patchpanel/mock_firewall.cc

// Copyright 2017 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "patchpanel/mock_firewall.h"

#include <algorithm>

namespace patchpanel {

int MockFirewall::SetRunInMinijailFailCriterion(
    const std::vector<std::string>& keywords, bool repeat, bool omit_failure) {
  match_criteria_.push_back(Criterion{keywords, repeat, omit_failure, 0});
  return match_criteria_.size() - 1;
}

int MockFirewall::GetRunInMinijailCriterionMatchCount(int id) {
  if (id < 0 || id >= static_cast<int>(match_criteria_.size()))
    return -1;
  return match_criteria_[id].match_count;
}

bool MockFirewall::MatchAndUpdate(const std::vector<std::string>& argv) {
  // Make a copy of the container so that we can delete elements while
  // iterating.
  auto criteria = match_criteria_;
  for (auto& criterion : criteria) {
    bool match = true;
    // Empty criterion is a catch all -- fail on any RunInMinijail.
    for (const std::string& keyword : criterion.keywords) {
      match =
          match && (std::find(argv.begin(), argv.end(), keyword) != argv.end());
    }
    if (match) {
      criterion.match_count++;
      if (!criterion.repeat) {
        match_criteria_.erase(std::remove(match_criteria_.begin(),
                                          match_criteria_.end(), criterion),
                              match_criteria_.end());
      }
      // If not negating, treat as fail criterion,
      // otherwise ignore (return false).
      return !criterion.omit_failure;
    }
  }
  return false;
}

std::vector<std::string> MockFirewall::GetAllCommands() {
  std::vector<std::string> commands;
  commands.reserve(commands_.size());
  for (const auto& argv : commands_) {
    std::string joined_argv = "";
    std::string separator = "";
    for (const auto& arg : argv) {
      joined_argv += separator + arg;
      separator = " ";
    }
    commands.push_back(joined_argv);
  }
  return commands;
}

int MockFirewall::RunInMinijail(const std::vector<std::string>& argv) {
  commands_.push_back(argv);
  return MatchAndUpdate(argv) ? 1 : 0;
}

// Returns the inverse of a given command. For an insert or append returns a
// command to delete that rule, for a deletion returns a command to insert it at
// the start. Assumes that the inverse of -D is always -I and that -I|--insert
// is used without index arguments. This holds as of 2019-11-20 but if you start
// using them you'll need to update this method.
std::vector<std::string> MockFirewall::GetInverseCommand(
    const std::vector<std::string>& argv) {
  std::vector<std::string> inverse;
  if (argv.size() == 0) {
    return inverse;
  }

  bool isIpTablesCommand = argv[0] == kIpTablesPath;
  for (const auto& arg : argv) {
    if (isIpTablesCommand && (arg == "-I" || arg == "-A" || arg == "--insert" ||
                              arg == "--append")) {
      inverse.push_back("-D");
    } else if (isIpTablesCommand && arg == "-D") {
      inverse.push_back("-I");
    } else {
      inverse.push_back(arg);
    }
  }
  return inverse;
}

// This check does not enforce ordering. It only checks
// that for each command that adds a rule/mark with
// ip/iptables, there is a later match command that
// deletes that same rule/mark.
bool MockFirewall::CheckCommandsUndone() {
  return CountActiveCommands() == 0;
}

// For each command, if it's an insert or an append it checks if there's a
// corresponding delete later on, then it returns a count of all rules without
// deletes. Will skip any rule that's not an append or insert e.g. delete
// without an insert first will return 0 not -1.
int MockFirewall::CountActiveCommands() {
  int count = 0;
  for (std::vector<std::vector<std::string>>::iterator it = commands_.begin();
       it != commands_.end(); it++) {
    // For each command that adds a rule, check that its inverse
    // exists later in the log of commands.
    if ((std::find(it->begin(), it->end(), "-A") != it->end()) ||
        (std::find(it->begin(), it->end(), "--append") != it->end()) ||
        (std::find(it->begin(), it->end(), "-I") != it->end()) ||
        (std::find(it->begin(), it->end(), "--insert") != it->end())) {
      bool found = false;
      std::vector<std::string> inverse = GetInverseCommand(*it);
      // If GetInverseCommand returns the same command, then it was
      // not an ip/iptables command that added/removed a rule/mark.
      if (std::equal(it->begin(), it->end(), inverse.begin()))
        continue;
      for (auto it_next = it + 1; it_next != commands_.end(); it_next++) {
        if (*it_next == inverse) {
          found = true;
          break;
        }
      }
      if (!found)
        count++;
    }
  }
  return count;
}

void MockFirewall::ResetStoredCommands() {
  commands_.clear();
}

}  // namespace patchpanel