LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge changes from topic "firewall_socket_destroy"

Browse Source 
* changes:
  Close sockets from ConnectivityService#setFirewallChainEnabled
  Add test to verify socket close when firewall is enabled
This commit is contained in:
Motomu Utsumi
2023-05-12 09:18:40 +00:00
committed by Gerrit Code Review
parent 2f82fcdd6c d44a33adb9
commit 179d18b3ad
6 changed files with 276 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
tests/unit/java/com/android/server/BpfNetMapsTest.java
View File

@@ -66,6 +66,7 @@ import android.net.INetd;
import android.os.Build;
import android.os.ServiceSpecificException;
import android.system.ErrnoException;
import android.util.ArraySet;
import android.util.IndentingPrintWriter;
import androidx.test.filters.SmallTest;
@@ -1151,4 +1152,33 @@ public final class BpfNetMapsTest {
mCookieTagMap.updateEntry(new CookieTagMapKey(123), new CookieTagMapValue(456, 0x789));
assertDumpContains(getDump(), "cookie=123 tag=0x789 uid=456");
}
@Test
public void testGetUids() throws ErrnoException {
final int uid0 = TEST_UIDS[0];
final int uid1 = TEST_UIDS[1];
final long match0 = DOZABLE_MATCH | POWERSAVE_MATCH;
final long match1 = DOZABLE_MATCH | STANDBY_MATCH;
mUidOwnerMap.updateEntry(new S32(uid0), new UidOwnerValue(NULL_IIF, match0));
mUidOwnerMap.updateEntry(new S32(uid1), new UidOwnerValue(NULL_IIF, match1));
assertEquals(new ArraySet<>(List.of(uid0, uid1)),
mBpfNetMaps.getUidsWithAllowRuleOnAllowListChain(FIREWALL_CHAIN_DOZABLE));
assertEquals(new ArraySet<>(List.of(uid0)),
mBpfNetMaps.getUidsWithAllowRuleOnAllowListChain(FIREWALL_CHAIN_POWERSAVE));
assertEquals(new ArraySet<>(List.of(uid1)),
mBpfNetMaps.getUidsWithDenyRuleOnDenyListChain(FIREWALL_CHAIN_STANDBY));
assertEquals(new ArraySet<>(),
mBpfNetMaps.getUidsWithDenyRuleOnDenyListChain(FIREWALL_CHAIN_OEM_DENY_1));
}
@Test
public void testGetUidsIllegalArgument() {
final Class<IllegalArgumentException> expected = IllegalArgumentException.class;
assertThrows(expected,
() -> mBpfNetMaps.getUidsWithDenyRuleOnDenyListChain(FIREWALL_CHAIN_DOZABLE));
assertThrows(expected,
() -> mBpfNetMaps.getUidsWithAllowRuleOnAllowListChain(FIREWALL_CHAIN_OEM_DENY_1));
}
}

49
tests/unit/java/com/android/server/ConnectivityServiceTest.java
View File

@@ -2173,6 +2173,11 @@ public class ConnectivityServiceTest {
final Set<Integer> exemptUids) {
// This function is empty since the invocation of this method is verified by mocks
}
@Override
public void destroyLiveTcpSocketsByOwnerUids(final Set<Integer> ownerUids) {
// This function is empty since the invocation of this method is verified by mocks
}
}
private class AutomaticOnOffKeepaliveTrackerDependencies
@@ -10269,6 +10274,50 @@ public class ConnectivityServiceTest {
}
}
private void doTestSetFirewallChainEnabledCloseSocket(final int chain,
final boolean isAllowList) throws Exception {
reset(mDeps);
mCm.setFirewallChainEnabled(chain, true /* enabled */);
final Set<Integer> uids =
new ArraySet<>(List.of(TEST_PACKAGE_UID, TEST_PACKAGE_UID2));
if (isAllowList) {
final Set<Range<Integer>> range = new ArraySet<>(
List.of(new Range<>(Process.FIRST_APPLICATION_UID, Integer.MAX_VALUE)));
verify(mDeps).destroyLiveTcpSockets(range, uids);
} else {
verify(mDeps).destroyLiveTcpSocketsByOwnerUids(uids);
}
mCm.setFirewallChainEnabled(chain, false /* enabled */);
verifyNoMoreInteractions(mDeps);
}
@Test @IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
public void testSetFirewallChainEnabledCloseSocket() throws Exception {
doReturn(new ArraySet<>(Arrays.asList(TEST_PACKAGE_UID, TEST_PACKAGE_UID2)))
.when(mBpfNetMaps)
.getUidsWithDenyRuleOnDenyListChain(anyInt());
doReturn(new ArraySet<>(Arrays.asList(TEST_PACKAGE_UID, TEST_PACKAGE_UID2)))
.when(mBpfNetMaps)
.getUidsWithAllowRuleOnAllowListChain(anyInt());
final boolean allowlist = true;
final boolean denylist = false;
doReturn(true).when(mBpfNetMaps).isFirewallAllowList(anyInt());
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_DOZABLE, allowlist);
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_POWERSAVE, allowlist);
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_RESTRICTED, allowlist);
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_LOW_POWER_STANDBY, allowlist);
doReturn(false).when(mBpfNetMaps).isFirewallAllowList(anyInt());
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_STANDBY, denylist);
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_OEM_DENY_1, denylist);
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_OEM_DENY_2, denylist);
doTestSetFirewallChainEnabledCloseSocket(FIREWALL_CHAIN_OEM_DENY_3, denylist);
}
private void doTestReplaceFirewallChain(final int chain) {
final int[] uids = new int[] {1001, 1002};
mCm.replaceFirewallChain(chain, uids);