1 /*
2  * Copyright 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <fcntl.h>
18 #include <gmock/gmock.h>
19 #include <gtest/gtest.h>
20 #include <sys/file.h>
21 #include <sys/socket.h>
22 #include <sys/un.h>
23 
24 #include <cinttypes>
25 #include <iostream>
26 #include <string>
27 
28 #define LOG_TAG "IptablesRestoreControllerTest"
29 #include <android-base/stringprintf.h>
30 #include <android-base/strings.h>
31 #include <log/log.h>
32 #include <netdutils/MockSyscalls.h>
33 #include <netdutils/Stopwatch.h>
34 
35 #include "IptablesRestoreController.h"
36 #include "NetdConstants.h"
37 #include "bpf/BpfUtils.h"
38 
39 #define XT_LOCK_NAME "/system/etc/xtables.lock"
40 #define XT_LOCK_ATTEMPTS 10
41 #define XT_LOCK_POLL_INTERVAL_MS 100
42 
43 #define PROC_STAT_MIN_ELEMENTS 52U
44 #define PROC_STAT_RSS_INDEX 23U
45 
46 #define IPTABLES_COMM "(iptables-restor)"
47 #define IP6TABLES_COMM "(ip6tables-resto)"
48 
49 using android::base::Join;
50 using android::base::StringAppendF;
51 using android::base::StringPrintf;
52 using android::netdutils::ScopedMockSyscalls;
53 using android::netdutils::Stopwatch;
54 using testing::Return;
55 using testing::StrictMock;
56 
57 class IptablesRestoreControllerTest : public ::testing::Test {
58 public:
59   IptablesRestoreController con;
60   int mDefaultMaxRetries = con.MAX_RETRIES;
61   int mDefaultPollTimeoutMs = con.POLL_TIMEOUT_MS;
62   int mIptablesLock = -1;
63   std::string mChainName;
64 
SetUpTestSuite()65   static void SetUpTestSuite() { blockSigpipe(); }
66 
SetUp()67   void SetUp() {
68     ASSERT_EQ(0, createTestChain());
69   }
70 
TearDown()71   void TearDown() {
72     con.MAX_RETRIES = mDefaultMaxRetries;
73     con.POLL_TIMEOUT_MS = mDefaultPollTimeoutMs;
74     deleteTestChain();
75   }
76 
Init()77   void Init() {
78     con.Init();
79   }
80 
getIpRestorePid(const IptablesRestoreController::IptablesProcessType type)81   pid_t getIpRestorePid(const IptablesRestoreController::IptablesProcessType type) {
82       return con.getIpRestorePid(type);
83   };
84 
getProcStatPath(pid_t pid)85   const std::string getProcStatPath(pid_t pid) { return StringPrintf("/proc/%d/stat", pid); }
86 
parseProcStat(int fd,const std::string & path)87   std::vector<std::string> parseProcStat(int fd, const std::string& path) {
88       std::vector<std::string> procStat;
89 
90       char statBuf[1024];
91       EXPECT_NE(-1, read(fd, statBuf, sizeof(statBuf)))
92               << "Could not read from " << path << ": " << strerror(errno);
93 
94       std::stringstream stream(statBuf);
95       std::string item;
96       while (std::getline(stream, item, ' ')) {
97           procStat.push_back(item);
98       }
99 
100       EXPECT_LE(PROC_STAT_MIN_ELEMENTS, procStat.size()) << "Too few elements in " << path;
101       return procStat;
102   }
103 
expectNoIptablesRestoreProcess(pid_t pid)104   void expectNoIptablesRestoreProcess(pid_t pid) {
105     // We can't readlink /proc/PID/exe, because zombie processes don't have it.
106     // Parse /proc/PID/stat instead.
107     std::string statPath = getProcStatPath(pid);
108     int fd = open(statPath.c_str(), O_RDONLY | O_CLOEXEC);
109     if (fd == -1) {
110       // ENOENT means the process is gone (expected).
111       ASSERT_EQ(errno, ENOENT)
112         << "Unexpected error opening " << statPath << ": " << strerror(errno);
113       return;
114     }
115 
116     // If the PID exists, it's possible (though very unlikely) that the PID was reused. Check the
117     // binary name as well, to ensure the test isn't flaky.
