blob: 2ccf949a9ecf3d0da297ccf1ff1bb2f8cade7c70 [file] [log] [blame]
// Copyright 2019 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "patchpanel/datapath.h"
#include <linux/if_tun.h>
#include <net/if.h>
#include <sys/ioctl.h>
#include <utility>
#include <vector>
#include <base/bind.h>
#include <base/bind_helpers.h>
#include <base/strings/string_util.h>
#include <gmock/gmock.h>
#include <gtest/gtest.h>
#include "patchpanel/mock_firewall.h"
#include "patchpanel/net_util.h"
using testing::_;
using testing::ElementsAre;
using testing::Return;
using testing::StrEq;
namespace patchpanel {
namespace {
// TODO(hugobenichi) Centralize this constant definition
constexpr pid_t kTestPID = -2;
std::vector<ioctl_req_t> ioctl_reqs;
std::vector<std::pair<std::string, struct rtentry>> ioctl_rtentry_args;
// Capture all ioctls and succeed.
int ioctl_req_cap(int fd, ioctl_req_t req, ...) {
ioctl_reqs.push_back(req);
return 0;
}
// Capture ioctls for SIOCADDRT and SIOCDELRT and succeed.
int ioctl_rtentry_cap(int fd, ioctl_req_t req, struct rtentry* arg) {
ioctl_reqs.push_back(req);
ioctl_rtentry_args.push_back({"", *arg});
// Copy the string poited by rtentry.rt_dev because Add/DeleteIPv4Route pass
// this value to ioctl() on the stack.
if (arg->rt_dev) {
auto& cap = ioctl_rtentry_args.back();
cap.first = std::string(arg->rt_dev);
cap.second.rt_dev = (char*)cap.first.c_str();
}
return 0;
}
} // namespace
class MockProcessRunner : public MinijailedProcessRunner {
public:
MockProcessRunner() = default;
~MockProcessRunner() = default;
MOCK_METHOD1(WriteSentinelToContainer, int(pid_t pid));
MOCK_METHOD3(brctl,
int(const std::string& cmd,
const std::vector<std::string>& argv,
bool log_failures));
MOCK_METHOD4(chown,
int(const std::string& uid,
const std::string& gid,
const std::string& file,
bool log_failures));
MOCK_METHOD4(ip,
int(const std::string& obj,
const std::string& cmd,
const std::vector<std::string>& args,
bool log_failures));
MOCK_METHOD4(ip6,
int(const std::string& obj,
const std::string& cmd,
const std::vector<std::string>& args,
bool log_failures));
MOCK_METHOD4(iptables,
int(const std::string& table,
const std::vector<std::string>& argv,
bool log_failures,
std::string* output));
MOCK_METHOD4(ip6tables,
int(const std::string& table,
const std::vector<std::string>& argv,
bool log_failures,
std::string* output));
MOCK_METHOD2(modprobe_all,
int(const std::vector<std::string>& modules, bool log_failures));
MOCK_METHOD3(sysctl_w,
int(const std::string& key,
const std::string& value,
bool log_failures));
MOCK_METHOD3(ip_netns_attach,
int(const std::string& netns_name,
pid_t netns_pid,
bool log_failures));
MOCK_METHOD2(ip_netns_delete,
int(const std::string& netns_name, bool log_failures));
};
TEST(DatapathTest, IpFamily) {
EXPECT_EQ(IpFamily::Dual, IpFamily::IPv4 | IpFamily::IPv6);
EXPECT_EQ(IpFamily::Dual & IpFamily::IPv4, IpFamily::IPv4);
EXPECT_EQ(IpFamily::Dual & IpFamily::IPv6, IpFamily::IPv6);
EXPECT_NE(IpFamily::Dual, IpFamily::IPv4);
EXPECT_NE(IpFamily::Dual, IpFamily::IPv6);
EXPECT_NE(IpFamily::IPv4, IpFamily::IPv6);
}
TEST(DatapathTest, AddTAP) {
MockProcessRunner runner;
MockFirewall firewall;
Datapath datapath(&runner, &firewall, ioctl_req_cap);
MacAddress mac = {1, 2, 3, 4, 5, 6};
