1 /*
2 * Copyright 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * binder_test.cpp - unit tests for netd binder RPCs.
17 */
18
19 #include <algorithm>
20 #include <cerrno>
21 #include <chrono>
22 #include <cinttypes>
23 #include <condition_variable>
24 #include <cstdint>
25 #include <cstdlib>
26 #include <iostream>
27 #include <mutex>
28 #include <numeric>
29 #include <regex>
30 #include <set>
31 #include <string>
32 #include <vector>
33
34 #include <dirent.h>
35 #include <fcntl.h>
36 #include <ifaddrs.h>
37 #include <linux/if.h>
38 #include <linux/if_tun.h>
39 #include <net/ethernet.h>
40 #include <net/if.h>
41 #include <netdb.h>
42 #include <netinet/in.h>
43 #include <netinet/tcp.h>
44 #include <openssl/base64.h>
45 #include <sys/socket.h>
46 #include <sys/types.h>
47
48 #include <android-base/file.h>
49 #include <android-base/format.h>
50 #include <android-base/macros.h>
51 #include <android-base/scopeguard.h>
52 #include <android-base/stringprintf.h>
53 #include <android-base/strings.h>
54 #include <android-base/test_utils.h>
55 #include <android/multinetwork.h>
56 #include <binder/IPCThreadState.h>
57 #include <bpf/KernelUtils.h>
58 #include <com/android/internal/net/BnOemNetdUnsolicitedEventListener.h>
59 #include <com/android/internal/net/IOemNetd.h>
60 #include <cutils/multiuser.h>
61 #include <gtest/gtest.h>
62 #include <netdutils/NetNativeTestBase.h>
63 #include <netutils/ifc.h>
64 #include <utils/Errors.h>
65 #include "Fwmark.h"
66 #include "InterfaceController.h"
67 #include "NetdClient.h"
68 #include "NetdConstants.h"
69 #include "NetworkController.h"
70 #include "RouteController.h"
71 #include "SockDiag.h"
72 #include "TestUnsolService.h"
73 #include "XfrmController.h"
74 #include "android/net/INetd.h"
75 #include "android/net/mdns/aidl/BnMDnsEventListener.h"
76 #include "android/net/mdns/aidl/DiscoveryInfo.h"
77 #include "android/net/mdns/aidl/GetAddressInfo.h"
78 #include "android/net/mdns/aidl/IMDns.h"
79 #include "android/net/mdns/aidl/RegistrationInfo.h"
80 #include "android/net/mdns/aidl/ResolutionInfo.h"
81 #include "binder/IServiceManager.h"
82 #include "netdutils/InternetAddresses.h"
83 #include "netdutils/Stopwatch.h"
84 #include "netdutils/Syscalls.h"
85 #include "netdutils/Utils.h"
86 #include "netid_client.h" // NETID_UNSET
87 #include "nettestutils/DumpService.h"
88 #include "test_utils.h"
89 #include "tun_interface.h"
90
91 #define IP6TABLES_PATH "/system/bin/ip6tables"
92 #define IPTABLES_PATH "/system/bin/iptables"
93 #define RAW_TABLE "raw"
94 #define MANGLE_TABLE "mangle"
95 #define FILTER_TABLE "filter"
96 #define NAT_TABLE "nat"
97
98 namespace binder = android::binder;
99
100 using android::IBinder;
101 using android::IServiceManager;
102 using android::sp;
103 using android::String16;
104 using android::String8;
105 using android::base::Join;
106 using android::base::make_scope_guard;
107 using android::base::ReadFileToString;
108 using android::base::StartsWith;
109 using android::base::StringPrintf;
110 using android::base::Trim;
111 using android::base::unique_fd;
112 using android::binder::Status;
113 using android::bpf::isAtLeastKernelVersion;
114 using android::net::INetd;
115 using android::net::InterfaceConfigurationParcel;
116 using android::net::InterfaceController;
117 using android::net::MarkMaskParcel;
118 using android::net::NativeNetworkConfig;
119 using android::net::NativeNetworkType;
120 using android::net::NativeVpnType;
121 using android::net::NetworkController;
122 using android::net::RULE_PRIORITY_BYPASSABLE_VPN_LOCAL_EXCLUSION;
123 using android::net::RULE_PRIORITY_BYPASSABLE_VPN_NO_LOCAL_EXCLUSION;
124 using android::net::RULE_PRIORITY_DEFAULT_NETWORK;
125 using android::net::RULE_PRIORITY_EXPLICIT_NETWORK;
126 using android::net::RULE_PRIORITY_LOCAL_NETWORK;
127 using android::net::RULE_PRIORITY_LOCAL_ROUTES;
128 using android::net::RULE_PRIORITY_OUTPUT_INTERFACE;
129 using android::net::RULE_PRIORITY_PROHIBIT_NON_VPN;
130 using android::net::RULE_PRIORITY_SECURE_VPN;
131 using android::net::RULE_PRIORITY_TETHERING;
132 using android::net::RULE_PRIORITY_UID_DEFAULT_NETWORK;
133 using android::net::RULE_PRIORITY_UID_DEFAULT_UNREACHABLE;
134 using android::net::RULE_PRIORITY_UID_EXPLICIT_NETWORK;
135 using android::net::RULE_PRIORITY_UID_IMPLICIT_NETWORK;
136 using android::net::RULE_PRIORITY_UID_LOCAL_ROUTES;
137 using android::net::RULE_PRIORITY_VPN_FALLTHROUGH;
138 using android::net::SockDiag;
139 using android::net::TetherOffloadRuleParcel;
140 using android::net::TetherStatsParcel;
141 using android::net::TunInterface;
142 using android::net::UidRangeParcel;
143 using android::net::UidRanges;
144 using android::net::mdns::aidl::DiscoveryInfo;
145 using android::net::mdns::aidl::GetAddressInfo;
146 using android::net::mdns::aidl::IMDns;
147 using android::net::mdns::aidl::RegistrationInfo;
148 using android::net::mdns::aidl::ResolutionInfo;
149 using android::net::netd::aidl::NativeUidRangeConfig;
150 using android::netdutils::getIfaceNames;
151 using android::netdutils::IPAddress;
152 using android::netdutils::IPSockAddr;
153 using android::netdutils::ScopedAddrinfo;
154 using android::netdutils::sSyscalls;
155 using android::netdutils::Stopwatch;
156
157 static const char* IP_RULE_V4 = "-4";
158 static const char* IP_RULE_V6 = "-6";
159 static const int TEST_NETID1 = 65501;
160 static const int TEST_NETID2 = 65502;
161 static const int TEST_NETID3 = 65503;
162 static const int TEST_NETID4 = 65504;
163 static const int TEST_DUMP_NETID = 65123;
164 static const char* DNSMASQ = "dnsmasq";
165
166 // Use maximum reserved appId for applications to avoid conflict with existing
167 // uids.
168 static const int TEST_UID1 = 99999;
169 static const int TEST_UID2 = 99998;
170 static const int TEST_UID3 = 99997;
171 static const int TEST_UID4 = 99996;
172 static const int TEST_UID5 = 99995;
173 static const int TEST_UID6 = 99994;
174
175 constexpr int BASE_UID = AID_USER_OFFSET * 5;
176
177 static const std::string NO_SOCKET_ALLOW_RULE("! owner UID match 0-4294967294");
178 static const std::string ESP_ALLOW_RULE("esp");
179
180 static const in6_addr V6_ADDR = {
181 {// 2001:db8:cafe::8888
182 .u6_addr8 = {0x20, 0x01, 0x0d, 0xb8, 0xca, 0xfe, 0, 0, 0, 0, 0, 0, 0, 0, 0x88, 0x88}}};
183
184 typedef enum { ALL_EXIST, NONE_EXIST } ExistMode;
185
186 class NetdBinderTest : public NetNativeTestBase {
187 public:
NetdBinderTest()188 NetdBinderTest() {
189 sp<IServiceManager> sm = android::defaultServiceManager();
190 sp<IBinder> binder = sm->getService(String16("netd"));
191 if (binder != nullptr) {
192 mNetd = android::interface_cast<INetd>(binder);
193 }
194 }
195
SetUp()196 void SetUp() override {
197 ASSERT_NE(nullptr, mNetd.get());
198 }
199
TearDown()200 void TearDown() override {
201 mNetd->networkDestroy(TEST_NETID1);
202 mNetd->networkDestroy(TEST_NETID2);
203 mNetd->networkDestroy(TEST_NETID3);
204 mNetd->networkDestroy(TEST_NETID4);
205 setNetworkForProcess(NETID_UNSET);
206 // Restore default network
207 if (mStoredDefaultNetwork >= 0) mNetd->networkSetDefault(mStoredDefaultNetwork);
208 }
209
210 bool allocateIpSecResources(bool expectOk, int32_t* spi);
211
212 // Static because setting up the tun interface takes about 40ms.
SetUpTestCase()213 static void SetUpTestCase() {
214 ASSERT_EQ(0, sTun.init());
215 ASSERT_EQ(0, sTun2.init());
216 ASSERT_EQ(0, sTun3.init());
217 ASSERT_EQ(0, sTun4.init());
218 ASSERT_LE(sTun.name().size(), static_cast<size_t>(IFNAMSIZ));
219 ASSERT_LE(sTun2.name().size(), static_cast<size_t>(IFNAMSIZ));
220 ASSERT_LE(sTun3.name().size(), static_cast<size_t>(IFNAMSIZ));
221 ASSERT_LE(sTun4.name().size(), static_cast<size_t>(IFNAMSIZ));
222 }
223
TearDownTestCase()224 static void TearDownTestCase() {
225 // Closing the socket removes the interface and IP addresses.
226 sTun.destroy();
227 sTun2.destroy();
228 sTun3.destroy();
229 sTun4.destroy();
230 }
231
232 static void fakeRemoteSocketPair(unique_fd* clientSocket, unique_fd* serverSocket,
233 unique_fd* acceptedSocket);
234
235 void createVpnNetworkWithUid(bool secure, uid_t uid, int vpnNetId = TEST_NETID2,
236 int fallthroughNetId = TEST_NETID1,
237 int nonDefaultNetId = TEST_NETID3);
238
239 void createAndSetDefaultNetwork(int netId, const std::string& interface,
240 int permission = INetd::PERMISSION_NONE);
241
242 void createPhysicalNetwork(int netId, const std::string& interface,
243 int permission = INetd::PERMISSION_NONE);
244
245 void createDefaultAndOtherPhysicalNetwork(int defaultNetId, int otherNetId);
246
247 void createVpnAndOtherPhysicalNetwork(int systemDefaultNetId, int otherNetId, int vpnNetId,
248 bool secure);
249
250 void createVpnAndAppDefaultNetworkWithUid(int systemDefaultNetId, int appDefaultNetId,
251 int vpnNetId, bool secure,
252 std::vector<UidRangeParcel>&& appDefaultUidRanges,
253 std::vector<UidRangeParcel>&& vpnUidRanges);
254
255 void setupNetworkRoutesForVpnAndDefaultNetworks(
256 int systemDefaultNetId, int appDefaultNetId, int vpnNetId, int otherNetId, bool secure,
257 bool testV6, bool differentLocalRoutes,
258 std::vector<UidRangeParcel>&& appDefaultUidRanges,
259 std::vector<UidRangeParcel>&& vpnUidRanges);
260
261 protected:
262 // Use -1 to represent that default network was not modified because
263 // real netId must be an unsigned value.
264 int mStoredDefaultNetwork = -1;
265 sp<INetd> mNetd;
266 static TunInterface sTun;
267 static TunInterface sTun2;
268 static TunInterface sTun3;
269 static TunInterface sTun4;
270 };
271
272 TunInterface NetdBinderTest::sTun;
273 TunInterface NetdBinderTest::sTun2;
274 TunInterface NetdBinderTest::sTun3;
275 TunInterface NetdBinderTest::sTun4;
276
277 class TimedOperation : public Stopwatch {
278 public:
TimedOperation(const std::string & name)279 explicit TimedOperation(const std::string &name): mName(name) {}
~TimedOperation()280 virtual ~TimedOperation() {
281 std::cerr << " " << mName << ": " << timeTakenUs() << "us" << std::endl;
282 }
283
284 private:
285 std::string mName;
286 };
287
TEST_F(NetdBinderTest,IsAlive)288 TEST_F(NetdBinderTest, IsAlive) {
289 TimedOperation t("isAlive RPC");
290 bool isAlive = false;
291 mNetd->isAlive(&isAlive);
292 ASSERT_TRUE(isAlive);
293 }
294
295 namespace {
296
makeNativeNetworkConfig(int netId,NativeNetworkType networkType,int permission,bool secure,bool excludeLocalRoutes)297 NativeNetworkConfig makeNativeNetworkConfig(int netId, NativeNetworkType networkType,
298 int permission, bool secure, bool excludeLocalRoutes) {
299 NativeNetworkConfig config = {};
300 config.netId = netId;
301 config.networkType = networkType;
302 config.permission = permission;
303 config.secure = secure;
304 // The vpnType doesn't matter in AOSP. Just pick a well defined one from INetd.
305 config.vpnType = NativeVpnType::PLATFORM;
306 config.excludeLocalRoutes = excludeLocalRoutes;
307 return config;
308 }
309
310 } // namespace
311
testNetworkExistsButCannotConnect(const sp<INetd> & netd,TunInterface & ifc,const int netId)312 bool testNetworkExistsButCannotConnect(const sp<INetd>& netd, TunInterface& ifc, const int netId) {
313 // If this network exists, we should definitely not be able to create it.
314 // Note that this networkCreate is never allowed to create reserved network IDs, so
315 // this call may fail for other reasons than the network already existing.
316 const auto& config = makeNativeNetworkConfig(netId, NativeNetworkType::PHYSICAL,
317 INetd::PERMISSION_NONE, false, false);
318 EXPECT_FALSE(netd->networkCreate(config).isOk());
319 // Test if the network exist by adding interface. INetd has no dedicated method to query. When
320 // the network exists and the interface can be added, the function succeeds. When the network
321 // exists but the interface cannot be added, it fails with EINVAL, otherwise it is ENONET.
322 binder::Status status = netd->networkAddInterface(netId, ifc.name());
323 if (status.isOk()) { // clean up
324 EXPECT_TRUE(netd->networkRemoveInterface(netId, ifc.name()).isOk());
325 } else if (status.serviceSpecificErrorCode() == ENONET) {
326 return false;
327 }
328
329 const sockaddr_in6 sin6 = {.sin6_family = AF_INET6,
330 .sin6_addr = {{.u6_addr32 = {htonl(0x20010db8), 0, 0, 0}}},
331 .sin6_port = 53};
332 const int s = socket(AF_INET6, SOCK_DGRAM, 0);
333 EXPECT_NE(-1, s);
334 if (s == -1) return true;
335 Fwmark fwmark;
336 fwmark.explicitlySelected = true;
337 fwmark.netId = netId;
338 EXPECT_EQ(0, setsockopt(s, SOL_SOCKET, SO_MARK, &fwmark.intValue, sizeof(fwmark.intValue)));
339 const int ret = connect(s, (struct sockaddr*)&sin6, sizeof(sin6));
340 const int err = errno;
341 EXPECT_EQ(-1, ret);
342 EXPECT_EQ(ENETUNREACH, err);
343 close(s);
344 return true;
345 }
346
TEST_F(NetdBinderTest,InitialNetworksExist)347 TEST_F(NetdBinderTest, InitialNetworksExist) {
348 EXPECT_TRUE(testNetworkExistsButCannotConnect(mNetd, sTun, INetd::DUMMY_NET_ID));
349 EXPECT_TRUE(testNetworkExistsButCannotConnect(mNetd, sTun, INetd::LOCAL_NET_ID));
350 EXPECT_TRUE(testNetworkExistsButCannotConnect(mNetd, sTun, INetd::UNREACHABLE_NET_ID));
351 EXPECT_FALSE(testNetworkExistsButCannotConnect(mNetd, sTun, 77 /* not exist */));
352 }
353
TEST_F(NetdBinderTest,IpSecTunnelInterface)354 TEST_F(NetdBinderTest, IpSecTunnelInterface) {
355 const struct TestData {
356 const std::string family;
357 const std::string deviceName;
358 const std::string localAddress;
359 const std::string remoteAddress;
360 int32_t iKey;
361 int32_t oKey;
362 int32_t ifId;
363 } kTestData[] = {
364 {"IPV4", "ipsec_test", "127.0.0.1", "8.8.8.8", 0x1234 + 53, 0x1234 + 53, 0xFFFE},
365 {"IPV6", "ipsec_test6", "::1", "2001:4860:4860::8888", 0x1234 + 50, 0x1234 + 50,
366 0xFFFE},
367 };
368
369 for (size_t i = 0; i < std::size(kTestData); i++) {
370 const auto& td = kTestData[i];
371
372 binder::Status status;
373
374 // Create Tunnel Interface.
375 status = mNetd->ipSecAddTunnelInterface(td.deviceName, td.localAddress, td.remoteAddress,
376 td.iKey, td.oKey, td.ifId);
377 EXPECT_TRUE(status.isOk()) << td.family << status.exceptionMessage();
378
379 // Check that the interface exists
380 EXPECT_NE(0U, if_nametoindex(td.deviceName.c_str()));
381
382 // Update Tunnel Interface.
383 status = mNetd->ipSecUpdateTunnelInterface(td.deviceName, td.localAddress, td.remoteAddress,
384 td.iKey, td.oKey, td.ifId);
385 EXPECT_TRUE(status.isOk()) << td.family << status.exceptionMessage();
386
387 // Remove Tunnel Interface.
388 status = mNetd->ipSecRemoveTunnelInterface(td.deviceName);
389 EXPECT_TRUE(status.isOk()) << td.family << status.exceptionMessage();
390
391 // Check that the interface no longer exists
392 EXPECT_EQ(0U, if_nametoindex(td.deviceName.c_str()));
393 }
394 }
395
TEST_F(NetdBinderTest,IpSecSetEncapSocketOwner)396 TEST_F(NetdBinderTest, IpSecSetEncapSocketOwner) {
397 unique_fd uniqueFd(socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0));
398 android::os::ParcelFileDescriptor sockFd(std::move(uniqueFd));
399
400 int sockOptVal = UDP_ENCAP_ESPINUDP;
401 setsockopt(sockFd.get(), IPPROTO_UDP, UDP_ENCAP, &sockOptVal, sizeof(sockOptVal));
402
403 binder::Status res = mNetd->ipSecSetEncapSocketOwner(sockFd, 1001);
404 EXPECT_TRUE(res.isOk());
405
406 struct stat info;
407 EXPECT_EQ(0, fstat(sockFd.get(), &info));
408 EXPECT_EQ(1001, (int) info.st_uid);
409 }
410
411 // IPsec tests are not run in 32 bit mode; both 32-bit kernels and
412 // mismatched ABIs (64-bit kernel with 32-bit userspace) are unsupported.
413 #if INTPTR_MAX != INT32_MAX
414
415 using android::net::XfrmController;
416
417 static const int XFRM_DIRECTIONS[] = {static_cast<int>(android::net::XfrmDirection::IN),
418 static_cast<int>(android::net::XfrmDirection::OUT)};
419 static const int ADDRESS_FAMILIES[] = {AF_INET, AF_INET6};
420
421 #define RETURN_FALSE_IF_NEQ(_expect_, _ret_) \
422 do { if ((_expect_) != (_ret_)) return false; } while(false)
allocateIpSecResources(bool expectOk,int32_t * spi)423 bool NetdBinderTest::allocateIpSecResources(bool expectOk, int32_t* spi) {
424 android::netdutils::Status status = XfrmController::ipSecAllocateSpi(0, "::", "::1", 123, spi);
425 SCOPED_TRACE(status);
426 RETURN_FALSE_IF_NEQ(status.ok(), expectOk);
427
428 // Add a policy
429 status = XfrmController::ipSecAddSecurityPolicy(0, AF_INET6, 0, "::", "::1", 123, 0, 0, 0);
430 SCOPED_TRACE(status);
431 RETURN_FALSE_IF_NEQ(status.ok(), expectOk);
432
433 // Add an ipsec interface
434 return expectOk == XfrmController::ipSecAddTunnelInterface("ipsec_test", "::", "::1", 0xF00D,
435 0xD00D, 0xE00D, false)
436 .ok();
437 }
438
TEST_F(NetdBinderTest,XfrmDualSelectorTunnelModePoliciesV4)439 TEST_F(NetdBinderTest, XfrmDualSelectorTunnelModePoliciesV4) {
440 android::binder::Status status;
441
442 // Repeat to ensure cleanup and recreation works correctly
443 for (int i = 0; i < 2; i++) {
444 for (int direction : XFRM_DIRECTIONS) {
445 for (int addrFamily : ADDRESS_FAMILIES) {
446 status = mNetd->ipSecAddSecurityPolicy(0, addrFamily, direction, "127.0.0.5",
447 "127.0.0.6", 123, 0, 0, 0);
448 EXPECT_TRUE(status.isOk())
449 << " family: " << addrFamily << " direction: " << direction;
450 }
451 }
452
453 // Cleanup
454 for (int direction : XFRM_DIRECTIONS) {
455 for (int addrFamily : ADDRESS_FAMILIES) {
456 status = mNetd->ipSecDeleteSecurityPolicy(0, addrFamily, direction, 0, 0, 0);
457 EXPECT_TRUE(status.isOk());
458 }
459 }
460 }
461 }
462
TEST_F(NetdBinderTest,XfrmDualSelectorTunnelModePoliciesV6)463 TEST_F(NetdBinderTest, XfrmDualSelectorTunnelModePoliciesV6) {
464 binder::Status status;
465
466 // Repeat to ensure cleanup and recreation works correctly
467 for (int i = 0; i < 2; i++) {
468 for (int direction : XFRM_DIRECTIONS) {
469 for (int addrFamily : ADDRESS_FAMILIES) {
470 status = mNetd->ipSecAddSecurityPolicy(0, addrFamily, direction, "2001:db8::f00d",
471 "2001:db8::d00d", 123, 0, 0, 0);
472 EXPECT_TRUE(status.isOk())
473 << " family: " << addrFamily << " direction: " << direction;
474 }
475 }
476
477 // Cleanup
478 for (int direction : XFRM_DIRECTIONS) {
479 for (int addrFamily : ADDRESS_FAMILIES) {
480 status = mNetd->ipSecDeleteSecurityPolicy(0, addrFamily, direction, 0, 0, 0);
481 EXPECT_TRUE(status.isOk());
482 }
483 }
484 }
485 }
486
TEST_F(NetdBinderTest,XfrmControllerInit)487 TEST_F(NetdBinderTest, XfrmControllerInit) {
488 android::netdutils::Status status;
489 status = XfrmController::Init();
490 SCOPED_TRACE(status);
491
492 // Older devices or devices with mismatched Kernel/User ABI cannot support the IPsec
493 // feature.
494 if (status.code() == EOPNOTSUPP) return;
495
496 ASSERT_TRUE(status.ok());
497
498 int32_t spi = 0;
499
500 ASSERT_TRUE(allocateIpSecResources(true, &spi));
501 ASSERT_TRUE(allocateIpSecResources(false, &spi));
502
503 status = XfrmController::Init();
504 ASSERT_TRUE(status.ok());
505 ASSERT_TRUE(allocateIpSecResources(true, &spi));
506
507 // Clean up
508 status = XfrmController::ipSecDeleteSecurityAssociation(0, "::", "::1", 123, spi, 0, 0);
509 SCOPED_TRACE(status);
510 ASSERT_TRUE(status.ok());
511
512 status = XfrmController::ipSecDeleteSecurityPolicy(0, AF_INET6, 0, 0, 0, 0);
513 SCOPED_TRACE(status);
514 ASSERT_TRUE(status.ok());
515
516 // Remove Virtual Tunnel Interface.
517 ASSERT_TRUE(XfrmController::ipSecRemoveTunnelInterface("ipsec_test").ok());
518 }
519
520 // Two kernel fixes have been added in 5.17 to allow XFRM_MIGRATE to work correctly
521 // when (1) there are multiple tunnels with the same selectors; and (2) addresses
522 // are updated to a different IP family. These two fixes were pulled into upstream
523 // LTS releases 4.14.273, 4.19.236, 5.4.186, 5.10.107 and 5.15.30, from whence they
524 // flowed into the Android Common Kernel (via standard LTS merges).
525 // As such we require 4.14.273+, 4.19.236+, 5.4.186+, 5.10.107+, 5.15.30+ and 5.17+
526 // to have these fixes.
hasXfrmMigrateKernelFixes()527 bool hasXfrmMigrateKernelFixes() {
528 return (isAtLeastKernelVersion(4, 14, 273) && !isAtLeastKernelVersion(4, 19, 0)) ||
529 (isAtLeastKernelVersion(4, 19, 236) && !isAtLeastKernelVersion(5, 4, 0)) ||
530 (isAtLeastKernelVersion(5, 4, 186) && !isAtLeastKernelVersion(5, 10, 0)) ||
531 (isAtLeastKernelVersion(5, 10, 107) && !isAtLeastKernelVersion(5, 15, 0)) ||
532 isAtLeastKernelVersion(5, 15, 30);
533 }
534
535 // Does the kernel support CONFIG_XFRM_MIGRATE and include the kernel fixes?
supportsXfrmMigrate()536 bool supportsXfrmMigrate() {
537 if (!hasXfrmMigrateKernelFixes()) return false;
538
539 // 5.10+ VINTF requires CONFIG_XFRM_MIGRATE enabled
540 if (isAtLeastKernelVersion(5, 10, 0)) return true;
541
542 const std::string wildcardAddr = "::";
543
544 // Expect migration to fail with EINVAL because it is trying to migrate a
545 // non-existent SA.
546 auto status = XfrmController::ipSecMigrate(
547 0 /* resourceId */, AF_INET6, 0 /* direction == out */,
548 wildcardAddr /* sourceAddress */, wildcardAddr /* destinationAddress */,
549 wildcardAddr /* newSourceAddress */, wildcardAddr /* newDestinationAddress */,
550 0 /* xfrmInterfaceId */);
551
552 if (android::netdutils::equalToErrno(status, EINVAL)) {
553 return true;
554 } else if (android::netdutils::equalToErrno(status, ENOPROTOOPT)) {
555 return false;
556 } else {
557 GTEST_LOG_(WARNING) << "Unexpected migration result: "
558 << android::netdutils::toString(status)
559 << "Assuming XFRM_MIGRATE is enabled.";
560 return true;
561 }
562 }
563
564 #define SKIP_IF_XFRM_MIGRATE_NOT_SUPPORTED \
565 do { \
566 if (!supportsXfrmMigrate()) \
567 GTEST_SKIP() << "This test is skipped since xfrm migrate feature " \
568 << "not supported\n"; \
569 } while (0)
570
TEST_F(NetdBinderTest,XfrmMigrate)571 TEST_F(NetdBinderTest, XfrmMigrate) {
572 SKIP_IF_XFRM_MIGRATE_NOT_SUPPORTED;
573
574 static const struct TestData {
575 const int32_t addrFamily;
576 const int32_t newAddrFamily;
577 const std::string srcAddr;
578 const std::string dstAddr;
579 const std::string newSrcAddr;
580 const std::string newDstAddr;
581 } kTestData[] = {
582 {AF_INET, AF_INET, "192.0.2.1", "192.0.2.2", "192.0.2.101", "192.0.2.102"},
583 {AF_INET, AF_INET6, "192.0.2.1", "192.0.2.2", "2001:db8::101", "2001:db8::102"},
584 {AF_INET6, AF_INET6, "2001:db8::1", "2001:db8::2", "2001:db8::101", "2001:db8::102"},
585 {AF_INET6, AF_INET, "2001:db8::1", "2001:db8::2", "192.0.2.101", "192.0.2.102"},
586 };
587
588 const int32_t xfrmInterfaceId = 0xFFFE;
589 const std::string tunnelDeviceName = "ipsec_test";
590
591 auto status = mNetd->ipSecAddTunnelInterface(tunnelDeviceName, "2001:db8::fe", "2001:db8::ff",
592 0x1234 + 50 /* iKey */, 0x1234 + 50 /* oKey */,
593 xfrmInterfaceId);
594
595 SCOPED_TRACE(status);
596 ASSERT_TRUE(status.isOk());
597
598 for (auto& td : kTestData) {
599 const int32_t direction = static_cast<int>(android::net::XfrmDirection::OUT);
600 const int32_t resourceId = 0;
601 const int32_t spiReq = 123;
602 int32_t spi = 0;
603
604 status = mNetd->ipSecAllocateSpi(resourceId, td.srcAddr, td.dstAddr, spiReq, &spi);
605 SCOPED_TRACE(status);
606 ASSERT_TRUE(status.isOk());
607
608 status = mNetd->ipSecAddSecurityAssociation(
609 resourceId, static_cast<int32_t>(android::net::XfrmMode::TUNNEL), td.srcAddr,
610 td.dstAddr, 100 /* underlyingNetid */, spiReq, 0 /* markValue */, 0 /* markMask */,
611 "digest_null" /* authAlgo */, {} /* authKey */, 0 /* authTruncBits */,
612 "ecb(cipher_null)" /* cryptAlgo */, {} /* cryptKey */, 0 /* cryptTruncBits */,
613 "" /* aeadAlgo */, {} /* aeadKey */, 0 /* aeadIcvBits */,
614 0 /* encapType == ENCAP_NONE */, 0 /* encapLocalPort */, 0 /* encapRemotePort */,
615 xfrmInterfaceId);
616 SCOPED_TRACE(status);
617 ASSERT_TRUE(status.isOk());
618
619 for (int addrFamily : ADDRESS_FAMILIES) {
620 // Add a policy
621 status = mNetd->ipSecAddSecurityPolicy(resourceId, addrFamily, direction, td.srcAddr,
622 td.dstAddr, spiReq, 0 /* markValue */,
623 0 /* markMask */, xfrmInterfaceId);
624 SCOPED_TRACE(status);
625 ASSERT_TRUE(status.isOk());
626
627 // Migrate tunnel mode SA
628 android::net::IpSecMigrateInfoParcel parcel;
629 parcel.requestId = resourceId;
630 parcel.selAddrFamily = addrFamily;
631 parcel.direction = direction;
632 parcel.oldSourceAddress = td.srcAddr;
633 parcel.oldDestinationAddress = td.dstAddr;
634 parcel.newSourceAddress = td.newSrcAddr;
635 parcel.newDestinationAddress = td.newDstAddr;
636 parcel.interfaceId = xfrmInterfaceId;
637
638 status = mNetd->ipSecMigrate(parcel);
639 SCOPED_TRACE(status);
640 ASSERT_TRUE(status.isOk());
641 }
642
643 // Clean up
644 status = mNetd->ipSecDeleteSecurityAssociation(resourceId, td.newSrcAddr, td.newDstAddr,
645 spiReq, 0 /* markValue */, 0 /* markMask */,
646 xfrmInterfaceId);
647 SCOPED_TRACE(status);
648 ASSERT_TRUE(status.isOk());
649
650 for (int addrFamily : ADDRESS_FAMILIES) {
651 status = mNetd->ipSecDeleteSecurityPolicy(resourceId, addrFamily, direction,
652 0 /* markValue */, 0 /* markMask */,
653 xfrmInterfaceId);
654 SCOPED_TRACE(status);
655 ASSERT_TRUE(status.isOk());
656 }
657 }
658
659 // Remove Tunnel Interface.
660 status = mNetd->ipSecRemoveTunnelInterface(tunnelDeviceName);
661 SCOPED_TRACE(status);
662 EXPECT_TRUE(status.isOk());
663 }
664 #endif // INTPTR_MAX != INT32_MAX
665
bandwidthDataSaverEnabled(const char * binary)666 static int bandwidthDataSaverEnabled(const char *binary) {
667 std::vector<std::string> lines = listIptablesRule(binary, "bw_data_saver");
668
669 // Output looks like this:
670 //
671 // Chain bw_data_saver (1 references)
672 // target prot opt source destination
673 // RETURN all -- 0.0.0.0/0 0.0.0.0/0
674 //
675 // or:
676 //
677 // Chain bw_data_saver (1 references)
678 // target prot opt source destination
679 // ... possibly connectivity critical packet rules here ...
680 // REJECT all -- ::/0 ::/0
681
682 EXPECT_GE(lines.size(), 3U);
683
684 if (lines.size() == 3 && StartsWith(lines[2], "RETURN ")) {
685 // Data saver disabled.
686 return 0;
687 }
688
689 size_t minSize = (std::string(binary) == IPTABLES_PATH) ? 3 : 9;
690
691 if (lines.size() >= minSize && StartsWith(lines[lines.size() -1], "REJECT ")) {
692 // Data saver enabled.
