Google Git
Sign in
android/platform/packages/modules/NetworkStack/13c7bd497098565627370ea83f37f242cc4e05b9/./tests/unit/src/android/net/apf/ApfFilterTest.kt
blob: 0645cdd87be5cb1976b9914556f389c905750966 [file]
/*
* Copyright (C) 2024 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.net.apf
import android.content.Context
import android.net.LinkAddress
import android.net.LinkProperties
import android.net.MacAddress
import android.net.NattKeepalivePacketDataParcelable
import android.net.TcpKeepalivePacketDataParcelable
import android.net.apf.ApfCounterTracker.Counter.DROPPED_ARP_NON_IPV4
import android.net.apf.ApfCounterTracker.Counter.DROPPED_ARP_OTHER_HOST
import android.net.apf.ApfCounterTracker.Counter.DROPPED_ARP_REPLY_SPA_NO_HOST
import android.net.apf.ApfCounterTracker.Counter.DROPPED_ARP_REQUEST_REPLIED
import android.net.apf.ApfCounterTracker.Counter.DROPPED_ARP_UNKNOWN
import android.net.apf.ApfCounterTracker.Counter.DROPPED_ARP_V6_ONLY
import android.net.apf.ApfCounterTracker.Counter.DROPPED_ETHERTYPE_NOT_ALLOWED
import android.net.apf.ApfCounterTracker.Counter.DROPPED_GARP_REPLY
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_BROADCAST_ADDR
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_BROADCAST_NET
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_KEEPALIVE_ACK
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_L2_BROADCAST
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_MULTICAST
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_NATT_KEEPALIVE
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_NON_DHCP4
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV4_TCP_PORT7_UNICAST
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV6_MULTICAST_NA
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV6_NON_ICMP_MULTICAST
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV6_NS_INVALID
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV6_NS_OTHER_HOST
import android.net.apf.ApfCounterTracker.Counter.DROPPED_IPV6_NS_REPLIED_NON_DAD
import android.net.apf.ApfCounterTracker.Counter.PASSED_ETHER_OUR_SRC_MAC
import android.net.apf.ApfCounterTracker.Counter.PASSED_ARP_BROADCAST_REPLY
import android.net.apf.ApfCounterTracker.Counter.PASSED_ARP_REQUEST
import android.net.apf.ApfCounterTracker.Counter.PASSED_ARP_UNICAST_REPLY
import android.net.apf.ApfCounterTracker.Counter.PASSED_DHCP
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV4
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV4_FROM_DHCPV4_SERVER
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV4_UNICAST
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV6_ICMP
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV6_NON_ICMP
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV6_NS_DAD
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV6_NS_NO_ADDRESS
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV6_NS_NO_SLLA_OPTION
import android.net.apf.ApfCounterTracker.Counter.PASSED_IPV6_NS_TENTATIVE
import android.net.apf.ApfCounterTracker.Counter.PASSED_MLD
import android.net.apf.ApfFilter.Dependencies
import android.net.apf.ApfTestHelpers.Companion.TIMEOUT_MS
import android.net.apf.ApfTestHelpers.Companion.consumeInstalledProgram
import android.net.apf.ApfTestHelpers.Companion.consumeTransmittedPackets
import android.net.apf.ApfTestHelpers.Companion.verifyProgramRun
import android.net.apf.BaseApfGenerator.APF_VERSION_3
import android.net.apf.BaseApfGenerator.APF_VERSION_6
import android.net.ip.IpClient.IpClientCallbacksWrapper
import android.net.nsd.NsdManager
import android.net.nsd.OffloadEngine
import android.net.nsd.OffloadServiceInfo
import android.os.Build
import android.os.Handler
import android.os.HandlerThread
import android.os.SystemClock
import android.system.Os
import android.system.OsConstants.AF_UNIX
import android.system.OsConstants.IFA_F_TENTATIVE
import android.system.OsConstants.SOCK_STREAM
import androidx.test.filters.SmallTest
import com.android.internal.annotations.GuardedBy
import com.android.net.module.util.HexDump
import com.android.net.module.util.InterfaceParams
import com.android.net.module.util.NetworkStackConstants.ARP_ETHER_IPV4_LEN
import com.android.net.module.util.NetworkStackConstants.ARP_REPLY
import com.android.net.module.util.NetworkStackConstants.ARP_REQUEST
import com.android.net.module.util.NetworkStackConstants.ETHER_HEADER_LEN
import com.android.net.module.util.NetworkStackConstants.ICMPV6_NA_HEADER_LEN
import com.android.net.module.util.NetworkStackConstants.ICMPV6_NS_HEADER_LEN
import com.android.net.module.util.NetworkStackConstants.IPV6_HEADER_LEN
import com.android.net.module.util.arp.ArpPacket
import com.android.networkstack.metrics.NetworkQuirkMetrics
import com.android.networkstack.packets.NeighborAdvertisement
import com.android.networkstack.packets.NeighborSolicitation
import com.android.networkstack.util.NetworkStackUtils
import com.android.testutils.DevSdkIgnoreRule
import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
import com.android.testutils.DevSdkIgnoreRunner
import com.android.testutils.quitResources
import com.android.testutils.waitForIdle
import java.io.FileDescriptor
import java.net.Inet4Address
import java.net.Inet6Address
import java.net.InetAddress
import kotlin.test.assertContentEquals
import kotlin.test.assertEquals
import libcore.io.IoUtils
import org.junit.After
import org.junit.Before
import org.junit.Rule
import org.junit.Test
import org.junit.runner.RunWith
import org.mockito.ArgumentCaptor
import org.mockito.ArgumentMatchers.any
import org.mockito.ArgumentMatchers.anyInt
import org.mockito.ArgumentMatchers.anyLong
import org.mockito.ArgumentMatchers.eq
import org.mockito.Mock
import org.mockito.Mockito
import org.mockito.Mockito.doAnswer
import org.mockito.Mockito.doReturn
import org.mockito.Mockito.never
import org.mockito.Mockito.times
import org.mockito.Mockito.verify
import org.mockito.MockitoAnnotations
import org.mockito.invocation.InvocationOnMock
/**
* Test for APF filter.
