Home | History | Annotate | Download | only in server 
      1 /*
      2  * Copyright (C) 2016 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #include <regex>
     18 #include <set>
     19 #include <string>
     20 
     21 #include <android-base/strings.h>
     22 #include <android-base/stringprintf.h>
     23 
     24 #define LOG_TAG "Netd"
     25 #include <cutils/log.h>
     26 
     27 #include "Controllers.h"
     28 #include "IdletimerController.h"
     29 #include "NetworkController.h"
     30 #include "RouteController.h"
     31 #include "Stopwatch.h"
     32 #include "oem_iptables_hook.h"
     33 #include "XfrmController.h"
     34 
     35 namespace android {
     36 namespace net {
     37 
     38 using android::base::Join;
     39 using android::base::StringPrintf;
     40 using android::base::StringAppendF;
     41 
     42 auto Controllers::execIptablesRestore  = ::execIptablesRestore;
     43 auto Controllers::execIptablesRestoreWithOutput = ::execIptablesRestoreWithOutput;
     44 
     45 namespace {
     46 
     47 /**
     48  * List of module chains to be created, along with explicit ordering. ORDERING
     49  * IS CRITICAL, AND SHOULD BE TRIPLE-CHECKED WITH EACH CHANGE.
     50  */
     51 static const std::vector<const char*> FILTER_INPUT = {
     52         // Bandwidth should always be early in input chain, to make sure we
     53         // correctly count incoming traffic against data plan.
     54         BandwidthController::LOCAL_INPUT,
     55         FirewallController::LOCAL_INPUT,
     56 };
     57 
     58 static const std::vector<const char*> FILTER_FORWARD = {
     59         OEM_IPTABLES_FILTER_FORWARD,
     60         FirewallController::LOCAL_FORWARD,
     61         BandwidthController::LOCAL_FORWARD,
     62         TetherController::LOCAL_FORWARD,
     63 };
     64 
     65 static const std::vector<const char*> FILTER_OUTPUT = {
     66         OEM_IPTABLES_FILTER_OUTPUT,
     67         FirewallController::LOCAL_OUTPUT,
     68         StrictController::LOCAL_OUTPUT,
     69         BandwidthController::LOCAL_OUTPUT,
     70 };
     71 
     72 static const std::vector<const char*> RAW_PREROUTING = {
     73         BandwidthController::LOCAL_RAW_PREROUTING,
     74         IdletimerController::LOCAL_RAW_PREROUTING,
     75         TetherController::LOCAL_RAW_PREROUTING,
     76 };
     77 
     78 static const std::vector<const char*> MANGLE_POSTROUTING = {
     79         OEM_IPTABLES_MANGLE_POSTROUTING,
     80         BandwidthController::LOCAL_MANGLE_POSTROUTING,
     81         IdletimerController::LOCAL_MANGLE_POSTROUTING,
     82 };
     83 
     84 static const std::vector<const char*> MANGLE_INPUT = {
     85         WakeupController::LOCAL_MANGLE_INPUT,
     86         RouteController::LOCAL_MANGLE_INPUT,
     87 };
     88 
     89 static const std::vector<const char*> MANGLE_FORWARD = {
     90         TetherController::LOCAL_MANGLE_FORWARD,
     91 };
     92 
     93 static const std::vector<const char*> NAT_PREROUTING = {
     94         OEM_IPTABLES_NAT_PREROUTING,
     95 };
     96 
     97 static const std::vector<const char*> NAT_POSTROUTING = {
     98         TetherController::LOCAL_NAT_POSTROUTING,
     99 };
    100 
    101 // Commands to create child chains and to match created chains in iptables -S output. Keep in sync.
    102 static const char* CHILD_CHAIN_TEMPLATE = "-A %s -j %s\n";
    103 static const std::regex CHILD_CHAIN_REGEX("^-A ([^ ]+) -j ([^ ]+)$",
    104                                           std::regex_constants::extended);
    105 
    106 }  // namespace
    107 
    108 /* static */
    109 std::set<std::string> Controllers::findExistingChildChains(const IptablesTarget target,
    110                                                            const char* table,
    111                                                            const char* parentChain) {
    112     if (target == V4V6) {
    113         ALOGE("findExistingChildChains only supports one protocol at a time");
    114         abort();
    115     }
    116 
    117     std::set<std::string> existing;
    118 
    119     // List the current contents of parentChain.
