From ca314e7f77f5a8a27d076677669781704393d8c1 Mon Sep 17 00:00:00 2001 From: Motomu Utsumi Date: Tue, 24 May 2022 02:26:29 +0000 Subject: [PATCH] Skip VPN filtering tests on unsupported versions Lockdown filtering rule and interface filtering rule with null interface were introduced to T+ devices. So, skip related tests in pre-T devices. Bug: 232902954 Test: atest ConnectivityServiceTest Change-Id: I9ee76096c1bd04c9333bc561ffc8064a14780ce5 --- .../server/ConnectivityServiceTest.java | 86 +++++++++++-------- 1 file changed, 48 insertions(+), 38 deletions(-) diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java index 52cebeccda..78cf7fdae3 100644 --- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java +++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java @@ -9505,7 +9505,7 @@ public class ConnectivityServiceTest { b2.expectBroadcast(); } - @Test + @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) public void testLockdownSetFirewallUidRule() throws Exception { // For ConnectivityService#setAlwaysOnVpnPackage. mServiceContext.setPermission( @@ -10428,7 +10428,7 @@ public class ConnectivityServiceTest { } @Test - public void testLegacyVpnSetInterfaceFilteringRuleWithWildcard() throws Exception { + public void testLegacyVpnInterfaceFilteringRule() throws Exception { LinkProperties lp = new LinkProperties(); lp.setInterfaceName("tun0"); lp.addRoute(new RouteInfo(new IpPrefix(Inet6Address.ANY, 0), null)); @@ -10438,29 +10438,34 @@ public class ConnectivityServiceTest { mMockVpn.establish(lp, Process.SYSTEM_UID, vpnRange); assertVpnUidRangesUpdated(true, vpnRange, Process.SYSTEM_UID); - // A connected Legacy VPN should have interface rules with null interface. - // Null Interface is a wildcard and this accepts traffic from all the interfaces. - // There are two expected invocations, one during the VPN initial connection, - // one during the VPN LinkProperties update. - ArgumentCaptor uidCaptor = ArgumentCaptor.forClass(int[].class); - verify(mBpfNetMaps, times(2)).addUidInterfaceRules( - eq(null) /* iface */, uidCaptor.capture()); - assertContainsExactly(uidCaptor.getAllValues().get(0), APP1_UID, APP2_UID, VPN_UID); - assertContainsExactly(uidCaptor.getAllValues().get(1), APP1_UID, APP2_UID, VPN_UID); - assertEquals(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */), - vpnRange); + if (SdkLevel.isAtLeastT()) { + // On T and above, A connected Legacy VPN should have interface rules with null + // interface. Null Interface is a wildcard and this accepts traffic from all the + // interfaces. There are two expected invocations, one during the VPN initial + // connection, one during the VPN LinkProperties update. + ArgumentCaptor uidCaptor = ArgumentCaptor.forClass(int[].class); + verify(mBpfNetMaps, times(2)).addUidInterfaceRules( + eq(null) /* iface */, uidCaptor.capture()); + assertContainsExactly(uidCaptor.getAllValues().get(0), APP1_UID, APP2_UID, VPN_UID); + assertContainsExactly(uidCaptor.getAllValues().get(1), APP1_UID, APP2_UID, VPN_UID); + assertEquals(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */), + vpnRange); - mMockVpn.disconnect(); - waitForIdle(); + mMockVpn.disconnect(); + waitForIdle(); - // Disconnected VPN should have interface rules removed - verify(mBpfNetMaps).removeUidInterfaceRules(uidCaptor.capture()); - assertContainsExactly(uidCaptor.getValue(), APP1_UID, APP2_UID, VPN_UID); - assertNull(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */)); + // Disconnected VPN should have interface rules removed + verify(mBpfNetMaps).removeUidInterfaceRules(uidCaptor.capture()); + assertContainsExactly(uidCaptor.getValue(), APP1_UID, APP2_UID, VPN_UID); + assertNull(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */)); + } else { + // Before T, Legacy VPN should not have interface rules. + verify(mBpfNetMaps, never()).addUidInterfaceRules(any(), any()); + } } @Test - public void testLocalIpv4OnlyVpnSetInterfaceFilteringRuleWithWildcard() throws Exception { + public void testLocalIpv4OnlyVpnInterfaceFilteringRule() throws Exception { LinkProperties lp = new LinkProperties(); lp.setInterfaceName("tun0"); lp.addRoute(new RouteInfo(new IpPrefix("192.0.2.0/24"), null, "tun0")); @@ -10470,26 +10475,31 @@ public class ConnectivityServiceTest { mMockVpn.establish(lp, Process.SYSTEM_UID, vpnRange); assertVpnUidRangesUpdated(true, vpnRange, Process.SYSTEM_UID); - // IPv6 unreachable route should not be misinterpreted as a default route - // A connected VPN should have interface rules with null interface. - // Null Interface is a wildcard and this accepts traffic from all the interfaces. - // There are two expected invocations, one during the VPN initial connection, - // one during the VPN LinkProperties update. - ArgumentCaptor uidCaptor = ArgumentCaptor.forClass(int[].class); - verify(mBpfNetMaps, times(2)).addUidInterfaceRules( - eq(null) /* iface */, uidCaptor.capture()); - assertContainsExactly(uidCaptor.getAllValues().get(0), APP1_UID, APP2_UID, VPN_UID); - assertContainsExactly(uidCaptor.getAllValues().get(1), APP1_UID, APP2_UID, VPN_UID); - assertEquals(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */), - vpnRange); + if (SdkLevel.isAtLeastT()) { + // IPv6 unreachable route should not be misinterpreted as a default route + // On T and above, A connected VPN that does not provide a default route should have + // interface rules with null interface. Null Interface is a wildcard and this accepts + // traffic from all the interfaces. There are two expected invocations, one during the + // VPN initial connection, one during the VPN LinkProperties update. + ArgumentCaptor uidCaptor = ArgumentCaptor.forClass(int[].class); + verify(mBpfNetMaps, times(2)).addUidInterfaceRules( + eq(null) /* iface */, uidCaptor.capture()); + assertContainsExactly(uidCaptor.getAllValues().get(0), APP1_UID, APP2_UID, VPN_UID); + assertContainsExactly(uidCaptor.getAllValues().get(1), APP1_UID, APP2_UID, VPN_UID); + assertEquals(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */), + vpnRange); - mMockVpn.disconnect(); - waitForIdle(); + mMockVpn.disconnect(); + waitForIdle(); - // Disconnected VPN should have interface rules removed - verify(mBpfNetMaps).removeUidInterfaceRules(uidCaptor.capture()); - assertContainsExactly(uidCaptor.getValue(), APP1_UID, APP2_UID, VPN_UID); - assertNull(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */)); + // Disconnected VPN should have interface rules removed + verify(mBpfNetMaps).removeUidInterfaceRules(uidCaptor.capture()); + assertContainsExactly(uidCaptor.getValue(), APP1_UID, APP2_UID, VPN_UID); + assertNull(mService.mPermissionMonitor.getVpnInterfaceUidRanges(null /* iface */)); + } else { + // Before T, VPN with IPv6 unreachable route should not have interface rules. + verify(mBpfNetMaps, never()).addUidInterfaceRules(any(), any()); + } } @Test