocket, TEST_TAG, TEST_UID, TEST_UID));
369 expectMapEmpty(mFakeCookieTagMap);
370 }
371
TEST_F(TrafficControllerTest,TestTagSocketWithoutPermission)372 TEST_F(TrafficControllerTest, TestTagSocketWithoutPermission) {
373 SKIP_IF_BPF_NOT_SUPPORTED;
374
375 int sock = socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0);
376 ASSERT_NE(-1, sock);
377 ASSERT_EQ(-EPERM, mTc.tagSocket(sock, TEST_TAG, TEST_UID, TEST_UID2));
378 expectMapEmpty(mFakeCookieTagMap);
379 }
380
TEST_F(TrafficControllerTest,TestTagSocketWithPermission)381 TEST_F(TrafficControllerTest, TestTagSocketWithPermission) {
382 SKIP_IF_BPF_NOT_SUPPORTED;
383
384 // Grant permission to calling uid.
385 std::vector<uid_t> callingUid = {TEST_UID2};
386 mTc.setPermissionForUids(INetd::PERMISSION_UPDATE_DEVICE_STATS, callingUid);
387
388 // Tag a socket to a different uid other then callingUid.
389 uint64_t sockCookie;
390 int v6socket = setUpSocketAndTag(AF_INET6, &sockCookie, TEST_TAG, TEST_UID, TEST_UID2);
391 expectUidTag(sockCookie, TEST_UID, TEST_TAG);
392 EXPECT_EQ(0, mTc.untagSocket(v6socket));
393 expectNoTag(sockCookie);
394 expectMapEmpty(mFakeCookieTagMap);
395
396 // Clean up the permission
397 mTc.setPermissionForUids(INetd::PERMISSION_NONE, callingUid);
398 expectPrivilegedUserSetEmpty();
399 }
400
TEST_F(TrafficControllerTest,TestUntagInvalidSocket)401 TEST_F(TrafficControllerTest, TestUntagInvalidSocket) {
402 SKIP_IF_BPF_NOT_SUPPORTED;
403
404 int invalidSocket = -1;
405 ASSERT_GT(0, mTc.untagSocket(invalidSocket));
406 int v4socket = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
407 ASSERT_GT(0, mTc.untagSocket(v4socket));
408 expectMapEmpty(mFakeCookieTagMap);
409 }
410
TEST_F(TrafficControllerTest,TestTagSocketReachLimitFail)411 TEST_F(TrafficControllerTest, TestTagSocketReachLimitFail) {
412 SKIP_IF_BPF_NOT_SUPPORTED;
413
414 uid_t uid = TEST_UID;
415 StatsKey tagStatsMapKey[4];
416 for (int i = 0; i < 3; i++) {
417 uint64_t cookie = TEST_COOKIE + i;
418 uint32_t tag = TEST_TAG + i;
419 populateFakeStats(cookie, uid, tag, &tagStatsMapKey[i]);
420 }
421 expectTagSocketReachLimit(TEST_TAG, TEST_UID);
422 }
423
TEST_F(TrafficControllerTest,TestTagSocketReachTotalLimitFail)424 TEST_F(TrafficControllerTest, TestTagSocketReachTotalLimitFail) {
425 SKIP_IF_BPF_NOT_SUPPORTED;
426
427 StatsKey tagStatsMapKey[4];
428 for (int i = 0; i < 4; i++) {
429 uint64_t cookie = TEST_COOKIE + i;
430 uint32_t tag = TEST_TAG + i;
431 uid_t uid = TEST_UID + i;
432 populateFakeStats(cookie, uid, tag, &tagStatsMapKey[i]);
433 }
434 expectTagSocketReachLimit(TEST_TAG, TEST_UID);
435 }
436
TEST_F(TrafficControllerTest,TestSetCounterSet)437 TEST_F(TrafficControllerTest, TestSetCounterSet) {
438 SKIP_IF_BPF_NOT_SUPPORTED;
439
440 uid_t callingUid = TEST_UID2;
441 addPrivilegedUid(callingUid);
442 ASSERT_EQ(0, mTc.setCounterSet(TEST_COUNTERSET, TEST_UID, callingUid));
443 uid_t uid = TEST_UID;
444 Result<uint8_t> counterSetResult = mFakeUidCounterSetMap.readValue(uid);
445 ASSERT_RESULT_OK(counterSetResult);
446 ASSERT_EQ(TEST_COUNTERSET, counterSetResult.value());
447 ASSERT_EQ(0, mTc.setCounterSet(DEFAULT_COUNTERSET, TEST_UID, callingUid));
448 ASSERT_FALSE(mFakeUidCounterSetMap.readValue(uid).ok());
449 expectMapEmpty(mFakeUidCounterSetMap);
450 }
