| /* |
| * Copyright 2016 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| * binder_test.cpp - unit tests for netd binder RPCs. |
| */ |
| |
| #include <cerrno> |
| #include <chrono> |
| #include <cinttypes> |
| #include <condition_variable> |
| #include <cstdint> |
| #include <cstdio> |
| #include <cstdlib> |
| #include <mutex> |
| #include <set> |
| #include <vector> |
| |
| #include <dirent.h> |
| #include <fcntl.h> |
| #include <ifaddrs.h> |
| #include <linux/if.h> |
| #include <linux/if_tun.h> |
| #include <net/if.h> |
| #include <netdb.h> |
| #include <netinet/in.h> |
| #include <openssl/base64.h> |
| #include <sys/socket.h> |
| #include <sys/types.h> |
| |
| #include <android-base/file.h> |
| #include <android-base/macros.h> |
| #include <android-base/stringprintf.h> |
| #include <android-base/strings.h> |
| #include <binder/IPCThreadState.h> |
| #include <bpf/BpfMap.h> |
| #include <bpf/BpfUtils.h> |
| #include <com/android/internal/net/BnOemNetdUnsolicitedEventListener.h> |
| #include <com/android/internal/net/IOemNetd.h> |
| #include <cutils/multiuser.h> |
| #include <gtest/gtest.h> |
| #include <logwrap/logwrap.h> |
| #include <netdbpf/bpf_shared.h> |
| #include <netutils/ifc.h> |
| #include "Fwmark.h" |
| #include "InterfaceController.h" |
| #include "NetdClient.h" |
| #include "NetdConstants.h" |
| #include "TestUnsolService.h" |
| #include "XfrmController.h" |
| #include "android/net/INetd.h" |
| #include "binder/IServiceManager.h" |
| #include "netdutils/Stopwatch.h" |
| #include "netdutils/Syscalls.h" |
| #include "netid_client.h" // NETID_UNSET |
| #include "tun_interface.h" |
| |
| #define IP_PATH "/system/bin/ip" |
| #define IP6TABLES_PATH "/system/bin/ip6tables" |
| #define IPTABLES_PATH "/system/bin/iptables" |
| #define TUN_DEV "/dev/tun" |
| #define RAW_TABLE "raw" |
| #define MANGLE_TABLE "mangle" |
| #define FILTER_TABLE "filter" |
| #define NAT_TABLE "nat" |
| |
| namespace binder = android::binder; |
| |
| using android::IBinder; |
| using android::IServiceManager; |
| using android::sp; |
| using android::String16; |
| using android::String8; |
| using android::base::Join; |
| using android::base::ReadFileToString; |
| using android::base::StartsWith; |
| using android::base::StringPrintf; |
| using android::base::Trim; |
| using android::net::INetd; |
| using android::net::InterfaceConfigurationParcel; |
| using android::net::InterfaceController; |
| using android::net::TetherStatsParcel; |
| using android::net::TunInterface; |
| using android::net::UidRangeParcel; |
| using android::netdutils::sSyscalls; |
| using android::netdutils::Stopwatch; |
| |
| static const char* IP_RULE_V4 = "-4"; |
| static const char* IP_RULE_V6 = "-6"; |
| static const int TEST_NETID1 = 65501; |
| static const int TEST_NETID2 = 65502; |
| |
| // Use maximum reserved appId for applications to avoid conflict with existing |
| // uids. |
| static const int TEST_UID1 = 99999; |
| static const int TEST_UID2 = 99998; |
| |
| constexpr int BASE_UID = AID_USER_OFFSET * 5; |
| |
| static const std::string NO_SOCKET_ALLOW_RULE("! owner UID match 0-4294967294"); |
| static const std::string ESP_ALLOW_RULE("esp"); |
| |
| class BinderTest : public ::testing::Test { |
| public: |
| BinderTest() { |
| sp<IServiceManager> sm = android::defaultServiceManager(); |
| sp<IBinder> binder = sm->getService(String16("netd")); |
| if (binder != nullptr) { |
| mNetd = android::interface_cast<INetd>(binder); |
| } |
| } |
| |
| void SetUp() override { |
| ASSERT_NE(nullptr, mNetd.get()); |
| } |
| |
| void TearDown() override { |
| mNetd->networkDestroy(TEST_NETID1); |
| mNetd->networkDestroy(TEST_NETID2); |
| setNetworkForProcess(NETID_UNSET); |
| // Restore default network |
| if (mStoredDefaultNetwork >= 0) mNetd->networkSetDefault(mStoredDefaultNetwork); |
| } |
| |
| bool allocateIpSecResources(bool expectOk, int32_t* spi); |
| |
| // Static because setting up the tun interface takes about 40ms. |
| static void SetUpTestCase() { |
| ASSERT_EQ(0, sTun.init()); |
| ASSERT_EQ(0, sTun2.init()); |
| ASSERT_LE(sTun.name().size(), static_cast<size_t>(IFNAMSIZ)); |
| ASSERT_LE(sTun2.name().size(), static_cast<size_t>(IFNAMSIZ)); |
| } |
| |
| static void TearDownTestCase() { |
| // Closing the socket removes the interface and IP addresses. |
| sTun.destroy(); |
| sTun2.destroy(); |
| } |
| |
| static void fakeRemoteSocketPair(int *clientSocket, int *serverSocket, int *acceptedSocket); |
| |
| void createVpnNetworkWithUid(bool secure, uid_t uid, int vpnNetId = TEST_NETID2, |
| int fallthroughNetId = TEST_NETID1); |
| |
| protected: |
| // Use -1 to represent that default network was not modified because |
| // real netId must be an unsigned value. |
| int mStoredDefaultNetwork = -1; |
| sp<INetd> mNetd; |
| static TunInterface sTun; |
| static TunInterface sTun2; |
| }; |
| |
| TunInterface BinderTest::sTun; |
| TunInterface BinderTest::sTun2; |
| |
| class TimedOperation : public Stopwatch { |
| public: |
| explicit TimedOperation(const std::string &name): mName(name) {} |
| virtual ~TimedOperation() { |
| fprintf(stderr, " %s: %6.1f ms\n", mName.c_str(), timeTaken()); |
| } |
| |
| private: |
| std::string mName; |
| }; |
| |
| TEST_F(BinderTest, IsAlive) { |
| TimedOperation t("isAlive RPC"); |
| bool isAlive = false; |
| mNetd->isAlive(&isAlive); |
| ASSERT_TRUE(isAlive); |
| } |
| |
| static int randomUid() { |
| return 100000 * arc4random_uniform(7) + 10000 + arc4random_uniform(5000); |
| } |
| |
| static std::vector<std::string> runCommand(const std::string& command) { |
| std::vector<std::string> lines; |
| FILE *f = popen(command.c_str(), "r"); // NOLINT(cert-env33-c) |
| if (f == nullptr) { |
| perror("popen"); |
| return lines; |
| } |
| |
| char *line = nullptr; |
| size_t bufsize = 0; |
| ssize_t linelen = 0; |
| while ((linelen = getline(&line, &bufsize, f)) >= 0) { |
| lines.push_back(std::string(line, linelen)); |
| free(line); |
| line = nullptr; |
| } |
| |
| pclose(f); |
| return lines; |
| } |
| |
| static std::vector<std::string> listIpRules(const char *ipVersion) { |
| std::string command = StringPrintf("%s %s rule list", IP_PATH, ipVersion); |
| return runCommand(command); |
| } |
| |
| static std::vector<std::string> listIptablesRule(const char *binary, const char *chainName) { |
| std::string command = StringPrintf("%s -w -n -L %s", binary, chainName); |
| return runCommand(command); |
| } |
| |
| static int iptablesRuleLineLength(const char *binary, const char *chainName) { |
| return listIptablesRule(binary, chainName).size(); |
| } |
| |
| static bool iptablesRuleExists(const char *binary, |
| const char *chainName, |
| const std::string& expectedRule) { |
| std::vector<std::string> rules = listIptablesRule(binary, chainName); |
| for (const auto& rule : rules) { |
| if(rule.find(expectedRule) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| static bool iptablesNoSocketAllowRuleExists(const char *chainName){ |
| return iptablesRuleExists(IPTABLES_PATH, chainName, NO_SOCKET_ALLOW_RULE) && |
| iptablesRuleExists(IP6TABLES_PATH, chainName, NO_SOCKET_ALLOW_RULE); |
| } |
| |
| static bool iptablesEspAllowRuleExists(const char *chainName){ |
| return iptablesRuleExists(IPTABLES_PATH, chainName, ESP_ALLOW_RULE) && |
| iptablesRuleExists(IP6TABLES_PATH, chainName, ESP_ALLOW_RULE); |
| } |
| |
| TEST_F(BinderTest, FirewallReplaceUidChain) { |
| SKIP_IF_BPF_SUPPORTED; |
| |
| std::string chainName = StringPrintf("netd_binder_test_%u", arc4random_uniform(10000)); |
| const int kNumUids = 500; |
| std::vector<int32_t> noUids(0); |
| std::vector<int32_t> uids(kNumUids); |
| for (int i = 0; i < kNumUids; i++) { |
| uids[i] = randomUid(); |
| } |
| |
| bool ret; |
| { |
| TimedOperation op(StringPrintf("Programming %d-UID whitelist chain", kNumUids)); |
| mNetd->firewallReplaceUidChain(chainName, true, uids, &ret); |
| } |
| EXPECT_EQ(true, ret); |
| EXPECT_EQ((int) uids.size() + 9, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str())); |
| EXPECT_EQ((int) uids.size() + 15, iptablesRuleLineLength(IP6TABLES_PATH, chainName.c_str())); |
| EXPECT_EQ(true, iptablesNoSocketAllowRuleExists(chainName.c_str())); |
| EXPECT_EQ(true, iptablesEspAllowRuleExists(chainName.c_str())); |
| { |
| TimedOperation op("Clearing whitelist chain"); |
| mNetd->firewallReplaceUidChain(chainName, false, noUids, &ret); |
| } |
| EXPECT_EQ(true, ret); |
| EXPECT_EQ(5, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str())); |
| EXPECT_EQ(5, iptablesRuleLineLength(IP6TABLES_PATH, chainName.c_str())); |
| |
| { |
| TimedOperation op(StringPrintf("Programming %d-UID blacklist chain", kNumUids)); |
| mNetd->firewallReplaceUidChain(chainName, false, uids, &ret); |
| } |
| EXPECT_EQ(true, ret); |
| EXPECT_EQ((int) uids.size() + 5, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str())); |
| EXPECT_EQ((int) uids.size() + 5, iptablesRuleLineLength(IP6TABLES_PATH, chainName.c_str())); |
| EXPECT_EQ(false, iptablesNoSocketAllowRuleExists(chainName.c_str())); |
| EXPECT_EQ(false, iptablesEspAllowRuleExists(chainName.c_str())); |
| |
| { |
| TimedOperation op("Clearing blacklist chain"); |
| mNetd->firewallReplaceUidChain(chainName, false, noUids, &ret); |
| } |
| EXPECT_EQ(true, ret); |
| EXPECT_EQ(5, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str())); |
| EXPECT_EQ(5, iptablesRuleLineLength(IP6TABLES_PATH, chainName.c_str())); |
| |
| // Check that the call fails if iptables returns an error. |
| std::string veryLongStringName = "netd_binder_test_UnacceptablyLongIptablesChainName"; |
| mNetd->firewallReplaceUidChain(veryLongStringName, true, noUids, &ret); |
| EXPECT_EQ(false, ret); |
| } |
| |
| TEST_F(BinderTest, IpSecTunnelInterface) { |
| const struct TestData { |
| const std::string family; |
| const std::string deviceName; |
| const std::string localAddress; |
| const std::string remoteAddress; |
| int32_t iKey; |
| int32_t oKey; |
| int32_t ifId; |
| } kTestData[] = { |
| {"IPV4", "ipsec_test", "127.0.0.1", "8.8.8.8", 0x1234 + 53, 0x1234 + 53, 0xFFFE}, |
| {"IPV6", "ipsec_test6", "::1", "2001:4860:4860::8888", 0x1234 + 50, 0x1234 + 50, |
| 0xFFFE}, |
| }; |
| |
| for (size_t i = 0; i < std::size(kTestData); i++) { |
| const auto& td = kTestData[i]; |
| |
| binder::Status status; |
| |
| // Create Tunnel Interface. |
| status = mNetd->ipSecAddTunnelInterface(td.deviceName, td.localAddress, td.remoteAddress, |
| td.iKey, td.oKey, td.ifId); |
| EXPECT_TRUE(status.isOk()) << td.family << status.exceptionMessage(); |
| |
| // Check that the interface exists |
| EXPECT_NE(0U, if_nametoindex(td.deviceName.c_str())); |
| |
| // Update Tunnel Interface. |
| status = mNetd->ipSecUpdateTunnelInterface(td.deviceName, td.localAddress, td.remoteAddress, |
| td.iKey, td.oKey, td.ifId); |
| EXPECT_TRUE(status.isOk()) << td.family << status.exceptionMessage(); |
| |
| // Remove Tunnel Interface. |
| status = mNetd->ipSecRemoveTunnelInterface(td.deviceName); |
| EXPECT_TRUE(status.isOk()) << td.family << status.exceptionMessage(); |
| |
| // Check that the interface no longer exists |
| EXPECT_EQ(0U, if_nametoindex(td.deviceName.c_str())); |
| } |
| } |
| |
| TEST_F(BinderTest, IpSecSetEncapSocketOwner) { |
| android::base::unique_fd uniqueFd(socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0)); |
| android::os::ParcelFileDescriptor sockFd(std::move(uniqueFd)); |
| |
| int sockOptVal = UDP_ENCAP_ESPINUDP; |
| setsockopt(sockFd.get(), IPPROTO_UDP, UDP_ENCAP, &sockOptVal, sizeof(sockOptVal)); |
| |
| binder::Status res = mNetd->ipSecSetEncapSocketOwner(sockFd, 1001); |
| EXPECT_TRUE(res.isOk()); |
| |
| struct stat info; |
| EXPECT_EQ(0, fstat(sockFd.get(), &info)); |
| EXPECT_EQ(1001, (int) info.st_uid); |
| } |
| |
| // IPsec tests are not run in 32 bit mode; both 32-bit kernels and |
| // mismatched ABIs (64-bit kernel with 32-bit userspace) are unsupported. |
| #if INTPTR_MAX != INT32_MAX |
| |
| using android::net::XfrmController; |
| |
| static const int XFRM_DIRECTIONS[] = {static_cast<int>(android::net::XfrmDirection::IN), |
| static_cast<int>(android::net::XfrmDirection::OUT)}; |
| static const int ADDRESS_FAMILIES[] = {AF_INET, AF_INET6}; |
| |
| #define RETURN_FALSE_IF_NEQ(_expect_, _ret_) \ |
| do { if ((_expect_) != (_ret_)) return false; } while(false) |
| bool BinderTest::allocateIpSecResources(bool expectOk, int32_t* spi) { |
| android::netdutils::Status status = XfrmController::ipSecAllocateSpi(0, "::", "::1", 123, spi); |
| SCOPED_TRACE(status); |
| RETURN_FALSE_IF_NEQ(status.ok(), expectOk); |
| |
| // Add a policy |
| status = XfrmController::ipSecAddSecurityPolicy(0, AF_INET6, 0, "::", "::1", 123, 0, 0, 0); |
| SCOPED_TRACE(status); |
| RETURN_FALSE_IF_NEQ(status.ok(), expectOk); |
| |
| // Add an ipsec interface |
| return expectOk == XfrmController::ipSecAddTunnelInterface("ipsec_test", "::", "::1", 0xF00D, |
| 0xD00D, 0xE00D, false) |
| .ok(); |
| } |
| |
| TEST_F(BinderTest, XfrmDualSelectorTunnelModePoliciesV4) { |
| android::binder::Status status; |
| |
| // Repeat to ensure cleanup and recreation works correctly |
| for (int i = 0; i < 2; i++) { |
| for (int direction : XFRM_DIRECTIONS) { |
| for (int addrFamily : ADDRESS_FAMILIES) { |
| status = mNetd->ipSecAddSecurityPolicy(0, addrFamily, direction, "127.0.0.5", |
| "127.0.0.6", 123, 0, 0, 0); |
| EXPECT_TRUE(status.isOk()) |
| << " family: " << addrFamily << " direction: " << direction; |
| } |
| } |
| |
| // Cleanup |
| for (int direction : XFRM_DIRECTIONS) { |
| for (int addrFamily : ADDRESS_FAMILIES) { |
| status = mNetd->ipSecDeleteSecurityPolicy(0, addrFamily, direction, 0, 0, 0); |
| EXPECT_TRUE(status.isOk()); |
| } |
| } |
| } |
| } |
| |
| TEST_F(BinderTest, XfrmDualSelectorTunnelModePoliciesV6) { |
| binder::Status status; |
| |
| // Repeat to ensure cleanup and recreation works correctly |
| for (int i = 0; i < 2; i++) { |
| for (int direction : XFRM_DIRECTIONS) { |
| for (int addrFamily : ADDRESS_FAMILIES) { |
| status = mNetd->ipSecAddSecurityPolicy(0, addrFamily, direction, "2001:db8::f00d", |
| "2001:db8::d00d", 123, 0, 0, 0); |
| EXPECT_TRUE(status.isOk()) |
| << " family: " << addrFamily << " direction: " << direction; |
| } |
| } |
| |
| // Cleanup |
| for (int direction : XFRM_DIRECTIONS) { |
| for (int addrFamily : ADDRESS_FAMILIES) { |
| status = mNetd->ipSecDeleteSecurityPolicy(0, addrFamily, direction, 0, 0, 0); |
| EXPECT_TRUE(status.isOk()); |
| } |
| } |
| } |
| } |
| |
| TEST_F(BinderTest, XfrmControllerInit) { |
| android::netdutils::Status status; |
| status = XfrmController::Init(); |
| SCOPED_TRACE(status); |
| |
| // Older devices or devices with mismatched Kernel/User ABI cannot support the IPsec |
| // feature. |
| if (status.code() == EOPNOTSUPP) return; |
| |
| ASSERT_TRUE(status.ok()); |
| |
| int32_t spi = 0; |
| |
| ASSERT_TRUE(allocateIpSecResources(true, &spi)); |
| ASSERT_TRUE(allocateIpSecResources(false, &spi)); |
| |
| status = XfrmController::Init(); |
| ASSERT_TRUE(status.ok()); |
| ASSERT_TRUE(allocateIpSecResources(true, &spi)); |
| |
| // Clean up |
