1 /*
2 * Copyright 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * ControllersTest.cpp - unit tests for Controllers.cpp
17 */
18
19 #include <set>
20 #include <string>
21 #include <vector>
22
23 #include <gmock/gmock.h>
24 #include <gtest/gtest.h>
25
26 #include <android-base/strings.h>
27
28 #include "Controllers.h"
29 #include "IptablesBaseTest.h"
30
31 using testing::ContainerEq;
32
33 namespace android {
34 namespace net {
35
36 class ControllersTest : public IptablesBaseTest {
37 public:
ControllersTest()38 ControllersTest() {
39 Controllers::execIptablesRestore = fakeExecIptablesRestore;
40 Controllers::execIptablesRestoreWithOutput = fakeExecIptablesRestoreWithOutput;
41 }
42
43 protected:
initChildChains()44 void initChildChains() { Controllers::initChildChains(); };
findExistingChildChains(IptablesTarget a,const char * b,const char * c)45 std::set<std::string> findExistingChildChains(IptablesTarget a, const char* b, const char*c) {
46 return Controllers::findExistingChildChains(a, b, c);
47 }
48 };
49
TEST_F(ControllersTest,TestFindExistingChildChains)50 TEST_F(ControllersTest, TestFindExistingChildChains) {
51 ExpectedIptablesCommands expectedCmds = {
52 { V6, "*raw\n-S PREROUTING\nCOMMIT\n" },
53 };
54 sIptablesRestoreOutput.push_back(
55 "-P PREROUTING ACCEPT\n"
56 "-A PREROUTING -j bw_raw_PREROUTING\n"
57 "-A PREROUTING -j idletimer_raw_PREROUTING\n"
58 "-A PREROUTING -j tetherctrl_raw_PREROUTING\n"
59 );
60 std::set<std::string> expectedChains = {
61 "bw_raw_PREROUTING",
62 "idletimer_raw_PREROUTING",
63 "tetherctrl_raw_PREROUTING",
64 };
65 std::set<std::string> actual = findExistingChildChains(V6, "raw", "PREROUTING");
66 EXPECT_THAT(expectedChains, ContainerEq(actual));
67 expectIptablesRestoreCommands(expectedCmds);
68 }
69
TEST_F(ControllersTest,TestInitIptablesRules)70 TEST_F(ControllersTest, TestInitIptablesRules) {
71 // Test what happens when we boot and there are no rules.
72 ExpectedIptablesCommands expected = {
73 {V4V6,
74 "*filter\n"
75 ":INPUT -\n"
76 "-F INPUT\n"
77 ":bw_INPUT -\n"
78 "-A INPUT -j bw_INPUT\n"
79 ":fw_INPUT -\n"
80 "-A INPUT -j fw_INPUT\n"
81 "COMMIT\n"},
82 {V4V6,
83 "*filter\n"
84 ":FORWARD -\n"
85 "-F FORWARD\n"
86 ":oem_fwd -\n"
87 "-A FORWARD -j oem_fwd\n"
88 ":fw_FORWARD -\n"
89 "-A FORWARD -j fw_FORWARD\n"
90 ":bw_FORWARD -\n"
91 "-A FORWARD -j bw_FORWARD\n"
92 ":tetherctrl_FORWARD -\n"
93 "-A FORWARD -j tetherctrl_FORWARD\n"
94 "COMMIT\n"},
95 {V4V6,
96 "*raw\n"
97 ":PREROUTING -\n"
98 "-F PREROUTING\n"
99 ":clat_raw_PREROUTING -\n"
100 "-A PREROUTING -j clat_raw_PREROUTING\n"
101 ":bw_raw_PREROUTING -\n"
102 "-A PREROUTING -j bw_raw_PREROUTING\n"
103 ":idletimer_raw_PREROUTING -\n"