*/
@DevSdkIgnoreRunner.MonitorThreadLeak
@RunWith(DevSdkIgnoreRunner::class)
@SmallTest
class ApfFilterTest {
companion object {
private const val THREAD_QUIT_MAX_RETRY_COUNT = 3
private const val TAG = "ApfFilterTest"
}
@get:Rule
val ignoreRule = DevSdkIgnoreRule()
@Mock
private lateinit var context: Context
@Mock private lateinit var metrics: NetworkQuirkMetrics
@Mock private lateinit var dependencies: Dependencies
@Mock private lateinit var ipClientCallback: IpClientCallbacksWrapper
@Mock private lateinit var nsdManager: NsdManager
@GuardedBy("mApfFilterCreated")
private val mApfFilterCreated = ArrayList<AndroidPacketFilter>()
private val loInterfaceParams = InterfaceParams.getByName("lo")
private val ifParams =
InterfaceParams(
"lo",
loInterfaceParams.index,
MacAddress.fromBytes(byteArrayOf(2, 3, 4, 5, 6, 7)),
loInterfaceParams.defaultMtu
)
private val hostIpv4Address = byteArrayOf(10, 0, 0, 1)
private val senderIpv4Address = byteArrayOf(10, 0, 0, 2)
private val arpBroadcastMacAddress = intArrayOf(0xff, 0xff, 0xff, 0xff, 0xff, 0xff)
.map { it.toByte() }.toByteArray()
private val senderMacAddress = intArrayOf(0x02, 0x22, 0x33, 0x44, 0x55, 0x66)
.map { it.toByte() }.toByteArray()
private val senderIpv6Address =
// 2001::200:1a:1122:3344
intArrayOf(0x20, 0x01, 0, 0, 0, 0, 0, 0, 0x02, 0, 0, 0x1a, 0x11, 0x22, 0x33, 0x44)
.map{ it.toByte() }.toByteArray()
private val hostIpv6Addresses = listOf(
// 2001::200:1a:3344:1122
intArrayOf(0x20, 0x01, 0, 0, 0, 0, 0, 0, 0x02, 0, 0, 0x1a, 0x33, 0x44, 0x11, 0x22)
.map{ it.toByte() }.toByteArray(),
// 2001::100:1b:4455:6677
intArrayOf(0x20, 0x01, 0, 0, 0, 0, 0, 0, 0x01, 0, 0, 0x1b, 0x44, 0x55, 0x66, 0x77)
.map{ it.toByte() }.toByteArray()
)
private val hostIpv6TentativeAddresses = listOf(
// 2001::200:1a:1234:5678
intArrayOf(0x20, 0x01, 0, 0, 0, 0, 0, 0, 0x02, 0, 0, 0x1a, 0x12, 0x34, 0x56, 0x78)
.map{ it.toByte() }.toByteArray(),
// 2001::100:1b:1234:5678
intArrayOf(0x20, 0x01, 0, 0, 0, 0, 0, 0, 0x01, 0, 0, 0x1b, 0x12, 0x34, 0x56, 0x78)
.map{ it.toByte() }.toByteArray()
)
private val hostAnycast6Addresses = listOf(
// 2001::100:1b:aabb:ccdd
intArrayOf(0x20, 0x01, 0, 0, 0, 0, 0, 0, 0x01, 0, 0, 0x1b, 0xaa, 0xbb, 0xcc, 0xdd)
.map{ it.toByte() }.toByteArray()
)
private val hostMulticastMacAddresses = listOf(
// 33:33:00:00:00:01
intArrayOf(0x33, 0x33, 0, 0, 0, 1).map { it.toByte() }.toByteArray(),
// 33:33:ff:44:11:22
intArrayOf(0x33, 0x33, 0xff, 0x44, 0x11, 0x22).map { it.toByte() }.toByteArray(),
// 33:33:ff:55:66:77
intArrayOf(0x33, 0x33, 0xff, 0x55, 0x66, 0x77).map { it.toByte() }.toByteArray(),
// 33:33:ff:bb:cc:dd
intArrayOf(0x33, 0x33, 0xff, 0xbb, 0xcc, 0xdd).map { it.toByte() }.toByteArray(),
)
private val handlerThread by lazy {
HandlerThread("$TAG handler thread").apply { start() }
}
private val handler by lazy { Handler(handlerThread.looper) }
private var writerSocket = FileDescriptor()
@Before
fun setUp() {
MockitoAnnotations.initMocks(this)
// mock anycast6 address from /proc/net/anycast6
doReturn(hostAnycast6Addresses).`when`(dependencies).getAnycast6Addresses(any())
// mock ether multicast mac address from /proc/net/dev_mcast
doReturn(hostMulticastMacAddresses).`when`(dependencies).getEtherMulticastAddresses(any())
// mock nd traffic class from /proc/sys/net/ipv6/conf/{ifname}/ndisc_tclass
doReturn(0).`when`(dependencies).getNdTrafficClass(any())
doAnswer { invocation: InvocationOnMock ->
synchronized(mApfFilterCreated) {
mApfFilterCreated.add(invocation.getArgument(0))
}
}.`when`(dependencies).onApfFilterCreated(any())
doReturn(SystemClock.elapsedRealtime()).`when`(dependencies).elapsedRealtime()
val readSocket = FileDescriptor()
Os.socketpair(AF_UNIX, SOCK_STREAM, 0, writerSocket, readSocket)
doReturn(readSocket).`when`(dependencies).createPacketReaderSocket(anyInt())
doReturn(nsdManager).`when`(context).getSystemService(NsdManager::class.java)
}
private fun shutdownApfFilters() {
quitResources(THREAD_QUIT_MAX_RETRY_COUNT, {
synchronized(mApfFilterCreated) {
val ret = ArrayList(mApfFilterCreated)
mApfFilterCreated.clear()
return@quitResources ret
}
}, { apf: AndroidPacketFilter ->
handler.post { apf.shutdown() }
})
synchronized(mApfFilterCreated) {
assertEquals(
0,
mApfFilterCreated.size.toLong(),
"ApfFilters did not fully shutdown."
)
}
}
@After
fun tearDown() {
IoUtils.closeQuietly(writerSocket)
shutdownApfFilters()
handler.waitForIdle(TIMEOUT_MS)
Mockito.framework().clearInlineMocks()
ApfJniUtils.resetTransmittedPacketMemory()
handlerThread.quitSafely()
handlerThread.join()
}
private fun getDefaultConfig(apfVersion: Int = APF_VERSION_6): ApfFilter.ApfConfiguration {
val config = ApfFilter.ApfConfiguration()
config.apfVersionSupported = apfVersion
// 4K is the highly recommended value in APFv6 for vendor
config.apfRamSize = 4096
config.multicastFilter = false
config.ieee802_3Filter = false
config.ethTypeBlackList = IntArray(0)
config.shouldHandleArpOffload = true
config.shouldHandleNdOffload = true
return config
}
private fun getApfFilter(
apfCfg: ApfFilter.ApfConfiguration = getDefaultConfig(APF_VERSION_6)
): ApfFilter {
lateinit var apfFilter: ApfFilter
handler.post {
apfFilter = ApfFilter(
handler,
context,
apfCfg,
ifParams,
ipClientCallback,
metrics,
dependencies
)
}
handlerThread.waitForIdle(TIMEOUT_MS)
return apfFilter
}
private fun doTestEtherTypeAllowListFilter(apfFilter: ApfFilter) {
val program = consumeInstalledProgram(ipClientCallback, installCnt = 2)
// Using scapy to generate IPv4 mDNS packet:
// eth = Ether(src="E8:9F:80:66:60:BB", dst="01:00:5E:00:00:FB")
// ip = IP(src="192.168.1.1")
// udp = UDP(sport=5353, dport=5353)
// dns = DNS(qd=DNSQR(qtype="PTR", qname="a.local"))
// p = eth/ip/udp/dns
val mdnsPkt = """
01005e0000fbe89f806660bb080045000035000100004011d812c0a80101e00000f
b14e914e900214d970000010000010000000000000161056c6f63616c00000c0001
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(mdnsPkt),
PASSED_IPV4
)
// Using scapy to generate RA packet:
// eth = Ether(src="E8:9F:80:66:60:BB", dst="33:33:00:00:00:01")
// ip6 = IPv6(src="fe80::1", dst="ff02::1")
// icmp6 = ICMPv6ND_RA(routerlifetime=3600, retranstimer=3600)
// p = eth/ip6/icmp6
val raPkt = """
333300000001e89f806660bb86dd6000000000103afffe800000000000000000000000
000001ff0200000000000000000000000000018600600700080e100000000000000e10
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(raPkt),
PASSED_IPV6_ICMP
)
// Using scapy to generate ethernet packet with type 0x88A2:
// p = Ether(type=0x88A2)/Raw(load="01")
val ethPkt = "ffffffffffff047bcb463fb588a23031"
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(ethPkt),
DROPPED_ETHERTYPE_NOT_ALLOWED
)
}
private fun generateNsPacket(
srcMac: ByteArray,
dstMac: ByteArray,
srcIp: ByteArray,
dstIp: ByteArray,
target: ByteArray,
): ByteArray {
val nsPacketBuf = NeighborSolicitation.build(
MacAddress.fromBytes(srcMac),
MacAddress.fromBytes(dstMac),
InetAddress.getByAddress(srcIp) as Inet6Address,
InetAddress.getByAddress(dstIp) as Inet6Address,
InetAddress.getByAddress(target) as Inet6Address
)
val nsPacket = ByteArray(
ETHER_HEADER_LEN + IPV6_HEADER_LEN + ICMPV6_NS_HEADER_LEN + 8 // option length
)
nsPacketBuf.get(nsPacket)
return nsPacket
}
private fun generateNaPacket(
srcMac: ByteArray,
dstMac: ByteArray,
srcIp: ByteArray,
dstIp: ByteArray,
flags: Int,
target: ByteArray,
): ByteArray {
val naPacketBuf = NeighborAdvertisement.build(
MacAddress.fromBytes(srcMac),
MacAddress.fromBytes(dstMac),
InetAddress.getByAddress(srcIp) as Inet6Address,
InetAddress.getByAddress(dstIp) as Inet6Address,
flags,
InetAddress.getByAddress(target) as Inet6Address
)
val naPacket = ByteArray(
ETHER_HEADER_LEN + IPV6_HEADER_LEN + ICMPV6_NA_HEADER_LEN + 8 // lla option length
)
naPacketBuf.get(naPacket)
return naPacket
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
fun testV4EtherTypeAllowListFilter() {
val apfFilter = getApfFilter(getDefaultConfig(APF_VERSION_3))
doTestEtherTypeAllowListFilter(apfFilter)
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
fun testV6EtherTypeAllowListFilter() {
val apfFilter = getApfFilter(getDefaultConfig(APF_VERSION_6))
doTestEtherTypeAllowListFilter(apfFilter)
}
@Test
fun testIPv4PacketFilterOnV6OnlyNetwork() {
val apfFilter = getApfFilter()
apfFilter.updateClatInterfaceState(true)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 3)
// Using scapy to generate IPv4 mDNS packet:
// eth = Ether(src="E8:9F:80:66:60:BB", dst="01:00:5E:00:00:FB")
// ip = IP(src="192.168.1.1")
// udp = UDP(sport=5353, dport=5353)
// dns = DNS(qd=DNSQR(qtype="PTR", qname="a.local"))
// p = eth/ip/udp/dns
val mdnsPkt = """
01005e0000fbe89f806660bb080045000035000100004011d812c0a80101e00000f
b14e914e900214d970000010000010000000000000161056c6f63616c00000c0001