| status = XfrmController::ipSecDeleteSecurityAssociation(0, "::", "::1", 123, spi, 0, 0); |
| SCOPED_TRACE(status); |
| ASSERT_TRUE(status.ok()); |
| |
| status = XfrmController::ipSecDeleteSecurityPolicy(0, AF_INET6, 0, 0, 0, 0); |
| SCOPED_TRACE(status); |
| ASSERT_TRUE(status.ok()); |
| |
| // Remove Virtual Tunnel Interface. |
| ASSERT_TRUE(XfrmController::ipSecRemoveTunnelInterface("ipsec_test").ok()); |
| } |
| |
| #endif // INTPTR_MAX != INT32_MAX |
| |
| static int bandwidthDataSaverEnabled(const char *binary) { |
| std::vector<std::string> lines = listIptablesRule(binary, "bw_data_saver"); |
| |
| // Output looks like this: |
| // |
| // Chain bw_data_saver (1 references) |
| // target prot opt source destination |
| // RETURN all -- 0.0.0.0/0 0.0.0.0/0 |
| // |
| // or: |
| // |
| // Chain bw_data_saver (1 references) |
| // target prot opt source destination |
| // ... possibly connectivity critical packet rules here ... |
| // REJECT all -- ::/0 ::/0 |
| |
| EXPECT_GE(lines.size(), 3U); |
| |
| if (lines.size() == 3 && StartsWith(lines[2], "RETURN ")) { |
| // Data saver disabled. |
| return 0; |
| } |
| |
| size_t minSize = (std::string(binary) == IPTABLES_PATH) ? 3 : 9; |
| |
| if (lines.size() >= minSize && StartsWith(lines[lines.size() -1], "REJECT ")) { |
| // Data saver enabled. |
| return 1; |
| } |
| |
| return -1; |
| } |
| |
| bool enableDataSaver(sp<INetd>& netd, bool enable) { |
| TimedOperation op(enable ? " Enabling data saver" : "Disabling data saver"); |
| bool ret; |
| netd->bandwidthEnableDataSaver(enable, &ret); |
| return ret; |
| } |
| |
| int getDataSaverState() { |
| const int enabled4 = bandwidthDataSaverEnabled(IPTABLES_PATH); |
| const int enabled6 = bandwidthDataSaverEnabled(IP6TABLES_PATH); |
| EXPECT_EQ(enabled4, enabled6); |
| EXPECT_NE(-1, enabled4); |
| EXPECT_NE(-1, enabled6); |
| if (enabled4 != enabled6 || (enabled6 != 0 && enabled6 != 1)) { |
| return -1; |
| } |
| return enabled6; |
| } |
| |
| TEST_F(BinderTest, BandwidthEnableDataSaver) { |
| const int wasEnabled = getDataSaverState(); |
| ASSERT_NE(-1, wasEnabled); |
| |
| if (wasEnabled) { |
| ASSERT_TRUE(enableDataSaver(mNetd, false)); |
| EXPECT_EQ(0, getDataSaverState()); |
| } |
| |
| ASSERT_TRUE(enableDataSaver(mNetd, false)); |
| EXPECT_EQ(0, getDataSaverState()); |
| |
| ASSERT_TRUE(enableDataSaver(mNetd, true)); |
| EXPECT_EQ(1, getDataSaverState()); |
| |
| ASSERT_TRUE(enableDataSaver(mNetd, true)); |
| EXPECT_EQ(1, getDataSaverState()); |
| |
| if (!wasEnabled) { |
| ASSERT_TRUE(enableDataSaver(mNetd, false)); |
| EXPECT_EQ(0, getDataSaverState()); |
| } |
| } |
| |
| static bool ipRuleExistsForRange(const uint32_t priority, const UidRangeParcel& range, |
| const std::string& action, const char* ipVersion) { |
| // Output looks like this: |
| // "12500:\tfrom all fwmark 0x0/0x20000 iif lo uidrange 1000-2000 prohibit" |
| std::vector<std::string> rules = listIpRules(ipVersion); |
| |
| std::string prefix = StringPrintf("%" PRIu32 ":", priority); |
| std::string suffix = |
| StringPrintf(" iif lo uidrange %d-%d %s\n", range.start, range.stop, action.c_str()); |
| for (const auto& line : rules) { |
| if (android::base::StartsWith(line, prefix) && android::base::EndsWith(line, suffix)) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| static bool ipRuleExistsForRange(const uint32_t priority, const UidRangeParcel& range, |
| const std::string& action) { |
| bool existsIp4 = ipRuleExistsForRange(priority, range, action, IP_RULE_V4); |
| bool existsIp6 = ipRuleExistsForRange(priority, range, action, IP_RULE_V6); |
| EXPECT_EQ(existsIp4, existsIp6); |
| return existsIp4; |
| } |
| |
| namespace { |
| |
| UidRangeParcel makeUidRangeParcel(int start, int stop) { |
| UidRangeParcel res; |
| res.start = start; |
| res.stop = stop; |
| |
| return res; |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, NetworkInterfaces) { |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_EQ(EEXIST, mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE) |
| .serviceSpecificErrorCode()); |
| EXPECT_EQ(EEXIST, mNetd->networkCreateVpn(TEST_NETID1, true).serviceSpecificErrorCode()); |
| EXPECT_TRUE(mNetd->networkCreateVpn(TEST_NETID2, true).isOk()); |
| |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| EXPECT_EQ(EBUSY, |
| mNetd->networkAddInterface(TEST_NETID2, sTun.name()).serviceSpecificErrorCode()); |
| |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID2, sTun.name()).isOk()); |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID2).isOk()); |
| EXPECT_EQ(ENONET, mNetd->networkDestroy(TEST_NETID1).serviceSpecificErrorCode()); |
| } |
| |
| TEST_F(BinderTest, NetworkUidRules) { |
| const uint32_t RULE_PRIORITY_SECURE_VPN = 12000; |
| |
| EXPECT_TRUE(mNetd->networkCreateVpn(TEST_NETID1, true).isOk()); |
| EXPECT_EQ(EEXIST, mNetd->networkCreateVpn(TEST_NETID1, true).serviceSpecificErrorCode()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| std::vector<UidRangeParcel> uidRanges = {makeUidRangeParcel(BASE_UID + 8005, BASE_UID + 8012), |
| makeUidRangeParcel(BASE_UID + 8090, BASE_UID + 8099)}; |
| UidRangeParcel otherRange = makeUidRangeParcel(BASE_UID + 8190, BASE_UID + 8299); |
| std::string suffix = StringPrintf("lookup %s ", sTun.name().c_str()); |
| |
| EXPECT_TRUE(mNetd->networkAddUidRanges(TEST_NETID1, uidRanges).isOk()); |
| |
| EXPECT_TRUE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[0], suffix)); |
| EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, otherRange, suffix)); |
| EXPECT_TRUE(mNetd->networkRemoveUidRanges(TEST_NETID1, uidRanges).isOk()); |
| EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[0], suffix)); |
| |
| EXPECT_TRUE(mNetd->networkAddUidRanges(TEST_NETID1, uidRanges).isOk()); |
| EXPECT_TRUE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[1], suffix)); |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY_SECURE_VPN, uidRanges[1], suffix)); |
| |
| EXPECT_EQ(ENONET, mNetd->networkDestroy(TEST_NETID1).serviceSpecificErrorCode()); |
| } |
| |
| TEST_F(BinderTest, NetworkRejectNonSecureVpn) { |
| constexpr uint32_t RULE_PRIORITY = 12500; |
| |
| std::vector<UidRangeParcel> uidRanges = {makeUidRangeParcel(BASE_UID + 150, BASE_UID + 224), |
| makeUidRangeParcel(BASE_UID + 226, BASE_UID + 300)}; |
| |
| const std::vector<std::string> initialRulesV4 = listIpRules(IP_RULE_V4); |
| const std::vector<std::string> initialRulesV6 = listIpRules(IP_RULE_V6); |
| |
| // Create two valid rules. |
| ASSERT_TRUE(mNetd->networkRejectNonSecureVpn(true, uidRanges).isOk()); |
| EXPECT_EQ(initialRulesV4.size() + 2, listIpRules(IP_RULE_V4).size()); |
| EXPECT_EQ(initialRulesV6.size() + 2, listIpRules(IP_RULE_V6).size()); |
| for (auto const& range : uidRanges) { |
| EXPECT_TRUE(ipRuleExistsForRange(RULE_PRIORITY, range, "prohibit")); |
| } |
| |
| // Remove the rules. |
| ASSERT_TRUE(mNetd->networkRejectNonSecureVpn(false, uidRanges).isOk()); |
| EXPECT_EQ(initialRulesV4.size(), listIpRules(IP_RULE_V4).size()); |
| EXPECT_EQ(initialRulesV6.size(), listIpRules(IP_RULE_V6).size()); |
| for (auto const& range : uidRanges) { |
| EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY, range, "prohibit")); |
| } |
| |
| // Fail to remove the rules a second time after they are already deleted. |
| binder::Status status = mNetd->networkRejectNonSecureVpn(false, uidRanges); |
| ASSERT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_EQ(ENOENT, status.serviceSpecificErrorCode()); |
| |
| // All rules should be the same as before. |
| EXPECT_EQ(initialRulesV4, listIpRules(IP_RULE_V4)); |
| EXPECT_EQ(initialRulesV6, listIpRules(IP_RULE_V6)); |
| } |
| |
| // Create a socket pair that isLoopbackSocket won't think is local. |
| void BinderTest::fakeRemoteSocketPair(int *clientSocket, int *serverSocket, int *acceptedSocket) { |
| *serverSocket = socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0); |
| struct sockaddr_in6 server6 = { .sin6_family = AF_INET6, .sin6_addr = sTun.dstAddr() }; |
| ASSERT_EQ(0, bind(*serverSocket, (struct sockaddr *) &server6, sizeof(server6))); |
| |
| socklen_t addrlen = sizeof(server6); |
| ASSERT_EQ(0, getsockname(*serverSocket, (struct sockaddr *) &server6, &addrlen)); |
| ASSERT_EQ(0, listen(*serverSocket, 10)); |
| |
| *clientSocket = socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0); |
| struct sockaddr_in6 client6 = { .sin6_family = AF_INET6, .sin6_addr = sTun.srcAddr() }; |
| ASSERT_EQ(0, bind(*clientSocket, (struct sockaddr *) &client6, sizeof(client6))); |
| ASSERT_EQ(0, connect(*clientSocket, (struct sockaddr *) &server6, sizeof(server6))); |
| ASSERT_EQ(0, getsockname(*clientSocket, (struct sockaddr *) &client6, &addrlen)); |
| |
| *acceptedSocket = accept4(*serverSocket, (struct sockaddr *) &server6, &addrlen, SOCK_CLOEXEC); |
| ASSERT_NE(-1, *acceptedSocket); |
| |
| ASSERT_EQ(0, memcmp(&client6, &server6, sizeof(client6))); |
| } |
| |
| void checkSocketpairOpen(int clientSocket, int acceptedSocket) { |
| char buf[4096]; |
| EXPECT_EQ(4, write(clientSocket, "foo", sizeof("foo"))); |
| EXPECT_EQ(4, read(acceptedSocket, buf, sizeof(buf))); |
| EXPECT_EQ(0, memcmp(buf, "foo", sizeof("foo"))); |
| } |
| |
| void checkSocketpairClosed(int clientSocket, int acceptedSocket) { |
| // Check that the client socket was closed with ECONNABORTED. |
| int ret = write(clientSocket, "foo", sizeof("foo")); |
| int err = errno; |
| EXPECT_EQ(-1, ret); |
| EXPECT_EQ(ECONNABORTED, err); |
| |
| // Check that it sent a RST to the server. |
| ret = write(acceptedSocket, "foo", sizeof("foo")); |
| err = errno; |
| EXPECT_EQ(-1, ret); |
| EXPECT_EQ(ECONNRESET, err); |
| } |
| |
| TEST_F(BinderTest, SocketDestroy) { |
| int clientSocket, serverSocket, acceptedSocket; |
| ASSERT_NO_FATAL_FAILURE(fakeRemoteSocketPair(&clientSocket, &serverSocket, &acceptedSocket)); |
| |
| // Pick a random UID in the system UID range. |
| constexpr int baseUid = AID_APP - 2000; |
| static_assert(baseUid > 0, "Not enough UIDs? Please fix this test."); |
| int uid = baseUid + 500 + arc4random_uniform(1000); |
| EXPECT_EQ(0, fchown(clientSocket, uid, -1)); |
| |
| // UID ranges that don't contain uid. |
| std::vector<UidRangeParcel> uidRanges = { |
| makeUidRangeParcel(baseUid + 42, baseUid + 449), |
| makeUidRangeParcel(baseUid + 1536, AID_APP - 4), |
| makeUidRangeParcel(baseUid + 498, uid - 1), |
| makeUidRangeParcel(uid + 1, baseUid + 1520), |
| }; |
| // A skip list that doesn't contain UID. |
| std::vector<int32_t> skipUids { baseUid + 123, baseUid + 1600 }; |
| |
| // Close sockets. Our test socket should be intact. |
| EXPECT_TRUE(mNetd->socketDestroy(uidRanges, skipUids).isOk()); |
| checkSocketpairOpen(clientSocket, acceptedSocket); |
| |
| // UID ranges that do contain uid. |
| uidRanges = { |
| makeUidRangeParcel(baseUid + 42, baseUid + 449), |
| makeUidRangeParcel(baseUid + 1536, AID_APP - 4), |
| makeUidRangeParcel(baseUid + 498, baseUid + 1520), |
| }; |
| // Add uid to the skip list. |
| skipUids.push_back(uid); |
| |
| // Close sockets. Our test socket should still be intact because it's in the skip list. |
| EXPECT_TRUE(mNetd->socketDestroy(uidRanges, skipUids).isOk()); |
| checkSocketpairOpen(clientSocket, acceptedSocket); |
| |
| // Now remove uid from skipUids, and close sockets. Our test socket should have been closed. |
| skipUids.resize(skipUids.size() - 1); |
| EXPECT_TRUE(mNetd->socketDestroy(uidRanges, skipUids).isOk()); |
| checkSocketpairClosed(clientSocket, acceptedSocket); |
| |
| close(clientSocket); |
| close(serverSocket); |
| close(acceptedSocket); |
| } |
| |
| namespace { |
| |
| int netmaskToPrefixLength(const uint8_t *buf, size_t buflen) { |
| if (buf == nullptr) return -1; |
| |
| int prefixLength = 0; |
| bool endOfContiguousBits = false; |
| for (unsigned int i = 0; i < buflen; i++) { |
| const uint8_t value = buf[i]; |
| |
| // Bad bit sequence: check for a contiguous set of bits from the high |
| // end by verifying that the inverted value + 1 is a power of 2 |
| // (power of 2 iff. (v & (v - 1)) == 0). |
| const uint8_t inverse = ~value + 1; |
| if ((inverse & (inverse - 1)) != 0) return -1; |
| |
| prefixLength += (value == 0) ? 0 : CHAR_BIT - ffs(value) + 1; |
| |
| // Bogus netmask. |
| if (endOfContiguousBits && value != 0) return -1; |
| |
| if (value != 0xff) endOfContiguousBits = true; |
| } |
| |
| return prefixLength; |
| } |
| |
| template<typename T> |
| int netmaskToPrefixLength(const T *p) { |
| return netmaskToPrefixLength(reinterpret_cast<const uint8_t*>(p), sizeof(T)); |
| } |
| |
| |
| static bool interfaceHasAddress( |
| const std::string &ifname, const char *addrString, int prefixLength) { |
| struct addrinfo *addrinfoList = nullptr; |
| |
| const struct addrinfo hints = { |
| .ai_flags = AI_NUMERICHOST, |
| .ai_family = AF_UNSPEC, |
| .ai_socktype = SOCK_DGRAM, |
| }; |
| if (getaddrinfo(addrString, nullptr, &hints, &addrinfoList) != 0 || |
| addrinfoList == nullptr || addrinfoList->ai_addr == nullptr) { |
| return false; |
| } |
| ScopedAddrinfo addrinfoCleanup(addrinfoList); |
| |
| struct ifaddrs *ifaddrsList = nullptr; |
| ScopedIfaddrs ifaddrsCleanup(ifaddrsList); |
| |
| if (getifaddrs(&ifaddrsList) != 0) { |
| return false; |
| } |
| |
| for (struct ifaddrs *addr = ifaddrsList; addr != nullptr; addr = addr->ifa_next) { |
| if (std::string(addr->ifa_name) != ifname || |
| addr->ifa_addr == nullptr || |
| addr->ifa_addr->sa_family != addrinfoList->ai_addr->sa_family) { |
| continue; |
| } |
| |
| switch (addr->ifa_addr->sa_family) { |
| case AF_INET: { |
| auto *addr4 = reinterpret_cast<const struct sockaddr_in*>(addr->ifa_addr); |
| auto *want = reinterpret_cast<const struct sockaddr_in*>(addrinfoList->ai_addr); |
| if (memcmp(&addr4->sin_addr, &want->sin_addr, sizeof(want->sin_addr)) != 0) { |
| continue; |
| } |
| |
| if (prefixLength < 0) return true; // not checking prefix lengths |
| |
| if (addr->ifa_netmask == nullptr) return false; |
| auto *nm = reinterpret_cast<const struct sockaddr_in*>(addr->ifa_netmask); |
| EXPECT_EQ(prefixLength, netmaskToPrefixLength(&nm->sin_addr)); |
| return (prefixLength == netmaskToPrefixLength(&nm->sin_addr)); |
| } |
| case AF_INET6: { |
| auto *addr6 = reinterpret_cast<const struct sockaddr_in6*>(addr->ifa_addr); |
| auto *want = reinterpret_cast<const struct sockaddr_in6*>(addrinfoList->ai_addr); |
| if (memcmp(&addr6->sin6_addr, &want->sin6_addr, sizeof(want->sin6_addr)) != 0) { |
| continue; |
| } |
| |
| if (prefixLength < 0) return true; // not checking prefix lengths |
| |
| if (addr->ifa_netmask == nullptr) return false; |
| auto *nm = reinterpret_cast<const struct sockaddr_in6*>(addr->ifa_netmask); |
| EXPECT_EQ(prefixLength, netmaskToPrefixLength(&nm->sin6_addr)); |
| return (prefixLength == netmaskToPrefixLength(&nm->sin6_addr)); |
| } |
| default: |
| // Cannot happen because we have already screened for matching |
| // address families at the top of each iteration. |
| continue; |
| } |
| } |
| |
| return false; |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, InterfaceAddRemoveAddress) { |
| static const struct TestData { |