Subnet subnet(Ipv4Addr(100, 115, 92, 4), 30, base::DoNothing());
auto addr = subnet.AllocateAtOffset(0);
auto ifname = datapath.AddTAP("foo0", &mac, addr.get(), "");
EXPECT_EQ(ifname, "foo0");
std::vector<ioctl_req_t> expected = {
TUNSETIFF, TUNSETPERSIST, SIOCSIFADDR, SIOCSIFNETMASK,
SIOCSIFHWADDR, SIOCGIFFLAGS, SIOCSIFFLAGS};
EXPECT_EQ(ioctl_reqs, expected);
ioctl_reqs.clear();
}
TEST(DatapathTest, AddTAPWithOwner) {
MockProcessRunner runner;
MockFirewall firewall;
Datapath datapath(&runner, &firewall, ioctl_req_cap);
MacAddress mac = {1, 2, 3, 4, 5, 6};
Subnet subnet(Ipv4Addr(100, 115, 92, 4), 30, base::DoNothing());
auto addr = subnet.AllocateAtOffset(0);
auto ifname = datapath.AddTAP("foo0", &mac, addr.get(), "root");
EXPECT_EQ(ifname, "foo0");
std::vector<ioctl_req_t> expected = {
TUNSETIFF, TUNSETPERSIST, TUNSETOWNER, SIOCSIFADDR,
SIOCSIFNETMASK, SIOCSIFHWADDR, SIOCGIFFLAGS, SIOCSIFFLAGS};
EXPECT_EQ(ioctl_reqs, expected);
ioctl_reqs.clear();
}
TEST(DatapathTest, AddTAPNoAddrs) {
MockProcessRunner runner;
MockFirewall firewall;
Datapath datapath(&runner, &firewall, ioctl_req_cap);
auto ifname = datapath.AddTAP("foo0", nullptr, nullptr, "");
EXPECT_EQ(ifname, "foo0");
std::vector<ioctl_req_t> expected = {TUNSETIFF, TUNSETPERSIST, SIOCGIFFLAGS,
SIOCSIFFLAGS};
EXPECT_EQ(ioctl_reqs, expected);
ioctl_reqs.clear();
}
TEST(DatapathTest, RemoveTAP) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, ip(StrEq("tuntap"), StrEq("del"),
ElementsAre("foo0", "mode", "tap"), true));
Datapath datapath(&runner, &firewall);
datapath.RemoveTAP("foo0");
}
TEST(DatapathTest, NetnsAttachName) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, ip_netns_delete(StrEq("netns_foo"), false));
EXPECT_CALL(runner, ip_netns_attach(StrEq("netns_foo"), 1234, true));
Datapath datapath(&runner, &firewall);
EXPECT_TRUE(datapath.NetnsAttachName("netns_foo", 1234));
}
TEST(DatapathTest, NetnsDeleteName) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, ip_netns_delete(StrEq("netns_foo"), true));
Datapath datapath(&runner, &firewall);
EXPECT_TRUE(datapath.NetnsDeleteName("netns_foo"));
}
TEST(DatapathTest, AddBridge) {
MockProcessRunner runner;
MockFirewall firewall;
Datapath datapath(&runner, &firewall);
EXPECT_CALL(runner, brctl(StrEq("addbr"), ElementsAre("br"), true));
EXPECT_CALL(
runner,
ip(StrEq("addr"), StrEq("add"),
ElementsAre("1.1.1.1/30", "brd", "1.1.1.3", "dev", "br"), true));
EXPECT_CALL(runner,
ip(StrEq("link"), StrEq("set"), ElementsAre("br", "up"), true));
EXPECT_CALL(runner, iptables(StrEq("mangle"),
ElementsAre("-A", "PREROUTING", "-i", "br", "-j",
"MARK", "--set-mark", "1/1", "-w"),
true, nullptr));
datapath.AddBridge("br", Ipv4Addr(1, 1, 1, 1), 30);
}
TEST(DatapathTest, ConnectVethPair) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, ip(StrEq("link"), StrEq("add"),
ElementsAre("veth_foo", "type", "veth", "peer", "name",
"peer_foo", "netns", "netns_foo"),
true));
EXPECT_CALL(runner, ip(StrEq("addr"), StrEq("add"),
ElementsAre("100.115.92.169/30", "brd",
"100.115.92.171", "dev", "peer_foo"),
true))
.WillOnce(Return(0));
EXPECT_CALL(runner, ip(StrEq("link"), StrEq("set"),
ElementsAre("dev", "peer_foo", "up", "addr",
"01:02:03:04:05:06", "multicast", "on"),
true))