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(mdnsPkt),
DROPPED_IPV4_NON_DHCP4
)
// Using scapy to generate non UDP protocol packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='255.255.255.255', proto=12)
// pkt = ether/ip
val nonUdpPkt = """
ffffffffffff00112233445508004500001400010000400cb934c0a80101ffffffff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonUdpPkt),
DROPPED_IPV4_NON_DHCP4
)
// Using scapy to generate fragmented UDP protocol packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='255.255.255.255', flags=1, frag=10, proto=17)
// pkt = ether/ip
val fragmentUdpPkt = """
ffffffffffff0011223344550800450000140001200a40119925c0a80101ffffffff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(fragmentUdpPkt),
DROPPED_IPV4_NON_DHCP4
)
// Using scapy to generate destination port is not DHCP client port packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='255.255.255.255')
// udp = UDP(dport=70)
// pkt = ether/ip/udp
val nonDhcpServerPkt = """
ffffffffffff00112233445508004500001c000100004011b927c0a80101ffffffff0035004600083dba
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDhcpServerPkt),
DROPPED_IPV4_NON_DHCP4
)
// Using scapy to generate DHCP4 offer packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='255.255.255.255')
// udp = UDP(sport=67, dport=68)
// bootp = BOOTP(op=2,
// yiaddr='192.168.1.100',
// siaddr='192.168.1.1',
// chaddr=b'\x00\x11\x22\x33\x44\x55')
// dhcp_options = [('message-type', 'offer'),
// ('server_id', '192.168.1.1'),
// ('subnet_mask', '255.255.255.0'),
// ('router', '192.168.1.1'),
// ('lease_time', 86400),
// ('name_server', '8.8.8.8'),
// 'end']
// dhcp = DHCP(options=dhcp_options)
// dhcp_offer_packet = ether/ip/udp/bootp/dhcp
val dhcp4Pkt = """
ffffffffffff00112233445508004500012e000100004011b815c0a80101ffffffff0043
0044011a5ffc02010600000000000000000000000000c0a80164c0a80101000000000011
223344550000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000638253633501023604c0
a801010104ffffff000304c0a80101330400015180060408080808ff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(dhcp4Pkt),
PASSED_IPV4_FROM_DHCPV4_SERVER
)
// Duplicate of dhcp4Pkt with DF flag set.
val dhcp4PktDf = """
ffffffffffff00112233445508004500012e000140004011b815c0a80101ffffffff0043
0044011a5ffc02010600000000000000000000000000c0a80164c0a80101000000000011
223344550000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000638253633501023604c0
a801010104ffffff000304c0a80101330400015180060408080808ff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(dhcp4PktDf),
PASSED_IPV4_FROM_DHCPV4_SERVER
)
// Using scapy to generate DHCP4 offer packet:
// eth = Ether(src="E8:9F:80:66:60:BB", dst="01:00:5E:00:00:FB")
// ip = IP(src="192.168.1.10", dst="192.168.1.20") # IPv4
// udp = UDP(sport=12345, dport=53)
// dns = DNS(qd=DNSQR(qtype="PTR", qname="a.local"))
// pkt = eth / ip / udp / dns
// fragments = fragment(pkt, fragsize=30)
// fragments[1]
val fragmentedUdpPkt = """
01005e0000fbe89f806660bb08004500001d000100034011f75dc0a8010ac0a8
01146f63616c00000c0001
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(fragmentedUdpPkt),
DROPPED_IPV4_NON_DHCP4
)
}
@Test
fun testLoopbackFilter() {
val apfConfig = getDefaultConfig()
val apfFilter = getApfFilter(apfConfig)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 2)
// Using scapy to generate echo-ed broadcast packet:
// ether = Ether(src=${ifParams.macAddr}, dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='255.255.255.255', proto=21)
// pkt = ether/ip
val nonDhcpBcastPkt = """
ffffffffffff020304050607080045000014000100004015b92bc0a80101ffffffff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDhcpBcastPkt),
PASSED_ETHER_OUR_SRC_MAC
)
}
@Test
fun testIPv4MulticastPacketFilter() {
val apfConfig = getDefaultConfig()
apfConfig.multicastFilter = true
val apfFilter = getApfFilter(apfConfig)
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val linkAddress = LinkAddress(InetAddress.getByAddress(hostIpv4Address), 24)
val lp = LinkProperties()
lp.addLinkAddress(linkAddress)
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// Using scapy to generate DHCP4 offer packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='255.255.255.255')
// udp = UDP(sport=67, dport=68)
// bootp = BOOTP(op=2,
// yiaddr='192.168.1.100',
// siaddr='192.168.1.1',
// chaddr=b'\x02\x03\x04\x05\x06\x07')
// dhcp_options = [('message-type', 'offer'),
// ('server_id', '192.168.1.1'),
// ('subnet_mask', '255.255.255.0'),
// ('router', '192.168.1.1'),
// ('lease_time', 86400),
// ('name_server', '8.8.8.8'),
// 'end']
// dhcp = DHCP(options=dhcp_options)
// dhcp_offer_packet = ether/ip/udp/bootp/dhcp
val dhcp4Pkt = """
ffffffffffff00112233445508004500012e000100004011b815c0a80101ffffffff0043
0044011a5ffc02010600000000000000000000000000c0a80164c0a80101000000000203
040506070000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000638253633501023604c0
a801010104ffffff000304c0a80101330400015180060408080808ff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(dhcp4Pkt),
PASSED_DHCP
)
// Using scapy to generate non DHCP multicast packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='224.0.0.1', proto=21)
// pkt = ether/ip
val nonDhcpMcastPkt = """
ffffffffffff001122334455080045000014000100004015d929c0a80101e0000001
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDhcpMcastPkt),
DROPPED_IPV4_MULTICAST
)
// Using scapy to generate non DHCP broadcast packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='255.255.255.255', proto=21)
// pkt = ether/ip
val nonDhcpBcastPkt = """
ffffffffffff001122334455080045000014000100004015b92bc0a80101ffffffff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDhcpBcastPkt),
DROPPED_IPV4_BROADCAST_ADDR
)
// Using scapy to generate non DHCP subnet broadcast packet:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='10.0.0.255', proto=21)
// pkt = ether/ip
val nonDhcpNetBcastPkt = """
ffffffffffff001122334455080045000014000100004015ae2cc0a801010a0000ff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDhcpNetBcastPkt),
DROPPED_IPV4_BROADCAST_NET
)
// Using scapy to generate non DHCP unicast packet:
// ether = Ether(src='00:11:22:33:44:55', dst='02:03:04:05:06:07')
// ip = IP(src='192.168.1.1', dst='192.168.1.2', proto=21)
// pkt = ether/ip
val nonDhcpUcastPkt = """
020304050607001122334455080045000014000100004015f780c0a80101c0a80102
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDhcpUcastPkt),
PASSED_IPV4_UNICAST
)
// Using scapy to generate non DHCP unicast packet with broadcast ether destination:
// ether = Ether(src='00:11:22:33:44:55', dst='ff:ff:ff:ff:ff:ff')
// ip = IP(src='192.168.1.1', dst='192.168.1.2', proto=21)
// pkt = ether/ip
val nonDhcpUcastL2BcastPkt = """
ffffffffffff001122334455080045000014000100004015f780c0a80101c0a80102
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDhcpUcastL2BcastPkt),
DROPPED_IPV4_L2_BROADCAST
)
}
@Test
fun testArpFilterDropPktsOnV6OnlyNetwork() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
apfFilter.updateClatInterfaceState(true)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// Drop ARP request packet when clat is enabled
// Using scapy to generate ARP request packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP()
// pkt = eth/arp
val arpPkt = """
010203040506000102030405080600010800060400015c857e3c74e1c0a8012200000000000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(arpPkt),
DROPPED_ARP_V6_ONLY
)
}
@Test
fun testIPv4TcpKeepaliveFilter() {
val srcAddr = byteArrayOf(10, 0, 0, 5)
val dstAddr = byteArrayOf(10, 0, 0, 6)
val srcPort = 12345
val dstPort = 54321
val seqNum = 2123456789
val ackNum = 1234567890
// src: 10.0.0.5:12345
// dst: 10.0.0.6:54321
val parcel = TcpKeepalivePacketDataParcelable()
parcel.srcAddress = InetAddress.getByAddress(srcAddr).address
parcel.srcPort = srcPort
parcel.dstAddress = InetAddress.getByAddress(dstAddr).address
parcel.dstPort = dstPort
parcel.seq = seqNum
parcel.ack = ackNum
val apfConfig = getDefaultConfig()
apfConfig.multicastFilter = true
apfConfig.ieee802_3Filter = true
val apfFilter = getApfFilter(apfConfig)
consumeInstalledProgram(ipClientCallback, installCnt = 2)
apfFilter.addTcpKeepalivePacketFilter(1, parcel)
var program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// Drop IPv4 keepalive ack
// Using scapy to generate IPv4 TCP keepalive ack packet with seq + 1:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5')
// tcp = TCP(sport=54321, dport=12345, flags="A", seq=1234567890, ack=2123456790)
// pkt = eth/ip/tcp
val keepaliveAckPkt = """
01020304050600010203040508004500002800010000400666c50a0000060a000005d4313039499602d2
7e916116501020004b4f0000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(keepaliveAckPkt),
DROPPED_IPV4_KEEPALIVE_ACK
)