451
TEST_F(TrafficControllerTest,TestSetCounterSetWithoutPermission)452 TEST_F(TrafficControllerTest, TestSetCounterSetWithoutPermission) {
453 SKIP_IF_BPF_NOT_SUPPORTED;
454
455 ASSERT_EQ(-EPERM, mTc.setCounterSet(TEST_COUNTERSET, TEST_UID, TEST_UID2));
456 uid_t uid = TEST_UID;
457 ASSERT_FALSE(mFakeUidCounterSetMap.readValue(uid).ok());
458 expectMapEmpty(mFakeUidCounterSetMap);
459 }
460
TEST_F(TrafficControllerTest,TestSetInvalidCounterSet)461 TEST_F(TrafficControllerTest, TestSetInvalidCounterSet) {
462 SKIP_IF_BPF_NOT_SUPPORTED;
463
464 uid_t callingUid = TEST_UID2;
465 addPrivilegedUid(callingUid);
466 ASSERT_GT(0, mTc.setCounterSet(OVERFLOW_COUNTERSET, TEST_UID, callingUid));
467 uid_t uid = TEST_UID;
468 ASSERT_FALSE(mFakeUidCounterSetMap.readValue(uid).ok());
469 expectMapEmpty(mFakeUidCounterSetMap);
470 }
471
TEST_F(TrafficControllerTest,TestDeleteTagDataWithoutPermission)472 TEST_F(TrafficControllerTest, TestDeleteTagDataWithoutPermission) {
473 SKIP_IF_BPF_NOT_SUPPORTED;
474
475 uint64_t cookie = 1;
476 uid_t uid = TEST_UID;
477 uint32_t tag = TEST_TAG;
478 StatsKey tagStatsMapKey;
479 populateFakeStats(cookie, uid, tag, &tagStatsMapKey);
480 ASSERT_EQ(-EPERM, mTc.deleteTagData(0, TEST_UID, TEST_UID2));
481
482 expectFakeStatsUnchanged(cookie, tag, uid, tagStatsMapKey);
483 }
484
TEST_F(TrafficControllerTest,TestDeleteTagData)485 TEST_F(TrafficControllerTest, TestDeleteTagData) {
486 SKIP_IF_BPF_NOT_SUPPORTED;
487
488 uid_t callingUid = TEST_UID2;
489 addPrivilegedUid(callingUid);
490 uint64_t cookie = 1;
491 uid_t uid = TEST_UID;
492 uint32_t tag = TEST_TAG;
493 StatsKey tagStatsMapKey;
494 populateFakeStats(cookie, uid, tag, &tagStatsMapKey);
495 ASSERT_EQ(0, mTc.deleteTagData(TEST_TAG, TEST_UID, callingUid));
496 ASSERT_FALSE(mFakeCookieTagMap.readValue(cookie).ok());
497 Result<uint8_t> counterSetResult = mFakeUidCounterSetMap.readValue(uid);
498 ASSERT_RESULT_OK(counterSetResult);
499 ASSERT_EQ(TEST_COUNTERSET, counterSetResult.value());
500 ASSERT_FALSE(mFakeStatsMapA.readValue(tagStatsMapKey).ok());
501 tagStatsMapKey.tag = 0;
502 Result<StatsValue> statsMapResult = mFakeStatsMapA.readValue(tagStatsMapKey);
503 ASSERT_RESULT_OK(statsMapResult);
504 ASSERT_EQ((uint64_t)1, statsMapResult.value().rxPackets);
505 ASSERT_EQ((uint64_t)100, statsMapResult.value().rxBytes);
506 auto appStatsResult = mFakeAppUidStatsMap.readValue(TEST_UID);
507 ASSERT_RESULT_OK(appStatsResult);
508 ASSERT_EQ((uint64_t)1, appStatsResult.value().rxPackets);
509 ASSERT_EQ((uint64_t)100, appStatsResult.value().rxBytes);
510 }
511
TEST_F(TrafficControllerTest,TestDeleteAllUidData)512 TEST_F(TrafficControllerTest, TestDeleteAllUidData) {
513 SKIP_IF_BPF_NOT_SUPPORTED;
514
515 uid_t callingUid = TEST_UID2;
516 addPrivilegedUid(callingUid);
517 uint64_t cookie = 1;
518 uid_t uid = TEST_UID;
519 uint32_t tag = TEST_TAG;
520 StatsKey tagStatsMapKey;
521 populateFakeStats(cookie, uid, tag, &tagStatsMapKey);
522 ASSERT_EQ(0, mTc.deleteTagData(0, TEST_UID, callingUid));
523 ASSERT_FALSE(mFakeCookieTagMap.readValue(cookie).ok());
524 ASSERT_FALSE(mFakeUidCounterSetMap.readValue(uid).ok());
525 ASSERT_FALSE(mFakeStatsMapA.readValue(tagStatsMapKey).ok());
526 tagStatsMapKey.tag = 0;
527 ASSERT_FALSE(mFakeStatsMapA.readValue(tagStatsMapKey).ok());
