1 /*
2 * Copyright 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * NatControllerTest.cpp - unit tests for NatController.cpp
17 */
18
19 #include <string>
20 #include <vector>
21
22 #include <fcntl.h>
23 #include <unistd.h>
24 #include <sys/types.h>
25 #include <sys/socket.h>
26
27 #include <gtest/gtest.h>
28
29 #include <android-base/stringprintf.h>
30 #include <android-base/strings.h>
31
32 #include "NatController.h"
33 #include "IptablesBaseTest.h"
34
35 using android::base::StringPrintf;
36
37 class NatControllerTest : public IptablesBaseTest {
38 public:
NatControllerTest()39 NatControllerTest() {
40 NatController::execFunction = fake_android_fork_exec;
41 }
42
43 protected:
44 NatController mNatCtrl;
45
setDefaults()46 int setDefaults() {
47 return mNatCtrl.setDefaults();
48 }
49
50 const ExpectedIptablesCommands FLUSH_COMMANDS = {
51 { V4V6, "-F natctrl_FORWARD" },
52 { V4, "-A natctrl_FORWARD -j DROP" },
53 { V4, "-t nat -F natctrl_nat_POSTROUTING" },
54 { V6, "-t raw -F natctrl_raw_PREROUTING" },
55 };
56
57 const ExpectedIptablesCommands SETUP_COMMANDS = {
58 { V4V6, "-F natctrl_FORWARD" },
59 { V4, "-A natctrl_FORWARD -j DROP" },
60 { V4, "-t nat -F natctrl_nat_POSTROUTING" },
61 { V6, "-t raw -F natctrl_raw_PREROUTING" },
62 { V4V6, "-F natctrl_tether_counters" },
63 { V4V6, "-X natctrl_tether_counters" },
64 { V4V6, "-N natctrl_tether_counters" },
65 { V4, "-t mangle -A natctrl_mangle_FORWARD -p tcp --tcp-flags SYN SYN "
66 "-j TCPMSS --clamp-mss-to-pmtu" },
67 };
68
69 const ExpectedIptablesCommands TWIDDLE_COMMANDS = {
70 { V4, "-D natctrl_FORWARD -j DROP" },
71 { V4, "-A natctrl_FORWARD -j DROP" },
72 };
73
firstNatCommands(const char * extIf)74 ExpectedIptablesCommands firstNatCommands(const char *extIf) {
75 return {
76 { V4, StringPrintf("-t nat -A natctrl_nat_POSTROUTING -o %s -j MASQUERADE", extIf) },
77 { V6, "-A natctrl_FORWARD -g natctrl_tether_counters" },
78 };
79 }
80
startNatCommands(const char * intIf,const char * extIf)81 ExpectedIptablesCommands startNatCommands(const char *intIf, const char *extIf) {
82 return {
83 { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state"
84 " ESTABLISHED,RELATED -g natctrl_tether_counters", extIf, intIf) },
85 { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
86 intIf, extIf) },
87 { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -g natctrl_tether_counters",
88 intIf, extIf) },
89 { V6, StringPrintf("-t raw -A natctrl_raw_PREROUTING -i %s -m rpfilter --invert"
90 " ! -s fe80::/64 -j DROP", intIf) },
91 { V4V6, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN",
92 intIf, extIf) },
93 { V4V6, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN",
94 extIf, intIf) },
95 };
96 }
97
stopNatCommands(const char * intIf,const char * extIf)98 ExpectedIptablesCommands stopNatCommands(const char *intIf, const char *extIf) {
99 return {
100 { V4, StringPrintf("-D natctrl_FORWARD -i %s -o %s -m state --state"
101 " ESTABLISHED,RELATED -g natctrl_tether_counters", extIf, intIf) },
102 { V4, StringPrintf("-D natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
103 intIf, extIf) },
104 { V4, StringPrintf("-D natctrl_FORWARD -i %s -o %s -g natctrl_tether_counters",
105 intIf, extIf) },
106 { V6, StringPrintf("-t raw -D natctrl_raw_PREROUTING -i %s -m rpfilter --invert"
107 " ! -s fe80::/64 -j DROP", intIf) },
108 };
109 }
110 };
111
TEST_F(NatControllerTest,TestSetupIptablesHooks)112 TEST_F(NatControllerTest, TestSetupIptablesHooks) {
113 mNatCtrl.setupIptablesHooks();
114 expectIptablesCommands(SETUP_COMMANDS);
115 }
116
TEST_F(NatControllerTest,TestSetDefaults)117 TEST_F(NatControllerTest, TestSetDefaults) {
118 setDefaults();
119 expectIptablesCommands(FLUSH_COMMANDS);
120 }
121
TEST_F(NatControllerTest,TestAddAndRemoveNat)122 TEST_F(NatControllerTest, TestAddAndRemoveNat) {
123
124 std::vector<ExpectedIptablesCommands> startFirstNat = {
125 firstNatCommands("rmnet0"),
126 startNatCommands("wlan0", "rmnet0"),
127 TWIDDLE_COMMANDS,
128 };
129 mNatCtrl.enableNat("wlan0", "rmnet0");
130 expectIptablesCommands(startFirstNat);
131
132 std::vector<ExpectedIptablesCommands> startOtherNat = {
133 startNatCommands("usb0", "rmnet0"),
134 TWIDDLE_COMMANDS,
135 };
136 mNatCtrl.enableNat("usb0", "rmnet0");
137 expectIptablesCommands(startOtherNat);
138
139 ExpectedIptablesCommands stopOtherNat = stopNatCommands("wlan0", "rmnet0");
140 mNatCtrl.disableNat("wlan0", "rmnet0");
141 expectIptablesCommands(stopOtherNat);
142
143 std::vector<ExpectedIptablesCommands> stopLastNat = {
144 stopNatCommands("usb0", "rmnet0"),
145 FLUSH_COMMANDS,
146 };
147 mNatCtrl.disableNat("usb0", "rmnet0");
148 expectIptablesCommands(stopLastNat);
149 }
150