104 "-A PREROUTING -j idletimer_raw_PREROUTING\n"
105 ":tetherctrl_raw_PREROUTING -\n"
106 "-A PREROUTING -j tetherctrl_raw_PREROUTING\n"
107 "COMMIT\n"},
108 {V4V6,
109 "*mangle\n"
110 ":FORWARD -\n"
111 "-F FORWARD\n"
112 ":tetherctrl_mangle_FORWARD -\n"
113 "-A FORWARD -j tetherctrl_mangle_FORWARD\n"
114 "COMMIT\n"},
115 {V4V6,
116 "*mangle\n"
117 ":INPUT -\n"
118 "-F INPUT\n"
119 ":wakeupctrl_mangle_INPUT -\n"
120 "-A INPUT -j wakeupctrl_mangle_INPUT\n"
121 ":routectrl_mangle_INPUT -\n"
122 "-A INPUT -j routectrl_mangle_INPUT\n"
123 "COMMIT\n"},
124 {V4,
125 "*nat\n"
126 ":PREROUTING -\n"
127 "-F PREROUTING\n"
128 ":oem_nat_pre -\n"
129 "-A PREROUTING -j oem_nat_pre\n"
130 "COMMIT\n"},
131 {V4,
132 "*nat\n"
133 ":POSTROUTING -\n"
134 "-F POSTROUTING\n"
135 ":tetherctrl_nat_POSTROUTING -\n"
136 "-A POSTROUTING -j tetherctrl_nat_POSTROUTING\n"
137 "COMMIT\n"},
138 {V4,
139 "*filter\n"
140 "-S OUTPUT\n"
141 "COMMIT\n"},
142 {V4,
143 "*filter\n"
144 ":oem_out -\n"
145 "-A OUTPUT -j oem_out\n"
146 ":fw_OUTPUT -\n"
147 "-A OUTPUT -j fw_OUTPUT\n"
148 ":st_OUTPUT -\n"
149 "-A OUTPUT -j st_OUTPUT\n"
150 ":bw_OUTPUT -\n"
151 "-A OUTPUT -j bw_OUTPUT\n"
152 "COMMIT\n"},
153 {V6,
154 "*filter\n"
155 "-S OUTPUT\n"
156 "COMMIT\n"},
157 {V6,
158 "*filter\n"
159 ":oem_out -\n"
160 "-A OUTPUT -j oem_out\n"
161 ":fw_OUTPUT -\n"
162 "-A OUTPUT -j fw_OUTPUT\n"
163 ":st_OUTPUT -\n"
164 "-A OUTPUT -j st_OUTPUT\n"
165 ":bw_OUTPUT -\n"
166 "-A OUTPUT -j bw_OUTPUT\n"
167 "COMMIT\n"},
168 {V4,
169 "*mangle\n"
170 "-S POSTROUTING\n"
171 "COMMIT\n"},
172 {V4,
173 "*mangle\n"
174 ":oem_mangle_post -\n"
175 "-A POSTROUTING -j oem_mangle_post\n"
176 ":bw_mangle_POSTROUTING -\n"
177 "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
178 ":idletimer_mangle_POSTROUTING -\n"
179 "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
180 "COMMIT\n"},
181 {V6,
182 "*mangle\n"
183 "-S POSTROUTING\n"
184 "COMMIT\n"},
185 {V6,
186 "*mangle\n"
187 ":oem_mangle_post -\n"
188 "-A POSTROUTING -j oem_mangle_post\n"
189 ":bw_mangle_POSTROUTING -\n"
190 "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
191 ":idletimer_mangle_POSTROUTING -\n"
192 "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
193 "COMMIT\n"},
194 };
195
196 // Check that we run these commands and these only.
197 initChildChains();
198 expectIptablesRestoreCommands(expected);
199 expectIptablesRestoreCommands(ExpectedIptablesCommands{});
200
201 // Now test what happens when some rules exist (e.g., if we crash and restart).
202
203 // First, explicitly tell the iptables test code to return empty output to all the commands we
204 // send. This allows us to tell it to return non-empty output to particular commands in the
205 // following code.
