• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  *
16  * ControllersTest.cpp - unit tests for Controllers.cpp
17  */
18 
19 #include <set>
20 #include <string>
21 #include <vector>
22 
23 #include <gmock/gmock.h>
24 #include <gtest/gtest.h>
25 
26 #include <android-base/strings.h>
27 
28 #include "Controllers.h"
29 #include "IptablesBaseTest.h"
30 
31 using testing::ContainerEq;
32 
33 namespace android {
34 namespace net {
35 
36 class ControllersTest : public IptablesBaseTest {
37   public:
ControllersTest()38     ControllersTest() {
39         Controllers::execIptablesRestore = fakeExecIptablesRestore;
40         Controllers::execIptablesRestoreWithOutput = fakeExecIptablesRestoreWithOutput;
41     }
42 
43   protected:
initChildChains()44     void initChildChains() { Controllers::initChildChains(); };
findExistingChildChains(IptablesTarget a,const char * b,const char * c)45     std::set<std::string> findExistingChildChains(IptablesTarget a, const char* b, const char*c) {
46         return Controllers::findExistingChildChains(a, b, c);
47     }
48 };
49 
TEST_F(ControllersTest,TestFindExistingChildChains)50 TEST_F(ControllersTest, TestFindExistingChildChains) {
51     ExpectedIptablesCommands expectedCmds = {
52         { V6, "*raw\n-S PREROUTING\nCOMMIT\n" },
53     };
54     sIptablesRestoreOutput.push_back(
55         "-P PREROUTING ACCEPT\n"
56         "-A PREROUTING -j bw_raw_PREROUTING\n"
57         "-A PREROUTING -j idletimer_raw_PREROUTING\n"
58         "-A PREROUTING -j tetherctrl_raw_PREROUTING\n"
59     );
60     std::set<std::string> expectedChains = {
61         "bw_raw_PREROUTING",
62         "idletimer_raw_PREROUTING",
63         "tetherctrl_raw_PREROUTING",
64     };
65     std::set<std::string> actual = findExistingChildChains(V6, "raw", "PREROUTING");
66     EXPECT_THAT(expectedChains, ContainerEq(actual));
67     expectIptablesRestoreCommands(expectedCmds);
68 }
69 
TEST_F(ControllersTest,TestInitIptablesRules)70 TEST_F(ControllersTest, TestInitIptablesRules) {
71     // Test what happens when we boot and there are no rules.
72     ExpectedIptablesCommands expected = {
73             {V4V6,
74              "*filter\n"
75              ":INPUT -\n"
76              "-F INPUT\n"
77              ":bw_INPUT -\n"
78              "-A INPUT -j bw_INPUT\n"
79              ":fw_INPUT -\n"
80              "-A INPUT -j fw_INPUT\n"
81              "COMMIT\n"},
82             {V4V6,
83              "*filter\n"
84              ":FORWARD -\n"
85              "-F FORWARD\n"
86              ":oem_fwd -\n"
87              "-A FORWARD -j oem_fwd\n"
88              ":fw_FORWARD -\n"
89              "-A FORWARD -j fw_FORWARD\n"
90              ":bw_FORWARD -\n"
91              "-A FORWARD -j bw_FORWARD\n"
92              ":tetherctrl_FORWARD -\n"
93              "-A FORWARD -j tetherctrl_FORWARD\n"
94              "COMMIT\n"},
95             {V4V6,
96              "*raw\n"
97              ":PREROUTING -\n"
98              "-F PREROUTING\n"
99              ":idletimer_raw_PREROUTING -\n"
100              "-A PREROUTING -j idletimer_raw_PREROUTING\n"
101              ":bw_raw_PREROUTING -\n"
102              "-A PREROUTING -j bw_raw_PREROUTING\n"
103              ":tetherctrl_raw_PREROUTING -\n"
104              "-A PREROUTING -j tetherctrl_raw_PREROUTING\n"
105              "COMMIT\n"},
106             {V4V6,
107              "*mangle\n"
108              ":FORWARD -\n"
109              "-F FORWARD\n"
110              ":tetherctrl_mangle_FORWARD -\n"