| const char *addrString; |
| const int prefixLength; |
| const bool expectSuccess; |
| } kTestData[] = { |
| { "192.0.2.1", 24, true }, |
| { "192.0.2.2", 25, true }, |
| { "192.0.2.3", 32, true }, |
| { "192.0.2.4", 33, false }, |
| { "192.not.an.ip", 24, false }, |
| { "2001:db8::1", 64, true }, |
| { "2001:db8::2", 65, true }, |
| { "2001:db8::3", 128, true }, |
| { "2001:db8::4", 129, false }, |
| { "foo:bar::bad", 64, false }, |
| }; |
| |
| for (size_t i = 0; i < std::size(kTestData); i++) { |
| const auto &td = kTestData[i]; |
| |
| // [1.a] Add the address. |
| binder::Status status = mNetd->interfaceAddAddress( |
| sTun.name(), td.addrString, td.prefixLength); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| } else { |
| ASSERT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| ASSERT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| |
| // [1.b] Verify the addition meets the expectation. |
| if (td.expectSuccess) { |
| EXPECT_TRUE(interfaceHasAddress(sTun.name(), td.addrString, td.prefixLength)); |
| } else { |
| EXPECT_FALSE(interfaceHasAddress(sTun.name(), td.addrString, -1)); |
| } |
| |
| // [2.a] Try to remove the address. If it was not previously added, removing it fails. |
| status = mNetd->interfaceDelAddress(sTun.name(), td.addrString, td.prefixLength); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| } else { |
| ASSERT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| ASSERT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| |
| // [2.b] No matter what, the address should not be present. |
| EXPECT_FALSE(interfaceHasAddress(sTun.name(), td.addrString, -1)); |
| } |
| } |
| |
| TEST_F(BinderTest, GetProcSysNet) { |
| const char LOOPBACK[] = "lo"; |
| static const struct { |
| const int ipversion; |
| const int which; |
| const char* ifname; |
| const char* parameter; |
| const char* expectedValue; |
| const int expectedReturnCode; |
| } kTestData[] = { |
| {INetd::IPV4, INetd::CONF, LOOPBACK, "arp_ignore", "0", 0}, |
| {-1, INetd::CONF, sTun.name().c_str(), "arp_ignore", nullptr, EAFNOSUPPORT}, |
| {INetd::IPV4, -1, sTun.name().c_str(), "arp_ignore", nullptr, EINVAL}, |
| {INetd::IPV4, INetd::CONF, "..", "conf/lo/arp_ignore", nullptr, EINVAL}, |
| {INetd::IPV4, INetd::CONF, ".", "lo/arp_ignore", nullptr, EINVAL}, |
| {INetd::IPV4, INetd::CONF, sTun.name().c_str(), "../all/arp_ignore", nullptr, EINVAL}, |
| {INetd::IPV6, INetd::NEIGH, LOOPBACK, "ucast_solicit", "3", 0}, |
| }; |
| |
| for (size_t i = 0; i < std::size(kTestData); i++) { |
| const auto& td = kTestData[i]; |
| |
| std::string value; |
| const binder::Status status = |
| mNetd->getProcSysNet(td.ipversion, td.which, td.ifname, td.parameter, &value); |
| |
| if (td.expectedReturnCode == 0) { |
| SCOPED_TRACE(String8::format("test case %zu should have passed", i)); |
| EXPECT_EQ(0, status.exceptionCode()); |
| EXPECT_EQ(0, status.serviceSpecificErrorCode()); |
| EXPECT_EQ(td.expectedValue, value); |
| } else { |
| SCOPED_TRACE(String8::format("test case %zu should have failed", i)); |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_EQ(td.expectedReturnCode, status.serviceSpecificErrorCode()); |
| } |
| } |
| } |
| |
| TEST_F(BinderTest, SetProcSysNet) { |
| static const struct { |
| const int ipversion; |
| const int which; |
| const char* ifname; |
| const char* parameter; |
| const char* value; |
| const int expectedReturnCode; |
| } kTestData[] = { |
| {INetd::IPV4, INetd::CONF, sTun.name().c_str(), "arp_ignore", "1", 0}, |
| {-1, INetd::CONF, sTun.name().c_str(), "arp_ignore", "1", EAFNOSUPPORT}, |
| {INetd::IPV4, -1, sTun.name().c_str(), "arp_ignore", "1", EINVAL}, |
| {INetd::IPV4, INetd::CONF, "..", "conf/lo/arp_ignore", "1", EINVAL}, |
| {INetd::IPV4, INetd::CONF, ".", "lo/arp_ignore", "1", EINVAL}, |
| {INetd::IPV4, INetd::CONF, sTun.name().c_str(), "../all/arp_ignore", "1", EINVAL}, |
| {INetd::IPV6, INetd::NEIGH, sTun.name().c_str(), "ucast_solicit", "7", 0}, |
| }; |
| |
| for (size_t i = 0; i < std::size(kTestData); i++) { |
| const auto& td = kTestData[i]; |
| const binder::Status status = |
| mNetd->setProcSysNet(td.ipversion, td.which, td.ifname, td.parameter, td.value); |
| |
| if (td.expectedReturnCode == 0) { |
| SCOPED_TRACE(String8::format("test case %zu should have passed", i)); |
| EXPECT_EQ(0, status.exceptionCode()); |
| EXPECT_EQ(0, status.serviceSpecificErrorCode()); |
| } else { |
| SCOPED_TRACE(String8::format("test case %zu should have failed", i)); |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_EQ(td.expectedReturnCode, status.serviceSpecificErrorCode()); |
| } |
| } |
| } |
| |
| TEST_F(BinderTest, GetSetProcSysNet) { |
| const int ipversion = INetd::IPV6; |
| const int category = INetd::NEIGH; |
| const std::string& tun = sTun.name(); |
| const std::string parameter("ucast_solicit"); |
| |
| std::string value{}; |
| EXPECT_TRUE(mNetd->getProcSysNet(ipversion, category, tun, parameter, &value).isOk()); |
| ASSERT_FALSE(value.empty()); |
| const int ival = std::stoi(value); |
| EXPECT_GT(ival, 0); |
| // Try doubling the parameter value (always best!). |
| EXPECT_TRUE(mNetd->setProcSysNet(ipversion, category, tun, parameter, std::to_string(2 * ival)) |
| .isOk()); |
| EXPECT_TRUE(mNetd->getProcSysNet(ipversion, category, tun, parameter, &value).isOk()); |
| EXPECT_EQ(2 * ival, std::stoi(value)); |
| // Try resetting the parameter. |
| EXPECT_TRUE(mNetd->setProcSysNet(ipversion, category, tun, parameter, std::to_string(ival)) |
| .isOk()); |
| EXPECT_TRUE(mNetd->getProcSysNet(ipversion, category, tun, parameter, &value).isOk()); |
| EXPECT_EQ(ival, std::stoi(value)); |
| } |
| |
| namespace { |
| |
| void expectNoTestCounterRules() { |
| for (const auto& binary : { IPTABLES_PATH, IP6TABLES_PATH }) { |
| std::string command = StringPrintf("%s -w -nvL tetherctrl_counters", binary); |
| std::string allRules = Join(runCommand(command), "\n"); |
| EXPECT_EQ(std::string::npos, allRules.find("netdtest_")); |
| } |
| } |
| |
| void addTetherCounterValues(const char* path, const std::string& if1, const std::string& if2, |
| int byte, int pkt) { |
| runCommand(StringPrintf("%s -w -A tetherctrl_counters -i %s -o %s -j RETURN -c %d %d", |
| path, if1.c_str(), if2.c_str(), pkt, byte)); |
| } |
| |
| void delTetherCounterValues(const char* path, const std::string& if1, const std::string& if2) { |
| runCommand(StringPrintf("%s -w -D tetherctrl_counters -i %s -o %s -j RETURN", |
| path, if1.c_str(), if2.c_str())); |
| runCommand(StringPrintf("%s -w -D tetherctrl_counters -i %s -o %s -j RETURN", |
| path, if2.c_str(), if1.c_str())); |
| } |
| |
| std::vector<int64_t> getStatsVectorByIf(const std::vector<TetherStatsParcel>& statsVec, |
| const std::string& iface) { |
| for (auto& stats : statsVec) { |
| if (stats.iface == iface) { |
| return {stats.rxBytes, stats.rxPackets, stats.txBytes, stats.txPackets}; |
| } |
| } |
| return {}; |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, TetherGetStats) { |
| expectNoTestCounterRules(); |
| |
| // TODO: fold this into more comprehensive tests once we have binder RPCs for enabling and |
| // disabling tethering. We don't check the return value because these commands will fail if |
| // tethering is already enabled. |
| runCommand(StringPrintf("%s -w -N tetherctrl_counters", IPTABLES_PATH)); |
| runCommand(StringPrintf("%s -w -N tetherctrl_counters", IP6TABLES_PATH)); |
| |
| std::string intIface1 = StringPrintf("netdtest_%u", arc4random_uniform(10000)); |
| std::string intIface2 = StringPrintf("netdtest_%u", arc4random_uniform(10000)); |
| std::string intIface3 = StringPrintf("netdtest_%u", arc4random_uniform(10000)); |
| std::string extIface1 = StringPrintf("netdtest_%u", arc4random_uniform(10000)); |
| std::string extIface2 = StringPrintf("netdtest_%u", arc4random_uniform(10000)); |
| |
| addTetherCounterValues(IPTABLES_PATH, intIface1, extIface1, 123, 111); |
| addTetherCounterValues(IP6TABLES_PATH, intIface1, extIface1, 456, 10); |
| addTetherCounterValues(IPTABLES_PATH, extIface1, intIface1, 321, 222); |
| addTetherCounterValues(IP6TABLES_PATH, extIface1, intIface1, 654, 20); |
| // RX is from external to internal, and TX is from internal to external. |
| // So rxBytes is 321 + 654 = 975, txBytes is 123 + 456 = 579, etc. |
| std::vector<int64_t> expected1 = { 975, 242, 579, 121 }; |
| |
| addTetherCounterValues(IPTABLES_PATH, intIface2, extIface2, 1000, 333); |
| addTetherCounterValues(IP6TABLES_PATH, intIface2, extIface2, 3000, 30); |
| |
| addTetherCounterValues(IPTABLES_PATH, extIface2, intIface2, 2000, 444); |
| addTetherCounterValues(IP6TABLES_PATH, extIface2, intIface2, 4000, 40); |
| |
| addTetherCounterValues(IP6TABLES_PATH, intIface3, extIface2, 1000, 25); |
| addTetherCounterValues(IP6TABLES_PATH, extIface2, intIface3, 2000, 35); |
| std::vector<int64_t> expected2 = { 8000, 519, 5000, 388 }; |
| |
| std::vector<TetherStatsParcel> statsVec; |
| binder::Status status = mNetd->tetherGetStats(&statsVec); |
| EXPECT_TRUE(status.isOk()) << "Getting tethering stats failed: " << status; |
| |
| EXPECT_EQ(expected1, getStatsVectorByIf(statsVec, extIface1)); |
| |
| EXPECT_EQ(expected2, getStatsVectorByIf(statsVec, extIface2)); |
| |
| for (const auto& path : { IPTABLES_PATH, IP6TABLES_PATH }) { |
| delTetherCounterValues(path, intIface1, extIface1); |
| delTetherCounterValues(path, intIface2, extIface2); |
| if (path == IP6TABLES_PATH) { |
| delTetherCounterValues(path, intIface3, extIface2); |
| } |
| } |
| |
| expectNoTestCounterRules(); |
| } |
| |
| namespace { |
| |
| constexpr char IDLETIMER_RAW_PREROUTING[] = "idletimer_raw_PREROUTING"; |
| constexpr char IDLETIMER_MANGLE_POSTROUTING[] = "idletimer_mangle_POSTROUTING"; |
| |
| static std::vector<std::string> listIptablesRuleByTable(const char* binary, const char* table, |
| const char* chainName) { |
| std::string command = StringPrintf("%s -t %s -w -n -v -L %s", binary, table, chainName); |
| return runCommand(command); |
| } |
| |
| // TODO: It is a duplicate function, need to remove it |
| bool iptablesIdleTimerInterfaceRuleExists(const char* binary, const char* chainName, |
| const std::string& expectedInterface, |
| const std::string& expectedRule, const char* table) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName); |
| for (const auto& rule : rules) { |
| if (rule.find(expectedInterface) != std::string::npos) { |
| if (rule.find(expectedRule) != std::string::npos) { |
| return true; |
| } |
| } |
| } |
| return false; |
| } |
| |
| void expectIdletimerInterfaceRuleExists(const std::string& ifname, int timeout, |
| const std::string& classLabel) { |
| std::string IdletimerRule = |
| StringPrintf("timeout:%u label:%s send_nl_msg:1", timeout, classLabel.c_str()); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_RAW_PREROUTING, ifname, |
| IdletimerRule, RAW_TABLE)); |
| EXPECT_TRUE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_MANGLE_POSTROUTING, |
| ifname, IdletimerRule, MANGLE_TABLE)); |
| } |
| } |
| |
| void expectIdletimerInterfaceRuleNotExists(const std::string& ifname, int timeout, |
| const std::string& classLabel) { |
| std::string IdletimerRule = |
| StringPrintf("timeout:%u label:%s send_nl_msg:1", timeout, classLabel.c_str()); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_FALSE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_RAW_PREROUTING, ifname, |
| IdletimerRule, RAW_TABLE)); |
| EXPECT_FALSE(iptablesIdleTimerInterfaceRuleExists(binary, IDLETIMER_MANGLE_POSTROUTING, |
| ifname, IdletimerRule, MANGLE_TABLE)); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, IdletimerAddRemoveInterface) { |
| // TODO: We will get error in if expectIdletimerInterfaceRuleNotExists if there are the same |
| // rule in the table. Because we only check the result after calling remove function. We might |
| // check the actual rule which is removed by our function (maybe compare the results between |
| // calling function before and after) |
| binder::Status status; |
| const struct TestData { |
| const std::string ifname; |
| int32_t timeout; |
| const std::string classLabel; |
| } idleTestData[] = { |
| {"wlan0", 1234, "happyday"}, |
| {"rmnet_data0", 4567, "friday"}, |
| }; |
| for (const auto& td : idleTestData) { |
| status = mNetd->idletimerAddInterface(td.ifname, td.timeout, td.classLabel); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectIdletimerInterfaceRuleExists(td.ifname, td.timeout, td.classLabel); |
| |
| status = mNetd->idletimerRemoveInterface(td.ifname, td.timeout, td.classLabel); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectIdletimerInterfaceRuleNotExists(td.ifname, td.timeout, td.classLabel); |
| } |
| } |
| |
| namespace { |
| |
| constexpr char STRICT_OUTPUT[] = "st_OUTPUT"; |
| constexpr char STRICT_CLEAR_CAUGHT[] = "st_clear_caught"; |
| |
| void expectStrictSetUidAccept(const int uid) { |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| std::string perUidChain = StringPrintf("st_clear_caught_%u", uid); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_FALSE(iptablesRuleExists(binary, STRICT_OUTPUT, uidRule)); |
| EXPECT_FALSE(iptablesRuleExists(binary, STRICT_CLEAR_CAUGHT, uidRule)); |
| EXPECT_EQ(0, iptablesRuleLineLength(binary, perUidChain.c_str())); |
| } |
| } |
| |
| void expectStrictSetUidLog(const int uid) { |
| static const char logRule[] = "st_penalty_log all"; |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| std::string perUidChain = StringPrintf("st_clear_caught_%u", uid); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesRuleExists(binary, STRICT_OUTPUT, uidRule)); |
| EXPECT_TRUE(iptablesRuleExists(binary, STRICT_CLEAR_CAUGHT, uidRule)); |
| EXPECT_TRUE(iptablesRuleExists(binary, perUidChain.c_str(), logRule)); |
| } |
| } |
| |
| void expectStrictSetUidReject(const int uid) { |
| static const char rejectRule[] = "st_penalty_reject all"; |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| std::string perUidChain = StringPrintf("st_clear_caught_%u", uid); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesRuleExists(binary, STRICT_OUTPUT, uidRule)); |
| EXPECT_TRUE(iptablesRuleExists(binary, STRICT_CLEAR_CAUGHT, uidRule)); |
| EXPECT_TRUE(iptablesRuleExists(binary, perUidChain.c_str(), rejectRule)); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, StrictSetUidCleartextPenalty) { |
| binder::Status status; |
| int32_t uid = randomUid(); |
| |
| // setUidCleartextPenalty Policy:Log with randomUid |
| status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_LOG); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectStrictSetUidLog(uid); |
| |
| // setUidCleartextPenalty Policy:Accept with randomUid |
| status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_ACCEPT); |
| expectStrictSetUidAccept(uid); |
| |
| // setUidCleartextPenalty Policy:Reject with randomUid |
| status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_REJECT); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectStrictSetUidReject(uid); |
| |
| // setUidCleartextPenalty Policy:Accept with randomUid |