.WillOnce(Return(0));
EXPECT_CALL(runner, ip(StrEq("link"), StrEq("set"),
ElementsAre("veth_foo", "up"), true));
Datapath datapath(&runner, &firewall);
EXPECT_TRUE(datapath.ConnectVethPair(kTestPID, "netns_foo", "veth_foo",
"peer_foo", {1, 2, 3, 4, 5, 6},
Ipv4Addr(100, 115, 92, 169), 30, true));
}
TEST(DatapathTest, AddVirtualInterfacePair) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, ip(StrEq("link"), StrEq("add"),
ElementsAre("veth_foo", "type", "veth", "peer", "name",
"peer_foo", "netns", "netns_foo"),
true));
Datapath datapath(&runner, &firewall);
EXPECT_TRUE(
datapath.AddVirtualInterfacePair("netns_foo", "veth_foo", "peer_foo"));
}
TEST(DatapathTest, ToggleInterface) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner,
ip(StrEq("link"), StrEq("set"), ElementsAre("foo", "up"), true));
EXPECT_CALL(runner, ip(StrEq("link"), StrEq("set"),
ElementsAre("bar", "down"), true));
Datapath datapath(&runner, &firewall);
EXPECT_TRUE(datapath.ToggleInterface("foo", true));
EXPECT_TRUE(datapath.ToggleInterface("bar", false));
}
TEST(DatapathTest, ConfigureInterface) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(
runner,
ip(StrEq("addr"), StrEq("add"),
ElementsAre("1.1.1.1/30", "brd", "1.1.1.3", "dev", "foo"), true))
.WillOnce(Return(0));
EXPECT_CALL(runner, ip(StrEq("link"), StrEq("set"),
ElementsAre("dev", "foo", "up", "addr",
"02:02:02:02:02:02", "multicast", "on"),
true))
.WillOnce(Return(0));
Datapath datapath(&runner, &firewall);
MacAddress mac_addr = {2, 2, 2, 2, 2, 2};
EXPECT_TRUE(datapath.ConfigureInterface("foo", mac_addr, Ipv4Addr(1, 1, 1, 1),
30, true, true));
}
TEST(DatapathTest, RemoveInterface) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner,
ip(StrEq("link"), StrEq("delete"), ElementsAre("foo"), false));
Datapath datapath(&runner, &firewall);
datapath.RemoveInterface("foo");
}
TEST(DatapathTest, RemoveBridge) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("mangle"),
ElementsAre("-D", "PREROUTING", "-i", "br", "-j",
"MARK", "--set-mark", "1/1", "-w"),
true, nullptr));
EXPECT_CALL(runner,
ip(StrEq("link"), StrEq("set"), ElementsAre("br", "down"), true));
EXPECT_CALL(runner, brctl(StrEq("delbr"), ElementsAre("br"), true));
Datapath datapath(&runner, &firewall);
datapath.RemoveBridge("br");
}
TEST(DatapathTest, AddRemoveSourceIPv4DropRule) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner,
iptables(StrEq("filter"),
ElementsAre("-I", "OUTPUT", "-o", "eth+", "-s",
"100.115.92.0/24", "-j", "DROP", "-w"),
true, nullptr));
EXPECT_CALL(runner,
iptables(StrEq("filter"),
ElementsAre("-D", "OUTPUT", "-o", "eth+", "-s",
"100.115.92.0/24", "-j", "DROP", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddSourceIPv4DropRule("eth+", "100.115.92.0/24");
datapath.RemoveSourceIPv4DropRule("eth+", "100.115.92.0/24");
}
TEST(DatapathTest, StartRoutingDevice_Arc) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-A", "PREROUTING", "-i", "eth0",
"-m", "socket", "--nowildcard", "-j",
"ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-A", "PREROUTING", "-i", "eth0",
"-p", "tcp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-A", "PREROUTING", "-i", "eth0",
"-p", "udp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-i", "eth0", "-o",
