1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include <gmock/gmock.h>
16 #include <gtest/gtest.h>
17
18 #include "domain_chain_rule.h"
19 #include "firewall_rule.h"
20 #include "iptables_manager_test.h"
21
22 #define private public
23 #define protected public
24 #include "executer_factory.h"
25 #include "rule_utils.h"
26 #undef protected
27 #undef private
28
29 using namespace testing::ext;
30 using namespace testing;
31 using namespace OHOS::EDM::IPTABLES;
32
33 using ::testing::Return;
34 using ::testing::DoAll;
35 using ::testing::SetArgReferee;
36 using ::testing::Invoke;
37
38 namespace OHOS {
39 namespace EDM {
40 namespace IPTABLES {
41 namespace TEST {
42
SetUp()43 void IptablesManagerTest::SetUp()
44 {
45 executerUtilsMock = std::make_shared<ExecuterUtilsMock>();
46 ExecuterUtils::instance_ = executerUtilsMock;
47
48 iptablesManager = IptablesManager::GetInstance();
49 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
50 iptablesManager->Init();
51 }
52
TearDown()53 void IptablesManagerTest::TearDown()
54 {
55 ExecuterUtils::instance_ = nullptr;
56 ExecuterFactory::instance_ = nullptr;
57 IptablesManager::instance_ = nullptr;
58 }
59
60 /**
61 * @tc.name: TestInit
62 * @tc.desc: Test Init func.
63 * @tc.type: FUNC
64 */
65 HWTEST_F(IptablesManagerTest, TestInit, TestSize.Level1)
66 {
67 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
68 iptablesManager->Init();
69 EXPECT_EQ(iptablesManager->HasInit(), true);
70 }
71
72 /**
73 * @tc.name: TestAddFilewallSuccess
74 * @tc.desc: Test AddFilewall func success.
75 * @tc.type: FUNC
76 */
77 HWTEST_F(IptablesManagerTest, TestAddFilewallSuccess, TestSize.Level1)
78 {
79 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
80
81 std::vector<FirewallRule> validRules{
82 {Direction::INPUT, Action::DENY, Protocol::UDP, "192.168.2.100", "192.168.2.200", "80", "90", ""},
83 {Direction::INPUT, Action::ALLOW, Protocol::TCP, "192.168.2.100", "", "", "", ""},
84 {Direction::OUTPUT, Action::DENY, Protocol::ICMP, "", "", "", "", ""},
85 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "192.168.1.1", "", "", "", ""},
86 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "192.168.1.1/20", "", "", "", ""},
87 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "", "192.168.1.1", "", "", ""},
88 {Direction::OUTPUT, Action::DENY, Protocol::INVALID, "", "192.168.1.1/20", "", "", ""},
89 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "80", "", ""},
90 {Direction::INPUT, Action::DENY, Protocol::INVALID, "", "", "80:90", "", ""},
91 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "80,90", "99", ""},
92 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901", ""},
93 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901:1000", ""},
94 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901,1000", ""},
95 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "", "5555"}};
96 for (const auto &item : validRules) {
97 FirewallRuleParcel validFirewallRule{item};
98 ErrCode ret = iptablesManager->AddFirewallRule(validFirewallRule);
99 EXPECT_EQ(ret, ERR_OK);
100 }
101 }
102
103 /**
104 * @tc.name: TestAddFilewallFail
105 * @tc.desc: Test AddFilewall func fail.
106 * @tc.type: FUNC
107 */
108 HWTEST_F(IptablesManagerTest, TestAddFilewallFail, TestSize.Level1)
109 {
110 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
111
112 std::vector<FirewallRule> invalidRules{
113 {Direction::INPUT, Action::INVALID, Protocol::INVALID, "", "", "", "", "9999"},
114 {Direction::INPUT, Action::ALLOW, Protocol::ALL, "", "", "80", "", ""},
115 {Direction::INPUT, Action::ALLOW, Protocol::ALL, "", "", "", "90", ""},
116 {Direction::INPUT, Action::INVALID, Protocol::INVALID, "192.168.1.1", "", "", "", ""},
117 {Direction::OUTPUT, Action::INVALID, Protocol::INVALID, "", "192.168.1.1", "", "", ""},
118 {Direction::INVALID, Action::ALLOW, Protocol::INVALID, "192.168.1.1", "192.168.2.1", "", "", ""},
119 {Direction::INVALID, Action::DENY, Protocol::INVALID, "192.168.1.1", "192.168.2.1", "", "", ""}};
120 for (const auto &item : invalidRules) {
121 FirewallRuleParcel invalidFirewallRule{item};
122 ErrCode ret = iptablesManager->RemoveFirewallRule(invalidFirewallRule);
123 EXPECT_EQ(ret, EdmReturnErrCode::PARAM_ERROR);
124 }
125 }
126
127 /**
128 * @tc.name: TestAddFilewallError
129 * @tc.desc: Test AddFilewall func error.