206 for (size_t i = 0; i < expected.size(); i++) {
207 sIptablesRestoreOutput.push_back("");
208 }
209
210 // Define a macro to remove a substring from a string. We use a macro instead of a function so
211 // we can assert in it. In the following code, we use ASSERT_* to check for programming errors
212 // in the test code, and EXPECT_* to check for errors in the actual code.
213 #define DELETE_SUBSTRING(substr, str) { \
214 size_t start = (str).find((substr)); \
215 ASSERT_NE(std::string::npos, start); \
216 (str).erase(start, strlen((substr))); \
217 ASSERT_EQ(std::string::npos, (str).find((substr))); \
218 }
219
220 // Now set test expectations.
221
222 // 1. Test that if we find rules that we don't create ourselves, we ignore them.
223 // First check that command #7 is where we list the OUTPUT chain in the (IPv4) filter table:
224 ASSERT_NE(std::string::npos, expected[7].second.find("*filter\n-S OUTPUT\n"));
225 // ... and pretend that when we run that command, we find the following rules. Because we don't
226 // create any of these rules ourselves, our behaviour is unchanged.
227 sIptablesRestoreOutput[7] =
228 "-P OUTPUT ACCEPT\n"
229 "-A OUTPUT -o r_rmnet_data8 -p udp -m udp --dport 1900 -j DROP\n";
230
231 // 2. Test that rules that we create ourselves are not added if they already exist.
232 // Pretend that when we list the OUTPUT chain in the (IPv6) filter table, we find the oem_out
233 // and st_OUTPUT chains:
234 ASSERT_NE(std::string::npos, expected[9].second.find("*filter\n-S OUTPUT\n"));
235 sIptablesRestoreOutput[9] =
236 "-A OUTPUT -j oem_out\n"
237 "-A OUTPUT -j st_OUTPUT\n";
238 // ... and expect that when we populate the OUTPUT chain, we do not re-add them.
239 DELETE_SUBSTRING("-A OUTPUT -j oem_out\n", expected[10].second);
240 DELETE_SUBSTRING("-A OUTPUT -j st_OUTPUT\n", expected[10].second);
241
242 // 3. Now test that when we list the POSTROUTING chain in the mangle table, we find a mixture of
243 // netd-created rules and vendor rules:
244 ASSERT_NE(std::string::npos, expected[13].second.find("*mangle\n-S POSTROUTING\n"));
245 sIptablesRestoreOutput[13] =
246 "-P POSTROUTING ACCEPT\n"
247 "-A POSTROUTING -j oem_mangle_post\n"
248 "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
249 "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
250 "-A POSTROUTING -j qcom_qos_reset_POSTROUTING\n"
251 "-A POSTROUTING -j qcom_qos_filter_POSTROUTING\n";
252 // and expect that we don't re-add the netd-created rules that already exist.
253 DELETE_SUBSTRING("-A POSTROUTING -j oem_mangle_post\n", expected[14].second);
254 DELETE_SUBSTRING("-A POSTROUTING -j bw_mangle_POSTROUTING\n", expected[14].second);
255 DELETE_SUBSTRING("-A POSTROUTING -j idletimer_mangle_POSTROUTING\n", expected[14].second);
256
257 // In this last case, also check that our expectations are reasonable.
258 std::string expectedCmd14 =
259 "*mangle\n"
260 ":oem_mangle_post -\n"
261 ":bw_mangle_POSTROUTING -\n"
262 ":idletimer_mangle_POSTROUTING -\n"
263 "COMMIT\n";
264 ASSERT_EQ(expectedCmd14, expected[14].second);
265
266 // Finally, actually test that initChildChains runs the expected commands, and nothing more.
267 initChildChains();
268 expectIptablesRestoreCommands(expected);
269 expectIptablesRestoreCommands(ExpectedIptablesCommands{});
270 }
271
272 } // namespace net
273 } // namespace android
274