| status = mNetd->strictUidCleartextPenalty(uid, INetd::PENALTY_POLICY_ACCEPT); |
| expectStrictSetUidAccept(uid); |
| |
| // test wrong policy |
| int32_t wrongPolicy = -123; |
| status = mNetd->strictUidCleartextPenalty(uid, wrongPolicy); |
| EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode()); |
| } |
| |
| namespace { |
| |
| std::vector<std::string> tryToFindProcesses(const std::string& processName, uint32_t maxTries = 1, |
| uint32_t intervalMs = 50) { |
| // Output looks like:(clatd) |
| // clat 4963 850 1 12:16:51 ? 00:00:00 clatd-netd10a88 -i netd10a88 ... |
| // ... |
| // root 5221 5219 0 12:18:12 ? 00:00:00 sh -c ps -Af | grep ' clatd-netdcc1a0' |
| |
| // (dnsmasq) |
| // dns_tether 4620 792 0 16:51:28 ? 00:00:00 dnsmasq --keep-in-foreground ... |
| |
| if (maxTries == 0) return {}; |
| |
| std::string cmd = StringPrintf("ps -Af | grep '[0-9] %s'", processName.c_str()); |
| std::vector<std::string> result; |
| for (uint32_t run = 1;;) { |
| result = runCommand(cmd); |
| if (result.size() || ++run > maxTries) { |
| break; |
| } |
| |
| usleep(intervalMs * 1000); |
| } |
| return result; |
| } |
| |
| void expectProcessExists(const std::string& processName) { |
| EXPECT_EQ(1U, tryToFindProcesses(processName, 5 /*maxTries*/).size()); |
| } |
| |
| void expectProcessDoesNotExist(const std::string& processName) { |
| EXPECT_FALSE(tryToFindProcesses(processName).size()); |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, ClatdStartStop) { |
| binder::Status status; |
| |
| const std::string clatdName = StringPrintf("clatd-%s", sTun.name().c_str()); |
| std::string clatAddress; |
| std::string nat64Prefix = "2001:db8:cafe:f00d:1:2::/96"; |
| |
| // Can't start clatd on an interface that's not part of any network... |
| status = mNetd->clatdStart(sTun.name(), nat64Prefix, &clatAddress); |
| EXPECT_FALSE(status.isOk()); |
| EXPECT_EQ(ENODEV, status.serviceSpecificErrorCode()); |
| |
| // ... so create a test physical network and add our tun to it. |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| // Prefix must be 96 bits long. |
| status = mNetd->clatdStart(sTun.name(), "2001:db8:cafe:f00d::/64", &clatAddress); |
| EXPECT_FALSE(status.isOk()); |
| EXPECT_EQ(EINVAL, status.serviceSpecificErrorCode()); |
| |
| // Can't start clatd unless there's a default route... |
| status = mNetd->clatdStart(sTun.name(), nat64Prefix, &clatAddress); |
| EXPECT_FALSE(status.isOk()); |
| EXPECT_EQ(EADDRNOTAVAIL, status.serviceSpecificErrorCode()); |
| |
| // so add a default route. |
| EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk()); |
| |
| // Can't start clatd unless there's a global address... |
| status = mNetd->clatdStart(sTun.name(), nat64Prefix, &clatAddress); |
| EXPECT_FALSE(status.isOk()); |
| EXPECT_EQ(EADDRNOTAVAIL, status.serviceSpecificErrorCode()); |
| |
| // ... so add a global address. |
| const std::string v6 = "2001:db8:1:2:f076:ae99:124e:aa99"; |
| EXPECT_EQ(0, sTun.addAddress(v6.c_str(), 64)); |
| |
| // Now expect clatd to start successfully. |
| status = mNetd->clatdStart(sTun.name(), nat64Prefix, &clatAddress); |
| EXPECT_TRUE(status.isOk()); |
| EXPECT_EQ(0, status.serviceSpecificErrorCode()); |
| |
| // Starting it again returns EBUSY. |
| status = mNetd->clatdStart(sTun.name(), nat64Prefix, &clatAddress); |
| EXPECT_FALSE(status.isOk()); |
| EXPECT_EQ(EBUSY, status.serviceSpecificErrorCode()); |
| |
| expectProcessExists(clatdName); |
| |
| // Expect clatd to stop successfully. |
| status = mNetd->clatdStop(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectProcessDoesNotExist(clatdName); |
| |
| // Stopping a clatd that doesn't exist returns ENODEV. |
| status = mNetd->clatdStop(sTun.name()); |
| EXPECT_FALSE(status.isOk()); |
| EXPECT_EQ(ENODEV, status.serviceSpecificErrorCode()); |
| expectProcessDoesNotExist(clatdName); |
| |
| // Clean up. |
| EXPECT_TRUE(mNetd->networkRemoveRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk()); |
| EXPECT_EQ(0, ifc_del_address(sTun.name().c_str(), v6.c_str(), 64)); |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| namespace { |
| |
| bool getIpfwdV4Enable() { |
| static const char ipv4IpfwdCmd[] = "cat /proc/sys/net/ipv4/ip_forward"; |
| std::vector<std::string> result = runCommand(ipv4IpfwdCmd); |
| EXPECT_TRUE(!result.empty()); |
| int v4Enable = std::stoi(result[0]); |
| return v4Enable; |
| } |
| |
| bool getIpfwdV6Enable() { |
| static const char ipv6IpfwdCmd[] = "cat /proc/sys/net/ipv6/conf/all/forwarding"; |
| std::vector<std::string> result = runCommand(ipv6IpfwdCmd); |
| EXPECT_TRUE(!result.empty()); |
| int v6Enable = std::stoi(result[0]); |
| return v6Enable; |
| } |
| |
| void expectIpfwdEnable(bool enable) { |
| int enableIPv4 = getIpfwdV4Enable(); |
| int enableIPv6 = getIpfwdV6Enable(); |
| EXPECT_EQ(enable, enableIPv4); |
| EXPECT_EQ(enable, enableIPv6); |
| } |
| |
| bool ipRuleIpfwdExists(const char* ipVersion, const std::string& ipfwdRule) { |
| std::vector<std::string> rules = listIpRules(ipVersion); |
| for (const auto& rule : rules) { |
| if (rule.find(ipfwdRule) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| void expectIpfwdRuleExists(const char* fromIf, const char* toIf) { |
| std::string ipfwdRule = StringPrintf("18000:\tfrom all iif %s lookup %s ", fromIf, toIf); |
| |
| for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) { |
| EXPECT_TRUE(ipRuleIpfwdExists(ipVersion, ipfwdRule)); |
| } |
| } |
| |
| void expectIpfwdRuleNotExists(const char* fromIf, const char* toIf) { |
| std::string ipfwdRule = StringPrintf("18000:\tfrom all iif %s lookup %s ", fromIf, toIf); |
| |
| for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) { |
| EXPECT_FALSE(ipRuleIpfwdExists(ipVersion, ipfwdRule)); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, TestIpfwdEnableDisableStatusForwarding) { |
| // Get ipfwd requester list from Netd |
| std::vector<std::string> requesterList; |
| binder::Status status = mNetd->ipfwdGetRequesterList(&requesterList); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| bool ipfwdEnabled; |
| if (requesterList.size() == 0) { |
| // No requester in Netd, ipfwd should be disabled |
| // So add one test requester and verify |
| status = mNetd->ipfwdEnableForwarding("TestRequester"); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| expectIpfwdEnable(true); |
| status = mNetd->ipfwdEnabled(&ipfwdEnabled); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| EXPECT_TRUE(ipfwdEnabled); |
| |
| // Remove test one, verify again |
| status = mNetd->ipfwdDisableForwarding("TestRequester"); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| expectIpfwdEnable(false); |
| status = mNetd->ipfwdEnabled(&ipfwdEnabled); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| EXPECT_FALSE(ipfwdEnabled); |
| } else { |
| // Disable all requesters |
| for (const auto& requester : requesterList) { |
| status = mNetd->ipfwdDisableForwarding(requester); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| } |
| |
| // After disable all requester, ipfwd should be disabled |
| expectIpfwdEnable(false); |
| status = mNetd->ipfwdEnabled(&ipfwdEnabled); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| EXPECT_FALSE(ipfwdEnabled); |
| |
| // Enable them back |
| for (const auto& requester : requesterList) { |
| status = mNetd->ipfwdEnableForwarding(requester); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| } |
| |
| // ipfwd should be enabled |
| expectIpfwdEnable(true); |
| status = mNetd->ipfwdEnabled(&ipfwdEnabled); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| EXPECT_TRUE(ipfwdEnabled); |
| } |
| } |
| |
| TEST_F(BinderTest, TestIpfwdAddRemoveInterfaceForward) { |
| // Add test physical network |
| EXPECT_TRUE( |
| mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| EXPECT_TRUE( |
| mNetd->networkCreatePhysical(TEST_NETID2, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID2, sTun2.name()).isOk()); |
| |
| binder::Status status = |
| mNetd->ipfwdAddInterfaceForward(sTun.name(), sTun2.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectIpfwdRuleExists(sTun.name().c_str(), sTun2.name().c_str()); |
| |
| status = mNetd->ipfwdRemoveInterfaceForward(sTun.name(), sTun2.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectIpfwdRuleNotExists(sTun.name().c_str(), sTun2.name().c_str()); |
| } |
| |
| namespace { |
| |
| constexpr char BANDWIDTH_INPUT[] = "bw_INPUT"; |
| constexpr char BANDWIDTH_OUTPUT[] = "bw_OUTPUT"; |
| constexpr char BANDWIDTH_FORWARD[] = "bw_FORWARD"; |
| constexpr char BANDWIDTH_NAUGHTY[] = "bw_penalty_box"; |
| constexpr char BANDWIDTH_NICE[] = "bw_happy_box"; |
| constexpr char BANDWIDTH_ALERT[] = "bw_global_alert"; |
| |
| // TODO: Move iptablesTargetsExists and listIptablesRuleByTable to the top. |
| // Use either a std::vector<std::string> of things to match, or a variadic function. |
| bool iptablesTargetsExists(const char* binary, int expectedCount, const char* table, |
| const char* chainName, const std::string& expectedTargetA, |
| const std::string& expectedTargetB) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName); |
| int matchCount = 0; |
| |
| for (const auto& rule : rules) { |
| if (rule.find(expectedTargetA) != std::string::npos) { |
| if (rule.find(expectedTargetB) != std::string::npos) { |
| matchCount++; |
| } |
| } |
| } |
| return matchCount == expectedCount; |
| } |
| |
| void expectXtQuotaValueEqual(const char* ifname, long quotaBytes) { |
| std::string path = StringPrintf("/proc/net/xt_quota/%s", ifname); |
| std::string result = ""; |
| |
| EXPECT_TRUE(ReadFileToString(path, &result)); |
| // Quota value might be decreased while matching packets |
| EXPECT_GE(quotaBytes, std::stol(Trim(result))); |
| } |
| |
| void expectBandwidthInterfaceQuotaRuleExists(const char* ifname, long quotaBytes) { |
| std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname); |
| std::string quotaRule = StringPrintf("quota %s", ifname); |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_INPUT, ifname, |
| BANDWIDTH_COSTLY_IF)); |
| EXPECT_TRUE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_OUTPUT, ifname, |
| BANDWIDTH_COSTLY_IF)); |
| EXPECT_TRUE(iptablesTargetsExists(binary, 2, FILTER_TABLE, BANDWIDTH_FORWARD, ifname, |
| BANDWIDTH_COSTLY_IF)); |
| EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), BANDWIDTH_NAUGHTY)); |
| EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), quotaRule)); |
| } |
| expectXtQuotaValueEqual(ifname, quotaBytes); |
| } |
| |
| void expectBandwidthInterfaceQuotaRuleDoesNotExist(const char* ifname) { |
| std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname); |
| std::string quotaRule = StringPrintf("quota %s", ifname); |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_FALSE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_INPUT, ifname, |
| BANDWIDTH_COSTLY_IF)); |
| EXPECT_FALSE(iptablesTargetsExists(binary, 1, FILTER_TABLE, BANDWIDTH_OUTPUT, ifname, |
| BANDWIDTH_COSTLY_IF)); |
| EXPECT_FALSE(iptablesTargetsExists(binary, 2, FILTER_TABLE, BANDWIDTH_FORWARD, ifname, |
| BANDWIDTH_COSTLY_IF)); |
| EXPECT_FALSE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), BANDWIDTH_NAUGHTY)); |
| EXPECT_FALSE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), quotaRule)); |
| } |
| } |
| |
| void expectBandwidthInterfaceAlertRuleExists(const char* ifname, long alertBytes) { |
| std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname); |
| std::string alertRule = StringPrintf("quota %sAlert", ifname); |
| std::string alertName = StringPrintf("%sAlert", ifname); |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), alertRule)); |
| } |
| expectXtQuotaValueEqual(alertName.c_str(), alertBytes); |
| } |
| |
| void expectBandwidthInterfaceAlertRuleDoesNotExist(const char* ifname) { |
| std::string BANDWIDTH_COSTLY_IF = StringPrintf("bw_costly_%s", ifname); |
| std::string alertRule = StringPrintf("quota %sAlert", ifname); |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_FALSE(iptablesRuleExists(binary, BANDWIDTH_COSTLY_IF.c_str(), alertRule)); |
| } |
| } |
| |
| void expectBandwidthGlobalAlertRuleExists(long alertBytes) { |
| static const char globalAlertRule[] = "quota globalAlert"; |
| static const char globalAlertName[] = "globalAlert"; |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesRuleExists(binary, BANDWIDTH_ALERT, globalAlertRule)); |
| } |
| expectXtQuotaValueEqual(globalAlertName, alertBytes); |
| } |
| |
| void expectBandwidthManipulateSpecialAppRuleExists(const char* chain, const char* target, int uid) { |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesTargetsExists(binary, 1, FILTER_TABLE, chain, target, uidRule)); |
| } |
| } |
| |
| void expectBandwidthManipulateSpecialAppRuleDoesNotExist(const char* chain, int uid) { |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_FALSE(iptablesRuleExists(binary, chain, uidRule)); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, BandwidthSetRemoveInterfaceQuota) { |
| long testQuotaBytes = 5550; |
| |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| binder::Status status = mNetd->bandwidthSetInterfaceQuota(sTun.name(), testQuotaBytes); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthInterfaceQuotaRuleExists(sTun.name().c_str(), testQuotaBytes); |
| |
| status = mNetd->bandwidthRemoveInterfaceQuota(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthInterfaceQuotaRuleDoesNotExist(sTun.name().c_str()); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, BandwidthSetRemoveInterfaceAlert) { |
| long testAlertBytes = 373; |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| // Need to have a prior interface quota set to set an alert |
| binder::Status status = mNetd->bandwidthSetInterfaceQuota(sTun.name(), testAlertBytes); |
| status = mNetd->bandwidthSetInterfaceAlert(sTun.name(), testAlertBytes); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthInterfaceAlertRuleExists(sTun.name().c_str(), testAlertBytes); |
| |
| status = mNetd->bandwidthRemoveInterfaceAlert(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthInterfaceAlertRuleDoesNotExist(sTun.name().c_str()); |
| |
| // Remove interface quota |
| status = mNetd->bandwidthRemoveInterfaceQuota(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthInterfaceQuotaRuleDoesNotExist(sTun.name().c_str()); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, BandwidthSetGlobalAlert) { |
| long testAlertBytes = 2097149; |
| |
| binder::Status status = mNetd->bandwidthSetGlobalAlert(testAlertBytes); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthGlobalAlertRuleExists(testAlertBytes); |
| |
| testAlertBytes = 2097152; |
| status = mNetd->bandwidthSetGlobalAlert(testAlertBytes); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthGlobalAlertRuleExists(testAlertBytes); |
| } |
| |
| TEST_F(BinderTest, BandwidthManipulateSpecialApp) { |
| SKIP_IF_BPF_SUPPORTED; |
| |
| int32_t uid = randomUid(); |
| static const char targetReject[] = "REJECT"; |
| static const char targetReturn[] = "RETURN"; |
| |
| // add NaughtyApp |