// Pass IPv4 non-keepalive ack from the same source address
// Using scapy to generate IPv4 TCP non-keepalive ack from the same source address:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5')
// tcp = TCP(sport=54321, dport=12345, flags="A", seq=1234567990, ack=2123456789)
// pkt = eth/ip/tcp
val nonKeepaliveAckPkt1 = """
01020304050600010203040508004500002800010000400666c50a0000060a000005d431303949960336
7e916115501020004aec0000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(nonKeepaliveAckPkt1),
PASSED_IPV4_UNICAST
)
// Pass IPv4 non-keepalive ack from the same source address
// Using scapy to generate IPv4 TCP non-keepalive ack from the same source address:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5')
// tcp = TCP(sport=54321, dport=12345, flags="A", seq=1234567890, ack=2123456790)
// payload = Raw(b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09')
// pkt = eth/ip/tcp/payload
val nonKeepaliveAckPkt2 = """
01020304050600010203040508004500003200010000400666bb0a0000060a000005d4313039499602d27
e91611650102000372c000000010203040506070809
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(nonKeepaliveAckPkt2),
PASSED_IPV4_UNICAST
)
// Pass IPv4 keepalive ack from another address
// Using scapy to generate IPv4 TCP keepalive ack from another address:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.7', dst='10.0.0.5')
// tcp = TCP(sport=23456, dport=65432, flags="A", seq=2123456780, ack=1123456789)
// pkt = eth/ip/tcp
val otherSrcKeepaliveAck = """
01020304050600010203040508004500002800010000400666c40a0000070a0000055ba0ff987e91610c4
2f697155010200066e60000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(otherSrcKeepaliveAck),
PASSED_IPV4_UNICAST
)
// test IPv4 packets when TCP keepalive filter is removed
apfFilter.removeKeepalivePacketFilter(1)
program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(keepaliveAckPkt),
PASSED_IPV4_UNICAST
)
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(otherSrcKeepaliveAck),
PASSED_IPV4_UNICAST
)
}
@Test
fun testIPv4NattKeepaliveFilter() {
val srcAddr = byteArrayOf(10, 0, 0, 5)
val dstAddr = byteArrayOf(10, 0, 0, 6)
val srcPort = 1024
val dstPort = 4500
// src: 10.0.0.5:1024
// dst: 10.0.0.6:4500
val parcel = NattKeepalivePacketDataParcelable()
parcel.srcAddress = InetAddress.getByAddress(srcAddr).address
parcel.srcPort = srcPort
parcel.dstAddress = InetAddress.getByAddress(dstAddr).address
parcel.dstPort = dstPort
val apfConfig = getDefaultConfig()
apfConfig.multicastFilter = true
apfConfig.ieee802_3Filter = true
val apfFilter = getApfFilter(apfConfig)
consumeInstalledProgram(ipClientCallback, installCnt = 2)
apfFilter.addNattKeepalivePacketFilter(1, parcel)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// Drop IPv4 keepalive response packet
// Using scapy to generate IPv4 NAT-T keepalive ack packet with payload 0xff:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5')
// udp = UDP(sport=4500, dport=1024)
// payload = NAT_KEEPALIVE(nat_keepalive=0xff)
// pkt = eth/ip/udp/payload
val validNattPkt = """
01020304050600010203040508004500001d00010000401166c50a0000060a000005119404000009d73cff
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(validNattPkt),
DROPPED_IPV4_NATT_KEEPALIVE
)
// Pass IPv4 keepalive response packet with 0xfe payload
// Using scapy to generate IPv4 NAT-T keepalive ack packet with payload 0xfe:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5')
// udp = UDP(sport=4500, dport=1024)
// payload = NAT_KEEPALIVE(nat_keepalive=0xfe)
// pkt = eth/ip/udp/payload
val invalidNattPkt = """
01020304050600010203040508004500001d00010000401166c50a0000060a000005119404000009d83cfe
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(invalidNattPkt),
PASSED_IPV4_UNICAST
)
// Pass IPv4 non-keepalive response packet from the same source address
// Using scapy to generate IPv4 NAT-T keepalive ack packet with payload 0xfe:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5')
// udp = UDP(sport=4500, dport=1024)
// payload = Raw(b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09')
// pkt = eth/ip/udp/payload
val nonNattPkt = """
01020304050600010203040508004500002600010000401166bc0a0000060a000005119404000012c2120
0010203040506070809
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(nonNattPkt),
PASSED_IPV4_UNICAST
)
// Pass IPv4 non-keepalive response packet from other source address
// Using scapy to generate IPv4 NAT-T keepalive ack packet with payload 0xfe:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.7', dst='10.0.0.5')
// udp = UDP(sport=4500, dport=1024)
// payload = Raw(b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09')
// pkt = eth/ip/udp/payload
val otherSrcNonNattPkt = """
01020304050600010203040508004500002600010000401166bb0a0000070a000005119404000012c2110
0010203040506070809
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(otherSrcNonNattPkt),
PASSED_IPV4_UNICAST
)
}
@Test
fun testIPv4TcpPort7Filter() {
val apfFilter = getApfFilter()
val program = consumeInstalledProgram(ipClientCallback, installCnt = 2)
// Drop IPv4 TCP port 7 packet
// Using scapy to generate IPv4 TCP port 7 packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5')
// tcp = TCP(dport=7)
// pkt = eth/ip/tcp
val tcpPort7Pkt = """
01020304050600010203040508004500002800010000400666c50a0000060a00000500140007000000000
0000000500220007bbd0000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(tcpPort7Pkt),
DROPPED_IPV4_TCP_PORT7_UNICAST
)
// Pass IPv4 TCP initial fragment packet
// Using scapy to generate IPv4 TCP initial fragment packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5', flags=1, frag=0)
// tcp = TCP()
// pkt = eth/ip/tcp
val initialFragmentTcpPkt = """
01020304050600010203040508004500002800012000400646c50a0000060a00000500140050000000000
0000000500220007b740000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(initialFragmentTcpPkt),
PASSED_IPV4
)
// Pass IPv4 TCP fragment packet
// Using scapy to generate IPv4 TCP fragment packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip = IP(src='10.0.0.6', dst='10.0.0.5', flags=1, frag=100)
// tcp = TCP()
// pkt = eth/ip/tcp
val fragmentTcpPkt = """
01020304050600010203040508004500002800012064400646610a0000060a00000500140050000000000
0000000500220007b740000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(fragmentTcpPkt),
PASSED_IPV4
)
}
@Test
fun testIPv6MulticastPacketFilterInDozeMode() {
val apfConfig = getDefaultConfig()
apfConfig.multicastFilter = true
val apfFilter = getApfFilter(apfConfig)
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val lp = LinkProperties()
for (addr in hostIpv6Addresses) {
lp.addLinkAddress(LinkAddress(InetAddress.getByAddress(addr), 64))
}
apfFilter.setLinkProperties(lp)
apfFilter.setDozeMode(true)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 2)
// Using scapy to generate non ICMPv6 sent to ff00::/8 (multicast prefix) packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="ff00::1", nh=59)
// pkt = eth/ip6
val nonIcmpv6McastPkt = """
ffffffffffff00112233445586dd6000000000003b4020010000000000000200001a11223344ff00000
0000000000000000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(nonIcmpv6McastPkt),
DROPPED_IPV6_NON_ICMP_MULTICAST
)
// Using scapy to generate ICMPv6 echo sent to ff00::/8 (multicast prefix) packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="ff00::1", hlim=255)
// icmp6 = ICMPv6EchoRequest()
// pkt = eth/ip6/icmp6
val icmpv6EchoPkt = """
02030405060700010203040586dd6000000000083aff20010000000000000200001a11223344ff00000
000000000000000000000000180001a3a00000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(icmpv6EchoPkt),
DROPPED_IPV6_NON_ICMP_MULTICAST
)
}
@Test
fun testIPv6PacketFilter() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val lp = LinkProperties()
for (addr in hostIpv6Addresses) {
lp.addLinkAddress(LinkAddress(InetAddress.getByAddress(addr), 64))
}
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// Using scapy to generate non ICMPv6 packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", nh=59)
// pkt = eth/ip6
val nonIcmpv6Pkt = """
ffffffffffff00112233445586dd6000000000003b4020010000000000000200001a112233442001000
0000000000200001a33441122
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(nonIcmpv6Pkt),
PASSED_IPV6_NON_ICMP
)
// Using scapy to generate ICMPv6 NA sent to ff02::/120 packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="ff02::1")
// icmp6 = ICMPv6ND_NA()
// pkt = eth/ip6/icmp6
val icmpv6McastNaPkt = """
01020304050600010203040586dd6000000000183aff20010000000000000200001a11223344ff02000
000000000000000000000000188007227a000000000000000000000000000000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(icmpv6McastNaPkt),
DROPPED_IPV6_MULTICAST_NA
)