111              "-A FORWARD -j tetherctrl_mangle_FORWARD\n"
112              "COMMIT\n"},
113             {V4V6,
114              "*mangle\n"
115              ":INPUT -\n"
116              "-F INPUT\n"
117              ":wakeupctrl_mangle_INPUT -\n"
118              "-A INPUT -j wakeupctrl_mangle_INPUT\n"
119              ":routectrl_mangle_INPUT -\n"
120              "-A INPUT -j routectrl_mangle_INPUT\n"
121              "COMMIT\n"},
122             {V4,
123              "*nat\n"
124              ":PREROUTING -\n"
125              "-F PREROUTING\n"
126              ":oem_nat_pre -\n"
127              "-A PREROUTING -j oem_nat_pre\n"
128              "COMMIT\n"},
129             {V4,
130              "*nat\n"
131              ":POSTROUTING -\n"
132              "-F POSTROUTING\n"
133              ":tetherctrl_nat_POSTROUTING -\n"
134              "-A POSTROUTING -j tetherctrl_nat_POSTROUTING\n"
135              "COMMIT\n"},
136             {V4,
137              "*filter\n"
138              "-S OUTPUT\n"
139              "COMMIT\n"},
140             {V4,
141              "*filter\n"
142              ":oem_out -\n"
143              "-A OUTPUT -j oem_out\n"
144              ":fw_OUTPUT -\n"
145              "-A OUTPUT -j fw_OUTPUT\n"
146              ":st_OUTPUT -\n"
147              "-A OUTPUT -j st_OUTPUT\n"
148              ":bw_OUTPUT -\n"
149              "-A OUTPUT -j bw_OUTPUT\n"
150              "COMMIT\n"},
151             {V6,
152              "*filter\n"
153              "-S OUTPUT\n"
154              "COMMIT\n"},
155             {V6,
156              "*filter\n"
157              ":oem_out -\n"
158              "-A OUTPUT -j oem_out\n"
159              ":fw_OUTPUT -\n"
160              "-A OUTPUT -j fw_OUTPUT\n"
161              ":st_OUTPUT -\n"
162              "-A OUTPUT -j st_OUTPUT\n"
163              ":bw_OUTPUT -\n"
164              "-A OUTPUT -j bw_OUTPUT\n"
165              "COMMIT\n"},
166             {V4,
167              "*mangle\n"
168              "-S POSTROUTING\n"
169              "COMMIT\n"},
170             {V4,
171              "*mangle\n"
172              ":oem_mangle_post -\n"
173              "-A POSTROUTING -j oem_mangle_post\n"
174              ":bw_mangle_POSTROUTING -\n"
175              "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
176              ":idletimer_mangle_POSTROUTING -\n"
177              "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
178              "COMMIT\n"},
179             {V6,
180              "*mangle\n"
181              "-S POSTROUTING\n"
182              "COMMIT\n"},
183             {V6,
184              "*mangle\n"
185              ":oem_mangle_post -\n"
186              "-A POSTROUTING -j oem_mangle_post\n"
187              ":bw_mangle_POSTROUTING -\n"
188              "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
189              ":idletimer_mangle_POSTROUTING -\n"
190              "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
191              "COMMIT\n"},
192     };
193 
194     // Check that we run these commands and these only.
195     initChildChains();
196     expectIptablesRestoreCommands(expected);
197     expectIptablesRestoreCommands(ExpectedIptablesCommands{});
198 
199     // Now test what happens when some rules exist (e.g., if we crash and restart).
200 
201     // First, explicitly tell the iptables test code to return empty output to all the commands we
202     // send. This allows us to tell it to return non-empty output to particular commands in the
203     // following code.