130 * @tc.type: FUNC
131 */
132 HWTEST_F(IptablesManagerTest, TestAddFilewallError, TestSize.Level1)
133 {
134 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
135
136 ExecuterFactory::instance_ = std::make_shared<ExecuterFactory>();
137
138 std::vector<FirewallRule> validRules{
139 {Direction::INPUT, Action::DENY, Protocol::UDP, "192.168.2.100", "192.168.2.200", "80", "90", ""},
140 {Direction::INPUT, Action::ALLOW, Protocol::TCP, "192.168.2.100", "", "", "", ""},
141 {Direction::OUTPUT, Action::DENY, Protocol::ICMP, "", "", "", "", ""},
142 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "192.168.1.1", "", "", "", ""},
143 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "192.168.1.1/20", "", "", "", ""},
144 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "", "192.168.1.1", "", "", ""},
145 {Direction::OUTPUT, Action::DENY, Protocol::INVALID, "", "192.168.1.1/20", "", "", ""},
146 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "80", "", ""},
147 {Direction::INPUT, Action::DENY, Protocol::INVALID, "", "", "80-90", "", ""},
148 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "80,90", "", ""},
149 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901", ""},
150 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901-1000", ""},
151 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901,1000", ""},
152 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "", "5555"}};
153 for (const auto &item : validRules) {
154 FirewallRuleParcel validFirewallRule{item};
155 ErrCode ret = iptablesManager->AddFirewallRule(validFirewallRule);
156 EXPECT_EQ(ret, EdmReturnErrCode::SYSTEM_ABNORMALLY);
157 }
158 }
159
160 /**
161 * @tc.name: TestAddFilewallParamError
162 * @tc.desc: Test AddFilewall func param error.
163 * @tc.type: FUNC
164 */
165 HWTEST_F(IptablesManagerTest, TestAddFilewallParamError, TestSize.Level1)
166 {
167 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
168
169 ExecuterFactory::instance_ = std::make_shared<ExecuterFactory>();
170
171 std::vector<FirewallRule> validRules{
172 {Direction::OUTPUT, Action::INVALID, Protocol::INVALID, "", "", "", "", "5555"},
173 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901,1000", "123"}};
174 for (const auto &item : validRules) {
175 FirewallRuleParcel validFirewallRule{item};
176 ErrCode ret = iptablesManager->AddFirewallRule(validFirewallRule);
177 EXPECT_EQ(ret, EdmReturnErrCode::PARAM_ERROR);
178 }
179 }
180
181 /**
182 * @tc.name: TestRemoveFilewallSuccess
183 * @tc.desc: Test RemoveFilewall func success.
184 * @tc.type: FUNC
185 */
186 HWTEST_F(IptablesManagerTest, TestRemoveFilewallSuccess, TestSize.Level1)
187 {
188 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
189
190 std::vector<FirewallRule> validRules{{Direction::INVALID, Action::INVALID, Protocol::INVALID, "", "", "", "", ""},
191 {Direction::INPUT, Action::DENY, Protocol::UDP, "192.168.2.100", "192.168.2.200", "80", "90", ""},
192 {Direction::INPUT, Action::ALLOW, Protocol::TCP, "192.168.2.100", "", "", "", ""},
193 {Direction::OUTPUT, Action::DENY, Protocol::ICMP, "", "", "", "", ""},
194 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "192.168.1.1", "", "", "", ""},
195 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "192.168.1.1/20", "", "", "", ""},
196 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "", "192.168.1.1", "", "", ""},
197 {Direction::OUTPUT, Action::DENY, Protocol::INVALID, "", "192.168.1.1/20", "", "", ""},
198 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "80", "", ""},
199 {Direction::INPUT, Action::DENY, Protocol::INVALID, "", "", "80-90", "", ""},
200 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "80,90", "", ""},
201 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901", ""},
202 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901-1000", ""},
203 {Direction::INPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "901,1000", ""},
204 {Direction::OUTPUT, Action::ALLOW, Protocol::INVALID, "", "", "", "", "5555"}};
205 for (const auto &item : validRules) {
206 FirewallRuleParcel validFirewallRule{item};
207 ErrCode ret = iptablesManager->RemoveFirewallRule(validFirewallRule);
208 EXPECT_EQ(ret, ERR_OK);
209 }
210 }
211
212 /**
213 * @tc.name: TestRemoveFilewallFail
214 * @tc.desc: Test RemoveFilewall func fail.
