1 /*
2 * Copyright 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "IptablesRestoreControllerTest"
18 #include "IptablesRestoreController.h"
19
20 #include <fcntl.h>
21 #include <gmock/gmock.h>
22 #include <gtest/gtest.h>
23 #include <sys/file.h>
24 #include <sys/socket.h>
25 #include <sys/un.h>
26
27 #include <cinttypes>
28 #include <iostream>
29 #include <string>
30
31 #include <android-base/stringprintf.h>
32 #include <android-base/strings.h>
33 #include <log/log.h>
34 #include <netdutils/MockSyscalls.h>
35 #include <netdutils/NetNativeTestBase.h>
36 #include <netdutils/Stopwatch.h>
37
38 #include "NetdConstants.h"
39
40 #define XT_LOCK_NAME "/system/etc/xtables.lock"
41 #define XT_LOCK_ATTEMPTS 10
42 #define XT_LOCK_POLL_INTERVAL_MS 100
43
44 #define PROC_STAT_MIN_ELEMENTS 52U
45 #define PROC_STAT_RSS_INDEX 23U
46
47 #define IPTABLES_COMM "(iptables-restor)"
48 #define IP6TABLES_COMM "(ip6tables-resto)"
49
50 using android::base::Join;
51 using android::base::StringAppendF;
52 using android::base::StringPrintf;
53 using android::netdutils::ScopedMockSyscalls;
54 using android::netdutils::Stopwatch;
55 using testing::Return;
56 using testing::StrictMock;
57
58 class IptablesRestoreControllerTest : public NetNativeTestBase {
59 public:
60 IptablesRestoreController con;
61 int mDefaultMaxRetries = con.MAX_RETRIES;
62 int mDefaultPollTimeoutMs = con.POLL_TIMEOUT_MS;
63 int mIptablesLock = -1;
64 std::string mChainName;
65
SetUpTestSuite()66 static void SetUpTestSuite() { blockSigpipe(); }
67
SetUp()68 void SetUp() {
69 ASSERT_EQ(0, createTestChain());
70 }
71
TearDown()72 void TearDown() {
73 con.MAX_RETRIES = mDefaultMaxRetries;
74 con.POLL_TIMEOUT_MS = mDefaultPollTimeoutMs;
75 deleteTestChain();
76 }
77
Init()78 void Init() {
79 con.Init();
80 }
81
getIpRestorePid(const IptablesRestoreController::IptablesProcessType type)82 pid_t getIpRestorePid(const IptablesRestoreController::IptablesProcessType type) {
83 return con.getIpRestorePid(type);
84 };
85
getProcStatPath(pid_t pid)86 const std::string getProcStatPath(pid_t pid) { return StringPrintf("/proc/%d/stat", pid); }
87
parseProcStat(int fd,const std::string & path)88 std::vector<std::string> parseProcStat(int fd, const std::string& path) {
89 std::vector<std::string> procStat;
90
91 char statBuf[1024];
92 EXPECT_NE(-1, read(fd, statBuf, sizeof(statBuf)))
93 << "Could not read from " << path << ": " << strerror(errno);
94
95 std::stringstream stream(statBuf);
96 std::string item;
97 while (std::getline(stream, item, ' ')) {
98 procStat.push_back(item);
99 }
100
101 EXPECT_LE(PROC_STAT_MIN_ELEMENTS, procStat.size()) << "Too few elements in " << path;
102 return procStat;
103 }
104
expectNoIptablesRestoreProcess(pid_t pid)105 void expectNoIptablesRestoreProcess(pid_t pid) {
106 // We can't readlink /proc/PID/exe, because zombie processes don't have it.
107 // Parse /proc/PID/stat instead.
108 std::string statPath = getProcStatPath(pid);
109 int fd = open(statPath.c_str(), O_RDONLY | O_CLOEXEC);
110 if (fd == -1) {
111 // ENOENT means the process is gone (expected).
112 ASSERT_EQ(errno, ENOENT)
113 << "Unexpected error opening " << statPath << ": " << strerror(errno);
114 return;
115 }
116
117 // If the PID exists, it's possible (though very unlikely) that the PID was reused. Check the
118 // binary name as well, to ensure the test isn't flaky.