// Using scapy to generate IPv6 packet with hop-by-hop option:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", nh=0)
// pkt = eth/ip6
val ipv6WithHopByHopOptionPkt = """
01020304050600010203040586dd600000000000004020010000000000000200001a112233442001000
0000000000200001a33441122
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(ipv6WithHopByHopOptionPkt),
PASSED_MLD
)
}
@Test
fun testArpFilterDropPktsNoIPv4() {
val apfFilter = getApfFilter()
val program = consumeInstalledProgram(ipClientCallback, installCnt = 2)
// Drop ARP request packet with invalid hw type
// Using scapy to generate ARP request packet with invalid hw type :
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP(hwtype=3)
// pkt = eth/arp
val invalidHwTypePkt = """
01020304050600010203040508060003080000040001c0a8012200000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(invalidHwTypePkt),
DROPPED_ARP_NON_IPV4
)
// Drop ARP request packet with invalid proto type
// Using scapy to generate ARP request packet with invalid proto type:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP(ptype=20)
// pkt = eth/arp
val invalidProtoTypePkt = """
010203040506000102030405080600010014060000015c857e3c74e1000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(invalidProtoTypePkt),
DROPPED_ARP_NON_IPV4
)
// Drop ARP request packet with invalid hw len
// Using scapy to generate ARP request packet with invalid hw len:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP(hwlen=20)
// pkt = eth/arp
val invalidHwLenPkt = """
01020304050600010203040508060001080014040001000000000000000000000000
0000000000000000c0a8012200000000000000000000000000000000000000000000
0000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(invalidHwLenPkt),
DROPPED_ARP_NON_IPV4
)
// Drop ARP request packet with invalid proto len
// Using scapy to generate ARP request packet with invalid proto len:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP(plen=20)
// pkt = eth/arp
val invalidProtoLenPkt = """
010203040506000102030405080600010800061400015c857e3c74e1000000000000
00000000000000000000000000000000000000000000000000000000000000000000
000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(invalidProtoLenPkt),
DROPPED_ARP_NON_IPV4
)
// Drop ARP request packet with invalid opcode
// Using scapy to generate ARP request packet with invalid opcode:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP(op=5)
// pkt = eth/arp
val invalidOpPkt = """
010203040506000102030405080600010800060400055c857e3c74e1c0a8012200000000000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(invalidOpPkt),
DROPPED_ARP_UNKNOWN
)
// Drop ARP reply packet with zero source protocol address
// Using scapy to generate ARP request packet with zero source protocol address:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP(op=2, psrc="0.0.0.0)
// pkt = eth/arp
val noHostArpReplyPkt = """
010203040506000102030405080600010800060400025c857e3c74e10000000000000000000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(noHostArpReplyPkt),
DROPPED_ARP_REPLY_SPA_NO_HOST
)
// Drop ARP reply packet with ethernet broadcast destination
// Using scapy to generate ARP reply packet with ethernet broadcast destination:
// eth = Ether(src="00:01:02:03:04:05", dst="FF:FF:FF:FF:FF:FF")
// arp = ARP(op=2, pdst="0.0.0.0")
// pkt = eth/arp
val garpReplyPkt = """
ffffffffffff000102030405080600010800060400025c857e3c74e1c0a8012200000000000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(garpReplyPkt),
DROPPED_GARP_REPLY
)
}
@Test
fun testArpFilterPassPktsNoIPv4() {
val apfFilter = getApfFilter()
val program = consumeInstalledProgram(ipClientCallback, installCnt = 2)
// Pass non-broadcast ARP reply packet
// Using scapy to generate unicast ARP reply packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// arp = ARP(op=2, psrc="1.2.3.4")
// pkt = eth/arp
val nonBcastArpReplyPkt = """
010203040506000102030405080600010800060400025c857e3c74e10102030400000000000000000000
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(nonBcastArpReplyPkt),
PASSED_ARP_UNICAST_REPLY
)
// Pass ARP request packet if device doesn't have any IPv4 address
// Using scapy to generate ARP request packet:
// eth = Ether(src="00:01:02:03:04:05", dst="FF:FF:FF:FF:FF:FF")
// arp = ARP(op=1, pdst="1.2.3.4")
// pkt = eth/arp
val arpRequestPkt = """
ffffffffffff000102030405080600010800060400015c857e3c74e1c0a8012200000000000001020304
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(arpRequestPkt),
PASSED_ARP_REQUEST
)
}
@Test
fun testArpFilterDropPktsWithIPv4() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val linkAddress = LinkAddress(InetAddress.getByAddress(hostIpv4Address), 24)
val lp = LinkProperties()
lp.addLinkAddress(linkAddress)
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// Drop ARP reply packet is not for the device
// Using scapy to generate ARP reply packet not for the device:
// eth = Ether(src="00:01:02:03:04:05", dst="FF:FF:FF:FF:FF:FF")
// arp = ARP(op=2, pdst="1.2.3.4")
// pkt = eth/arp
val otherHostArpReplyPkt = """
ffffffffffff000102030405080600010800060400025c857e3c74e1c0a8012200000000000001020304
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(otherHostArpReplyPkt),
DROPPED_ARP_OTHER_HOST
)
// Drop broadcast ARP request packet not for the device
// Using scapy to generate ARP broadcast request packet not for the device:
// eth = Ether(src="00:01:02:03:04:05", dst="FF:FF:FF:FF:FF:FF")
// arp = ARP(op=1, pdst="1.2.3.4")
// pkt = eth/arp
val otherHostArpRequestPkt = """
ffffffffffff000102030405080600010800060400015c857e3c74e1c0a8012200000000000001020304
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(otherHostArpRequestPkt),
DROPPED_ARP_OTHER_HOST
)
}
@Test
fun testArpFilterPassPktsWithIPv4() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val linkAddress = LinkAddress(InetAddress.getByAddress(hostIpv4Address), 24)
val lp = LinkProperties()
lp.addLinkAddress(linkAddress)
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// Using scapy to generate ARP broadcast reply packet:
// eth = Ether(src="00:01:02:03:04:05", dst="FF:FF:FF:FF:FF:FF")
// arp = ARP(op=2, pdst="10.0.0.1")
// pkt = eth/arp
val bcastArpReplyPkt = """
ffffffffffff000102030405080600010800060400025c857e3c74e1c0a801220000000000000a000001
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
APF_VERSION_6,
program,
HexDump.hexStringToByteArray(bcastArpReplyPkt),
PASSED_ARP_BROADCAST_REPLY
)
}
// The APFv6 code path is only turned on in V+
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@Test
fun testArpTransmit() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val linkAddress = LinkAddress(InetAddress.getByAddress(hostIpv4Address), 24)
val lp = LinkProperties()
lp.addLinkAddress(linkAddress)
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
val receivedArpPacketBuf = ArpPacket.buildArpPacket(
arpBroadcastMacAddress,
senderMacAddress,
hostIpv4Address,
HexDump.hexStringToByteArray("000000000000"),
senderIpv4Address,
ARP_REQUEST.toShort()
)
val receivedArpPacket = ByteArray(ARP_ETHER_IPV4_LEN)
receivedArpPacketBuf.get(receivedArpPacket)
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
receivedArpPacket,
DROPPED_ARP_REQUEST_REPLIED
)
val transmittedPackets = consumeTransmittedPackets(1)
val expectedArpReplyBuf = ArpPacket.buildArpPacket(
senderMacAddress,
apfFilter.mHardwareAddress,
senderIpv4Address,
senderMacAddress,
hostIpv4Address,
ARP_REPLY.toShort()
)
val expectedArpReplyPacket = ByteArray(ARP_ETHER_IPV4_LEN)
expectedArpReplyBuf.get(expectedArpReplyPacket)
assertContentEquals(
expectedArpReplyPacket + ByteArray(18) { 0 },
transmittedPackets[0]
)
}
@Test
fun testArpOffloadDisabled() {
val apfConfig = getDefaultConfig()
apfConfig.shouldHandleArpOffload = false
val apfFilter = getApfFilter(apfConfig)
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val linkAddress = LinkAddress(InetAddress.getByAddress(hostIpv4Address), 24)
val lp = LinkProperties()
lp.addLinkAddress(linkAddress)
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
val receivedArpPacketBuf = ArpPacket.buildArpPacket(
arpBroadcastMacAddress,
senderMacAddress,
hostIpv4Address,
HexDump.hexStringToByteArray("000000000000"),
senderIpv4Address,
ARP_REQUEST.toShort()
)
val receivedArpPacket = ByteArray(ARP_ETHER_IPV4_LEN)
receivedArpPacketBuf.get(receivedArpPacket)
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
receivedArpPacket,
PASSED_ARP_REQUEST
)
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
fun testNsFilterNoIPv6() {
doReturn(listOf<ByteArray>()).`when`(dependencies).getAnycast6Addresses(any())
val apfFilter = getApfFilter()
// validate NS packet check when there is no IPv6 address