| binder::Status status = mNetd->bandwidthAddNaughtyApp(uid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthManipulateSpecialAppRuleExists(BANDWIDTH_NAUGHTY, targetReject, uid); |
| |
| // remove NaughtyApp |
| status = mNetd->bandwidthRemoveNaughtyApp(uid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthManipulateSpecialAppRuleDoesNotExist(BANDWIDTH_NAUGHTY, uid); |
| |
| // add NiceApp |
| status = mNetd->bandwidthAddNiceApp(uid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthManipulateSpecialAppRuleExists(BANDWIDTH_NICE, targetReturn, uid); |
| |
| // remove NiceApp |
| status = mNetd->bandwidthRemoveNiceApp(uid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectBandwidthManipulateSpecialAppRuleDoesNotExist(BANDWIDTH_NICE, uid); |
| } |
| |
| namespace { |
| |
| std::vector<std::string> listIpRoutes(const char* ipVersion, const char* table) { |
| std::string command = StringPrintf("%s %s route ls table %s", IP_PATH, ipVersion, table); |
| return runCommand(command); |
| } |
| |
| bool ipRouteExists(const char* ipVersion, const char* table, const std::string& ipRoute) { |
| std::vector<std::string> routes = listIpRoutes(ipVersion, table); |
| for (const auto& route : routes) { |
| if (route.find(ipRoute) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| std::string ipRouteString(const std::string& ifName, const std::string& dst, |
| const std::string& nextHop) { |
| std::string dstString = (dst == "0.0.0.0/0" || dst == "::/0") ? "default" : dst; |
| |
| if (!nextHop.empty()) { |
| dstString += " via " + nextHop; |
| } |
| |
| return dstString + " dev " + ifName; |
| } |
| |
| void expectNetworkRouteExists(const char* ipVersion, const std::string& ifName, |
| const std::string& dst, const std::string& nextHop, |
| const char* table) { |
| EXPECT_TRUE(ipRouteExists(ipVersion, table, ipRouteString(ifName, dst, nextHop))); |
| } |
| |
| void expectNetworkRouteDoesNotExist(const char* ipVersion, const std::string& ifName, |
| const std::string& dst, const std::string& nextHop, |
| const char* table) { |
| EXPECT_FALSE(ipRouteExists(ipVersion, table, ipRouteString(ifName, dst, nextHop))); |
| } |
| |
| bool ipRuleExists(const char* ipVersion, const std::string& ipRule) { |
| std::vector<std::string> rules = listIpRules(ipVersion); |
| for (const auto& rule : rules) { |
| if (rule.find(ipRule) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| void expectNetworkDefaultIpRuleExists(const char* ifName) { |
| std::string networkDefaultRule = |
| StringPrintf("22000:\tfrom all fwmark 0x0/0xffff iif lo lookup %s", ifName); |
| |
| for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) { |
| EXPECT_TRUE(ipRuleExists(ipVersion, networkDefaultRule)); |
| } |
| } |
| |
| void expectNetworkDefaultIpRuleDoesNotExist() { |
| static const char networkDefaultRule[] = "22000:\tfrom all fwmark 0x0/0xffff iif lo"; |
| |
| for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) { |
| EXPECT_FALSE(ipRuleExists(ipVersion, networkDefaultRule)); |
| } |
| } |
| |
| void expectNetworkPermissionIpRuleExists(const char* ifName, int permission) { |
| std::string networkPermissionRule = ""; |
| switch (permission) { |
| case INetd::PERMISSION_NONE: |
| networkPermissionRule = StringPrintf( |
| "13000:\tfrom all fwmark 0x1ffdd/0x1ffff iif lo lookup %s", ifName); |
| break; |
| case INetd::PERMISSION_NETWORK: |
| networkPermissionRule = StringPrintf( |
| "13000:\tfrom all fwmark 0x5ffdd/0x5ffff iif lo lookup %s", ifName); |
| break; |
| case INetd::PERMISSION_SYSTEM: |
| networkPermissionRule = StringPrintf( |
| "13000:\tfrom all fwmark 0xdffdd/0xdffff iif lo lookup %s", ifName); |
| break; |
| } |
| |
| for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) { |
| EXPECT_TRUE(ipRuleExists(ipVersion, networkPermissionRule)); |
| } |
| } |
| |
| // TODO: It is a duplicate function, need to remove it |
| bool iptablesNetworkPermissionIptablesRuleExists(const char* binary, const char* chainName, |
| const std::string& expectedInterface, |
| const std::string& expectedRule, |
| const char* table) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName); |
| for (const auto& rule : rules) { |
| if (rule.find(expectedInterface) != std::string::npos) { |
| if (rule.find(expectedRule) != std::string::npos) { |
| return true; |
| } |
| } |
| } |
| return false; |
| } |
| |
| void expectNetworkPermissionIptablesRuleExists(const char* ifName, int permission) { |
| static const char ROUTECTRL_INPUT[] = "routectrl_mangle_INPUT"; |
| std::string networkIncomingPacketMarkRule = ""; |
| switch (permission) { |
| case INetd::PERMISSION_NONE: |
| networkIncomingPacketMarkRule = "MARK xset 0x3ffdd/0xffefffff"; |
| break; |
| case INetd::PERMISSION_NETWORK: |
| networkIncomingPacketMarkRule = "MARK xset 0x7ffdd/0xffefffff"; |
| break; |
| case INetd::PERMISSION_SYSTEM: |
| networkIncomingPacketMarkRule = "MARK xset 0xfffdd/0xffefffff"; |
| break; |
| } |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesNetworkPermissionIptablesRuleExists( |
| binary, ROUTECTRL_INPUT, ifName, networkIncomingPacketMarkRule, MANGLE_TABLE)); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, NetworkAddRemoveRouteUserPermission) { |
| static const struct { |
| const char* ipVersion; |
| const char* testDest; |
| const char* testNextHop; |
| const bool expectSuccess; |
| } kTestData[] = { |
| {IP_RULE_V4, "0.0.0.0/0", "", true}, |
| {IP_RULE_V4, "0.0.0.0/0", "10.251.10.0", true}, |
| {IP_RULE_V4, "10.251.0.0/16", "", true}, |
| {IP_RULE_V4, "10.251.0.0/16", "10.251.10.0", true}, |
| {IP_RULE_V4, "10.251.0.0/16", "fe80::/64", false}, |
| {IP_RULE_V6, "::/0", "", true}, |
| {IP_RULE_V6, "::/0", "2001:db8::", true}, |
| {IP_RULE_V6, "2001:db8:cafe::/64", "2001:db8::", true}, |
| {IP_RULE_V4, "fe80::/64", "0.0.0.0", false}, |
| }; |
| |
| static const struct { |
| const char* ipVersion; |
| const char* testDest; |
| const char* testNextHop; |
| } kTestDataWithNextHop[] = { |
| {IP_RULE_V4, "10.251.10.0/30", ""}, |
| {IP_RULE_V6, "2001:db8::/32", ""}, |
| }; |
| |
| static const char testTableLegacySystem[] = "legacy_system"; |
| static const char testTableLegacyNetwork[] = "legacy_network"; |
| const int testUid = randomUid(); |
| const std::vector<int32_t> testUids = {testUid}; |
| |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| // Setup route for testing nextHop |
| for (size_t i = 0; i < std::size(kTestDataWithNextHop); i++) { |
| const auto& td = kTestDataWithNextHop[i]; |
| |
| // All route for test tun will disappear once the tun interface is deleted. |
| binder::Status status = |
| mNetd->networkAddRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| sTun.name().c_str()); |
| |
| // Add system permission for test uid, setup route in legacy system table. |
| EXPECT_TRUE(mNetd->networkSetPermissionForUser(INetd::PERMISSION_SYSTEM, testUids).isOk()); |
| |
| status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop, |
| testUid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| testTableLegacySystem); |
| |
| // Remove system permission for test uid, setup route in legacy network table. |
| EXPECT_TRUE(mNetd->networkClearPermissionForUser(testUids).isOk()); |
| |
| status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop, |
| testUid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| testTableLegacyNetwork); |
| } |
| |
| for (size_t i = 0; i < std::size(kTestData); i++) { |
| const auto& td = kTestData[i]; |
| |
| binder::Status status = |
| mNetd->networkAddRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| sTun.name().c_str()); |
| } else { |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| |
| status = mNetd->networkRemoveRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| sTun.name().c_str()); |
| } else { |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| |
| // Add system permission for test uid, route will be added into legacy system table. |
| EXPECT_TRUE(mNetd->networkSetPermissionForUser(INetd::PERMISSION_SYSTEM, testUids).isOk()); |
| |
| status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop, |
| testUid); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| testTableLegacySystem); |
| } else { |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| |
| status = mNetd->networkRemoveLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, |
| td.testNextHop, testUid); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| testTableLegacySystem); |
| } else { |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| |
| // Remove system permission for test uid, route will be added into legacy network table. |
| EXPECT_TRUE(mNetd->networkClearPermissionForUser(testUids).isOk()); |
| |
| status = mNetd->networkAddLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, td.testNextHop, |
| testUid); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| testTableLegacyNetwork); |
| } else { |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| |
| status = mNetd->networkRemoveLegacyRoute(TEST_NETID1, sTun.name(), td.testDest, |
| td.testNextHop, testUid); |
| if (td.expectSuccess) { |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| testTableLegacyNetwork); |
| } else { |
| EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode()); |
| EXPECT_NE(0, status.serviceSpecificErrorCode()); |
| } |
| } |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, NetworkPermissionDefault) { |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| // Get current default network NetId |
| binder::Status status = mNetd->networkGetDefault(&mStoredDefaultNetwork); |
| ASSERT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| // Test SetDefault |
| status = mNetd->networkSetDefault(TEST_NETID1); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkDefaultIpRuleExists(sTun.name().c_str()); |
| |
| status = mNetd->networkClearDefault(); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkDefaultIpRuleDoesNotExist(); |
| |
| // Set default network back |
| status = mNetd->networkSetDefault(mStoredDefaultNetwork); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| // Test SetPermission |
| status = mNetd->networkSetPermissionForNetwork(TEST_NETID1, INetd::PERMISSION_SYSTEM); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkPermissionIpRuleExists(sTun.name().c_str(), INetd::PERMISSION_SYSTEM); |
| expectNetworkPermissionIptablesRuleExists(sTun.name().c_str(), INetd::PERMISSION_SYSTEM); |
| |
| status = mNetd->networkSetPermissionForNetwork(TEST_NETID1, INetd::PERMISSION_NONE); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNetworkPermissionIpRuleExists(sTun.name().c_str(), INetd::PERMISSION_NONE); |
| expectNetworkPermissionIptablesRuleExists(sTun.name().c_str(), INetd::PERMISSION_NONE); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, NetworkSetProtectAllowDeny) { |
| const int testUid = randomUid(); |
| binder::Status status = mNetd->networkSetProtectAllow(testUid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| bool ret = false; |
| status = mNetd->networkCanProtect(testUid, &ret); |
| EXPECT_TRUE(ret); |
| |
| status = mNetd->networkSetProtectDeny(testUid); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| status = mNetd->networkCanProtect(testUid, &ret); |
| EXPECT_FALSE(ret); |
| } |
| |
| namespace { |
| |
| int readIntFromPath(const std::string& path) { |
| std::string result = ""; |
| EXPECT_TRUE(ReadFileToString(path, &result)); |
| return std::stoi(result); |
| } |
| |
| int getTetherAcceptIPv6Ra(const std::string& ifName) { |
| std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/accept_ra", ifName.c_str()); |
| return readIntFromPath(path); |
| } |
| |
| bool getTetherAcceptIPv6Dad(const std::string& ifName) { |
| std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/accept_dad", ifName.c_str()); |
| return readIntFromPath(path); |
| } |
| |
| int getTetherIPv6DadTransmits(const std::string& ifName) { |
| std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/dad_transmits", ifName.c_str()); |
| return readIntFromPath(path); |
| } |
| |
| bool getTetherEnableIPv6(const std::string& ifName) { |
| std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/disable_ipv6", ifName.c_str()); |
| int disableIPv6 = readIntFromPath(path); |
| return !disableIPv6; |
| } |
| |
| bool interfaceListContains(const std::vector<std::string>& ifList, const std::string& ifName) { |
| for (const auto& iface : ifList) { |
| if (iface == ifName) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| void expectTetherInterfaceConfigureForIPv6Router(const std::string& ifName) { |
| EXPECT_EQ(getTetherAcceptIPv6Ra(ifName), 0); |
| EXPECT_FALSE(getTetherAcceptIPv6Dad(ifName)); |
| EXPECT_EQ(getTetherIPv6DadTransmits(ifName), 0); |
| EXPECT_TRUE(getTetherEnableIPv6(ifName)); |
| } |
| |
| void expectTetherInterfaceConfigureForIPv6Client(const std::string& ifName) { |
| EXPECT_EQ(getTetherAcceptIPv6Ra(ifName), 2); |
| EXPECT_TRUE(getTetherAcceptIPv6Dad(ifName)); |
| EXPECT_EQ(getTetherIPv6DadTransmits(ifName), 1); |
| EXPECT_FALSE(getTetherEnableIPv6(ifName)); |
| } |
| |
| void expectTetherInterfaceExists(const std::vector<std::string>& ifList, |
| const std::string& ifName) { |
| EXPECT_TRUE(interfaceListContains(ifList, ifName)); |
| } |
| |
| void expectTetherInterfaceNotExists(const std::vector<std::string>& ifList, |
| const std::string& ifName) { |
| EXPECT_FALSE(interfaceListContains(ifList, ifName)); |
| } |
| |
| void expectTetherDnsListEquals(const std::vector<std::string>& dnsList, |
| const std::vector<std::string>& testDnsAddrs) { |
| EXPECT_TRUE(dnsList == testDnsAddrs); |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, TetherStartStopStatus) { |
| std::vector<std::string> noDhcpRange = {}; |
| static const char dnsdName[] = "dnsmasq"; |
| |
| binder::Status status = mNetd->tetherStart(noDhcpRange); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectProcessExists(dnsdName); |
| |
| bool tetherEnabled; |
| status = mNetd->tetherIsEnabled(&tetherEnabled); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| EXPECT_TRUE(tetherEnabled); |
| |
| status = mNetd->tetherStop(); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectProcessDoesNotExist(dnsdName); |
| |
| status = mNetd->tetherIsEnabled(&tetherEnabled); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| EXPECT_FALSE(tetherEnabled); |
| } |
| |
| TEST_F(BinderTest, TetherInterfaceAddRemoveList) { |
| // TODO: verify if dnsmasq update interface successfully |
| |
| binder::Status status = mNetd->tetherInterfaceAdd(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectTetherInterfaceConfigureForIPv6Router(sTun.name()); |
| |
| std::vector<std::string> ifList; |
| status = mNetd->tetherInterfaceList(&ifList); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectTetherInterfaceExists(ifList, sTun.name()); |
| |
| status = mNetd->tetherInterfaceRemove(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectTetherInterfaceConfigureForIPv6Client(sTun.name()); |
| |
| status = mNetd->tetherInterfaceList(&ifList); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectTetherInterfaceNotExists(ifList, sTun.name()); |
| } |
| |
| TEST_F(BinderTest, TetherDnsSetList) { |