528 ASSERT_FALSE(mFakeAppUidStatsMap.readValue(TEST_UID).ok());
529 }
530
TEST_F(TrafficControllerTest,TestDeleteDataWithTwoTags)531 TEST_F(TrafficControllerTest, TestDeleteDataWithTwoTags) {
532 SKIP_IF_BPF_NOT_SUPPORTED;
533
534 uid_t callingUid = TEST_UID2;
535 addPrivilegedUid(callingUid);
536 uint64_t cookie1 = 1;
537 uint64_t cookie2 = 2;
538 uid_t uid = TEST_UID;
539 uint32_t tag1 = TEST_TAG;
540 uint32_t tag2 = TEST_TAG + 1;
541 StatsKey tagStatsMapKey1;
542 StatsKey tagStatsMapKey2;
543 populateFakeStats(cookie1, uid, tag1, &tagStatsMapKey1);
544 populateFakeStats(cookie2, uid, tag2, &tagStatsMapKey2);
545 ASSERT_EQ(0, mTc.deleteTagData(TEST_TAG, TEST_UID, callingUid));
546 ASSERT_FALSE(mFakeCookieTagMap.readValue(cookie1).ok());
547 Result<UidTagValue> cookieMapResult = mFakeCookieTagMap.readValue(cookie2);
548 ASSERT_RESULT_OK(cookieMapResult);
549 ASSERT_EQ(TEST_UID, cookieMapResult.value().uid);
550 ASSERT_EQ(TEST_TAG + 1, cookieMapResult.value().tag);
551 Result<uint8_t> counterSetResult = mFakeUidCounterSetMap.readValue(uid);
552 ASSERT_RESULT_OK(counterSetResult);
553 ASSERT_EQ(TEST_COUNTERSET, counterSetResult.value());
554 ASSERT_FALSE(mFakeStatsMapA.readValue(tagStatsMapKey1).ok());
555 Result<StatsValue> statsMapResult = mFakeStatsMapA.readValue(tagStatsMapKey2);
556 ASSERT_RESULT_OK(statsMapResult);
557 ASSERT_EQ((uint64_t)1, statsMapResult.value().rxPackets);
558 ASSERT_EQ((uint64_t)100, statsMapResult.value().rxBytes);
559 }
560
TEST_F(TrafficControllerTest,TestDeleteDataWithTwoUids)561 TEST_F(TrafficControllerTest, TestDeleteDataWithTwoUids) {
562 SKIP_IF_BPF_NOT_SUPPORTED;
563
564 uid_t callingUid = TEST_UID2;
565 addPrivilegedUid(callingUid);
566 uint64_t cookie1 = 1;
567 uint64_t cookie2 = 2;
568 uid_t uid1 = TEST_UID;
569 uid_t uid2 = TEST_UID + 1;
570 uint32_t tag = TEST_TAG;
571 StatsKey tagStatsMapKey1;
572 StatsKey tagStatsMapKey2;
573 populateFakeStats(cookie1, uid1, tag, &tagStatsMapKey1);
574 populateFakeStats(cookie2, uid2, tag, &tagStatsMapKey2);
575
576 // Delete the stats of one of the uid. Check if it is properly collected by
577 // removedStats.
578 ASSERT_EQ(0, mTc.deleteTagData(0, uid2, callingUid));
579 ASSERT_FALSE(mFakeCookieTagMap.readValue(cookie2).ok());
580 Result<uint8_t> counterSetResult = mFakeUidCounterSetMap.readValue(uid1);
581 ASSERT_RESULT_OK(counterSetResult);
582 ASSERT_EQ(TEST_COUNTERSET, counterSetResult.value());
583 ASSERT_FALSE(mFakeUidCounterSetMap.readValue(uid2).ok());
584 ASSERT_FALSE(mFakeStatsMapA.readValue(tagStatsMapKey2).ok());
585 tagStatsMapKey2.tag = 0;
586 ASSERT_FALSE(mFakeStatsMapA.readValue(tagStatsMapKey2).ok());
587 ASSERT_FALSE(mFakeAppUidStatsMap.readValue(uid2).ok());
588 tagStatsMapKey1.tag = 0;
589 Result<StatsValue> statsMapResult = mFakeStatsMapA.readValue(tagStatsMapKey1);
590 ASSERT_RESULT_OK(statsMapResult);
591 ASSERT_EQ((uint64_t)1, statsMapResult.value().rxPackets);
592 ASSERT_EQ((uint64_t)100, statsMapResult.value().rxBytes);
593 auto appStatsResult = mFakeAppUidStatsMap.readValue(uid1);
594 ASSERT_RESULT_OK(appStatsResult);
595 ASSERT_EQ((uint64_t)1, appStatsResult.value().rxPackets);
596 ASSERT_EQ((uint64_t)100, appStatsResult.value().rxBytes);
597
598 // Delete the stats of the other uid.