204     for (size_t i = 0; i < expected.size(); i++) {
205         sIptablesRestoreOutput.push_back("");
206     }
207 
208     // Define a macro to remove a substring from a string. We use a macro instead of a function so
209     // we can assert in it. In the following code, we use ASSERT_* to check for programming errors
210     // in the test code, and EXPECT_* to check for errors in the actual code.
211 #define DELETE_SUBSTRING(substr, str) {                      \
212         size_t start = (str).find((substr));                 \
213         ASSERT_NE(std::string::npos, start);                 \
214         (str).erase(start, strlen((substr)));                \
215         ASSERT_EQ(std::string::npos, (str).find((substr)));  \
216     }
217 
218     // Now set test expectations.
219 
220     // 1. Test that if we find rules that we don't create ourselves, we ignore them.
221     // First check that command #7 is where we list the OUTPUT chain in the (IPv4) filter table:
222     ASSERT_NE(std::string::npos, expected[7].second.find("*filter\n-S OUTPUT\n"));
223     // ... and pretend that when we run that command, we find the following rules. Because we don't
224     // create any of these rules ourselves, our behaviour is unchanged.
225     sIptablesRestoreOutput[7] =
226         "-P OUTPUT ACCEPT\n"
227         "-A OUTPUT -o r_rmnet_data8 -p udp -m udp --dport 1900 -j DROP\n";
228 
229     // 2. Test that rules that we create ourselves are not added if they already exist.
230     // Pretend that when we list the OUTPUT chain in the (IPv6) filter table, we find the oem_out
231     // and st_OUTPUT chains:
232     ASSERT_NE(std::string::npos, expected[9].second.find("*filter\n-S OUTPUT\n"));
233     sIptablesRestoreOutput[9] =
234         "-A OUTPUT -j oem_out\n"
235         "-A OUTPUT -j st_OUTPUT\n";
236     // ... and expect that when we populate the OUTPUT chain, we do not re-add them.
237     DELETE_SUBSTRING("-A OUTPUT -j oem_out\n", expected[10].second);
238     DELETE_SUBSTRING("-A OUTPUT -j st_OUTPUT\n", expected[10].second);
239 
240     // 3. Now test that when we list the POSTROUTING chain in the mangle table, we find a mixture of
241     // netd-created rules and vendor rules:
242     ASSERT_NE(std::string::npos, expected[13].second.find("*mangle\n-S POSTROUTING\n"));
243     sIptablesRestoreOutput[13] =
244         "-P POSTROUTING ACCEPT\n"
245         "-A POSTROUTING -j oem_mangle_post\n"
246         "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
247         "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
248         "-A POSTROUTING -j qcom_qos_reset_POSTROUTING\n"
249         "-A POSTROUTING -j qcom_qos_filter_POSTROUTING\n";
250     // and expect that we don't re-add the netd-created rules that already exist.
251     DELETE_SUBSTRING("-A POSTROUTING -j oem_mangle_post\n", expected[14].second);
252     DELETE_SUBSTRING("-A POSTROUTING -j bw_mangle_POSTROUTING\n", expected[14].second);
253     DELETE_SUBSTRING("-A POSTROUTING -j idletimer_mangle_POSTROUTING\n", expected[14].second);
254 
255     // In this last case, also check that our expectations are reasonable.
256     std::string expectedCmd14 =
257         "*mangle\n"
258         ":oem_mangle_post -\n"
259         ":bw_mangle_POSTROUTING -\n"
260         ":idletimer_mangle_POSTROUTING -\n"
261         "COMMIT\n";
262     ASSERT_EQ(expectedCmd14, expected[14].second);
263 
264     // Finally, actually test that initChildChains runs the expected commands, and nothing more.
265     initChildChains();
266     expectIptablesRestoreCommands(expected);
267     expectIptablesRestoreCommands(ExpectedIptablesCommands{});
268 }
269 
270 }  // namespace net
271 }  // namespace android
272