val program = consumeInstalledProgram(ipClientCallback, installCnt = 2)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="01:02:03:04:05:06")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// pkt = eth/ip6/icmp6
val nsPkt = """
01020304050600010203040586DD6000000000183AFF200100000000000
00200001A1122334420010000000000000200001A334411228700452900
00000020010000000000000200001A33441122
""".replace("\\s+".toRegex(), "").trim()
// when there is no IPv6 addresses -> pass NS packet
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nsPkt),
PASSED_IPV6_NS_NO_ADDRESS
)
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
fun testNsFilter() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
val lp = LinkProperties()
for (addr in hostIpv6Addresses) {
lp.addLinkAddress(LinkAddress(InetAddress.getByAddress(addr), 64))
}
for (addr in hostIpv6TentativeAddresses) {
lp.addLinkAddress(
LinkAddress(
InetAddress.getByAddress(addr),
64,
IFA_F_TENTATIVE,
0
)
)
}
apfFilter.setLinkProperties(lp)
consumeInstalledProgram(ipClientCallback, installCnt = 1)
apfFilter.updateClatInterfaceState(true)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
// validate Ethernet dst address check
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="00:05:04:03:02:01")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptDstLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val nonHostDstMacNsPkt = """
00050403020100010203040586DD6000000000203AFF2001000000000000
0200001A1122334420010000000000000200001A3344112287003D170000
000020010000000000000200001A334411220201000102030405
""".replace("\\s+".toRegex(), "").trim()
// invalid unicast ether dst -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonHostDstMacNsPkt),
DROPPED_IPV6_NS_OTHER_HOST
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="33:33:ff:03:02:01")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptDstLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val nonMcastDstMacNsPkt = """
3333FF03020100010203040586DD6000000000203AFF20010000000000
000200001A1122334420010000000000000200001A3344112287003D17
0000000020010000000000000200001A334411220201000102030405
""".replace("\\s+".toRegex(), "").trim()
// mcast dst mac is not one of solicited mcast mac derived from one of device's ip -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonMcastDstMacNsPkt),
DROPPED_IPV6_NS_OTHER_HOST
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="33:33:ff:44:11:22")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val hostMcastDstMacNsPkt = """
3333FF44112200010203040586DD6000000000203AFF20010000000000
000200001A1122334420010000000000000200001A3344112287003E17
0000000020010000000000000200001A334411220101000102030405
""".replace("\\s+".toRegex(), "").trim()
// mcast dst mac is one of solicited mcast mac derived from one of device's ip
// -> drop and replied
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(hostMcastDstMacNsPkt),
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="FF:FF:FF:FF:FF:FF")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val broadcastNsPkt = """
FFFFFFFFFFFF00010203040586DD6000000000203AFF200100000000000002000
01A1122334420010000000000000200001A3344112287003E1700000000200100
00000000000200001A334411220101000102030405
""".replace("\\s+".toRegex(), "").trim()
// mcast dst mac is broadcast address -> drop and replied
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(broadcastNsPkt),
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
// validate IPv6 dst address check
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val validHostDstIpNsPkt = """
02030405060700010203040586DD6000000000203AFF200100000000000
00200001A1122334420010000000000000200001A3344112287003E1700
00000020010000000000000200001A334411220101000102030405
""".replace("\\s+".toRegex(), "").trim()
// dst ip is one of device's ip -> drop and replied
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(validHostDstIpNsPkt),
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::100:1b:aabb:ccdd", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::100:1b:aabb:ccdd")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val validHostAnycastDstIpNsPkt = """
02030405060700010203040586DD6000000000203AFF20010000
000000000200001A1122334420010000000000000100001BAABB
CCDD8700D9AE0000000020010000000000000100001BAABBCCDD
0101000102030405
""".replace("\\s+".toRegex(), "").trim()
// dst ip is device's anycast address -> drop and replied
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(validHostAnycastDstIpNsPkt),
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:4444:5555", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val nonHostUcastDstIpNsPkt = """
02030405060700010203040586DD6000000000203AFF2001000000000
0000200001A1122334420010000000000000200001A444455558700E8
E30000000020010000000000000200001A334411220101000102030405
""".replace("\\s+".toRegex(), "").trim()
// unicast dst ip is not one of device's ip -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonHostUcastDstIpNsPkt),
DROPPED_IPV6_NS_OTHER_HOST
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="ff02::1:ff44:1133", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val nonHostMcastDstIpNsPkt = """
02030405060700010203040586DD6000000000203AFF2001000000000
0000200001A11223344FF0200000000000000000001FF441133870095
1C0000000020010000000000000200001A334411220101000102030405
""".replace("\\s+".toRegex(), "").trim()
// mcast dst ip is not one of solicited mcast ip derived from one of device's ip -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonHostMcastDstIpNsPkt),
DROPPED_IPV6_NS_OTHER_HOST
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="ff02::1:ff44:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val hostMcastDstIpNsPkt =
"02030405060700010203040586DD6000000000203AFF2001000000000000" +
"0200001A11223344FF0200000000000000000001FF4411228700952D0000" +
"000020010000000000000200001A334411220101000102030405"
// mcast dst ip is one of solicited mcast ip derived from one of device's ip
// -> drop and replied
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(hostMcastDstIpNsPkt),
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
// validate IPv6 NS payload check
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255, plen=20)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val shortNsPkt = """
02030405060700010203040586DD6000000000143AFF20010000000000000200001A1
122334420010000000000000200001A3344112287003B140000000020010000000000
000200001A334411220101010203040506
""".replace("\\s+".toRegex(), "").trim()
// payload len < 24 -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(shortNsPkt),
DROPPED_IPV6_NS_INVALID
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:4444:5555")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val otherHostNsPkt = """
02030405060700010203040586DD6000000000203AFF200100000000000002000
01A1122334420010000000000000200001A334411228700E5E000000000200100
00000000000200001A444455550101010203040506
""".replace("\\s+".toRegex(), "").trim()
// target ip is not one of device's ip -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(otherHostNsPkt),
DROPPED_IPV6_NS_OTHER_HOST
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=20)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val invalidHoplimitNsPkt = """
02030405060700010203040586DD6000000000203A14200100000000000
00200001A1122334420010000000000000200001A3344112287003B1400
00000020010000000000000200001A334411220101010203040506
""".replace("\\s+".toRegex(), "").trim()
// hoplimit is not 255 -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(invalidHoplimitNsPkt),
DROPPED_IPV6_NS_INVALID
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122", code=5)
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val invalidIcmpCodeNsPkt = """
02030405060700010203040586DD6000000000203AFF200100000000000
00200001A1122334420010000000000000200001A3344112287053B0F00
00000020010000000000000200001A334411220101010203040506
""".replace("\\s+".toRegex(), "").trim()
// icmp6 code is not 0 -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(invalidIcmpCodeNsPkt),
DROPPED_IPV6_NS_INVALID
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:1234:5678")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val tentativeTargetIpNsPkt = """
02030405060700010203040586DD6000000000203AFF200100000000
00000200001A1122334420010000000000000200001A334411228700
16CE0000000020010000000000000200001A123456780101010203040506
""".replace("\\s+".toRegex(), "").trim()
// target ip is one of tentative address -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(tentativeTargetIpNsPkt),
PASSED_IPV6_NS_TENTATIVE
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1c:2255:6666")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val invalidTargetIpNsPkt = """
