A Firewall Model For Testing User-Configurable Software Systems