1 /*
2  * Copyright 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  *
16  * FirewallControllerTest.cpp - unit tests for FirewallController.cpp
17  */
18 
19 #include <string>
20 #include <vector>
21 #include <stdio.h>
22 
23 #include <gtest/gtest.h>
24 
25 #include <android-base/strings.h>
26 
27 #include "FirewallController.h"
28 #include "IptablesBaseTest.h"
29 
30 
31 class FirewallControllerTest : public IptablesBaseTest {
32 protected:
FirewallControllerTest()33     FirewallControllerTest() {
34         FirewallController::execIptables = fakeExecIptables;
35         FirewallController::execIptablesSilently = fakeExecIptables;
36         FirewallController::execIptablesRestore = fakeExecIptablesRestore;
37     }
38     FirewallController mFw;
39 
makeUidRules(IptablesTarget a,const char * b,bool c,const std::vector<int32_t> & d)40     std::string makeUidRules(IptablesTarget a, const char* b, bool c,
41                              const std::vector<int32_t>& d) {
42         return mFw.makeUidRules(a, b, c, d);
43     }
44 
createChain(const char * a,const char * b,FirewallType c)45     int createChain(const char* a, const char* b , FirewallType c) {
46         return mFw.createChain(a, b, c);
47     }
48 };
49 
50 
TEST_F(FirewallControllerTest,TestCreateWhitelistChain)51 TEST_F(FirewallControllerTest, TestCreateWhitelistChain) {
52     ExpectedIptablesCommands expectedCommands = {
53         { V4V6, "-t filter -D INPUT -j fw_whitelist" },
54     };
55 
56     std::vector<std::string> expectedRestore4 = {
57         "*filter",
58         ":fw_whitelist -",
59         "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
60         "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
61         "-A fw_whitelist -j DROP",
62         "COMMIT\n\x04"
63     };
64     std::vector<std::string> expectedRestore6 = {
65         "*filter",
66         ":fw_whitelist -",
67         "-A fw_whitelist -p tcp --tcp-flags RST RST -j RETURN",
68         "-A fw_whitelist -p icmpv6 --icmpv6-type packet-too-big -j RETURN",
69         "-A fw_whitelist -p icmpv6 --icmpv6-type router-solicitation -j RETURN",
70         "-A fw_whitelist -p icmpv6 --icmpv6-type router-advertisement -j RETURN",
71         "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN",
72         "-A fw_whitelist -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN",
73         "-A fw_whitelist -p icmpv6 --icmpv6-type redirect -j RETURN",
74         "-A fw_whitelist -m owner --uid-owner 0-9999 -j RETURN",
75         "-A fw_whitelist -j DROP",
76         "COMMIT\n\x04"
77     };
78     std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
79         { V4, android::base::Join(expectedRestore4, '\n') },
80         { V6, android::base::Join(expectedRestore6, '\n') },
81     };
82 
83     createChain("fw_whitelist", "INPUT", WHITELIST);
84     expectIptablesCommands(expectedCommands);
85     expectIptablesRestoreCommands(expectedRestoreCommands);
86 }
87 
TEST_F(FirewallControllerTest,TestCreateBlacklistChain)88 TEST_F(FirewallControllerTest, TestCreateBlacklistChain) {
89     ExpectedIptablesCommands expectedCommands = {
90         { V4V6, "-t filter -D INPUT -j fw_blacklist" },
91     };
92 
93     std::vector<std::string> expectedRestore = {
94         "*filter",
95         ":fw_blacklist -",
96         "-A fw_blacklist -p tcp --tcp-flags RST RST -j RETURN",
97         "COMMIT\n\x04"
98     };
99     std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
100         { V4, android::base::Join(expectedRestore, '\n') },
101         { V6, android::base::Join(expectedRestore, '\n') },
