Home | History | Annotate | Download | only in server 
      1 /*
      2  * Copyright (C) 2012 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #include <ctype.h>
     18 #include <errno.h>
     19 #include <fcntl.h>
     20 #include <netdb.h>
     21 #include <net/if.h>
     22 #include <netinet/in.h>
     23 #include <stdlib.h>
     24 #include <string.h>
     25 #include <sys/wait.h>
     26 
     27 #define LOG_TAG "Netd"
     28 
     29 #include <cutils/log.h>
     30 #include <logwrap/logwrap.h>
     31 
     32 #include "NetdConstants.h"
     33 
     34 const char * const OEM_SCRIPT_PATH = "/system/bin/oem-iptables-init.sh";
     35 const char * const IPTABLES_PATH = "/system/bin/iptables";
     36 const char * const IP6TABLES_PATH = "/system/bin/ip6tables";
     37 const char * const IPTABLES_RESTORE_PATH = "/system/bin/iptables-restore";
     38 const char * const IP6TABLES_RESTORE_PATH = "/system/bin/ip6tables-restore";
     39 const char * const TC_PATH = "/system/bin/tc";
     40 const char * const IP_PATH = "/system/bin/ip";
     41 const char * const ADD = "add";
     42 const char * const DEL = "del";
     43 
     44 static void logExecError(const char* argv[], int res, int status) {
     45     const char** argp = argv;
     46     std::string args = "";
     47     while (*argp) {
     48         args += *argp;
     49         args += ' ';
     50         argp++;
     51     }
     52     ALOGE("exec() res=%d, status=%d for %s", res, status, args.c_str());
     53 }
     54 
     55 static int execIptablesCommand(int argc, const char *argv[], bool silent) {
     56     int res;
     57     int status;
     58 
     59     res = android_fork_execvp(argc, (char **)argv, &status, false,
     60         !silent);
     61     if (res || !WIFEXITED(status) || WEXITSTATUS(status)) {
     62         if (!silent) {
     63             logExecError(argv, res, status);
     64         }
     65         if (res)
     66             return res;
     67         if (!WIFEXITED(status))
     68             return ECHILD;
     69     }
     70     return WEXITSTATUS(status);
     71 }
     72 
     73 static int execIptables(IptablesTarget target, bool silent, va_list args) {
     74     /* Read arguments from incoming va_list; we expect the list to be NULL terminated. */
     75     std::list<const char*> argsList;
     76     argsList.push_back(NULL);
     77     const char* arg;
     78 
     79     // Wait to avoid failure due to another process holding the lock
     80     argsList.push_back("-w");
     81 
     82     do {
     83         arg = va_arg(args, const char *);
     84         argsList.push_back(arg);
     85     } while (arg);
     86 
     87     int i = 0;
     88     const char* argv[argsList.size()];
     89     std::list<const char*>::iterator it;
     90     for (it = argsList.begin(); it != argsList.end(); it++, i++) {
     91         argv[i] = *it;
     92     }
     93 
     94     int res = 0;
     95     if (target == V4 || target == V4V6) {
     96         argv[0] = IPTABLES_PATH;
     97         res |= execIptablesCommand(argsList.size(), argv, silent);
     98     }
     99     if (target == V6 || target == V4V6) {
    100         argv[0] = IP6TABLES_PATH;
    101         res |= execIptablesCommand(argsList.size(), argv, silent);
    102     }
    103     return res;
    104 }
    105 
    106 int execIptables(IptablesTarget target, ...) {
    107     va_list args;
    108     va_start(args, target);
    109     int res = execIptables(target, false, args);
    110     va_end(args);
    111     return res;
    112 }
    113 
    114 int execIptablesSilently(IptablesTarget target, ...) {
    115     va_list args;
    116     va_start(args, target);
    117     int res = execIptables(target, true, args);
    118     va_end(args);
    119     return res;
    120 }
    121 
    122 static int execIptablesRestoreCommand(const char *cmd, const std::string& commands) {
    123     const char *argv[] = {
    124         cmd,
    125         "--noflush",  // Don't flush the whole table.
    126         "-w",         // Wait instead of failing if the lock is held.