02030405060700010203040586DD6000000000203AFF200100000000000
00200001A1122334420010000000000000200001A334411228700F6BC00
00000020010000000000000200001C225566660101010203040506
""".replace("\\s+".toRegex(), "").trim()
// target ip is none of {non-tentative, anycast} -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(invalidTargetIpNsPkt),
DROPPED_IPV6_NS_OTHER_HOST
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="::", dst="ff02::1:ff44:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptDstLLAddr(lladdr="02:03:04:05:06:07")
// pkt = eth/ip6/icmp6/icmp6_opt
val dadNsPkt = """
02030405060700010203040586DD6000000000203AFF000000000000000000000000000
00000FF0200000000000000000001FF4411228700F4A800000000200100000000000002
00001A334411220201020304050607
""".replace("\\s+".toRegex(), "").trim()
// DAD NS request -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(dadNsPkt),
PASSED_IPV6_NS_DAD
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// pkt = eth/ip6/icmp6
val noOptionNsPkt = """
02030405060700010203040586DD6000000000183AFF2001000000000000020000
1A1122334420010000000000000200001A33441122870045290000000020010000
000000000200001A33441122
""".replace("\\s+".toRegex(), "").trim()
// payload len < 32 -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(noOptionNsPkt),
PASSED_IPV6_NS_NO_SLLA_OPTION
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="ff01::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val nonDadMcastSrcIpPkt = """
02030405060700010203040586DD6000000000203AFFFF01000000000000
0200001A1122334420010000000000000200001A3344112287005C130000
000020010000000000000200001A334411220101010203040506
""".replace("\\s+".toRegex(), "").trim()
// non-DAD src IPv6 is FF::/8 -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDadMcastSrcIpPkt),
DROPPED_IPV6_NS_INVALID
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="0001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val nonDadLoopbackSrcIpPkt = """
02030405060700010203040586DD6000000000203AFF0001000000000
0000200001A1122334420010000000000000200001A3344112287005B
140000000020010000000000000200001A334411220101010203040506
""".replace("\\s+".toRegex(), "").trim()
// non-DAD src IPv6 is 00::/8 -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(nonDadLoopbackSrcIpPkt),
DROPPED_IPV6_NS_INVALID
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt1 = ICMPv6NDOptDstLLAddr(lladdr="01:02:03:04:05:06")
// icmp6_opt2 = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt1/icmp6_opt2
val sllaNotFirstOptionNsPkt = """
02030405060700010203040586DD6000000000283AFF200100000000
00000200001A1122334420010000000000000200001A334411228700
2FFF0000000020010000000000000200001A33441122020101020304
05060101010203040506
""".replace("\\s+".toRegex(), "").trim()
// non-DAD with multiple options, SLLA in 2nd option -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(sllaNotFirstOptionNsPkt),
PASSED_IPV6_NS_NO_SLLA_OPTION
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptDstLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val noSllaOptionNsPkt = """
02030405060700010203040586DD6000000000203AFF200100000000000002
00001A1122334420010000000000000200001A3344112287003A1400000000
20010000000000000200001A334411220201010203040506
""".replace("\\s+".toRegex(), "").trim()
// non-DAD with one option but not SLLA -> pass
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(noSllaOptionNsPkt),
PASSED_IPV6_NS_NO_SLLA_OPTION
)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="2001::200:1a:3344:1122", hlim=255)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="01:02:03:04:05:06")
// pkt = eth/ip6/icmp6/icmp6_opt
val mcastMacSllaOptionNsPkt = """
02030405060700010203040586DD6000000000203AFF200100000000
00000200001A1122334420010000000000000200001A334411228700
3B140000000020010000000000000200001A33441122010101020304
0506
""".replace("\\s+".toRegex(), "").trim()
// non-DAD, SLLA is multicast MAC -> drop
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(mcastMacSllaOptionNsPkt),
DROPPED_IPV6_NS_INVALID
)
}
// The APFv6 code path is only turned on in V+
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@Test
fun testNaTransmit() {
val apfFilter = getApfFilter()
val lp = LinkProperties()
for (addr in hostIpv6Addresses) {
lp.addLinkAddress(LinkAddress(InetAddress.getByAddress(addr), 64))
}
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 3)
val validIpv6Addresses = hostIpv6Addresses + hostAnycast6Addresses
val expectPackets = mutableListOf<ByteArray>()
for (addr in validIpv6Addresses) {
// unicast solicited NS request
val receivedUcastNsPacket = generateNsPacket(
senderMacAddress,
apfFilter.mHardwareAddress,
senderIpv6Address,
addr,
addr
)
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
receivedUcastNsPacket,
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
val expectedUcastNaPacket = generateNaPacket(
apfFilter.mHardwareAddress,
senderMacAddress,
addr,
senderIpv6Address,
0xe0000000.toInt(), // R=1, S=1, O=1
addr
)
expectPackets.add(expectedUcastNaPacket)
val solicitedMcastAddr = NetworkStackUtils.ipv6AddressToSolicitedNodeMulticast(
InetAddress.getByAddress(addr) as Inet6Address
)!!
val mcastDa = NetworkStackUtils.ipv6MulticastToEthernetMulticast(solicitedMcastAddr)
.toByteArray()
// multicast solicited NS request
var receivedMcastNsPacket = generateNsPacket(
senderMacAddress,
mcastDa,
senderIpv6Address,
solicitedMcastAddr.address,
addr
)
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
receivedMcastNsPacket,
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
val expectedMcastNaPacket = generateNaPacket(
apfFilter.mHardwareAddress,
senderMacAddress,
addr,
senderIpv6Address,
0xe0000000.toInt(), // R=1, S=1, O=1
addr
)
expectPackets.add(expectedMcastNaPacket)
}
val transmitPackets = consumeTransmittedPackets(expectPackets.size)
for (i in transmitPackets.indices) {
assertContentEquals(expectPackets[i], transmitPackets[i])
}
}
// The APFv6 code path is only turned on in V+
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@Test
fun testNaTransmitWithTclass() {
// mock nd traffic class from /proc/sys/net/ipv6/conf/{ifname}/ndisc_tclass to 20
doReturn(20).`when`(dependencies).getNdTrafficClass(any())
val apfFilter = getApfFilter()
val lp = LinkProperties()
for (addr in hostIpv6Addresses) {
lp.addLinkAddress(LinkAddress(InetAddress.getByAddress(addr), 64))
}
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 3)
// Using scapy to generate IPv6 NS packet:
// eth = Ether(src="00:01:02:03:04:05", dst="02:03:04:05:06:07")
// ip6 = IPv6(src="2001::200:1a:1122:3344", dst="ff02::1:ff44:1122", hlim=255, tc=20)
// icmp6 = ICMPv6ND_NS(tgt="2001::200:1a:3344:1122")
// icmp6_opt = ICMPv6NDOptSrcLLAddr(lladdr="00:01:02:03:04:05")
// pkt = eth/ip6/icmp6/icmp6_opt
val hostMcastDstIpNsPkt = """
02030405060700010203040586DD6140000000203AFF2001000000000000
0200001A11223344FF0200000000000000000001FF4411228700952D0000
000020010000000000000200001A334411220101000102030405
""".replace("\\s+".toRegex(), "").trim()
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
HexDump.hexStringToByteArray(hostMcastDstIpNsPkt),
DROPPED_IPV6_NS_REPLIED_NON_DAD
)
val transmitPkts = consumeTransmittedPackets(1)
// Using scapy to generate IPv6 NA packet:
// eth = Ether(src="02:03:04:05:06:07", dst="00:01:02:03:04:05")
// ip6 = IPv6(src="2001::200:1a:3344:1122", dst="2001::200:1a:1122:3344", hlim=255, tc=20)
// icmp6 = ICMPv6ND_NA(tgt="2001::200:1a:3344:1122", R=1, S=1, O=1)
// icmp6_opt = ICMPv6NDOptDstLLAddr(lladdr="02:03:04:05:06:07")
// pkt = eth/ip6/icmp6/icmp6_opt
val expectedNaPacket = """
00010203040502030405060786DD6140000000203AFF2001000000000000020
0001A3344112220010000000000000200001A1122334488005610E000000020
010000000000000200001A334411220201020304050607
""".replace("\\s+".toRegex(), "").trim()
assertContentEquals(
HexDump.hexStringToByteArray(expectedNaPacket),
transmitPkts[0]
)
}
@Test
fun testNdOffloadDisabled() {
val apfConfig = getDefaultConfig()
apfConfig.shouldHandleNdOffload = false
val apfFilter = getApfFilter(apfConfig)
val lp = LinkProperties()
for (addr in hostIpv6Addresses) {
lp.addLinkAddress(LinkAddress(InetAddress.getByAddress(addr), 64))
}
apfFilter.setLinkProperties(lp)
val program = consumeInstalledProgram(ipClientCallback, installCnt = 3)
val validIpv6Addresses = hostIpv6Addresses + hostAnycast6Addresses
for (addr in validIpv6Addresses) {
// unicast solicited NS request
val receivedUcastNsPacket = generateNsPacket(
senderMacAddress,
apfFilter.mHardwareAddress,
senderIpv6Address,
addr,
addr
)
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
receivedUcastNsPacket,
PASSED_IPV6_ICMP
)
val solicitedMcastAddr = NetworkStackUtils.ipv6AddressToSolicitedNodeMulticast(
InetAddress.getByAddress(addr) as Inet6Address
)!!
