server/FirewallControllerTest.cpp

/*
 * Copyright 2016 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * FirewallControllerTest.cpp - unit tests for FirewallController.cpp
 */

#include <string>
#include <vector>
#include <stdio.h>

#include <gtest/gtest.h>

#include <android-base/file.h>
#include <android-base/stringprintf.h>
#include <android-base/strings.h>

#include "FirewallController.h"
#include "IptablesBaseTest.h"

using android::base::Join;
using android::base::WriteStringToFile;

namespace android {
namespace net {

class FirewallControllerTest : public IptablesBaseTest {
protected:
    FirewallControllerTest() {
        FirewallController::execIptablesRestore = fakeExecIptablesRestore;
        // This unit test currently doesn't cover the eBPF owner match case so
        // we have to manually turn eBPF support off.
        // TODO: find a way to unit test the eBPF code path.
        mFw.mUseBpfOwnerMatch = false;
    }
    FirewallController mFw;

    std::string makeUidRules(IptablesTarget a, const char* b, bool c,
                             const std::vector<int32_t>& d) {
        return mFw.makeUidRules(a, b, c, d);
    }

    int createChain(const char* a, FirewallType b) {
        return mFw.createChain(a, b);
    }
};

TEST_F(FirewallControllerTest, TestCreateAllowlistChain) {
    std::vector<std::string> expectedRestore4 = {
            "*filter",
            ":fw_allowlist -",
            "-A fw_allowlist -m owner --uid-owner 0-9999 -j RETURN",
            "-A fw_allowlist -m owner ! --uid-owner 0-4294967294 -j RETURN",
            "-A fw_allowlist -p esp -j RETURN",
            "-A fw_allowlist -i lo -j RETURN",
            "-A fw_allowlist -o lo -j RETURN",
            "-A fw_allowlist -p tcp --tcp-flags RST RST -j RETURN",
            "-A fw_allowlist -j DROP",
            "COMMIT\n"};
    std::vector<std::string> expectedRestore6 = {
            "*filter",
            ":fw_allowlist -",
            "-A fw_allowlist -m owner --uid-owner 0-9999 -j RETURN",
            "-A fw_allowlist -m owner ! --uid-owner 0-4294967294 -j RETURN",
            "-A fw_allowlist -p esp -j RETURN",
            "-A fw_allowlist -i lo -j RETURN",
            "-A fw_allowlist -o lo -j RETURN",
            "-A fw_allowlist -p tcp --tcp-flags RST RST -j RETURN",
            "-A fw_allowlist -p icmpv6 --icmpv6-type packet-too-big -j RETURN",
            "-A fw_allowlist -p icmpv6 --icmpv6-type router-solicitation -j RETURN",
            "-A fw_allowlist -p icmpv6 --icmpv6-type router-advertisement -j RETURN",
            "-A fw_allowlist -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN",
            "-A fw_allowlist -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN",
            "-A fw_allowlist -p icmpv6 --icmpv6-type redirect -j RETURN",
            "-A fw_allowlist -j DROP",
            "COMMIT\n"};
    std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
            {V4, Join(expectedRestore4, '\n')},
            {V6, Join(expectedRestore6, '\n')},
    };

    createChain("fw_allowlist", ALLOWLIST);
    expectIptablesRestoreCommands(expectedRestoreCommands);
}

TEST_F(FirewallControllerTest, TestCreateDenylistChain) {
    std::vector<std::string> expectedRestore = {
            "*filter",
            ":fw_denylist -",
            "-A fw_denylist -i lo -j RETURN",
            "-A fw_denylist -o lo -j RETURN",
            "-A fw_denylist -p tcp --tcp-flags RST RST -j RETURN",
            "COMMIT\n"};
    std::vector<std::pair<IptablesTarget, std::string>> expectedRestoreCommands = {
            {V4, Join(expectedRestore, '\n')},
            {V6, Join(expectedRestore, '\n')},
    };

    createChain("fw_denylist", DENYLIST);
    expectIptablesRestoreCommands(expectedRestoreCommands);
}

TEST_F(FirewallControllerTest, TestSetStandbyRule) {
    ExpectedIptablesCommands expected = {
        { V4V6, "*filter\n-D fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" }
    };
    mFw.setUidRule(STANDBY, 12345, ALLOW);
    expectIptablesRestoreCommands(expected);

    expected = {
        { V4V6, "*filter\n-A fw_standby -m owner --uid-owner 12345 -j DROP\nCOMMIT\n" }
    };
    mFw.setUidRule(STANDBY, 12345, DENY);
    expectIptablesRestoreCommands(expected);
}