599 ASSERT_EQ(0, mTc.deleteTagData(0, uid1, callingUid));
600 ASSERT_FALSE(mFakeStatsMapA.readValue(tagStatsMapKey1).ok());
601 ASSERT_FALSE(mFakeAppUidStatsMap.readValue(uid1).ok());
602 }
603
TEST_F(TrafficControllerTest,TestUpdateOwnerMapEntry)604 TEST_F(TrafficControllerTest, TestUpdateOwnerMapEntry) {
605 SKIP_IF_BPF_NOT_SUPPORTED;
606
607 uint32_t uid = TEST_UID;
608 ASSERT_TRUE(isOk(mTc.updateOwnerMapEntry(STANDBY_MATCH, uid, DENY, BLACKLIST)));
609 Result<UidOwnerValue> value = mFakeUidOwnerMap.readValue(uid);
610 ASSERT_RESULT_OK(value);
611 ASSERT_TRUE(value.value().rule & STANDBY_MATCH);
612
613 ASSERT_TRUE(isOk(mTc.updateOwnerMapEntry(DOZABLE_MATCH, uid, ALLOW, WHITELIST)));
614 value = mFakeUidOwnerMap.readValue(uid);
615 ASSERT_RESULT_OK(value);
616 ASSERT_TRUE(value.value().rule & DOZABLE_MATCH);
617
618 ASSERT_TRUE(isOk(mTc.updateOwnerMapEntry(DOZABLE_MATCH, uid, DENY, WHITELIST)));
619 value = mFakeUidOwnerMap.readValue(uid);
620 ASSERT_RESULT_OK(value);
621 ASSERT_FALSE(value.value().rule & DOZABLE_MATCH);
622
623 ASSERT_TRUE(isOk(mTc.updateOwnerMapEntry(STANDBY_MATCH, uid, ALLOW, BLACKLIST)));
624 ASSERT_FALSE(mFakeUidOwnerMap.readValue(uid).ok());
625
626 uid = TEST_UID2;
627 ASSERT_FALSE(isOk(mTc.updateOwnerMapEntry(STANDBY_MATCH, uid, ALLOW, BLACKLIST)));
628 ASSERT_FALSE(mFakeUidOwnerMap.readValue(uid).ok());
629 }
630
TEST_F(TrafficControllerTest,TestChangeUidOwnerRule)631 TEST_F(TrafficControllerTest, TestChangeUidOwnerRule) {
632 SKIP_IF_BPF_NOT_SUPPORTED;
633
634 checkUidOwnerRuleForChain(DOZABLE, DOZABLE_MATCH);
635 checkUidOwnerRuleForChain(STANDBY, STANDBY_MATCH);
636 checkUidOwnerRuleForChain(POWERSAVE, POWERSAVE_MATCH);
637 ASSERT_EQ(-EINVAL, mTc.changeUidOwnerRule(NONE, TEST_UID, ALLOW, WHITELIST));
638 ASSERT_EQ(-EINVAL, mTc.changeUidOwnerRule(INVALID_CHAIN, TEST_UID, ALLOW, WHITELIST));
639 }
640
TEST_F(TrafficControllerTest,TestReplaceUidOwnerMap)641 TEST_F(TrafficControllerTest, TestReplaceUidOwnerMap) {
642 SKIP_IF_BPF_NOT_SUPPORTED;
643
644 std::vector<int32_t> uids = {TEST_UID, TEST_UID2, TEST_UID3};
645 checkUidMapReplace("fw_dozable", uids, DOZABLE_MATCH);
646 checkUidMapReplace("fw_standby", uids, STANDBY_MATCH);
647 checkUidMapReplace("fw_powersave", uids, POWERSAVE_MATCH);
648 ASSERT_EQ(-EINVAL, mTc.replaceUidOwnerMap("unknow", true, uids));
649 }
650
TEST_F(TrafficControllerTest,TestReplaceSameChain)651 TEST_F(TrafficControllerTest, TestReplaceSameChain) {
652 SKIP_IF_BPF_NOT_SUPPORTED;
653
654 std::vector<int32_t> uids = {TEST_UID, TEST_UID2, TEST_UID3};
655 checkUidMapReplace("fw_dozable", uids, DOZABLE_MATCH);
656 std::vector<int32_t> newUids = {TEST_UID2, TEST_UID3};
657 checkUidMapReplace("fw_dozable", newUids, DOZABLE_MATCH);
658 }
659
TEST_F(TrafficControllerTest,TestBlacklistUidMatch)660 TEST_F(TrafficControllerTest, TestBlacklistUidMatch) {
661 SKIP_IF_BPF_NOT_SUPPORTED;
662
663 std::vector<std::string> appStrUids = {"1000", "1001", "10012"};
664 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReject,
665 BandwidthController::IptOpInsert)));