215 * @tc.type: FUNC
216 */
217 HWTEST_F(IptablesManagerTest, TestRemoveFilewallFail, TestSize.Level1)
218 {
219 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
220
221 std::vector<FirewallRule> invalidRules{
222 {Direction::INPUT, Action::INVALID, Protocol::INVALID, "", "", "", "", "9999"},
223 {Direction::INPUT, Action::ALLOW, Protocol::ALL, "", "", "80", "", ""},
224 {Direction::INPUT, Action::ALLOW, Protocol::ALL, "", "", "", "90", ""},
225 {Direction::INVALID, Action::ALLOW, Protocol::INVALID, "", "", "", "", ""},
226 {Direction::INVALID, Action::INVALID, Protocol::ALL, "", "", "", "", ""},
227 {Direction::INVALID, Action::INVALID, Protocol::UDP, "", "", "", "", ""},
228 {Direction::INVALID, Action::INVALID, Protocol::TCP, "", "", "", "", ""},
229 {Direction::INVALID, Action::INVALID, Protocol::ICMP, "", "", "", "", ""},
230 {Direction::INVALID, Action::INVALID, Protocol::INVALID, "192.168.1.1", "", "", "", ""},
231 {Direction::INVALID, Action::INVALID, Protocol::INVALID, "", "192.168.1.1", "", "", ""},
232 {Direction::INVALID, Action::INVALID, Protocol::INVALID, "", "", "80", "", ""},
233 {Direction::INVALID, Action::INVALID, Protocol::INVALID, "", "", "", "901", ""},
234 {Direction::INVALID, Action::INVALID, Protocol::INVALID, "", "", "", "901", "5555"}};
235 for (const auto &item : invalidRules) {
236 FirewallRuleParcel invalidFirewallRule{item};
237 ErrCode ret = iptablesManager->RemoveFirewallRule(invalidFirewallRule);
238 EXPECT_EQ(ret, EdmReturnErrCode::PARAM_ERROR);
239 }
240 }
241
242 /**
243 * @tc.name: GetFirewallRulesTest
244 * @tc.desc: Test GetFirewallRules func.
245 * @tc.type: FUNC
246 */
247 HWTEST_F(IptablesManagerTest, GetFirewallRulesTest, TestSize.Level1)
248 {
249 std::string result =
250 "Chain edm_deny_output (1 references)\n"
251 "num pkts bytes target prot opt in out source destination\n"
252 "1 0 0 DROP udp -- * * 0.0.0.0/0 10.1.1.1 "
253 "source IP range 192.168.1.1-192.188.22.66 udp spt:8080 dpt:8080";
254 std::string resultEmpty =
255 "Chain edm_deny_output (1 references)\n"
256 "num pkts bytes target prot opt in out source destination";
257 EXPECT_CALL(*executerUtilsMock, Execute)
258 .Times(4)
259 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
260 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
261 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
262 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(result), Return(ERR_OK)));
263
264 std::vector<FirewallRuleParcel> list;
265 ErrCode ret = iptablesManager->GetFirewallRules(list);
266 EXPECT_TRUE(ret == ERR_OK);
267 EXPECT_TRUE(list.size() == 1);
268
269 result =
270 "Chain edm_deny_output (1 references)\n"
271 "num pkts bytes target prot opt in out source destination\n"
272 "1 0 0 DROP udp -- * * 0.0.0.0/0 10.1.1.1 "
273 "source IP range 192.168.1.1-192.188.22.66 udp spt:8080 dpt:8080 owner UID match 9696";
274 EXPECT_CALL(*executerUtilsMock, Execute)
275 .Times(4)
276 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
277 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
278 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
279 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(result), Return(ERR_OK)));
280
281 list = {};
282 ret = iptablesManager->GetFirewallRules(list);
283 EXPECT_TRUE(ret == ERR_OK);
284 EXPECT_TRUE(list.size() == 1);
285
286 result =
287 "Chain edm_deny_input (1 references)\n"
288 "num pkts bytes target prot opt in out source destination\n"
289 "1 0 0 DROP udp -- * * 0.0.0.0/0 10.1.1.1 "
290 "source IP range 192.168.1.1-192.188.22.66 udp spt:8080 dpt:8080 owner UID match 9696";
291 EXPECT_CALL(*executerUtilsMock, Execute)
292 .Times(4)
293 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
294 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(result), Return(ERR_OK)))
295 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
296 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)));
297
298 list = {};
299 ret = iptablesManager->GetFirewallRules(list);
300 EXPECT_TRUE(ret == ERR_OK);
301 EXPECT_TRUE(list.size() == 1);
302 }
303
304 /**
305 * @tc.name: TestAddDomainFilterSuccess
306 * @tc.desc: Test AddDomainFilter func.