119 std::vector<std::string> procStat = parseProcStat(fd, statPath);
120 EXPECT_FALSE(procStat[1] == IPTABLES_COMM || procStat[1] == IP6TABLES_COMM)
121 << "Previous iptables-restore or ip6tables-restore pid " << pid
122 << " still alive: " << Join(procStat, " ");
123
124 close(fd);
125 }
126
getRssPages(pid_t pid)127 int getRssPages(pid_t pid) {
128 std::string statPath = getProcStatPath(pid);
129 int fd = open(statPath.c_str(), O_RDONLY | O_CLOEXEC);
130 EXPECT_NE(-1, fd) << "Unexpected error opening " << statPath << ": " << strerror(errno);
131 if (fd == -1) return 0;
132
133 const auto& procStat = parseProcStat(fd, statPath);
134 close(fd);
135
136 if (procStat.size() < PROC_STAT_MIN_ELEMENTS) return 0;
137 EXPECT_TRUE(procStat[1] == IPTABLES_COMM || procStat[1] == IP6TABLES_COMM)
138 << statPath << " is for unexpected process: " << procStat[1];
139
140 return std::atoi(procStat[PROC_STAT_RSS_INDEX].c_str());
141 }
142
createTestChain()143 int createTestChain() {
144 mChainName = StringPrintf("netd_unit_test_%u", arc4random_uniform(10000)).c_str();
145
146 // Create a chain to list.
147 std::vector<std::string> createCommands = {
148 "*filter",
149 StringPrintf(":%s -", mChainName.c_str()),
150 StringPrintf("-A %s -j RETURN", mChainName.c_str()),
151 "COMMIT",
152 ""
153 };
154
155 int ret = con.execute(V4V6, Join(createCommands, "\n"), nullptr);
156 if (ret) mChainName = "";
157 return ret;
158 }
159
deleteTestChain()160 void deleteTestChain() {
161 std::vector<std::string> deleteCommands = {
162 "*filter",
163 StringPrintf(":%s -", mChainName.c_str()), // Flush chain (otherwise we can't delete it).
164 StringPrintf("-X %s", mChainName.c_str()), // Delete it.
165 "COMMIT",
166 ""
167 };
168 con.execute(V4V6, Join(deleteCommands, "\n"), nullptr);
169 mChainName = "";
170 }
171
acquireIptablesLock()172 int acquireIptablesLock() {
173 mIptablesLock = open(XT_LOCK_NAME, O_CREAT | O_CLOEXEC, 0600);
174 if (mIptablesLock == -1) return mIptablesLock;
175 int attempts;
176 for (attempts = 0; attempts < XT_LOCK_ATTEMPTS; attempts++) {
177 if (flock(mIptablesLock, LOCK_EX | LOCK_NB) == 0) {
178 return 0;
179 }
180 usleep(XT_LOCK_POLL_INTERVAL_MS * 1000);
181 }
182 EXPECT_LT(attempts, XT_LOCK_ATTEMPTS) <<
183 "Could not acquire iptables lock after " << XT_LOCK_ATTEMPTS << " attempts " <<
184 XT_LOCK_POLL_INTERVAL_MS << "ms apart";
185 return -1;
186 }
187
releaseIptablesLock()188 void releaseIptablesLock() {
189 if (mIptablesLock != -1) {
190 close(mIptablesLock);
191 }
192 }
193
setRetryParameters(int maxRetries,int pollTimeoutMs)194 void setRetryParameters(int maxRetries, int pollTimeoutMs) {
195 con.MAX_RETRIES = maxRetries;
196 con.POLL_TIMEOUT_MS = pollTimeoutMs;
197 }
198 };
199
TEST_F(IptablesRestoreControllerTest,TestBasicCommand)200 TEST_F(IptablesRestoreControllerTest, TestBasicCommand) {
201 std::string output;
202
203 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", nullptr));
204
205 pid_t pid4 = getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS);
206 pid_t pid6 = getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS);
207
208 EXPECT_EQ(0, con.execute(IptablesTarget::V6, "#Test\n", nullptr));
209 EXPECT_EQ(0, con.execute(IptablesTarget::V4, "#Test\n", nullptr));
210
211 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", &output));
212 EXPECT_EQ("#Test\n#Test\n", output); // One for IPv4 and one for IPv6.
213
214 // Check the PIDs are the same as they were before. If they're not, the child processes were
215 // restarted, which causes a 30-60ms delay.