666 expectUidOwnerMapValues(appStrUids, PENALTY_BOX_MATCH, 0);
667 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReject,
668 BandwidthController::IptOpDelete)));
669 expectMapEmpty(mFakeUidOwnerMap);
670 }
671
TEST_F(TrafficControllerTest,TestWhitelistUidMatch)672 TEST_F(TrafficControllerTest, TestWhitelistUidMatch) {
673 SKIP_IF_BPF_NOT_SUPPORTED;
674
675 std::vector<std::string> appStrUids = {"1000", "1001", "10012"};
676 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReturn,
677 BandwidthController::IptOpInsert)));
678 expectUidOwnerMapValues(appStrUids, HAPPY_BOX_MATCH, 0);
679 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReturn,
680 BandwidthController::IptOpDelete)));
681 expectMapEmpty(mFakeUidOwnerMap);
682 }
683
TEST_F(TrafficControllerTest,TestReplaceMatchUid)684 TEST_F(TrafficControllerTest, TestReplaceMatchUid) {
685 SKIP_IF_BPF_NOT_SUPPORTED;
686
687 std::vector<std::string> appStrUids = {"1000", "1001", "10012"};
688 // Add appStrUids to the blacklist and expect that their values are all PENALTY_BOX_MATCH.
689 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReject,
690 BandwidthController::IptOpInsert)));
691 expectUidOwnerMapValues(appStrUids, PENALTY_BOX_MATCH, 0);
692
693 // Add the same UIDs to the whitelist and expect that we get PENALTY_BOX_MATCH |
694 // HAPPY_BOX_MATCH.
695 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReturn,
696 BandwidthController::IptOpInsert)));
697 expectUidOwnerMapValues(appStrUids, HAPPY_BOX_MATCH | PENALTY_BOX_MATCH, 0);
698
699 // Remove the same UIDs from the whitelist and check the PENALTY_BOX_MATCH is still there.
700 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReturn,
701 BandwidthController::IptOpDelete)));
702 expectUidOwnerMapValues(appStrUids, PENALTY_BOX_MATCH, 0);
703
704 // Remove the same UIDs from the blacklist and check the map is empty.
705 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReject,
706 BandwidthController::IptOpDelete)));
707 ASSERT_FALSE(mFakeUidOwnerMap.getFirstKey().ok());
708 }
709
TEST_F(TrafficControllerTest,TestDeleteWrongMatchSilentlyFails)710 TEST_F(TrafficControllerTest, TestDeleteWrongMatchSilentlyFails) {
711 SKIP_IF_BPF_NOT_SUPPORTED;
712
713 std::vector<std::string> appStrUids = {"1000", "1001", "10012"};
714 // If the uid does not exist in the map, trying to delete a rule about it will fail.
715 ASSERT_FALSE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReturn,
716 BandwidthController::IptOpDelete)));
717 expectMapEmpty(mFakeUidOwnerMap);
718
719 // Add blacklist rules for appStrUids.
720 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReturn,
721 BandwidthController::IptOpInsert)));
722 expectUidOwnerMapValues(appStrUids, HAPPY_BOX_MATCH, 0);
723
724 // Delete (non-existent) blacklist rules for appStrUids, and check that this silently does
725 // nothing if the uid is in the map but does not have blacklist match. This is required because
726 // NetworkManagementService will try to remove a uid from blacklist after adding it to the
727 // whitelist and if the remove fails it will not update the uid status.