693 return 1;
694 }
695
696 return -1;
697 }
698
enableDataSaver(sp<INetd> & netd,bool enable)699 bool enableDataSaver(sp<INetd>& netd, bool enable) {
700 TimedOperation op(enable ? " Enabling data saver" : "Disabling data saver");
701 bool ret;
702 netd->bandwidthEnableDataSaver(enable, &ret);
703 return ret;
704 }
705
getDataSaverState()706 int getDataSaverState() {
707 const int enabled4 = bandwidthDataSaverEnabled(IPTABLES_PATH);
708 const int enabled6 = bandwidthDataSaverEnabled(IP6TABLES_PATH);
709 EXPECT_EQ(enabled4, enabled6);
710 EXPECT_NE(-1, enabled4);
711 EXPECT_NE(-1, enabled6);
712 if (enabled4 != enabled6 || (enabled6 != 0 && enabled6 != 1)) {
713 return -1;
714 }
715 return enabled6;
716 }
717
TEST_F(NetdBinderTest,BandwidthEnableDataSaver)718 TEST_F(NetdBinderTest, BandwidthEnableDataSaver) {
719 const int wasEnabled = getDataSaverState();
720 ASSERT_NE(-1, wasEnabled);
721
722 if (wasEnabled) {
723 ASSERT_TRUE(enableDataSaver(mNetd, false));
724 EXPECT_EQ(0, getDataSaverState());
725 }
726
727 ASSERT_TRUE(enableDataSaver(mNetd, false));
728 EXPECT_EQ(0, getDataSaverState());
729
730 ASSERT_TRUE(enableDataSaver(mNetd, true));
731 EXPECT_EQ(1, getDataSaverState());
732
733 ASSERT_TRUE(enableDataSaver(mNetd, true));
734 EXPECT_EQ(1, getDataSaverState());
735
736 if (!wasEnabled) {
737 ASSERT_TRUE(enableDataSaver(mNetd, false));
738 EXPECT_EQ(0, getDataSaverState());
739 }
740 }
741
ipRuleExists(const char * ipVersion,const std::string & ipRule)742 static bool ipRuleExists(const char* ipVersion, const std::string& ipRule) {
743 std::vector<std::string> rules = listIpRules(ipVersion);
744 return std::find(rules.begin(), rules.end(), ipRule) != rules.end();
745 }
746
ipRuleExistsForRange(const uint32_t priority,const UidRangeParcel & range,const std::string & action,const char * ipVersion,const char * oif)747 static bool ipRuleExistsForRange(const uint32_t priority, const UidRangeParcel& range,
748 const std::string& action, const char* ipVersion,
749 const char* oif) {
750 // Output looks like this:
751 // "<priority>:\tfrom all iif lo oif netdc0ca6 uidrange 500000-500000 lookup netdc0ca6"
752 // "<priority>:\tfrom all fwmark 0x0/0x20000 iif lo uidrange 1000-2000 prohibit"
753 std::vector<std::string> rules = listIpRules(ipVersion);
754
755 std::string prefix = StringPrintf("%" PRIu32 ":", priority);
756 std::string suffix;
757 if (oif) {
758 suffix = StringPrintf(" iif lo oif %s uidrange %d-%d %s", oif, range.start, range.stop,
759 action.c_str());
760 } else {
761 suffix = StringPrintf(" iif lo uidrange %d-%d %s", range.start, range.stop, action.c_str());
762 }
763 for (const auto& line : rules) {
764 if (android::base::StartsWith(line, prefix) && android::base::EndsWith(line, suffix)) {
765 return true;
766 }
767 }
768 return false;
769 }
770
771 // Overloads function with oif parameter for VPN rules compare.
ipRuleExistsForRange(const uint32_t priority,const UidRangeParcel & range,const std::string & action,const char * oif)772 static bool ipRuleExistsForRange(const uint32_t priority, const UidRangeParcel& range,
773 const std::string& action, const char* oif) {
774 bool existsIp4 = ipRuleExistsForRange(priority, range, action, IP_RULE_V4, oif);
775 bool existsIp6 = ipRuleExistsForRange(priority, range, action, IP_RULE_V6, oif);
776 EXPECT_EQ(existsIp4, existsIp6);
777 return existsIp4;
778 }
779
ipRuleExistsForRange(const uint32_t priority,const UidRangeParcel & range,const std::string & action)780 static bool ipRuleExistsForRange(const uint32_t priority, const UidRangeParcel& range,
781 const std::string& action) {
782 return ipRuleExistsForRange(priority, range, action, nullptr);
783 }
784
expectRuleForV4AndV6(ExistMode mode,const std::string & rule)785 static void expectRuleForV4AndV6(ExistMode mode, const std::string& rule) {
786 for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) {
787 if (mode == ALL_EXIST) {
788 EXPECT_TRUE(ipRuleExists(ipVersion, rule));
789 } else {
790 EXPECT_FALSE(ipRuleExists(ipVersion, rule));
791 }
792 }
793 }
794
expectLocalIpRuleExists(ExistMode mode,const std::string & ifName)795 static void expectLocalIpRuleExists(ExistMode mode, const std::string& ifName) {
796 std::string localIpRule = StringPrintf("%u:\tfrom all fwmark 0x0/0x10000 lookup %s",
797 RULE_PRIORITY_LOCAL_NETWORK, ifName.c_str());
798 expectRuleForV4AndV6(mode, localIpRule);
799
800 std::string dnsMasqRule = StringPrintf("%u:\tfrom all fwmark 0x10063/0x1ffff iif lo lookup %s",
801 RULE_PRIORITY_EXPLICIT_NETWORK, ifName.c_str());
802 expectRuleForV4AndV6(mode, dnsMasqRule);
803 }
804
805 namespace {
806
makeUidRangeParcel(int start,int stop)807 UidRangeParcel makeUidRangeParcel(int start, int stop) {
808 UidRangeParcel res;
809 res.start = start;
810 res.stop = stop;
811
812 return res;
813 }
814
makeUidRangeParcel(int uid)815 UidRangeParcel makeUidRangeParcel(int uid) {
816 return makeUidRangeParcel(uid, uid);
817 }
818
makeNativeUidRangeConfig(unsigned netId,std::vector<UidRangeParcel> uidRanges,int32_t subPriority)819 NativeUidRangeConfig makeNativeUidRangeConfig(unsigned netId, std::vector<UidRangeParcel> uidRanges,
820 int32_t subPriority) {
821 NativeUidRangeConfig res;
822 res.netId = netId;
823 res.uidRanges = std::move(uidRanges);
824 res.subPriority = subPriority;
825
826 return res;
827 }
828
829 } // namespace
830
TEST_F(NetdBinderTest,NetworkInterfaces)831 TEST_F(NetdBinderTest, NetworkInterfaces) {
832 auto config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
833 INetd::PERMISSION_NONE, false, false);
834 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
835 EXPECT_EQ(EEXIST, mNetd->networkCreate(config).serviceSpecificErrorCode());
836
837 config.networkType = NativeNetworkType::VIRTUAL;
838 config.secure = true;
839 EXPECT_EQ(EEXIST, mNetd->networkCreate(config).serviceSpecificErrorCode());
840
841 config.netId = TEST_NETID2;
842 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
843
844 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
845 EXPECT_EQ(EBUSY,
846 mNetd->networkAddInterface(TEST_NETID2, sTun.name()).serviceSpecificErrorCode());
847
848 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
849 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID2, sTun.name()).isOk());
850 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID2).isOk());
851 EXPECT_EQ(ENONET, mNetd->networkDestroy(TEST_NETID1).serviceSpecificErrorCode());
852 }
853
TEST_F(NetdBinderTest,NetworkUidRules)854 TEST_F(NetdBinderTest, NetworkUidRules) {
855 auto config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::VIRTUAL,
856 INetd::PERMISSION_NONE, true, false);
857 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
858 EXPECT_EQ(EEXIST, mNetd->networkCreate(config).serviceSpecificErrorCode());
859 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
860
861 std::vector<UidRangeParcel> uidRanges = {makeUidRangeParcel(BASE_UID + 8005, BASE_UID + 8012),
862 makeUidRangeParcel(BASE_UID + 8090, BASE_UID + 8099)};
863 UidRangeParcel otherRange = makeUidRangeParcel(BASE_UID + 8190, BASE_UID + 8299);
864 std::string action = StringPrintf("lookup %s", sTun.name().c_str());
865
866 EXPECT_TRUE(mNetd->networkAddUidRanges(TEST_NETID1, uidRanges).isOk());
867
868 EXPECT_TRUE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[0], action));
869 EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, otherRange, action));
870 EXPECT_TRUE(mNetd->networkRemoveUidRanges(TEST_NETID1, uidRanges).isOk());
871 EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[0], action));
872
873 EXPECT_TRUE(mNetd->networkAddUidRanges(TEST_NETID1, uidRanges).isOk());
874 EXPECT_TRUE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[1], action));
875 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
876 EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[1], action));
877
878 EXPECT_EQ(ENONET, mNetd->networkDestroy(TEST_NETID1).serviceSpecificErrorCode());
879 }
880
881 class LocalNetworkParameterizedTest : public NetdBinderTest,
882 public testing::WithParamInterface<bool> {};
883
884 // Exercise both local and non-local networks
885 INSTANTIATE_TEST_SUITE_P(LocalNetworkTests, LocalNetworkParameterizedTest, testing::Bool(),
__anondf233e380402(const testing::TestParamInfo<bool>& info) 886 [](const testing::TestParamInfo<bool>& info) {
887 return info.param ? "Local" : "NonLocal";
888 });
889
TEST_P(LocalNetworkParameterizedTest,LocalNetworkUidRules)890 TEST_P(LocalNetworkParameterizedTest, LocalNetworkUidRules) {
891 const bool local = GetParam();
892 const auto type = local ? NativeNetworkType::PHYSICAL_LOCAL : NativeNetworkType::PHYSICAL;
893 auto config = makeNativeNetworkConfig(TEST_NETID1, type, INetd::PERMISSION_NONE,
894 false /* secure */, false /* excludeLocalRoutes */);
895 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
896 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
897
898 expectLocalIpRuleExists(local ? ALL_EXIST : NONE_EXIST, sTun.name());
899 }
900
TEST_F(NetdBinderTest,NetworkRejectNonSecureVpn)901 TEST_F(NetdBinderTest, NetworkRejectNonSecureVpn) {
902 std::vector<UidRangeParcel> uidRanges = {makeUidRangeParcel(BASE_UID + 150, BASE_UID + 224),
903 makeUidRangeParcel(BASE_UID + 226, BASE_UID + 300)};
904 // Make sure no rules existed before calling commands.
905 for (auto const& range : uidRanges) {
906 EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_PROHIBIT_NON_VPN, range, "prohibit"));
907 }
908 // Create two valid rules.
909 ASSERT_TRUE(mNetd->networkRejectNonSecureVpn(true, uidRanges).isOk());
910 for (auto const& range : uidRanges) {
911 EXPECT_TRUE(ipRuleExistsForRange(RULE_PRIORITY_PROHIBIT_NON_VPN, range, "prohibit"));
912 }
913
914 // Remove the rules.
915 ASSERT_TRUE(mNetd->networkRejectNonSecureVpn(false, uidRanges).isOk());
916 for (auto const& range : uidRanges) {
917 EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_PROHIBIT_NON_VPN, range, "prohibit"));
918 }
919
920 // Fail to remove the rules a second time after they are already deleted.
921 binder::Status status = mNetd->networkRejectNonSecureVpn(false, uidRanges);
922 ASSERT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
923 EXPECT_EQ(ENOENT, status.serviceSpecificErrorCode());
924 }
925
926 // Create a socket pair that isLoopbackSocket won't think is local.
fakeRemoteSocketPair(unique_fd * clientSocket,unique_fd * serverSocket,unique_fd * acceptedSocket)927 void NetdBinderTest::fakeRemoteSocketPair(unique_fd* clientSocket, unique_fd* serverSocket,
928 unique_fd* acceptedSocket) {
929 serverSocket->reset(socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0));
930 struct sockaddr_in6 server6 = { .sin6_family = AF_INET6, .sin6_addr = sTun.dstAddr() };
931 ASSERT_EQ(0, bind(*serverSocket, (struct sockaddr *) &server6, sizeof(server6)));
932
933 socklen_t addrlen = sizeof(server6);
934 ASSERT_EQ(0, getsockname(*serverSocket, (struct sockaddr *) &server6, &addrlen));
935 ASSERT_EQ(0, listen(*serverSocket, 10));
936
937 clientSocket->reset(socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0));
938 struct sockaddr_in6 client6 = { .sin6_family = AF_INET6, .sin6_addr = sTun.srcAddr() };
939 ASSERT_EQ(0, bind(*clientSocket, (struct sockaddr *) &client6, sizeof(client6)));
940 ASSERT_EQ(0, connect(*clientSocket, (struct sockaddr *) &server6, sizeof(server6)));
941 ASSERT_EQ(0, getsockname(*clientSocket, (struct sockaddr *) &client6, &addrlen));
942
943 acceptedSocket->reset(
944 accept4(*serverSocket, (struct sockaddr*)&server6, &addrlen, SOCK_CLOEXEC));
945 ASSERT_NE(-1, *acceptedSocket);
946
947 ASSERT_EQ(0, memcmp(&client6, &server6, sizeof(client6)));
948 }
949
checkSocketpairOpen(int clientSocket,int acceptedSocket)950 void checkSocketpairOpen(int clientSocket, int acceptedSocket) {
951 char buf[4096];
952 EXPECT_EQ(4, write(clientSocket, "foo", sizeof("foo")));
953 EXPECT_EQ(4, read(acceptedSocket, buf, sizeof(buf)));
954 EXPECT_EQ(0, memcmp(buf, "foo", sizeof("foo")));
955 }
956
checkSocketpairClosed(int clientSocket,int acceptedSocket)957 void checkSocketpairClosed(int clientSocket, int acceptedSocket) {
958 // Check that the client socket was closed with ECONNABORTED.
959 int ret = write(clientSocket, "foo", sizeof("foo"));
960 int err = errno;
961 EXPECT_EQ(-1, ret);
962 EXPECT_EQ(ECONNABORTED, err);
963
964 // Check that it sent a RST to the server.
965 ret = write(acceptedSocket, "foo", sizeof("foo"));
966 err = errno;
967 EXPECT_EQ(-1, ret);
968 EXPECT_EQ(ECONNRESET, err);
969 }
970
TEST_F(NetdBinderTest,SocketDestroy)971 TEST_F(NetdBinderTest, SocketDestroy) {
972 unique_fd clientSocket, serverSocket, acceptedSocket;
973 ASSERT_NO_FATAL_FAILURE(fakeRemoteSocketPair(&clientSocket, &serverSocket, &acceptedSocket));
974
975 // Pick a random UID in the system UID range.
976 constexpr int baseUid = AID_APP - 2000;
977 static_assert(baseUid > 0, "Not enough UIDs? Please fix this test.");
978 int uid = baseUid + 500 + arc4random_uniform(1000);
979 EXPECT_EQ(0, fchown(clientSocket, uid, -1));
980
981 // UID ranges that don't contain uid.
982 std::vector<UidRangeParcel> uidRanges = {
983 makeUidRangeParcel(baseUid + 42, baseUid + 449),
984 makeUidRangeParcel(baseUid + 1536, AID_APP - 4),
985 makeUidRangeParcel(baseUid + 498, uid - 1),
986 makeUidRangeParcel(uid + 1, baseUid + 1520),
987 };
988 // A skip list that doesn't contain UID.
989 std::vector<int32_t> skipUids { baseUid + 123, baseUid + 1600 };
990
991 // Close sockets. Our test socket should be intact.
992 EXPECT_TRUE(mNetd->socketDestroy(uidRanges, skipUids).isOk());
993 checkSocketpairOpen(clientSocket, acceptedSocket);
994
995 // UID ranges that do contain uid.
996 uidRanges = {
997 makeUidRangeParcel(baseUid + 42, baseUid + 449),
998 makeUidRangeParcel(baseUid + 1536, AID_APP - 4),
999 makeUidRangeParcel(baseUid + 498, baseUid + 1520),
1000 };
1001 // Add uid to the skip list.
1002 skipUids.push_back(uid);
1003
1004 // Close sockets. Our test socket should still be intact because it's in the skip list.
1005 EXPECT_TRUE(mNetd->socketDestroy(uidRanges, skipUids).isOk());
1006 checkSocketpairOpen(clientSocket, acceptedSocket);
1007
1008 // Now remove uid from skipUids, and close sockets. Our test socket should have been closed.
1009 skipUids.resize(skipUids.size() - 1);
1010 EXPECT_TRUE(mNetd->socketDestroy(uidRanges, skipUids).isOk());
1011 checkSocketpairClosed(clientSocket, acceptedSocket);
1012 }
1013
TEST_F(NetdBinderTest,SocketDestroyLinkLocal)1014 TEST_F(NetdBinderTest, SocketDestroyLinkLocal) {
1015 // Add the same link-local address to two interfaces.
1016 const char* kLinkLocalAddress = "fe80::ace:d00d";
1017
1018 const struct addrinfo hints = {
1019 .ai_family = AF_INET6,
1020 .ai_socktype = SOCK_STREAM,
1021 .ai_flags = AI_NUMERICHOST,
1022 };
1023
1024 binder::Status status = mNetd->interfaceAddAddress(sTun.name(), kLinkLocalAddress, 64);
1025 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1026 status = mNetd->interfaceAddAddress(sTun2.name(), kLinkLocalAddress, 64);
1027 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1028
1029 // Bind a listening socket to the address on each of two interfaces.
1030 // The sockets must be open at the same time, because this test checks that SOCK_DESTROY only
1031 // destroys the sockets on the interface where the address is deleted.
1032 struct addrinfo* addrinfoList = nullptr;
1033 int ret = getaddrinfo(kLinkLocalAddress, nullptr, &hints, &addrinfoList);
1034 ScopedAddrinfo addrinfoCleanup(addrinfoList);
1035 ASSERT_EQ(0, ret);
1036
1037 socklen_t len = addrinfoList[0].ai_addrlen;
1038 sockaddr_in6 sin6_1 = *reinterpret_cast<sockaddr_in6*>(addrinfoList[0].ai_addr);
1039 sockaddr_in6 sin6_2 = sin6_1;
1040 sin6_1.sin6_scope_id = if_nametoindex(sTun.name().c_str());
1041 sin6_2.sin6_scope_id = if_nametoindex(sTun2.name().c_str());
1042
1043 int s1 = socket(AF_INET6, SOCK_STREAM | SOCK_NONBLOCK, 0);
1044 ASSERT_EQ(0, bind(s1, reinterpret_cast<sockaddr*>(&sin6_1), len));
1045 ASSERT_EQ(0, getsockname(s1, reinterpret_cast<sockaddr*>(&sin6_1), &len));
1046 // getsockname technically writes to len, but sizeof(sockaddr_in6) doesn't change.
1047
1048 int s2 = socket(AF_INET6, SOCK_STREAM | SOCK_NONBLOCK, 0);
1049 ASSERT_EQ(0, bind(s2, reinterpret_cast<sockaddr*>(&sin6_2), len));
1050 ASSERT_EQ(0, getsockname(s2, reinterpret_cast<sockaddr*>(&sin6_2), &len));
1051
1052 ASSERT_EQ(0, listen(s1, 10));
1053 ASSERT_EQ(0, listen(s2, 10));
1054
1055 // Connect one client socket to each and accept the connections.
1056 int c1 = socket(AF_INET6, SOCK_STREAM, 0);
1057 int c2 = socket(AF_INET6, SOCK_STREAM, 0);
1058 ASSERT_EQ(0, connect(c1, reinterpret_cast<sockaddr*>(&sin6_1), len));
1059 ASSERT_EQ(0, connect(c2, reinterpret_cast<sockaddr*>(&sin6_2), len));
1060 int a1 = accept(s1, nullptr, 0);
1061 ASSERT_NE(-1, a1);
1062 int a2 = accept(s2, nullptr, 0);
1063 ASSERT_NE(-1, a2);
1064
1065 // Delete the address on sTun2.
1066 status = mNetd->interfaceDelAddress(sTun2.name(), kLinkLocalAddress, 64);
1067 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1068
1069 // The client sockets on sTun2 are closed, but the ones on sTun1 remain open.
1070 char buf[1024];
1071 EXPECT_EQ(-1, read(c2, buf, sizeof(buf)));
1072 EXPECT_TRUE(errno == ECONNABORTED || errno == ECONNRESET) << "errno:" << errno;
1073 // The blocking read above ensures that SOCK_DESTROY has completed.
1074
1075 EXPECT_EQ(3, write(a1, "foo", 3));
1076 EXPECT_EQ(3, read(c1, buf, sizeof(buf)));
1077 EXPECT_EQ(-1, write(a2, "foo", 3));
1078 EXPECT_TRUE(errno == ECONNABORTED || errno == ECONNRESET) << "errno:" << errno;
1079
1080 // Check the server sockets too.
1081 EXPECT_EQ(-1, accept(s1, nullptr, 0));
1082 EXPECT_EQ(EAGAIN, errno);
1083 EXPECT_EQ(-1, accept(s2, nullptr, 0));
1084 EXPECT_EQ(EINVAL, errno);
1085 }
1086
1087 namespace {
1088
netmaskToPrefixLength(const uint8_t * buf,size_t buflen)1089 int netmaskToPrefixLength(const uint8_t *buf, size_t buflen) {
1090 if (buf == nullptr) return -1;
1091
1092 int prefixLength = 0;
1093 bool endOfContiguousBits = false;
1094 for (unsigned int i = 0; i < buflen; i++) {
1095 const uint8_t value = buf[i];
1096
1097 // Bad bit sequence: check for a contiguous set of bits from the high
1098 // end by verifying that the inverted value + 1 is a power of 2
1099 // (power of 2 iff. (v & (v - 1)) == 0).
1100 const uint8_t inverse = ~value + 1;
1101 if ((inverse & (inverse - 1)) != 0) return -1;
1102
1103 prefixLength += (value == 0) ? 0 : CHAR_BIT - ffs(value) + 1;
1104
1105 // Bogus netmask.
1106 if (endOfContiguousBits && value != 0) return -1;
1107
1108 if (value != 0xff) endOfContiguousBits = true;
1109 }
1110
1111 return prefixLength;
1112 }
1113
1114 template<typename T>
netmaskToPrefixLength(const T * p)1115 int netmaskToPrefixLength(const T *p) {
1116 return netmaskToPrefixLength(reinterpret_cast<const uint8_t*>(p), sizeof(T));
1117 }
1118
1119
interfaceHasAddress(const std::string & ifname,const char * addrString,int prefixLength)1120 static bool interfaceHasAddress(
1121 const std::string &ifname, const char *addrString, int prefixLength) {
1122 struct addrinfo *addrinfoList = nullptr;
1123
1124 const struct addrinfo hints = {
1125 .ai_flags = AI_NUMERICHOST,
1126 .ai_family = AF_UNSPEC,
1127 .ai_socktype = SOCK_DGRAM,
1128 };
1129 if (getaddrinfo(addrString, nullptr, &hints, &addrinfoList) != 0 ||
1130 addrinfoList == nullptr || addrinfoList->ai_addr == nullptr) {
1131 return false;
1132 }
1133 ScopedAddrinfo addrinfoCleanup(addrinfoList);
1134
1135 struct ifaddrs *ifaddrsList = nullptr;
1136 ScopedIfaddrs ifaddrsCleanup(ifaddrsList);
1137
1138 if (getifaddrs(&ifaddrsList) != 0) {
1139 return false;
1140 }
1141
1142 for (struct ifaddrs *addr = ifaddrsList; addr != nullptr; addr = addr->ifa_next) {
1143 if (std::string(addr->ifa_name) != ifname ||
1144 addr->ifa_addr == nullptr ||
1145 addr->ifa_addr->sa_family != addrinfoList->ai_addr->sa_family) {
1146 continue;
1147 }
1148
1149 switch (addr->ifa_addr->sa_family) {
1150 case AF_INET: {
1151 auto *addr4 = reinterpret_cast<const struct sockaddr_in*>(addr->ifa_addr);
1152 auto *want = reinterpret_cast<const struct sockaddr_in*>(addrinfoList->ai_addr);
1153 if (memcmp(&addr4->sin_addr, &want->sin_addr, sizeof(want->sin_addr)) != 0) {
1154 continue;
1155 }
1156
1157 if (prefixLength < 0) return true; // not checking prefix lengths
1158
1159 if (addr->ifa_netmask == nullptr) return false;
1160 auto *nm = reinterpret_cast<const struct sockaddr_in*>(addr->ifa_netmask);
1161 EXPECT_EQ(prefixLength, netmaskToPrefixLength(&nm->sin_addr));
1162 return (prefixLength == netmaskToPrefixLength(&nm->sin_addr));
1163 }
1164 case AF_INET6: {
1165 auto *addr6 = reinterpret_cast<const struct sockaddr_in6*>(addr->ifa_addr);
1166 auto *want = reinterpret_cast<const struct sockaddr_in6*>(addrinfoList->ai_addr);
1167 if (memcmp(&addr6->sin6_addr, &want->sin6_addr, sizeof(want->sin6_addr)) != 0) {
1168 continue;
1169 }
1170
1171 if (prefixLength < 0) return true; // not checking prefix lengths
1172
1173 if (addr->ifa_netmask == nullptr) return false;
1174 auto *nm = reinterpret_cast<const struct sockaddr_in6*>(addr->ifa_netmask);
1175 EXPECT_EQ(prefixLength, netmaskToPrefixLength(&nm->sin6_addr));
1176 return (prefixLength == netmaskToPrefixLength(&nm->sin6_addr));
1177 }
1178 default:
1179 // Cannot happen because we have already screened for matching
1180 // address families at the top of each iteration.
1181 continue;
1182 }
1183 }
1184
1185 return false;
1186 }
1187
1188 } // namespace
1189
TEST_F(NetdBinderTest,InterfaceAddRemoveAddress)1190 TEST_F(NetdBinderTest, InterfaceAddRemoveAddress) {
1191 static const struct TestData {
1192 const char *addrString;
1193 const int prefixLength;
1194 const int expectAddResult;
1195 const int expectRemoveResult;
1196 } kTestData[] = {
1197 {"192.0.2.1", 24, 0, 0},
1198 {"192.0.2.2", 25, 0, 0},
1199 {"192.0.2.3", 32, 0, 0},
1200 {"192.0.2.4", 33, EINVAL, EADDRNOTAVAIL},
1201 {"192.not.an.ip", 24, EINVAL, EINVAL},
1202 {"2001:db8::1", 64, 0, 0},
1203 {"2001:db8::2", 65, 0, 0},
1204 {"2001:db8::3", 128, 0, 0},
1205 {"fe80::1234", 64, 0, 0},
1206 {"2001:db8::4", 129, EINVAL, EINVAL},
1207 {"foo:bar::bad", 64, EINVAL, EINVAL},
1208 {"2001:db8::1/64", 64, EINVAL, EINVAL},
1209 };
1210
1211 for (size_t i = 0; i < std::size(kTestData); i++) {
1212 const auto &td = kTestData[i];
1213
1214 SCOPED_TRACE(String8::format("Offending IP address %s/%d", td.addrString, td.prefixLength));
1215
1216 // [1.a] Add the address.
1217 binder::Status status = mNetd->interfaceAddAddress(
1218 sTun.name(), td.addrString, td.prefixLength);
1219 if (td.expectAddResult == 0) {
1220 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1221 } else {
1222 ASSERT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
1223 ASSERT_EQ(td.expectAddResult, status.serviceSpecificErrorCode());
1224 }
1225
1226 // [1.b] Verify the addition meets the expectation.
1227 if (td.expectAddResult == 0) {
1228 EXPECT_TRUE(interfaceHasAddress(sTun.name(), td.addrString, td.prefixLength));
1229 } else {
1230 EXPECT_FALSE(interfaceHasAddress(sTun.name(), td.addrString, -1));
1231 }
1232
1233 // [2.a] Try to remove the address. If it was not previously added, removing it fails.
1234 status = mNetd->interfaceDelAddress(sTun.name(), td.addrString, td.prefixLength);
1235 if (td.expectRemoveResult == 0) {
1236 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1237 } else {
1238 ASSERT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
1239 ASSERT_EQ(td.expectRemoveResult, status.serviceSpecificErrorCode());
1240 }
1241
1242 // [2.b] No matter what, the address should not be present.
1243 EXPECT_FALSE(interfaceHasAddress(sTun.name(), td.addrString, -1));
1244 }
1245
1246 // Check that netlink errors are returned correctly.
1247 // We do this by attempting to create an IPv6 address on an interface that has IPv6 disabled,
1248 // which returns EACCES.
1249 TunInterface tun;
1250 ASSERT_EQ(0, tun.init());
1251 binder::Status status =
1252 mNetd->setProcSysNet(INetd::IPV6, INetd::CONF, tun.name(), "disable_ipv6", "1");
1253 ASSERT_TRUE(status.isOk()) << status.exceptionMessage();
1254 status = mNetd->interfaceAddAddress(tun.name(), "2001:db8::1", 64);
1255 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
1256 EXPECT_EQ(EACCES, status.serviceSpecificErrorCode());
1257 tun.destroy();
1258 }
1259
TEST_F(NetdBinderTest,GetProcSysNet)1260 TEST_F(NetdBinderTest, GetProcSysNet) {
1261 const char* LOOPBACK = "lo";
1262 static const struct {
1263 const int ipversion;
1264 const int which;
1265 const char* ifname;
1266 const char* parameter;
1267 const char* expectedValue;
1268 const int expectedReturnCode;
1269 } kTestData[] = {
1270 {INetd::IPV4, INetd::CONF, LOOPBACK, "arp_ignore", "0", 0},
1271 {-1, INetd::CONF, sTun.name().c_str(), "arp_ignore", nullptr, EAFNOSUPPORT},
1272 {INetd::IPV4, -1, sTun.name().c_str(), "arp_ignore", nullptr, EINVAL},
1273 {INetd::IPV4, INetd::CONF, "..", "conf/lo/arp_ignore", nullptr, EINVAL},
1274 {INetd::IPV4, INetd::CONF, ".", "lo/arp_ignore", nullptr, EINVAL},
1275 {INetd::IPV4, INetd::CONF, sTun.name().c_str(), "../all/arp_ignore", nullptr, EINVAL},
1276 {INetd::IPV6, INetd::NEIGH, LOOPBACK, "ucast_solicit", "3", 0},
1277 };
1278
1279 for (size_t i = 0; i < std::size(kTestData); i++) {
1280 const auto& td = kTestData[i];
1281
1282 std::string value;
1283 const binder::Status status =
1284 mNetd->getProcSysNet(td.ipversion, td.which, td.ifname, td.parameter, &value);
1285
1286 if (td.expectedReturnCode == 0) {
1287 SCOPED_TRACE(String8::format("test case %zu should have passed", i));
1288 EXPECT_EQ(0, status.exceptionCode());
1289 EXPECT_EQ(0, status.serviceSpecificErrorCode());
1290 EXPECT_EQ(td.expectedValue, value);
1291 } else {
1292 SCOPED_TRACE(String8::format("test case %zu should have failed", i));
1293 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
1294 EXPECT_EQ(td.expectedReturnCode, status.serviceSpecificErrorCode());
1295 }
1296 }
1297 }
1298
TEST_F(NetdBinderTest,SetProcSysNet)1299 TEST_F(NetdBinderTest, SetProcSysNet) {
1300 static const struct {
1301 const int ipversion;
1302 const int which;
1303 const char* ifname;
1304 const char* parameter;
1305 const char* value;
1306 const int expectedReturnCode;
1307 } kTestData[] = {
1308 {INetd::IPV4, INetd::CONF, sTun.name().c_str(), "arp_ignore", "1", 0},
1309 {-1, INetd::CONF, sTun.name().c_str(), "arp_ignore", "1", EAFNOSUPPORT},
1310 {INetd::IPV4, -1, sTun.name().c_str(), "arp_ignore", "1", EINVAL},
1311 {INetd::IPV4, INetd::CONF, "..", "conf/lo/arp_ignore", "1", EINVAL},
1312 {INetd::IPV4, INetd::CONF, ".", "lo/arp_ignore", "1", EINVAL},
1313 {INetd::IPV4, INetd::CONF, sTun.name().c_str(), "../all/arp_ignore", "1", EINVAL},
1314 {INetd::IPV6, INetd::NEIGH, sTun.name().c_str(), "ucast_solicit", "7", 0},
1315 };
1316
1317 for (size_t i = 0; i < std::size(kTestData); i++) {
1318 const auto& td = kTestData[i];
1319 const binder::Status status =
1320 mNetd->setProcSysNet(td.ipversion, td.which, td.ifname, td.parameter, td.value);
1321
1322 if (td.expectedReturnCode == 0) {
1323 SCOPED_TRACE(String8::format("test case %zu should have passed", i));
1324 EXPECT_EQ(0, status.exceptionCode());
1325 EXPECT_EQ(0, status.serviceSpecificErrorCode());
1326 } else {
1327 SCOPED_TRACE(String8::format("test case %zu should have failed", i));
1328 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
1329 EXPECT_EQ(td.expectedReturnCode, status.serviceSpecificErrorCode());
1330 }
1331 }
1332 }
1333
TEST_F(NetdBinderTest,GetSetProcSysNet)1334 TEST_F(NetdBinderTest, GetSetProcSysNet) {
1335 const int ipversion = INetd::IPV6;
1336 const int category = INetd::NEIGH;
1337 const std::string& tun = sTun.name();
1338 const std::string parameter("ucast_solicit");
1339
1340 std::string value{};
1341 EXPECT_TRUE(mNetd->getProcSysNet(ipversion, category, tun, parameter, &value).isOk());
1342 ASSERT_FALSE(value.empty());
1343 const int ival = std::stoi(value);
1344 EXPECT_GT(ival, 0);
1345 // Try doubling the parameter value (always best!).
1346 EXPECT_TRUE(mNetd->setProcSysNet(ipversion, category, tun, parameter, std::to_string(2 * ival))
1347 .isOk());
1348 EXPECT_TRUE(mNetd->getProcSysNet(ipversion, category, tun, parameter, &value).isOk());
1349 EXPECT_EQ(2 * ival, std::stoi(value));
1350 // Try resetting the parameter.
1351 EXPECT_TRUE(mNetd->setProcSysNet(ipversion, category, tun, parameter, std::to_string(ival))
1352 .isOk());
1353 EXPECT_TRUE(mNetd->getProcSysNet(ipversion, category, tun, parameter, &value).isOk());
1354 EXPECT_EQ(ival, std::stoi(value));
1355 }
1356
1357 namespace {
1358
expectNoTestCounterRules()1359 void expectNoTestCounterRules() {
1360 for (const auto& binary : { IPTABLES_PATH, IP6TABLES_PATH }) {
1361 std::string command = StringPrintf("%s -w -nvL tetherctrl_counters", binary);
1362 std::string allRules = Join(runCommand(command), "\n");
1363 EXPECT_EQ(std::string::npos, allRules.find("netdtest_"));
1364 }
1365 }
1366
addTetherCounterValues(const char * path,const std::string & if1,const std::string & if2,int byte,int pkt)1367 void addTetherCounterValues(const char* path, const std::string& if1, const std::string& if2,
1368 int byte, int pkt) {
1369 runCommand(StringPrintf("%s -w -A tetherctrl_counters -i %s -o %s -j RETURN -c %d %d",
1370 path, if1.c_str(), if2.c_str(), pkt, byte));
1371 }
1372
delTetherCounterValues(const char * path,const std::string & if1,const std::string & if2)1373 void delTetherCounterValues(const char* path, const std::string& if1, const std::string& if2) {
1374 runCommand(StringPrintf("%s -w -D tetherctrl_counters -i %s -o %s -j RETURN",
1375 path, if1.c_str(), if2.c_str()));
1376 runCommand(StringPrintf("%s -w -D tetherctrl_counters -i %s -o %s -j RETURN",
1377 path, if2.c_str(), if1.c_str()));
1378 }
1379
getStatsVectorByIf(const std::vector<TetherStatsParcel> & statsVec,const std::string & iface)1380 std::vector<int64_t> getStatsVectorByIf(const std::vector<TetherStatsParcel>& statsVec,
1381 const std::string& iface) {
1382 for (auto& stats : statsVec) {
1383 if (stats.iface == iface) {
1384 return {stats.rxBytes, stats.rxPackets, stats.txBytes, stats.txPackets};
1385 }
1386 }
1387 return {};
1388 }
1389
1390 } // namespace
1391
TEST_F(NetdBinderTest,TetherGetStats)1392 TEST_F(NetdBinderTest, TetherGetStats) {
1393 expectNoTestCounterRules();
1394
1395 // TODO: fold this into more comprehensive tests once we have binder RPCs for enabling and
1396 // disabling tethering. We don't check the return value because these commands will fail if
1397 // tethering is already enabled.
1398 runCommand(StringPrintf("%s -w -N tetherctrl_counters", IPTABLES_PATH));
1399 runCommand(StringPrintf("%s -w -N tetherctrl_counters", IP6TABLES_PATH));
1400
1401 std::string intIface1 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
1402 std::string intIface2 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
1403 std::string intIface3 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
1404
1405 // Ensure we won't use the same interface name, otherwise the test will fail.
1406 u_int32_t rNumber = arc4random_uniform(10000);
1407 std::string extIface1 = StringPrintf("netdtest_%u", rNumber);
1408 std::string extIface2 = StringPrintf("netdtest_%u", rNumber + 1);
1409
1410 addTetherCounterValues(IPTABLES_PATH, intIface1, extIface1, 123, 111);
1411 addTetherCounterValues(IP6TABLES_PATH, intIface1, extIface1, 456, 10);
1412 addTetherCounterValues(IPTABLES_PATH, extIface1, intIface1, 321, 222);
1413 addTetherCounterValues(IP6TABLES_PATH, extIface1, intIface1, 654, 20);
1414 // RX is from external to internal, and TX is from internal to external.
1415 // So rxBytes is 321 + 654 = 975, txBytes is 123 + 456 = 579, etc.
1416 std::vector<int64_t> expected1 = { 975, 242, 579, 121 };
1417
1418 addTetherCounterValues(IPTABLES_PATH, intIface2, extIface2, 1000, 333);
1419 addTetherCounterValues(IP6TABLES_PATH, intIface2, extIface2, 3000, 30);
1420
1421 addTetherCounterValues(IPTABLES_PATH, extIface2, intIface2, 2000, 444);
1422 addTetherCounterValues(IP6TABLES_PATH, extIface2, intIface2, 4000, 40);
1423
1424 addTetherCounterValues(IP6TABLES_PATH, intIface3, extIface2, 1000, 25);
1425 addTetherCounterValues(IP6TABLES_PATH, extIface2, intIface3, 2000, 35);
1426 std::vector<int64_t> expected2 = { 8000, 519, 5000, 388 };
1427
1428 std::vector<TetherStatsParcel> statsVec;
1429 binder::Status status = mNetd->tetherGetStats(&statsVec);
1430 EXPECT_TRUE(status.isOk()) << "Getting tethering stats failed: " << status;
1431
1432 EXPECT_EQ(expected1, getStatsVectorByIf(statsVec, extIface1));
1433
1434 EXPECT_EQ(expected2, getStatsVectorByIf(statsVec, extIface2));
1435
1436 for (const auto& path : { IPTABLES_PATH, IP6TABLES_PATH }) {
1437 delTetherCounterValues(path, intIface1, extIface1);
1438 delTetherCounterValues(path, intIface2, extIface2);
1439 if (strcmp(path, IP6TABLES_PATH) == 0) {
1440 delTetherCounterValues(path, intIface3, extIface2);
1441 }
1442 }
1443
1444 expectNoTestCounterRules();
1445 }
1446
1447 namespace {
1448
1449 constexpr char IDLETIMER_RAW_PREROUTING[] = "idletimer_raw_PREROUTING";
1450 constexpr char IDLETIMER_MANGLE_POSTROUTING[] = "idletimer_mangle_POSTROUTING";
1451
listIptablesRuleByTable(const char * binary,const char * table,const char * chainName)1452 static std::vector<std::string> listIptablesRuleByTable(const char* binary, const char* table,
1453 const char* chainName) {
1454 std::string command = StringPrintf("%s -t %s -w -n -v -L %s", binary, table, chainName);
1455 return runCommand(command);
1456 }
1457
1458 // TODO: It is a duplicate function, need to remove it
iptablesIdleTimerInterfaceRuleExists(const char * binary,const char * chainName,const std::string & expectedInterface,const std::string & expectedRule,const char * table)1459 bool iptablesIdleTimerInterfaceRuleExists(const char* binary, const char* chainName,
1460 const std::string& expectedInterface,
1461 const std::string& expectedRule, const char* table) {
1462 std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName);
1463 for (const auto& rule : rules) {
1464 if (rule.find(expectedInterface) != std::string::npos) {
1465 if (rule.find(expectedRule) != std::string::npos) {
1466 return true;
1467 }
1468 }
1469 }
1470 return false;
1471 }
1472
expectIdletimerInterfaceRuleExists(const std::string & ifname,int timeout,const std::string & classLabel)1473 void expectIdletimerInterfaceRuleExists(const std::string& ifname, int timeout,
1474 const std::string& classLabel) {
1475 std::string IdletimerRule =
1476 StringPrintf("timeout:%u label:%s send_nl_msg", timeout, classLabel.c_str());
1477 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
1478 EXPECT_TRUE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_RAW_PREROUTING, ifname,
1479 IdletimerRule, RAW_TABLE));
1480 EXPECT_TRUE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_MANGLE_POSTROUTING,
1481 ifname, IdletimerRule, MANGLE_TABLE));
1482 }
1483 }
1484
expectIdletimerInterfaceRuleNotExists(const std::string & ifname,int timeout,const std::string & classLabel)1485 void expectIdletimerInterfaceRuleNotExists(const std::string& ifname, int timeout,
1486 const std::string& classLabel) {
1487 std::string IdletimerRule =
1488 StringPrintf("timeout:%u label:%s send_nl_msg", timeout, classLabel.c_str());
1489 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
1490 EXPECT_FALSE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_RAW_PREROUTING, ifname,
1491 IdletimerRule, RAW_TABLE));
1492 EXPECT_FALSE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_MANGLE_POSTROUTING,
1493 ifname, IdletimerRule, MANGLE_TABLE));
1494 }
1495 }
1496
1497 } // namespace
1498
TEST_F(NetdBinderTest,IdletimerAddRemoveInterface)1499 TEST_F(NetdBinderTest, IdletimerAddRemoveInterface) {
1500 // TODO: We will get error in if expectIdletimerInterfaceRuleNotExists if there are the same
1501 // rule in the table. Because we only check the result after calling remove function. We might
1502 // check the actual rule which is removed by our function (maybe compare the results between
1503 // calling function before and after)
1504 binder::Status status;
1505 const struct TestData {
1506 const std::string ifname;
1507 int32_t timeout;
1508 const std::string classLabel;
1509 } idleTestData[] = {
1510 {"wlan0", 1234, "happyday"},
1511 {"rmnet_data0", 4567, "friday"},
1512 };
1513 for (const auto& td : idleTestData) {
1514 status = mNetd->idletimerAddInterface(td.ifname, td.timeout, td.classLabel);
1515 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1516 expectIdletimerInterfaceRuleExists(td.ifname, td.timeout, td.classLabel);
1517
1518 status = mNetd->idletimerRemoveInterface(td.ifname, td.timeout, td.classLabel);
1519 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1520 expectIdletimerInterfaceRuleNotExists(td.ifname, td.timeout, td.classLabel);
1521 }
1522 }
1523
1524 namespace {
1525
1526 constexpr char STRICT_OUTPUT[] = "st_OUTPUT";
1527 constexpr char STRICT_CLEAR_CAUGHT[] = "st_clear_caught";
1528
1529 // Output looks like this:
1530 //
1531 // IPv4:
1532 //
1533 // throw dst proto static scope link
1534 // unreachable dst proto static scope link
1535 // dst via nextHop dev ifName proto static
1536 // dst dev ifName proto static scope link
1537 //
1538 // IPv6:
1539 //
1540 // throw dst dev lo proto static metric 1024
1541 // unreachable dst dev lo proto static metric 1024
1542 // dst via nextHop dev ifName proto static metric 1024
1543 // dst dev ifName proto static metric 1024
ipRoutePrefix(const std::string & ifName,const std::string & dst,const std::string & nextHop)1544 std::string ipRoutePrefix(const std::string& ifName, const std::string& dst,
1545 const std::string& nextHop) {
1546 std::string prefixString;
1547
1548 bool isThrow = nextHop == "throw";
1549 bool isUnreachable = nextHop == "unreachable";
1550 bool isDefault = (dst == "0.0.0.0/0" || dst == "::/0");
1551 bool isIPv6 = dst.find(':') != std::string::npos;
1552 bool isThrowOrUnreachable = isThrow || isUnreachable;
1553
1554 if (isThrowOrUnreachable) {
1555 prefixString += nextHop + " ";
1556 }
1557
1558 prefixString += isDefault ? "default" : dst;
1559
1560 if (!nextHop.empty() && !isThrowOrUnreachable) {
1561 prefixString += " via " + nextHop;
1562 }
1563
1564 if (isThrowOrUnreachable) {
1565 if (isIPv6) {
1566 prefixString += " dev lo";
1567 }
1568 } else {
1569 prefixString += " dev " + ifName;
1570 }
1571
1572 prefixString += " proto static";
1573
1574 // IPv6 routes report the metric, IPv4 routes report the scope.