TEST_F(FirewallControllerTest, TestSetDozeRule) {
    ExpectedIptablesCommands expected = {
        { V4V6, "*filter\n-I fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" }
    };
    mFw.setUidRule(DOZABLE, 54321, ALLOW);
    expectIptablesRestoreCommands(expected);

    expected = {
        { V4V6, "*filter\n-D fw_dozable -m owner --uid-owner 54321 -j RETURN\nCOMMIT\n" }
    };
    mFw.setUidRule(DOZABLE, 54321, DENY);
    expectIptablesRestoreCommands(expected);
}

TEST_F(FirewallControllerTest, TestSetFirewallRule) {
    ExpectedIptablesCommands expected = {
        { V4V6, "*filter\n"
                "-A fw_INPUT -m owner --uid-owner 54321 -j DROP\n"
                "-A fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n"
                "COMMIT\n" }
    };
    mFw.setUidRule(NONE, 54321, DENY);
    expectIptablesRestoreCommands(expected);

    expected = {
        { V4V6, "*filter\n"
                "-D fw_INPUT -m owner --uid-owner 54321 -j DROP\n"
                "-D fw_OUTPUT -m owner --uid-owner 54321 -j DROP\n"
                "COMMIT\n" }
    };
    mFw.setUidRule(NONE, 54321, ALLOW);
    expectIptablesRestoreCommands(expected);
}

TEST_F(FirewallControllerTest, TestReplaceAllowlistUidRule) {
    std::string expected =
            "*filter\n"
            ":FW_allowchain -\n"
            "-A FW_allowchain -m owner --uid-owner 10023 -j RETURN\n"
            "-A FW_allowchain -m owner --uid-owner 10059 -j RETURN\n"
            "-A FW_allowchain -m owner --uid-owner 10124 -j RETURN\n"
            "-A FW_allowchain -m owner --uid-owner 10111 -j RETURN\n"
            "-A FW_allowchain -m owner --uid-owner 110122 -j RETURN\n"
            "-A FW_allowchain -m owner --uid-owner 210153 -j RETURN\n"
            "-A FW_allowchain -m owner --uid-owner 210024 -j RETURN\n"
            "-A FW_allowchain -m owner --uid-owner 0-9999 -j RETURN\n"
            "-A FW_allowchain -m owner ! --uid-owner 0-4294967294 -j RETURN\n"
            "-A FW_allowchain -p esp -j RETURN\n"
            "-A FW_allowchain -i lo -j RETURN\n"
            "-A FW_allowchain -o lo -j RETURN\n"
            "-A FW_allowchain -p tcp --tcp-flags RST RST -j RETURN\n"
            "-A FW_allowchain -p icmpv6 --icmpv6-type packet-too-big -j RETURN\n"
            "-A FW_allowchain -p icmpv6 --icmpv6-type router-solicitation -j RETURN\n"
            "-A FW_allowchain -p icmpv6 --icmpv6-type router-advertisement -j RETURN\n"
            "-A FW_allowchain -p icmpv6 --icmpv6-type neighbour-solicitation -j RETURN\n"
            "-A FW_allowchain -p icmpv6 --icmpv6-type neighbour-advertisement -j RETURN\n"
            "-A FW_allowchain -p icmpv6 --icmpv6-type redirect -j RETURN\n"
            "-A FW_allowchain -j DROP\n"
            "COMMIT\n";

    std::vector<int32_t> uids = { 10023, 10059, 10124, 10111, 110122, 210153, 210024 };
    EXPECT_EQ(expected, makeUidRules(V6, "FW_allowchain", true, uids));
}

TEST_F(FirewallControllerTest, TestReplaceDenylistUidRule) {
    std::string expected =
            "*filter\n"
            ":FW_denychain -\n"
            "-A FW_denychain -i lo -j RETURN\n"
            "-A FW_denychain -o lo -j RETURN\n"
            "-A FW_denychain -p tcp --tcp-flags RST RST -j RETURN\n"
            "-A FW_denychain -m owner --uid-owner 10023 -j DROP\n"
            "-A FW_denychain -m owner --uid-owner 10059 -j DROP\n"
            "-A FW_denychain -m owner --uid-owner 10124 -j DROP\n"
            "COMMIT\n";

    std::vector<int32_t> uids = { 10023, 10059, 10124 };
    EXPECT_EQ(expected, makeUidRules(V4, "FW_denychain", false, uids));
}

TEST_F(FirewallControllerTest, TestEnableChildChains) {
    std::vector<std::string> expected = {
        "*filter\n"
        "-A fw_INPUT -j fw_dozable\n"
        "-A fw_OUTPUT -j fw_dozable\n"
        "COMMIT\n"
    };
    EXPECT_EQ(0, mFw.enableChildChains(DOZABLE, true));
    expectIptablesRestoreCommands(expected);

    expected = {
        "*filter\n"
        "-D fw_INPUT -j fw_powersave\n"
        "-D fw_OUTPUT -j fw_powersave\n"
        "COMMIT\n"
    };
    EXPECT_EQ(0, mFw.enableChildChains(POWERSAVE, false));
    expectIptablesRestoreCommands(expected);
}