val mcastDa = NetworkStackUtils.ipv6MulticastToEthernetMulticast(solicitedMcastAddr)
.toByteArray()
// multicast solicited NS request
var receivedMcastNsPacket = generateNsPacket(
senderMacAddress,
mcastDa,
senderIpv6Address,
solicitedMcastAddr.address,
addr
)
verifyProgramRun(
apfFilter.mApfVersionSupported,
program,
receivedMcastNsPacket,
PASSED_IPV6_ICMP
)
}
}
@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@Test
fun testRegisterOffloadEngine() {
val apfConfig = getDefaultConfig()
apfConfig.shouldHandleMdnsOffload = true
val apfFilter = getApfFilter(apfConfig)
val captor = ArgumentCaptor.forClass(OffloadEngine::class.java)
verify(nsdManager).registerOffloadEngine(
eq(ifParams.name),
anyLong(),
anyLong(),
any(),
captor.capture()
)
val offloadEngine = captor.value
val info1 = OffloadServiceInfo(
OffloadServiceInfo.Key("TestServiceName", "_advertisertest._tcp"),
listOf(),
"Android_test.local",
byteArrayOf(0x01, 0x02, 0x03, 0x04),
0,
OffloadEngine.OFFLOAD_TYPE_REPLY.toLong()
)
val info2 = OffloadServiceInfo(
OffloadServiceInfo.Key("TestServiceName2", "_advertisertest._tcp"),
listOf(),
"Android_test.local",
byteArrayOf(0x01, 0x02, 0x03, 0x04),
0,
OffloadEngine.OFFLOAD_TYPE_REPLY.toLong()
)
val updatedInfo1 = OffloadServiceInfo(
OffloadServiceInfo.Key("TestServiceName", "_advertisertest._tcp"),
listOf(),
"Android_test.local",
byteArrayOf(),
0,
OffloadEngine.OFFLOAD_TYPE_REPLY.toLong()
)
handler.post { offloadEngine.onOffloadServiceUpdated(info1) }
handlerThread.waitForIdle(TIMEOUT_MS)
assertContentEquals(listOf(info1), apfFilter.mOffloadServiceInfos)
handler.post { offloadEngine.onOffloadServiceUpdated(info2) }
handlerThread.waitForIdle(TIMEOUT_MS)
assertContentEquals(listOf(info1, info2), apfFilter.mOffloadServiceInfos)
handler.post { offloadEngine.onOffloadServiceUpdated(updatedInfo1) }
handlerThread.waitForIdle(TIMEOUT_MS)
assertContentEquals(listOf(info2, updatedInfo1), apfFilter.mOffloadServiceInfos)
handler.post { offloadEngine.onOffloadServiceRemoved(updatedInfo1) }
handlerThread.waitForIdle(TIMEOUT_MS)
assertContentEquals(listOf(info2), apfFilter.mOffloadServiceInfos)
handler.post { apfFilter.shutdown() }
handlerThread.waitForIdle(TIMEOUT_MS)
verify(nsdManager).unregisterOffloadEngine(any())
}
@Test
fun testApfProgramUpdate() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
// add IPv4 address, expect to have apf program update
val lp = LinkProperties()
val linkAddress = LinkAddress(InetAddress.getByAddress(hostIpv4Address), 24)
lp.addLinkAddress(linkAddress)
apfFilter.setLinkProperties(lp)
consumeInstalledProgram(ipClientCallback, installCnt = 1)
// add the same IPv4 address, expect to have no apf program update
apfFilter.setLinkProperties(lp)
verify(ipClientCallback, never()).installPacketFilter(any())
// add IPv6 addresses, expect to have apf program update
for (addr in hostIpv6Addresses) {
lp.addLinkAddress(LinkAddress(InetAddress.getByAddress(addr), 64))
}
apfFilter.setLinkProperties(lp)
consumeInstalledProgram(ipClientCallback, installCnt = 1)
// add the same IPv6 addresses, expect to have no apf program update
apfFilter.setLinkProperties(lp)
verify(ipClientCallback, never()).installPacketFilter(any())
// add more tentative IPv6 addresses, expect to have apf program update
for (addr in hostIpv6TentativeAddresses) {
lp.addLinkAddress(
LinkAddress(
InetAddress.getByAddress(addr),
64,
IFA_F_TENTATIVE,
0
)
)
}
apfFilter.setLinkProperties(lp)
consumeInstalledProgram(ipClientCallback, installCnt = 1)
// add the same IPv6 addresses, expect to have no apf program update
apfFilter.setLinkProperties(lp)
verify(ipClientCallback, never()).installPacketFilter(any())
}
@Test
fun testApfFilterInitializationCleanUpTheApfMemoryRegion() {
val apfFilter = getApfFilter()
val programCaptor = ArgumentCaptor.forClass(ByteArray::class.java)
verify(ipClientCallback, times(2)).installPacketFilter(programCaptor.capture())
val program = programCaptor.allValues.first()
assertContentEquals(ByteArray(4096) { 0 }, program)
}
@Test
fun testApfFilterResumeWillCleanUpTheApfMemoryRegion() {
val apfFilter = getApfFilter()
consumeInstalledProgram(ipClientCallback, installCnt = 2)
apfFilter.resume()
val program = consumeInstalledProgram(ipClientCallback, installCnt = 1)
assertContentEquals(ByteArray(4096) { 0 }, program)
}
@Test
fun testApfIPv4MulticastAddrsUpdate() {
val apfFilter = getApfFilter()
// mock IPv4 multicast address from /proc/net/igmp
val mcastAddrs = mutableListOf(
InetAddress.getByName("224.0.0.1") as Inet4Address
)
consumeInstalledProgram(ipClientCallback, installCnt = 2)
doReturn(mcastAddrs).`when`(dependencies).getIPv4MulticastAddresses(any())
apfFilter.updateIPv4MulticastAddrs()
consumeInstalledProgram(ipClientCallback, installCnt = 1)
assertEquals(mcastAddrs.toSet(), apfFilter.mIPv4MulticastAddresses)
val addr = InetAddress.getByName("239.0.0.1") as Inet4Address
mcastAddrs.add(addr)
doReturn(mcastAddrs).`when`(dependencies).getIPv4MulticastAddresses(any())
apfFilter.updateIPv4MulticastAddrs()
consumeInstalledProgram(ipClientCallback, installCnt = 1)
assertEquals(mcastAddrs.toSet(), apfFilter.mIPv4MulticastAddresses)
apfFilter.updateIPv4MulticastAddrs()
verify(ipClientCallback, never()).installPacketFilter(any())
}
}