1575 if (isIPv6) {
1576 prefixString += " metric 1024";
1577 } else {
1578 if (nextHop.empty() || isThrowOrUnreachable) {
1579 prefixString += " scope link";
1580 }
1581 }
1582
1583 return prefixString;
1584 }
1585
expectStrictSetUidAccept(const int uid)1586 void expectStrictSetUidAccept(const int uid) {
1587 std::string uidRule = StringPrintf("owner UID match %u", uid);
1588 std::string perUidChain = StringPrintf("st_clear_caught_%u", uid);
1589 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
1590 EXPECT_FALSE(iptablesRuleExists(binary, STRICT_OUTPUT, uidRule));
1591 EXPECT_FALSE(iptablesRuleExists(binary, STRICT_CLEAR_CAUGHT, uidRule));
1592 EXPECT_EQ(0, iptablesRuleLineLength(binary, perUidChain.c_str()));
1593 }
1594 }
1595
expectStrictSetUidLog(const int uid)1596 void expectStrictSetUidLog(const int uid) {
1597 static const char logRule[] = "st_penalty_log all";
1598 std::string uidRule = StringPrintf("owner UID match %u", uid);
1599 std::string perUidChain = StringPrintf("st_clear_caught_%u", uid);
1600 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
1601 EXPECT_TRUE(iptablesRuleExists(binary, STRICT_OUTPUT, uidRule));
1602 EXPECT_TRUE(iptablesRuleExists(binary, STRICT_CLEAR_CAUGHT, uidRule));
1603 EXPECT_TRUE(iptablesRuleExists(binary, perUidChain.c_str(), logRule));
1604 }
1605 }
1606
expectStrictSetUidReject(const int uid)1607 void expectStrictSetUidReject(const int uid) {
1608 static const char rejectRule[] = "st_penalty_reject all";
1609 std::string uidRule = StringPrintf("owner UID match %u", uid);
1610 std::string perUidChain = StringPrintf("st_clear_caught_%u", uid);
1611 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
1612 EXPECT_TRUE(iptablesRuleExists(binary, STRICT_OUTPUT, uidRule));
1613 EXPECT_TRUE(iptablesRuleExists(binary, STRICT_CLEAR_CAUGHT, uidRule));
1614 EXPECT_TRUE(iptablesRuleExists(binary, perUidChain.c_str(), rejectRule));
1615 }
1616 }
1617
ipRouteSubstrings(const std::string & ifName,const std::string & dst,const std::string & nextHop,const std::string & mtu)1618 std::vector<std::string> ipRouteSubstrings(const std::string& ifName, const std::string& dst,
1619 const std::string& nextHop, const std::string& mtu) {
1620 std::vector<std::string> routeSubstrings;
1621
1622 routeSubstrings.push_back(ipRoutePrefix(ifName, dst, nextHop));
1623
1624 if (!mtu.empty()) {
1625 // Add separate substring to match mtu value.
1626 // This is needed because on some devices "error -11"/"error -113" appears between ip prefix
1627 // and mtu for throw/unreachable routes.
1628 routeSubstrings.push_back("mtu " + mtu);
1629 }
1630
1631 return routeSubstrings;
1632 }
1633
expectNetworkRouteDoesNotExistWithMtu(const char * ipVersion,const std::string & ifName,const std::string & dst,const std::string & nextHop,const std::string & mtu,const char * table)1634 void expectNetworkRouteDoesNotExistWithMtu(const char* ipVersion, const std::string& ifName,
1635 const std::string& dst, const std::string& nextHop,
1636 const std::string& mtu, const char* table) {
1637 std::vector<std::string> routeSubstrings = ipRouteSubstrings(ifName, dst, nextHop, mtu);
1638 EXPECT_FALSE(ipRouteExists(ipVersion, table, routeSubstrings))
1639 << "Found unexpected route [" << Join(routeSubstrings, ", ") << "] in table " << table;
1640 }
1641
expectNetworkRouteExistsWithMtu(const char * ipVersion,const std::string & ifName,const std::string & dst,const std::string & nextHop,const std::string & mtu,const char * table)1642 void expectNetworkRouteExistsWithMtu(const char* ipVersion, const std::string& ifName,
1643 const std::string& dst, const std::string& nextHop,
1644 const std::string& mtu, const char* table) {
1645 std::vector<std::string> routeSubstrings = ipRouteSubstrings(ifName, dst, nextHop, mtu);
1646 EXPECT_TRUE(ipRouteExists(ipVersion, table, routeSubstrings))
1647 << "Couldn't find route to " << dst << ": [" << Join(routeSubstrings, ", ")
1648 << "] in table " << table;
1649 }
1650
expectVpnLocalExclusionRuleExists(const std::string & ifName,bool expectExists)1651 void expectVpnLocalExclusionRuleExists(const std::string& ifName, bool expectExists) {
1652 std::string tableName = std::string(ifName + "_local");
1653 // Check if rule exists
1654 std::string vpnLocalExclusionRule =
1655 StringPrintf("%d:\tfrom all fwmark 0x0/0x10000 iif lo lookup %s",
1656 RULE_PRIORITY_LOCAL_ROUTES, tableName.c_str());
1657 for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) {
1658 EXPECT_EQ(expectExists, ipRuleExists(ipVersion, vpnLocalExclusionRule));
1659 }
1660 }
1661
expectNetworkRouteExists(const char * ipVersion,const std::string & ifName,const std::string & dst,const std::string & nextHop,const char * table)1662 void expectNetworkRouteExists(const char* ipVersion, const std::string& ifName,
1663 const std::string& dst, const std::string& nextHop,
1664 const char* table) {
1665 expectNetworkRouteExistsWithMtu(ipVersion, ifName, dst, nextHop, "", table);
1666 }
1667
expectNetworkRouteDoesNotExist(const char * ipVersion,const std::string & ifName,const std::string & dst,const std::string & nextHop,const char * table)1668 void expectNetworkRouteDoesNotExist(const char* ipVersion, const std::string& ifName,
1669 const std::string& dst, const std::string& nextHop,
1670 const char* table) {
1671 expectNetworkRouteDoesNotExistWithMtu(ipVersion, ifName, dst, nextHop, "", table);
1672 }
1673
expectNetworkDefaultIpRuleExists(const char * ifName)1674 void expectNetworkDefaultIpRuleExists(const char* ifName) {
1675 std::string networkDefaultRule =
1676 StringPrintf("%u:\tfrom all fwmark 0x0/0xffff iif lo lookup %s",
1677 RULE_PRIORITY_DEFAULT_NETWORK, ifName);
1678
1679 expectRuleForV4AndV6(ALL_EXIST, networkDefaultRule);
1680 }
1681
expectNetworkDefaultIpRuleDoesNotExist()1682 void expectNetworkDefaultIpRuleDoesNotExist() {
1683 std::string networkDefaultRule =
1684 StringPrintf("%u:\tfrom all fwmark 0x0/0xffff iif lo", RULE_PRIORITY_DEFAULT_NETWORK);
1685
1686 for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) {
1687 std::vector<std::string> rules = listIpRules(ipVersion);
1688 for (const auto& line : rules) {
1689 if (android::base::StartsWith(line, networkDefaultRule)) {
1690 FAIL();
1691 }
1692 }
1693 }
1694 }
1695
expectNetworkPermissionIpRuleExists(const char * ifName,int permission)1696 void expectNetworkPermissionIpRuleExists(const char* ifName, int permission) {
1697 std::string networkPermissionRule = "";
1698 switch (permission) {
1699 case INetd::PERMISSION_NONE:
1700 networkPermissionRule =
1701 StringPrintf("%u:\tfrom all fwmark 0x1ffdd/0x1ffff iif lo lookup %s",
1702 RULE_PRIORITY_EXPLICIT_NETWORK, ifName);
1703 break;
1704 case INetd::PERMISSION_NETWORK:
1705 networkPermissionRule =
1706 StringPrintf("%u:\tfrom all fwmark 0x5ffdd/0x5ffff iif lo lookup %s",
1707 RULE_PRIORITY_EXPLICIT_NETWORK, ifName);
1708 break;
1709 case INetd::PERMISSION_SYSTEM:
1710 networkPermissionRule =
1711 StringPrintf("%u:\tfrom all fwmark 0xdffdd/0xdffff iif lo lookup %s",
1712 RULE_PRIORITY_EXPLICIT_NETWORK, ifName);
1713 break;
1714 }
1715
1716 expectRuleForV4AndV6(ALL_EXIST, networkPermissionRule);
1717 }
1718
1719 // TODO: It is a duplicate function, need to remove it
iptablesNetworkPermissionIptablesRuleExists(const char * binary,const char * chainName,const std::string & expectedInterface,const std::string & expectedRule,const char * table)1720 bool iptablesNetworkPermissionIptablesRuleExists(const char* binary, const char* chainName,
1721 const std::string& expectedInterface,
1722 const std::string& expectedRule,
1723 const char* table) {
1724 std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName);
1725 for (const auto& rule : rules) {
1726 if (rule.find(expectedInterface) != std::string::npos) {
1727 if (rule.find(expectedRule) != std::string::npos) {
1728 return true;
1729 }
1730 }
1731 }
1732 return false;
1733 }
1734
expectNetworkPermissionIptablesRuleExists(const char * ifName,int permission)1735 void expectNetworkPermissionIptablesRuleExists(const char* ifName, int permission) {
1736 static const char ROUTECTRL_INPUT[] = "routectrl_mangle_INPUT";
1737 std::string networkIncomingPacketMarkRule = "";
1738 switch (permission) {
1739 case INetd::PERMISSION_NONE:
1740 networkIncomingPacketMarkRule = "MARK xset 0x3ffdd/0xffefffff";
1741 break;
1742 case INetd::PERMISSION_NETWORK:
1743 networkIncomingPacketMarkRule = "MARK xset 0x7ffdd/0xffefffff";
1744 break;
1745 case INetd::PERMISSION_SYSTEM:
1746 networkIncomingPacketMarkRule = "MARK xset 0xfffdd/0xffefffff";
1747 break;
1748 }
1749
1750 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
1751 EXPECT_TRUE(iptablesNetworkPermissionIptablesRuleExists(
1752 binary, ROUTECTRL_INPUT, ifName, networkIncomingPacketMarkRule, MANGLE_TABLE));
1753 }
1754 }
1755
1756 } // namespace
1757
TEST_F(NetdBinderTest,StrictSetUidCleartextPenalty)1758 TEST_F(NetdBinderTest, StrictSetUidCleartextPenalty) {
1759 binder::Status status;
1760 int32_t uid = randomUid();
1761
1762 // setUidCleartextPenalty Policy:Log with randomUid
1763 status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_LOG);
1764 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1765 expectStrictSetUidLog(uid);
1766
1767 // setUidCleartextPenalty Policy:Accept with randomUid
1768 status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_ACCEPT);
1769 expectStrictSetUidAccept(uid);
1770
1771 // setUidCleartextPenalty Policy:Reject with randomUid
1772 status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_REJECT);
1773 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1774 expectStrictSetUidReject(uid);
1775
1776 // setUidCleartextPenalty Policy:Accept with randomUid
1777 status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_ACCEPT);
1778 expectStrictSetUidAccept(uid);
1779
1780 // test wrong policy
1781 int32_t wrongPolicy = -123;
1782 status = mNetd->strictUidCleartextPenalty(uid, wrongPolicy);
1783 EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode());
1784 }
1785
1786 namespace {
1787
tryToFindProcesses(const std::string & processName,uint32_t maxTries=1,uint32_t intervalMs=50)1788 std::vector<std::string> tryToFindProcesses(const std::string& processName, uint32_t maxTries = 1,
1789 uint32_t intervalMs = 50) {
1790 // Output looks like:(clatd)
1791 // clat 4963 850 1 12:16:51 ? 00:00:00 clatd-netd10a88 -i netd10a88 ...
1792 // ...
1793 // root 5221 5219 0 12:18:12 ? 00:00:00 sh -c ps -Af | grep ' clatd-netdcc1a0'
1794
1795 // (dnsmasq)
1796 // dns_tether 4620 792 0 16:51:28 ? 00:00:00 dnsmasq --keep-in-foreground ...
1797
1798 if (maxTries == 0) return {};
1799
1800 std::string cmd = StringPrintf("ps -Af | grep '[0-9] %s'", processName.c_str());
1801 std::vector<std::string> result;
1802 for (uint32_t run = 1;;) {
1803 result = runCommand(cmd);
1804 if (result.size() || ++run > maxTries) {
1805 break;
1806 }
1807
1808 usleep(intervalMs * 1000);
1809 }
1810 return result;
1811 }
1812
expectProcessExists(const std::string & processName)1813 void expectProcessExists(const std::string& processName) {
1814 EXPECT_EQ(1U, tryToFindProcesses(processName, 5 /*maxTries*/).size());
1815 }
1816
expectProcessDoesNotExist(const std::string & processName)1817 void expectProcessDoesNotExist(const std::string& processName) {
1818 EXPECT_FALSE(tryToFindProcesses(processName).size());
1819 }
1820
1821 } // namespace
1822
TEST_F(NetdBinderTest,NetworkAddRemoveRouteToLocalExcludeTable)1823 TEST_F(NetdBinderTest, NetworkAddRemoveRouteToLocalExcludeTable) {
1824 static const struct {
1825 const char* ipVersion;
1826 const char* testDest;
1827 const char* testNextHop;
1828 const bool expectInLocalTable;
1829 } kTestData[] = {{IP_RULE_V6, "::/0", "fe80::", false},
1830 {IP_RULE_V6, "::/0", "", false},
1831 {IP_RULE_V6, "2001:db8:cafe::/64", "fe80::", false},
1832 {IP_RULE_V6, "fe80::/64", "", true},
1833 {IP_RULE_V6, "2001:db8:cafe::/48", "", true},
1834 {IP_RULE_V6, "2001:db8:cafe::/64", "unreachable", false},
1835 {IP_RULE_V6, "2001:db8:ca00::/40", "", true},
1836 {IP_RULE_V4, "0.0.0.0/0", "10.251.10.1", false},
1837 {IP_RULE_V4, "192.1.0.0/16", "", false},
1838 {IP_RULE_V4, "192.168.0.0/15", "", false},
1839 {IP_RULE_V4, "192.168.0.0/16", "", true},
1840 {IP_RULE_V4, "192.168.0.0/24", "", true},
1841 {IP_RULE_V4, "100.1.0.0/16", "", false},
1842 {IP_RULE_V4, "100.0.0.0/8", "", false},
1843 {IP_RULE_V4, "100.64.0.0/10", "", true},
1844 {IP_RULE_V4, "100.64.0.0/16", "", true},
1845 {IP_RULE_V4, "100.64.0.0/10", "throw", false},
1846 {IP_RULE_V4, "172.0.0.0/8", "", false},
1847 {IP_RULE_V4, "172.16.0.0/12", "", true},
1848 {IP_RULE_V4, "172.16.0.0/16", "", true},
1849 {IP_RULE_V4, "172.16.0.0/12", "unreachable", false},
1850 {IP_RULE_V4, "172.32.0.0/12", "", false},
1851 {IP_RULE_V4, "169.0.0.0/8", "", false},
1852 {IP_RULE_V4, "169.254.0.0/16", "", true},
1853 {IP_RULE_V4, "169.254.0.0/20", "", true},
1854 {IP_RULE_V4, "169.254.3.0/24", "", true},
1855 {IP_RULE_V4, "170.254.0.0/16", "", false},
1856 {IP_RULE_V4, "10.0.0.0/8", "", true},
1857 {IP_RULE_V4, "10.0.0.0/7", "", false},
1858 {IP_RULE_V4, "10.0.0.0/16", "", true},
1859 {IP_RULE_V4, "10.251.0.0/16", "", true},
1860 {IP_RULE_V4, "10.251.250.0/24", "", true},
1861 {IP_RULE_V4, "10.251.10.2/31", "throw", false},
1862 {IP_RULE_V4, "10.251.10.2/31", "unreachable", false}};
1863
1864 // To ensure that the nexthops for the above are reachable.
1865 // Otherwise, the routes can't be created.
1866 static const struct {
1867 const char* ipVersion;
1868 const char* testDest;
1869 const char* testNextHop;
1870 } kDirectlyConnectedRoutes[] = {
1871 {IP_RULE_V4, "10.251.10.0/30", ""},
1872 {IP_RULE_V6, "2001:db8::/32", ""},
1873 };
1874
1875 // This should ba aligned with V4_FIXED_LOCAL_PREFIXES in system/netd/server/RouteController.cpp
1876 // An expandable array for fixed local prefix though it's only one element now.
1877 static const char* kV4LocalPrefixes[] = {"224.0.0.0/24"};
1878
1879 // Add test physical network
1880 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
1881 INetd::PERMISSION_NONE, false, false);
1882 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
1883 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
1884
1885 // Get current default network NetId
1886 binder::Status status = mNetd->networkGetDefault(&mStoredDefaultNetwork);
1887 ASSERT_TRUE(status.isOk()) << status.exceptionMessage();
1888
1889 // Set default network
1890 EXPECT_TRUE(mNetd->networkSetDefault(TEST_NETID1).isOk());
1891
1892 std::string localTableName = std::string(sTun.name() + "_local");
1893
1894 // Verify the fixed routes exist in the local table.
1895 for (size_t i = 0; i < std::size(kV4LocalPrefixes); i++) {
1896 expectNetworkRouteExists(IP_RULE_V4, sTun.name(), kV4LocalPrefixes[i], "",
1897 localTableName.c_str());
1898 }
1899
1900 // Set up link-local routes for connectivity to the "gateway"
1901 for (size_t i = 0; i < std::size(kDirectlyConnectedRoutes); i++) {
1902 const auto& td = kDirectlyConnectedRoutes[i];
1903
1904 binder::Status status =
1905 mNetd->networkAddRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop);
1906 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1907 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
1908 sTun.name().c_str());
1909 // Verify routes in local table
1910 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
1911 localTableName.c_str());
1912 }
1913
1914 for (size_t i = 0; i < std::size(kTestData); i++) {
1915 const auto& td = kTestData[i];
1916 SCOPED_TRACE(StringPrintf("case ip:%s, dest:%s, nexHop:%s, expect:%d", td.ipVersion,
1917 td.testDest, td.testNextHop, td.expectInLocalTable));
1918 binder::Status status =
1919 mNetd->networkAddRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop);
1920 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1921 // Verify routes in local table
1922 if (td.expectInLocalTable) {
1923 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
1924 localTableName.c_str());
1925 } else {
1926 expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
1927 localTableName.c_str());
1928 }
1929
1930 status = mNetd->networkRemoveRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop);
1931 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1932 expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
1933 localTableName.c_str());
1934 }
1935
1936 for (size_t i = 0; i < std::size(kDirectlyConnectedRoutes); i++) {
1937 const auto& td = kDirectlyConnectedRoutes[i];
1938 status = mNetd->networkRemoveRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop);
1939 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
1940 }
1941
1942 // Set default network back
1943 status = mNetd->networkSetDefault(mStoredDefaultNetwork);
1944
1945 // Remove test physical network
1946 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
1947 }
1948
1949 namespace {
1950
getIpfwdV4Enable()1951 bool getIpfwdV4Enable() {
1952 static const char ipv4IpfwdCmd[] = "cat /proc/sys/net/ipv4/ip_forward";
1953 std::vector<std::string> result = runCommand(ipv4IpfwdCmd);
1954 EXPECT_TRUE(!result.empty());
1955 int v4Enable = std::stoi(result[0]);
1956 return v4Enable;
1957 }
1958
getIpfwdV6Enable()1959 bool getIpfwdV6Enable() {
1960 static const char ipv6IpfwdCmd[] = "cat /proc/sys/net/ipv6/conf/all/forwarding";
1961 std::vector<std::string> result = runCommand(ipv6IpfwdCmd);
1962 EXPECT_TRUE(!result.empty());
1963 int v6Enable = std::stoi(result[0]);
1964 return v6Enable;
1965 }
1966
expectIpfwdEnable(bool enable)1967 void expectIpfwdEnable(bool enable) {
1968 int enableIPv4 = getIpfwdV4Enable();
1969 int enableIPv6 = getIpfwdV6Enable();
1970 EXPECT_EQ(enable, enableIPv4);
1971 EXPECT_EQ(enable, enableIPv6);
1972 }
1973
ipRuleIpfwdExists(const char * ipVersion,const std::string & ipfwdRule)1974 bool ipRuleIpfwdExists(const char* ipVersion, const std::string& ipfwdRule) {
1975 std::vector<std::string> rules = listIpRules(ipVersion);
1976 for (const auto& rule : rules) {
1977 if (rule.find(ipfwdRule) != std::string::npos) {
1978 return true;
1979 }
1980 }
1981 return false;
1982 }
1983
expectIpfwdRuleExists(const char * fromIf,const char * toIf)1984 void expectIpfwdRuleExists(const char* fromIf, const char* toIf) {
1985 std::string ipfwdRule =
1986 StringPrintf("%u:\tfrom all iif %s lookup %s", RULE_PRIORITY_TETHERING, fromIf, toIf);
1987
1988 for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) {
1989 EXPECT_TRUE(ipRuleIpfwdExists(ipVersion, ipfwdRule));
1990 }
1991 }
1992
expectIpfwdRuleNotExists(const char * fromIf,const char * toIf)1993 void expectIpfwdRuleNotExists(const char* fromIf, const char* toIf) {
1994 std::string ipfwdRule =
1995 StringPrintf("%u:\tfrom all iif %s lookup %s", RULE_PRIORITY_TETHERING, fromIf, toIf);
1996
1997 for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) {
1998 EXPECT_FALSE(ipRuleIpfwdExists(ipVersion, ipfwdRule));
1999 }
2000 }
2001
2002 } // namespace
2003
TEST_F(NetdBinderTest,TestIpfwdEnableDisableStatusForwarding)2004 TEST_F(NetdBinderTest, TestIpfwdEnableDisableStatusForwarding) {
2005 // Get ipfwd requester list from Netd
2006 std::vector<std::string> requesterList;
2007 binder::Status status = mNetd->ipfwdGetRequesterList(&requesterList);
2008 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2009
2010 bool ipfwdEnabled;
2011 if (requesterList.size() == 0) {
2012 // No requester in Netd, ipfwd should be disabled
2013 // So add one test requester and verify
2014 status = mNetd->ipfwdEnableForwarding("TestRequester");
2015 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2016
2017 expectIpfwdEnable(true);
2018 status = mNetd->ipfwdEnabled(&ipfwdEnabled);
2019 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2020 EXPECT_TRUE(ipfwdEnabled);
2021
2022 // Remove test one, verify again
2023 status = mNetd->ipfwdDisableForwarding("TestRequester");
2024 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2025
2026 expectIpfwdEnable(false);
2027 status = mNetd->ipfwdEnabled(&ipfwdEnabled);
2028 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2029 EXPECT_FALSE(ipfwdEnabled);
2030 } else {
2031 // Disable all requesters
2032 for (const auto& requester : requesterList) {
2033 status = mNetd->ipfwdDisableForwarding(requester);
2034 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2035 }
2036
2037 // After disable all requester, ipfwd should be disabled
2038 expectIpfwdEnable(false);
2039 status = mNetd->ipfwdEnabled(&ipfwdEnabled);
2040 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2041 EXPECT_FALSE(ipfwdEnabled);
2042
2043 // Enable them back
2044 for (const auto& requester : requesterList) {
2045 status = mNetd->ipfwdEnableForwarding(requester);
2046 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2047 }
2048
2049 // ipfwd should be enabled
2050 expectIpfwdEnable(true);
2051 status = mNetd->ipfwdEnabled(&ipfwdEnabled);
2052 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2053 EXPECT_TRUE(ipfwdEnabled);
2054 }
2055 }
2056
TEST_F(NetdBinderTest,TestIpfwdAddRemoveInterfaceForward)2057 TEST_F(NetdBinderTest, TestIpfwdAddRemoveInterfaceForward) {
2058 // Add test physical network
2059 auto config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
2060 INetd::PERMISSION_NONE, false, false);
2061 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
2062 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
2063
2064 config.netId = TEST_NETID2;
2065 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
2066 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID2, sTun2.name()).isOk());
2067
2068 binder::Status status = mNetd->ipfwdAddInterfaceForward(sTun.name(), sTun2.name());
2069 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2070 expectIpfwdRuleExists(sTun.name().c_str(), sTun2.name().c_str());
2071
2072 status = mNetd->ipfwdRemoveInterfaceForward(sTun.name(), sTun2.name());
2073 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2074 expectIpfwdRuleNotExists(sTun.name().c_str(), sTun2.name().c_str());
2075 }
2076
2077 namespace {
2078
2079 constexpr char BANDWIDTH_INPUT[] = "bw_INPUT";
2080 constexpr char BANDWIDTH_OUTPUT[] = "bw_OUTPUT";
2081 constexpr char BANDWIDTH_FORWARD[] = "bw_FORWARD";
2082 constexpr char BANDWIDTH_NAUGHTY[] = "bw_penalty_box";
2083 constexpr char BANDWIDTH_ALERT[] = "bw_global_alert";
2084
2085 // TODO: Move iptablesTargetsExists and listIptablesRuleByTable to the top.
2086 // Use either a std::vector<std::string> of things to match, or a variadic function.
iptablesTargetsExists(const char * binary,int expectedCount,const char * table,const char * chainName,const std::string & expectedTargetA,const std::string & expectedTargetB)2087 bool iptablesTargetsExists(const char* binary, int expectedCount, const char* table,
2088 const char* chainName, const std::string& expectedTargetA,
2089 const std::string& expectedTargetB) {
2090 std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName);
2091 int matchCount = 0;
2092
2093 for (const auto& rule : rules) {
2094 if (rule.find(expectedTargetA) != std::string::npos) {
2095 if (rule.find(expectedTargetB) != std::string::npos) {
2096 matchCount++;
2097 }
2098 }
2099 }
2100 return matchCount == expectedCount;
2101 }
2102
expectXtQuotaValueEqual(const char * ifname,long quotaBytes)2103 void expectXtQuotaValueEqual(const char* ifname, long quotaBytes) {
2104 std::string path = StringPrintf("/proc/net/xt_quota/%s", ifname);
2105 std::string result = "";
2106
2107 EXPECT_TRUE(ReadFileToString(path, &result));
2108 // Quota value might be decreased while matching packets
2109 EXPECT_GE(quotaBytes, std::stol(Trim(result)));
2110 }
2111
expectBandwidthInterfaceQuotaRuleExists(const char * ifname,long quotaBytes)2112 void expectBandwidthInterfaceQuotaRuleExists(const char* ifname, long quotaBytes) {
2113 std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname);
2114 std::string quotaRule = StringPrintf("quota %s", ifname);
2115
2116 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2117 EXPECT_TRUE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_INPUT, ifname,
2118 BANDWIDTH_COSTLY_IF));
2119 EXPECT_TRUE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_OUTPUT, ifname,
2120 BANDWIDTH_COSTLY_IF));
2121 EXPECT_TRUE(iptablesTargetsExists(binary, 2, FILTER_TABLE, BANDWIDTH_FORWARD, ifname,
2122 BANDWIDTH_COSTLY_IF));
2123 EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), BANDWIDTH_NAUGHTY));
2124 EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), quotaRule));
2125 }
2126 expectXtQuotaValueEqual(ifname, quotaBytes);
2127 }
2128
expectBandwidthInterfaceQuotaRuleDoesNotExist(const char * ifname)2129 void expectBandwidthInterfaceQuotaRuleDoesNotExist(const char* ifname) {
2130 std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname);
2131 std::string quotaRule = StringPrintf("quota %s", ifname);
2132
2133 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2134 EXPECT_FALSE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_INPUT, ifname,
2135 BANDWIDTH_COSTLY_IF));
2136 EXPECT_FALSE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_OUTPUT, ifname,
2137 BANDWIDTH_COSTLY_IF));
2138 EXPECT_FALSE(iptablesTargetsExists(binary, 2, FILTER_TABLE, BANDWIDTH_FORWARD, ifname,
2139 BANDWIDTH_COSTLY_IF));
2140 EXPECT_FALSE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), BANDWIDTH_NAUGHTY));
2141 EXPECT_FALSE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), quotaRule));
2142 }
2143 }
2144
expectBandwidthInterfaceAlertRuleExists(const char * ifname,long alertBytes)2145 void expectBandwidthInterfaceAlertRuleExists(const char* ifname, long alertBytes) {
2146 std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname);
2147 std::string alertRule = StringPrintf("quota %sAlert", ifname);
2148 std::string alertName = StringPrintf("%sAlert", ifname);
2149
2150 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2151 EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), alertRule));
2152 }
2153 expectXtQuotaValueEqual(alertName.c_str(), alertBytes);
2154 }
2155
expectBandwidthInterfaceAlertRuleDoesNotExist(const char * ifname)2156 void expectBandwidthInterfaceAlertRuleDoesNotExist(const char* ifname) {
2157 std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname);
2158 std::string alertRule = StringPrintf("quota %sAlert", ifname);
2159
2160 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2161 EXPECT_FALSE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), alertRule));
2162 }
2163 }
2164
expectBandwidthGlobalAlertRuleExists(long alertBytes)2165 void expectBandwidthGlobalAlertRuleExists(long alertBytes) {
2166 static const char globalAlertRule[] = "quota globalAlert";
2167 static const char globalAlertName[] = "globalAlert";
2168
2169 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2170 EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_ALERT, globalAlertRule));
2171 }
2172 expectXtQuotaValueEqual(globalAlertName, alertBytes);
2173 }
2174
2175 } // namespace
2176
TEST_F(NetdBinderTest,BandwidthSetRemoveInterfaceQuota)2177 TEST_F(NetdBinderTest, BandwidthSetRemoveInterfaceQuota) {
2178 long testQuotaBytes = 5550;
2179
2180 // Add test physical network
2181 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
2182 INetd::PERMISSION_NONE, false, false);
2183 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
2184 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
2185
2186 binder::Status status = mNetd->bandwidthSetInterfaceQuota(sTun.name(), testQuotaBytes);
2187 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2188 expectBandwidthInterfaceQuotaRuleExists(sTun.name().c_str(), testQuotaBytes);
2189
2190 status = mNetd->bandwidthRemoveInterfaceQuota(sTun.name());
2191 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2192 expectBandwidthInterfaceQuotaRuleDoesNotExist(sTun.name().c_str());
2193
2194 // Remove test physical network
2195 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
2196 }
2197
TEST_F(NetdBinderTest,BandwidthSetRemoveInterfaceAlert)2198 TEST_F(NetdBinderTest, BandwidthSetRemoveInterfaceAlert) {
2199 long testAlertBytes = 373;
2200 // Add test physical network
2201 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
2202 INetd::PERMISSION_NONE, false, false);
2203 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
2204 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
2205 // Need to have a prior interface quota set to set an alert
2206 binder::Status status = mNetd->bandwidthSetInterfaceQuota(sTun.name(), testAlertBytes);
2207 status = mNetd->bandwidthSetInterfaceAlert(sTun.name(), testAlertBytes);
2208 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2209 expectBandwidthInterfaceAlertRuleExists(sTun.name().c_str(), testAlertBytes);
2210
2211 status = mNetd->bandwidthRemoveInterfaceAlert(sTun.name());
2212 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2213 expectBandwidthInterfaceAlertRuleDoesNotExist(sTun.name().c_str());
2214
2215 // Remove interface quota
2216 status = mNetd->bandwidthRemoveInterfaceQuota(sTun.name());
2217 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2218 expectBandwidthInterfaceQuotaRuleDoesNotExist(sTun.name().c_str());
2219
2220 // Remove test physical network
2221 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
2222 }
2223
TEST_F(NetdBinderTest,BandwidthSetGlobalAlert)2224 TEST_F(NetdBinderTest, BandwidthSetGlobalAlert) {
2225 int64_t testAlertBytes = 2097200;
2226
2227 binder::Status status = mNetd->bandwidthSetGlobalAlert(testAlertBytes);
2228 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2229 expectBandwidthGlobalAlertRuleExists(testAlertBytes);
2230
2231 testAlertBytes = 2098230;
2232 status = mNetd->bandwidthSetGlobalAlert(testAlertBytes);
2233 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2234 expectBandwidthGlobalAlertRuleExists(testAlertBytes);
2235 }
2236
TEST_F(NetdBinderTest,NetworkAddRemoveRouteUserPermission)2237 TEST_F(NetdBinderTest, NetworkAddRemoveRouteUserPermission) {
2238 static const struct {
2239 const char* ipVersion;
2240 const char* testDest;
2241 const char* testNextHop;
2242 const bool expectSuccess;
2243 } kTestData[] = {
2244 {IP_RULE_V4, "0.0.0.0/0", "", true},
2245 {IP_RULE_V4, "0.0.0.0/0", "10.251.10.0", true},
2246 {IP_RULE_V4, "10.251.0.0/16", "", true},
2247 {IP_RULE_V4, "10.251.0.0/16", "10.251.10.0", true},
2248 {IP_RULE_V4, "10.251.0.0/16", "fe80::/64", false},
2249 {IP_RULE_V6, "::/0", "", true},
2250 {IP_RULE_V6, "::/0", "2001:db8::", true},
2251 {IP_RULE_V6, "2001:db8:cafe::/64", "2001:db8::", true},
2252 {IP_RULE_V4, "fe80::/64", "0.0.0.0", false},
2253 {IP_RULE_V4, "10.251.10.2/31", "throw", true},
2254 {IP_RULE_V4, "10.251.10.2/31", "unreachable", true},
2255 {IP_RULE_V4, "0.0.0.0/0", "throw", true},
2256 {IP_RULE_V4, "0.0.0.0/0", "unreachable", true},
2257 {IP_RULE_V6, "::/0", "throw", true},
2258 {IP_RULE_V6, "::/0", "unreachable", true},
2259 {IP_RULE_V6, "2001:db8:cafe::/64", "throw", true},
2260 {IP_RULE_V6, "2001:db8:cafe::/64", "unreachable", true},
2261 };
2262
2263 static const struct {
2264 const char* ipVersion;
2265 const char* testDest;
2266 const char* testNextHop;
2267 } kTestDataWithNextHop[] = {
2268 {IP_RULE_V4, "10.251.10.0/30", ""},
2269 {IP_RULE_V6, "2001:db8::/32", ""},
2270 };
2271
2272 static const char testTableLegacySystem[] = "legacy_system";
2273 static const char testTableLegacyNetwork[] = "legacy_network";
2274 const int testUid = randomUid();
2275 const std::vector<int32_t> testUids = {testUid};
2276
2277 // Add test physical network
2278 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
2279 INetd::PERMISSION_NONE, false, false);
2280 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
2281 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
2282
2283 // Setup route for testing nextHop
2284 for (size_t i = 0; i < std::size(kTestDataWithNextHop); i++) {
2285 const auto& td = kTestDataWithNextHop[i];
2286
2287 // All route for test tun will disappear once the tun interface is deleted.