    127     };
    128     AndroidForkExecvpOption opt[1] = {
    129         {
    130             .opt_type = FORK_EXECVP_OPTION_INPUT,
    131             .opt_input.input = reinterpret_cast<const uint8_t*>(commands.c_str()),
    132             .opt_input.input_len = commands.size(),
    133         }
    134     };
    135 
    136     int status = 0;
    137     int res = android_fork_execvp_ext(
    138             ARRAY_SIZE(argv), (char**)argv, &status, false /* ignore_int_quit */, LOG_NONE,
    139             false /* abbreviated */, NULL /* file_path */, opt, ARRAY_SIZE(opt));
    140     if (res || status) {
    141         ALOGE("%s failed with res=%d, status=%d", argv[0], res, status);
    142         return -1;
    143     }
    144 
    145     return 0;
    146 }
    147 
    148 int execIptablesRestore(IptablesTarget target, const std::string& commands) {
    149     int res = 0;
    150     if (target == V4 || target == V4V6) {
    151         res |= execIptablesRestoreCommand(IPTABLES_RESTORE_PATH, commands);
    152     }
    153     if (target == V6 || target == V4V6) {
    154         res |= execIptablesRestoreCommand(IP6TABLES_RESTORE_PATH, commands);
    155     }
    156     return res;
    157 }
    158 
    159 /*
    160  * Check an interface name for plausibility. This should e.g. help against
    161  * directory traversal.
    162  */
    163 bool isIfaceName(const char *name) {
    164     size_t i;
    165     size_t name_len = strlen(name);
    166     if ((name_len == 0) || (name_len > IFNAMSIZ)) {
    167         return false;
    168     }
    169 
    170     /* First character must be alphanumeric */
    171     if (!isalnum(name[0])) {
    172         return false;
    173     }
    174 
    175     for (i = 1; i < name_len; i++) {
    176         if (!isalnum(name[i]) && (name[i] != '_') && (name[i] != '-') && (name[i] != ':')) {
    177             return false;
    178         }
    179     }
    180 
    181     return true;
    182 }
    183 
    184 int parsePrefix(const char *prefix, uint8_t *family, void *address, int size, uint8_t *prefixlen) {
    185     if (!prefix || !family || !address || !prefixlen) {
    186         return -EFAULT;
    187     }
    188 
    189     // Find the '/' separating address from prefix length.
    190     const char *slash = strchr(prefix, '/');
    191     const char *prefixlenString = slash + 1;
    192     if (!slash || !*prefixlenString)
    193         return -EINVAL;
    194 
    195     // Convert the prefix length to a uint8_t.
    196     char *endptr;
    197     unsigned templen;
    198     templen = strtoul(prefixlenString, &endptr, 10);
    199     if (*endptr || templen > 255) {
    200         return -EINVAL;
    201     }
    202     *prefixlen = templen;
    203 
    204     // Copy the address part of the prefix to a local buffer. We have to copy
    205     // because inet_pton and getaddrinfo operate on null-terminated address
    206     // strings, but prefix is const and has '/' after the address.
    207     std::string addressString(prefix, slash - prefix);
    208 
    209     // Parse the address.
    210     addrinfo *res;
    211     addrinfo hints = {
    212         .ai_flags = AI_NUMERICHOST,
    213     };
    214     int ret = getaddrinfo(addressString.c_str(), NULL, &hints, &res);
    215     if (ret || !res) {
    216         return -EINVAL;  // getaddrinfo return values are not errno values.
    217     }
    218 
    219     // Convert the address string to raw address bytes.
    220     void *rawAddress;
    221     int rawLength;
    222     switch (res[0].ai_family) {
    223         case AF_INET: {
    224             if (*prefixlen > 32) {
    225                 return -EINVAL;
    226             }
    227             sockaddr_in *sin = (sockaddr_in *) res[0].ai_addr;
    228             rawAddress = &sin->sin_addr;
    229             rawLength = 4;
    230             break;
    231         }
    232         case AF_INET6: {
    233             if (*prefixlen > 128) {
    234                 return -EINVAL;
    235             }
    236             sockaddr_in6 *sin6 = (sockaddr_in6 *) res[0].ai_addr;
    237             rawAddress = &sin6->sin6_addr;
    238             rawLength = 16;
    239             break;
    240         }
    241         default: {
    242             freeaddrinfo(res);
    243             return -EAFNOSUPPORT;
    244         }
    245     }
    246 
    247     if (rawLength > size) {
    248         freeaddrinfo(res);
    249         return -ENOSPC;
    250     }
    251 
    252     *family = res[0].ai_family;
    253     memcpy(address, rawAddress, rawLength);
    254     freeaddrinfo(res);
    255 
    256     return rawLength;
    257 }
    258