728 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap(appStrUids, BandwidthController::IptJumpReject,
729 BandwidthController::IptOpDelete)));
730 expectUidOwnerMapValues(appStrUids, HAPPY_BOX_MATCH, 0);
731 }
732
TEST_F(TrafficControllerTest,TestAddUidInterfaceFilteringRules)733 TEST_F(TrafficControllerTest, TestAddUidInterfaceFilteringRules) {
734 SKIP_IF_BPF_NOT_SUPPORTED;
735
736 int iif0 = 15;
737 ASSERT_TRUE(isOk(mTc.addUidInterfaceRules(iif0, {1000, 1001})));
738 expectUidOwnerMapValues({"1000", "1001"}, IIF_MATCH, iif0);
739
740 // Add some non-overlapping new uids. They should coexist with existing rules
741 int iif1 = 16;
742 ASSERT_TRUE(isOk(mTc.addUidInterfaceRules(iif1, {2000, 2001})));
743 expectUidOwnerMapValues({"1000", "1001"}, IIF_MATCH, iif0);
744 expectUidOwnerMapValues({"2000", "2001"}, IIF_MATCH, iif1);
745
746 // Overwrite some existing uids
747 int iif2 = 17;
748 ASSERT_TRUE(isOk(mTc.addUidInterfaceRules(iif2, {1000, 2000})));
749 expectUidOwnerMapValues({"1001"}, IIF_MATCH, iif0);
750 expectUidOwnerMapValues({"2001"}, IIF_MATCH, iif1);
751 expectUidOwnerMapValues({"1000", "2000"}, IIF_MATCH, iif2);
752 }
753
TEST_F(TrafficControllerTest,TestRemoveUidInterfaceFilteringRules)754 TEST_F(TrafficControllerTest, TestRemoveUidInterfaceFilteringRules) {
755 SKIP_IF_BPF_NOT_SUPPORTED;
756
757 int iif0 = 15;
758 int iif1 = 16;
759 ASSERT_TRUE(isOk(mTc.addUidInterfaceRules(iif0, {1000, 1001})));
760 ASSERT_TRUE(isOk(mTc.addUidInterfaceRules(iif1, {2000, 2001})));
761 expectUidOwnerMapValues({"1000", "1001"}, IIF_MATCH, iif0);
762 expectUidOwnerMapValues({"2000", "2001"}, IIF_MATCH, iif1);
763
764 // Rmove some uids
765 ASSERT_TRUE(isOk(mTc.removeUidInterfaceRules({1001, 2001})));
766 expectUidOwnerMapValues({"1000"}, IIF_MATCH, iif0);
767 expectUidOwnerMapValues({"2000"}, IIF_MATCH, iif1);
768 checkEachUidValue({1000, 2000}, IIF_MATCH); // Make sure there are only two uids remaining
769
770 // Remove non-existent uids shouldn't fail
771 ASSERT_TRUE(isOk(mTc.removeUidInterfaceRules({2000, 3000})));
772 expectUidOwnerMapValues({"1000"}, IIF_MATCH, iif0);
773 checkEachUidValue({1000}, IIF_MATCH); // Make sure there are only one uid remaining
774
775 // Remove everything
776 ASSERT_TRUE(isOk(mTc.removeUidInterfaceRules({1000})));
777 expectMapEmpty(mFakeUidOwnerMap);
778 }
779
TEST_F(TrafficControllerTest,TestUidInterfaceFilteringRulesCoexistWithExistingMatches)780 TEST_F(TrafficControllerTest, TestUidInterfaceFilteringRulesCoexistWithExistingMatches) {
781 SKIP_IF_BPF_NOT_SUPPORTED;
782
783 // Set up existing PENALTY_BOX_MATCH rules
784 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap({"1000", "1001", "10012"},
785 BandwidthController::IptJumpReject,
786 BandwidthController::IptOpInsert)));
787 expectUidOwnerMapValues({"1000", "1001", "10012"}, PENALTY_BOX_MATCH, 0);
788
789 // Add some partially-overlapping uid owner rules and check result
790 int iif1 = 32;
791 ASSERT_TRUE(isOk(mTc.addUidInterfaceRules(iif1, {10012, 10013, 10014})));
792 expectUidOwnerMapValues({"1000", "1001"}, PENALTY_BOX_MATCH, 0);
793 expectUidOwnerMapValues({"10012"}, PENALTY_BOX_MATCH | IIF_MATCH, iif1);
794 expectUidOwnerMapValues({"10013", "10014"}, IIF_MATCH, iif1);
795
796 // Removing some PENALTY_BOX_MATCH rules should not change uid interface rule
797 ASSERT_TRUE(isOk(mTc.updateUidOwnerMap({"1001", "10012"}, BandwidthController::IptJumpReject,