2288 binder::Status status =
2289 mNetd->networkAddRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop);
2290 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2291 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2292 sTun.name().c_str());
2293
2294 // Add system permission for test uid, setup route in legacy system table.
2295 EXPECT_TRUE(mNetd->networkSetPermissionForUser(INetd::PERMISSION_SYSTEM, testUids).isOk());
2296
2297 status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop,
2298 testUid);
2299 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2300 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2301 testTableLegacySystem);
2302
2303 // Remove system permission for test uid, setup route in legacy network table.
2304 EXPECT_TRUE(mNetd->networkClearPermissionForUser(testUids).isOk());
2305
2306 status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop,
2307 testUid);
2308 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2309 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2310 testTableLegacyNetwork);
2311 }
2312
2313 for (size_t i = 0; i < std::size(kTestData); i++) {
2314 const auto& td = kTestData[i];
2315
2316 binder::Status status =
2317 mNetd->networkAddRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop);
2318 if (td.expectSuccess) {
2319 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2320 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2321 sTun.name().c_str());
2322 } else {
2323 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2324 EXPECT_NE(0, status.serviceSpecificErrorCode());
2325 }
2326
2327 status = mNetd->networkRemoveRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop);
2328 if (td.expectSuccess) {
2329 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2330 expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2331 sTun.name().c_str());
2332 } else {
2333 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2334 EXPECT_NE(0, status.serviceSpecificErrorCode());
2335 }
2336
2337 // Add system permission for test uid, route will be added into legacy system table.
2338 EXPECT_TRUE(mNetd->networkSetPermissionForUser(INetd::PERMISSION_SYSTEM, testUids).isOk());
2339
2340 status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop,
2341 testUid);
2342 if (td.expectSuccess) {
2343 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2344 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2345 testTableLegacySystem);
2346 } else {
2347 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2348 EXPECT_NE(0, status.serviceSpecificErrorCode());
2349 }
2350
2351 status = mNetd->networkRemoveLegacyRoute(TEST_NETID1, sTun.name(), td.testDest,
2352 td.testNextHop, testUid);
2353 if (td.expectSuccess) {
2354 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2355 expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2356 testTableLegacySystem);
2357 } else {
2358 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2359 EXPECT_NE(0, status.serviceSpecificErrorCode());
2360 }
2361
2362 // Remove system permission for test uid, route will be added into legacy network table.
2363 EXPECT_TRUE(mNetd->networkClearPermissionForUser(testUids).isOk());
2364
2365 status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop,
2366 testUid);
2367 if (td.expectSuccess) {
2368 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2369 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2370 testTableLegacyNetwork);
2371 } else {
2372 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2373 EXPECT_NE(0, status.serviceSpecificErrorCode());
2374 }
2375
2376 status = mNetd->networkRemoveLegacyRoute(TEST_NETID1, sTun.name(), td.testDest,
2377 td.testNextHop, testUid);
2378 if (td.expectSuccess) {
2379 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2380 expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2381 testTableLegacyNetwork);
2382 } else {
2383 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2384 EXPECT_NE(0, status.serviceSpecificErrorCode());
2385 }
2386 }
2387
2388 /*
2389 * Test networkUpdateRouteParcel behavior in case of route MTU change.
2390 *
2391 * Change of route MTU should be treated as an update of the route:
2392 * - networkUpdateRouteParcel should succeed and update route MTU.
2393 */
2394 for (size_t i = 0; i < std::size(kTestData); i++) {
2395 const auto& td = kTestData[i];
2396 int mtu = (i % 2) ? 1480 : 1280;
2397
2398 android::net::RouteInfoParcel parcel;
2399 parcel.ifName = sTun.name();
2400 parcel.destination = td.testDest;
2401 parcel.nextHop = td.testNextHop;
2402 parcel.mtu = mtu;
2403 binder::Status status = mNetd->networkAddRouteParcel(TEST_NETID1, parcel);
2404 if (td.expectSuccess) {
2405 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2406 expectNetworkRouteExistsWithMtu(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2407 std::to_string(parcel.mtu), sTun.name().c_str());
2408 } else {
2409 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2410 EXPECT_NE(0, status.serviceSpecificErrorCode());
2411 }
2412
2413 parcel.mtu = 1337;
2414 status = mNetd->networkUpdateRouteParcel(TEST_NETID1, parcel);
2415 if (td.expectSuccess) {
2416 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2417 expectNetworkRouteExistsWithMtu(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2418 std::to_string(parcel.mtu), sTun.name().c_str());
2419 } else {
2420 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2421 EXPECT_NE(0, status.serviceSpecificErrorCode());
2422 }
2423
2424 status = mNetd->networkRemoveRouteParcel(TEST_NETID1, parcel);
2425 if (td.expectSuccess) {
2426 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2427 expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2428 sTun.name().c_str());
2429 } else {
2430 EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
2431 EXPECT_NE(0, status.serviceSpecificErrorCode());
2432 }
2433 }
2434
2435 /*
2436 * Test network[Update|Add]RouteParcel behavior in case of route type change.
2437 *
2438 * Change of route type should be treated as an update of the route:
2439 * - networkUpdateRouteParcel should succeed and update route type.
2440 * - networkAddRouteParcel should silently fail, because the route already exists. Route type
2441 * should not be changed in this case.
2442 */
2443 for (size_t i = 0; i < std::size(kTestData); i++) {
2444 const auto& td = kTestData[i];
2445
2446 if (!td.expectSuccess) {
2447 continue;
2448 }
2449
2450 android::net::RouteInfoParcel parcel;
2451 parcel.ifName = sTun.name();
2452 parcel.destination = td.testDest;
2453 parcel.nextHop = td.testNextHop;
2454 parcel.mtu = 1280;
2455 binder::Status status = mNetd->networkAddRouteParcel(TEST_NETID1, parcel);
2456 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2457 expectNetworkRouteExistsWithMtu(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
2458 std::to_string(parcel.mtu), sTun.name().c_str());
2459
2460 parcel.nextHop = parcel.nextHop == "throw" ? "unreachable" : "throw";
2461 const char* oldNextHop = td.testNextHop;
2462 const char* newNextHop = parcel.nextHop.c_str();
2463
2464 // Trying to add same route with changed type, this should silently fail.
2465 status = mNetd->networkAddRouteParcel(TEST_NETID1, parcel);
2466 // No error reported.
2467 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2468 // Old route still exists.
2469 expectNetworkRouteExistsWithMtu(td.ipVersion, sTun.name(), td.testDest, oldNextHop,
2470 std::to_string(parcel.mtu), sTun.name().c_str());
2471 // New route was not actually added.
2472 expectNetworkRouteDoesNotExistWithMtu(td.ipVersion, sTun.name(), td.testDest, newNextHop,
2473 std::to_string(parcel.mtu), sTun.name().c_str());
2474
2475 // Update should succeed.
2476 status = mNetd->networkUpdateRouteParcel(TEST_NETID1, parcel);
2477 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2478 expectNetworkRouteExistsWithMtu(td.ipVersion, sTun.name(), td.testDest, newNextHop,
2479 std::to_string(parcel.mtu), sTun.name().c_str());
2480 expectNetworkRouteDoesNotExistWithMtu(td.ipVersion, sTun.name(), td.testDest, oldNextHop,
2481 std::to_string(parcel.mtu), sTun.name().c_str());
2482
2483 status = mNetd->networkRemoveRouteParcel(TEST_NETID1, parcel);
2484 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2485 expectNetworkRouteDoesNotExistWithMtu(td.ipVersion, sTun.name(), td.testDest, newNextHop,
2486 std::to_string(parcel.mtu), sTun.name().c_str());
2487 }
2488
2489 // Remove test physical network
2490 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
2491 }
2492
TEST_F(NetdBinderTest,NetworkPermissionDefault)2493 TEST_F(NetdBinderTest, NetworkPermissionDefault) {
2494 // Add test physical network
2495 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
2496 INetd::PERMISSION_NONE, false, false);
2497 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
2498 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
2499
2500 // Get current default network NetId
2501 binder::Status status = mNetd->networkGetDefault(&mStoredDefaultNetwork);
2502 ASSERT_TRUE(status.isOk()) << status.exceptionMessage();
2503
2504 // Test SetDefault
2505 status = mNetd->networkSetDefault(TEST_NETID1);
2506 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2507 expectNetworkDefaultIpRuleExists(sTun.name().c_str());
2508
2509 status = mNetd->networkClearDefault();
2510 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2511 expectNetworkDefaultIpRuleDoesNotExist();
2512
2513 // Set default network back
2514 status = mNetd->networkSetDefault(mStoredDefaultNetwork);
2515 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2516
2517 // Test SetPermission
2518 status = mNetd->networkSetPermissionForNetwork(TEST_NETID1, INetd::PERMISSION_SYSTEM);
2519 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2520 expectNetworkPermissionIpRuleExists(sTun.name().c_str(), INetd::PERMISSION_SYSTEM);
2521 expectNetworkPermissionIptablesRuleExists(sTun.name().c_str(), INetd::PERMISSION_SYSTEM);
2522
2523 status = mNetd->networkSetPermissionForNetwork(TEST_NETID1, INetd::PERMISSION_NONE);
2524 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2525 expectNetworkPermissionIpRuleExists(sTun.name().c_str(), INetd::PERMISSION_NONE);
2526 expectNetworkPermissionIptablesRuleExists(sTun.name().c_str(), INetd::PERMISSION_NONE);
2527
2528 // Remove test physical network
2529 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
2530 }
2531
TEST_F(NetdBinderTest,NetworkSetProtectAllowDeny)2532 TEST_F(NetdBinderTest, NetworkSetProtectAllowDeny) {
2533 binder::Status status = mNetd->networkSetProtectAllow(TEST_UID1);
2534 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2535 bool ret = false;
2536 status = mNetd->networkCanProtect(TEST_UID1, &ret);
2537 EXPECT_TRUE(ret);
2538
2539 status = mNetd->networkSetProtectDeny(TEST_UID1);
2540 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2541
2542 // Clear uid permission before calling networkCanProtect to ensure
2543 // the call won't be affected by uid permission.
2544 EXPECT_TRUE(mNetd->networkClearPermissionForUser({TEST_UID1}).isOk());
2545
2546 status = mNetd->networkCanProtect(TEST_UID1, &ret);
2547 EXPECT_FALSE(ret);
2548 }
2549
2550 namespace {
2551
readIntFromPath(const std::string & path)2552 int readIntFromPath(const std::string& path) {
2553 std::string result = "";
2554 EXPECT_TRUE(ReadFileToString(path, &result));
2555 return std::stoi(result);
2556 }
2557
getTetherAcceptIPv6Ra(const std::string & ifName)2558 int getTetherAcceptIPv6Ra(const std::string& ifName) {
2559 std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/accept_ra", ifName.c_str());
2560 return readIntFromPath(path);
2561 }
2562
getTetherAcceptIPv6Dad(const std::string & ifName)2563 bool getTetherAcceptIPv6Dad(const std::string& ifName) {
2564 std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/accept_dad", ifName.c_str());
2565 return readIntFromPath(path);
2566 }
2567
getTetherIPv6DadTransmits(const std::string & ifName)2568 int getTetherIPv6DadTransmits(const std::string& ifName) {
2569 std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/dad_transmits", ifName.c_str());
2570 return readIntFromPath(path);
2571 }
2572
getTetherEnableIPv6(const std::string & ifName)2573 bool getTetherEnableIPv6(const std::string& ifName) {
2574 std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/disable_ipv6", ifName.c_str());
2575 int disableIPv6 = readIntFromPath(path);
2576 return !disableIPv6;
2577 }
2578
interfaceListContains(const std::vector<std::string> & ifList,const std::string & ifName)2579 bool interfaceListContains(const std::vector<std::string>& ifList, const std::string& ifName) {
2580 for (const auto& iface : ifList) {
2581 if (iface == ifName) {
2582 return true;
2583 }
2584 }
2585 return false;
2586 }
2587
expectTetherInterfaceConfigureForIPv6Router(const std::string & ifName)2588 void expectTetherInterfaceConfigureForIPv6Router(const std::string& ifName) {
2589 EXPECT_EQ(getTetherAcceptIPv6Ra(ifName), 0);
2590 EXPECT_FALSE(getTetherAcceptIPv6Dad(ifName));
2591 EXPECT_EQ(getTetherIPv6DadTransmits(ifName), 0);
2592 EXPECT_TRUE(getTetherEnableIPv6(ifName));
2593 }
2594
expectTetherInterfaceConfigureForIPv6Client(const std::string & ifName)2595 void expectTetherInterfaceConfigureForIPv6Client(const std::string& ifName) {
2596 EXPECT_EQ(getTetherAcceptIPv6Ra(ifName), 2);
2597 EXPECT_TRUE(getTetherAcceptIPv6Dad(ifName));
2598 EXPECT_EQ(getTetherIPv6DadTransmits(ifName), 1);
2599 EXPECT_FALSE(getTetherEnableIPv6(ifName));
2600 }
2601
expectTetherInterfaceExists(const std::vector<std::string> & ifList,const std::string & ifName)2602 void expectTetherInterfaceExists(const std::vector<std::string>& ifList,
2603 const std::string& ifName) {
2604 EXPECT_TRUE(interfaceListContains(ifList, ifName));
2605 }
2606
expectTetherInterfaceNotExists(const std::vector<std::string> & ifList,const std::string & ifName)2607 void expectTetherInterfaceNotExists(const std::vector<std::string>& ifList,
2608 const std::string& ifName) {
2609 EXPECT_FALSE(interfaceListContains(ifList, ifName));
2610 }
2611
expectTetherDnsListEquals(const std::vector<std::string> & dnsList,const std::vector<std::string> & testDnsAddrs)2612 void expectTetherDnsListEquals(const std::vector<std::string>& dnsList,
2613 const std::vector<std::string>& testDnsAddrs) {
2614 EXPECT_TRUE(dnsList == testDnsAddrs);
2615 }
2616
2617 } // namespace
2618
TEST_F(NetdBinderTest,TetherStartStopStatus)2619 TEST_F(NetdBinderTest, TetherStartStopStatus) {
2620 std::vector<std::string> noDhcpRange = {};
2621 for (bool usingLegacyDnsProxy : {true, false}) {
2622 android::net::TetherConfigParcel config;
2623 config.usingLegacyDnsProxy = usingLegacyDnsProxy;
2624 config.dhcpRanges = noDhcpRange;
2625 binder::Status status = mNetd->tetherStartWithConfiguration(config);
2626 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2627 SCOPED_TRACE(StringPrintf("usingLegacyDnsProxy: %d", usingLegacyDnsProxy));
2628 if (usingLegacyDnsProxy == true) {
2629 expectProcessExists(DNSMASQ);
2630 } else {
2631 expectProcessDoesNotExist(DNSMASQ);
2632 }
2633
2634 bool tetherEnabled;
2635 status = mNetd->tetherIsEnabled(&tetherEnabled);
2636 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2637 EXPECT_TRUE(tetherEnabled);
2638
2639 status = mNetd->tetherStop();
2640 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2641 expectProcessDoesNotExist(DNSMASQ);
2642
2643 status = mNetd->tetherIsEnabled(&tetherEnabled);
2644 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2645 EXPECT_FALSE(tetherEnabled);
2646 }
2647 }
2648
TEST_F(NetdBinderTest,TetherInterfaceAddRemoveList)2649 TEST_F(NetdBinderTest, TetherInterfaceAddRemoveList) {
2650 // TODO: verify if dnsmasq update interface successfully
2651
2652 binder::Status status = mNetd->tetherInterfaceAdd(sTun.name());
2653 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2654 expectTetherInterfaceConfigureForIPv6Router(sTun.name());
2655
2656 std::vector<std::string> ifList;
2657 status = mNetd->tetherInterfaceList(&ifList);
2658 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2659 expectTetherInterfaceExists(ifList, sTun.name());
2660
2661 status = mNetd->tetherInterfaceRemove(sTun.name());
2662 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2663 expectTetherInterfaceConfigureForIPv6Client(sTun.name());
2664
2665 status = mNetd->tetherInterfaceList(&ifList);
2666 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2667 expectTetherInterfaceNotExists(ifList, sTun.name());
2668
2669 // Disable IPv6 tethering will disable IPv6 abilities by changing IPv6 settings(accept_ra,
2670 // dad_transmits, accept_dad, disable_ipv6). See tetherInterfaceRemove in details.
2671 // Re-init sTun to reset the interface to prevent affecting other test that requires IPv6 with
2672 // the same interface.
2673 sTun.destroy();
2674 sTun.init();
2675 }
2676
TEST_F(NetdBinderTest,TetherDnsSetList)2677 TEST_F(NetdBinderTest, TetherDnsSetList) {
2678 // TODO: verify if dnsmasq update dns successfully
2679 std::vector<std::string> testDnsAddrs = {"192.168.1.37", "213.137.100.3",
2680 "fe80::1%" + sTun.name()};
2681
2682 binder::Status status = mNetd->tetherDnsSet(TEST_NETID1, testDnsAddrs);
2683 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2684
2685 std::vector<std::string> dnsList;
2686 status = mNetd->tetherDnsList(&dnsList);
2687 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2688 expectTetherDnsListEquals(dnsList, testDnsAddrs);
2689 }
2690
2691 namespace {
2692
findDnsSockets(SockDiag * sd,unsigned numExpected)2693 std::vector<IPAddress> findDnsSockets(SockDiag* sd, unsigned numExpected) {
2694 std::vector<IPAddress> listenAddrs;
2695
2696 // Callback lambda that finds all IPv4 sockets with source port 53.
2697 auto findDnsSockets = [&](uint8_t /* proto */, const inet_diag_msg* msg) {
2698 // Always return false, which means do not destroy this socket.
2699 if (msg->id.idiag_sport != htons(53)) return false;
2700 IPAddress addr(*(in_addr*)msg->id.idiag_src);
2701 listenAddrs.push_back(addr);
2702 return false;
2703 };
2704
2705 // There is no way to know if dnsmasq has finished processing the update_interfaces command and
2706 // opened listening sockets. So, just spin a few times and return the first list of sockets
2707 // that is at least numExpected long.
2708 // Pick a relatively large timeout to avoid flaky tests, particularly when running on shared
2709 // devices.
2710 constexpr int kMaxAttempts = 50;
2711 constexpr int kSleepMs = 100;
2712 for (int i = 0; i < kMaxAttempts; i++) {
2713 listenAddrs.clear();
2714 EXPECT_EQ(0, sd->sendDumpRequest(IPPROTO_TCP, AF_INET, 1 << TCP_LISTEN))
2715 << "Failed to dump sockets, attempt " << i << " of " << kMaxAttempts;
2716 sd->readDiagMsg(IPPROTO_TCP, findDnsSockets);
2717 if (listenAddrs.size() >= numExpected) {
2718 break;
2719 }
2720 usleep(kSleepMs * 1000);
2721 }
2722
2723 return listenAddrs;
2724 }
2725
2726 } // namespace
2727
2728 // Checks that when starting dnsmasq on an interface that no longer exists, it doesn't attempt to
2729 // start on other interfaces instead.
TEST_F(NetdBinderTest,TetherDeletedInterface)2730 TEST_F(NetdBinderTest, TetherDeletedInterface) {
2731 // Do this first so we don't need to clean up anything else if it fails.
2732 SockDiag sd;
2733 ASSERT_TRUE(sd.open()) << "Failed to open SOCK_DIAG socket";
2734
2735 // Create our own TunInterfaces (so we can delete them without affecting other tests), and add
2736 // IP addresses to them. They must be IPv4 because tethering an interface disables and
2737 // re-enables IPv6 on the interface, which clears all addresses.
2738 TunInterface tun1, tun2;
2739 ASSERT_EQ(0, tun1.init());
2740 ASSERT_EQ(0, tun2.init());
2741
2742 // Clean up. It is safe to call TunInterface::destroy multiple times.
2743 auto guard = android::base::make_scope_guard([&] {
2744 tun1.destroy();
2745 tun2.destroy();
2746 mNetd->tetherStop();
2747 mNetd->tetherInterfaceRemove(tun1.name());
2748 mNetd->tetherInterfaceRemove(tun2.name());
2749 });
2750
2751 IPAddress addr1, addr2;
2752 ASSERT_TRUE(IPAddress::forString("192.0.2.1", &addr1));
2753 ASSERT_TRUE(IPAddress::forString("192.0.2.2", &addr2));
2754 EXPECT_EQ(0, tun1.addAddress(addr1.toString(), 32));
2755 EXPECT_EQ(0, tun2.addAddress(addr2.toString(), 32));
2756
2757 // Stop tethering.
2758 binder::Status status = mNetd->tetherStop();
2759 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2760
2761 // Start dnsmasq on an interface that doesn't exist.
2762 // First, tether our tun interface...
2763 status = mNetd->tetherInterfaceAdd(tun1.name());
2764 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2765 expectTetherInterfaceConfigureForIPv6Router(tun1.name());
2766
2767 // ... then delete it...
2768 tun1.destroy();
2769
2770 // ... then start dnsmasq.
2771 android::net::TetherConfigParcel config;
2772 config.usingLegacyDnsProxy = true;
2773 config.dhcpRanges = {};
2774 status = mNetd->tetherStartWithConfiguration(config);
2775 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2776
2777 // Wait for dnsmasq to start.
2778 expectProcessExists(DNSMASQ);
2779
2780 // Make sure that netd thinks the interface is tethered (even though it doesn't exist).
2781 std::vector<std::string> ifList;
2782 status = mNetd->tetherInterfaceList(&ifList);
2783 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2784 ASSERT_EQ(1U, ifList.size());
2785 EXPECT_EQ(tun1.name(), ifList[0]);
2786
2787 // Give dnsmasq some time to start up.
2788 usleep(200 * 1000);
2789
2790 // Check that dnsmasq is not listening on any IP addresses. It shouldn't, because it was only
2791 // told to run on tun1, and tun1 does not exist. Ensure it stays running and doesn't listen on
2792 // any IP addresses.
2793 std::vector<IPAddress> listenAddrs = findDnsSockets(&sd, 0);
2794 EXPECT_EQ(0U, listenAddrs.size()) << "Unexpectedly found IPv4 socket(s) listening on port 53";
2795
2796 // Now add an interface to dnsmasq and check that we can see the sockets. This confirms that
2797 // findDnsSockets is actually able to see sockets when they exist.
2798 status = mNetd->tetherInterfaceAdd(tun2.name());
2799 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2800
2801 in_addr loopback = {htonl(INADDR_LOOPBACK)};
2802 listenAddrs = findDnsSockets(&sd, 2);
2803 EXPECT_EQ(2U, listenAddrs.size()) << "Expected exactly 2 IPv4 sockets listening on port 53";
2804 EXPECT_EQ(1, std::count(listenAddrs.begin(), listenAddrs.end(), addr2));
2805 EXPECT_EQ(1, std::count(listenAddrs.begin(), listenAddrs.end(), IPAddress(loopback)));
2806
2807 // Clean up.
2808 status = mNetd->tetherStop();
2809 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2810
2811 expectProcessDoesNotExist(DNSMASQ);
2812
2813 status = mNetd->tetherInterfaceRemove(tun1.name());
2814 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2815
2816 status = mNetd->tetherInterfaceRemove(tun2.name());
2817 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2818 }
2819
2820 namespace {
2821
2822 constexpr char FIREWALL_INPUT[] = "fw_INPUT";
2823 constexpr char FIREWALL_OUTPUT[] = "fw_OUTPUT";
2824 constexpr char FIREWALL_FORWARD[] = "fw_FORWARD";
2825
expectFirewallAllowlistMode()2826 void expectFirewallAllowlistMode() {
2827 static const char dropRule[] = "DROP all";
2828 static const char rejectRule[] = "REJECT all";
2829 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2830 EXPECT_TRUE(iptablesRuleExists(binary, FIREWALL_INPUT, dropRule));
2831 EXPECT_TRUE(iptablesRuleExists(binary, FIREWALL_OUTPUT, rejectRule));
2832 EXPECT_TRUE(iptablesRuleExists(binary, FIREWALL_FORWARD, rejectRule));
2833 }
2834 }
2835
expectFirewallDenylistMode()2836 void expectFirewallDenylistMode() {
2837 EXPECT_EQ(2, iptablesRuleLineLength(IPTABLES_PATH, FIREWALL_INPUT));
2838 EXPECT_EQ(2, iptablesRuleLineLength(IPTABLES_PATH, FIREWALL_OUTPUT));
2839 EXPECT_EQ(2, iptablesRuleLineLength(IPTABLES_PATH, FIREWALL_FORWARD));
2840
2841 // for IPv6 there is an extra OUTPUT rule to DROP ::1 sourced packets to non-loopback devices
2842 EXPECT_EQ(2, iptablesRuleLineLength(IP6TABLES_PATH, FIREWALL_INPUT));
2843 EXPECT_EQ(3, iptablesRuleLineLength(IP6TABLES_PATH, FIREWALL_OUTPUT));
2844 EXPECT_EQ(2, iptablesRuleLineLength(IP6TABLES_PATH, FIREWALL_FORWARD));
2845 }
2846
iptablesFirewallInterfaceFirstRuleExists(const char * binary,const char * chainName,const std::string & expectedInterface,const std::string & expectedRule)2847 bool iptablesFirewallInterfaceFirstRuleExists(const char* binary, const char* chainName,
2848 const std::string& expectedInterface,
2849 const std::string& expectedRule) {
2850 std::vector<std::string> rules = listIptablesRuleByTable(binary, FILTER_TABLE, chainName);
2851 // Expected rule:
2852 // Chain fw_INPUT (1 references)
2853 // pkts bytes target prot opt in out source destination
2854 // 0 0 RETURN all -- expectedInterface * 0.0.0.0/0 0.0.0.0/0
2855 // 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
2856 int firstRuleIndex = 2;
2857 if (rules.size() < 4) return false;
2858 if (rules[firstRuleIndex].find(expectedInterface) != std::string::npos) {
2859 if (rules[firstRuleIndex].find(expectedRule) != std::string::npos) {
2860 return true;
2861 }
2862 }
2863 return false;
2864 }
2865
2866 // TODO: It is a duplicate function, need to remove it
iptablesFirewallInterfaceRuleExists(const char * binary,const char * chainName,const std::string & expectedInterface,const std::string & expectedRule)2867 bool iptablesFirewallInterfaceRuleExists(const char* binary, const char* chainName,
2868 const std::string& expectedInterface,
2869 const std::string& expectedRule) {
2870 std::vector<std::string> rules = listIptablesRuleByTable(binary, FILTER_TABLE, chainName);
2871 for (const auto& rule : rules) {
2872 if (rule.find(expectedInterface) != std::string::npos) {
2873 if (rule.find(expectedRule) != std::string::npos) {
2874 return true;
2875 }
2876 }
2877 }
2878 return false;
2879 }
2880
expectFirewallInterfaceRuleAllowExists(const std::string & ifname)2881 void expectFirewallInterfaceRuleAllowExists(const std::string& ifname) {
2882 static const char returnRule[] = "RETURN all";
2883 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2884 EXPECT_TRUE(iptablesFirewallInterfaceFirstRuleExists(binary, FIREWALL_INPUT, ifname,
2885 returnRule));
2886 EXPECT_TRUE(iptablesFirewallInterfaceFirstRuleExists(binary, FIREWALL_OUTPUT, ifname,
2887 returnRule));
2888 }
2889 }
2890
expectFireWallInterfaceRuleAllowDoesNotExist(const std::string & ifname)2891 void expectFireWallInterfaceRuleAllowDoesNotExist(const std::string& ifname) {
2892 static const char returnRule[] = "RETURN all";
2893 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
2894 EXPECT_FALSE(
2895 iptablesFirewallInterfaceRuleExists(binary, FIREWALL_INPUT, ifname, returnRule));
2896 EXPECT_FALSE(
2897 iptablesFirewallInterfaceRuleExists(binary, FIREWALL_OUTPUT, ifname, returnRule));
2898 }
2899 }
2900
2901 } // namespace
2902
TEST_F(NetdBinderTest,FirewallSetFirewallType)2903 TEST_F(NetdBinderTest, FirewallSetFirewallType) {
2904 binder::Status status = mNetd->firewallSetFirewallType(INetd::FIREWALL_ALLOWLIST);
2905 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2906 expectFirewallAllowlistMode();
2907
2908 status = mNetd->firewallSetFirewallType(INetd::FIREWALL_DENYLIST);
2909 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2910 expectFirewallDenylistMode();
2911
2912 // set firewall type blacklist twice
2913 mNetd->firewallSetFirewallType(INetd::FIREWALL_DENYLIST);
2914 status = mNetd->firewallSetFirewallType(INetd::FIREWALL_DENYLIST);
2915 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2916 expectFirewallDenylistMode();
2917
2918 // set firewall type whitelist twice
2919 mNetd->firewallSetFirewallType(INetd::FIREWALL_ALLOWLIST);
2920 status = mNetd->firewallSetFirewallType(INetd::FIREWALL_ALLOWLIST);
2921 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2922 expectFirewallAllowlistMode();
2923
2924 // reset firewall type to default
2925 status = mNetd->firewallSetFirewallType(INetd::FIREWALL_DENYLIST);
2926 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2927 expectFirewallDenylistMode();
2928 }
2929
TEST_F(NetdBinderTest,FirewallSetInterfaceRule)2930 TEST_F(NetdBinderTest, FirewallSetInterfaceRule) {
2931 // setinterfaceRule is not supported in BLACKLIST MODE
2932 binder::Status status = mNetd->firewallSetFirewallType(INetd::FIREWALL_DENYLIST);
2933 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2934
2935 status = mNetd->firewallSetInterfaceRule(sTun.name(), INetd::FIREWALL_RULE_ALLOW);
2936 EXPECT_FALSE(status.isOk()) << status.exceptionMessage();
2937
2938 // set WHITELIST mode first
2939 status = mNetd->firewallSetFirewallType(INetd::FIREWALL_ALLOWLIST);
2940 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2941
2942 status = mNetd->firewallSetInterfaceRule(sTun.name(), INetd::FIREWALL_RULE_ALLOW);
2943 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2944 expectFirewallInterfaceRuleAllowExists(sTun.name());
2945
2946 status = mNetd->firewallSetInterfaceRule(sTun.name(), INetd::FIREWALL_RULE_DENY);
2947 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2948 expectFireWallInterfaceRuleAllowDoesNotExist(sTun.name());
2949
2950 // reset firewall mode to default
2951 status = mNetd->firewallSetFirewallType(INetd::FIREWALL_DENYLIST);
2952 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
2953 expectFirewallDenylistMode();
2954 }
2955
2956 namespace {
2957
hwAddrToStr(unsigned char * hwaddr)2958 std::string hwAddrToStr(unsigned char* hwaddr) {
2959 return StringPrintf("%02x:%02x:%02x:%02x:%02x:%02x", hwaddr[0], hwaddr[1], hwaddr[2], hwaddr[3],
2960 hwaddr[4], hwaddr[5]);
2961 }
2962
ipv4NetmaskToPrefixLength(in_addr_t mask)2963 int ipv4NetmaskToPrefixLength(in_addr_t mask) {
2964 int prefixLength = 0;
2965 uint32_t m = ntohl(mask);
2966 while (m & (1 << 31)) {
2967 prefixLength++;
2968 m = m << 1;
2969 }
2970 return prefixLength;
2971 }
2972
toStdString(const String16 & s)2973 std::string toStdString(const String16& s) {
2974 return std::string(String8(s.string()));
2975 }
2976
ioctlByIfName(const std::string & ifName,unsigned long flag)2977 android::netdutils::StatusOr<ifreq> ioctlByIfName(const std::string& ifName, unsigned long flag) {
2978 const auto& sys = sSyscalls.get();
2979 auto fd = sys.socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
2980 EXPECT_TRUE(isOk(fd.status()));
2981
2982 struct ifreq ifr = {};
2983 strlcpy(ifr.ifr_name, ifName.c_str(), IFNAMSIZ);
2984
2985 return sys.ioctl(fd.value(), flag, &ifr);
2986 }
2987
getInterfaceHwAddr(const std::string & ifName)2988 std::string getInterfaceHwAddr(const std::string& ifName) {
2989 auto res = ioctlByIfName(ifName, SIOCGIFHWADDR);
2990
2991 unsigned char hwaddr[ETH_ALEN] = {};
2992 if (isOk(res.status())) {
2993 memcpy((void*) hwaddr, &res.value().ifr_hwaddr.sa_data, ETH_ALEN);
2994 }
2995
2996 return hwAddrToStr(hwaddr);
2997 }
2998
getInterfaceIPv4Prefix(const std::string & ifName)2999 int getInterfaceIPv4Prefix(const std::string& ifName) {
3000 auto res = ioctlByIfName(ifName, SIOCGIFNETMASK);
3001
3002 int prefixLength = 0;
3003 if (isOk(res.status())) {
3004 prefixLength = ipv4NetmaskToPrefixLength(
3005 ((struct sockaddr_in*) &res.value().ifr_addr)->sin_addr.s_addr);
3006 }
3007
3008 return prefixLength;
3009 }
3010
getInterfaceIPv4Addr(const std::string & ifName)3011 std::string getInterfaceIPv4Addr(const std::string& ifName) {
3012 auto res = ioctlByIfName(ifName, SIOCGIFADDR);
3013
3014 struct in_addr addr = {};
3015 if (isOk(res.status())) {
3016 addr.s_addr = ((struct sockaddr_in*) &res.value().ifr_addr)->sin_addr.s_addr;
3017 }
3018
3019 return std::string(inet_ntoa(addr));
3020 }
3021
getInterfaceFlags(const std::string & ifName)3022 std::vector<std::string> getInterfaceFlags(const std::string& ifName) {
3023 auto res = ioctlByIfName(ifName, SIOCGIFFLAGS);
3024
3025 unsigned flags = 0;
3026 if (isOk(res.status())) {
3027 flags = res.value().ifr_flags;
3028 }
3029
3030 std::vector<std::string> ifFlags;
3031 ifFlags.push_back(flags & IFF_UP ? toStdString(INetd::IF_STATE_UP())
3032 : toStdString(INetd::IF_STATE_DOWN()));
3033
3034 if (flags & IFF_BROADCAST) ifFlags.push_back(toStdString(INetd::IF_FLAG_BROADCAST()));
3035 if (flags & IFF_LOOPBACK) ifFlags.push_back(toStdString(INetd::IF_FLAG_LOOPBACK()));
3036 if (flags & IFF_POINTOPOINT) ifFlags.push_back(toStdString(INetd::IF_FLAG_POINTOPOINT()));
3037 if (flags & IFF_RUNNING) ifFlags.push_back(toStdString(INetd::IF_FLAG_RUNNING()));
3038 if (flags & IFF_MULTICAST) ifFlags.push_back(toStdString(INetd::IF_FLAG_MULTICAST()));
3039
3040 return ifFlags;
3041 }
3042
compareListInterface(const std::vector<std::string> & interfaceList)3043 bool compareListInterface(const std::vector<std::string>& interfaceList) {
3044 const auto& res = getIfaceNames();
3045 EXPECT_TRUE(isOk(res));
3046
3047 std::vector<std::string> resIfList;
3048 resIfList.reserve(res.value().size());
3049 resIfList.insert(end(resIfList), begin(res.value()), end(res.value()));
3050
3051 return resIfList == interfaceList;
3052 }
3053
getInterfaceIPv6PrivacyExtensions(const std::string & ifName)3054 int getInterfaceIPv6PrivacyExtensions(const std::string& ifName) {
3055 std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/use_tempaddr", ifName.c_str());
3056 return readIntFromPath(path);
3057 }
3058
getInterfaceEnableIPv6(const std::string & ifName)3059 bool getInterfaceEnableIPv6(const std::string& ifName) {
3060 std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/disable_ipv6", ifName.c_str());
3061
3062 int disableIPv6 = readIntFromPath(path);
3063 return !disableIPv6;
3064 }
3065
getInterfaceMtu(const std::string & ifName)3066 int getInterfaceMtu(const std::string& ifName) {
3067 std::string path = StringPrintf("/sys/class/net/%s/mtu", ifName.c_str());
3068 return readIntFromPath(path);
3069 }
3070
expectInterfaceList(const std::vector<std::string> & interfaceList)3071 void expectInterfaceList(const std::vector<std::string>& interfaceList) {
3072 EXPECT_TRUE(compareListInterface(interfaceList));
3073 }
3074
expectCurrentInterfaceConfigurationEquals(const std::string & ifName,const InterfaceConfigurationParcel & interfaceCfg)3075 void expectCurrentInterfaceConfigurationEquals(const std::string& ifName,
3076 const InterfaceConfigurationParcel& interfaceCfg) {
3077 EXPECT_EQ(getInterfaceIPv4Addr(ifName), interfaceCfg.ipv4Addr);
3078 EXPECT_EQ(getInterfaceIPv4Prefix(ifName), interfaceCfg.prefixLength);
3079 EXPECT_EQ(getInterfaceHwAddr(ifName), interfaceCfg.hwAddr);
3080 EXPECT_EQ(getInterfaceFlags(ifName), interfaceCfg.flags);
3081 }
3082
expectCurrentInterfaceConfigurationAlmostEqual(const InterfaceConfigurationParcel & setCfg)3083 void expectCurrentInterfaceConfigurationAlmostEqual(const InterfaceConfigurationParcel& setCfg) {
3084 EXPECT_EQ(getInterfaceIPv4Addr(setCfg.ifName), setCfg.ipv4Addr);
3085 EXPECT_EQ(getInterfaceIPv4Prefix(setCfg.ifName), setCfg.prefixLength);
3086
3087 const auto& ifFlags = getInterfaceFlags(setCfg.ifName);
3088 for (const auto& flag : setCfg.flags) {
3089 EXPECT_TRUE(std::find(ifFlags.begin(), ifFlags.end(), flag) != ifFlags.end());
3090 }
3091 }
3092
expectInterfaceIPv6PrivacyExtensions(const std::string & ifName,bool enable)3093 void expectInterfaceIPv6PrivacyExtensions(const std::string& ifName, bool enable) {
3094 int v6PrivacyExtensions = getInterfaceIPv6PrivacyExtensions(ifName);
3095 EXPECT_EQ(v6PrivacyExtensions, enable ? 2 : 0);
3096 }
3097
expectInterfaceNoAddr(const std::string & ifName)3098 void expectInterfaceNoAddr(const std::string& ifName) {
3099 // noAddr
3100 EXPECT_EQ(getInterfaceIPv4Addr(ifName), "0.0.0.0");
3101 // noPrefix
3102 EXPECT_EQ(getInterfaceIPv4Prefix(ifName), 0);
3103 }
3104
expectInterfaceEnableIPv6(const std::string & ifName,bool enable)3105 void expectInterfaceEnableIPv6(const std::string& ifName, bool enable) {
3106 int enableIPv6 = getInterfaceEnableIPv6(ifName);
3107 EXPECT_EQ(enableIPv6, enable);
3108 }
3109
expectInterfaceMtu(const std::string & ifName,const int mtu)3110 void expectInterfaceMtu(const std::string& ifName, const int mtu) {
3111 int mtuSize = getInterfaceMtu(ifName);
3112 EXPECT_EQ(mtu, mtuSize);
3113 }
3114
makeInterfaceCfgParcel(const std::string & ifName,const std::string & addr,int prefixLength,const std::vector<std::string> & flags)3115 InterfaceConfigurationParcel makeInterfaceCfgParcel(const std::string& ifName,
3116 const std::string& addr, int prefixLength,
3117 const std::vector<std::string>& flags) {
3118 InterfaceConfigurationParcel cfg;
3119 cfg.ifName = ifName;
3120 cfg.hwAddr = "";
3121 cfg.ipv4Addr = addr;
3122 cfg.prefixLength = prefixLength;
3123 cfg.flags = flags;
3124 return cfg;
3125 }
3126
expectTunFlags(const InterfaceConfigurationParcel & interfaceCfg)3127 void expectTunFlags(const InterfaceConfigurationParcel& interfaceCfg) {
3128 std::vector<std::string> expectedFlags = {"up", "point-to-point", "running", "multicast"};
3129 std::vector<std::string> unexpectedFlags = {"down", "broadcast"};
3130
3131 for (const auto& flag : expectedFlags) {
3132 EXPECT_TRUE(std::find(interfaceCfg.flags.begin(), interfaceCfg.flags.end(), flag) !=
3133 interfaceCfg.flags.end());
3134 }
3135
3136 for (const auto& flag : unexpectedFlags) {
3137 EXPECT_TRUE(std::find(interfaceCfg.flags.begin(), interfaceCfg.flags.end(), flag) ==
3138 interfaceCfg.flags.end());
3139 }
3140 }
3141
3142 } // namespace
3143
TEST_F(NetdBinderTest,InterfaceList)3144 TEST_F(NetdBinderTest, InterfaceList) {
3145 std::vector<std::string> interfaceListResult;
3146
3147 binder::Status status = mNetd->interfaceGetList(&interfaceListResult);
3148 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3149 expectInterfaceList(interfaceListResult);
3150 }
3151
TEST_F(NetdBinderTest,InterfaceGetCfg)3152 TEST_F(NetdBinderTest, InterfaceGetCfg) {
3153 InterfaceConfigurationParcel interfaceCfgResult;
3154
3155 // Add test physical network
3156 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
3157 INetd::PERMISSION_NONE, false, false);
3158 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3159 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
3160
3161 binder::Status status = mNetd->interfaceGetCfg(sTun.name(), &interfaceCfgResult);
3162 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3163 expectCurrentInterfaceConfigurationEquals(sTun.name(), interfaceCfgResult);
3164 expectTunFlags(interfaceCfgResult);
3165
3166 // Remove test physical network
3167 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
3168 }
3169
TEST_F(NetdBinderTest,InterfaceSetCfg)3170 TEST_F(NetdBinderTest, InterfaceSetCfg) {
3171 const std::string testAddr = "192.0.2.3";
3172 const int testPrefixLength = 24;
3173 std::vector<std::string> upFlags = {"up"};
3174 std::vector<std::string> downFlags = {"down"};
3175
3176 // Add test physical network
3177 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
3178 INetd::PERMISSION_NONE, false, false);
3179 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3180 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
3181
3182 // Set tun interface down.