| // TODO: verify if dnsmasq update dns successfully |
| std::vector<std::string> testDnsAddrs = {"192.168.1.37", "213.137.100.3", |
| "fe80::1%" + sTun.name()}; |
| |
| binder::Status status = mNetd->tetherDnsSet(TEST_NETID1, testDnsAddrs); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| std::vector<std::string> dnsList; |
| status = mNetd->tetherDnsList(&dnsList); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectTetherDnsListEquals(dnsList, testDnsAddrs); |
| } |
| |
| namespace { |
| |
| constexpr char FIREWALL_INPUT[] = "fw_INPUT"; |
| constexpr char FIREWALL_OUTPUT[] = "fw_OUTPUT"; |
| constexpr char FIREWALL_FORWARD[] = "fw_FORWARD"; |
| constexpr char FIREWALL_DOZABLE[] = "fw_dozable"; |
| constexpr char FIREWALL_POWERSAVE[] = "fw_powersave"; |
| constexpr char FIREWALL_STANDBY[] = "fw_standby"; |
| constexpr char targetReturn[] = "RETURN"; |
| constexpr char targetDrop[] = "DROP"; |
| |
| void expectFirewallWhitelistMode() { |
| static const char dropRule[] = "DROP all"; |
| static const char rejectRule[] = "REJECT all"; |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesRuleExists(binary, FIREWALL_INPUT, dropRule)); |
| EXPECT_TRUE(iptablesRuleExists(binary, FIREWALL_OUTPUT, rejectRule)); |
| EXPECT_TRUE(iptablesRuleExists(binary, FIREWALL_FORWARD, rejectRule)); |
| } |
| } |
| |
| void expectFirewallBlacklistMode() { |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_EQ(2, iptablesRuleLineLength(binary, FIREWALL_INPUT)); |
| EXPECT_EQ(2, iptablesRuleLineLength(binary, FIREWALL_OUTPUT)); |
| EXPECT_EQ(2, iptablesRuleLineLength(binary, FIREWALL_FORWARD)); |
| } |
| } |
| |
| bool iptablesFirewallInterfaceFirstRuleExists(const char* binary, const char* chainName, |
| const std::string& expectedInterface, |
| const std::string& expectedRule) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, FILTER_TABLE, chainName); |
| // Expected rule: |
| // Chain fw_INPUT (1 references) |
| // pkts bytes target prot opt in out source destination |
| // 0 0 RETURN all -- expectedInterface * 0.0.0.0/0 0.0.0.0/0 |
| // 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 |
| int firstRuleIndex = 2; |
| if (rules.size() < 4) return false; |
| if (rules[firstRuleIndex].find(expectedInterface) != std::string::npos) { |
| if (rules[firstRuleIndex].find(expectedRule) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| // TODO: It is a duplicate function, need to remove it |
| bool iptablesFirewallInterfaceRuleExists(const char* binary, const char* chainName, |
| const std::string& expectedInterface, |
| const std::string& expectedRule) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, FILTER_TABLE, chainName); |
| for (const auto& rule : rules) { |
| if (rule.find(expectedInterface) != std::string::npos) { |
| if (rule.find(expectedRule) != std::string::npos) { |
| return true; |
| } |
| } |
| } |
| return false; |
| } |
| |
| void expectFirewallInterfaceRuleAllowExists(const std::string& ifname) { |
| static const char returnRule[] = "RETURN all"; |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesFirewallInterfaceFirstRuleExists(binary, FIREWALL_INPUT, ifname, |
| returnRule)); |
| EXPECT_TRUE(iptablesFirewallInterfaceFirstRuleExists(binary, FIREWALL_OUTPUT, ifname, |
| returnRule)); |
| } |
| } |
| |
| void expectFireWallInterfaceRuleAllowDoesNotExist(const std::string& ifname) { |
| static const char returnRule[] = "RETURN all"; |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_FALSE( |
| iptablesFirewallInterfaceRuleExists(binary, FIREWALL_INPUT, ifname, returnRule)); |
| EXPECT_FALSE( |
| iptablesFirewallInterfaceRuleExists(binary, FIREWALL_OUTPUT, ifname, returnRule)); |
| } |
| } |
| |
| bool iptablesFirewallUidFirstRuleExists(const char* binary, const char* chainName, |
| const std::string& expectedTarget, |
| const std::string& expectedRule) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, FILTER_TABLE, chainName); |
| int firstRuleIndex = 2; |
| if (rules.size() < 4) return false; |
| if (rules[firstRuleIndex].find(expectedTarget) != std::string::npos) { |
| if (rules[firstRuleIndex].find(expectedRule) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| bool iptablesFirewallUidLastRuleExists(const char* binary, const char* chainName, |
| const std::string& expectedTarget, |
| const std::string& expectedRule) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, FILTER_TABLE, chainName); |
| int lastRuleIndex = rules.size() - 1; |
| if (lastRuleIndex < 0) return false; |
| if (rules[lastRuleIndex].find(expectedTarget) != std::string::npos) { |
| if (rules[lastRuleIndex].find(expectedRule) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| void expectFirewallUidFirstRuleExists(const char* chainName, int32_t uid) { |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) |
| EXPECT_TRUE(iptablesFirewallUidFirstRuleExists(binary, chainName, targetReturn, uidRule)); |
| } |
| |
| void expectFirewallUidFirstRuleDoesNotExist(const char* chainName, int32_t uid) { |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) |
| EXPECT_FALSE(iptablesFirewallUidFirstRuleExists(binary, chainName, targetReturn, uidRule)); |
| } |
| |
| void expectFirewallUidLastRuleExists(const char* chainName, int32_t uid) { |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) |
| EXPECT_TRUE(iptablesFirewallUidLastRuleExists(binary, chainName, targetDrop, uidRule)); |
| } |
| |
| void expectFirewallUidLastRuleDoesNotExist(const char* chainName, int32_t uid) { |
| std::string uidRule = StringPrintf("owner UID match %u", uid); |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) |
| EXPECT_FALSE(iptablesFirewallUidLastRuleExists(binary, chainName, targetDrop, uidRule)); |
| } |
| |
| bool iptablesFirewallChildChainsLastRuleExists(const char* binary, const char* chainName) { |
| std::vector<std::string> inputRules = |
| listIptablesRuleByTable(binary, FILTER_TABLE, FIREWALL_INPUT); |
| std::vector<std::string> outputRules = |
| listIptablesRuleByTable(binary, FILTER_TABLE, FIREWALL_OUTPUT); |
| int inputLastRuleIndex = inputRules.size() - 1; |
| int outputLastRuleIndex = outputRules.size() - 1; |
| |
| if (inputLastRuleIndex < 0 || outputLastRuleIndex < 0) return false; |
| if (inputRules[inputLastRuleIndex].find(chainName) != std::string::npos) { |
| if (outputRules[outputLastRuleIndex].find(chainName) != std::string::npos) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| void expectFirewallChildChainsLastRuleExists(const char* chainRule) { |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) |
| EXPECT_TRUE(iptablesFirewallChildChainsLastRuleExists(binary, chainRule)); |
| } |
| |
| void expectFirewallChildChainsLastRuleDoesNotExist(const char* chainRule) { |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_FALSE(iptablesRuleExists(binary, FIREWALL_INPUT, chainRule)); |
| EXPECT_FALSE(iptablesRuleExists(binary, FIREWALL_OUTPUT, chainRule)); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, FirewallSetFirewallType) { |
| binder::Status status = mNetd->firewallSetFirewallType(INetd::FIREWALL_WHITELIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallWhitelistMode(); |
| |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_BLACKLIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallBlacklistMode(); |
| |
| // set firewall type blacklist twice |
| mNetd->firewallSetFirewallType(INetd::FIREWALL_BLACKLIST); |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_BLACKLIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallBlacklistMode(); |
| |
| // set firewall type whitelist twice |
| mNetd->firewallSetFirewallType(INetd::FIREWALL_WHITELIST); |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_WHITELIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallWhitelistMode(); |
| |
| // reset firewall type to default |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_BLACKLIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallBlacklistMode(); |
| } |
| |
| TEST_F(BinderTest, FirewallSetInterfaceRule) { |
| // setinterfaceRule is not supported in BLACKLIST MODE |
| binder::Status status = mNetd->firewallSetFirewallType(INetd::FIREWALL_BLACKLIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| status = mNetd->firewallSetInterfaceRule(sTun.name(), INetd::FIREWALL_RULE_ALLOW); |
| EXPECT_FALSE(status.isOk()) << status.exceptionMessage(); |
| |
| // set WHITELIST mode first |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_WHITELIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| status = mNetd->firewallSetInterfaceRule(sTun.name(), INetd::FIREWALL_RULE_ALLOW); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallInterfaceRuleAllowExists(sTun.name()); |
| |
| status = mNetd->firewallSetInterfaceRule(sTun.name(), INetd::FIREWALL_RULE_DENY); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFireWallInterfaceRuleAllowDoesNotExist(sTun.name()); |
| |
| // reset firewall mode to default |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_BLACKLIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallBlacklistMode(); |
| } |
| |
| TEST_F(BinderTest, FirewallSetUidRule) { |
| SKIP_IF_BPF_SUPPORTED; |
| |
| int32_t uid = randomUid(); |
| |
| // Doze allow |
| binder::Status status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_DOZABLE, uid, |
| INetd::FIREWALL_RULE_ALLOW); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidFirstRuleExists(FIREWALL_DOZABLE, uid); |
| |
| // Doze deny |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_DOZABLE, uid, |
| INetd::FIREWALL_RULE_DENY); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidFirstRuleDoesNotExist(FIREWALL_DOZABLE, uid); |
| |
| // Powersave allow |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_POWERSAVE, uid, |
| INetd::FIREWALL_RULE_ALLOW); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidFirstRuleExists(FIREWALL_POWERSAVE, uid); |
| |
| // Powersave deny |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_POWERSAVE, uid, |
| INetd::FIREWALL_RULE_DENY); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidFirstRuleDoesNotExist(FIREWALL_POWERSAVE, uid); |
| |
| // Standby deny |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_STANDBY, uid, |
| INetd::FIREWALL_RULE_DENY); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidLastRuleExists(FIREWALL_STANDBY, uid); |
| |
| // Standby allow |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_STANDBY, uid, |
| INetd::FIREWALL_RULE_ALLOW); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidLastRuleDoesNotExist(FIREWALL_STANDBY, uid); |
| |
| // None deny in BLACKLIST |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_NONE, uid, INetd::FIREWALL_RULE_DENY); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidLastRuleExists(FIREWALL_INPUT, uid); |
| expectFirewallUidLastRuleExists(FIREWALL_OUTPUT, uid); |
| |
| // None allow in BLACKLIST |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_NONE, uid, INetd::FIREWALL_RULE_ALLOW); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidLastRuleDoesNotExist(FIREWALL_INPUT, uid); |
| expectFirewallUidLastRuleDoesNotExist(FIREWALL_OUTPUT, uid); |
| |
| // set firewall type whitelist twice |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_WHITELIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallWhitelistMode(); |
| |
| // None allow in WHITELIST |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_NONE, uid, INetd::FIREWALL_RULE_ALLOW); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidFirstRuleExists(FIREWALL_INPUT, uid); |
| expectFirewallUidFirstRuleExists(FIREWALL_OUTPUT, uid); |
| |
| // None deny in WHITELIST |
| status = mNetd->firewallSetUidRule(INetd::FIREWALL_CHAIN_NONE, uid, INetd::FIREWALL_RULE_DENY); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallUidFirstRuleDoesNotExist(FIREWALL_INPUT, uid); |
| expectFirewallUidFirstRuleDoesNotExist(FIREWALL_OUTPUT, uid); |
| |
| // reset firewall mode to default |
| status = mNetd->firewallSetFirewallType(INetd::FIREWALL_BLACKLIST); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallBlacklistMode(); |
| } |
| |
| TEST_F(BinderTest, FirewallEnableDisableChildChains) { |
| SKIP_IF_BPF_SUPPORTED; |
| |
| binder::Status status = mNetd->firewallEnableChildChain(INetd::FIREWALL_CHAIN_DOZABLE, true); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallChildChainsLastRuleExists(FIREWALL_DOZABLE); |
| |
| status = mNetd->firewallEnableChildChain(INetd::FIREWALL_CHAIN_STANDBY, true); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallChildChainsLastRuleExists(FIREWALL_STANDBY); |
| |
| status = mNetd->firewallEnableChildChain(INetd::FIREWALL_CHAIN_POWERSAVE, true); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallChildChainsLastRuleExists(FIREWALL_POWERSAVE); |
| |
| status = mNetd->firewallEnableChildChain(INetd::FIREWALL_CHAIN_DOZABLE, false); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallChildChainsLastRuleDoesNotExist(FIREWALL_DOZABLE); |
| |
| status = mNetd->firewallEnableChildChain(INetd::FIREWALL_CHAIN_STANDBY, false); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallChildChainsLastRuleDoesNotExist(FIREWALL_STANDBY); |
| |
| status = mNetd->firewallEnableChildChain(INetd::FIREWALL_CHAIN_POWERSAVE, false); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectFirewallChildChainsLastRuleDoesNotExist(FIREWALL_POWERSAVE); |
| } |
| |
| namespace { |
| |
| std::string hwAddrToStr(unsigned char* hwaddr) { |
| return StringPrintf("%02x:%02x:%02x:%02x:%02x:%02x", hwaddr[0], hwaddr[1], hwaddr[2], hwaddr[3], |
| hwaddr[4], hwaddr[5]); |
| } |
| |
| int ipv4NetmaskToPrefixLength(in_addr_t mask) { |
| int prefixLength = 0; |
| uint32_t m = ntohl(mask); |
| while (m & (1 << 31)) { |
| prefixLength++; |
| m = m << 1; |
| } |
| return prefixLength; |
| } |
| |
| std::string toStdString(const String16& s) { |
| return std::string(String8(s.string())); |
| } |
| |
| android::netdutils::StatusOr<ifreq> ioctlByIfName(const std::string& ifName, unsigned long flag) { |
| const auto& sys = sSyscalls.get(); |
| auto fd = sys.socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); |
| EXPECT_TRUE(isOk(fd.status())); |
| |
| struct ifreq ifr = {}; |
| strlcpy(ifr.ifr_name, ifName.c_str(), IFNAMSIZ); |
| |
| return sys.ioctl(fd.value(), flag, &ifr); |
| } |
| |
| std::string getInterfaceHwAddr(const std::string& ifName) { |
| auto res = ioctlByIfName(ifName, SIOCGIFHWADDR); |
| |
| unsigned char hwaddr[ETH_ALEN] = {}; |
| if (isOk(res.status())) { |
| memcpy((void*) hwaddr, &res.value().ifr_hwaddr.sa_data, ETH_ALEN); |
| } |
| |
| return hwAddrToStr(hwaddr); |
| } |
| |
| int getInterfaceIPv4Prefix(const std::string& ifName) { |
| auto res = ioctlByIfName(ifName, SIOCGIFNETMASK); |
| |
| int prefixLength = 0; |
| if (isOk(res.status())) { |
| prefixLength = ipv4NetmaskToPrefixLength( |
| ((struct sockaddr_in*) &res.value().ifr_addr)->sin_addr.s_addr); |
| } |
| |
| return prefixLength; |
| } |
| |
| std::string getInterfaceIPv4Addr(const std::string& ifName) { |
| auto res = ioctlByIfName(ifName, SIOCGIFADDR); |
| |
| struct in_addr addr = {}; |