TEST_F(FirewallControllerTest, TestFirewall) {
    std::vector<std::string> enableCommands = {
            "*filter\n"
            "-A fw_INPUT -j DROP\n"
            "-A fw_OUTPUT -j REJECT\n"
            "-A fw_FORWARD -j REJECT\n"
            "COMMIT\n"};
    std::vector<std::string> disableCommands = {
            "*filter\n"
            ":fw_INPUT -\n"
            ":fw_OUTPUT -\n"
            ":fw_FORWARD -\n"
            "-6 -A fw_OUTPUT ! -o lo -s ::1 -j DROP\n"
            "COMMIT\n"};
    std::vector<std::string> noCommands = {};

    EXPECT_EQ(0, mFw.resetFirewall());
    expectIptablesRestoreCommands(disableCommands);

    EXPECT_EQ(0, mFw.resetFirewall());
    expectIptablesRestoreCommands(disableCommands);

    EXPECT_EQ(0, mFw.setFirewallType(DENYLIST));
    expectIptablesRestoreCommands(disableCommands);

    EXPECT_EQ(0, mFw.setFirewallType(DENYLIST));
    expectIptablesRestoreCommands(noCommands);

    std::vector<std::string> disableEnableCommands;
    disableEnableCommands.insert(
            disableEnableCommands.end(), disableCommands.begin(), disableCommands.end());
    disableEnableCommands.insert(
            disableEnableCommands.end(), enableCommands.begin(), enableCommands.end());

    EXPECT_EQ(0, mFw.setFirewallType(ALLOWLIST));
    expectIptablesRestoreCommands(disableEnableCommands);

    std::vector<std::string> ifaceCommands = {
        "*filter\n"
        "-I fw_INPUT -i rmnet_data0 -j RETURN\n"
        "-I fw_OUTPUT -o rmnet_data0 -j RETURN\n"
        "COMMIT\n"
    };
    EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", ALLOW));
    expectIptablesRestoreCommands(ifaceCommands);

    EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", ALLOW));
    expectIptablesRestoreCommands(noCommands);

    ifaceCommands = {
        "*filter\n"
        "-D fw_INPUT -i rmnet_data0 -j RETURN\n"
        "-D fw_OUTPUT -o rmnet_data0 -j RETURN\n"
        "COMMIT\n"
    };
    EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", DENY));
    expectIptablesRestoreCommands(ifaceCommands);

    EXPECT_EQ(0, mFw.setInterfaceRule("rmnet_data0", DENY));
    expectIptablesRestoreCommands(noCommands);

    EXPECT_EQ(0, mFw.setFirewallType(ALLOWLIST));
    expectIptablesRestoreCommands(noCommands);

    EXPECT_EQ(0, mFw.resetFirewall());
    expectIptablesRestoreCommands(disableCommands);

    // TODO: calling resetFirewall and then setFirewallType(ALLOWLIST) does
    // nothing. This seems like a clear bug.
    EXPECT_EQ(0, mFw.setFirewallType(ALLOWLIST));
    expectIptablesRestoreCommands(noCommands);
}

TEST_F(FirewallControllerTest, TestDiscoverMaximumValidUid) {
    struct {
        const std::string description;
        const std::string content;
        const uint32_t expected;
    } testCases[] = {
            {
                    .description = "root namespace case",
                    .content = "         0          0 4294967295",
                    .expected = 4294967294,
            },
            {
                    .description = "container namespace case",
                    .content = "         0     655360       5000\n"
                               "      5000        600         50\n"
                               "      5050     660410    1994950\n",
                    .expected = 1999999,
            },
            {
                    .description = "garbage content case",
                    .content = "garbage",
                    .expected = 4294967294,
            },
            {
                    .description = "no content case",
                    .content = "",
                    .expected = 4294967294,
            },
    };

    const std::string tempFile = "/data/local/tmp/fake_uid_mapping";

    for (const auto& test : testCases) {
        EXPECT_TRUE(WriteStringToFile(test.content, tempFile, false));
        uint32_t got = FirewallController::discoverMaximumValidUid(tempFile);
        EXPECT_EQ(0, remove(tempFile.c_str()));
        if (got != test.expected) {
            FAIL() << test.description << ":\n"
                   << test.content << "\ngot " << got << ", but expected " << test.expected;
        }
    }

    // Also check when the file is not defined
    EXPECT_NE(0, access(tempFile.c_str(), F_OK));
    EXPECT_EQ(4294967294, FirewallController::discoverMaximumValidUid(tempFile));
}

}  // namespace net
}  // namespace android