798 BandwidthController::IptOpDelete)));
799 expectUidOwnerMapValues({"1000"}, PENALTY_BOX_MATCH, 0);
800 expectUidOwnerMapValues({"10012", "10013", "10014"}, IIF_MATCH, iif1);
801
802 // Remove all uid interface rules
803 ASSERT_TRUE(isOk(mTc.removeUidInterfaceRules({10012, 10013, 10014})));
804 expectUidOwnerMapValues({"1000"}, PENALTY_BOX_MATCH, 0);
805 // Make sure these are the only uids left
806 checkEachUidValue({1000}, PENALTY_BOX_MATCH);
807 }
808
TEST_F(TrafficControllerTest,TestUidInterfaceFilteringRulesCoexistWithNewMatches)809 TEST_F(TrafficControllerTest, TestUidInterfaceFilteringRulesCoexistWithNewMatches) {
810 SKIP_IF_BPF_NOT_SUPPORTED;
811
812 int iif1 = 56;
813 // Set up existing uid interface rules
814 ASSERT_TRUE(isOk(mTc.addUidInterfaceRules(iif1, {10001, 10002})));
815 expectUidOwnerMapValues({"10001", "10002"}, IIF_MATCH, iif1);
816
817 // Add some partially-overlapping doze rules
818 EXPECT_EQ(0, mTc.replaceUidOwnerMap("fw_dozable", true, {10002, 10003}));
819 expectUidOwnerMapValues({"10001"}, IIF_MATCH, iif1);
820 expectUidOwnerMapValues({"10002"}, DOZABLE_MATCH | IIF_MATCH, iif1);
821 expectUidOwnerMapValues({"10003"}, DOZABLE_MATCH, 0);
822
823 // Introduce a third rule type (powersave) on various existing UIDs
824 EXPECT_EQ(0, mTc.replaceUidOwnerMap("fw_powersave", true, {10000, 10001, 10002, 10003}));
825 expectUidOwnerMapValues({"10000"}, POWERSAVE_MATCH, 0);
826 expectUidOwnerMapValues({"10001"}, POWERSAVE_MATCH | IIF_MATCH, iif1);
827 expectUidOwnerMapValues({"10002"}, POWERSAVE_MATCH | DOZABLE_MATCH | IIF_MATCH, iif1);
828 expectUidOwnerMapValues({"10003"}, POWERSAVE_MATCH | DOZABLE_MATCH, 0);
829
830 // Remove all doze rules
831 EXPECT_EQ(0, mTc.replaceUidOwnerMap("fw_dozable", true, {}));
832 expectUidOwnerMapValues({"10000"}, POWERSAVE_MATCH, 0);
833 expectUidOwnerMapValues({"10001"}, POWERSAVE_MATCH | IIF_MATCH, iif1);
834 expectUidOwnerMapValues({"10002"}, POWERSAVE_MATCH | IIF_MATCH, iif1);
835 expectUidOwnerMapValues({"10003"}, POWERSAVE_MATCH, 0);
836
837 // Remove all powersave rules, expect ownerMap to only have uid interface rules left
838 EXPECT_EQ(0, mTc.replaceUidOwnerMap("fw_powersave", true, {}));
839 expectUidOwnerMapValues({"10001", "10002"}, IIF_MATCH, iif1);
840 // Make sure these are the only uids left
841 checkEachUidValue({10001, 10002}, IIF_MATCH);
842 }
843
TEST_F(TrafficControllerTest,TestGrantInternetPermission)844 TEST_F(TrafficControllerTest, TestGrantInternetPermission) {
845 SKIP_IF_BPF_NOT_SUPPORTED;
846
847 std::vector<uid_t> appUids = {TEST_UID, TEST_UID2, TEST_UID3};
848
849 mTc.setPermissionForUids(INetd::PERMISSION_INTERNET, appUids);
850 expectMapEmpty(mFakeUidPermissionMap);
851 expectPrivilegedUserSetEmpty();
852 }
853
TEST_F(TrafficControllerTest,TestRevokeInternetPermission)854 TEST_F(TrafficControllerTest, TestRevokeInternetPermission) {
855 SKIP_IF_BPF_NOT_SUPPORTED;
856
857 std::vector<uid_t> appUids = {TEST_UID, TEST_UID2, TEST_UID3};
858
859 mTc.setPermissionForUids(INetd::PERMISSION_NONE, appUids);
860 expectUidPermissionMapValues(appUids, INetd::PERMISSION_NONE);
861 }
862
TEST_F(TrafficControllerTest,TestPermissionUninstalled)863 TEST_F(TrafficControllerTest, TestPermissionUninstalled) {
864 SKIP_IF_BPF_NOT_SUPPORTED;
865
866 std::vector<uid_t> appUids = {TEST_UID, TEST_UID2, TEST_UID3};
867
868 mTc.setPermissionForUids(INetd::PERMISSION_UPDATE_DEVICE_STATS, appUids);
