1 /*
2 * Copyright 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * ControllersTest.cpp - unit tests for Controllers.cpp
17 */
18
19 #include <set>
20 #include <string>
21 #include <vector>
22
23 #include <gmock/gmock.h>
24 #include <gtest/gtest.h>
25
26 #include <android-base/strings.h>
27
28 #include "Controllers.h"
29 #include "IptablesBaseTest.h"
30
31 using testing::ContainerEq;
32
33 namespace android {
34 namespace net {
35
36 class ControllersTest : public IptablesBaseTest {
37 public:
ControllersTest()38 ControllersTest() {
39 Controllers::execIptablesRestore = fakeExecIptablesRestore;
40 Controllers::execIptablesRestoreWithOutput = fakeExecIptablesRestoreWithOutput;
41 }
42
43 protected:
initChildChains()44 void initChildChains() { Controllers::initChildChains(); };
findExistingChildChains(IptablesTarget a,const char * b,const char * c)45 std::set<std::string> findExistingChildChains(IptablesTarget a, const char* b, const char*c) {
46 return Controllers::findExistingChildChains(a, b, c);
47 }
48 };
49
TEST_F(ControllersTest,TestFindExistingChildChains)50 TEST_F(ControllersTest, TestFindExistingChildChains) {
51 ExpectedIptablesCommands expectedCmds = {
52 { V6, "*raw\n-S PREROUTING\nCOMMIT\n" },
53 };
54 sIptablesRestoreOutput.push_back(
55 "-P PREROUTING ACCEPT\n"
56 "-A PREROUTING -j bw_raw_PREROUTING\n"
57 "-A PREROUTING -j idletimer_raw_PREROUTING\n"
58 "-A PREROUTING -j tetherctrl_raw_PREROUTING\n"
59 );
60 std::set<std::string> expectedChains = {
61 "bw_raw_PREROUTING",
62 "idletimer_raw_PREROUTING",
63 "tetherctrl_raw_PREROUTING",
64 };
65 std::set<std::string> actual = findExistingChildChains(V6, "raw", "PREROUTING");
66 EXPECT_THAT(expectedChains, ContainerEq(actual));
67 expectIptablesRestoreCommands(expectedCmds);
68 }
69
TEST_F(ControllersTest,TestInitIptablesRules)70 TEST_F(ControllersTest, TestInitIptablesRules) {
71 // Test what happens when we boot and there are no rules.
72 ExpectedIptablesCommands expected = {
73 {V4V6,
74 "*filter\n"
75 ":INPUT -\n"
76 "-F INPUT\n"
77 ":bw_INPUT -\n"
78 "-A INPUT -j bw_INPUT\n"
79 ":fw_INPUT -\n"
80 "-A INPUT -j fw_INPUT\n"
81 "COMMIT\n"},
82 {V4V6,
83 "*filter\n"
84 ":FORWARD -\n"
85 "-F FORWARD\n"
86 ":oem_fwd -\n"
87 "-A FORWARD -j oem_fwd\n"
88 ":fw_FORWARD -\n"
89 "-A FORWARD -j fw_FORWARD\n"
90 ":bw_FORWARD -\n"
91 "-A FORWARD -j bw_FORWARD\n"
92 ":tetherctrl_FORWARD -\n"
93 "-A FORWARD -j tetherctrl_FORWARD\n"
94 "COMMIT\n"},
95 {V4V6,
96 "*raw\n"
97 ":PREROUTING -\n"
98 "-F PREROUTING\n"
99 ":idletimer_raw_PREROUTING -\n"
100 "-A PREROUTING -j idletimer_raw_PREROUTING\n"
101 ":bw_raw_PREROUTING -\n"
102 "-A PREROUTING -j bw_raw_PREROUTING\n"
