1 /*
2 * Copyright 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * FirewallControllerTest.cpp - unit tests for FirewallController.cpp
17 */
18
19 #include <string>
20 #include <vector>
21 #include <stdio.h>
22
23 #include <gtest/gtest.h>
24
25 #include <android-base/strings.h>
26
27 #include "FirewallController.h"
28 #include "IptablesBaseTest.h"
29
30
31 class FirewallControllerTest : public IptablesBaseTest {
32 protected:
FirewallControllerTest()33 FirewallControllerTest() {
34 FirewallController::execIptables = fakeExecIptables;
35 FirewallController::execIptablesSilently = fakeExecIptables;
36 FirewallController::execIptablesRestore = fakeExecIptablesRestore;
37 }
38 FirewallController mFw;
39
makeUidRules(IptablesTarget a,const char * b,bool c,const std::vector<int32_t> & d)40 std::string makeUidRules(IptablesTarget a, const char* b, bool c,
41 const std::vector<int32_t>& d) {
42 return mFw.makeUidRules(a, b, c, d);
43 }
44
createChain(const char * a,FirewallType b)45 int createChain(const char* a, FirewallType b) {
46 return mFw.createChain(a, b);
47 }
48 };
49
50
TEST_F(FirewallControllerTest,TestCreateWhitelistChain)51 TEST_F(FirewallControllerTest, TestCreateWhitelistChain) {
52 std::vector<std::string> expectedRestore4 = {
53 "*filter",
54 ":fw_whitelist -",
55 "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
56 "-A fw_whitelist -i lo -j RETURN",
57 "-A fw_whitelist -o lo -j RETURN",
58 "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
59 "-A fw_whitelist -j DROP",
60 "COMMIT\n"
61 };
62 std::vector<std::string> expectedRestore6 = {
63 "*filter",
64 ":fw_whitelist -",
65 "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
66 "-A fw_whitelist -i lo -j RETURN",
67 "-A fw_whitelist -o lo -j RETURN",
68 "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
69 "-A fw_whitelist -p icmpv6 --icmpv6-type packet-too-big -j RETURN",
70 "-A fw_whitelist -p icmpv6 --icmpv6-type router-solicitation -j RETURN",
71 "-A fw_whitelist -p icmpv6 --icmpv6-type router-advertisement -j RETURN",
72 "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN",
73 "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN",
74 "-A fw_whitelist -p icmpv6 --icmpv6-type redirect -j RETURN",
75 "-A fw_whitelist -j DROP",
76 "COMMIT\n"
77 };
78 std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
79 { V4, android::base::Join(expectedRestore4, '\n') },
80 { V6, android::base::Join(expectedRestore6, '\n') },
81 };
82
83 createChain("fw_whitelist", WHITELIST);
84 expectIptablesRestoreCommands(expectedRestoreCommands);
85 }
86
TEST_F(FirewallControllerTest,TestCreateBlacklistChain)87 TEST_F(FirewallControllerTest, TestCreateBlacklistChain) {
88 std::vector<std::string> expectedRestore = {
89 "*filter",
90 ":fw_blacklist -",
91 "-A fw_blacklist -i lo -j RETURN",
92 "-A fw_blacklist -o lo -j RETURN",
93 "-A fw_blacklist -p tcp --tcp-flags RST RST -j RETURN",
94 "COMMIT\n"
95 };
96 std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
97 { V4, android::base::Join(expectedRestore, '\n') },
98 { V6, android::base::Join(expectedRestore, '\n') },
99 };
100
101 createChain("fw_blacklist", BLACKLIST);
102 expectIptablesRestoreCommands(expectedRestoreCommands);
103 }
104
TEST_F(FirewallControllerTest,TestSetStandbyRule)105 TEST_F(FirewallControllerTest, TestSetStandbyRule) {
106 ExpectedIptablesCommands expected = {
107 { V4V6, "*filter\n-D fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" }
108 };
109 mFw.setUidRule(STANDBY, 12345, ALLOW);
110 expectIptablesRestoreCommands(expected);
111
112 expected = {
113 { V4V6, "*filter\n-A fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" }
114 };
115 mFw.setUidRule(STANDBY, 12345, DENY);
116 expectIptablesRestoreCommands(expected);
117 }
118
TEST_F(FirewallControllerTest,TestSetDozeRule)119 TEST_F(FirewallControllerTest, TestSetDozeRule) {