"arc_eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-i", "arc_eth0",
"-o", "eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("mangle"),
ElementsAre("-A", "PREROUTING", "-i", "arc_eth0",
"-j", "MARK", "--set-mark",
"0x00002000/0x00003f00", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.StartRoutingDevice("eth0", "arc_eth0", Ipv4Addr(1, 2, 3, 4),
TrafficSource::ARC);
}
TEST(DatapathTest, StartRoutingDevice_CrosVM) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-o", "vmtap0",
"-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-i", "vmtap0",
"-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("mangle"),
ElementsAre("-A", "PREROUTING", "-i", "vmtap0",
"-j", "MARK", "--set-mark",
"0x00002100/0x00003f00", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.StartRoutingDevice("", "vmtap0", Ipv4Addr(1, 2, 3, 4),
TrafficSource::CROSVM);
}
TEST(DatapathTest, StopRoutingDevice_Arc) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-D", "PREROUTING", "-i", "eth0",
"-m", "socket", "--nowildcard", "-j",
"ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-D", "PREROUTING", "-i", "eth0",
"-p", "tcp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-D", "PREROUTING", "-i", "eth0",
"-p", "udp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-i", "eth0", "-o",
"arc_eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-i", "arc_eth0",
"-o", "eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("mangle"),
ElementsAre("-D", "PREROUTING", "-i", "arc_eth0",
"-j", "MARK", "--set-mark",
"0x00002000/0x00003f00", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.StopRoutingDevice("eth0", "arc_eth0", Ipv4Addr(1, 2, 3, 4),
TrafficSource::ARC);
}
TEST(DatapathTest, StopRoutingDevice_CrosVM) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-o", "vmtap0",
"-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-i", "vmtap0",
"-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("mangle"),
ElementsAre("-D", "PREROUTING", "-i", "vmtap0",
"-j", "MARK", "--set-mark",
"0x00002100/0x00003f00", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.StopRoutingDevice("", "vmtap0", Ipv4Addr(1, 2, 3, 4),
TrafficSource::CROSVM);
}
TEST(DatapathTest, StartStopIpForwarding) {
struct {
IpFamily family;
std::string iif;
std::string oif;
std::vector<std::string> start_args;
std::vector<std::string> stop_args;
bool result;
} testcases[] = {
{IpFamily::IPv4, "", "", {}, {}, false},
{IpFamily::NONE, "foo", "bar", {}, {}, false},
{IpFamily::IPv4,
"foo",
"bar",
{"-A", "FORWARD", "-i", "foo", "-o", "bar", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-i", "foo", "-o", "bar", "-j", "ACCEPT", "-w"},
true},
{IpFamily::IPv4,
"",
"bar",
{"-A", "FORWARD", "-o", "bar", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-o", "bar", "-j", "ACCEPT", "-w"},
true},
{IpFamily::IPv4,
"foo",
"",
{"-A", "FORWARD", "-i", "foo", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-i", "foo", "-j", "ACCEPT", "-w"},
true},
{IpFamily::IPv6,
"foo",
"bar",
{"-A", "FORWARD", "-i", "foo", "-o", "bar", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-i", "foo", "-o", "bar", "-j", "ACCEPT", "-w"},
true},
{IpFamily::IPv6,
"",
"bar",
{"-A", "FORWARD", "-o", "bar", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-o", "bar", "-j", "ACCEPT", "-w"},