118     std::vector<std::string> procStat = parseProcStat(fd, statPath);
119     EXPECT_FALSE(procStat[1] == IPTABLES_COMM || procStat[1] == IP6TABLES_COMM)
120             << "Previous iptables-restore or ip6tables-restore pid " << pid
121             << " still alive: " << Join(procStat, " ");
122 
123     close(fd);
124   }
125 
getRssPages(pid_t pid)126   int getRssPages(pid_t pid) {
127       std::string statPath = getProcStatPath(pid);
128       int fd = open(statPath.c_str(), O_RDONLY | O_CLOEXEC);
129       EXPECT_NE(-1, fd) << "Unexpected error opening " << statPath << ": " << strerror(errno);
130       if (fd == -1) return 0;
131 
132       const auto& procStat = parseProcStat(fd, statPath);
133       close(fd);
134 
135       if (procStat.size() < PROC_STAT_MIN_ELEMENTS) return 0;
136       EXPECT_TRUE(procStat[1] == IPTABLES_COMM || procStat[1] == IP6TABLES_COMM)
137               << statPath << " is for unexpected process: " << procStat[1];
138 
139       return std::atoi(procStat[PROC_STAT_RSS_INDEX].c_str());
140   }
141 
createTestChain()142   int createTestChain() {
143     mChainName = StringPrintf("netd_unit_test_%u", arc4random_uniform(10000)).c_str();
144 
145     // Create a chain to list.
146     std::vector<std::string> createCommands = {
147         "*filter",
148         StringPrintf(":%s -", mChainName.c_str()),
149         StringPrintf("-A %s -j RETURN", mChainName.c_str()),
150         "COMMIT",
151         ""
152     };
153 
154     int ret = con.execute(V4V6, Join(createCommands, "\n"), nullptr);
155     if (ret) mChainName = "";
156     return ret;
157   }
158 
deleteTestChain()159   void deleteTestChain() {
160     std::vector<std::string> deleteCommands = {
161         "*filter",
162         StringPrintf(":%s -", mChainName.c_str()),  // Flush chain (otherwise we can't delete it).
163         StringPrintf("-X %s", mChainName.c_str()),  // Delete it.
164         "COMMIT",
165         ""
166     };
167     con.execute(V4V6, Join(deleteCommands, "\n"), nullptr);
168     mChainName = "";
169   }
170 
acquireIptablesLock()171   int acquireIptablesLock() {
172     mIptablesLock = open(XT_LOCK_NAME, O_CREAT | O_CLOEXEC, 0600);
173     if (mIptablesLock == -1) return mIptablesLock;
174     int attempts;
175     for (attempts = 0; attempts < XT_LOCK_ATTEMPTS; attempts++) {
176       if (flock(mIptablesLock, LOCK_EX | LOCK_NB) == 0) {
177         return 0;
178       }
179       usleep(XT_LOCK_POLL_INTERVAL_MS * 1000);
180     }
181     EXPECT_LT(attempts, XT_LOCK_ATTEMPTS) <<
182         "Could not acquire iptables lock after " << XT_LOCK_ATTEMPTS << " attempts " <<
183         XT_LOCK_POLL_INTERVAL_MS << "ms apart";
184     return -1;
185   }
186 
releaseIptablesLock()187   void releaseIptablesLock() {
188     if (mIptablesLock != -1) {
189       close(mIptablesLock);
190     }
191   }
192 
setRetryParameters(int maxRetries,int pollTimeoutMs)193   void setRetryParameters(int maxRetries, int pollTimeoutMs) {
194     con.MAX_RETRIES = maxRetries;
195     con.POLL_TIMEOUT_MS = pollTimeoutMs;
196   }
197 };
198 
TEST_F(IptablesRestoreControllerTest,TestBasicCommand)199 TEST_F(IptablesRestoreControllerTest, TestBasicCommand) {
200   std::string output;
201 
202   EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", nullptr));
203 
204   pid_t pid4 = getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS);
205   pid_t pid6 = getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS);
206 
207   EXPECT_EQ(0, con.execute(IptablesTarget::V6, "#Test\n", nullptr));
208   EXPECT_EQ(0, con.execute(IptablesTarget::V4, "#Test\n", nullptr));
209 
210   EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", &output));
211   EXPECT_EQ("#Test\n#Test\n", output);  // One for IPv4 and one for IPv6.
212 
213   // Check the PIDs are the same as they were before. If they're not, the child processes were
214   // restarted, which causes a 30-60ms delay.