120 ExpectedIptablesCommands expected = {
121 { V4V6, "*filter\n-I fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" }
122 };
123 mFw.setUidRule(DOZABLE, 54321, ALLOW);
124 expectIptablesRestoreCommands(expected);
125
126 expected = {
127 { V4V6, "*filter\n-D fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" }
128 };
129 mFw.setUidRule(DOZABLE, 54321, DENY);
130 expectIptablesRestoreCommands(expected);
131 }
132
TEST_F(FirewallControllerTest,TestSetFirewallRule)133 TEST_F(FirewallControllerTest, TestSetFirewallRule) {
134 ExpectedIptablesCommands expected = {
135 { V4V6, "*filter\n"
136 "-A fw_INPUT -m owner --uid-owner 54321 -j DROP\n"
137 "-A fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n"
138 "COMMIT\n" }
139 };
140 mFw.setUidRule(NONE, 54321, DENY);
141 expectIptablesRestoreCommands(expected);
142
143 expected = {
144 { V4V6, "*filter\n"
145 "-D fw_INPUT -m owner --uid-owner 54321 -j DROP\n"
146 "-D fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n"
147 "COMMIT\n" }
148 };
149 mFw.setUidRule(NONE, 54321, ALLOW);
150 expectIptablesRestoreCommands(expected);
151 }
152
TEST_F(FirewallControllerTest,TestReplaceWhitelistUidRule)153 TEST_F(FirewallControllerTest, TestReplaceWhitelistUidRule) {
154 std::string expected =
155 "*filter\n"
156 ":FW_whitechain -\n"
157 "-A FW_whitechain -m owner --uid-owner 10023 -j RETURN\n"
158 "-A FW_whitechain -m owner --uid-owner 10059 -j RETURN\n"
159 "-A FW_whitechain -m owner --uid-owner 10124 -j RETURN\n"
160 "-A FW_whitechain -m owner --uid-owner 10111 -j RETURN\n"
161 "-A FW_whitechain -m owner --uid-owner 110122 -j RETURN\n"
162 "-A FW_whitechain -m owner --uid-owner 210153 -j RETURN\n"
163 "-A FW_whitechain -m owner --uid-owner 210024 -j RETURN\n"
164 "-A FW_whitechain -m owner --uid-owner 0-9999 -j RETURN\n"
165 "-A FW_whitechain -i lo -j RETURN\n"
166 "-A FW_whitechain -o lo -j RETURN\n"
167 "-A FW_whitechain -p tcp --tcp-flags RST RST -j RETURN\n"
168 "-A FW_whitechain -p icmpv6 --icmpv6-type packet-too-big -j RETURN\n"
169 "-A FW_whitechain -p icmpv6 --icmpv6-type router-solicitation -j RETURN\n"
170 "-A FW_whitechain -p icmpv6 --icmpv6-type router-advertisement -j RETURN\n"
171 "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN\n"
172 "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN\n"
173 "-A FW_whitechain -p icmpv6 --icmpv6-type redirect -j RETURN\n"
174 "-A FW_whitechain -j DROP\n"
175 "COMMIT\n";
176
177 std::vector<int32_t> uids = { 10023, 10059, 10124, 10111, 110122, 210153, 210024 };
178 EXPECT_EQ(expected, makeUidRules(V6, "FW_whitechain", true, uids));
179 }
180
TEST_F(FirewallControllerTest,TestReplaceBlacklistUidRule)181 TEST_F(FirewallControllerTest, TestReplaceBlacklistUidRule) {
182 std::string expected =
183 "*filter\n"
184 ":FW_blackchain -\n"
185 "-A FW_blackchain -i lo -j RETURN\n"
186 "-A FW_blackchain -o lo -j RETURN\n"
187 "-A FW_blackchain -p tcp --tcp-flags RST RST -j RETURN\n"
188 "-A FW_blackchain -m owner --uid-owner 10023 -j DROP\n"
189 "-A FW_blackchain -m owner --uid-owner 10059 -j DROP\n"
190 "-A FW_blackchain -m owner --uid-owner 10124 -j DROP\n"
191 "COMMIT\n";
192
193 std::vector<int32_t> uids = { 10023, 10059, 10124 };
194 EXPECT_EQ(expected, makeUidRules(V4 ,"FW_blackchain", false, uids));
195 }
196
TEST_F(FirewallControllerTest,TestEnableChildChains)197 TEST_F(FirewallControllerTest, TestEnableChildChains) {
198 std::vector<std::string> expected = {
199 "*filter\n"
200 "-A fw_INPUT -j fw_dozable\n"
201 "-A fw_OUTPUT -j fw_dozable\n"
202 "COMMIT\n"
203 };
204 EXPECT_EQ(0, mFw.enableChildChains(DOZABLE, true));
205 expectIptablesRestoreCommands(expected);
206
207 expected = {
208 "*filter\n"
209 "-D fw_INPUT -j fw_powersave\n"
210 "-D fw_OUTPUT -j fw_powersave\n"
211 "COMMIT\n"
212 };
213 EXPECT_EQ(0, mFw.enableChildChains(POWERSAVE, false));
214 expectIptablesRestoreCommands(expected);
215 }
216