true},
{IpFamily::IPv6,
"foo",
"",
{"-A", "FORWARD", "-i", "foo", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-i", "foo", "-j", "ACCEPT", "-w"},
true},
{IpFamily::Dual,
"foo",
"bar",
{"-A", "FORWARD", "-i", "foo", "-o", "bar", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-i", "foo", "-o", "bar", "-j", "ACCEPT", "-w"},
true},
{IpFamily::Dual,
"",
"bar",
{"-A", "FORWARD", "-o", "bar", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-o", "bar", "-j", "ACCEPT", "-w"},
true},
{IpFamily::Dual,
"foo",
"",
{"-A", "FORWARD", "-i", "foo", "-j", "ACCEPT", "-w"},
{"-D", "FORWARD", "-i", "foo", "-j", "ACCEPT", "-w"},
true},
};
for (const auto& tt : testcases) {
MockProcessRunner runner;
MockFirewall firewall;
if (tt.result) {
if (tt.family & IpFamily::IPv4) {
EXPECT_CALL(runner,
iptables(StrEq("filter"), tt.start_args, true, nullptr))
.WillOnce(Return(0));
EXPECT_CALL(runner,
iptables(StrEq("filter"), tt.stop_args, true, nullptr))
.WillOnce(Return(0));
}
if (tt.family & IpFamily::IPv6) {
EXPECT_CALL(runner,
ip6tables(StrEq("filter"), tt.start_args, true, nullptr))
.WillOnce(Return(0));
EXPECT_CALL(runner,
ip6tables(StrEq("filter"), tt.stop_args, true, nullptr))
.WillOnce(Return(0));
}
}
Datapath datapath(&runner, &firewall);
EXPECT_EQ(tt.result, datapath.StartIpForwarding(tt.family, tt.iif, tt.oif));
EXPECT_EQ(tt.result, datapath.StopIpForwarding(tt.family, tt.iif, tt.oif));
}
}
TEST(DatapathTest, AddInboundIPv4DNAT) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-A", "PREROUTING", "-i", "eth0",
"-m", "socket", "--nowildcard", "-j",
"ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-A", "PREROUTING", "-i", "eth0",
"-p", "tcp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-A", "PREROUTING", "-i", "eth0",
"-p", "udp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddInboundIPv4DNAT("eth0", "1.2.3.4");
}
TEST(DatapathTest, RemoveInboundIPv4DNAT) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-D", "PREROUTING", "-i", "eth0",
"-m", "socket", "--nowildcard", "-j",
"ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-D", "PREROUTING", "-i", "eth0",
"-p", "tcp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-D", "PREROUTING", "-i", "eth0",
"-p", "udp", "-j", "DNAT",
"--to-destination", "1.2.3.4", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.RemoveInboundIPv4DNAT("eth0", "1.2.3.4");
}
TEST(DatapathTest, AddOutboundIPv4) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-o", "eth0", "-j",
"ACCEPT", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddOutboundIPv4("eth0");
}
TEST(DatapathTest, RemoveInboundIPv4) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-o", "eth0", "-j",
"ACCEPT", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.RemoveOutboundIPv4("eth0");
}
TEST(DatapathTest, MaskInterfaceFlags) {
MockProcessRunner runner;
MockFirewall firewall;
Datapath datapath(&runner, &firewall, ioctl_req_cap);
bool result = datapath.MaskInterfaceFlags("foo0", IFF_DEBUG);
EXPECT_TRUE(result);
std::vector<ioctl_req_t> expected = {SIOCGIFFLAGS, SIOCSIFFLAGS};
EXPECT_EQ(ioctl_reqs, expected);
ioctl_reqs.clear();
}
TEST(DatapathTest, AddIPv6Forwarding) {
MockProcessRunner runner;