215   EXPECT_EQ(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
216   EXPECT_EQ(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
217 }
218 
TEST_F(IptablesRestoreControllerTest,TestRestartOnMalformedCommand)219 TEST_F(IptablesRestoreControllerTest, TestRestartOnMalformedCommand) {
220   std::string buffer;
221   for (int i = 0; i < 50; i++) {
222       IptablesTarget target = (IptablesTarget) (i % 3);
223       std::string *output = (i % 2) ? &buffer : nullptr;
224       ASSERT_EQ(-1, con.execute(target, "malformed command\n", output)) <<
225           "Malformed command did not fail at iteration " << i;
226       ASSERT_EQ(0, con.execute(target, "#Test\n", output)) <<
227           "No-op command did not succeed at iteration " << i;
228   }
229 }
230 
TEST_F(IptablesRestoreControllerTest,TestRestartOnProcessDeath)231 TEST_F(IptablesRestoreControllerTest, TestRestartOnProcessDeath) {
232   std::string output;
233 
234   // Run a command to ensure that the processes are running.
235   EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", &output));
236 
237   pid_t pid4 = getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS);
238   pid_t pid6 = getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS);
239 
240   ASSERT_EQ(0, kill(pid4, 0)) << "iptables-restore pid " << pid4 << " does not exist";
241   ASSERT_EQ(0, kill(pid6, 0)) << "ip6tables-restore pid " << pid6 << " does not exist";
242   ASSERT_EQ(0, kill(pid4, SIGTERM)) << "Failed to send SIGTERM to iptables-restore pid " << pid4;
243   ASSERT_EQ(0, kill(pid6, SIGTERM)) << "Failed to send SIGTERM to ip6tables-restore pid " << pid6;
244 
245   // Wait 100ms for processes to terminate.
246   TEMP_FAILURE_RETRY(usleep(100 * 1000));
247 
248   // Ensure that running a new command properly restarts the processes.
249   EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, "#Test\n", nullptr));
250   EXPECT_NE(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
251   EXPECT_NE(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
252 
253   // Check there are no zombies.
254   expectNoIptablesRestoreProcess(pid4);
255   expectNoIptablesRestoreProcess(pid6);
256 }
257 
TEST_F(IptablesRestoreControllerTest,TestCommandTimeout)258 TEST_F(IptablesRestoreControllerTest, TestCommandTimeout) {
259   // Don't wait 10 seconds for this test to fail.
260   setRetryParameters(3, 100);
261 
262   // Expected contents of the chain.
263   std::vector<std::string> expectedLines = {
264       StringPrintf("Chain %s (0 references)", mChainName.c_str()),
265       "target     prot opt source               destination         ",
266       "RETURN     all  --  0.0.0.0/0            0.0.0.0/0           ",
267       StringPrintf("Chain %s (0 references)", mChainName.c_str()),
268       "target     prot opt source               destination         ",
269       "RETURN     all      ::/0                 ::/0                ",
270       ""
271   };
272   std::string expected = Join(expectedLines, "\n");
273 
274   std::vector<std::string> listCommands = {
275       "*filter",
276       StringPrintf("-n -L %s", mChainName.c_str()),  // List chain.
277       "COMMIT",
278       ""
279   };
280   std::string commandString = Join(listCommands, "\n");
281   std::string output;
282 
283   EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, commandString, &output));
284   EXPECT_EQ(expected, output);
285 
286   ASSERT_EQ(0, acquireIptablesLock());
287   EXPECT_EQ(-1, con.execute(IptablesTarget::V4V6, commandString, &output));
288   EXPECT_EQ(-1, con.execute(IptablesTarget::V4V6, commandString, &output));
289   releaseIptablesLock();
290 
291   EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, commandString, &output));
292   EXPECT_EQ(expected, output);
293 }
294 
295 
TEST_F(IptablesRestoreControllerTest,TestUidRuleBenchmark)296 TEST_F(IptablesRestoreControllerTest, TestUidRuleBenchmark) {
297     const std::vector<int> ITERATIONS = { 1, 5, 10 };
298 
299     const std::string IPTABLES_RESTORE_ADD =
300             StringPrintf("*filter\n-I %s -m owner --uid-owner 2000000000 -j RETURN\nCOMMIT\n",
301                          mChainName.c_str());
302     const std::string IPTABLES_RESTORE_DEL =
303             StringPrintf("*filter\n-D %s -m owner --uid-owner 2000000000 -j RETURN\nCOMMIT\n",
304                          mChainName.c_str());
305 
306     for (const int iterations : ITERATIONS) {
307         Stopwatch s;
308         for (int i = 0; i < iterations; i++) {
309             EXPECT_EQ(0, con.execute(V4V6, IPTABLES_RESTORE_ADD, nullptr));
310             EXPECT_EQ(0, con.execute(V4V6, IPTABLES_RESTORE_DEL, nullptr));
311         }
312         int64_t timeTaken = s.getTimeAndResetUs();
313         std::cerr << "    Add/del " << iterations << " UID rules via restore: " << timeTaken
314                   << "us (" << (timeTaken / 2 / iterations) << "us per operation)" << std::endl;
315     }
316 }
317 
TEST_F(IptablesRestoreControllerTest,TestStartup)318 TEST_F(IptablesRestoreControllerTest, TestStartup) {
319   // Tests that IptablesRestoreController::Init never sets its processes to null pointers if
320   // fork() succeeds.