| if (isOk(res.status())) { |
| addr.s_addr = ((struct sockaddr_in*) &res.value().ifr_addr)->sin_addr.s_addr; |
| } |
| |
| return std::string(inet_ntoa(addr)); |
| } |
| |
| std::vector<std::string> getInterfaceFlags(const std::string& ifName) { |
| auto res = ioctlByIfName(ifName, SIOCGIFFLAGS); |
| |
| unsigned flags = 0; |
| if (isOk(res.status())) { |
| flags = res.value().ifr_flags; |
| } |
| |
| std::vector<std::string> ifFlags; |
| ifFlags.push_back(flags & IFF_UP ? toStdString(INetd::IF_STATE_UP()) |
| : toStdString(INetd::IF_STATE_DOWN())); |
| |
| if (flags & IFF_BROADCAST) ifFlags.push_back(toStdString(INetd::IF_FLAG_BROADCAST())); |
| if (flags & IFF_LOOPBACK) ifFlags.push_back(toStdString(INetd::IF_FLAG_LOOPBACK())); |
| if (flags & IFF_POINTOPOINT) ifFlags.push_back(toStdString(INetd::IF_FLAG_POINTOPOINT())); |
| if (flags & IFF_RUNNING) ifFlags.push_back(toStdString(INetd::IF_FLAG_RUNNING())); |
| if (flags & IFF_MULTICAST) ifFlags.push_back(toStdString(INetd::IF_FLAG_MULTICAST())); |
| |
| return ifFlags; |
| } |
| |
| bool compareListInterface(const std::vector<std::string>& interfaceList) { |
| const auto& res = InterfaceController::getIfaceNames(); |
| EXPECT_TRUE(isOk(res)); |
| |
| std::vector<std::string> resIfList; |
| resIfList.reserve(res.value().size()); |
| resIfList.insert(end(resIfList), begin(res.value()), end(res.value())); |
| |
| return resIfList == interfaceList; |
| } |
| |
| int getInterfaceIPv6PrivacyExtensions(const std::string& ifName) { |
| std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/use_tempaddr", ifName.c_str()); |
| return readIntFromPath(path); |
| } |
| |
| bool getInterfaceEnableIPv6(const std::string& ifName) { |
| std::string path = StringPrintf("/proc/sys/net/ipv6/conf/%s/disable_ipv6", ifName.c_str()); |
| |
| int disableIPv6 = readIntFromPath(path); |
| return !disableIPv6; |
| } |
| |
| int getInterfaceMtu(const std::string& ifName) { |
| std::string path = StringPrintf("/sys/class/net/%s/mtu", ifName.c_str()); |
| return readIntFromPath(path); |
| } |
| |
| void expectInterfaceList(const std::vector<std::string>& interfaceList) { |
| EXPECT_TRUE(compareListInterface(interfaceList)); |
| } |
| |
| void expectCurrentInterfaceConfigurationEquals(const std::string& ifName, |
| const InterfaceConfigurationParcel& interfaceCfg) { |
| EXPECT_EQ(getInterfaceIPv4Addr(ifName), interfaceCfg.ipv4Addr); |
| EXPECT_EQ(getInterfaceIPv4Prefix(ifName), interfaceCfg.prefixLength); |
| EXPECT_EQ(getInterfaceHwAddr(ifName), interfaceCfg.hwAddr); |
| EXPECT_EQ(getInterfaceFlags(ifName), interfaceCfg.flags); |
| } |
| |
| void expectCurrentInterfaceConfigurationAlmostEqual(const InterfaceConfigurationParcel& setCfg) { |
| EXPECT_EQ(getInterfaceIPv4Addr(setCfg.ifName), setCfg.ipv4Addr); |
| EXPECT_EQ(getInterfaceIPv4Prefix(setCfg.ifName), setCfg.prefixLength); |
| |
| const auto& ifFlags = getInterfaceFlags(setCfg.ifName); |
| for (const auto& flag : setCfg.flags) { |
| EXPECT_TRUE(std::find(ifFlags.begin(), ifFlags.end(), flag) != ifFlags.end()); |
| } |
| } |
| |
| void expectInterfaceIPv6PrivacyExtensions(const std::string& ifName, bool enable) { |
| int v6PrivacyExtensions = getInterfaceIPv6PrivacyExtensions(ifName); |
| EXPECT_EQ(v6PrivacyExtensions, enable ? 2 : 0); |
| } |
| |
| void expectInterfaceNoAddr(const std::string& ifName) { |
| // noAddr |
| EXPECT_EQ(getInterfaceIPv4Addr(ifName), "0.0.0.0"); |
| // noPrefix |
| EXPECT_EQ(getInterfaceIPv4Prefix(ifName), 0); |
| } |
| |
| void expectInterfaceEnableIPv6(const std::string& ifName, bool enable) { |
| int enableIPv6 = getInterfaceEnableIPv6(ifName); |
| EXPECT_EQ(enableIPv6, enable); |
| } |
| |
| void expectInterfaceMtu(const std::string& ifName, const int mtu) { |
| int mtuSize = getInterfaceMtu(ifName); |
| EXPECT_EQ(mtu, mtuSize); |
| } |
| |
| InterfaceConfigurationParcel makeInterfaceCfgParcel(const std::string& ifName, |
| const std::string& addr, int prefixLength, |
| const std::vector<std::string>& flags) { |
| InterfaceConfigurationParcel cfg; |
| cfg.ifName = ifName; |
| cfg.hwAddr = ""; |
| cfg.ipv4Addr = addr; |
| cfg.prefixLength = prefixLength; |
| cfg.flags = flags; |
| return cfg; |
| } |
| |
| void expectTunFlags(const InterfaceConfigurationParcel& interfaceCfg) { |
| std::vector<std::string> expectedFlags = {"up", "point-to-point", "running", "multicast"}; |
| std::vector<std::string> unexpectedFlags = {"down", "broadcast"}; |
| |
| for (const auto& flag : expectedFlags) { |
| EXPECT_TRUE(std::find(interfaceCfg.flags.begin(), interfaceCfg.flags.end(), flag) != |
| interfaceCfg.flags.end()); |
| } |
| |
| for (const auto& flag : unexpectedFlags) { |
| EXPECT_TRUE(std::find(interfaceCfg.flags.begin(), interfaceCfg.flags.end(), flag) == |
| interfaceCfg.flags.end()); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, InterfaceList) { |
| std::vector<std::string> interfaceListResult; |
| |
| binder::Status status = mNetd->interfaceGetList(&interfaceListResult); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectInterfaceList(interfaceListResult); |
| } |
| |
| TEST_F(BinderTest, InterfaceGetCfg) { |
| InterfaceConfigurationParcel interfaceCfgResult; |
| |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| binder::Status status = mNetd->interfaceGetCfg(sTun.name(), &interfaceCfgResult); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectCurrentInterfaceConfigurationEquals(sTun.name(), interfaceCfgResult); |
| expectTunFlags(interfaceCfgResult); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, InterfaceSetCfg) { |
| const std::string testAddr = "192.0.2.3"; |
| const int testPrefixLength = 24; |
| std::vector<std::string> upFlags = {"up"}; |
| std::vector<std::string> downFlags = {"down"}; |
| |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| // Set tun interface down. |
| auto interfaceCfg = makeInterfaceCfgParcel(sTun.name(), testAddr, testPrefixLength, downFlags); |
| binder::Status status = mNetd->interfaceSetCfg(interfaceCfg); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectCurrentInterfaceConfigurationAlmostEqual(interfaceCfg); |
| |
| // Set tun interface up again. |
| interfaceCfg = makeInterfaceCfgParcel(sTun.name(), testAddr, testPrefixLength, upFlags); |
| status = mNetd->interfaceSetCfg(interfaceCfg); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| status = mNetd->interfaceClearAddrs(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, InterfaceSetIPv6PrivacyExtensions) { |
| // enable |
| binder::Status status = mNetd->interfaceSetIPv6PrivacyExtensions(sTun.name(), true); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectInterfaceIPv6PrivacyExtensions(sTun.name(), true); |
| |
| // disable |
| status = mNetd->interfaceSetIPv6PrivacyExtensions(sTun.name(), false); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectInterfaceIPv6PrivacyExtensions(sTun.name(), false); |
| } |
| |
| TEST_F(BinderTest, InterfaceClearAddr) { |
| const std::string testAddr = "192.0.2.3"; |
| const int testPrefixLength = 24; |
| std::vector<std::string> noFlags{}; |
| |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| auto interfaceCfg = makeInterfaceCfgParcel(sTun.name(), testAddr, testPrefixLength, noFlags); |
| binder::Status status = mNetd->interfaceSetCfg(interfaceCfg); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectCurrentInterfaceConfigurationAlmostEqual(interfaceCfg); |
| |
| status = mNetd->interfaceClearAddrs(sTun.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectInterfaceNoAddr(sTun.name()); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, InterfaceSetEnableIPv6) { |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| // disable |
| binder::Status status = mNetd->interfaceSetEnableIPv6(sTun.name(), false); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectInterfaceEnableIPv6(sTun.name(), false); |
| |
| // enable |
| status = mNetd->interfaceSetEnableIPv6(sTun.name(), true); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectInterfaceEnableIPv6(sTun.name(), true); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, InterfaceSetMtu) { |
| const int testMtu = 1200; |
| |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| binder::Status status = mNetd->interfaceSetMtu(sTun.name(), testMtu); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectInterfaceMtu(sTun.name(), testMtu); |
| |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| namespace { |
| |
| constexpr const char TETHER_FORWARD[] = "tetherctrl_FORWARD"; |
| constexpr const char TETHER_NAT_POSTROUTING[] = "tetherctrl_nat_POSTROUTING"; |
| constexpr const char TETHER_RAW_PREROUTING[] = "tetherctrl_raw_PREROUTING"; |
| constexpr const char TETHER_COUNTERS_CHAIN[] = "tetherctrl_counters"; |
| |
| int iptablesCountRules(const char* binary, const char* table, const char* chainName) { |
| return listIptablesRuleByTable(binary, table, chainName).size(); |
| } |
| |
| bool iptablesChainMatch(const char* binary, const char* table, const char* chainName, |
| const std::vector<std::string>& targetVec) { |
| std::vector<std::string> rules = listIptablesRuleByTable(binary, table, chainName); |
| if (targetVec.size() != rules.size() - 2) { |
| return false; |
| } |
| |
| /* |
| * Check that the rules match. Note that this function matches substrings, not entire rules, |
| * because otherwise rules where "pkts" or "bytes" are nonzero would not match. |
| * Skip first two lines since rules start from third line. |
| * Chain chainName (x references) |
| * pkts bytes target prot opt in out source destination |
| * ... |
| */ |
| int rIndex = 2; |
| for (const auto& target : targetVec) { |
| if (rules[rIndex].find(target) == std::string::npos) { |
| return false; |
| } |
| rIndex++; |
| } |
| return true; |
| } |
| |
| void expectNatEnable(const std::string& intIf, const std::string& extIf) { |
| std::vector<std::string> postroutingV4Match = {"MASQUERADE"}; |
| std::vector<std::string> preroutingV4Match = {"CT helper ftp", "CT helper pptp"}; |
| std::vector<std::string> forwardV4Match = { |
| "bw_global_alert", "state RELATED", "state INVALID", |
| StringPrintf("tetherctrl_counters all -- %s %s", intIf.c_str(), extIf.c_str()), |
| "DROP"}; |
| |
| // V4 |
| EXPECT_TRUE(iptablesChainMatch(IPTABLES_PATH, NAT_TABLE, TETHER_NAT_POSTROUTING, |
| postroutingV4Match)); |
| EXPECT_TRUE( |
| iptablesChainMatch(IPTABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING, preroutingV4Match)); |
| EXPECT_TRUE(iptablesChainMatch(IPTABLES_PATH, FILTER_TABLE, TETHER_FORWARD, forwardV4Match)); |
| |
| std::vector<std::string> forwardV6Match = {"bw_global_alert", "tetherctrl_counters"}; |
| std::vector<std::string> preroutingV6Match = {"rpfilter invert"}; |
| |
| // V6 |
| EXPECT_TRUE(iptablesChainMatch(IP6TABLES_PATH, FILTER_TABLE, TETHER_FORWARD, forwardV6Match)); |
| EXPECT_TRUE(iptablesChainMatch(IP6TABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING, |
| preroutingV6Match)); |
| |
| for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) { |
| EXPECT_TRUE(iptablesTargetsExists(binary, 2, FILTER_TABLE, TETHER_COUNTERS_CHAIN, intIf, |
| extIf)); |
| } |
| } |
| |
| void expectNatDisable() { |
| // It is the default DROP rule with tethering disable. |
| // Chain tetherctrl_FORWARD (1 references) |
| // pkts bytes target prot opt in out source destination |
| // 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 |
| std::vector<std::string> forwardV4Match = {"DROP"}; |
| EXPECT_TRUE(iptablesChainMatch(IPTABLES_PATH, FILTER_TABLE, TETHER_FORWARD, forwardV4Match)); |
| |
| // We expect that these chains should be empty. |
| EXPECT_EQ(2, iptablesCountRules(IPTABLES_PATH, NAT_TABLE, TETHER_NAT_POSTROUTING)); |
| EXPECT_EQ(2, iptablesCountRules(IPTABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING)); |
| |
| EXPECT_EQ(2, iptablesCountRules(IP6TABLES_PATH, FILTER_TABLE, TETHER_FORWARD)); |
| EXPECT_EQ(2, iptablesCountRules(IP6TABLES_PATH, RAW_TABLE, TETHER_RAW_PREROUTING)); |
| |
| // Netd won't clear tether quota rule, we don't care rule in tetherctrl_counters. |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, TetherForwardAddRemove) { |
| binder::Status status = mNetd->tetherAddForward(sTun.name(), sTun2.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNatEnable(sTun.name(), sTun2.name()); |
| |
| status = mNetd->tetherRemoveForward(sTun.name(), sTun2.name()); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| expectNatDisable(); |
| } |
| |
| namespace { |
| |
| using TripleInt = std::array<int, 3>; |
| |
| TripleInt readProcFileToTripleInt(const std::string& path) { |
| std::string valueString; |
| int min, def, max; |
| EXPECT_TRUE(ReadFileToString(path, &valueString)); |
| EXPECT_EQ(3, sscanf(valueString.c_str(), "%d %d %d", &min, &def, &max)); |
| return {min, def, max}; |
| } |
| |
| void updateAndCheckTcpBuffer(sp<INetd>& netd, TripleInt& rmemValues, TripleInt& wmemValues) { |
| std::string testRmemValues = |
| StringPrintf("%u %u %u", rmemValues[0], rmemValues[1], rmemValues[2]); |
| std::string testWmemValues = |
| StringPrintf("%u %u %u", wmemValues[0], wmemValues[1], wmemValues[2]); |
| EXPECT_TRUE(netd->setTcpRWmemorySize(testRmemValues, testWmemValues).isOk()); |
| |
| TripleInt newRmemValues = readProcFileToTripleInt(TCP_RMEM_PROC_FILE); |
| TripleInt newWmemValues = readProcFileToTripleInt(TCP_WMEM_PROC_FILE); |
| |
| for (int i = 0; i < 3; i++) { |
| SCOPED_TRACE(StringPrintf("tcp_mem value %d should be equal", i)); |
| EXPECT_EQ(rmemValues[i], newRmemValues[i]); |
| EXPECT_EQ(wmemValues[i], newWmemValues[i]); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, TcpBufferSet) { |
| TripleInt rmemValue = readProcFileToTripleInt(TCP_RMEM_PROC_FILE); |
| TripleInt testRmemValue{rmemValue[0] + 42, rmemValue[1] + 42, rmemValue[2] + 42}; |
| TripleInt wmemValue = readProcFileToTripleInt(TCP_WMEM_PROC_FILE); |
| TripleInt testWmemValue{wmemValue[0] + 42, wmemValue[1] + 42, wmemValue[2] + 42}; |
| |
| updateAndCheckTcpBuffer(mNetd, testRmemValue, testWmemValue); |
| updateAndCheckTcpBuffer(mNetd, rmemValue, wmemValue); |
| } |
| |
| namespace { |
| |
| void checkUidsInPermissionMap(std::vector<int32_t>& uids, bool exist) { |
| android::bpf::BpfMap<uint32_t, uint8_t> uidPermissionMap( |
| android::bpf::mapRetrieve(UID_PERMISSION_MAP_PATH, 0)); |
| for (int32_t uid : uids) { |
| android::netdutils::StatusOr<uint8_t> permission = uidPermissionMap.readValue(uid); |
| if (exist) { |
| EXPECT_TRUE(isOk(permission)); |
| EXPECT_EQ(INetd::PERMISSION_NONE, permission.value()); |
| } else { |
| EXPECT_FALSE(isOk(permission)); |
| EXPECT_EQ(ENOENT, permission.status().code()); |
| } |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, TestInternetPermission) { |
| SKIP_IF_BPF_NOT_SUPPORTED; |
| |
| std::vector<int32_t> appUids = {TEST_UID1, TEST_UID2}; |
| |
| mNetd->trafficSetNetPermForUids(INetd::PERMISSION_INTERNET, appUids); |
| checkUidsInPermissionMap(appUids, false); |
| mNetd->trafficSetNetPermForUids(INetd::PERMISSION_NONE, appUids); |
| checkUidsInPermissionMap(appUids, true); |