MockFirewall firewall;
// Return 1 on iptables -C to simulate rule not existing case
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-C", "FORWARD", "-i", "eth0", "-o",
"arc_eth0", "-j", "ACCEPT", "-w"),
false, nullptr))
.WillOnce(Return(1));
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-i", "eth0", "-o",
"arc_eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-C", "FORWARD", "-i", "arc_eth0",
"-o", "eth0", "-j", "ACCEPT", "-w"),
false, nullptr))
.WillOnce(Return(1));
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-i", "arc_eth0",
"-o", "eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddIPv6Forwarding("eth0", "arc_eth0");
}
TEST(DatapathTest, AddIPv6ForwardingRuleExists) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-C", "FORWARD", "-i", "eth0", "-o",
"arc_eth0", "-j", "ACCEPT", "-w"),
false, nullptr));
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-C", "FORWARD", "-i", "arc_eth0",
"-o", "eth0", "-j", "ACCEPT", "-w"),
false, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddIPv6Forwarding("eth0", "arc_eth0");
}
TEST(DatapathTest, RemoveIPv6Forwarding) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-i", "eth0", "-o",
"arc_eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner, ip6tables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-i", "arc_eth0",
"-o", "eth0", "-j", "ACCEPT", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.RemoveIPv6Forwarding("eth0", "arc_eth0");
}
TEST(DatapathTest, AddIPv6HostRoute) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner,
ip6(StrEq("route"), StrEq("replace"),
ElementsAre("2001:da8:e00::1234/128", "dev", "eth0"), true));
Datapath datapath(&runner, &firewall);
datapath.AddIPv6HostRoute("eth0", "2001:da8:e00::1234", 128);
}
TEST(DatapathTest, AddIPv4Route) {
MockProcessRunner runner;
MockFirewall firewall;
Datapath datapath(&runner, &firewall, (ioctl_t)ioctl_rtentry_cap);
datapath.AddIPv4Route(Ipv4Addr(192, 168, 1, 1), Ipv4Addr(100, 115, 93, 0),
Ipv4Addr(255, 255, 255, 0));
datapath.DeleteIPv4Route(Ipv4Addr(192, 168, 1, 1), Ipv4Addr(100, 115, 93, 0),
Ipv4Addr(255, 255, 255, 0));
datapath.AddIPv4Route("eth0", Ipv4Addr(100, 115, 92, 8),
Ipv4Addr(255, 255, 255, 252));
datapath.DeleteIPv4Route("eth0", Ipv4Addr(100, 115, 92, 8),
Ipv4Addr(255, 255, 255, 252));
std::vector<ioctl_req_t> expected_reqs = {SIOCADDRT, SIOCDELRT, SIOCADDRT,
SIOCDELRT};
EXPECT_EQ(expected_reqs, ioctl_reqs);
ioctl_reqs.clear();
std::string route1 =
"{rt_dst: {family: AF_INET, port: 0, addr: 100.115.93.0}, rt_genmask: "
"{family: AF_INET, port: 0, addr: 255.255.255.0}, rt_gateway: {family: "
"AF_INET, port: 0, addr: 192.168.1.1}, rt_dev: null, rt_flags: RTF_UP | "
"RTF_GATEWAY}";
std::string route2 =
"{rt_dst: {family: AF_INET, port: 0, addr: 100.115.92.8}, rt_genmask: "
"{family: AF_INET, port: 0, addr: 255.255.255.252}, rt_gateway: {unset}, "
"rt_dev: eth0, rt_flags: RTF_UP | RTF_GATEWAY}";
std::vector<std::string> captured_routes;
for (const auto& route : ioctl_rtentry_args) {
std::ostringstream stream;
stream << route.second;
captured_routes.emplace_back(stream.str());
}
ioctl_rtentry_args.clear();
EXPECT_EQ(route1, captured_routes[0]);
EXPECT_EQ(route1, captured_routes[1]);
EXPECT_EQ(route2, captured_routes[2]);