216 EXPECT_EQ(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
217 EXPECT_EQ(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
218 }
219
TEST_F(IptablesRestoreControllerTest,TestRestartOnMalformedCommand)220 TEST_F(IptablesRestoreControllerTest, TestRestartOnMalformedCommand) {
221 std::string buffer;
222 for (int i = 0; i < 50; i++) {
223 IptablesTarget target = (IptablesTarget) (i % 3);
224 std::string *output = (i % 2) ? &buffer : nullptr;
225 ASSERT_EQ(-1, con.execute(target, "malformed command\n", output)) <<
226 "Malformed command did not fail at iteration " << i;
227 ASSERT_EQ(0, con.execute(target, "#Test\n", output)) <<
228 "No-op command did not succeed at iteration " << i;
229 }
230 }
231
TEST_F(IptablesRestoreControllerTest,TestRestartOnProcessDeath)232 TEST_F(IptablesRestoreControllerTest, TestRestartOnProcessDeath) {
233 std::string output;
234
235 // Run a command to ensure that the processes are running.
236 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", &output));
237
238 pid_t pid4 = getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS);
239 pid_t pid6 = getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS);
240
241 ASSERT_EQ(0, kill(pid4, 0)) << "iptables-restore pid " << pid4 << " does not exist";
242 ASSERT_EQ(0, kill(pid6, 0)) << "ip6tables-restore pid " << pid6 << " does not exist";
243 ASSERT_EQ(0, kill(pid4, SIGTERM)) << "Failed to send SIGTERM to iptables-restore pid " << pid4;
244 ASSERT_EQ(0, kill(pid6, SIGTERM)) << "Failed to send SIGTERM to ip6tables-restore pid " << pid6;
245
246 // Wait 100ms for processes to terminate.
247 TEMP_FAILURE_RETRY(usleep(100 * 1000));
248
249 // Ensure that running a new command properly restarts the processes.
250 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", nullptr));
251 EXPECT_NE(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
252 EXPECT_NE(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
253
254 // Check there are no zombies.
255 expectNoIptablesRestoreProcess(pid4);
256 expectNoIptablesRestoreProcess(pid6);
257 }
258
TEST_F(IptablesRestoreControllerTest,TestCommandTimeout)259 TEST_F(IptablesRestoreControllerTest, TestCommandTimeout) {
260 // Don't wait 10 seconds for this test to fail.
261 setRetryParameters(3, 100);
262
263 // Expected contents of the chain.
264 std::vector<std::string> expectedLines = {
265 StringPrintf("Chain %s (0 references)", mChainName.c_str()),
266 "target prot opt source destination ",
267 "RETURN all -- 0.0.0.0/0 0.0.0.0/0 ",
268 StringPrintf("Chain %s (0 references)", mChainName.c_str()),
269 "target prot opt source destination ",
270 "RETURN all -- ::/0 ::/0 ",
271 ""
272 };
273 std::string expected = Join(expectedLines, "\n");
274
275 std::vector<std::string> listCommands = {
276 "*filter",
277 StringPrintf("-n -L %s", mChainName.c_str()), // List chain.
278 "COMMIT",
279 ""
280 };
281 std::string commandString = Join(listCommands, "\n");
282 std::string output;
283
284 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, commandString, &output));
285 EXPECT_EQ(expected, output);
286
287 ASSERT_EQ(0, acquireIptablesLock());
288 EXPECT_EQ(-1, con.execute(IptablesTarget::V4V6, commandString, &output));
289 EXPECT_EQ(-1, con.execute(IptablesTarget::V4V6, commandString, &output));
290 releaseIptablesLock();
291
292 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, commandString, &output));
293 EXPECT_EQ(expected, output);
294 }
295
296
TEST_F(IptablesRestoreControllerTest,TestUidRuleBenchmark)297 TEST_F(IptablesRestoreControllerTest, TestUidRuleBenchmark) {
298 const std::vector<int> ITERATIONS = { 1, 5, 10 };
299
300 const std::string IPTABLES_RESTORE_ADD =
301 StringPrintf("*filter\n-I %s -m owner --uid-owner 2000000000 -j RETURN\nCOMMIT\n",
302 mChainName.c_str());
303 const std::string IPTABLES_RESTORE_DEL =
304 StringPrintf("*filter\n-D %s -m owner --uid-owner 2000000000 -j RETURN\nCOMMIT\n",
305 mChainName.c_str());
306
307 for (const int iterations : ITERATIONS) {
308 Stopwatch s;
309 for (int i = 0; i < iterations; i++) {
310 EXPECT_EQ(0, con.execute(V4V6, IPTABLES_RESTORE_ADD, nullptr));
311 EXPECT_EQ(0, con.execute(V4V6, IPTABLES_RESTORE_DEL, nullptr));
312 }
313 int64_t timeTaken = s.getTimeAndResetUs();
314 std::cerr << " Add/del " << iterations << " UID rules via restore: " << timeTaken
315 << "us (" << (timeTaken / 2 / iterations) << "us per operation)" << std::endl;
316 }
317 }
318
TEST_F(IptablesRestoreControllerTest,TestStartup)319 TEST_F(IptablesRestoreControllerTest, TestStartup) {
320 // Tests that IptablesRestoreController::Init never sets its processes to null pointers if
321 // fork() succeeds.