| mNetd->trafficSetNetPermForUids(INetd::PERMISSION_UNINSTALLED, appUids); |
| checkUidsInPermissionMap(appUids, false); |
| } |
| |
| TEST_F(BinderTest, UnsolEvents) { |
| auto testUnsolService = android::net::TestUnsolService::start(); |
| std::string oldTunName = sTun.name(); |
| std::string newTunName = "unsolTest"; |
| testUnsolService->tarVec.push_back(oldTunName); |
| testUnsolService->tarVec.push_back(newTunName); |
| auto& cv = testUnsolService->getCv(); |
| auto& cvMutex = testUnsolService->getCvMutex(); |
| binder::Status status = mNetd->registerUnsolicitedEventListener( |
| android::interface_cast<android::net::INetdUnsolicitedEventListener>(testUnsolService)); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| // TODO: Add test for below events |
| // StrictCleartextDetected / InterfaceDnsServersAdded |
| // InterfaceClassActivity / QuotaLimitReached / InterfaceAddressRemoved |
| |
| { |
| std::unique_lock lock(cvMutex); |
| |
| // Re-init test Tun, and we expect that we will get some unsol events. |
| // Use the test Tun device name to verify if we receive its unsol events. |
| sTun.destroy(); |
| // Use predefined name |
| sTun.init(newTunName); |
| |
| EXPECT_EQ(std::cv_status::no_timeout, cv.wait_for(lock, std::chrono::seconds(2))); |
| } |
| |
| // bit mask 1101101000 |
| // Test only covers below events currently |
| const uint32_t kExpectedEvents = InterfaceAddressUpdated | InterfaceAdded | InterfaceRemoved | |
| InterfaceLinkStatusChanged | RouteChanged; |
| EXPECT_EQ(kExpectedEvents, testUnsolService->getReceived()); |
| |
| // Re-init sTun to clear predefined name |
| sTun.destroy(); |
| sTun.init(); |
| } |
| |
| TEST_F(BinderTest, NDC) { |
| struct Command { |
| const std::string cmdString; |
| const std::string expectedResult; |
| }; |
| |
| // clang-format off |
| // Do not change the commands order |
| const Command networkCmds[] = { |
| {StringPrintf("ndc network create %d", TEST_NETID1), |
| "200 0 success"}, |
| {StringPrintf("ndc network interface add %d %s", TEST_NETID1, sTun.name().c_str()), |
| "200 0 success"}, |
| {StringPrintf("ndc network interface remove %d %s", TEST_NETID1, sTun.name().c_str()), |
| "200 0 success"}, |
| {StringPrintf("ndc network interface add %d %s", TEST_NETID2, sTun.name().c_str()), |
| "400 0 addInterfaceToNetwork() failed (Machine is not on the network)"}, |
| {StringPrintf("ndc network destroy %d", TEST_NETID1), |
| "200 0 success"}, |
| }; |
| |
| const std::vector<Command> ipfwdCmds = { |
| {"ndc ipfwd enable " + sTun.name(), |
| "200 0 ipfwd operation succeeded"}, |
| {"ndc ipfwd disable " + sTun.name(), |
| "200 0 ipfwd operation succeeded"}, |
| {"ndc ipfwd add lo2 lo3", |
| "400 0 ipfwd operation failed (No such process)"}, |
| {"ndc ipfwd add " + sTun.name() + " " + sTun2.name(), |
| "200 0 ipfwd operation succeeded"}, |
| {"ndc ipfwd remove " + sTun.name() + " " + sTun2.name(), |
| "200 0 ipfwd operation succeeded"}, |
| }; |
| |
| static const struct { |
| const char* ipVersion; |
| const char* testDest; |
| const char* testNextHop; |
| const bool expectSuccess; |
| const std::string expectedResult; |
| } kTestData[] = { |
| {IP_RULE_V4, "0.0.0.0/0", "", true, |
| "200 0 success"}, |
| {IP_RULE_V4, "10.251.0.0/16", "", true, |
| "200 0 success"}, |
| {IP_RULE_V4, "10.251.0.0/16", "fe80::/64", false, |
| "400 0 addRoute() failed (Invalid argument)",}, |
| {IP_RULE_V6, "::/0", "", true, |
| "200 0 success"}, |
| {IP_RULE_V6, "2001:db8:cafe::/64", "", true, |
| "200 0 success"}, |
| {IP_RULE_V6, "fe80::/64", "0.0.0.0", false, |
| "400 0 addRoute() failed (Invalid argument)"}, |
| }; |
| // clang-format on |
| |
| for (const auto& cmd : networkCmds) { |
| const std::vector<std::string> result = runCommand(cmd.cmdString); |
| SCOPED_TRACE(cmd.cmdString); |
| EXPECT_EQ(result.size(), 1U); |
| EXPECT_EQ(cmd.expectedResult, Trim(result[0])); |
| } |
| |
| for (const auto& cmd : ipfwdCmds) { |
| const std::vector<std::string> result = runCommand(cmd.cmdString); |
| SCOPED_TRACE(cmd.cmdString); |
| EXPECT_EQ(result.size(), 1U); |
| EXPECT_EQ(cmd.expectedResult, Trim(result[0])); |
| } |
| |
| // Add test physical network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(TEST_NETID1, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(TEST_NETID1, sTun.name()).isOk()); |
| |
| for (const auto& td : kTestData) { |
| const std::string routeAddCmd = |
| StringPrintf("ndc network route add %d %s %s %s", TEST_NETID1, sTun.name().c_str(), |
| td.testDest, td.testNextHop); |
| const std::string routeRemoveCmd = |
| StringPrintf("ndc network route remove %d %s %s %s", TEST_NETID1, |
| sTun.name().c_str(), td.testDest, td.testNextHop); |
| std::vector<std::string> result = runCommand(routeAddCmd); |
| SCOPED_TRACE(routeAddCmd); |
| EXPECT_EQ(result.size(), 1U); |
| EXPECT_EQ(td.expectedResult, Trim(result[0])); |
| if (td.expectSuccess) { |
| expectNetworkRouteExists(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| sTun.name().c_str()); |
| result = runCommand(routeRemoveCmd); |
| EXPECT_EQ(result.size(), 1U); |
| EXPECT_EQ(td.expectedResult, Trim(result[0])); |
| expectNetworkRouteDoesNotExist(td.ipVersion, sTun.name(), td.testDest, td.testNextHop, |
| sTun.name().c_str()); |
| } |
| } |
| // Remove test physical network |
| EXPECT_TRUE(mNetd->networkDestroy(TEST_NETID1).isOk()); |
| } |
| |
| TEST_F(BinderTest, OemNetdRelated) { |
| sp<IBinder> binder; |
| binder::Status status = mNetd->getOemNetd(&binder); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| sp<com::android::internal::net::IOemNetd> oemNetd; |
| if (binder != nullptr) { |
| oemNetd = android::interface_cast<com::android::internal::net::IOemNetd>(binder); |
| } |
| ASSERT_NE(nullptr, oemNetd.get()); |
| |
| TimedOperation t("OemNetd isAlive RPC"); |
| bool isAlive = false; |
| oemNetd->isAlive(&isAlive); |
| ASSERT_TRUE(isAlive); |
| |
| class TestOemUnsolListener |
| : public com::android::internal::net::BnOemNetdUnsolicitedEventListener { |
| public: |
| android::binder::Status onRegistered() override { |
| std::lock_guard lock(mCvMutex); |
| mCv.notify_one(); |
| return android::binder::Status::ok(); |
| } |
| std::condition_variable& getCv() { return mCv; } |
| std::mutex& getCvMutex() { return mCvMutex; } |
| |
| private: |
| std::mutex mCvMutex; |
| std::condition_variable mCv; |
| }; |
| |
| // Start the Binder thread pool. |
| android::ProcessState::self()->startThreadPool(); |
| |
| android::sp<TestOemUnsolListener> testListener = new TestOemUnsolListener(); |
| |
| auto& cv = testListener->getCv(); |
| auto& cvMutex = testListener->getCvMutex(); |
| |
| { |
| std::unique_lock lock(cvMutex); |
| |
| status = oemNetd->registerOemUnsolicitedEventListener( |
| ::android::interface_cast< |
| com::android::internal::net::IOemNetdUnsolicitedEventListener>( |
| testListener)); |
| EXPECT_TRUE(status.isOk()) << status.exceptionMessage(); |
| |
| // Wait for receiving expected events. |
| EXPECT_EQ(std::cv_status::no_timeout, cv.wait_for(lock, std::chrono::seconds(2))); |
| } |
| } |
| |
| void BinderTest::createVpnNetworkWithUid(bool secure, uid_t uid, int vpnNetId, |
| int fallthroughNetId) { |
| // Re-init sTun* to ensure route rule exists. |
| sTun.destroy(); |
| sTun.init(); |
| sTun2.destroy(); |
| sTun2.init(); |
| |
| // Create physical network with fallthroughNetId but not set it as default network |
| EXPECT_TRUE(mNetd->networkCreatePhysical(fallthroughNetId, INetd::PERMISSION_NONE).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(fallthroughNetId, sTun.name()).isOk()); |
| |
| // Create VPN with vpnNetId |
| EXPECT_TRUE(mNetd->networkCreateVpn(vpnNetId, secure).isOk()); |
| |
| // Add uid to VPN |
| EXPECT_TRUE(mNetd->networkAddUidRanges(vpnNetId, {makeUidRangeParcel(uid, uid)}).isOk()); |
| EXPECT_TRUE(mNetd->networkAddInterface(vpnNetId, sTun2.name()).isOk()); |
| |
| // Add default route to fallthroughNetwork |
| EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID1, sTun.name(), "::/0", "").isOk()); |
| // Add limited route |
| EXPECT_TRUE(mNetd->networkAddRoute(TEST_NETID2, sTun2.name(), "2001:db8::/32", "").isOk()); |
| } |
| |
| namespace { |
| |
| class ScopedUidChange { |
| public: |
| explicit ScopedUidChange(uid_t uid) : mInputUid(uid) { |
| mStoredUid = getuid(); |
| if (mInputUid == mStoredUid) return; |
| EXPECT_TRUE(seteuid(uid) == 0); |
| } |
| ~ScopedUidChange() { |
| if (mInputUid == mStoredUid) return; |
| EXPECT_TRUE(seteuid(mStoredUid) == 0); |
| } |
| |
| private: |
| uid_t mInputUid; |
| uid_t mStoredUid; |
| }; |
| |
| constexpr uint32_t RULE_PRIORITY_VPN_FALLTHROUGH = 21000; |
| |
| void clearQueue(int tunFd) { |
| char buf[4096]; |
| int ret; |
| do { |
| ret = read(tunFd, buf, sizeof(buf)); |
| } while (ret > 0); |
| } |
| |
| void checkDataReceived(int udpSocket, int tunFd) { |
| char buf[4096] = {}; |
| // Clear tunFd's queue before write something because there might be some |
| // arbitrary packets in the queue. (e.g. ICMPv6 packet) |
| clearQueue(tunFd); |
| EXPECT_EQ(4, write(udpSocket, "foo", sizeof("foo"))); |
| // TODO: extract header and verify data |
| EXPECT_GT(read(tunFd, buf, sizeof(buf)), 0); |
| } |
| |
| bool sendIPv6PacketFromUid(uid_t uid, const in6_addr& dstAddr, Fwmark* fwmark, int tunFd) { |
| ScopedUidChange scopedUidChange(uid); |
| android::base::unique_fd testSocket(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0)); |
| if (testSocket < 0) return false; |
| |
| const sockaddr_in6 dst6 = {.sin6_family = AF_INET6, .sin6_addr = dstAddr, .sin6_port = 42}; |
| int res = connect(testSocket, (sockaddr*)&dst6, sizeof(dst6)); |
| socklen_t fwmarkLen = sizeof(fwmark->intValue); |
| EXPECT_NE(-1, getsockopt(testSocket, SOL_SOCKET, SO_MARK, &(fwmark->intValue), &fwmarkLen)); |
| if (res == -1) return false; |
| |
| char addr[INET6_ADDRSTRLEN]; |
| inet_ntop(AF_INET6, &dstAddr, addr, INET6_ADDRSTRLEN); |
| SCOPED_TRACE(StringPrintf("sendIPv6PacketFromUid, addr: %s, uid: %u", addr, uid)); |
| checkDataReceived(testSocket, tunFd); |
| return true; |
| } |
| |
| void expectVpnFallthroughRuleExists(const std::string& ifName, int vpnNetId) { |
| std::string vpnFallthroughRule = |
| StringPrintf("%d:\tfrom all fwmark 0x%x/0xffff lookup %s", |
| RULE_PRIORITY_VPN_FALLTHROUGH, vpnNetId, ifName.c_str()); |
| for (const auto& ipVersion : {IP_RULE_V4, IP_RULE_V6}) { |
| EXPECT_TRUE(ipRuleExists(ipVersion, vpnFallthroughRule)); |
| } |
| } |
| |
| void expectVpnFallthroughWorks(android::net::INetd* netdService, bool bypassable, uid_t uid, |
| const TunInterface& fallthroughNetwork, |
| const TunInterface& vpnNetwork, int vpnNetId = TEST_NETID2, |
| int fallthroughNetId = TEST_NETID1) { |
| // Set default network to NETID_UNSET |
| EXPECT_TRUE(netdService->networkSetDefault(NETID_UNSET).isOk()); |
| |
| // insideVpnAddr based on the route we added in createVpnNetworkWithUid |
| in6_addr insideVpnAddr = { |
| {// 2001:db8:cafe::1 |
| .u6_addr8 = {0x20, 0x01, 0x0d, 0xb8, 0xca, 0xfe, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}}}; |
| // outsideVpnAddr will hit the route in the fallthrough network route table |
| // because we added default route in createVpnNetworkWithUid |
| in6_addr outsideVpnAddr = { |
| {// 2607:f0d0:1002::4 |
| .u6_addr8 = {0x26, 0x07, 0xf0, 0xd0, 0x10, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4}}}; |
| |
| int fallthroughFd = fallthroughNetwork.getFdForTesting(); |
| int vpnFd = vpnNetwork.getFdForTesting(); |
| // Expect all connections to fail because UID 0 is not routed to the VPN and there is no |
| // default network. |
| Fwmark fwmark; |
| EXPECT_FALSE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd)); |
| EXPECT_FALSE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, fallthroughFd)); |
| |
| // Set default network |
| EXPECT_TRUE(netdService->networkSetDefault(fallthroughNetId).isOk()); |
| |
| // Connections go on the default network because UID 0 is not subject to the VPN. |
| EXPECT_TRUE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd)); |
| EXPECT_EQ(fallthroughNetId | 0xC0000, static_cast<int>(fwmark.intValue)); |
| EXPECT_TRUE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, fallthroughFd)); |
| EXPECT_EQ(fallthroughNetId | 0xC0000, static_cast<int>(fwmark.intValue)); |
| |
| // Check if fallthrough rule exists |
| expectVpnFallthroughRuleExists(fallthroughNetwork.name(), vpnNetId); |
| |
| // Expect fallthrough to default network |
| // The fwmark differs depending on whether the VPN is bypassable or not. |
| EXPECT_TRUE(sendIPv6PacketFromUid(uid, outsideVpnAddr, &fwmark, fallthroughFd)); |
| EXPECT_EQ(bypassable ? vpnNetId : fallthroughNetId, static_cast<int>(fwmark.intValue)); |
| |
| // Expect connect success, packet will be sent to vpnFd. |
| EXPECT_TRUE(sendIPv6PacketFromUid(uid, insideVpnAddr, &fwmark, vpnFd)); |
| EXPECT_EQ(bypassable ? vpnNetId : fallthroughNetId, static_cast<int>(fwmark.intValue)); |
| |
| // Explicitly select vpn network |
| setNetworkForProcess(vpnNetId); |
| |
| // Expect fallthrough to default network |
| EXPECT_TRUE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd)); |
| // Expect the mark contains all the bit because we've selected network. |
| EXPECT_EQ(vpnNetId | 0xF0000, static_cast<int>(fwmark.intValue)); |
| |
| // Expect connect success, packet will be sent to vpnFd. |
| EXPECT_TRUE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, vpnFd)); |
| // Expect the mark contains all the bit because we've selected network. |
| EXPECT_EQ(vpnNetId | 0xF0000, static_cast<int>(fwmark.intValue)); |
| |
| // Explicitly select fallthrough network |
| setNetworkForProcess(fallthroughNetId); |
| |
| // The mark is set to fallthrough network because we've selected it. |
| EXPECT_TRUE(sendIPv6PacketFromUid(0, outsideVpnAddr, &fwmark, fallthroughFd)); |
| EXPECT_TRUE(sendIPv6PacketFromUid(0, insideVpnAddr, &fwmark, fallthroughFd)); |
| |
| // If vpn is BypassableVPN, connections can also go on the fallthrough network under vpn uid. |
| if (bypassable) { |
| EXPECT_TRUE(sendIPv6PacketFromUid(uid, outsideVpnAddr, &fwmark, fallthroughFd)); |
| EXPECT_TRUE(sendIPv6PacketFromUid(uid, insideVpnAddr, &fwmark, fallthroughFd)); |
| } else { |
| // If not, no permission to bypass vpn. |
| EXPECT_FALSE(sendIPv6PacketFromUid(uid, outsideVpnAddr, &fwmark, fallthroughFd)); |
| EXPECT_FALSE(sendIPv6PacketFromUid(uid, insideVpnAddr, &fwmark, fallthroughFd)); |
| } |
| } |
| |
| } // namespace |
| |
| TEST_F(BinderTest, SecureVPNFallthrough) { |
| createVpnNetworkWithUid(true /* secure */, TEST_UID1); |
| // Get current default network NetId |
| ASSERT_TRUE(mNetd->networkGetDefault(&mStoredDefaultNetwork).isOk()); |
| expectVpnFallthroughWorks(mNetd.get(), false /* bypassable */, TEST_UID1, sTun, sTun2); |
| } |
| |
| TEST_F(BinderTest, BypassableVPNFallthrough) { |
| createVpnNetworkWithUid(false /* secure */, TEST_UID1); |
| // Get current default network NetId |
| ASSERT_TRUE(mNetd->networkGetDefault(&mStoredDefaultNetwork).isOk()); |
| expectVpnFallthroughWorks(mNetd.get(), true /* bypassable */, TEST_UID1, sTun, sTun2); |
| } |