3183 auto interfaceCfg = makeInterfaceCfgParcel(sTun.name(), testAddr, testPrefixLength, downFlags);
3184 binder::Status status = mNetd->interfaceSetCfg(interfaceCfg);
3185 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3186 expectCurrentInterfaceConfigurationAlmostEqual(interfaceCfg);
3187
3188 // Set tun interface up again.
3189 interfaceCfg = makeInterfaceCfgParcel(sTun.name(), testAddr, testPrefixLength, upFlags);
3190 status = mNetd->interfaceSetCfg(interfaceCfg);
3191 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3192 status = mNetd->interfaceClearAddrs(sTun.name());
3193 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3194
3195 // Remove test physical network
3196 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
3197 }
3198
TEST_F(NetdBinderTest,InterfaceSetIPv6PrivacyExtensions)3199 TEST_F(NetdBinderTest, InterfaceSetIPv6PrivacyExtensions) {
3200 // enable
3201 binder::Status status = mNetd->interfaceSetIPv6PrivacyExtensions(sTun.name(), true);
3202 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3203 expectInterfaceIPv6PrivacyExtensions(sTun.name(), true);
3204
3205 // disable
3206 status = mNetd->interfaceSetIPv6PrivacyExtensions(sTun.name(), false);
3207 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3208 expectInterfaceIPv6PrivacyExtensions(sTun.name(), false);
3209 }
3210
TEST_F(NetdBinderTest,InterfaceClearAddr)3211 TEST_F(NetdBinderTest, InterfaceClearAddr) {
3212 const std::string testAddr = "192.0.2.3";
3213 const int testPrefixLength = 24;
3214 std::vector<std::string> noFlags{};
3215
3216 // Add test physical network
3217 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
3218 INetd::PERMISSION_NONE, false, false);
3219 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3220 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
3221
3222 auto interfaceCfg = makeInterfaceCfgParcel(sTun.name(), testAddr, testPrefixLength, noFlags);
3223 binder::Status status = mNetd->interfaceSetCfg(interfaceCfg);
3224 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3225 expectCurrentInterfaceConfigurationAlmostEqual(interfaceCfg);
3226
3227 status = mNetd->interfaceClearAddrs(sTun.name());
3228 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3229 expectInterfaceNoAddr(sTun.name());
3230
3231 // Remove test physical network
3232 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
3233 }
3234
TEST_F(NetdBinderTest,InterfaceSetEnableIPv6)3235 TEST_F(NetdBinderTest, InterfaceSetEnableIPv6) {
3236 // Add test physical network
3237 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
3238 INetd::PERMISSION_NONE, false, false);
3239 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3240 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
3241
3242 // disable
3243 binder::Status status = mNetd->interfaceSetEnableIPv6(sTun.name(), false);
3244 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3245 expectInterfaceEnableIPv6(sTun.name(), false);
3246
3247 // enable
3248 status = mNetd->interfaceSetEnableIPv6(sTun.name(), true);
3249 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3250 expectInterfaceEnableIPv6(sTun.name(), true);
3251
3252 // Remove test physical network
3253 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
3254 }
3255
TEST_F(NetdBinderTest,InterfaceSetMtu)3256 TEST_F(NetdBinderTest, InterfaceSetMtu) {
3257 const int currentMtu = getInterfaceMtu(sTun.name());
3258 const int testMtu = 1200;
3259
3260 // Add test physical network
3261 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
3262 INetd::PERMISSION_NONE, false, false);
3263 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3264 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
3265
3266 binder::Status status = mNetd->interfaceSetMtu(sTun.name(), testMtu);
3267 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3268 expectInterfaceMtu(sTun.name(), testMtu);
3269
3270 // restore the MTU back
3271 status = mNetd->interfaceSetMtu(sTun.name(), currentMtu);
3272 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3273
3274 // Remove test physical network
3275 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
3276 }
3277
3278 namespace {
3279
3280 constexpr const char TETHER_FORWARD[] = "tetherctrl_FORWARD";
3281 constexpr const char TETHER_NAT_POSTROUTING[] = "tetherctrl_nat_POSTROUTING";
3282 constexpr const char TETHER_RAW_PREROUTING[] = "tetherctrl_raw_PREROUTING";
3283 constexpr const char TETHER_COUNTERS_CHAIN[] = "tetherctrl_counters";
3284
iptablesCountRules(const char * binary,const char * table,const char * chainName)3285 int iptablesCountRules(const char* binary, const char* table, const char* chainName) {
3286 return listIptablesRuleByTable(binary, table, chainName).size();
3287 }
3288
iptablesChainMatch(const char * binary,const char * table,const char * chainName,const std::vector<std::string> & targetVec)3289 bool iptablesChainMatch(const char* binary, const char* table, const char* chainName,
3290 const std::vector<std::string>& targetVec) {
3291 std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName);
3292 if (targetVec.size() != rules.size() - 2) {
3293 return false;
3294 }
3295
3296 /*
3297 * Check that the rules match. Note that this function matches substrings, not entire rules,
3298 * because otherwise rules where "pkts" or "bytes" are nonzero would not match.
3299 * Skip first two lines since rules start from third line.
3300 * Chain chainName (x references)
3301 * pkts bytes target prot opt in out source destination
3302 * ...
3303 */
3304 int rIndex = 2;
3305 for (const auto& target : targetVec) {
3306 if (rules[rIndex].find(target) == std::string::npos) {
3307 return false;
3308 }
3309 rIndex++;
3310 }
3311 return true;
3312 }
3313
expectNatEnable(const std::string & intIf,const std::string & extIf)3314 void expectNatEnable(const std::string& intIf, const std::string& extIf) {
3315 std::vector<std::string> postroutingV4Match = {"MASQUERADE"};
3316 std::vector<std::string> preroutingV4Match = {"CT helper ftp", "CT helper pptp"};
3317 std::vector<std::string> forwardV4Match = {
3318 "bw_global_alert", "state RELATED", "state INVALID",
3319 StringPrintf("tetherctrl_counters all -- %s %s", intIf.c_str(), extIf.c_str()),
3320 "DROP"};
3321
3322 // V4
3323 EXPECT_TRUE(iptablesChainMatch(IPTABLES_PATH, NAT_TABLE, TETHER_NAT_POSTROUTING,
3324 postroutingV4Match));
3325 EXPECT_TRUE(
3326 iptablesChainMatch(IPTABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING, preroutingV4Match));
3327 EXPECT_TRUE(iptablesChainMatch(IPTABLES_PATH, FILTER_TABLE, TETHER_FORWARD, forwardV4Match));
3328
3329 std::vector<std::string> forwardV6Match = {"bw_global_alert", "tetherctrl_counters"};
3330 std::vector<std::string> preroutingV6Match = {"rpfilter invert"};
3331
3332 // V6
3333 EXPECT_TRUE(iptablesChainMatch(IP6TABLES_PATH, FILTER_TABLE, TETHER_FORWARD, forwardV6Match));
3334 EXPECT_TRUE(iptablesChainMatch(IP6TABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING,
3335 preroutingV6Match));
3336
3337 for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
3338 EXPECT_TRUE(iptablesTargetsExists(binary, 2, FILTER_TABLE, TETHER_COUNTERS_CHAIN, intIf,
3339 extIf));
3340 }
3341 }
3342
expectNatDisable()3343 void expectNatDisable() {
3344 // It is the default DROP rule with tethering disable.
3345 // Chain tetherctrl_FORWARD (1 references)
3346 // pkts bytes target prot opt in out source destination
3347 // 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
3348 std::vector<std::string> forwardV4Match = {"DROP"};
3349 EXPECT_TRUE(iptablesChainMatch(IPTABLES_PATH, FILTER_TABLE, TETHER_FORWARD, forwardV4Match));
3350
3351 // We expect that these chains should be empty.
3352 EXPECT_EQ(2, iptablesCountRules(IPTABLES_PATH, NAT_TABLE, TETHER_NAT_POSTROUTING));
3353 EXPECT_EQ(2, iptablesCountRules(IPTABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING));
3354
3355 EXPECT_EQ(2, iptablesCountRules(IP6TABLES_PATH, FILTER_TABLE, TETHER_FORWARD));
3356 EXPECT_EQ(2, iptablesCountRules(IP6TABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING));
3357
3358 // Netd won't clear tether quota rule, we don't care rule in tetherctrl_counters.
3359 }
3360
3361 } // namespace
3362
TEST_F(NetdBinderTest,TetherForwardAddRemove)3363 TEST_F(NetdBinderTest, TetherForwardAddRemove) {
3364 binder::Status status = mNetd->tetherAddForward(sTun.name(), sTun2.name());
3365 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3366 expectNatEnable(sTun.name(), sTun2.name());
3367
3368 status = mNetd->tetherRemoveForward(sTun.name(), sTun2.name());
3369 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3370 expectNatDisable();
3371 }
3372
3373 namespace {
3374
3375 using TripleInt = std::array<int, 3>;
3376
readProcFileToTripleInt(const std::string & path)3377 TripleInt readProcFileToTripleInt(const std::string& path) {
3378 std::string valueString;
3379 int min, def, max;
3380 EXPECT_TRUE(ReadFileToString(path, &valueString));
3381 EXPECT_EQ(3, sscanf(valueString.c_str(), "%d %d %d", &min, &def, &max));
3382 return {min, def, max};
3383 }
3384
updateAndCheckTcpBuffer(sp<INetd> & netd,TripleInt & rmemValues,TripleInt & wmemValues)3385 void updateAndCheckTcpBuffer(sp<INetd>& netd, TripleInt& rmemValues, TripleInt& wmemValues) {
3386 std::string testRmemValues =
3387 StringPrintf("%u %u %u", rmemValues[0], rmemValues[1], rmemValues[2]);
3388 std::string testWmemValues =
3389 StringPrintf("%u %u %u", wmemValues[0], wmemValues[1], wmemValues[2]);
3390 EXPECT_TRUE(netd->setTcpRWmemorySize(testRmemValues, testWmemValues).isOk());
3391
3392 TripleInt newRmemValues = readProcFileToTripleInt(TCP_RMEM_PROC_FILE);
3393 TripleInt newWmemValues = readProcFileToTripleInt(TCP_WMEM_PROC_FILE);
3394
3395 for (int i = 0; i < 3; i++) {
3396 SCOPED_TRACE(StringPrintf("tcp_mem value %d should be equal", i));
3397 EXPECT_EQ(rmemValues[i], newRmemValues[i]);
3398 EXPECT_EQ(wmemValues[i], newWmemValues[i]);
3399 }
3400 }
3401
3402 } // namespace
3403
TEST_F(NetdBinderTest,TcpBufferSet)3404 TEST_F(NetdBinderTest, TcpBufferSet) {
3405 TripleInt rmemValue = readProcFileToTripleInt(TCP_RMEM_PROC_FILE);
3406 TripleInt testRmemValue{rmemValue[0] + 42, rmemValue[1] + 42, rmemValue[2] + 42};
3407 TripleInt wmemValue = readProcFileToTripleInt(TCP_WMEM_PROC_FILE);
3408 TripleInt testWmemValue{wmemValue[0] + 42, wmemValue[1] + 42, wmemValue[2] + 42};
3409
3410 updateAndCheckTcpBuffer(mNetd, testRmemValue, testWmemValue);
3411 updateAndCheckTcpBuffer(mNetd, rmemValue, wmemValue);
3412 }
3413
TEST_F(NetdBinderTest,UnsolEvents)3414 TEST_F(NetdBinderTest, UnsolEvents) {
3415 auto testUnsolService = android::net::TestUnsolService::start();
3416 std::string oldTunName = sTun.name();
3417 std::string newTunName = "unsolTest";
3418 testUnsolService->tarVec.push_back(oldTunName);
3419 testUnsolService->tarVec.push_back(newTunName);
3420 auto& cv = testUnsolService->getCv();
3421 auto& cvMutex = testUnsolService->getCvMutex();
3422 binder::Status status = mNetd->registerUnsolicitedEventListener(
3423 android::interface_cast<android::net::INetdUnsolicitedEventListener>(testUnsolService));
3424 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3425
3426 // TODO: Add test for below events
3427 // StrictCleartextDetected / InterfaceDnsServersAdded
3428 // InterfaceClassActivity / QuotaLimitReached / InterfaceAddressRemoved
3429
3430 {
3431 std::unique_lock lock(cvMutex);
3432
3433 // Re-init test Tun, and we expect that we will get some unsol events.
3434 // Use the test Tun device name to verify if we receive its unsol events.
3435 sTun.destroy();
3436 // Use predefined name
3437 sTun.init(newTunName);
3438
3439 EXPECT_EQ(std::cv_status::no_timeout, cv.wait_for(lock, std::chrono::seconds(2)));
3440 }
3441
3442 // bit mask 1101101000
3443 // Test only covers below events currently
3444 const uint32_t kExpectedEvents = InterfaceAddressUpdated | InterfaceAdded | InterfaceRemoved |
3445 InterfaceLinkStatusChanged | RouteChanged;
3446 EXPECT_EQ(kExpectedEvents, testUnsolService->getReceived());
3447
3448 // Re-init sTun to clear predefined name
3449 sTun.destroy();
3450 sTun.init();
3451 }
3452
TEST_F(NetdBinderTest,NDC)3453 TEST_F(NetdBinderTest, NDC) {
3454 struct Command {
3455 const std::string cmdString;
3456 const std::string expectedResult;
3457 };
3458
3459 // clang-format off
3460 // Do not change the commands order
3461 const Command networkCmds[] = {
3462 {StringPrintf("ndc network create %d", TEST_NETID1),
3463 "200 0 success"},
3464 {StringPrintf("ndc network interface add %d %s", TEST_NETID1, sTun.name().c_str()),
3465 "200 0 success"},
3466 {StringPrintf("ndc network interface remove %d %s", TEST_NETID1, sTun.name().c_str()),
3467 "200 0 success"},
3468 {StringPrintf("ndc network interface add %d %s", TEST_NETID2, sTun.name().c_str()),
3469 "400 0 addInterfaceToNetwork() failed (Machine is not on the network)"},
3470 {StringPrintf("ndc network destroy %d", TEST_NETID1),
3471 "200 0 success"},
3472 };
3473
3474 const std::vector<Command> ipfwdCmds = {
3475 {"ndc ipfwd enable " + sTun.name(),
3476 "200 0 ipfwd operation succeeded"},
3477 {"ndc ipfwd disable " + sTun.name(),
3478 "200 0 ipfwd operation succeeded"},
3479 {"ndc ipfwd add lo2 lo3",
3480 "400 0 ipfwd operation failed (No such process)"},
3481 {"ndc ipfwd add " + sTun.name() + " " + sTun2.name(),
3482 "200 0 ipfwd operation succeeded"},
3483 {"ndc ipfwd remove " + sTun.name() + " " + sTun2.name(),
3484 "200 0 ipfwd operation succeeded"},
3485 };
3486
3487 static const struct {
3488 const char* ipVersion;
3489 const char* testDest;
3490 const char* testNextHop;
3491 const bool expectSuccess;
3492 const std::string expectedResult;
3493 } kTestData[] = {
3494 {IP_RULE_V4, "0.0.0.0/0", "", true,
3495 "200 0 success"},
3496 {IP_RULE_V4, "10.251.0.0/16", "", true,
3497 "200 0 success"},
3498 {IP_RULE_V4, "10.251.0.0/16", "fe80::/64", false,
3499 "400 0 addRoute() failed (Invalid argument)",},
3500 {IP_RULE_V6, "::/0", "", true,
3501 "200 0 success"},
3502 {IP_RULE_V6, "2001:db8:cafe::/64", "", true,
3503 "200 0 success"},
3504 {IP_RULE_V6, "fe80::/64", "0.0.0.0", false,
3505 "400 0 addRoute() failed (Invalid argument)"},
3506 };
3507 // clang-format on
3508
3509 for (const auto& cmd : networkCmds) {
3510 const std::vector<std::string> result = runCommand(cmd.cmdString);
3511 SCOPED_TRACE(cmd.cmdString);
3512 EXPECT_EQ(result.size(), 1U);
3513 EXPECT_EQ(cmd.expectedResult, Trim(result[0]));
3514 }
3515
3516 for (const auto& cmd : ipfwdCmds) {
3517 const std::vector<std::string> result = runCommand(cmd.cmdString);
3518 SCOPED_TRACE(cmd.cmdString);
3519 EXPECT_EQ(result.size(), 1U);
3520 EXPECT_EQ(cmd.expectedResult, Trim(result[0]));
3521 }
3522
3523 // Add test physical network
3524 const auto& config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
3525 INetd::PERMISSION_NONE, false, false);
3526 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3527 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
3528
3529 for (const auto& td : kTestData) {
3530 const std::string routeAddCmd =
3531 StringPrintf("ndc network route add %d %s %s %s", TEST_NETID1, sTun.name().c_str(),
3532 td.testDest, td.testNextHop);
3533 const std::string routeRemoveCmd =
3534 StringPrintf("ndc network route remove %d %s %s %s", TEST_NETID1,
3535 sTun.name().c_str(), td.testDest, td.testNextHop);
3536 std::vector<std::string> result = runCommand(routeAddCmd);
3537 SCOPED_TRACE(routeAddCmd);
3538 EXPECT_EQ(result.size(), 1U);
3539 EXPECT_EQ(td.expectedResult, Trim(result[0]));
3540 if (td.expectSuccess) {
3541 expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
3542 sTun.name().c_str());
3543 result = runCommand(routeRemoveCmd);
3544 EXPECT_EQ(result.size(), 1U);
3545 EXPECT_EQ(td.expectedResult, Trim(result[0]));
3546 expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop,
3547 sTun.name().c_str());
3548 }
3549 }
3550 // Remove test physical network
3551 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
3552 }
3553
TEST_F(NetdBinderTest,OemNetdRelated)3554 TEST_F(NetdBinderTest, OemNetdRelated) {
3555 sp<IBinder> binder;
3556 binder::Status status = mNetd->getOemNetd(&binder);
3557 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3558 sp<com::android::internal::net::IOemNetd> oemNetd;
3559 if (binder != nullptr) {
3560 oemNetd = android::interface_cast<com::android::internal::net::IOemNetd>(binder);
3561 }
3562 ASSERT_NE(nullptr, oemNetd.get());
3563
3564 TimedOperation t("OemNetd isAlive RPC");
3565 bool isAlive = false;
3566 oemNetd->isAlive(&isAlive);
3567 ASSERT_TRUE(isAlive);
3568
3569 class TestOemUnsolListener
3570 : public com::android::internal::net::BnOemNetdUnsolicitedEventListener {
3571 public:
3572 android::binder::Status onRegistered() override {
3573 std::lock_guard lock(mCvMutex);
3574 mCv.notify_one();
3575 return android::binder::Status::ok();
3576 }
3577 std::condition_variable& getCv() { return mCv; }
3578 std::mutex& getCvMutex() { return mCvMutex; }
3579
3580 private:
3581 std::mutex mCvMutex;
3582 std::condition_variable mCv;
3583 };
3584
3585 // Start the Binder thread pool.
3586 android::ProcessState::self()->startThreadPool();
3587
3588 android::sp<TestOemUnsolListener> testListener = new TestOemUnsolListener();
3589
3590 auto& cv = testListener->getCv();
3591 auto& cvMutex = testListener->getCvMutex();
3592
3593 {
3594 std::unique_lock lock(cvMutex);
3595
3596 status = oemNetd->registerOemUnsolicitedEventListener(
3597 ::android::interface_cast<
3598 com::android::internal::net::IOemNetdUnsolicitedEventListener>(
3599 testListener));
3600 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
3601
3602 // Wait for receiving expected events.
3603 EXPECT_EQ(std::cv_status::no_timeout, cv.wait_for(lock, std::chrono::seconds(2)));
3604 }
3605 }
3606
createVpnNetworkWithUid(bool secure,uid_t uid,int vpnNetId,int fallthroughNetId,int nonDefaultNetId)3607 void NetdBinderTest::createVpnNetworkWithUid(bool secure, uid_t uid, int vpnNetId,
3608 int fallthroughNetId, int nonDefaultNetId) {
3609 // Re-init sTun* to ensure route rule exists.
3610 sTun.destroy();
3611 sTun.init();
3612 sTun2.destroy();
3613 sTun2.init();
3614 sTun3.destroy();
3615 sTun3.init();
3616
3617 // Create physical network with fallthroughNetId but not set it as default network
3618 auto config = makeNativeNetworkConfig(fallthroughNetId, NativeNetworkType::PHYSICAL,
3619 INetd::PERMISSION_NONE, false, false);
3620 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3621 EXPECT_TRUE(mNetd->networkAddInterface(fallthroughNetId, sTun.name()).isOk());
3622 // Create another physical network in order to test VPN behaviour with multiple networks
3623 // connected, of which one may be the default.
3624 auto nonDefaultNetworkConfig = makeNativeNetworkConfig(
3625 nonDefaultNetId, NativeNetworkType::PHYSICAL, INetd::PERMISSION_NONE, false, false);
3626 EXPECT_TRUE(mNetd->networkCreate(nonDefaultNetworkConfig).isOk());
3627 EXPECT_TRUE(mNetd->networkAddInterface(nonDefaultNetId, sTun3.name()).isOk());
3628
3629 // Create VPN with vpnNetId
3630 config.netId = vpnNetId;
3631 config.networkType = NativeNetworkType::VIRTUAL;
3632 config.secure = secure;
3633 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3634
3635 // Add uid to VPN
3636 EXPECT_TRUE(mNetd->networkAddUidRanges(vpnNetId, {makeUidRangeParcel(uid, uid)}).isOk());
3637 EXPECT_TRUE(mNetd->networkAddInterface(vpnNetId, sTun2.name()).isOk());
3638
3639 // Add default route to fallthroughNetwork
3640 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk());
3641 // Add limited route
3642 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID2, sTun2.name(), "2001:db8::/32", "").isOk());
3643
3644 // Also add default route to non-default network for per app default use.
3645 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID3, sTun3.name(), "::/0", "").isOk());
3646 }
3647
createAndSetDefaultNetwork(int netId,const std::string & interface,int permission)3648 void NetdBinderTest::createAndSetDefaultNetwork(int netId, const std::string& interface,
3649 int permission) {
3650 // backup current default network.
3651 ASSERT_TRUE(mNetd->networkGetDefault(&mStoredDefaultNetwork).isOk());
3652
3653 const auto& config =
3654 makeNativeNetworkConfig(netId, NativeNetworkType::PHYSICAL, permission, false, false);
3655 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3656 EXPECT_TRUE(mNetd->networkAddInterface(netId, interface).isOk());
3657 EXPECT_TRUE(mNetd->networkSetDefault(netId).isOk());
3658 }
3659
createPhysicalNetwork(int netId,const std::string & interface,int permission)3660 void NetdBinderTest::createPhysicalNetwork(int netId, const std::string& interface,
3661 int permission) {
3662 const auto& config =
3663 makeNativeNetworkConfig(netId, NativeNetworkType::PHYSICAL, permission, false, false);
3664 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3665 EXPECT_TRUE(mNetd->networkAddInterface(netId, interface).isOk());
3666 }
3667
3668 // 1. Create a physical network on sTun, and set it as the system default network.
3669 // 2. Create another physical network on sTun2.
createDefaultAndOtherPhysicalNetwork(int defaultNetId,int otherNetId)3670 void NetdBinderTest::createDefaultAndOtherPhysicalNetwork(int defaultNetId, int otherNetId) {
3671 createAndSetDefaultNetwork(defaultNetId, sTun.name());
3672 EXPECT_TRUE(mNetd->networkAddRoute(defaultNetId, sTun.name(), "::/0", "").isOk());
3673
3674 createPhysicalNetwork(otherNetId, sTun2.name());
3675 EXPECT_TRUE(mNetd->networkAddRoute(otherNetId, sTun2.name(), "::/0", "").isOk());
3676 }
3677
3678 // 1. Create a system default network and a physical network.
3679 // 2. Create a VPN on sTun3.
createVpnAndOtherPhysicalNetwork(int systemDefaultNetId,int otherNetId,int vpnNetId,bool secure)3680 void NetdBinderTest::createVpnAndOtherPhysicalNetwork(int systemDefaultNetId, int otherNetId,
3681 int vpnNetId, bool secure) {
3682 createDefaultAndOtherPhysicalNetwork(systemDefaultNetId, otherNetId);
3683
3684 auto config = makeNativeNetworkConfig(vpnNetId, NativeNetworkType::VIRTUAL,
3685 INetd::PERMISSION_NONE, secure, false);
3686 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3687 EXPECT_TRUE(mNetd->networkAddInterface(vpnNetId, sTun3.name()).isOk());
3688 EXPECT_TRUE(mNetd->networkAddRoute(vpnNetId, sTun3.name(), "2001:db8::/32", "").isOk());
3689 }
3690
3691 // 1. Create system default network, a physical network (for per-app default), and a VPN.
3692 // 2. Add per-app uid ranges and VPN ranges.
createVpnAndAppDefaultNetworkWithUid(int systemDefaultNetId,int appDefaultNetId,int vpnNetId,bool secure,std::vector<UidRangeParcel> && appDefaultUidRanges,std::vector<UidRangeParcel> && vpnUidRanges)3693 void NetdBinderTest::createVpnAndAppDefaultNetworkWithUid(
3694 int systemDefaultNetId, int appDefaultNetId, int vpnNetId, bool secure,
3695 std::vector<UidRangeParcel>&& appDefaultUidRanges,
3696 std::vector<UidRangeParcel>&& vpnUidRanges) {
3697 createVpnAndOtherPhysicalNetwork(systemDefaultNetId, appDefaultNetId, vpnNetId, secure);
3698 // add per-app uid ranges.
3699 EXPECT_TRUE(mNetd->networkAddUidRanges(appDefaultNetId, appDefaultUidRanges).isOk());
3700 // add VPN uid ranges.
3701 EXPECT_TRUE(mNetd->networkAddUidRanges(vpnNetId, vpnUidRanges).isOk());
3702 }
3703
3704 namespace {
3705
clearQueue(int tunFd)3706 void clearQueue(int tunFd) {
3707 char buf[4096];
3708 int ret;
3709 do {
3710 ret = read(tunFd, buf, sizeof(buf));
3711 } while (ret > 0);
3712 }
3713
checkDataReceived(int udpSocket,int tunFd,sockaddr * dstAddr,int addrLen)3714 void checkDataReceived(int udpSocket, int tunFd, sockaddr* dstAddr, int addrLen) {
3715 char buf[4096] = {};
3716 // Clear tunFd's queue before write something because there might be some
3717 // arbitrary packets in the queue. (e.g. ICMPv6 packet)
3718 clearQueue(tunFd);
3719 EXPECT_EQ(4, sendto(udpSocket, "foo", sizeof("foo"), 0, dstAddr, addrLen));
3720 // TODO: extract header and verify data
3721 EXPECT_GT(read(tunFd, buf, sizeof(buf)), 0);
3722 }
3723
sendPacketFromUid(uid_t uid,IPSockAddr & dstAddr,Fwmark * fwmark,int tunFd,bool doConnect=true)3724 bool sendPacketFromUid(uid_t uid, IPSockAddr& dstAddr, Fwmark* fwmark, int tunFd,
3725 bool doConnect = true) {
3726 int family = dstAddr.family();
3727 ScopedUidChange scopedUidChange(uid);
3728 unique_fd testSocket(socket(family, SOCK_DGRAM | SOCK_CLOEXEC, 0));
3729
3730 if (testSocket < 0) return false;
3731 const sockaddr_storage dst = IPSockAddr(dstAddr.ip(), dstAddr.port());
3732 if (doConnect && connect(testSocket, (sockaddr*)&dst, sizeof(dst)) == -1) return false;
3733
3734 socklen_t fwmarkLen = sizeof(fwmark->intValue);
3735 EXPECT_NE(-1, getsockopt(testSocket, SOL_SOCKET, SO_MARK, &(fwmark->intValue), &fwmarkLen));
3736
3737 int addr_len = (family == AF_INET) ? INET_ADDRSTRLEN : INET6_ADDRSTRLEN;
3738 char addr[addr_len];
3739 inet_ntop(family, &dstAddr, addr, addr_len);
3740 SCOPED_TRACE(StringPrintf("sendPacket, addr: %s, uid: %u, doConnect: %s", addr, uid,
3741 doConnect ? "true" : "false"));
3742 if (doConnect) {
3743 checkDataReceived(testSocket, tunFd, nullptr, 0);
3744 } else {
3745 checkDataReceived(testSocket, tunFd, (sockaddr*)&dst, sizeof(dst));
3746 }
3747
3748 return true;
3749 }
3750
sendIPv4PacketFromUid(uid_t uid,const in_addr & dstAddr,Fwmark * fwmark,int tunFd,bool doConnect=true)3751 bool sendIPv4PacketFromUid(uid_t uid, const in_addr& dstAddr, Fwmark* fwmark, int tunFd,
3752 bool doConnect = true) {
3753 const sockaddr_in dst = {.sin_family = AF_INET, .sin_port = 42, .sin_addr = dstAddr};
3754 IPSockAddr addr = IPSockAddr(dst);
3755
3756 return sendPacketFromUid(uid, addr, fwmark, tunFd, doConnect);
3757 }
3758
sendIPv6PacketFromUid(uid_t uid,const in6_addr & dstAddr,Fwmark * fwmark,int tunFd,bool doConnect=true)3759 bool sendIPv6PacketFromUid(uid_t uid, const in6_addr& dstAddr, Fwmark* fwmark, int tunFd,
3760 bool doConnect = true) {
3761 const sockaddr_in6 dst6 = {
3762 .sin6_family = AF_INET6,
3763 .sin6_port = 42,
3764 .sin6_addr = dstAddr,
3765 };
3766 IPSockAddr addr = IPSockAddr(dst6);
3767
3768 return sendPacketFromUid(uid, addr, fwmark, tunFd, doConnect);
3769 }
3770
3771 // Send an IPv6 packet from the uid. Expect to fail and get specified errno.
sendIPv6PacketFromUidFail(uid_t uid,const in6_addr & dstAddr,Fwmark * fwmark,bool doConnect,int expectedErr)3772 bool sendIPv6PacketFromUidFail(uid_t uid, const in6_addr& dstAddr, Fwmark* fwmark, bool doConnect,
3773 int expectedErr) {
3774 ScopedUidChange scopedUidChange(uid);
3775 unique_fd s(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
3776 if (s < 0) return false;
3777
3778 const sockaddr_in6 dst6 = {
3779 .sin6_family = AF_INET6,
3780 .sin6_port = 42,
3781 .sin6_addr = dstAddr,
3782 };
3783 if (doConnect) {
3784 if (connect(s, (sockaddr*)&dst6, sizeof(dst6)) == 0) return false;
3785 if (errno != expectedErr) return false;
3786 }
3787
3788 socklen_t fwmarkLen = sizeof(fwmark->intValue);
3789 EXPECT_NE(-1, getsockopt(s, SOL_SOCKET, SO_MARK, &(fwmark->intValue), &fwmarkLen));
3790
3791 char addr[INET6_ADDRSTRLEN];
3792 inet_ntop(AF_INET6, &dstAddr, addr, INET6_ADDRSTRLEN);
3793 SCOPED_TRACE(StringPrintf("sendIPv6PacketFail, addr: %s, uid: %u, doConnect: %s", addr, uid,
3794 doConnect ? "true" : "false"));
3795 if (!doConnect) {
3796 if (sendto(s, "foo", sizeof("foo"), 0, (sockaddr*)&dst6, sizeof(dst6)) == 0) return false;
3797 if (errno != expectedErr) return false;
3798 }
3799 return true;
3800 }
3801
expectVpnFallthroughRuleExists(const std::string & ifName,int vpnNetId)3802 void expectVpnFallthroughRuleExists(const std::string& ifName, int vpnNetId) {
3803 std::string vpnFallthroughRule =
3804 StringPrintf("%d:\tfrom all fwmark 0x%x/0xffff lookup %s",
3805 RULE_PRIORITY_VPN_FALLTHROUGH, vpnNetId, ifName.c_str());
3806 for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) {
3807 EXPECT_TRUE(ipRuleExists(ipVersion, vpnFallthroughRule));
3808 }
3809 }
3810
expectVpnFallthroughWorks(android::net::INetd * netdService,bool bypassable,uid_t uid,uid_t uidNotInVpn,const TunInterface & fallthroughNetwork,const TunInterface & vpnNetwork,const TunInterface & otherNetwork,int vpnNetId=TEST_NETID2,int fallthroughNetId=TEST_NETID1,int otherNetId=TEST_NETID3)3811 void expectVpnFallthroughWorks(android::net::INetd* netdService, bool bypassable, uid_t uid,
3812 uid_t uidNotInVpn, const TunInterface& fallthroughNetwork,
3813 const TunInterface& vpnNetwork, const TunInterface& otherNetwork,
3814 int vpnNetId = TEST_NETID2, int fallthroughNetId = TEST_NETID1,
3815 int otherNetId = TEST_NETID3) {
3816 // Set default network to NETID_UNSET
3817 EXPECT_TRUE(netdService->networkSetDefault(NETID_UNSET).isOk());
3818
3819 // insideVpnAddr based on the route we added in createVpnNetworkWithUid
3820 in6_addr insideVpnAddr = {
3821 {// 2001:db8:cafe::1
3822 .u6_addr8 = {0x20, 0x01, 0x0d, 0xb8, 0xca, 0xfe, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}}};
3823 // outsideVpnAddr will hit the route in the fallthrough network route table
3824 // because we added default route in createVpnNetworkWithUid
3825 in6_addr outsideVpnAddr = {
3826 {// 2607:f0d0:1002::4
3827 .u6_addr8 = {0x26, 0x07, 0xf0, 0xd0, 0x10, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4}}};
3828
3829 int fallthroughFd = fallthroughNetwork.getFdForTesting();
3830 int vpnFd = vpnNetwork.getFdForTesting();
3831 // Expect all connections to fail because UID 0 is not routed to the VPN and there is no
3832 // default network.