103 ":tetherctrl_raw_PREROUTING -\n"
104 "-A PREROUTING -j tetherctrl_raw_PREROUTING\n"
105 "COMMIT\n"},
106 {V4V6,
107 "*mangle\n"
108 ":FORWARD -\n"
109 "-F FORWARD\n"
110 ":tetherctrl_mangle_FORWARD -\n"
111 "-A FORWARD -j tetherctrl_mangle_FORWARD\n"
112 "COMMIT\n"},
113 {V4V6,
114 "*mangle\n"
115 ":INPUT -\n"
116 "-F INPUT\n"
117 ":wakeupctrl_mangle_INPUT -\n"
118 "-A INPUT -j wakeupctrl_mangle_INPUT\n"
119 ":routectrl_mangle_INPUT -\n"
120 "-A INPUT -j routectrl_mangle_INPUT\n"
121 "COMMIT\n"},
122 {V4,
123 "*nat\n"
124 ":PREROUTING -\n"
125 "-F PREROUTING\n"
126 ":oem_nat_pre -\n"
127 "-A PREROUTING -j oem_nat_pre\n"
128 "COMMIT\n"},
129 {V4,
130 "*nat\n"
131 ":POSTROUTING -\n"
132 "-F POSTROUTING\n"
133 ":tetherctrl_nat_POSTROUTING -\n"
134 "-A POSTROUTING -j tetherctrl_nat_POSTROUTING\n"
135 "COMMIT\n"},
136 {V4,
137 "*filter\n"
138 "-S OUTPUT\n"
139 "COMMIT\n"},
140 {V4,
141 "*filter\n"
142 ":oem_out -\n"
143 "-A OUTPUT -j oem_out\n"
144 ":fw_OUTPUT -\n"
145 "-A OUTPUT -j fw_OUTPUT\n"
146 ":st_OUTPUT -\n"
147 "-A OUTPUT -j st_OUTPUT\n"
148 ":bw_OUTPUT -\n"
149 "-A OUTPUT -j bw_OUTPUT\n"
150 "COMMIT\n"},
151 {V6,
152 "*filter\n"
153 "-S OUTPUT\n"
154 "COMMIT\n"},
155 {V6,
156 "*filter\n"
157 ":oem_out -\n"
158 "-A OUTPUT -j oem_out\n"
159 ":fw_OUTPUT -\n"
160 "-A OUTPUT -j fw_OUTPUT\n"
161 ":st_OUTPUT -\n"
162 "-A OUTPUT -j st_OUTPUT\n"
163 ":bw_OUTPUT -\n"
164 "-A OUTPUT -j bw_OUTPUT\n"
165 "COMMIT\n"},
166 {V4,
167 "*mangle\n"
168 "-S POSTROUTING\n"
169 "COMMIT\n"},
170 {V4,
171 "*mangle\n"
172 ":oem_mangle_post -\n"
173 "-A POSTROUTING -j oem_mangle_post\n"
174 ":bw_mangle_POSTROUTING -\n"
175 "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
176 ":idletimer_mangle_POSTROUTING -\n"
177 "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
178 "COMMIT\n"},
179 {V6,
180 "*mangle\n"
181 "-S POSTROUTING\n"
182 "COMMIT\n"},
183 {V6,
184 "*mangle\n"
185 ":oem_mangle_post -\n"
186 "-A POSTROUTING -j oem_mangle_post\n"
187 ":bw_mangle_POSTROUTING -\n"
188 "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
189 ":idletimer_mangle_POSTROUTING -\n"
190 "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
191 "COMMIT\n"},
192 };
193
194 // Check that we run these commands and these only.
195 initChildChains();
196 expectIptablesRestoreCommands(expected);
197 expectIptablesRestoreCommands(ExpectedIptablesCommands{});
198
199 // Now test what happens when some rules exist (e.g., if we crash and restart).
200
201 // First, explicitly tell the iptables test code to return empty output to all the commands we
202 // send. This allows us to tell it to return non-empty output to particular commands in the
203 // following code.
