LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge "Use java BpfMap in BpfNetMaps#setUidRule"

Browse Source
This commit is contained in:
Motomu Utsumi
2022-07-15 01:06:48 +00:00
committed by Gerrit Code Review
parent 26df963836 40230beb5f
commit fe72021c06
2 changed files with 151 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
tests/unit/java/com/android/server/BpfNetMapsTest.java
View File

@@ -24,6 +24,8 @@ import static android.net.ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_3;
import static android.net.ConnectivityManager.FIREWALL_CHAIN_POWERSAVE;
import static android.net.ConnectivityManager.FIREWALL_CHAIN_RESTRICTED;
import static android.net.ConnectivityManager.FIREWALL_CHAIN_STANDBY;
import static android.net.ConnectivityManager.FIREWALL_RULE_ALLOW;
import static android.net.ConnectivityManager.FIREWALL_RULE_DENY;
import static android.net.INetd.PERMISSION_INTERNET;
import static com.android.server.BpfNetMaps.DOZABLE_MATCH;
@@ -124,12 +126,16 @@ public final class BpfNetMapsTest {
verify(mNetd).trafficSetNetPermForUids(PERMISSION_INTERNET, TEST_UIDS);
}
private void doTestIsChainEnabled(final List<Integer> enableChains) throws Exception {
private long getMatch(final List<Integer> chains) {
long match = 0;
for (final int chain: enableChains) {
for (final int chain: chains) {
match |= mBpfNetMaps.getMatchByFirewallChain(chain);
}
mConfigurationMap.updateEntry(UID_RULES_CONFIGURATION_KEY, new U32(match));
return match;
}
private void doTestIsChainEnabled(final List<Integer> enableChains) throws Exception {
mConfigurationMap.updateEntry(UID_RULES_CONFIGURATION_KEY, new U32(getMatch(enableChains)));
for (final int chain: FIREWALL_CHAINS) {
final String testCase = "EnabledChains: " + enableChains + " CheckedChain: " + chain;
@@ -557,4 +563,90 @@ public final class BpfNetMapsTest {
doTestRemoveUidInterfaceRules(NO_IIF, DOZABLE_MATCH,
NO_IIF, DOZABLE_MATCH | POWERSAVE_MATCH | RESTRICTED_MATCH);
}
private void doTestSetUidRule(final List<Integer> testChains) throws Exception {
mUidOwnerMap.updateEntry(new U32(TEST_UID), new UidOwnerValue(TEST_IF_INDEX, IIF_MATCH));
for (final int chain: testChains) {
final int ruleToAddMatch = mBpfNetMaps.isFirewallAllowList(chain)
? FIREWALL_RULE_ALLOW : FIREWALL_RULE_DENY;
mBpfNetMaps.setUidRule(chain, TEST_UID, ruleToAddMatch);
}
checkUidOwnerValue(TEST_UID, TEST_IF_INDEX, IIF_MATCH | getMatch(testChains));
for (final int chain: testChains) {
final int ruleToRemoveMatch = mBpfNetMaps.isFirewallAllowList(chain)
? FIREWALL_RULE_DENY : FIREWALL_RULE_ALLOW;
mBpfNetMaps.setUidRule(chain, TEST_UID, ruleToRemoveMatch);
}
checkUidOwnerValue(TEST_UID, TEST_IF_INDEX, IIF_MATCH);
}
private void doTestSetUidRule(final int testChain) throws Exception {
doTestSetUidRule(List.of(testChain));
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.S_V2)
public void testSetUidRule() throws Exception {
doTestSetUidRule(FIREWALL_CHAIN_DOZABLE);
doTestSetUidRule(FIREWALL_CHAIN_STANDBY);
doTestSetUidRule(FIREWALL_CHAIN_POWERSAVE);
doTestSetUidRule(FIREWALL_CHAIN_RESTRICTED);
doTestSetUidRule(FIREWALL_CHAIN_LOW_POWER_STANDBY);
doTestSetUidRule(FIREWALL_CHAIN_OEM_DENY_1);
doTestSetUidRule(FIREWALL_CHAIN_OEM_DENY_2);
doTestSetUidRule(FIREWALL_CHAIN_OEM_DENY_3);
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.S_V2)
public void testSetUidRuleMultipleChain() throws Exception {
doTestSetUidRule(List.of(
FIREWALL_CHAIN_DOZABLE,
FIREWALL_CHAIN_STANDBY));
doTestSetUidRule(List.of(
FIREWALL_CHAIN_DOZABLE,
FIREWALL_CHAIN_STANDBY,
FIREWALL_CHAIN_POWERSAVE,
FIREWALL_CHAIN_RESTRICTED));
doTestSetUidRule(FIREWALL_CHAINS);
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.S_V2)
public void testSetUidRuleRemoveRuleFromUidWithNoRule() {
final Class<ServiceSpecificException> expected = ServiceSpecificException.class;
assertThrows(expected,
() -> mBpfNetMaps.setUidRule(FIREWALL_CHAIN_DOZABLE, TEST_UID, FIREWALL_RULE_DENY));
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.S_V2)
public void testSetUidRuleInvalidChain() {
final Class<ServiceSpecificException> expected = ServiceSpecificException.class;
assertThrows(expected,
() -> mBpfNetMaps.setUidRule(-1 /* childChain */, TEST_UID, FIREWALL_RULE_ALLOW));
assertThrows(expected,
() -> mBpfNetMaps.setUidRule(1000 /* childChain */, TEST_UID, FIREWALL_RULE_ALLOW));
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.S_V2)
public void testSetUidRuleInvalidRule() {
final Class<ServiceSpecificException> expected = ServiceSpecificException.class;
assertThrows(expected, () ->
mBpfNetMaps.setUidRule(FIREWALL_CHAIN_DOZABLE, TEST_UID, -1 /* firewallRule */));
assertThrows(expected, () ->
mBpfNetMaps.setUidRule(FIREWALL_CHAIN_DOZABLE, TEST_UID, 1000 /* firewallRule */));
}
@Test
@IgnoreAfter(Build.VERSION_CODES.S_V2)
public void testSetUidRuleBeforeT() {
assertThrows(UnsupportedOperationException.class, () ->
mBpfNetMaps.setUidRule(FIREWALL_CHAIN_DOZABLE, TEST_UID, FIREWALL_RULE_ALLOW));
}
}