3833 Fwmark fwmark;
3834 EXPECT_FALSE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd));
3835 EXPECT_FALSE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, fallthroughFd));
3836
3837 // Set default network
3838 EXPECT_TRUE(netdService->networkSetDefault(fallthroughNetId).isOk());
3839
3840 // Connections go on the default network because UID 0 is not subject to the VPN.
3841 EXPECT_TRUE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd));
3842 EXPECT_EQ(fallthroughNetId | 0xC0000, static_cast<int>(fwmark.intValue));
3843 EXPECT_TRUE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, fallthroughFd));
3844 EXPECT_EQ(fallthroughNetId | 0xC0000, static_cast<int>(fwmark.intValue));
3845
3846 // Check if fallthrough rule exists
3847 expectVpnFallthroughRuleExists(fallthroughNetwork.name(), vpnNetId);
3848
3849 // Check if local exclusion rule exists for default network
3850 expectVpnLocalExclusionRuleExists(fallthroughNetwork.name(), true);
3851 // No local exclusion rule for non-default network
3852 expectVpnLocalExclusionRuleExists(otherNetwork.name(), false);
3853
3854 // Expect fallthrough to default network
3855 // The fwmark differs depending on whether the VPN is bypassable or not.
3856 EXPECT_TRUE(sendIPv6PacketFromUid(uid, outsideVpnAddr, &fwmark, fallthroughFd));
3857 EXPECT_EQ(bypassable ? vpnNetId : fallthroughNetId, static_cast<int>(fwmark.intValue));
3858
3859 // Expect connect success, packet will be sent to vpnFd.
3860 EXPECT_TRUE(sendIPv6PacketFromUid(uid, insideVpnAddr, &fwmark, vpnFd));
3861 EXPECT_EQ(bypassable ? vpnNetId : fallthroughNetId, static_cast<int>(fwmark.intValue));
3862
3863 // Explicitly select vpn network
3864 setNetworkForProcess(vpnNetId);
3865
3866 // Expect fallthrough to default network
3867 EXPECT_TRUE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd));
3868 // Expect the mark contains all the bit because we've selected network.
3869 EXPECT_EQ(vpnNetId | 0xF0000, static_cast<int>(fwmark.intValue));
3870
3871 // Expect connect success, packet will be sent to vpnFd.
3872 EXPECT_TRUE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, vpnFd));
3873 // Expect the mark contains all the bit because we've selected network.
3874 EXPECT_EQ(vpnNetId | 0xF0000, static_cast<int>(fwmark.intValue));
3875
3876 // Explicitly select fallthrough network
3877 setNetworkForProcess(fallthroughNetId);
3878
3879 // The mark is set to fallthrough network because we've selected it.
3880 EXPECT_TRUE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd));
3881 EXPECT_TRUE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, fallthroughFd));
3882
3883 // If vpn is BypassableVPN, connections can also go on the fallthrough network under vpn uid.
3884 if (bypassable) {
3885 EXPECT_TRUE(sendIPv6PacketFromUid(uid, outsideVpnAddr, &fwmark, fallthroughFd));
3886 EXPECT_TRUE(sendIPv6PacketFromUid(uid, insideVpnAddr, &fwmark, fallthroughFd));
3887 } else {
3888 // If not, no permission to bypass vpn.
3889 EXPECT_FALSE(sendIPv6PacketFromUid(uid, outsideVpnAddr, &fwmark, fallthroughFd));
3890 EXPECT_FALSE(sendIPv6PacketFromUid(uid, insideVpnAddr, &fwmark, fallthroughFd));
3891 }
3892
3893 // Add per-app uid ranges.
3894 EXPECT_TRUE(netdService
3895 ->networkAddUidRanges(otherNetId,
3896 {makeUidRangeParcel(uidNotInVpn, uidNotInVpn)})
3897 .isOk());
3898
3899 int appDefaultFd = otherNetwork.getFdForTesting();
3900
3901 // UID is not inside the VPN range, so it won't go to vpn network.
3902 // It won't fall into per app local rule because it's explicitly selected.
3903 EXPECT_TRUE(sendIPv6PacketFromUid(uidNotInVpn, outsideVpnAddr, &fwmark, fallthroughFd));
3904 EXPECT_TRUE(sendIPv6PacketFromUid(uidNotInVpn, insideVpnAddr, &fwmark, fallthroughFd));
3905
3906 // Reset explicitly selection.
3907 setNetworkForProcess(NETID_UNSET);
3908 // Connections can go to app default network.
3909 EXPECT_TRUE(sendIPv6PacketFromUid(uidNotInVpn, insideVpnAddr, &fwmark, appDefaultFd));
3910 EXPECT_TRUE(sendIPv6PacketFromUid(uidNotInVpn, outsideVpnAddr, &fwmark, appDefaultFd));
3911 }
3912
3913 } // namespace
3914
TEST_F(NetdBinderTest,SecureVPNFallthrough)3915 TEST_F(NetdBinderTest, SecureVPNFallthrough) {
3916 createVpnNetworkWithUid(true /* secure */, TEST_UID1);
3917 // Get current default network NetId
3918 ASSERT_TRUE(mNetd->networkGetDefault(&mStoredDefaultNetwork).isOk());
3919 expectVpnFallthroughWorks(mNetd.get(), false /* bypassable */, TEST_UID1, TEST_UID2, sTun,
3920 sTun2, sTun3);
3921 }
3922
TEST_F(NetdBinderTest,BypassableVPNFallthrough)3923 TEST_F(NetdBinderTest, BypassableVPNFallthrough) {
3924 createVpnNetworkWithUid(false /* secure */, TEST_UID1);
3925 // Get current default network NetId
3926 ASSERT_TRUE(mNetd->networkGetDefault(&mStoredDefaultNetwork).isOk());
3927 expectVpnFallthroughWorks(mNetd.get(), true /* bypassable */, TEST_UID1, TEST_UID2, sTun, sTun2,
3928 sTun3);
3929 }
3930
3931 namespace {
3932
createIpv6SocketAndCheckMark(int type,const in6_addr & dstAddr)3933 int32_t createIpv6SocketAndCheckMark(int type, const in6_addr& dstAddr) {
3934 const sockaddr_in6 dst6 = {
3935 .sin6_family = AF_INET6,
3936 .sin6_port = 1234,
3937 .sin6_addr = dstAddr,
3938 };
3939 // create non-blocking socket.
3940 int sockFd = socket(AF_INET6, type | SOCK_NONBLOCK, 0);
3941 EXPECT_NE(-1, sockFd);
3942 EXPECT_EQ((type == SOCK_STREAM) ? -1 : 0, connect(sockFd, (sockaddr*)&dst6, sizeof(dst6)));
3943
3944 // Get socket fwmark.
3945 Fwmark fwmark;
3946 socklen_t fwmarkLen = sizeof(fwmark.intValue);
3947 EXPECT_EQ(0, getsockopt(sockFd, SOL_SOCKET, SO_MARK, &fwmark.intValue, &fwmarkLen));
3948 EXPECT_EQ(0, close(sockFd));
3949 return fwmark.intValue;
3950 }
3951
3952 } // namespace
3953
TEST_F(NetdBinderTest,GetFwmarkForNetwork)3954 TEST_F(NetdBinderTest, GetFwmarkForNetwork) {
3955 // Save current default network.
3956 ASSERT_TRUE(mNetd->networkGetDefault(&mStoredDefaultNetwork).isOk());
3957
3958 // Add test physical network 1 and set as default network.
3959 auto config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
3960 INetd::PERMISSION_NONE, false, false);
3961 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3962 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk());
3963 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "2001:db8::/32", "").isOk());
3964 EXPECT_TRUE(mNetd->networkSetDefault(TEST_NETID1).isOk());
3965 // Add test physical network 2
3966 config.netId = TEST_NETID2;
3967 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
3968 EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID2, sTun2.name()).isOk());
3969
3970 // Get fwmark for network 1.
3971 MarkMaskParcel maskMarkNet1;
3972 ASSERT_TRUE(mNetd->getFwmarkForNetwork(TEST_NETID1, &maskMarkNet1).isOk());
3973
3974 uint32_t fwmarkTcp = createIpv6SocketAndCheckMark(SOCK_STREAM, V6_ADDR);
3975 uint32_t fwmarkUdp = createIpv6SocketAndCheckMark(SOCK_DGRAM, V6_ADDR);
3976 EXPECT_EQ(maskMarkNet1.mark, static_cast<int>(fwmarkTcp & maskMarkNet1.mask));
3977 EXPECT_EQ(maskMarkNet1.mark, static_cast<int>(fwmarkUdp & maskMarkNet1.mask));
3978
3979 // Get fwmark for network 2.
3980 MarkMaskParcel maskMarkNet2;
3981 ASSERT_TRUE(mNetd->getFwmarkForNetwork(TEST_NETID2, &maskMarkNet2).isOk());
3982 EXPECT_NE(maskMarkNet2.mark, static_cast<int>(fwmarkTcp & maskMarkNet2.mask));
3983 EXPECT_NE(maskMarkNet2.mark, static_cast<int>(fwmarkUdp & maskMarkNet2.mask));
3984
3985 // Remove test physical network.
3986 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID2).isOk());
3987 EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk());
3988 }
3989
TEST_F(NetdBinderTest,TestServiceDump)3990 TEST_F(NetdBinderTest, TestServiceDump) {
3991 sp<IBinder> binder = INetd::asBinder(mNetd);
3992 ASSERT_NE(nullptr, binder);
3993
3994 struct TestData {
3995 // Expected contents of the dump command.
3996 const std::string output;
3997 // A regex that might be helpful in matching relevant lines in the output.
3998 // Used to make it easier to add test cases for this code.
3999 const std::string hintRegex;
4000 };
4001 std::vector<TestData> testData;
4002
4003 // Send some IPCs and for each one add an element to testData telling us what to expect.
4004 const auto& config = makeNativeNetworkConfig(TEST_DUMP_NETID, NativeNetworkType::PHYSICAL,
4005 INetd::PERMISSION_NONE, false, false);
4006 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4007 testData.push_back(
4008 {"networkCreate(NativeNetworkConfig{netId: 65123, networkType: PHYSICAL, "
4009 "permission: 0, secure: false, vpnType: PLATFORM, excludeLocalRoutes: false})",
4010 "networkCreate.*65123"});
4011
4012 EXPECT_EQ(EEXIST, mNetd->networkCreate(config).serviceSpecificErrorCode());
4013 testData.push_back(
4014 {"networkCreate(NativeNetworkConfig{netId: 65123, networkType: PHYSICAL, "
4015 "permission: 0, secure: false, vpnType: PLATFORM, excludeLocalRoutes: false}) "
4016 "-> ServiceSpecificException(17, \"File exists\")",
4017 "networkCreate.*65123.*17"});
4018
4019 EXPECT_TRUE(mNetd->networkAddInterface(TEST_DUMP_NETID, sTun.name()).isOk());
4020 testData.push_back({StringPrintf("networkAddInterface(65123, %s)", sTun.name().c_str()),
4021 StringPrintf("networkAddInterface.*65123.*%s", sTun.name().c_str())});
4022
4023 android::net::RouteInfoParcel parcel;
4024 parcel.ifName = sTun.name();
4025 parcel.destination = "2001:db8:dead:beef::/64";
4026 parcel.nextHop = "fe80::dead:beef";
4027 parcel.mtu = 1234;
4028 EXPECT_TRUE(mNetd->networkAddRouteParcel(TEST_DUMP_NETID, parcel).isOk());
4029 testData.push_back(
4030 {StringPrintf("networkAddRouteParcel(65123, RouteInfoParcel{destination:"
4031 " 2001:db8:dead:beef::/64, ifName: %s, nextHop: fe80::dead:beef,"
4032 " mtu: 1234})",
4033 sTun.name().c_str()),
4034 "networkAddRouteParcel.*65123.*dead:beef"});
4035
4036 EXPECT_TRUE(mNetd->networkDestroy(TEST_DUMP_NETID).isOk());
4037 testData.push_back({"networkDestroy(65123)", "networkDestroy.*65123"});
4038
4039 // Send the service dump request to netd.
4040 std::vector<std::string> lines = {};
4041 android::status_t ret = dumpService(binder, {}, lines);
4042 ASSERT_EQ(android::OK, ret) << "Error dumping service: " << android::statusToString(ret);
4043
4044 // Basic regexp to match dump output lines. Matches the beginning and end of the line, and
4045 // puts the output of the command itself into the first match group.
4046 // Example: " 11-05 00:23:39.481 myCommand(args) <2.02ms>".
4047 const std::basic_regex lineRegex(
4048 "^ [0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}[.][0-9]{3} "
4049 "(.*)"
4050 " <[0-9]+[.][0-9]{2}ms>$");
4051
4052 // For each element of testdata, check that the expected output appears in the dump output.
4053 // If not, fail the test and use hintRegex to print similar lines to assist in debugging.
4054 for (const TestData& td : testData) {
4055 const bool found = std::any_of(lines.begin(), lines.end(), [&](const std::string& line) {
4056 std::smatch match;
4057 if (!std::regex_match(line, match, lineRegex)) return false;
4058 return (match.size() == 2) && (match[1].str() == td.output);
4059 });
4060 EXPECT_TRUE(found) << "Didn't find line '" << td.output << "' in dumpsys output.";
4061 if (found) continue;
4062 std::cerr << "Similar lines" << std::endl;
4063 for (const auto& line : lines) {
4064 if (std::regex_search(line, std::basic_regex(td.hintRegex))) {
4065 std::cerr << line << std::endl;
4066 }
4067 }
4068 }
4069 }
4070
4071 namespace {
4072
4073 // aliases for better reading
4074 #define SYSTEM_DEFAULT_NETID TEST_NETID1
4075 #define APP_DEFAULT_NETID TEST_NETID2
4076 #define VPN_NETID TEST_NETID3
4077
4078 #define ENTERPRISE_NETID_1 TEST_NETID2
4079 #define ENTERPRISE_NETID_2 TEST_NETID3
4080 #define ENTERPRISE_NETID_3 TEST_NETID4
4081
verifyAppUidRules(std::vector<bool> && expectedResults,std::vector<UidRangeParcel> & uidRanges,const std::string & iface,int32_t subPriority)4082 void verifyAppUidRules(std::vector<bool>&& expectedResults, std::vector<UidRangeParcel>& uidRanges,
4083 const std::string& iface, int32_t subPriority) {
4084 ASSERT_EQ(expectedResults.size(), uidRanges.size());
4085 if (iface.size()) {
4086 std::string action = StringPrintf("lookup %s", iface.c_str());
4087 std::string action_local = StringPrintf("lookup %s_local", iface.c_str());
4088 for (unsigned long i = 0; i < uidRanges.size(); i++) {
4089 EXPECT_EQ(expectedResults[i],
4090 ipRuleExistsForRange(RULE_PRIORITY_UID_EXPLICIT_NETWORK + subPriority,
4091 uidRanges[i], action));
4092 EXPECT_EQ(expectedResults[i],
4093 ipRuleExistsForRange(RULE_PRIORITY_UID_IMPLICIT_NETWORK + subPriority,
4094 uidRanges[i], action));
4095 EXPECT_EQ(expectedResults[i],
4096 ipRuleExistsForRange(RULE_PRIORITY_UID_DEFAULT_NETWORK + subPriority,
4097 uidRanges[i], action));
4098 EXPECT_EQ(expectedResults[i], ipRuleExistsForRange(RULE_PRIORITY_UID_LOCAL_ROUTES,
4099 uidRanges[i], action_local));
4100 }
4101 } else {
4102 std::string action = "unreachable";
4103 for (unsigned long i = 0; i < uidRanges.size(); i++) {
4104 EXPECT_EQ(expectedResults[i],
4105 ipRuleExistsForRange(RULE_PRIORITY_UID_EXPLICIT_NETWORK + subPriority,
4106 uidRanges[i], action));
4107 EXPECT_EQ(expectedResults[i],
4108 ipRuleExistsForRange(RULE_PRIORITY_UID_IMPLICIT_NETWORK + subPriority,
4109 uidRanges[i], action));
4110 EXPECT_EQ(expectedResults[i],
4111 ipRuleExistsForRange(RULE_PRIORITY_UID_DEFAULT_UNREACHABLE + subPriority,
4112 uidRanges[i], action));
4113 }
4114 }
4115 }
4116
verifyAppUidRules(std::vector<bool> && expectedResults,NativeUidRangeConfig & uidRangeConfig,const std::string & iface)4117 void verifyAppUidRules(std::vector<bool>&& expectedResults, NativeUidRangeConfig& uidRangeConfig,
4118 const std::string& iface) {
4119 verifyAppUidRules(std::move(expectedResults), uidRangeConfig.uidRanges, iface,
4120 uidRangeConfig.subPriority);
4121 }
4122
verifyVpnUidRules(std::vector<bool> && expectedResults,NativeUidRangeConfig & uidRangeConfig,const std::string & iface,bool secure,bool excludeLocalRoutes)4123 void verifyVpnUidRules(std::vector<bool>&& expectedResults, NativeUidRangeConfig& uidRangeConfig,
4124 const std::string& iface, bool secure, bool excludeLocalRoutes) {
4125 ASSERT_EQ(expectedResults.size(), uidRangeConfig.uidRanges.size());
4126 std::string action = StringPrintf("lookup %s", iface.c_str());
4127
4128 int32_t priority;
4129 if (secure) {
4130 priority = RULE_PRIORITY_SECURE_VPN;
4131 } else {
4132 // Set to no local exclusion here to reflect the default value of local exclusion.
4133 priority = excludeLocalRoutes ? RULE_PRIORITY_BYPASSABLE_VPN_LOCAL_EXCLUSION
4134 : RULE_PRIORITY_BYPASSABLE_VPN_NO_LOCAL_EXCLUSION;
4135 }
4136 for (unsigned long i = 0; i < uidRangeConfig.uidRanges.size(); i++) {
4137 EXPECT_EQ(expectedResults[i], ipRuleExistsForRange(priority + uidRangeConfig.subPriority,
4138 uidRangeConfig.uidRanges[i], action));
4139 EXPECT_EQ(expectedResults[i],
4140 ipRuleExistsForRange(RULE_PRIORITY_EXPLICIT_NETWORK + uidRangeConfig.subPriority,
4141 uidRangeConfig.uidRanges[i], action));
4142 EXPECT_EQ(expectedResults[i],
4143 ipRuleExistsForRange(RULE_PRIORITY_OUTPUT_INTERFACE + uidRangeConfig.subPriority,
4144 uidRangeConfig.uidRanges[i], action, iface.c_str()));
4145 }
4146 }
4147
4148 constexpr int SUB_PRIORITY_1 = UidRanges::SUB_PRIORITY_HIGHEST + 1;
4149 constexpr int SUB_PRIORITY_2 = UidRanges::SUB_PRIORITY_HIGHEST + 2;
4150
4151 constexpr int IMPLICITLY_SELECT = 0;
4152 constexpr int EXPLICITLY_SELECT = 1;
4153 constexpr int UNCONNECTED_SOCKET = 2;
4154
4155 // 1. Send data with the specified UID, on a connected or unconnected socket.
4156 // 2. Verify if data is received from the specified fd. The fd should belong to a TUN, which has
4157 // been assigned to the test network.
4158 // 3. Verify if fwmark of data is correct.
4159 // Note: This is a helper function used by per-app default network tests. It does not implement full
4160 // fwmark logic in netd, and it's currently sufficient. Extension may be required for more
4161 // complicated tests.
expectPacketSentOnNetId(uid_t uid,unsigned netId,int fd,int selectionMode)4162 void expectPacketSentOnNetId(uid_t uid, unsigned netId, int fd, int selectionMode) {
4163 Fwmark fwmark;
4164 const bool doConnect = (selectionMode != UNCONNECTED_SOCKET);
4165 EXPECT_TRUE(sendIPv6PacketFromUid(uid, V6_ADDR, &fwmark, fd, doConnect));
4166
4167 Fwmark expected;
4168 expected.netId = netId;
4169 expected.explicitlySelected = (selectionMode == EXPLICITLY_SELECT);
4170 if (uid == AID_ROOT && selectionMode == EXPLICITLY_SELECT) {
4171 expected.protectedFromVpn = true;
4172 } else {
4173 expected.protectedFromVpn = false;
4174 }
4175 if (selectionMode == UNCONNECTED_SOCKET) {
4176 expected.permission = PERMISSION_NONE;
4177 } else {
4178 expected.permission = (uid == AID_ROOT) ? PERMISSION_SYSTEM : PERMISSION_NONE;
4179 }
4180
4181 EXPECT_EQ(expected.intValue, fwmark.intValue);
4182 }
4183
expectUnreachableError(uid_t uid,unsigned netId,int selectionMode)4184 void expectUnreachableError(uid_t uid, unsigned netId, int selectionMode) {
4185 Fwmark fwmark;
4186 const bool doConnect = (selectionMode != UNCONNECTED_SOCKET);
4187 EXPECT_TRUE(sendIPv6PacketFromUidFail(uid, V6_ADDR, &fwmark, doConnect, ENETUNREACH));
4188
4189 Fwmark expected;
4190 expected.netId = netId;
4191 expected.explicitlySelected = (selectionMode == EXPLICITLY_SELECT);
4192 if (uid == AID_ROOT && selectionMode == EXPLICITLY_SELECT) {
4193 expected.protectedFromVpn = true;
4194 } else {
4195 expected.protectedFromVpn = false;
4196 }
4197 if (selectionMode == UNCONNECTED_SOCKET) {
4198 expected.permission = PERMISSION_NONE;
4199 } else {
4200 expected.permission = (uid == AID_ROOT) ? PERMISSION_SYSTEM : PERMISSION_NONE;
4201 }
4202
4203 EXPECT_EQ(expected.intValue, fwmark.intValue);
4204 }
4205
4206 } // namespace
4207
4208 // Verify how the API handle overlapped UID ranges
TEST_F(NetdBinderTest,PerAppDefaultNetwork_OverlappedUidRanges)4209 TEST_F(NetdBinderTest, PerAppDefaultNetwork_OverlappedUidRanges) {
4210 const auto& config = makeNativeNetworkConfig(APP_DEFAULT_NETID, NativeNetworkType::PHYSICAL,
4211 INetd::PERMISSION_NONE, false, false);
4212 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4213 EXPECT_TRUE(mNetd->networkAddInterface(APP_DEFAULT_NETID, sTun.name()).isOk());
4214
4215 std::vector<UidRangeParcel> uidRanges = {makeUidRangeParcel(BASE_UID + 1, BASE_UID + 1),
4216 makeUidRangeParcel(BASE_UID + 10, BASE_UID + 12)};
4217 EXPECT_TRUE(mNetd->networkAddUidRanges(APP_DEFAULT_NETID, uidRanges).isOk());
4218
4219 binder::Status status;
4220 status = mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4221 {makeUidRangeParcel(BASE_UID + 1, BASE_UID + 1)});
4222 EXPECT_TRUE(status.isOk());
4223
4224 status = mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4225 {makeUidRangeParcel(BASE_UID + 9, BASE_UID + 10)});
4226 EXPECT_TRUE(status.isOk());
4227
4228 status = mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4229 {makeUidRangeParcel(BASE_UID + 11, BASE_UID + 11)});
4230 EXPECT_TRUE(status.isOk());
4231
4232 status = mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4233 {makeUidRangeParcel(BASE_UID + 12, BASE_UID + 13)});
4234 EXPECT_TRUE(status.isOk());
4235
4236 status = mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4237 {makeUidRangeParcel(BASE_UID + 9, BASE_UID + 13)});
4238 EXPECT_TRUE(status.isOk());
4239
4240 std::vector<UidRangeParcel> selfOverlappedUidRanges = {
4241 makeUidRangeParcel(BASE_UID + 20, BASE_UID + 20),
4242 makeUidRangeParcel(BASE_UID + 20, BASE_UID + 21)};
4243 status = mNetd->networkAddUidRanges(APP_DEFAULT_NETID, selfOverlappedUidRanges);
4244 EXPECT_FALSE(status.isOk());
4245 EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode());
4246 }
4247
4248 // Verify whether IP rules for app default network are correctly configured.
TEST_F(NetdBinderTest,PerAppDefaultNetwork_VerifyIpRules)4249 TEST_F(NetdBinderTest, PerAppDefaultNetwork_VerifyIpRules) {
4250 const auto& config = makeNativeNetworkConfig(APP_DEFAULT_NETID, NativeNetworkType::PHYSICAL,
4251 INetd::PERMISSION_NONE, false, false);
4252 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4253 EXPECT_TRUE(mNetd->networkAddInterface(APP_DEFAULT_NETID, sTun.name()).isOk());
4254
4255 std::vector<UidRangeParcel> uidRanges = {makeUidRangeParcel(BASE_UID + 8005, BASE_UID + 8012),
4256 makeUidRangeParcel(BASE_UID + 8090, BASE_UID + 8099)};
4257
4258 EXPECT_TRUE(mNetd->networkAddUidRanges(APP_DEFAULT_NETID, uidRanges).isOk());
4259 verifyAppUidRules({true, true} /*expectedResults*/, uidRanges, sTun.name(),
4260 UidRanges::SUB_PRIORITY_HIGHEST);
4261 EXPECT_TRUE(mNetd->networkRemoveUidRanges(APP_DEFAULT_NETID, {uidRanges.at(0)}).isOk());
4262 verifyAppUidRules({false, true} /*expectedResults*/, uidRanges, sTun.name(),
4263 UidRanges::SUB_PRIORITY_HIGHEST);
4264 EXPECT_TRUE(mNetd->networkRemoveUidRanges(APP_DEFAULT_NETID, {uidRanges.at(1)}).isOk());
4265 verifyAppUidRules({false, false} /*expectedResults*/, uidRanges, sTun.name(),
4266 UidRanges::SUB_PRIORITY_HIGHEST);
4267
4268 EXPECT_TRUE(mNetd->networkAddUidRanges(INetd::UNREACHABLE_NET_ID, uidRanges).isOk());
4269 verifyAppUidRules({true, true} /*expectedResults*/, uidRanges, "",
4270 UidRanges::SUB_PRIORITY_HIGHEST);
4271 EXPECT_TRUE(mNetd->networkRemoveUidRanges(INetd::UNREACHABLE_NET_ID, {uidRanges.at(0)}).isOk());
4272 verifyAppUidRules({false, true} /*expectedResults*/, uidRanges, "",
4273 UidRanges::SUB_PRIORITY_HIGHEST);
4274 EXPECT_TRUE(mNetd->networkRemoveUidRanges(INetd::UNREACHABLE_NET_ID, {uidRanges.at(1)}).isOk());
4275 verifyAppUidRules({false, false} /*expectedResults*/, uidRanges, "",
4276 UidRanges::SUB_PRIORITY_HIGHEST);
4277 }
4278
4279 // Verify whether packets go through the right network with and without per-app default network.
4280 // Meaning of Fwmark bits (from Fwmark.h):
4281 // 0x0000ffff - Network ID
4282 // 0x00010000 - Explicit mark bit
4283 // 0x00020000 - VPN protect bit
4284 // 0x000c0000 - Permission bits
TEST_F(NetdBinderTest,PerAppDefaultNetwork_ImplicitlySelectNetwork)4285 TEST_F(NetdBinderTest, PerAppDefaultNetwork_ImplicitlySelectNetwork) {
4286 createDefaultAndOtherPhysicalNetwork(SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID);
4287
4288 int systemDefaultFd = sTun.getFdForTesting();
4289 int appDefaultFd = sTun2.getFdForTesting();
4290
4291 // Connections go through the system default network.
4292 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
4293 expectPacketSentOnNetId(TEST_UID1, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
4294
4295 // Add TEST_UID1 to per-app default network.
4296 EXPECT_TRUE(mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4297 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4298 .isOk());
4299 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
4300 expectPacketSentOnNetId(TEST_UID1, APP_DEFAULT_NETID, appDefaultFd, IMPLICITLY_SELECT);
4301
4302 // Remove TEST_UID1 from per-app default network.
4303 EXPECT_TRUE(mNetd->networkRemoveUidRanges(APP_DEFAULT_NETID,
4304 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4305 .isOk());
4306 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
4307 expectPacketSentOnNetId(TEST_UID1, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
4308
4309 // Prohibit TEST_UID1 from using the default network.
4310 EXPECT_TRUE(mNetd->networkAddUidRanges(INetd::UNREACHABLE_NET_ID,
4311 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4312 .isOk());
4313 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
4314 expectUnreachableError(TEST_UID1, INetd::UNREACHABLE_NET_ID, IMPLICITLY_SELECT);
4315
4316 // restore IP rules
4317 EXPECT_TRUE(mNetd->networkRemoveUidRanges(INetd::UNREACHABLE_NET_ID,
4318 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4319 .isOk());
4320 }
4321
4322 // Verify whether packets go through the right network when app explicitly selects a network.
TEST_F(NetdBinderTest,PerAppDefaultNetwork_ExplicitlySelectNetwork)4323 TEST_F(NetdBinderTest, PerAppDefaultNetwork_ExplicitlySelectNetwork) {
4324 createDefaultAndOtherPhysicalNetwork(SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID);
4325
4326 int systemDefaultFd = sTun.getFdForTesting();
4327 int appDefaultFd = sTun2.getFdForTesting();
4328
4329 // Explicitly select the system default network.
4330 setNetworkForProcess(SYSTEM_DEFAULT_NETID);
4331 // Connections go through the system default network.
4332 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, EXPLICITLY_SELECT);
4333 expectPacketSentOnNetId(TEST_UID1, SYSTEM_DEFAULT_NETID, systemDefaultFd, EXPLICITLY_SELECT);
4334
4335 // Set TEST_UID1 to default unreachable, which won't affect the explicitly selected network.
4336 // Connections go through the system default network.
4337 EXPECT_TRUE(mNetd->networkAddUidRanges(INetd::UNREACHABLE_NET_ID,
4338 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4339 .isOk());
4340 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, EXPLICITLY_SELECT);
4341 expectPacketSentOnNetId(TEST_UID1, SYSTEM_DEFAULT_NETID, systemDefaultFd, EXPLICITLY_SELECT);
4342
4343 // restore IP rules
4344 EXPECT_TRUE(mNetd->networkRemoveUidRanges(INetd::UNREACHABLE_NET_ID,
4345 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4346 .isOk());
4347
4348 // Add TEST_UID1 to per-app default network, which won't affect the explicitly selected network.
4349 EXPECT_TRUE(mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4350 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4351 .isOk());
4352 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, EXPLICITLY_SELECT);
4353 expectPacketSentOnNetId(TEST_UID1, SYSTEM_DEFAULT_NETID, systemDefaultFd, EXPLICITLY_SELECT);
4354
4355 // Explicitly select the per-app default network.
4356 setNetworkForProcess(APP_DEFAULT_NETID);
4357 // Connections go through the per-app default network.
4358 expectPacketSentOnNetId(AID_ROOT, APP_DEFAULT_NETID, appDefaultFd, EXPLICITLY_SELECT);
4359 expectPacketSentOnNetId(TEST_UID1, APP_DEFAULT_NETID, appDefaultFd, EXPLICITLY_SELECT);
4360 }
4361
4362 // Verify whether packets go through the right network if app does not implicitly or explicitly
4363 // select any network.
TEST_F(NetdBinderTest,PerAppDefaultNetwork_UnconnectedSocket)4364 TEST_F(NetdBinderTest, PerAppDefaultNetwork_UnconnectedSocket) {
4365 createDefaultAndOtherPhysicalNetwork(SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID);
4366
4367 int systemDefaultFd = sTun.getFdForTesting();
4368 int appDefaultFd = sTun2.getFdForTesting();
4369
4370 // Connections go through the system default network.
4371 expectPacketSentOnNetId(AID_ROOT, NETID_UNSET, systemDefaultFd, UNCONNECTED_SOCKET);
4372 expectPacketSentOnNetId(TEST_UID1, NETID_UNSET, systemDefaultFd, UNCONNECTED_SOCKET);
4373
4374 // Add TEST_UID1 to per-app default network. Traffic should go through the per-app default
4375 // network if UID is in range. Otherwise, go through the system default network.
4376 EXPECT_TRUE(mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4377 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4378 .isOk());
4379 expectPacketSentOnNetId(AID_ROOT, NETID_UNSET, systemDefaultFd, UNCONNECTED_SOCKET);
4380 expectPacketSentOnNetId(TEST_UID1, NETID_UNSET, appDefaultFd, UNCONNECTED_SOCKET);
4381
4382 // Set TEST_UID1's default network to unreachable. Its traffic should still go through the
4383 // per-app default network. Other traffic go through the system default network.
4384 // PS: per-app default network take precedence over unreachable network. This should happens
4385 // only in the transition period when both rules are briefly set.
4386 EXPECT_TRUE(mNetd->networkAddUidRanges(INetd::UNREACHABLE_NET_ID,
4387 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4388 .isOk());
4389 expectPacketSentOnNetId(AID_ROOT, NETID_UNSET, systemDefaultFd, UNCONNECTED_SOCKET);
4390 expectPacketSentOnNetId(TEST_UID1, NETID_UNSET, appDefaultFd, UNCONNECTED_SOCKET);
4391
4392 // Remove TEST_UID1's default network from OEM-paid network. Its traffic should get ENETUNREACH
4393 // error. Other traffic still go through the system default network.
4394 EXPECT_TRUE(mNetd->networkRemoveUidRanges(APP_DEFAULT_NETID,
4395 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4396 .isOk());
4397 expectPacketSentOnNetId(AID_ROOT, NETID_UNSET, systemDefaultFd, UNCONNECTED_SOCKET);
4398 expectUnreachableError(TEST_UID1, NETID_UNSET, UNCONNECTED_SOCKET);
4399
4400 // restore IP rules
4401 EXPECT_TRUE(mNetd->networkRemoveUidRanges(INetd::UNREACHABLE_NET_ID,
4402 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4403 .isOk());
4404 }
4405
TEST_F(NetdBinderTest,PerAppDefaultNetwork_PermissionCheck)4406 TEST_F(NetdBinderTest, PerAppDefaultNetwork_PermissionCheck) {
4407 createPhysicalNetwork(APP_DEFAULT_NETID, sTun2.name(), INetd::PERMISSION_SYSTEM);
4408
4409 { // uid is not in app range. Can not set network for process.