102     };
103 
104     createChain("fw_blacklist", "INPUT", BLACKLIST);
105     expectIptablesCommands(expectedCommands);
106     expectIptablesRestoreCommands(expectedRestoreCommands);
107 }
108 
TEST_F(FirewallControllerTest,TestSetStandbyRule)109 TEST_F(FirewallControllerTest, TestSetStandbyRule) {
110     ExpectedIptablesCommands expected = {
111         { V4V6, "-D fw_standby -m owner --uid-owner 12345 -j DROP" }
112     };
113     mFw.setUidRule(STANDBY, 12345, ALLOW);
114     expectIptablesCommands(expected);
115 
116     expected = {
117         { V4V6, "-A fw_standby -m owner --uid-owner 12345 -j DROP" }
118     };
119     mFw.setUidRule(STANDBY, 12345, DENY);
120     expectIptablesCommands(expected);
121 }
122 
TEST_F(FirewallControllerTest,TestSetDozeRule)123 TEST_F(FirewallControllerTest, TestSetDozeRule) {
124     ExpectedIptablesCommands expected = {
125         { V4V6, "-I fw_dozable -m owner --uid-owner 54321 -j RETURN" }
126     };
127     mFw.setUidRule(DOZABLE, 54321, ALLOW);
128     expectIptablesCommands(expected);
129 
130     expected = {
131         { V4V6, "-D fw_dozable -m owner --uid-owner 54321 -j RETURN" }
132     };
133     mFw.setUidRule(DOZABLE, 54321, DENY);
134     expectIptablesCommands(expected);
135 }
136 
TEST_F(FirewallControllerTest,TestReplaceWhitelistUidRule)137 TEST_F(FirewallControllerTest, TestReplaceWhitelistUidRule) {
138     std::string expected =
139             "*filter\n"
140             ":FW_whitechain -\n"
141             "-A FW_whitechain -p tcp --tcp-flags RST RST -j RETURN\n"
142             "-A FW_whitechain -p icmpv6 --icmpv6-type packet-too-big -j RETURN\n"
143             "-A FW_whitechain -p icmpv6 --icmpv6-type router-solicitation -j RETURN\n"
144             "-A FW_whitechain -p icmpv6 --icmpv6-type router-advertisement -j RETURN\n"
145             "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN\n"
146             "-A FW_whitechain -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN\n"
147             "-A FW_whitechain -p icmpv6 --icmpv6-type redirect -j RETURN\n"
148             "-A FW_whitechain -m owner --uid-owner 0-9999 -j RETURN\n"
149             "-A FW_whitechain -m owner --uid-owner 10023 -j RETURN\n"
150             "-A FW_whitechain -m owner --uid-owner 10059 -j RETURN\n"
151             "-A FW_whitechain -m owner --uid-owner 10124 -j RETURN\n"
152             "-A FW_whitechain -m owner --uid-owner 10111 -j RETURN\n"
153             "-A FW_whitechain -m owner --uid-owner 110122 -j RETURN\n"
154             "-A FW_whitechain -m owner --uid-owner 210153 -j RETURN\n"
155             "-A FW_whitechain -m owner --uid-owner 210024 -j RETURN\n"
156             "-A FW_whitechain -j DROP\n"
157             "COMMIT\n\x04";
158 
159     std::vector<int32_t> uids = { 10023, 10059, 10124, 10111, 110122, 210153, 210024 };
160     EXPECT_EQ(expected, makeUidRules(V6, "FW_whitechain", true, uids));
161 }
162 
TEST_F(FirewallControllerTest,TestReplaceBlacklistUidRule)163 TEST_F(FirewallControllerTest, TestReplaceBlacklistUidRule) {
164     std::string expected =
165             "*filter\n"
166             ":FW_blackchain -\n"
167             "-A FW_blackchain -p tcp --tcp-flags RST RST -j RETURN\n"
168             "-A FW_blackchain -m owner --uid-owner 10023 -j DROP\n"
169             "-A FW_blackchain -m owner --uid-owner 10059 -j DROP\n"
170             "-A FW_blackchain -m owner --uid-owner 10124 -j DROP\n"
171             "COMMIT\n\x04";
172 
173     std::vector<int32_t> uids = { 10023, 10059, 10124 };
174     EXPECT_EQ(expected, makeUidRules(V4 ,"FW_blackchain", false, uids));
175 }
176