307 * @tc.type: FUNC
308 */
309 HWTEST_F(IptablesManagerTest, TestAddDomainFilterSuccess, TestSize.Level1)
310 {
311 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
312
313 std::vector<DomainFilterRule> validRules{
314 {Action::ALLOW, "1000", "www.example.com"},
315 {Action::DENY, "1000", "www.example.com"},
316 {Action::ALLOW, "", "www.example.com"},
317 {Action::DENY, "", "www.example.com"},
318 };
319 for (const auto &item : validRules) {
320 DomainFilterRuleParcel validDomainFilterRuleParcel{item};
321 ErrCode ret = iptablesManager->AddDomainFilterRule(validDomainFilterRuleParcel);
322 EXPECT_EQ(ret, ERR_OK);
323 }
324 }
325
326 /**
327 * @tc.name: TestAddDomainFilterFail
328 * @tc.desc: Test AddDomainFilter func.
329 * @tc.type: FUNC
330 */
331 HWTEST_F(IptablesManagerTest, TestAddDomainFilterFail, TestSize.Level1)
332 {
333 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
334
335 std::string invalidDomainName;
336 for (int i = 0; i < 4; ++i) {
337 for (int j = 0; j < 63; ++j) {
338 invalidDomainName += "a";
339 }
340 invalidDomainName += ".";
341 }
342
343 std::vector<DomainFilterRule> invalidRules{{Action::ALLOW, "1000", ""},
344 {Action::INVALID, "1000", "www.example.com"}, {Action::DENY, "1000", "www.ex||ample.com"},
345 {Action::ALLOW, "1000", "www.ex/ample.com"}, {Action::INVALID, "1000", invalidDomainName}};
346 for (const auto &item : invalidRules) {
347 DomainFilterRuleParcel invalidDomainFilterRuleParcel{item};
348 ErrCode ret = iptablesManager->AddDomainFilterRule(invalidDomainFilterRuleParcel);
349 EXPECT_EQ(ret, EdmReturnErrCode::PARAM_ERROR);
350 }
351 }
352
353 /**
354 * @tc.name: TestAddDomainFilterError
355 * @tc.desc: Test AddDomainFilter func.
356 * @tc.type: FUNC
357 */
358 HWTEST_F(IptablesManagerTest, TestAddDomainFilterError, TestSize.Level1)
359 {
360 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
361
362 ExecuterFactory::instance_ = std::make_shared<ExecuterFactory>();
363
364 std::vector<DomainFilterRule> validRules{
365 {Action::ALLOW, "1000", "www.example.com"},
366 {Action::DENY, "1000", "www.example.com"},
367 {Action::ALLOW, "", "www.example.com"},
368 {Action::DENY, "", "www.example.com"},
369 };
370 for (const auto &item : validRules) {
371 DomainFilterRuleParcel validDomainFilterRuleParcel{item};
372 ErrCode ret = iptablesManager->AddDomainFilterRule(validDomainFilterRuleParcel);
373 EXPECT_EQ(ret, EdmReturnErrCode::SYSTEM_ABNORMALLY);
374 }
375 }
376
377 /**
378 * @tc.name: TestRemoveDomainFilterSuccess
379 * @tc.desc: Test RemoveDomainFilter func.