4410 ScopedUidChange scopedUidChange(TEST_UID1);
4411 EXPECT_EQ(-EACCES, setNetworkForProcess(APP_DEFAULT_NETID));
4412 }
4413
4414 EXPECT_TRUE(mNetd->networkAddUidRanges(APP_DEFAULT_NETID,
4415 {makeUidRangeParcel(TEST_UID1, TEST_UID1)})
4416 .isOk());
4417
4418 { // uid is in app range. Can set network for process.
4419 ScopedUidChange scopedUidChange(TEST_UID1);
4420 EXPECT_EQ(0, setNetworkForProcess(APP_DEFAULT_NETID));
4421 }
4422 }
4423
4424 class VpnParameterizedTest : public NetdBinderTest, public testing::WithParamInterface<bool> {};
4425
4426 // Exercise secure and bypassable VPN.
4427 INSTANTIATE_TEST_SUITE_P(PerAppDefaultNetwork, VpnParameterizedTest, testing::Bool(),
__anondf233e381f02(const testing::TestParamInfo<bool>& info) 4428 [](const testing::TestParamInfo<bool>& info) {
4429 return info.param ? "SecureVPN" : "BypassableVPN";
4430 });
4431
4432 // Verify per-app default network + VPN.
TEST_P(VpnParameterizedTest,ImplicitlySelectNetwork)4433 TEST_P(VpnParameterizedTest, ImplicitlySelectNetwork) {
4434 const bool isSecureVPN = GetParam();
4435 createVpnAndAppDefaultNetworkWithUid(
4436 SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID, VPN_NETID, isSecureVPN,
4437 {makeUidRangeParcel(TEST_UID2, TEST_UID1)} /* app range */,
4438 {makeUidRangeParcel(TEST_UID3, TEST_UID2)} /* VPN range */);
4439
4440 int systemDefaultFd = sTun.getFdForTesting();
4441 int appDefaultFd = sTun2.getFdForTesting();
4442 int vpnFd = sTun3.getFdForTesting();
4443
4444 // uid is neither in app range, nor in VPN range. Traffic goes through system default network.
4445 expectPacketSentOnNetId(AID_ROOT, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
4446 // uid is in VPN range, not in app range. Traffic goes through VPN.
4447 expectPacketSentOnNetId(TEST_UID3, (isSecureVPN ? SYSTEM_DEFAULT_NETID : VPN_NETID), vpnFd,
4448 IMPLICITLY_SELECT);
4449 // uid is in app range, not in VPN range. Traffic goes through per-app default network.
4450 expectPacketSentOnNetId(TEST_UID1, APP_DEFAULT_NETID, appDefaultFd, IMPLICITLY_SELECT);
4451 // uid is in both app and VPN range. Traffic goes through VPN.
4452 expectPacketSentOnNetId(TEST_UID2, (isSecureVPN ? APP_DEFAULT_NETID : VPN_NETID), vpnFd,
4453 IMPLICITLY_SELECT);
4454 }
4455
4456 class VpnAndSelectNetworkParameterizedTest
4457 : public NetdBinderTest,
4458 public testing::WithParamInterface<std::tuple<bool, int>> {};
4459
4460 // Exercise the combination of different VPN types and different user selected networks. e.g.
4461 // secure VPN + select on system default network
4462 // secure VPN + select on app default network
4463 // secure VPN + select on VPN
4464 // bypassable VPN + select on system default network
4465 // ...
4466 INSTANTIATE_TEST_SUITE_P(PerAppDefaultNetwork, VpnAndSelectNetworkParameterizedTest,
4467 testing::Combine(testing::Bool(),
4468 testing::Values(SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID,
4469 VPN_NETID)),
__anondf233e382002(const testing::TestParamInfo<std::tuple<bool, int>>& info) 4470 [](const testing::TestParamInfo<std::tuple<bool, int>>& info) {
4471 const std::string vpnType = std::get<0>(info.param)
4472 ? std::string("SecureVPN")
4473 : std::string("BypassableVPN");
4474 std::string selectedNetwork;
4475 switch (std::get<1>(info.param)) {
4476 case SYSTEM_DEFAULT_NETID:
4477 selectedNetwork = "SystemDefaultNetwork";
4478 break;
4479 case APP_DEFAULT_NETID:
4480 selectedNetwork = "AppDefaultNetwork";
4481 break;
4482 case VPN_NETID:
4483 selectedNetwork = "VPN";
4484 break;
4485 default:
4486 selectedNetwork = "InvalidParameter"; // Should not happen.
4487 }
4488 return vpnType + "_select" + selectedNetwork;
4489 });
4490
TEST_P(VpnAndSelectNetworkParameterizedTest,ExplicitlySelectNetwork)4491 TEST_P(VpnAndSelectNetworkParameterizedTest, ExplicitlySelectNetwork) {
4492 bool isSecureVPN;
4493 int selectedNetId;
4494 std::tie(isSecureVPN, selectedNetId) = GetParam();
4495 createVpnAndAppDefaultNetworkWithUid(
4496 SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID, VPN_NETID, isSecureVPN,
4497 {makeUidRangeParcel(TEST_UID2, TEST_UID1)} /* app range */,
4498 {makeUidRangeParcel(TEST_UID3, TEST_UID2)} /* VPN range */);
4499
4500 int expectedFd = -1;
4501 switch (selectedNetId) {
4502 case SYSTEM_DEFAULT_NETID:
4503 expectedFd = sTun.getFdForTesting();
4504 break;
4505 case APP_DEFAULT_NETID:
4506 expectedFd = sTun2.getFdForTesting();
4507 break;
4508 case VPN_NETID:
4509 expectedFd = sTun3.getFdForTesting();
4510 break;
4511 default:
4512 GTEST_LOG_(ERROR) << "unexpected netId:" << selectedNetId; // Should not happen.
4513 }
4514
4515 // In all following permutations, Traffic should go through the specified network if a process
4516 // can select network for itself. The fwmark should contain process UID and the explicit select
4517 // bit.
4518 { // uid is neither in app range, nor in VPN range. Permission bits, protect bit, and explicit
4519 // select bit are all set because of AID_ROOT.
4520 ScopedUidChange scopedUidChange(AID_ROOT);
4521 EXPECT_EQ(0, setNetworkForProcess(selectedNetId));
4522 expectPacketSentOnNetId(AID_ROOT, selectedNetId, expectedFd, EXPLICITLY_SELECT);
4523 }
4524 { // uid is in VPN range, not in app range.
4525 ScopedUidChange scopedUidChange(TEST_UID3);
4526 // Cannot select non-VPN networks when uid is subject to secure VPN.
4527 if (isSecureVPN && selectedNetId != VPN_NETID) {
4528 EXPECT_EQ(-EPERM, setNetworkForProcess(selectedNetId));
4529 } else {
4530 EXPECT_EQ(0, setNetworkForProcess(selectedNetId));
4531 expectPacketSentOnNetId(TEST_UID3, selectedNetId, expectedFd, EXPLICITLY_SELECT);
4532 }
4533 }
4534 { // uid is in app range, not in VPN range.
4535 ScopedUidChange scopedUidChange(TEST_UID1);
4536 // Cannot select the VPN because the VPN does not applies to the UID.
4537 if (selectedNetId == VPN_NETID) {
4538 EXPECT_EQ(-EPERM, setNetworkForProcess(selectedNetId));
4539 } else {
4540 EXPECT_EQ(0, setNetworkForProcess(selectedNetId));
4541 expectPacketSentOnNetId(TEST_UID1, selectedNetId, expectedFd, EXPLICITLY_SELECT);
4542 }
4543 }
4544 { // uid is in both app range and VPN range.
4545 ScopedUidChange scopedUidChange(TEST_UID2);
4546 // Cannot select non-VPN networks when uid is subject to secure VPN.
4547 if (isSecureVPN && selectedNetId != VPN_NETID) {
4548 EXPECT_EQ(-EPERM, setNetworkForProcess(selectedNetId));
4549 } else {
4550 EXPECT_EQ(0, setNetworkForProcess(selectedNetId));
4551 expectPacketSentOnNetId(TEST_UID2, selectedNetId, expectedFd, EXPLICITLY_SELECT);
4552 }
4553 }
4554 }
4555
TEST_P(VpnParameterizedTest,UnconnectedSocket)4556 TEST_P(VpnParameterizedTest, UnconnectedSocket) {
4557 const bool isSecureVPN = GetParam();
4558 createVpnAndAppDefaultNetworkWithUid(
4559 SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID, VPN_NETID, isSecureVPN,
4560 {makeUidRangeParcel(TEST_UID2, TEST_UID1)} /* app range */,
4561 {makeUidRangeParcel(TEST_UID3, TEST_UID2)} /* VPN range */);
4562
4563 int systemDefaultFd = sTun.getFdForTesting();
4564 int appDefaultFd = sTun2.getFdForTesting();
4565 int vpnFd = sTun3.getFdForTesting();
4566
4567 // uid is neither in app range, nor in VPN range. Traffic goes through system default network.
4568 expectPacketSentOnNetId(AID_ROOT, NETID_UNSET, systemDefaultFd, UNCONNECTED_SOCKET);
4569 // uid is in VPN range, not in app range. Traffic goes through VPN.
4570 expectPacketSentOnNetId(TEST_UID3, NETID_UNSET, vpnFd, UNCONNECTED_SOCKET);
4571 // uid is in app range, not in VPN range. Traffic goes through per-app default network.
4572 expectPacketSentOnNetId(TEST_UID1, NETID_UNSET, appDefaultFd, UNCONNECTED_SOCKET);
4573 // uid is in both app and VPN range. Traffic goes through VPN.
4574 expectPacketSentOnNetId(TEST_UID2, NETID_UNSET, vpnFd, UNCONNECTED_SOCKET);
4575 }
4576
4577 class VpnLocalRoutesParameterizedTest
4578 : public NetdBinderTest,
4579 public testing::WithParamInterface<std::tuple<int, int, bool, bool, bool, bool>> {
4580 protected:
4581 // Local/non-local addresses based on the route added in
4582 // setupNetworkRoutesForVpnAndDefaultNetworks.
4583 in_addr V4_LOCAL_ADDR = {htonl(0xC0A80008)}; // 192.168.0.8
4584 in_addr V4_APP_LOCAL_ADDR = {htonl(0xAC100008)}; // 172.16.0.8
4585 in_addr V4_GLOBAL_ADDR = {htonl(0x08080808)}; // 8.8.8.8
4586
4587 in6_addr V6_LOCAL_ADDR = {
4588 {// 2001:db8:cafe::1
4589 .u6_addr8 = {0x20, 0x01, 0x0d, 0xb8, 0xca, 0xfe, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}}};
4590 in6_addr V6_APP_LOCAL_ADDR = {
4591 {// 2607:f0d0:1234::4
4592 .u6_addr8 = {0x26, 0x07, 0xf0, 0xd0, 0x12, 0x34, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4}}};
4593 in6_addr V6_GLOBAL_ADDR = {
4594 {// 2607:1234:1002::4
4595 .u6_addr8 = {0x26, 0x07, 0x12, 0x34, 0x10, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4}}};
4596 };
4597
4598 const int SEND_TO_GLOBAL = 0;
4599 const int SEND_TO_SYSTEM_DEFAULT_LOCAL = 1;
4600 const int SEND_TO_PER_APP_DEFAULT_LOCAL = 2;
4601
4602 // Exercise the combination of different explicitly selected network, different uid, local/non-local
4603 // address on local route exclusion VPN. E.g.
4604 // explicitlySelected systemDefault + uid in VPN range + no app default + non local address
4605 // explicitlySelected systemDefault + uid in VPN range + has app default + non local address
4606 // explicitlySelected systemDefault + uid in VPN range + has app default + local address
4607 // explicitlySelected appDefault + uid not in VPN range + has app default + non local address
4608 INSTANTIATE_TEST_SUITE_P(
4609 PerAppDefaultNetwork, VpnLocalRoutesParameterizedTest,
4610 testing::Combine(testing::Values(SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID, NETID_UNSET),
4611 testing::Values(SEND_TO_GLOBAL, SEND_TO_SYSTEM_DEFAULT_LOCAL,
4612 SEND_TO_PER_APP_DEFAULT_LOCAL),
4613 testing::Bool(), testing::Bool(), testing::Bool(), testing::Bool()),
__anondf233e382102(const testing::TestParamInfo<std::tuple<int, int, bool, bool, bool, bool>>& info) 4614 [](const testing::TestParamInfo<std::tuple<int, int, bool, bool, bool, bool>>& info) {
4615 std::string explicitlySelected;
4616 switch (std::get<0>(info.param)) {
4617 case SYSTEM_DEFAULT_NETID:
4618 explicitlySelected = "explicitlySelectedSystemDefault";
4619 break;
4620 case APP_DEFAULT_NETID:
4621 explicitlySelected = "explicitlySelectedAppDefault";
4622 break;
4623 case NETID_UNSET:
4624 explicitlySelected = "implicitlySelected";
4625 break;
4626 default:
4627 explicitlySelected = "InvalidParameter"; // Should not happen.
4628 }
4629
4630 std::string sendToAddr;
4631 switch (std::get<1>(info.param)) {
4632 case SEND_TO_GLOBAL:
4633 sendToAddr = "GlobalAddr";
4634 break;
4635 case SEND_TO_SYSTEM_DEFAULT_LOCAL:
4636 sendToAddr = "SystemLocal";
4637 break;
4638 case SEND_TO_PER_APP_DEFAULT_LOCAL:
4639 sendToAddr = "AppLocal";
4640 break;
4641 default:
4642 sendToAddr = "InvalidAddr"; // Should not happen.
4643 }
4644
4645 const std::string isSubjectToVpn = std::get<2>(info.param)
4646 ? std::string("SubjectToVpn")
4647 : std::string("NotSubjectToVpn");
4648
4649 const std::string hasAppDefaultNetwork = std::get<3>(info.param)
4650 ? std::string("HasAppDefault")
4651 : std::string("NothasAppDefault");
4652
4653 const std::string testV6 =
4654 std::get<4>(info.param) ? std::string("v6") : std::string("v4");
4655
4656 // Apply the same or different local address in app default and system default.
4657 const std::string differentLocalRoutes = std::get<5>(info.param)
4658 ? std::string("DifferentLocalRoutes")
4659 : std::string("SameLocalAddr");
4660
4661 return explicitlySelected + "_uid" + isSubjectToVpn + hasAppDefaultNetwork +
4662 "Range_with" + testV6 + sendToAddr + differentLocalRoutes;
4663 });
4664
getTargetIfaceForLocalRoutesExclusion(bool isSubjectToVpn,bool hasAppDefaultNetwork,bool differentLocalRoutes,int sendToAddr,int selectedNetId,int fallthroughFd,int appDefaultFd,int vpnFd)4665 int getTargetIfaceForLocalRoutesExclusion(bool isSubjectToVpn, bool hasAppDefaultNetwork,
4666 bool differentLocalRoutes, int sendToAddr,
4667 int selectedNetId, int fallthroughFd, int appDefaultFd,
4668 int vpnFd) {
4669 int expectedIface;
4670
4671 // Setup the expected interface based on the condition.
4672 if (isSubjectToVpn && hasAppDefaultNetwork) {
4673 switch (sendToAddr) {
4674 case SEND_TO_GLOBAL:
4675 expectedIface = vpnFd;
4676 break;
4677 case SEND_TO_SYSTEM_DEFAULT_LOCAL:
4678 // Go to app default if the app default and system default are the same range
4679 // TODO(b/237351736): It should go to VPN if the system local and app local are
4680 // different.
4681 expectedIface = differentLocalRoutes ? fallthroughFd : appDefaultFd;
4682 break;
4683 case SEND_TO_PER_APP_DEFAULT_LOCAL:
4684 expectedIface = appDefaultFd;
4685 break;
4686 default:
4687 expectedIface = -1; // should not happen
4688 }
4689 } else if (isSubjectToVpn && !hasAppDefaultNetwork) {
4690 switch (sendToAddr) {
4691 case SEND_TO_GLOBAL:
4692 expectedIface = vpnFd;
4693 break;
4694 case SEND_TO_SYSTEM_DEFAULT_LOCAL:
4695 // TODO(b/237351736): It should go to app default if the system local and app local
4696 // are different.
4697 expectedIface = fallthroughFd;
4698 break;
4699 case SEND_TO_PER_APP_DEFAULT_LOCAL:
4700 // Go to system default if the system default and app default are the same range.
4701 expectedIface = differentLocalRoutes ? vpnFd : fallthroughFd;
4702 break;
4703 default:
4704 expectedIface = -1; // should not happen
4705 }
4706 } else if (!isSubjectToVpn && hasAppDefaultNetwork) {
4707 expectedIface = appDefaultFd;
4708 } else { // !isSubjectToVpn && !hasAppDefaultNetwork
4709 expectedIface = fallthroughFd;
4710 }
4711
4712 // Override the target if it's explicitly selected.
4713 switch (selectedNetId) {
4714 case SYSTEM_DEFAULT_NETID:
4715 expectedIface = fallthroughFd;
4716 break;
4717 case APP_DEFAULT_NETID:
4718 expectedIface = appDefaultFd;
4719 break;
4720 default:
4721 break;
4722 // Based on the uid range.
4723 }
4724
4725 return expectedIface;
4726 }
4727
4728 // Routes configured on the system default network and on the VPN.
4729 // This allows the test to verify the worst case where the physical network and the VPN configure
4730 // the same routes. This ensures that routing is determined by the IP rules and doesn't just happen
4731 // to work because the routes don't overlap. If differentLocalRoutes is false, these routes are also
4732 // configured on the per-app default network.
4733 // For both IPv4 and IPv6, the first route is local, the second is not.
4734 std::vector<std::string> SYSTEM_DEFAULT_ROUTES = {"192.168.0.0/16", "0.0.0.0/0",
4735 "2001:db8:cafe::/48", "::/0"};
4736 // Routes configured on the per-app default network if differentLocalRoutes is true.
4737 // For both IPv4 and IPv6, the first route is local, the second is not.
4738 std::vector<std::string> APP_DEFAULT_ROUTES = {"172.16.0.0/16", "0.0.0.0/0", "2607:f0d0:1234::/48",
4739 "::/0"};
setupNetworkRoutesForVpnAndDefaultNetworks(int systemDefaultNetId,int appDefaultNetId,int vpnNetId,int otherNetId,bool secure,bool testV6,bool differentLocalRoutes,std::vector<UidRangeParcel> && appDefaultUidRanges,std::vector<UidRangeParcel> && vpnUidRanges)4740 void NetdBinderTest::setupNetworkRoutesForVpnAndDefaultNetworks(
4741 int systemDefaultNetId, int appDefaultNetId, int vpnNetId, int otherNetId, bool secure,
4742 bool testV6, bool differentLocalRoutes, std::vector<UidRangeParcel>&& appDefaultUidRanges,
4743 std::vector<UidRangeParcel>&& vpnUidRanges) {
4744 // Create a physical network on sTun, and set it as the system default network
4745 createAndSetDefaultNetwork(systemDefaultNetId, sTun.name());
4746
4747 // Routes are configured to system default, app default and vpn network to verify if the packets
4748 // are routed correctly.
4749
4750 // Setup system default routing.
4751 for (const auto& route : SYSTEM_DEFAULT_ROUTES) {
4752 EXPECT_TRUE(mNetd->networkAddRoute(systemDefaultNetId, sTun.name(), route, "").isOk());
4753 }
4754
4755 // Create another physical network on sTun2 as per app default network
4756 createPhysicalNetwork(appDefaultNetId, sTun2.name());
4757
4758 // Setup app default routing.
4759 std::vector<std::string> appDefaultRoutes =
4760 (differentLocalRoutes ? APP_DEFAULT_ROUTES : SYSTEM_DEFAULT_ROUTES);
4761 for (const auto& route : appDefaultRoutes) {
4762 EXPECT_TRUE(mNetd->networkAddRoute(appDefaultNetId, sTun2.name(), route, "").isOk());
4763 }
4764
4765 // Create a bypassable VPN on sTun3.
4766 auto config = makeNativeNetworkConfig(vpnNetId, NativeNetworkType::VIRTUAL,
4767 INetd::PERMISSION_NONE, secure, true);
4768 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4769 EXPECT_TRUE(mNetd->networkAddInterface(vpnNetId, sTun3.name()).isOk());
4770
4771 // Setup vpn routing.
4772 for (const auto& route : SYSTEM_DEFAULT_ROUTES) {
4773 EXPECT_TRUE(mNetd->networkAddRoute(vpnNetId, sTun3.name(), route, "").isOk());
4774 }
4775
4776 // Create another interface that is neither system default nor the app default to make sure
4777 // the traffic won't be mis-routed.
4778 createPhysicalNetwork(otherNetId, sTun4.name());
4779 EXPECT_TRUE(mNetd->networkAddRoute(otherNetId, sTun4.name(), testV6 ? "::/0" : "0.0.0.0/0", "")
4780 .isOk());
4781 // Add per-app uid ranges.
4782 EXPECT_TRUE(mNetd->networkAddUidRanges(appDefaultNetId, appDefaultUidRanges).isOk());
4783
4784 // Add VPN uid ranges.
4785 EXPECT_TRUE(mNetd->networkAddUidRanges(vpnNetId, vpnUidRanges).isOk());
4786 }
4787
4788 // Rules are in approximately the following order for bypassable VPNs that allow local network
4789 // access:
4790 // - Local routes to the per-app default network (UID guarded)
4791 // - Local routes to the system default network
4792 // - Both local and global routs to VPN network (UID guarded)
4793 // - Global routes to per-app default network(UID guarded)
4794 // - Global routes to system default network
TEST_P(VpnLocalRoutesParameterizedTest,localRoutesExclusion)4795 TEST_P(VpnLocalRoutesParameterizedTest, localRoutesExclusion) {
4796 int selectedNetId;
4797 int sendToAddr;
4798 bool isSubjectToVpn;
4799 bool hasAppDefaultNetwork;
4800 bool testV6;
4801 bool differentLocalRoutes;
4802
4803 std::tie(selectedNetId, sendToAddr, isSubjectToVpn, hasAppDefaultNetwork, testV6,
4804 differentLocalRoutes) = GetParam();
4805
4806 setupNetworkRoutesForVpnAndDefaultNetworks(
4807 SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID, VPN_NETID, TEST_NETID4, false /* secure */,
4808 testV6, differentLocalRoutes,
4809 // Setup uid ranges for app default and VPN. Configure TEST_UID2 into both app default
4810 // and VPN to verify the behavior when the uid exists in both network.
4811 {makeUidRangeParcel(TEST_UID2, TEST_UID1)}, {makeUidRangeParcel(TEST_UID3, TEST_UID2)});
4812
4813 int fallthroughFd = sTun.getFdForTesting();
4814 int appDefaultFd = sTun2.getFdForTesting();
4815 int vpnFd = sTun3.getFdForTesting();
4816
4817 // Explicitly select network
4818 setNetworkForProcess(selectedNetId);
4819
4820 int targetUid;
4821
4822 // Setup the expected testing uid
4823 if (isSubjectToVpn) {
4824 if (hasAppDefaultNetwork) {
4825 targetUid = TEST_UID2;
4826 } else {
4827 targetUid = TEST_UID3;
4828 }
4829 } else {
4830 if (hasAppDefaultNetwork) {
4831 targetUid = TEST_UID1;
4832 } else {
4833 targetUid = TEST_UID4; // Not in any of the UID ranges.
4834 }
4835 }
4836
4837 // Get expected interface for the traffic.
4838 int expectedIface = getTargetIfaceForLocalRoutesExclusion(
4839 isSubjectToVpn, hasAppDefaultNetwork, differentLocalRoutes, sendToAddr, selectedNetId,
4840 fallthroughFd, appDefaultFd, vpnFd);
4841
4842 // Verify the packets are sent to the expected interface.
4843 Fwmark fwmark;
4844 if (testV6) {
4845 in6_addr addr;
4846 switch (sendToAddr) {
4847 case SEND_TO_GLOBAL:
4848 addr = V6_GLOBAL_ADDR;
4849 break;
4850 case SEND_TO_SYSTEM_DEFAULT_LOCAL:
4851 addr = V6_LOCAL_ADDR;
4852 break;
4853 case SEND_TO_PER_APP_DEFAULT_LOCAL:
4854 addr = differentLocalRoutes ? V6_APP_LOCAL_ADDR : V6_LOCAL_ADDR;
4855 break;
4856 default:
4857 break;
4858 // should not happen
4859 }
4860 EXPECT_TRUE(sendIPv6PacketFromUid(targetUid, addr, &fwmark, expectedIface));
4861 } else {
4862 in_addr addr;
4863 switch (sendToAddr) {
4864 case SEND_TO_GLOBAL:
4865 addr = V4_GLOBAL_ADDR;
4866 break;
4867 case SEND_TO_SYSTEM_DEFAULT_LOCAL:
4868 addr = V4_LOCAL_ADDR;
4869 break;
4870 case SEND_TO_PER_APP_DEFAULT_LOCAL:
4871 addr = differentLocalRoutes ? V4_APP_LOCAL_ADDR : V4_LOCAL_ADDR;
4872 break;
4873 default:
4874 break;
4875 // should not happen
4876 }
4877
4878 EXPECT_TRUE(sendIPv4PacketFromUid(targetUid, addr, &fwmark, expectedIface));
4879 }
4880 }
4881
TEST_F(NetdBinderTest,NetworkCreate)4882 TEST_F(NetdBinderTest, NetworkCreate) {
4883 auto config = makeNativeNetworkConfig(TEST_NETID1, NativeNetworkType::PHYSICAL,
4884 INetd::PERMISSION_NONE, false, false);
4885 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4886 EXPECT_TRUE(mNetd->networkDestroy(config.netId).isOk());
4887
4888 config.networkType = NativeNetworkType::VIRTUAL;
4889 config.secure = true;
4890 config.vpnType = NativeVpnType::OEM;
4891 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4892
4893 // invalid network type
4894 auto wrongConfig = makeNativeNetworkConfig(TEST_NETID2, static_cast<NativeNetworkType>(-1),
4895 INetd::PERMISSION_NONE, false, false);
4896 EXPECT_EQ(EINVAL, mNetd->networkCreate(wrongConfig).serviceSpecificErrorCode());
4897
4898 // invalid VPN type
4899 wrongConfig.networkType = NativeNetworkType::VIRTUAL;
4900 wrongConfig.vpnType = static_cast<NativeVpnType>(-1);
4901 EXPECT_EQ(EINVAL, mNetd->networkCreate(wrongConfig).serviceSpecificErrorCode());
4902 }
4903
4904 // Verifies valid and invalid inputs on networkAddUidRangesParcel method.
TEST_F(NetdBinderTest,UidRangeSubPriority_ValidateInputs)4905 TEST_F(NetdBinderTest, UidRangeSubPriority_ValidateInputs) {
4906 createVpnAndOtherPhysicalNetwork(SYSTEM_DEFAULT_NETID, APP_DEFAULT_NETID, VPN_NETID,
4907 /*isSecureVPN=*/true);
4908 // Invalid priority -10 on a physical network.
4909 NativeUidRangeConfig uidRangeConfig =
4910 makeNativeUidRangeConfig(APP_DEFAULT_NETID, {makeUidRangeParcel(BASE_UID, BASE_UID)},
4911 UidRanges::SUB_PRIORITY_HIGHEST - 10);
4912 binder::Status status = mNetd->networkAddUidRangesParcel(uidRangeConfig);
4913 EXPECT_FALSE(status.isOk());
4914 EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode());
4915
4916 // Invalid priority 1000 on a physical network.
4917 uidRangeConfig.subPriority = UidRanges::SUB_PRIORITY_NO_DEFAULT + 1;
4918 status = mNetd->networkAddUidRangesParcel(uidRangeConfig);
4919 EXPECT_FALSE(status.isOk());
4920 EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode());
4921
4922 // Virtual networks support only default priority.
4923 uidRangeConfig.netId = VPN_NETID;
4924 uidRangeConfig.subPriority = SUB_PRIORITY_1;
4925 status = mNetd->networkAddUidRangesParcel(uidRangeConfig);
4926 EXPECT_FALSE(status.isOk());
4927 EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode());
4928
4929 // For a single network, identical UID ranges with different priorities are allowed.
4930 uidRangeConfig.netId = APP_DEFAULT_NETID;
4931 uidRangeConfig.subPriority = SUB_PRIORITY_1;
4932 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig).isOk());
4933 uidRangeConfig.subPriority = SUB_PRIORITY_2;
4934 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig).isOk());
4935
4936 // Overlapping ranges is invalid.
4937 uidRangeConfig.uidRanges = {makeUidRangeParcel(BASE_UID + 1, BASE_UID + 1),
4938 makeUidRangeParcel(BASE_UID + 1, BASE_UID + 1)};
4939 status = mNetd->networkAddUidRangesParcel(uidRangeConfig);
4940 EXPECT_FALSE(status.isOk());
4941 EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode());
4942 }
4943
4944 // Examines whether IP rules for app default network with subsidiary priorities are correctly added
4945 // and removed.
TEST_F(NetdBinderTest,UidRangeSubPriority_VerifyPhysicalNwIpRules)4946 TEST_F(NetdBinderTest, UidRangeSubPriority_VerifyPhysicalNwIpRules) {
4947 createPhysicalNetwork(TEST_NETID1, sTun.name());
4948 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk());
4949 createPhysicalNetwork(TEST_NETID2, sTun2.name());
4950 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID2, sTun2.name(), "::/0", "").isOk());
4951
4952 // Adds priority 1 setting
4953 NativeUidRangeConfig uidRangeConfig1 = makeNativeUidRangeConfig(
4954 TEST_NETID1, {makeUidRangeParcel(BASE_UID, BASE_UID)}, SUB_PRIORITY_1);
4955 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig1).isOk());
4956 verifyAppUidRules({true}, uidRangeConfig1, sTun.name());
4957 // Adds priority 2 setting
4958 NativeUidRangeConfig uidRangeConfig2 = makeNativeUidRangeConfig(
4959 TEST_NETID2, {makeUidRangeParcel(BASE_UID + 1, BASE_UID + 1)}, SUB_PRIORITY_2);
4960 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig2).isOk());
4961 verifyAppUidRules({true}, uidRangeConfig2, sTun2.name());
4962 // Adds another priority 2 setting
4963 NativeUidRangeConfig uidRangeConfig3 = makeNativeUidRangeConfig(
4964 INetd::UNREACHABLE_NET_ID, {makeUidRangeParcel(BASE_UID + 2, BASE_UID + 2)},
4965 SUB_PRIORITY_2);
4966 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig3).isOk());
4967 verifyAppUidRules({true}, uidRangeConfig3, "");
4968
4969 // Removes.
4970 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(uidRangeConfig1).isOk());
4971 verifyAppUidRules({false}, uidRangeConfig1, sTun.name());
4972 verifyAppUidRules({true}, uidRangeConfig2, sTun2.name());
4973 verifyAppUidRules({true}, uidRangeConfig3, "");
4974 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(uidRangeConfig2).isOk());
4975 verifyAppUidRules({false}, uidRangeConfig1, sTun.name());
4976 verifyAppUidRules({false}, uidRangeConfig2, sTun2.name());
4977 verifyAppUidRules({true}, uidRangeConfig3, "");
4978 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(uidRangeConfig3).isOk());
4979 verifyAppUidRules({false}, uidRangeConfig1, sTun.name());
4980 verifyAppUidRules({false}, uidRangeConfig2, sTun2.name());
4981 verifyAppUidRules({false}, uidRangeConfig3, "");
4982 }
4983
4984 // Verify uid range rules on virtual network.
TEST_P(VpnParameterizedTest,UidRangeSubPriority_VerifyVpnIpRules)4985 TEST_P(VpnParameterizedTest, UidRangeSubPriority_VerifyVpnIpRules) {
4986 const bool isSecureVPN = GetParam();
4987 constexpr int VPN_NETID2 = TEST_NETID2;
4988
4989 // Create 2 VPNs, using sTun and sTun2.
4990 auto config = makeNativeNetworkConfig(VPN_NETID, NativeNetworkType::VIRTUAL,
4991 INetd::PERMISSION_NONE, isSecureVPN, false);
4992 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4993 EXPECT_TRUE(mNetd->networkAddInterface(VPN_NETID, sTun.name()).isOk());
4994
4995 config = makeNativeNetworkConfig(VPN_NETID2, NativeNetworkType::VIRTUAL, INetd::PERMISSION_NONE,
4996 isSecureVPN, false);
4997 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
4998 EXPECT_TRUE(mNetd->networkAddInterface(VPN_NETID2, sTun2.name()).isOk());
4999
5000 // Assign uid ranges to different VPNs. Check if rules match.
5001 NativeUidRangeConfig uidRangeConfig1 = makeNativeUidRangeConfig(
5002 VPN_NETID, {makeUidRangeParcel(BASE_UID, BASE_UID)}, UidRanges::SUB_PRIORITY_HIGHEST);
5003 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig1).isOk());
5004 verifyVpnUidRules({true}, uidRangeConfig1, sTun.name(), isSecureVPN, false);
5005
5006 NativeUidRangeConfig uidRangeConfig2 =
5007 makeNativeUidRangeConfig(VPN_NETID2, {makeUidRangeParcel(BASE_UID + 1, BASE_UID + 1)},
5008 UidRanges::SUB_PRIORITY_HIGHEST);
5009 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig2).isOk());
5010 verifyVpnUidRules({true}, uidRangeConfig2, sTun2.name(), isSecureVPN, false);
5011
5012 // Remove uid configs one-by-one. Check if rules match.
5013 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(uidRangeConfig1).isOk());
5014 verifyVpnUidRules({false}, uidRangeConfig1, sTun.name(), isSecureVPN, false);
5015 verifyVpnUidRules({true}, uidRangeConfig2, sTun2.name(), isSecureVPN, false);
5016 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(uidRangeConfig2).isOk());
5017 verifyVpnUidRules({false}, uidRangeConfig1, sTun.name(), isSecureVPN, false);
5018 verifyVpnUidRules({false}, uidRangeConfig2, sTun2.name(), isSecureVPN, false);
5019 }
5020
5021 // Verify VPN ip rule on bypassable/secureVPN virtual network with local routes excluded
TEST_P(VpnParameterizedTest,VerifyVpnIpRules_excludeLocalRoutes)5022 TEST_P(VpnParameterizedTest, VerifyVpnIpRules_excludeLocalRoutes) {
5023 const bool isSecureVPN = GetParam();
5024 // Create VPN with local route excluded
5025 auto config = makeNativeNetworkConfig(VPN_NETID, NativeNetworkType::VIRTUAL,
5026 INetd::PERMISSION_NONE, isSecureVPN, true);
5027 EXPECT_TRUE(mNetd->networkCreate(config).isOk());
5028 EXPECT_TRUE(mNetd->networkAddInterface(VPN_NETID, sTun.name()).isOk());
5029
5030 // Assign uid ranges to VPN. Check if rules match.
5031 NativeUidRangeConfig uidRangeConfig1 = makeNativeUidRangeConfig(
5032 VPN_NETID, {makeUidRangeParcel(BASE_UID, BASE_UID)}, UidRanges::SUB_PRIORITY_HIGHEST);
5033 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig1).isOk());
5034 verifyVpnUidRules({true}, uidRangeConfig1, sTun.name(), isSecureVPN, true);
5035
5036 // Remove uid configs. Check if rules match.
5037 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(uidRangeConfig1).isOk());
5038 verifyVpnUidRules({false}, uidRangeConfig1, sTun.name(), isSecureVPN, true);
5039 }
5040
5041 // Verify if packets go through the right network when subsidiary priority and VPN works together.
5042 //
5043 // Test config:
5044 // +----------+------------------------+-------------------------------------------+
5045 // | Priority | UID | Assigned Network |
5046 // +----------+------------------------+-------------------------------------------+
5047 // | 0 | TEST_UID1 | VPN bypassable (VPN_NETID) |
5048 // +----------+------------------------+-------------------------------------------+
5049 // | 1 | TEST_UID1, TEST_UID2, | Physical Network 1 (APP_DEFAULT_1_NETID) |
5050 // | 1 | TEST_UID3 | Physical Network 2 (APP_DEFAULT_2_NETID) |
5051 // | 1 | TEST_UID5 | Unreachable Network (UNREACHABLE_NET_ID) |
5052 // +----------+------------------------+-------------------------------------------+
5053 // | 2 | TEST_UID3 | Physical Network 1 (APP_DEFAULT_1_NETID) |
5054 // | 2 | TEST_UID4, TEST_UID5 | Physical Network 2 (APP_DEFAULT_2_NETID) |
5055 // +----------+------------------------+-------------------------------------------+
5056 //
5057 // Expected results:
5058 // +-----------+------------------------+
5059 // | UID | Using Network |
5060 // +-----------+------------------------+
5061 // | TEST_UID1 | VPN |
5062 // | TEST_UID2 | Physical Network 1 |
5063 // | TEST_UID3 | Physical Network 2 |
5064 // | TEST_UID4 | Physical Network 2 |
5065 // | TEST_UID5 | Unreachable Network |
5066 // | TEST_UID6 | System Default Network |
5067 // +-----------+------------------------+
5068 //
5069 // SYSTEM_DEFAULT_NETID uses sTun.
5070 // APP_DEFAULT_1_NETID uses sTun2.
5071 // VPN_NETID uses sTun3.