204 for (size_t i = 0; i < expected.size(); i++) {
205 sIptablesRestoreOutput.push_back("");
206 }
207
208 // Define a macro to remove a substring from a string. We use a macro instead of a function so
209 // we can assert in it. In the following code, we use ASSERT_* to check for programming errors
210 // in the test code, and EXPECT_* to check for errors in the actual code.
211 #define DELETE_SUBSTRING(substr, str) { \
212 size_t start = (str).find((substr)); \
213 ASSERT_NE(std::string::npos, start); \
214 (str).erase(start, strlen((substr))); \
215 ASSERT_EQ(std::string::npos, (str).find((substr))); \
216 }
217
218 // Now set test expectations.
219
220 // 1. Test that if we find rules that we don't create ourselves, we ignore them.
221 // First check that command #7 is where we list the OUTPUT chain in the (IPv4) filter table:
222 ASSERT_NE(std::string::npos, expected[7].second.find("*filter\n-S OUTPUT\n"));
223 // ... and pretend that when we run that command, we find the following rules. Because we don't
224 // create any of these rules ourselves, our behaviour is unchanged.
225 sIptablesRestoreOutput[7] =
226 "-P OUTPUT ACCEPT\n"
227 "-A OUTPUT -o r_rmnet_data8 -p udp -m udp --dport 1900 -j DROP\n";
228
229 // 2. Test that rules that we create ourselves are not added if they already exist.
230 // Pretend that when we list the OUTPUT chain in the (IPv6) filter table, we find the oem_out
231 // and st_OUTPUT chains:
232 ASSERT_NE(std::string::npos, expected[9].second.find("*filter\n-S OUTPUT\n"));
233 sIptablesRestoreOutput[9] =
234 "-A OUTPUT -j oem_out\n"
235 "-A OUTPUT -j st_OUTPUT\n";
236 // ... and expect that when we populate the OUTPUT chain, we do not re-add them.
237 DELETE_SUBSTRING("-A OUTPUT -j oem_out\n", expected[10].second);
238 DELETE_SUBSTRING("-A OUTPUT -j st_OUTPUT\n", expected[10].second);
239
240 // 3. Now test that when we list the POSTROUTING chain in the mangle table, we find a mixture of
241 // netd-created rules and vendor rules:
242 ASSERT_NE(std::string::npos, expected[13].second.find("*mangle\n-S POSTROUTING\n"));
243 sIptablesRestoreOutput[13] =
244 "-P POSTROUTING ACCEPT\n"
245 "-A POSTROUTING -j oem_mangle_post\n"
246 "-A POSTROUTING -j bw_mangle_POSTROUTING\n"
247 "-A POSTROUTING -j idletimer_mangle_POSTROUTING\n"
248 "-A POSTROUTING -j qcom_qos_reset_POSTROUTING\n"
249 "-A POSTROUTING -j qcom_qos_filter_POSTROUTING\n";
250 // and expect that we don't re-add the netd-created rules that already exist.
251 DELETE_SUBSTRING("-A POSTROUTING -j oem_mangle_post\n", expected[14].second);
252 DELETE_SUBSTRING("-A POSTROUTING -j bw_mangle_POSTROUTING\n", expected[14].second);
253 DELETE_SUBSTRING("-A POSTROUTING -j idletimer_mangle_POSTROUTING\n", expected[14].second);
254
255 // In this last case, also check that our expectations are reasonable.
256 std::string expectedCmd14 =
257 "*mangle\n"
258 ":oem_mangle_post -\n"
259 ":bw_mangle_POSTROUTING -\n"
260 ":idletimer_mangle_POSTROUTING -\n"
261 "COMMIT\n";
262 ASSERT_EQ(expectedCmd14, expected[14].second);
263
264 // Finally, actually test that initChildChains runs the expected commands, and nothing more.
265 initChildChains();
266 expectIptablesRestoreCommands(expected);
267 expectIptablesRestoreCommands(ExpectedIptablesCommands{});
268 }
269
270 } // namespace net
271 } // namespace android
272