    120     //
    121     // TODO: there is no guarantee that nothing else modifies the chain in the few milliseconds
    122     // between when we list the existing rules and when we delete them. However:
    123     // - Since this code is only run on startup, nothing else in netd will be running.
    124     // - While vendor code is known to add its own rules to chains created by netd, it should never
    125     //   be modifying the rules in childChains or the rules that hook said chains into their parent
    126     //   chains.
    127     std::string command = StringPrintf("*%s\n-S %s\nCOMMIT\n", table, parentChain);
    128     std::string output;
    129     if (Controllers::execIptablesRestoreWithOutput(target, command, &output) == -1) {
    130         ALOGE("Error listing chain %s in table %s\n", parentChain, table);
    131         return existing;
    132     }
    133 
    134     // The only rules added by createChildChains are of the simple form "-A <parent> -j <child>".
    135     // Find those rules and add each one's child chain to existing.
    136     std::smatch matches;
    137     std::stringstream stream(output);
    138     std::string rule;
    139     while (std::getline(stream, rule, '\n')) {
    140         if (std::regex_search(rule, matches, CHILD_CHAIN_REGEX) && matches[1] == parentChain) {
    141             existing.insert(matches[2]);
    142         }
    143     }
    144 
    145     return existing;
    146 }
    147 
    148 /* static */
    149 void Controllers::createChildChains(IptablesTarget target, const char* table,
    150                                     const char* parentChain,
    151                                     const std::vector<const char*>& childChains,
    152                                     bool exclusive) {
    153     std::string command = StringPrintf("*%s\n", table);
    154 
    155     // We cannot just clear all the chains we create because vendor code modifies filter OUTPUT and
    156     // mangle POSTROUTING directly. So:
    157     //
    158     // - If we're the exclusive owner of this chain, simply clear it entirely.
    159     // - If not, then list the chain's current contents to ensure that if we restart after a crash,
    160     //   we leave the existing rules alone in the positions they currently occupy. This is faster
    161     //   than blindly deleting our rules and recreating them, because deleting a rule that doesn't
    162     //   exists causes iptables-restore to quit, which takes ~30ms per delete. It's also more
    163     //   correct, because if we delete rules and re-add them, they'll be in the wrong position with
    164     //   regards to the vendor rules.
    165     //
    166     // TODO: Make all chains exclusive once vendor code uses the oem_* rules.
    167     std::set<std::string> existingChildChains;
    168     if (exclusive) {
    169         // Just running ":chain -" flushes user-defined chains, but not built-in chains like INPUT.
    170         // Since at this point we don't know if parentChain is a built-in chain, do both.
    171         StringAppendF(&command, ":%s -\n", parentChain);
    172         StringAppendF(&command, "-F %s\n", parentChain);
    173     } else {
    174         existingChildChains = findExistingChildChains(target, table, parentChain);
    175     }
    176 
    177     for (const auto& childChain : childChains) {
    178         // Always clear the child chain.
    179         StringAppendF(&command, ":%s -\n", childChain);
    180         // But only add it to the parent chain if it's not already there.
    181         if (existingChildChains.find(childChain) == existingChildChains.end()) {
    182             StringAppendF(&command, CHILD_CHAIN_TEMPLATE, parentChain, childChain);
    183         }
    184     }
    185     command += "COMMIT\n";
    186     execIptablesRestore(target, command);
    187 }
    188 
    189 Controllers::Controllers()
    190     : clatdCtrl(&netCtrl),
    191       wakeupCtrl(
    192           [this](const WakeupController::ReportArgs& args) {
    193               const auto listener = eventReporter.getNetdEventListener();
    194               if (listener == nullptr) {
    195                   ALOGE("getNetdEventListener() returned nullptr. dropping wakeup event");
    196                   return;
    197               }
    198               String16 prefix = String16(args.prefix.c_str());
    199               String16 srcIp = String16(args.srcIp.c_str());
    200               String16 dstIp = String16(args.dstIp.c_str());
    201               listener->onWakeupEvent(prefix, args.uid, args.ethertype, args.ipNextHeader,
    202                                       args.dstHw, srcIp, dstIp, args.srcPort, args.dstPort,
    203                                       args.timestampNs);
    204           },
    205           &iptablesRestoreCtrl) {
    206     InterfaceController::initializeAll();
    207 }
    208 
    209 void Controllers::initChildChains() {
    210     /*
    211      * This is the only time we touch top-level chains in iptables; controllers
    212      * should only mutate rules inside of their children chains, as created by
    213      * the constants above.