380 * @tc.type: FUNC
381 */
382 HWTEST_F(IptablesManagerTest, TestRemoveDomainFilterSuccess, TestSize.Level1)
383 {
384 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
385
386 std::vector<DomainFilterRule> validRules{
387 {Action::INVALID, "", ""},
388 {Action::ALLOW, "", ""},
389 {Action::DENY, "", ""},
390 {Action::ALLOW, "1000", "www.example.com"},
391 {Action::DENY, "1000", "www.example.com"},
392 {Action::ALLOW, "", "www.example.com"},
393 {Action::DENY, "", "www.example.com"},
394 };
395 for (const auto &item : validRules) {
396 DomainFilterRuleParcel validDomainFilterRuleParcel{item};
397 ErrCode ret = iptablesManager->RemoveDomainFilterRules(validDomainFilterRuleParcel);
398 EXPECT_EQ(ret, ERR_OK);
399 }
400 }
401
402 /**
403 * @tc.name: TestRemoveDomainFilterFail
404 * @tc.desc: Test RemoveDomainFilter func.
405 * @tc.type: FUNC
406 */
407 HWTEST_F(IptablesManagerTest, TestRemoveDomainFilterFail, TestSize.Level1)
408 {
409 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Invoke(PrintExecRule), Return(ERR_OK)));
410
411 std::vector<DomainFilterRule> invalidRules{
412 {Action::ALLOW, "1000", ""},
413 {Action::DENY, "1000", ""},
414 {Action::INVALID, "", "www.example.com"},
415 {Action::INVALID, "1000", "www.example.com"},
416 {Action::DENY, "1000", "www.ex||ample.com"},
417 {Action::ALLOW, "1000", "www.ex/ample.com"},
418 };
419 for (const auto &item : invalidRules) {
420 DomainFilterRuleParcel invalidDomainFilterRuleParcel{item};
421 ErrCode ret = iptablesManager->RemoveDomainFilterRules(invalidDomainFilterRuleParcel);
422 EXPECT_EQ(ret, EdmReturnErrCode::PARAM_ERROR);
423 }
424 }
425
426 /**
427 * @tc.name: TestGetDomainFilterRules
428 * @tc.desc: Test GetDomainFilterRules func.
429 * @tc.type: FUNC
430 */
431 HWTEST_F(IptablesManagerTest, TestGetDomainFilterRules, TestSize.Level1)
432 {
433 std::string result =
434 "Chain edm_dns_deny_output (1 references)\n"
435 "num pkts bytes target prot opt in out source destination\n"
436 "1 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 "
437 "udp dpt:53 owner UID match 9696 STRING match \"|03777777076578616d706c6503636f6d|\" ALGO name bm TO 65535";
438 std::string resultEmpty =
439 "Chain edm_dns_deny_output (1 references)\n"
440 "num pkts bytes target prot opt in out source destination";
441 EXPECT_CALL(*executerUtilsMock, Execute)
442 .Times(2)
443 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
444 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(result), Return(ERR_OK)));
445
446 std::vector<DomainFilterRuleParcel> list;
447 ErrCode ret = iptablesManager->GetDomainFilterRules(list);
448 EXPECT_EQ(ret, ERR_OK);
449 EXPECT_TRUE(list.size() == 1);
450 }
451
452 /**
453 * @tc.name: TestGetRemoveChainNameSuccess
454 * @tc.desc: Test GetRemoveChainName func.
455 * @tc.type: FUNC
456 */
457 HWTEST_F(IptablesManagerTest, TestGetRemoveChainNameSuccess, TestSize.Level1)
458 {
459 std::vector<std::string> chainNameList;
460 std::vector<std::string> expectList;
461 ErrCode ret = ERR_OK;
462
463 chainNameList = {};
464 ret = iptablesManager->GetRemoveChainName(Direction::INPUT, Action::ALLOW, chainNameList);
465 EXPECT_TRUE(ret == ERR_OK);
466 EXPECT_TRUE(chainNameList.size() == 1);
467 expectList = {EDM_ALLOW_INPUT_CHAIN_NAME};
468 EXPECT_EQ(chainNameList, expectList);
469
470 chainNameList = {};
471 ret = iptablesManager->GetRemoveChainName(Direction::INPUT, Action::DENY, chainNameList);
472 EXPECT_TRUE(ret == ERR_OK);
473 EXPECT_TRUE(chainNameList.size() == 1);
474 expectList = {EDM_DENY_INPUT_CHAIN_NAME};
475 EXPECT_EQ(chainNameList, expectList);
476
477 chainNameList = {};
478 ret = iptablesManager->GetRemoveChainName(Direction::INPUT, Action::INVALID, chainNameList);
479 EXPECT_TRUE(ret == ERR_OK);
480 EXPECT_TRUE(chainNameList.size() == 2);
481 expectList = {EDM_ALLOW_INPUT_CHAIN_NAME, EDM_DENY_INPUT_CHAIN_NAME};
482 EXPECT_EQ(chainNameList, expectList);
483 }
484
485 /**
486 * @tc.name: TestGetRemoveChainNameSuccess1
487 * @tc.desc: Test GetRemoveChainName func.