5072 // APP_DEFAULT_2_NETID uses sTun4.
5073 //
TEST_F(NetdBinderTest,UidRangeSubPriority_ImplicitlySelectNetwork)5074 TEST_F(NetdBinderTest, UidRangeSubPriority_ImplicitlySelectNetwork) {
5075 constexpr int APP_DEFAULT_1_NETID = TEST_NETID2;
5076 constexpr int APP_DEFAULT_2_NETID = TEST_NETID4;
5077
5078 static const struct TestData {
5079 uint32_t subPriority;
5080 std::vector<UidRangeParcel> uidRanges;
5081 unsigned int netId;
5082 } kTestData[] = {
5083 {UidRanges::SUB_PRIORITY_HIGHEST, {makeUidRangeParcel(TEST_UID1)}, VPN_NETID},
5084 {SUB_PRIORITY_1,
5085 {makeUidRangeParcel(TEST_UID1), makeUidRangeParcel(TEST_UID2)},
5086 APP_DEFAULT_1_NETID},
5087 {SUB_PRIORITY_1, {makeUidRangeParcel(TEST_UID3)}, APP_DEFAULT_2_NETID},
5088 {SUB_PRIORITY_1, {makeUidRangeParcel(TEST_UID5)}, INetd::UNREACHABLE_NET_ID},
5089 {SUB_PRIORITY_2, {makeUidRangeParcel(TEST_UID3)}, APP_DEFAULT_1_NETID},
5090 {SUB_PRIORITY_2,
5091 {makeUidRangeParcel(TEST_UID4), makeUidRangeParcel(TEST_UID5)},
5092 APP_DEFAULT_2_NETID},
5093 };
5094
5095 // Creates 4 networks.
5096 createVpnAndOtherPhysicalNetwork(SYSTEM_DEFAULT_NETID, APP_DEFAULT_1_NETID, VPN_NETID,
5097 /*isSecureVPN=*/false);
5098 createPhysicalNetwork(APP_DEFAULT_2_NETID, sTun4.name());
5099 EXPECT_TRUE(mNetd->networkAddRoute(APP_DEFAULT_2_NETID, sTun4.name(), "::/0", "").isOk());
5100
5101 for (const auto& td : kTestData) {
5102 NativeUidRangeConfig uidRangeConfig =
5103 makeNativeUidRangeConfig(td.netId, td.uidRanges, td.subPriority);
5104 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(uidRangeConfig).isOk());
5105 }
5106
5107 int systemDefaultFd = sTun.getFdForTesting();
5108 int appDefault_1_Fd = sTun2.getFdForTesting();
5109 int vpnFd = sTun3.getFdForTesting();
5110 int appDefault_2_Fd = sTun4.getFdForTesting();
5111 // Verify routings.
5112 expectPacketSentOnNetId(TEST_UID1, VPN_NETID, vpnFd, IMPLICITLY_SELECT);
5113 expectPacketSentOnNetId(TEST_UID2, APP_DEFAULT_1_NETID, appDefault_1_Fd, IMPLICITLY_SELECT);
5114 expectPacketSentOnNetId(TEST_UID3, APP_DEFAULT_2_NETID, appDefault_2_Fd, IMPLICITLY_SELECT);
5115 expectPacketSentOnNetId(TEST_UID4, APP_DEFAULT_2_NETID, appDefault_2_Fd, IMPLICITLY_SELECT);
5116 expectUnreachableError(TEST_UID5, INetd::UNREACHABLE_NET_ID, IMPLICITLY_SELECT);
5117 expectPacketSentOnNetId(TEST_UID6, SYSTEM_DEFAULT_NETID, systemDefaultFd, IMPLICITLY_SELECT);
5118
5119 // Remove test rules from the unreachable network.
5120 for (const auto& td : kTestData) {
5121 if (td.netId == INetd::UNREACHABLE_NET_ID) {
5122 NativeUidRangeConfig uidRangeConfig =
5123 makeNativeUidRangeConfig(td.netId, td.uidRanges, td.subPriority);
5124 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(uidRangeConfig).isOk());
5125 }
5126 }
5127 }
5128
5129 class PerAppNetworkPermissionsTest : public NetdBinderTest {
5130 public:
bindSocketToNetwork(int sock,int netId,bool explicitlySelected)5131 int bindSocketToNetwork(int sock, int netId, bool explicitlySelected) {
5132 ScopedUidChange uidChange(AID_ROOT);
5133 Fwmark fwmark;
5134 fwmark.explicitlySelected = explicitlySelected;
5135 fwmark.netId = netId;
5136 return setsockopt(sock, SOL_SOCKET, SO_MARK, &(fwmark.intValue), sizeof(fwmark.intValue));
5137 }
5138
changeNetworkPermissionForUid(int netId,int uid,bool add)5139 void changeNetworkPermissionForUid(int netId, int uid, bool add) {
5140 auto nativeUidRangeConfig = makeNativeUidRangeConfig(netId, {makeUidRangeParcel(uid, uid)},
5141 UidRanges::SUB_PRIORITY_NO_DEFAULT);
5142 ScopedUidChange rootUid(AID_ROOT);
5143 if (add) {
5144 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(nativeUidRangeConfig).isOk());
5145 } else {
5146 EXPECT_TRUE(mNetd->networkRemoveUidRangesParcel(nativeUidRangeConfig).isOk());
5147 }
5148 }
5149
5150 protected:
5151 static inline const sockaddr_in6 TEST_SOCKADDR_IN6 = {
5152 .sin6_family = AF_INET6,
5153 .sin6_port = 42,
5154 .sin6_addr = V6_ADDR,
5155 };
5156 std::array<char, 4096> mTestBuf;
5157 };
5158
TEST_F(PerAppNetworkPermissionsTest,HasExplicitAccess)5159 TEST_F(PerAppNetworkPermissionsTest, HasExplicitAccess) {
5160 // TEST_NETID1 -> restricted network
5161 createPhysicalNetwork(TEST_NETID1, sTun.name(), INetd::PERMISSION_SYSTEM);
5162 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk());
5163
5164 // Change uid to uid without PERMISSION_SYSTEM
5165 ScopedUidChange testUid(TEST_UID1);
5166 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5167 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID1, true /*explicitlySelected*/), 0);
5168
5169 // Test without permissions should fail
5170 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5171
5172 // Test access with permission succeeds and packet is routed correctly
5173 changeNetworkPermissionForUid(TEST_NETID1, TEST_UID1, true /*add*/);
5174 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), 0);
5175 EXPECT_EQ(send(sock, "foo", sizeof("foo"), 0), (int)sizeof("foo"));
5176 EXPECT_GT(read(sTun.getFdForTesting(), mTestBuf.data(), mTestBuf.size()), 0);
5177
5178 // Test removing permissions.
5179 // Note: Send will still succeed as the destination is cached in
5180 // sock.sk_dest_cache. Try another connect instead.
5181 changeNetworkPermissionForUid(TEST_NETID1, TEST_UID1, false /*add*/);
5182 EXPECT_EQ(-1, connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)));
5183 }
5184
TEST_F(PerAppNetworkPermissionsTest,HasImplicitAccess)5185 TEST_F(PerAppNetworkPermissionsTest, HasImplicitAccess) {
5186 // TEST_NETID1 -> restricted network
5187 createPhysicalNetwork(TEST_NETID1, sTun.name(), INetd::PERMISSION_SYSTEM);
5188 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk());
5189
5190 // Change uid to uid without PERMISSION_SYSTEM
5191 ScopedUidChange testUid(TEST_UID1);
5192 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5193 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID1, false /*explicitlySelected*/), 0);
5194
5195 // Note: we cannot call connect() when implicitly selecting the network as
5196 // the fwmark would get reset to the default network.
5197 // Call connect which should bind socket to default network
5198 EXPECT_EQ(sendto(sock, "foo", sizeof("foo"), 0, (sockaddr*)&TEST_SOCKADDR_IN6,
5199 sizeof(TEST_SOCKADDR_IN6)),
5200 -1);
5201
5202 // Test access with permission succeeds and packet is routed correctly
5203 changeNetworkPermissionForUid(TEST_NETID1, TEST_UID1, true /*add*/);
5204 EXPECT_EQ(sendto(sock, "foo", sizeof("foo"), 0, (sockaddr*)&TEST_SOCKADDR_IN6,
5205 sizeof(TEST_SOCKADDR_IN6)),
5206 (int)sizeof("foo"));
5207 EXPECT_GT(read(sTun.getFdForTesting(), mTestBuf.data(), mTestBuf.size()), 0);
5208 }
5209
TEST_F(PerAppNetworkPermissionsTest,DoesNotAffectDefaultNetworkSelection)5210 TEST_F(PerAppNetworkPermissionsTest, DoesNotAffectDefaultNetworkSelection) {
5211 // TEST_NETID1 -> default network
5212 // TEST_NETID2 -> restricted network
5213 createPhysicalNetwork(TEST_NETID1, sTun.name(), INetd::PERMISSION_NONE);
5214 createPhysicalNetwork(TEST_NETID2, sTun2.name(), INetd::PERMISSION_SYSTEM);
5215 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk());
5216 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID2, sTun2.name(), "::/0", "").isOk());
5217 mNetd->networkSetDefault(TEST_NETID1);
5218
5219 changeNetworkPermissionForUid(TEST_NETID2, TEST_UID1, true /*add*/);
5220
5221 // Change uid to uid without PERMISSION_SYSTEM
5222 ScopedUidChange testUid(TEST_UID1);
5223 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5224
5225 // Connect should select default network
5226 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), 0);
5227 EXPECT_EQ(send(sock, "foo", sizeof("foo"), 0), (int)sizeof("foo"));
5228 EXPECT_GT(read(sTun.getFdForTesting(), mTestBuf.data(), mTestBuf.size()), 0);
5229 }
5230
TEST_F(PerAppNetworkPermissionsTest,PermissionDoesNotAffectPerAppDefaultNetworkSelection)5231 TEST_F(PerAppNetworkPermissionsTest, PermissionDoesNotAffectPerAppDefaultNetworkSelection) {
5232 // TEST_NETID1 -> restricted app default network
5233 // TEST_NETID2 -> restricted network
5234 createPhysicalNetwork(TEST_NETID1, sTun.name(), INetd::PERMISSION_SYSTEM);
5235 createPhysicalNetwork(TEST_NETID2, sTun2.name(), INetd::PERMISSION_SYSTEM);
5236 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk());
5237 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID2, sTun2.name(), "::/0", "").isOk());
5238
5239 auto nativeUidRangeConfig = makeNativeUidRangeConfig(
5240 TEST_NETID1, {makeUidRangeParcel(TEST_UID1, TEST_UID1)}, 0 /*subPriority*/);
5241 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(nativeUidRangeConfig).isOk());
5242 changeNetworkPermissionForUid(TEST_NETID2, TEST_UID1, true /*add*/);
5243
5244 // Change uid to uid without PERMISSION_SYSTEM
5245 ScopedUidChange testUid(TEST_UID1);
5246 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5247
5248 // Connect should select app default network
5249 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), 0);
5250 EXPECT_EQ(send(sock, "foo", sizeof("foo"), 0), (int)sizeof("foo"));
5251 EXPECT_GT(read(sTun.getFdForTesting(), mTestBuf.data(), mTestBuf.size()), 0);
5252 }
5253
TEST_F(PerAppNetworkPermissionsTest,PermissionOnlyAffectsUid)5254 TEST_F(PerAppNetworkPermissionsTest, PermissionOnlyAffectsUid) {
5255 // TEST_NETID1 -> restricted network
5256 // TEST_NETID2 -> restricted network
5257 createPhysicalNetwork(TEST_NETID1, sTun.name(), INetd::PERMISSION_SYSTEM);
5258 createPhysicalNetwork(TEST_NETID2, sTun2.name(), INetd::PERMISSION_SYSTEM);
5259 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk());
5260 EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID2, sTun2.name(), "::/0", "").isOk());
5261
5262 // test that neither TEST_UID1, nor TEST_UID2 have access without permission
5263 {
5264 // TEST_UID1
5265 ScopedUidChange testUid(TEST_UID1);
5266 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5267 // TEST_NETID1
5268 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID1, true /*explicitlySelected*/), 0);
5269 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5270 // TEST_NETID2
5271 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID2, true /*explicitlySelected*/), 0);
5272 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5273 }
5274 {
5275 // TEST_UID2
5276 ScopedUidChange testUid(TEST_UID2);
5277 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5278 // TEST_NETID1
5279 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID1, true /*explicitlySelected*/), 0);
5280 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5281 // TEST_NETID2
5282 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID2, true /*explicitlySelected*/), 0);
5283 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5284 }
5285
5286 changeNetworkPermissionForUid(TEST_NETID1, TEST_UID1, true);
5287
5288 // test that TEST_UID1 has access to TEST_UID1
5289 {
5290 // TEST_UID1
5291 ScopedUidChange testUid(TEST_UID1);
5292 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5293 // TEST_NETID1
5294 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID1, true /*explicitlySelected*/), 0);
5295 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), 0);
5296 // TEST_NETID2
5297 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID2, true /*explicitlySelected*/), 0);
5298 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5299 }
5300 {
5301 // TEST_UID2
5302 ScopedUidChange testUid(TEST_UID2);
5303 unique_fd sock(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
5304 // TEST_NETID1
5305 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID1, true /*explicitlySelected*/), 0);
5306 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5307 // TEST_NETID2
5308 EXPECT_EQ(bindSocketToNetwork(sock, TEST_NETID2, true /*explicitlySelected*/), 0);
5309 EXPECT_EQ(connect(sock, (sockaddr*)&TEST_SOCKADDR_IN6, sizeof(TEST_SOCKADDR_IN6)), -1);
5310 }
5311 }
5312
5313 class MDnsBinderTest : public NetNativeTestBase {
5314 public:
5315 class TestMDnsListener : public android::net::mdns::aidl::BnMDnsEventListener {
5316 public:
onServiceRegistrationStatus(const RegistrationInfo &)5317 Status onServiceRegistrationStatus(const RegistrationInfo& /*status*/) override {
5318 // no-op
5319 return Status::ok();
5320 }
onServiceDiscoveryStatus(const DiscoveryInfo &)5321 Status onServiceDiscoveryStatus(const DiscoveryInfo& /*status*/) override {
5322 // no-op
5323 return Status::ok();
5324 }
onServiceResolutionStatus(const ResolutionInfo &)5325 Status onServiceResolutionStatus(const ResolutionInfo& /*status*/) override {
5326 // no-op
5327 return Status::ok();
5328 }
onGettingServiceAddressStatus(const GetAddressInfo & status)5329 Status onGettingServiceAddressStatus(const GetAddressInfo& status) override {
5330 if (status.id == mOperationId) {
5331 std::lock_guard lock(mCvMutex);
5332 mCv.notify_one();
5333 }
5334 return Status::ok();
5335 }
getCv()5336 std::condition_variable& getCv() { return mCv; }
getCvMutex()5337 std::mutex& getCvMutex() { return mCvMutex; }
setOperationId(int operationId)5338 void setOperationId(int operationId) { mOperationId = operationId; }
5339
5340 private:
5341 std::mutex mCvMutex;
5342 std::condition_variable mCv;
5343 int mOperationId;
5344 };
5345
MDnsBinderTest()5346 MDnsBinderTest() {
5347 sp<IServiceManager> sm = android::defaultServiceManager();
5348 sp<IBinder> binder = sm->getService(String16("mdns"));
5349 if (binder != nullptr) {
5350 mMDns = android::interface_cast<IMDns>(binder);
5351 }
5352 }
5353
SetUp()5354 void SetUp() override {
5355 ASSERT_NE(nullptr, mMDns.get());
5356 // Start the daemon for mdns operations.
5357 mDaemonStarted = mMDns->startDaemon().isOk();
5358 }
5359
TearDown()5360 void TearDown() override {
5361 if (mDaemonStarted) mMDns->stopDaemon();
5362 }
5363
5364 std::cv_status getServiceAddress(int operationId, const sp<TestMDnsListener>& listener);
5365
5366 protected:
5367 sp<IMDns> mMDns;
5368
5369 private:
5370 bool mDaemonStarted = false;
5371 };
5372
getServiceAddress(int operationId,const sp<TestMDnsListener> & listener)5373 std::cv_status MDnsBinderTest::getServiceAddress(int operationId,
5374 const sp<TestMDnsListener>& listener) {
5375 GetAddressInfo info;
5376 info.id = operationId;
5377 info.hostname = "Android.local";
5378 info.interfaceIdx = 0;
5379 binder::Status status = mMDns->getServiceAddress(info);
5380 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
5381
5382 auto& cv = listener->getCv();
5383 auto& cvMutex = listener->getCvMutex();
5384 std::unique_lock lock(cvMutex);
5385 // Wait for a long time to prevent test flaky.
5386 return cv.wait_for(lock, std::chrono::milliseconds(2500));
5387 }
5388
TEST_F(MDnsBinderTest,EventListenerTest)5389 TEST_F(MDnsBinderTest, EventListenerTest) {
5390 SKIP_WITH_HWASAN; // TODO(b/253513842): Re-enable.
5391 // Start the Binder thread pool.
5392 android::ProcessState::self()->startThreadPool();
5393
5394 // Register a null listener.
5395 binder::Status status = mMDns->registerEventListener(nullptr);
5396 EXPECT_FALSE(status.isOk());
5397
5398 // Unregister a null listener.
5399 status = mMDns->unregisterEventListener(nullptr);
5400 EXPECT_FALSE(status.isOk());
5401
5402 // Register a test listener
5403 auto testListener = android::sp<TestMDnsListener>::make();
5404 status = mMDns->registerEventListener(testListener);
5405 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
5406
5407 // Register the duplicated listener
5408 status = mMDns->registerEventListener(testListener);
5409 EXPECT_FALSE(status.isOk());
5410
5411 // Verify the listener can receive callback.
5412 int id = arc4random_uniform(10000); // use random number
5413 testListener->setOperationId(id);
5414 EXPECT_EQ(std::cv_status::no_timeout, getServiceAddress(id, testListener));
5415 // Stop getting address operation to release the service reference on MDnsSd
5416 status = mMDns->stopOperation(id);
5417 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
5418
5419 // Unregister the test listener
5420 status = mMDns->unregisterEventListener(testListener);
5421 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
5422
5423 // Verify the listener can not receive callback.
5424 testListener->setOperationId(id + 1);
5425 EXPECT_EQ(std::cv_status::timeout, getServiceAddress(id + 1, testListener));
5426 // Stop getting address operation to release the service reference on MDnsSd
5427 status = mMDns->stopOperation(id + 1);
5428 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
5429
5430 // Registering and unregistering the listener again should work.
5431 status = mMDns->registerEventListener(testListener);
5432 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
5433 status = mMDns->unregisterEventListener(testListener);
5434 EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
5435 }
5436
5437 // Creates a system default network and 3 enterprise networks for two profiles. Check if network
5438 // selection in compliance with network allow list settings.
5439 //
5440 // +-----------+-----------------------+----------------------------------------+
5441 // | UID | UID's default network | UID can select networks |
5442 // +-----------+-----------------------+----------------------------------------+
5443 // | TEST_UID1 | ENTERPRISE_NETID_1 | ENTERPRISE_NETID_1, ENTERPRISE_NETID_2 |
5444 // | TEST_UID2 | ENTERPRISE_NETID_3 | ENTERPRISE_NETID_3 |
5445 // +-----------+-----------------------+----------------------------------------+
TEST_F(NetdBinderTest,PerProfileNetworkPermission)5446 TEST_F(NetdBinderTest, PerProfileNetworkPermission) {
5447 // creates 4 networks
5448 createDefaultAndOtherPhysicalNetwork(SYSTEM_DEFAULT_NETID, ENTERPRISE_NETID_1);
5449 createPhysicalNetwork(ENTERPRISE_NETID_2, sTun3.name());
5450 EXPECT_TRUE(mNetd->networkAddRoute(ENTERPRISE_NETID_2, sTun3.name(), "::/0", "").isOk());
5451 createPhysicalNetwork(ENTERPRISE_NETID_3, sTun4.name());
5452 EXPECT_TRUE(mNetd->networkAddRoute(ENTERPRISE_NETID_3, sTun4.name(), "::/0", "").isOk());
5453
5454 // profile#1
5455 // UidRanges::SUB_PRIORITY_HIGHEST + 20 = PREFERENCE_ORDER_PROFILE, which is defined in
5456 // ConnectivityService.java. The value here doesn't really matter because user allowed network
5457 // does not depends on specific sub-priority.
5458 NativeUidRangeConfig cfg1 =
5459 makeNativeUidRangeConfig(ENTERPRISE_NETID_1, {makeUidRangeParcel(TEST_UID1, TEST_UID1)},
5460 UidRanges::SUB_PRIORITY_HIGHEST + 20);
5461 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(cfg1).isOk());
5462
5463 // profile#2
5464 NativeUidRangeConfig cfg2 =
5465 makeNativeUidRangeConfig(ENTERPRISE_NETID_3, {makeUidRangeParcel(TEST_UID2, TEST_UID2)},
5466 UidRanges::SUB_PRIORITY_HIGHEST + 20);
5467 EXPECT_TRUE(mNetd->networkAddUidRangesParcel(cfg2).isOk());
5468
5469 // setNetworkAllowlist at once
5470 // all uids except for TEST_UID2
5471 NativeUidRangeConfig nw1UserConfig = makeNativeUidRangeConfig(
5472 ENTERPRISE_NETID_1,
5473 {makeUidRangeParcel(0, TEST_UID3), makeUidRangeParcel(TEST_UID1, TEST_UID1)},
5474 /*unused*/ 0);
5475 NativeUidRangeConfig nw2UserConfig = makeNativeUidRangeConfig(
5476 ENTERPRISE_NETID_2,
5477 {makeUidRangeParcel(0, TEST_UID3), makeUidRangeParcel(TEST_UID1, TEST_UID1)},
5478 /*unused*/ 0);
5479 // all uids except for TEST_UID1
5480 NativeUidRangeConfig nw3UserConfig = makeNativeUidRangeConfig(
5481 ENTERPRISE_NETID_3, {makeUidRangeParcel(0, TEST_UID2)}, /*unused*/ 0);
5482 // all uids except for TEST_UID1 and TEST_UID2
5483 NativeUidRangeConfig nwDefaultUserConfig = makeNativeUidRangeConfig(
5484 SYSTEM_DEFAULT_NETID, {makeUidRangeParcel(0, TEST_UID3)}, /*unused*/ 0);
5485 EXPECT_TRUE(mNetd->setNetworkAllowlist(
5486 {nw1UserConfig, nw2UserConfig, nw3UserConfig, nwDefaultUserConfig})
5487 .isOk());
5488
5489 { // Can set network for process on allowed networks.
5490 ScopedUidChange scopedUidChange(TEST_UID1);
5491 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_1));
5492 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_2));
5493 // Can not set network for process on not allowed networks.
5494 EXPECT_EQ(-EACCES, setNetworkForProcess(SYSTEM_DEFAULT_NETID));
5495 EXPECT_EQ(-EACCES, setNetworkForProcess(ENTERPRISE_NETID_3));
5496 }
5497 { // Can set network for process on allowed networks.
5498 ScopedUidChange scopedUidChange(TEST_UID2);
5499 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_3));
5500 // Can not set network for process on not allowed networks.
5501 EXPECT_EQ(-EACCES, setNetworkForProcess(SYSTEM_DEFAULT_NETID));
5502 EXPECT_EQ(-EACCES, setNetworkForProcess(ENTERPRISE_NETID_1));
5503 EXPECT_EQ(-EACCES, setNetworkForProcess(ENTERPRISE_NETID_2));
5504 }
5505 { // Root can use whatever network it wants.
5506 ScopedUidChange scopedUidChange(AID_ROOT);
5507 EXPECT_EQ(0, setNetworkForProcess(SYSTEM_DEFAULT_NETID));
5508 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_1));
5509 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_2));
5510 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_3));
5511 }
5512
5513 // Update setting: remove ENTERPRISE_NETID_2 from profile#1's allowed network list and add it to
5514 // profile#2's allowed network list.
5515 // +-----------+-----------------------+----------------------------------------+
5516 // | UID | UID's default network | UID can select networks |
5517 // +-----------+-----------------------+----------------------------------------+
5518 // | TEST_UID1 | ENTERPRISE_NETID_1 | ENTERPRISE_NETID_1 |
5519 // | TEST_UID2 | ENTERPRISE_NETID_3 | ENTERPRISE_NETID_2, ENTERPRISE_NETID_3 |
5520 // +-----------+-----------------------+----------------------------------------+
5521
5522 // all uids except for TEST_UID2
5523 nw1UserConfig = makeNativeUidRangeConfig(
5524 ENTERPRISE_NETID_1,
5525 {makeUidRangeParcel(0, TEST_UID3), makeUidRangeParcel(TEST_UID1, TEST_UID1)},
5526 /*unused*/ 0);
5527 // all uids except for TEST_UID1
5528 nw2UserConfig = makeNativeUidRangeConfig(ENTERPRISE_NETID_2, {makeUidRangeParcel(0, TEST_UID2)},
5529 /*unused*/ 0);
5530 nw3UserConfig = makeNativeUidRangeConfig(ENTERPRISE_NETID_3, {makeUidRangeParcel(0, TEST_UID2)},
5531 /*unused*/ 0);
5532 // all uids except for TEST_UID1 and TEST_UID2
5533 nwDefaultUserConfig = makeNativeUidRangeConfig(
5534 SYSTEM_DEFAULT_NETID, {makeUidRangeParcel(0, TEST_UID3)}, /*unused*/ 0);
5535 EXPECT_TRUE(mNetd->setNetworkAllowlist(
5536 {nw1UserConfig, nw2UserConfig, nw3UserConfig, nwDefaultUserConfig})
5537 .isOk());
5538
5539 {
5540 ScopedUidChange scopedUidChange(TEST_UID1);
5541 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_1));
5542 EXPECT_EQ(-EACCES, setNetworkForProcess(SYSTEM_DEFAULT_NETID));
5543 EXPECT_EQ(-EACCES, setNetworkForProcess(ENTERPRISE_NETID_2));
5544 EXPECT_EQ(-EACCES, setNetworkForProcess(ENTERPRISE_NETID_3));
5545 }
5546 {
5547 ScopedUidChange scopedUidChange(TEST_UID2);
5548 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_2));
5549 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_3));
5550 EXPECT_EQ(-EACCES, setNetworkForProcess(SYSTEM_DEFAULT_NETID));
5551 EXPECT_EQ(-EACCES, setNetworkForProcess(ENTERPRISE_NETID_1));
5552 }
5553
5554 // UID not restricted by allowed list can select all networks.
5555 {
5556 ScopedUidChange scopedUidChange(TEST_UID3);
5557 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_1));
5558 EXPECT_EQ(0, setNetworkForProcess(SYSTEM_DEFAULT_NETID));
5559 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_2));
5560 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_3));
5561 }
5562
5563 // Update setting: remove ENTERPRISE_NETID_1 from profile#1's allowed network list
5564 // +-----------+-----------------------+----------------------------------------+
5565 // | UID | UID's default network | UID can select networks |
5566 // +-----------+-----------------------+----------------------------------------+
5567 // | TEST_UID2 | ENTERPRISE_NETID_3 | ENTERPRISE_NETID_2, ENTERPRISE_NETID_3 |
5568 // +-----------+-----------------------+----------------------------------------+
5569 EXPECT_TRUE(
5570 mNetd->setNetworkAllowlist({nw2UserConfig, nw3UserConfig, nwDefaultUserConfig}).isOk());
5571
5572 // All UIDs should be able to use ENTERPRISE_NETID_1.
5573 for (const int uid : {TEST_UID1, TEST_UID2, TEST_UID3}) {
5574 {
5575 ScopedUidChange scopedUidChange(uid);
5576 EXPECT_EQ(0, setNetworkForProcess(ENTERPRISE_NETID_1));
5577 }
5578 }
5579 }
5580
5581 namespace {
5582
5583 class ScopedIfaceRouteOperation {
5584 using IfaceCmd = std::tuple<int32_t, const std::string>;
5585 using RouteCmd = std::tuple<int32_t, const std::string, const std::string, const std::string>;
5586
5587 // Helper type for the visitor.
5588 template <class... Ts>
5589 struct overloaded : Ts... {
5590 using Ts::operator()...;
5591 };
5592 // Explicit deduction guide
5593 template <class... Ts>
5594 overloaded(Ts...) -> overloaded<Ts...>;
5595
5596 public:
ScopedIfaceRouteOperation(sp<INetd> netd)5597 ScopedIfaceRouteOperation(sp<INetd> netd) : mNetd(netd) {}
5598
addInterface(int32_t netId,const std::string & iface)5599 binder::Status addInterface(int32_t netId, const std::string& iface) {
5600 const binder::Status status = mNetd->networkAddInterface(netId, iface);
5601 if (status.isOk()) {
5602 mCmds.push_back(std::make_tuple(netId, iface));
5603 }
5604 return status;
5605 }
5606
addRoute(int32_t netId,const std::string & iface,const std::string & destination,const std::string & nextHop)5607 binder::Status addRoute(int32_t netId, const std::string& iface, const std::string& destination,
5608 const std::string& nextHop) {
5609 const binder::Status status = mNetd->networkAddRoute(netId, iface, destination, nextHop);
5610 if (status.isOk()) {
5611 mCmds.push_back(std::make_tuple(netId, iface, destination, nextHop));
5612 }
5613 return status;
5614 }
5615
~ScopedIfaceRouteOperation()5616 ~ScopedIfaceRouteOperation() {
5617 // Remove routes and interfaces in reverse order.
5618 for (std::vector<std::variant<IfaceCmd, RouteCmd>>::reverse_iterator iter = mCmds.rbegin();
5619 iter != mCmds.rend(); iter++) {
5620 // Do corresponding works according to the type of the command pointed by the iter.
5621 std::visit(overloaded{
5622 [&](IfaceCmd& cmd) {
5623 mNetd->networkRemoveInterface(std::get<0>(cmd),
5624 std::get<1>(cmd));
5625 },
5626 [&](RouteCmd& cmd) {
5627 mNetd->networkRemoveRoute(std::get<0>(cmd), std::get<1>(cmd),
5628 std::get<2>(cmd), std::get<3>(cmd));
5629 },
5630 },
5631 *iter);
5632 }
5633 }
5634
5635 private:
5636 sp<INetd> mNetd;
5637 std::vector<std::variant<IfaceCmd, RouteCmd>> mCmds;
5638 };
5639
getV6LinkLocalAddrFromIfIndex(const unsigned ifIndex)5640 std::optional<sockaddr_in6> getV6LinkLocalAddrFromIfIndex(const unsigned ifIndex) {
5641 struct ifaddrs* ifAddrList = nullptr;
5642 sockaddr_in6 linkLocalAddr{};
5643
5644 if (getifaddrs(&ifAddrList) == -1) return std::nullopt;
5645
5646 for (struct ifaddrs* ifa = ifAddrList; ifa != nullptr; ifa = ifa->ifa_next) {
5647 if (ifa->ifa_addr != nullptr && ifa->ifa_addr->sa_family == AF_INET6) {
5648 struct sockaddr_in6* addr = reinterpret_cast<struct sockaddr_in6*>(ifa->ifa_addr);
5649 if (addr->sin6_scope_id == ifIndex && IN6_IS_ADDR_LINKLOCAL(&(addr->sin6_addr))) {
5650 linkLocalAddr = *addr;
5651 freeifaddrs(ifAddrList);
5652 return linkLocalAddr;
5653 }
5654 }
5655 }
5656
5657 freeifaddrs(ifAddrList);
5658 return std::nullopt;
5659 }
5660
retry_bind(int sockfd,struct sockaddr * addr,socklen_t addrlen)5661 int retry_bind(int sockfd, struct sockaddr* addr, socklen_t addrlen) {
5662 int ret = 0;
5663
5664 for (int retry = 0; retry < 10; retry++) {
5665 ret = bind(sockfd, addr, addrlen);
5666 if (ret == 0 || (ret == -1 && errno != EADDRNOTAVAIL)) {
5667 break;
5668 }
5669 usleep(100 * 1000);
5670 }
5671 return ret;
5672 }
5673
5674 } // namespace
5675
TEST_F(NetdBinderTest,V6LinkLocalFwmark)5676 TEST_F(NetdBinderTest, V6LinkLocalFwmark) {
5677 createAndSetDefaultNetwork(TEST_NETID1, sTun.name());
5678
5679 // Add an interface and route for Local network.
5680 ScopedIfaceRouteOperation scopedOperation(mNetd);
5681 EXPECT_TRUE(scopedOperation.addInterface(NetworkController::LOCAL_NET_ID, sTun2.name()).isOk());
5682 EXPECT_TRUE(
5683 scopedOperation.addRoute(NetworkController::LOCAL_NET_ID, sTun2.name(), "fe80::/64", "")
5684 .isOk());
5685
5686 // Bind a listening socket to the auto assigned link-local address of the Local network.
5687 std::optional<sockaddr_in6> v6LinkLocalAddr_1 = getV6LinkLocalAddrFromIfIndex(sTun2.ifindex());
5688 ASSERT_TRUE(v6LinkLocalAddr_1.has_value()) << "errno:" << errno;
5689 socklen_t len = sizeof(v6LinkLocalAddr_1.value());
5690 unique_fd s1(socket(AF_INET6, SOCK_STREAM | SOCK_NONBLOCK, 0));
5691 ASSERT_EQ(0, bind(s1, reinterpret_cast<sockaddr*>(&v6LinkLocalAddr_1.value()), len))
5692 << "errno:" << errno;
5693 ASSERT_EQ(0, getsockname(s1, reinterpret_cast<sockaddr*>(&v6LinkLocalAddr_1.value()), &len))
5694 << "errno:" << errno;
5695 ASSERT_EQ(0, listen(s1, 10)) << "errno:" << errno;
5696
5697 // Add another v6 link-local address.
5698 const char* v6LinkLocalAddr_2 = "fe80::ace:d00d";
5699 EXPECT_TRUE(mNetd->interfaceAddAddress(sTun2.name(), v6LinkLocalAddr_2, 64).isOk());
5700
5701 // Bind a client socket on the new added link-local address and connect it to the listen socket.
5702 // Have different src and dst addresses is needed because we want to test the behavior of fwmark
5703 // and destroying sockets. The same src and dst addresses are treated as loopbacks and won't be
5704 // destroyed in any way.
5705 const struct addrinfo hints = {
5706 .ai_family = AF_INET6,
5707 .ai_socktype = SOCK_STREAM,
5708 .ai_flags = AI_NUMERICHOST,
5709 };
5710 struct addrinfo* addrinfoList = nullptr;
5711 int ret = getaddrinfo(v6LinkLocalAddr_2, nullptr, &hints, &addrinfoList);
5712 ScopedAddrinfo addrinfoCleanup(addrinfoList);
5713 ASSERT_EQ(0, ret) << "errno:" << errno;
5714
5715 len = addrinfoList[0].ai_addrlen;
5716 sockaddr_in6 sin6 = *reinterpret_cast<sockaddr_in6*>(addrinfoList[0].ai_addr);
5717 sin6.sin6_scope_id = sTun2.ifindex();
5718
5719 unique_fd c1(socket(AF_INET6, SOCK_STREAM, 0));
5720 // Retry in case the newly added address is not ready yet.
5721 ASSERT_EQ(0, retry_bind(c1, reinterpret_cast<sockaddr*>(&sin6), len)) << "errno:" << errno;
5722 ASSERT_EQ(0, getsockname(c1, reinterpret_cast<sockaddr*>(&sin6), &len)) << "errno:" << errno;
5723 ASSERT_EQ(0, connect(c1, reinterpret_cast<sockaddr*>(&v6LinkLocalAddr_1.value()), len))
5724 << "errno:" << errno;
5725
5726 // Verify netId in fwmark.
5727 Fwmark fwmark;
5728 socklen_t fwmarkLen = sizeof(fwmark.intValue);
5729 EXPECT_EQ(0, getsockopt(c1, SOL_SOCKET, SO_MARK, &fwmark.intValue, &fwmarkLen));
5730 EXPECT_EQ((unsigned)NetworkController::LOCAL_NET_ID, fwmark.netId);
5731
5732 unique_fd a1(accept(s1, nullptr, 0));
5733 ASSERT_NE(-1, a1) << "errno:" << errno;
5734 EXPECT_EQ(0, getsockopt(a1, SOL_SOCKET, SO_MARK, &fwmark.intValue, &fwmarkLen));
5735 // TODO: Fix fwmark on the accept socket?
5736 fwmark.netId = NetworkController::LOCAL_NET_ID;
5737 EXPECT_EQ(0, setsockopt(a1, SOL_SOCKET, SO_MARK, &fwmark.intValue, sizeof(fwmark.intValue)));
5738
5739 // Change permission on the default network. Client socket should not be destroyed.
5740 EXPECT_TRUE(
5741 mNetd->networkSetPermissionForNetwork(TEST_NETID1, INetd::PERMISSION_NETWORK).isOk());
5742
5743 char buf[1024] = {};
5744 EXPECT_EQ(3, write(a1, "foo", 3)) << "errno:" << errno;
5745 EXPECT_EQ(3, read(c1, buf, sizeof(buf))) << "errno:" << errno;
5746 }