EXPECT_EQ(route2, captured_routes[3]);
}
TEST(DatapathTest, AddSNATMarkRules) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(
runner,
iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-m", "mark", "--mark", "1/1", "-m",
"state", "--state", "INVALID", "-j", "DROP", "-w"),
true, nullptr));
EXPECT_CALL(runner,
iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-m", "mark", "--mark",
"1/1", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner,
iptables(StrEq("nat"),
ElementsAre("-A", "POSTROUTING", "-m", "mark", "--mark",
"1/1", "-j", "MASQUERADE", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddSNATMarkRules();
}
TEST(DatapathTest, RemoveSNATMarkRules) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(
runner,
iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-m", "mark", "--mark", "1/1", "-m",
"state", "--state", "INVALID", "-j", "DROP", "-w"),
true, nullptr));
EXPECT_CALL(runner,
iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-m", "mark", "--mark",
"1/1", "-j", "ACCEPT", "-w"),
true, nullptr));
EXPECT_CALL(runner,
iptables(StrEq("nat"),
ElementsAre("-D", "POSTROUTING", "-m", "mark", "--mark",
"1/1", "-j", "MASQUERADE", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.RemoveSNATMarkRules();
}
TEST(DatapathTest, AddForwardEstablishedRule) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner,
iptables(StrEq("filter"),
ElementsAre("-A", "FORWARD", "-m", "state", "--state",
"ESTABLISHED,RELATED", "-j", "ACCEPT", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddForwardEstablishedRule();
}
TEST(DatapathTest, RemoveForwardEstablishedRule) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner,
iptables(StrEq("filter"),
ElementsAre("-D", "FORWARD", "-m", "state", "--state",
"ESTABLISHED,RELATED", "-j", "ACCEPT", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.RemoveForwardEstablishedRule();
}
TEST(DatapathTest, AddInterfaceSNAT) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-A", "POSTROUTING", "-o", "wwan+",
"-j", "MASQUERADE", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.AddInterfaceSNAT("wwan+");
}
TEST(DatapathTest, RemoveInterfaceSNAT) {
MockProcessRunner runner;
MockFirewall firewall;
EXPECT_CALL(runner, iptables(StrEq("nat"),
ElementsAre("-D", "POSTROUTING", "-o", "wwan+",
"-j", "MASQUERADE", "-w"),
true, nullptr));
Datapath datapath(&runner, &firewall);
datapath.RemoveInterfaceSNAT("wwan+");
}
TEST(DatapathTest, ArcVethHostName) {
EXPECT_EQ("vetheth0", ArcVethHostName("eth0"));
EXPECT_EQ("vethrmnet0", ArcVethHostName("rmnet0"));
EXPECT_EQ("vethrmnet_data0", ArcVethHostName("rmnet_data0"));
EXPECT_EQ("vethifnamsiz_i0", ArcVethHostName("ifnamsiz_ifnam0"));
auto ifname = ArcVethHostName("exceeds_ifnamesiz_checkanyway");
EXPECT_EQ("vethexceeds_ify", ifname);
EXPECT_LT(ifname.length(), IFNAMSIZ);
}
TEST(DatapathTest, ArcBridgeName) {
EXPECT_EQ("arc_eth0", ArcBridgeName("eth0"));
EXPECT_EQ("arc_rmnet0", ArcBridgeName("rmnet0"));
EXPECT_EQ("arc_rmnet_data0", ArcBridgeName("rmnet_data0"));
EXPECT_EQ("arc_ifnamsiz_i0", ArcBridgeName("ifnamsiz_ifnam0"));
auto ifname = ArcBridgeName("exceeds_ifnamesiz_checkanyway");
EXPECT_EQ("arc_exceeds_ify", ifname);
EXPECT_LT(ifname.length(), IFNAMSIZ);
}
} // namespace patchpanel