488 * @tc.type: FUNC
489 */
490 HWTEST_F(IptablesManagerTest, TestGetRemoveChainNameSuccess1, TestSize.Level1)
491 {
492 std::vector<std::string> chainNameList;
493 std::vector<std::string> expectList;
494 ErrCode ret = ERR_OK;
495
496 chainNameList = {};
497 ret = iptablesManager->GetRemoveChainName(Direction::OUTPUT, Action::ALLOW, chainNameList);
498 EXPECT_EQ(ret, ERR_OK);
499 EXPECT_TRUE(chainNameList.size() == 1);
500 expectList = {EDM_ALLOW_OUTPUT_CHAIN_NAME};
501 EXPECT_EQ(chainNameList, expectList);
502
503 chainNameList = {};
504 ret = iptablesManager->GetRemoveChainName(Direction::OUTPUT, Action::DENY, chainNameList);
505 EXPECT_EQ(ret, ERR_OK);
506 EXPECT_TRUE(chainNameList.size() == 1);
507 expectList = {EDM_DENY_OUTPUT_CHAIN_NAME};
508 EXPECT_EQ(chainNameList, expectList);
509
510 chainNameList = {};
511 ret = iptablesManager->GetRemoveChainName(Direction::OUTPUT, Action::INVALID, chainNameList);
512 EXPECT_EQ(ret, ERR_OK);
513 EXPECT_TRUE(chainNameList.size() == 2);
514 expectList = {EDM_ALLOW_OUTPUT_CHAIN_NAME, EDM_DENY_OUTPUT_CHAIN_NAME};
515 EXPECT_EQ(chainNameList, expectList);
516 }
517
518 /**
519 * @tc.name: TestGetRemoveChainNameSuccess2
520 * @tc.desc: Test GetRemoveChainName func.
521 * @tc.type: FUNC
522 */
523 HWTEST_F(IptablesManagerTest, TestGetRemoveChainNameSuccess2, TestSize.Level1)
524 {
525 std::vector<std::string> chainNameList;
526 std::vector<std::string> expectList;
527 ErrCode ret = ERR_OK;
528
529 chainNameList = {};
530 ret = iptablesManager->GetRemoveChainName(Direction::INVALID, Action::INVALID, chainNameList);
531 EXPECT_EQ(ret, ERR_OK);
532 EXPECT_TRUE(chainNameList.size() == 4);
533 }
534
535 /**
536 * @tc.name: TestGetRemoveChainNameFail
537 * @tc.desc: Test GetRemoveChainName func.
538 * @tc.type: FUNC
539 */
540 HWTEST_F(IptablesManagerTest, TestGetRemoveChainNameFail, TestSize.Level1)
541 {
542 std::vector<std::string> chainNameList;
543 std::vector<std::string> expectList;
544 ErrCode ret = ERR_OK;
545
546 chainNameList = {};
547 ret = iptablesManager->GetRemoveChainName(Direction::INVALID, Action::DENY, chainNameList);
548 EXPECT_EQ(ret, EdmReturnErrCode::PARAM_ERROR);
549
550 ret = iptablesManager->GetRemoveChainName(Direction::INVALID, Action::ALLOW, chainNameList);
551 EXPECT_EQ(ret, EdmReturnErrCode::PARAM_ERROR);
552 }
553
554 /**
555 * @tc.name: TestExistAllowFirewallRule
556 * @tc.desc: Test ExistAllowFirewallRule func.