    214      *
    215      * Modules should never ACCEPT packets (except in well-justified cases);
    216      * they should instead defer to any remaining modules using RETURN, or
    217      * otherwise DROP/REJECT.
    218      */
    219 
    220     // Create chains for child modules.
    221     createChildChains(V4V6, "filter", "INPUT", FILTER_INPUT, true);
    222     createChildChains(V4V6, "filter", "FORWARD", FILTER_FORWARD, true);
    223     createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING, true);
    224     createChildChains(V4V6, "mangle", "FORWARD", MANGLE_FORWARD, true);
    225     createChildChains(V4V6, "mangle", "INPUT", MANGLE_INPUT, true);
    226     createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING, true);
    227     createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING, true);
    228 
    229     createChildChains(V4, "filter", "OUTPUT", FILTER_OUTPUT, false);
    230     createChildChains(V6, "filter", "OUTPUT", FILTER_OUTPUT, false);
    231     createChildChains(V4, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
    232     createChildChains(V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
    233 }
    234 
    235 void Controllers::initIptablesRules() {
    236     Stopwatch s;
    237     initChildChains();
    238     ALOGI("Creating child chains: %.1fms", s.getTimeAndReset());
    239 
    240     // Let each module setup their child chains
    241     setupOemIptablesHook();
    242     ALOGI("Setting up OEM hooks: %.1fms", s.getTimeAndReset());
    243 
    244     /* When enabled, DROPs all packets except those matching rules. */
    245     firewallCtrl.setupIptablesHooks();
    246     ALOGI("Setting up FirewallController hooks: %.1fms", s.getTimeAndReset());
    247 
    248     /* Does DROPs in FORWARD by default */
    249     tetherCtrl.setupIptablesHooks();
    250     ALOGI("Setting up TetherController hooks: %.1fms", s.getTimeAndReset());
    251 
    252     /*
    253      * Does REJECT in INPUT, OUTPUT. Does counting also.
    254      * No DROP/REJECT allowed later in netfilter-flow hook order.
    255      */
    256     bandwidthCtrl.setupIptablesHooks();
    257     ALOGI("Setting up BandwidthController hooks: %.1fms", s.getTimeAndReset());
    258 
    259     /*
    260      * Counts in nat: PREROUTING, POSTROUTING.
    261      * No DROP/REJECT allowed later in netfilter-flow hook order.
    262      */
    263     idletimerCtrl.setupIptablesHooks();
    264     ALOGI("Setting up IdletimerController hooks: %.1fms", s.getTimeAndReset());
    265 }
    266 
    267 void Controllers::init() {
    268     initIptablesRules();
    269     Stopwatch s;
    270     netdutils::Status tcStatus = trafficCtrl.start();
    271     if (!isOk(tcStatus)) {
    272         ALOGE("failed to start trafficcontroller: (%s)", toString(tcStatus).c_str());
    273     }
    274     ALOGI("initializing traffic control: %.1fms", s.getTimeAndReset());
    275 
    276     bandwidthCtrl.enableBandwidthControl(false);
    277     ALOGI("Disabling bandwidth control: %.1fms", s.getTimeAndReset());
    278 
    279     if (int ret = RouteController::Init(NetworkController::LOCAL_NET_ID)) {
    280         ALOGE("failed to initialize RouteController (%s)", strerror(-ret));
    281     }
    282     ALOGI("Initializing RouteController: %.1fms", s.getTimeAndReset());
    283 
    284     netdutils::Status xStatus = XfrmController::Init();
    285     if (!isOk(xStatus)) {
    286         ALOGE("Failed to initialize XfrmController (%s)", netdutils::toString(xStatus).c_str());
    287     };
    288     ALOGI("Initializing XfrmController: %.1fms", s.getTimeAndReset());
    289 }
    290 
    291 Controllers* gCtls = nullptr;
    292 
    293 }  // namespace net
    294 }  // namespace android
    295