| /* |
| * Copyright 2016 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| * StrictControllerTest.cpp - unit tests for StrictController.cpp |
| */ |
| |
| #include <string> |
| #include <vector> |
| |
| #include <gtest/gtest.h> |
| |
| #include <android-base/strings.h> |
| |
| #include "StrictController.h" |
| #include "IptablesBaseTest.h" |
| |
| class StrictControllerTest : public IptablesBaseTest { |
| public: |
| StrictControllerTest() { |
| StrictController::execIptablesRestore = fakeExecIptablesRestore; |
| } |
| StrictController mStrictCtrl; |
| }; |
| |
| TEST_F(StrictControllerTest, TestEnableStrict) { |
| mStrictCtrl.enableStrict(); |
| |
| std::vector<std::string> common = { |
| "*filter", |
| ":st_OUTPUT -", |
| ":st_penalty_log -", |
| ":st_penalty_reject -", |
| ":st_clear_caught -", |
| ":st_clear_detect -", |
| "COMMIT\n" |
| }; |
| |
| std::vector<std::string> v4 = { |
| "*filter", |
| "-A st_penalty_log -j CONNMARK --or-mark 0x1000000", |
| "-A st_penalty_log -j NFLOG --nflog-group 0", |
| "-A st_penalty_reject -j CONNMARK --or-mark 0x2000000", |
| "-A st_penalty_reject -j NFLOG --nflog-group 0", |
| "-A st_penalty_reject -j REJECT", |
| "-A st_clear_detect -m connmark --mark 0x2000000/0x2000000 -j REJECT", |
| "-A st_clear_detect -m connmark --mark 0x1000000/0x1000000 -j RETURN", |
| "-A st_clear_detect -p tcp -m u32 --u32 \"" |
| "0>>22&0x3C@ 12>>26&0x3C@ 0&0xFFFF0000=0x16030000 &&" |
| "0>>22&0x3C@ 12>>26&0x3C@ 4&0x00FF0000=0x00010000" |
| "\" -j CONNMARK --or-mark 0x1000000", |
| "-A st_clear_detect -p udp -m u32 --u32 \"" |
| "0>>22&0x3C@ 8&0xFFFF0000=0x16FE0000 &&" |
| "0>>22&0x3C@ 20&0x00FF0000=0x00010000" |
| "\" -j CONNMARK --or-mark 0x1000000", |
| "-A st_clear_detect -m connmark --mark 0x1000000/0x1000000 -j RETURN", |
| "-A st_clear_detect -p tcp -m state --state ESTABLISHED -m u32 --u32 " |
| "\"0>>22&0x3C@ 12>>26&0x3C@ 0&0x0=0x0\" -j st_clear_caught", |
| "-A st_clear_detect -p udp -j st_clear_caught", |
| "COMMIT\n" |
| }; |
| |
| std::vector<std::string> v6 = { |
| "*filter", |
| "-A st_penalty_log -j CONNMARK --or-mark 0x1000000", |
| "-A st_penalty_log -j NFLOG --nflog-group 0", |
| "-A st_penalty_reject -j CONNMARK --or-mark 0x2000000", |
| "-A st_penalty_reject -j NFLOG --nflog-group 0", |
| "-A st_penalty_reject -j REJECT", |
| "-A st_clear_detect -m connmark --mark 0x2000000/0x2000000 -j REJECT", |
| "-A st_clear_detect -m connmark --mark 0x1000000/0x1000000 -j RETURN", |
| |
| "-A st_clear_detect -p tcp -m u32 --u32 \"" |
| "52>>26&0x3C@ 40&0xFFFF0000=0x16030000 &&" |
| "52>>26&0x3C@ 44&0x00FF0000=0x00010000" |
| "\" -j CONNMARK --or-mark 0x1000000", |
| "-A st_clear_detect -p udp -m u32 --u32 \"" |
| "48&0xFFFF0000=0x16FE0000 &&" |
| "60&0x00FF0000=0x00010000" |
| "\" -j CONNMARK --or-mark 0x1000000", |
| "-A st_clear_detect -m connmark --mark 0x1000000/0x1000000 -j RETURN", |
| "-A st_clear_detect -p tcp -m state --state ESTABLISHED -m u32 --u32 " |
| "\"52>>26&0x3C@ 40&0x0=0x0\" -j st_clear_caught", |
| "-A st_clear_detect -p udp -j st_clear_caught", |
| "COMMIT\n" |
| }; |
| |
| std::string commandsCommon = android::base::Join(common, '\n'); |
| std::string commands4 = android::base::Join(v4, '\n'); |
| std::string commands6 = android::base::Join(v6, '\n'); |
| |
| std::vector<std::pair<IptablesTarget, std::string>> expected = { |
| { V4V6, commandsCommon }, |
| { V4, commands4 }, |
| { V6, commands6 }, |
| }; |
| expectIptablesRestoreCommands(expected); |
| } |
| |
| TEST_F(StrictControllerTest, TestDisableStrict) { |
| mStrictCtrl.disableStrict(); |
| |
| const std::string expected = |
| "*filter\n" |
| ":st_OUTPUT -\n" |
| ":st_penalty_log -\n" |
| ":st_penalty_reject -\n" |
| ":st_clear_caught -\n" |
| ":st_clear_detect -\n" |
| "COMMIT\n"; |
| expectIptablesRestoreCommands({ expected }); |
| } |
| |
| TEST_F(StrictControllerTest, TestSetUidCleartextPenalty) { |
| std::vector<std::string> acceptCommands = { |
| "*filter\n" |
| "-D st_OUTPUT -m owner --uid-owner 12345 -j st_clear_detect\n" |
| "-D st_clear_caught -m owner --uid-owner 12345 -j st_penalty_log\n" |
| "-D st_clear_caught -m owner --uid-owner 12345 -j st_penalty_reject\n" |
| "COMMIT\n" |
| }; |
| std::vector<std::string> logCommands = { |
| "*filter\n" |
| "-I st_OUTPUT -m owner --uid-owner 12345 -j st_clear_detect\n" |
| "-I st_clear_caught -m owner --uid-owner 12345 -j st_penalty_log\n" |
| "COMMIT\n" |
| }; |
| std::vector<std::string> rejectCommands = { |
| "*filter\n" |
| "-I st_OUTPUT -m owner --uid-owner 12345 -j st_clear_detect\n" |
| "-I st_clear_caught -m owner --uid-owner 12345 -j st_penalty_reject\n" |
| "COMMIT\n" |
| }; |
| |
| mStrictCtrl.setUidCleartextPenalty(12345, LOG); |
| expectIptablesRestoreCommands(logCommands); |
| |
| mStrictCtrl.setUidCleartextPenalty(12345, ACCEPT); |
| expectIptablesRestoreCommands(acceptCommands); |
| |
| // StrictController doesn't keep any state and it is not correct to call its methods in the |
| // wrong order (e.g., to go from LOG to REJECT without passing through ACCEPT). |
| // NetworkManagementService does keep state (not just to ensure correctness, but also so it can |
| // reprogram the rules when netd crashes). |
| mStrictCtrl.setUidCleartextPenalty(12345, REJECT); |
| expectIptablesRestoreCommands(rejectCommands); |
| |
| mStrictCtrl.setUidCleartextPenalty(12345, ACCEPT); |
| expectIptablesRestoreCommands(acceptCommands); |
| } |