322 {
323 // Mock fork(), and check that initializing 100 times never results in a null pointer.
324 constexpr int NUM_ITERATIONS = 100; // Takes 100-150ms on angler.
325 constexpr pid_t FAKE_PID = 2000000001;
326 StrictMock<ScopedMockSyscalls> sys;
327
328 EXPECT_CALL(sys, fork()).Times(NUM_ITERATIONS * 2).WillRepeatedly(Return(FAKE_PID));
329 for (int i = 0; i < NUM_ITERATIONS; i++) {
330 Init();
331 EXPECT_NE(0, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
332 EXPECT_NE(0, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
333 }
334 }
335
336 // The controller is now in an invalid state: the pipes are connected to working iptables
337 // processes, but the PIDs are set to FAKE_PID. Send a malformed command to ensure that the
338 // processes terminate and close the pipes, then send a valid command to have the controller
339 // re-initialize properly now that fork() is no longer mocked.
340 EXPECT_EQ(-1, con.execute(V4V6, "malformed command\n", nullptr));
341 EXPECT_EQ(0, con.execute(V4V6, "#Test\n", nullptr));
342 }
343
344 // Out of SLO flakiness
TEST_F(IptablesRestoreControllerTest,DISABLED_TestMemoryLeak)345 TEST_F(IptablesRestoreControllerTest, DISABLED_TestMemoryLeak) {
346 std::string cmd = "*filter\n";
347
348 // Keep command within PIPE_BUF (4096) just to make sure. Each line is 60 bytes including \n:
349 // -I netd_unit_test_9999 -p udp -m udp --sport 12345 -j DROP
350 for (int i = 0; i < 33; i++) {
351 StringAppendF(&cmd, "-I %s -p udp -m udp --sport 12345 -j DROP\n", mChainName.c_str());
352 StringAppendF(&cmd, "-D %s -p udp -m udp --sport 12345 -j DROP\n", mChainName.c_str());
353 }
354 StringAppendF(&cmd, "COMMIT\n");
355 ASSERT_GE(4096U, cmd.size());
356
357 // Run the command once in case it causes the first allocations for these iptables-restore
358 // processes, and check they don't crash.
359 pid_t pid4 = getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS);
360 pid_t pid6 = getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS);
361 std::string output;
362 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, cmd, nullptr));
363 EXPECT_EQ(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
364 EXPECT_EQ(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
365
366 // Check how much RAM the processes are using.
367 int pages4 = getRssPages(pid4);
368 ASSERT_NE(0, pages4);
369 int pages6 = getRssPages(pid6);
370 ASSERT_NE(0, pages6);
371
372 // Run the command a few times and check that it doesn't crash.
373 for (int i = 0; i < 10; i++) {
374 EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, cmd, nullptr));
375 }
376 EXPECT_EQ(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
377 EXPECT_EQ(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
378
379 // Don't allow a leak of more than 38 pages (~150 kiB).
380 // This is more than enough for accuracy: the leak in b/162925719 fails with:
381 // Expected: (38U) >= (getRssPages(pid4) - pages4), actual: 38 vs 66
382 EXPECT_GE(38, getRssPages(pid4) - pages4) << "iptables-restore leaked too many pages";
383 EXPECT_GE(38, getRssPages(pid6) - pages6) << "ip6tables-restore leaked too many pages";
384 }
385