321   {
322     // Mock fork(), and check that initializing 100 times never results in a null pointer.
323     constexpr int NUM_ITERATIONS = 100;  // Takes 100-150ms on angler.
324     constexpr pid_t FAKE_PID = 2000000001;
325     StrictMock<ScopedMockSyscalls> sys;
326 
327     EXPECT_CALL(sys, fork()).Times(NUM_ITERATIONS * 2).WillRepeatedly(Return(FAKE_PID));
328     for (int i = 0; i < NUM_ITERATIONS; i++) {
329       Init();
330       EXPECT_NE(0, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
331       EXPECT_NE(0, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
332     }
333   }
334 
335   // The controller is now in an invalid state: the pipes are connected to working iptables
336   // processes, but the PIDs are set to FAKE_PID. Send a malformed command to ensure that the
337   // processes terminate and close the pipes, then send a valid command to have the controller
338   // re-initialize properly now that fork() is no longer mocked.
339   EXPECT_EQ(-1, con.execute(V4V6, "malformed command\n", nullptr));
340   EXPECT_EQ(0, con.execute(V4V6, "#Test\n", nullptr));
341 }
342 
TEST_F(IptablesRestoreControllerTest,TestMemoryLeak)343 TEST_F(IptablesRestoreControllerTest, TestMemoryLeak) {
344     std::string cmd = "*filter\n";
345 
346     // Keep command within PIPE_BUF (4096) just to make sure. Each line is 60 bytes including \n:
347     // -I netd_unit_test_9999 -p udp -m udp --sport 12345 -j DROP
348     for (int i = 0; i < 33; i++) {
349         StringAppendF(&cmd, "-I %s -p udp -m udp --sport 12345 -j DROP\n", mChainName.c_str());
350         StringAppendF(&cmd, "-D %s -p udp -m udp --sport 12345 -j DROP\n", mChainName.c_str());
351     }
352     StringAppendF(&cmd, "COMMIT\n");
353     ASSERT_GE(4096U, cmd.size());
354 
355     // Run the command once in case it causes the first allocations for these iptables-restore
356     // processes, and check they don't crash.
357     pid_t pid4 = getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS);
358     pid_t pid6 = getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS);
359     std::string output;
360     EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, cmd, nullptr));
361     EXPECT_EQ(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
362     EXPECT_EQ(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
363 
364     // Check how much RAM the processes are using.
365     int pages4 = getRssPages(pid4);
366     ASSERT_NE(0, pages4);
367     int pages6 = getRssPages(pid6);
368     ASSERT_NE(0, pages6);
369 
370     // Run the command a few times and check that it doesn't crash.
371     for (int i = 0; i < 10; i++) {
372         EXPECT_EQ(0, con.execute(IptablesTarget::V4V6, cmd, nullptr));
373     }
374     EXPECT_EQ(pid4, getIpRestorePid(IptablesRestoreController::IPTABLES_PROCESS));
375     EXPECT_EQ(pid6, getIpRestorePid(IptablesRestoreController::IP6TABLES_PROCESS));
376 
377     // Don't allow a leak of more than 25 pages (100kB).
378     // This is more than enough for accuracy: the leak in b/162925719 fails with:
379     // Expected: (25U) >= (getRssPages(pid4) - pages4), actual: 5 vs 66
380     EXPECT_GE(25, getRssPages(pid4) - pages4) << "iptables-restore leaked too many pages";
381     EXPECT_GE(25, getRssPages(pid6) - pages6) << "ip6tables-restore leaked too many pages";
382 }
383