869 expectUidPermissionMapValues(appUids, INetd::PERMISSION_UPDATE_DEVICE_STATS);
870 expectPrivilegedUserSet(appUids);
871
872 std::vector<uid_t> uidToRemove = {TEST_UID};
873 mTc.setPermissionForUids(INetd::PERMISSION_UNINSTALLED, uidToRemove);
874
875 std::vector<uid_t> uidRemain = {TEST_UID3, TEST_UID2};
876 expectUidPermissionMapValues(uidRemain, INetd::PERMISSION_UPDATE_DEVICE_STATS);
877 expectPrivilegedUserSet(uidRemain);
878
879 mTc.setPermissionForUids(INetd::PERMISSION_UNINSTALLED, uidRemain);
880 expectMapEmpty(mFakeUidPermissionMap);
881 expectPrivilegedUserSetEmpty();
882 }
883
TEST_F(TrafficControllerTest,TestGrantUpdateStatsPermission)884 TEST_F(TrafficControllerTest, TestGrantUpdateStatsPermission) {
885 SKIP_IF_BPF_NOT_SUPPORTED;
886
887 std::vector<uid_t> appUids = {TEST_UID, TEST_UID2, TEST_UID3};
888
889 mTc.setPermissionForUids(INetd::PERMISSION_UPDATE_DEVICE_STATS, appUids);
890 expectUidPermissionMapValues(appUids, INetd::PERMISSION_UPDATE_DEVICE_STATS);
891 expectPrivilegedUserSet(appUids);
892
893 mTc.setPermissionForUids(INetd::PERMISSION_NONE, appUids);
894 expectPrivilegedUserSetEmpty();
895 expectUidPermissionMapValues(appUids, INetd::PERMISSION_NONE);
896 }
897
TEST_F(TrafficControllerTest,TestRevokeUpdateStatsPermission)898 TEST_F(TrafficControllerTest, TestRevokeUpdateStatsPermission) {
899 SKIP_IF_BPF_NOT_SUPPORTED;
900
901 std::vector<uid_t> appUids = {TEST_UID, TEST_UID2, TEST_UID3};
902
903 mTc.setPermissionForUids(INetd::PERMISSION_UPDATE_DEVICE_STATS, appUids);
904 expectPrivilegedUserSet(appUids);
905
906 std::vector<uid_t> uidToRemove = {TEST_UID};
907 mTc.setPermissionForUids(INetd::PERMISSION_NONE, uidToRemove);
908
909 std::vector<uid_t> uidRemain = {TEST_UID3, TEST_UID2};
910 expectPrivilegedUserSet(uidRemain);
911
912 mTc.setPermissionForUids(INetd::PERMISSION_NONE, uidRemain);
913 expectPrivilegedUserSetEmpty();
914 }
915
TEST_F(TrafficControllerTest,TestGrantWrongPermission)916 TEST_F(TrafficControllerTest, TestGrantWrongPermission) {
917 SKIP_IF_BPF_NOT_SUPPORTED;
918
919 std::vector<uid_t> appUids = {TEST_UID, TEST_UID2, TEST_UID3};
920
921 mTc.setPermissionForUids(INetd::PERMISSION_NONE, appUids);
922 expectPrivilegedUserSetEmpty();
923 expectUidPermissionMapValues(appUids, INetd::PERMISSION_NONE);
924 }
925
TEST_F(TrafficControllerTest,TestGrantDuplicatePermissionSlientlyFail)926 TEST_F(TrafficControllerTest, TestGrantDuplicatePermissionSlientlyFail) {
927 SKIP_IF_BPF_NOT_SUPPORTED;
928
929 std::vector<uid_t> appUids = {TEST_UID, TEST_UID2, TEST_UID3};
930
931 mTc.setPermissionForUids(INetd::PERMISSION_INTERNET, appUids);
932 expectMapEmpty(mFakeUidPermissionMap);
933
934 std::vector<uid_t> uidToAdd = {TEST_UID};
935 mTc.setPermissionForUids(INetd::PERMISSION_INTERNET, uidToAdd);
936
937 expectPrivilegedUserSetEmpty();
938
939 mTc.setPermissionForUids(INetd::PERMISSION_NONE, appUids);
940 expectUidPermissionMapValues(appUids, INetd::PERMISSION_NONE);
941
942 mTc.setPermissionForUids(INetd::PERMISSION_UPDATE_DEVICE_STATS, appUids);
943 expectPrivilegedUserSet(appUids);
944
945 mTc.setPermissionForUids(INetd::PERMISSION_UPDATE_DEVICE_STATS, uidToAdd);
946 expectPrivilegedUserSet(appUids);
947
948 mTc.setPermissionForUids(INetd::PERMISSION_NONE, appUids);
949 expectPrivilegedUserSetEmpty();
950 }
951
952 } // namespace net
953 } // namespace android
954