557 * @tc.type: FUNC
558 */
559 HWTEST_F(IptablesManagerTest, TestExistAllowFirewallRule, TestSize.Level1)
560 {
561 std::string result =
562 "Chain edm_deny_output (1 references)\n"
563 "num pkts bytes target prot opt in out source destination\n"
564 "1 0 0 DROP udp -- * * 0.0.0.0/0 10.1.1.1 "
565 "source IP range 192.168.1.1-192.188.22.66 udp spt:8080 dpt:8080";
566 std::string resultEmpty =
567 "Chain edm_deny_output (1 references)\n"
568 "num pkts bytes target prot opt in out source destination";
569 EXPECT_CALL(*executerUtilsMock, Execute)
570 .Times(2)
571 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(resultEmpty), Return(ERR_OK)))
572 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(result), Return(ERR_OK)));
573
574 EXPECT_TRUE(iptablesManager->ExistAllowFirewallRule());
575
576 EXPECT_CALL(*executerUtilsMock, Execute).Times(2).WillOnce(DoAll(Return(ERR_OK))).WillOnce(DoAll(Return(ERR_OK)));
577 EXPECT_FALSE(iptablesManager->ExistAllowFirewallRule());
578 }
579
580 /**
581 * @tc.name: TestExistAllowDomainRule
582 * @tc.desc: Test ExistAllowDomainRule func.
583 * @tc.type: FUNC
584 */
585 HWTEST_F(IptablesManagerTest, TestExistAllowDomainRule, TestSize.Level1)
586 {
587 std::string result =
588 "Chain edm_dns_deny_output (1 references)\n"
589 "num pkts bytes target prot opt in out source destination\n"
590 "1 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 "
591 "udp dpt:53 owner UID match 9696 STRING match \"|03777777076578616d706c6503636f6d|\" ALGO name bm TO 65535";
592 EXPECT_CALL(*executerUtilsMock, Execute)
593 .Times(1)
594 .WillOnce(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(result), Return(ERR_OK)));
595
596 EXPECT_TRUE(iptablesManager->ExistAllowDomainRule());
597
598 EXPECT_CALL(*executerUtilsMock, Execute).Times(1).WillOnce(DoAll(Return(ERR_OK)));
599 EXPECT_FALSE(iptablesManager->ExistAllowDomainRule());
600 }
601
602 /**
603 * @tc.name: TestChainExistRule
604 * @tc.desc: Test ChainExistRule func.
605 * @tc.type: FUNC
606 */
607 HWTEST_F(IptablesManagerTest, TestChainExistRule, TestSize.Level1)
608 {
609 std::string result =
610 "Chain edm_deny_output (1 references)\n"
611 "num pkts bytes target prot opt in out source destination\n"
612 "1 0 0 DROP udp -- * * 0.0.0.0/0 10.1.1.1 "
613 "source IP range 192.168.1.1-192.188.22.66 udp spt:8080 dpt:8080";
614 EXPECT_CALL(*executerUtilsMock, Execute)
615 .WillRepeatedly(DoAll(Invoke(PrintExecRule), SetArgReferee<1>(result), Return(ERR_OK)));
616
617 std::vector<std::string> chainNameList = {EDM_ALLOW_INPUT_CHAIN_NAME, EDM_DENY_INPUT_CHAIN_NAME,
618 EDM_ALLOW_OUTPUT_CHAIN_NAME, EDM_DENY_OUTPUT_CHAIN_NAME};
619 EXPECT_TRUE(iptablesManager->ChainExistRule(chainNameList));
620
621 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Return(ERR_OK)));
622 EXPECT_FALSE(iptablesManager->ChainExistRule(chainNameList));
623 }
624
625 /**
626 * @tc.name: TestStaticAttribute
627 * @tc.desc: Test attribute.
628 * @tc.type: FUNC
629 */
630 HWTEST_F(IptablesManagerTest, TestStaticAttribute, TestSize.Level1)
631 {
632 EXPECT_CALL(*executerUtilsMock, Execute).WillRepeatedly(DoAll(Return(ERR_OK)));
633
634 IptablesManager::g_defaultFirewallChainInit = false;
635 IptablesManager::SetDefaultFirewallDenyChain();
636 EXPECT_TRUE(IptablesManager::g_defaultFirewallChainInit);
637
638 IptablesManager::ClearDefaultFirewallDenyChain();
639 EXPECT_FALSE(IptablesManager::g_defaultFirewallChainInit);
640
641 IptablesManager::g_defaultDomainChainInit = false;
642 IptablesManager::SetDefaultDomainDenyChain();
643 EXPECT_TRUE(IptablesManager::g_defaultDomainChainInit);
644
645 IptablesManager::ClearDefaultDomainDenyChain();
646 EXPECT_FALSE(IptablesManager::g_defaultDomainChainInit);
647 }
648 } // namespace TEST
649 } // namespace IPTABLES
650 } // namespace EDM
651 } // namespace OHOS