1 /*
2  * Copyright (C) 2007 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define TRACE_TAG TRACE_ADB
18 
19 #include "sysdeps.h"
20 #include "adb.h"
21 
22 #include <ctype.h>
23 #include <errno.h>
24 #include <stdarg.h>
25 #include <stddef.h>
26 #include <stdint.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <sys/time.h>
31 #include <time.h>
32 
33 #include <string>
34 
35 #include <base/stringprintf.h>
36 #include <base/strings.h>
37 
38 #include "adb_auth.h"
39 #include "adb_io.h"
40 #include "adb_listeners.h"
41 #include "transport.h"
42 
43 #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
44 
45 #if !ADB_HOST
46 #include <cutils/properties.h>
47 #include <sys/capability.h>
48 #include <sys/mount.h>
49 #endif
50 
51 ADB_MUTEX_DEFINE( D_lock );
52 
53 int HOST = 0;
54 
55 #if !ADB_HOST
56 const char *adb_device_banner = "device";
57 #endif
58 
fatal(const char * fmt,...)59 void fatal(const char *fmt, ...)
60 {
61     va_list ap;
62     va_start(ap, fmt);
63     fprintf(stderr, "error: ");
64     vfprintf(stderr, fmt, ap);
65     fprintf(stderr, "\n");
66     va_end(ap);
67     exit(-1);
68 }
69 
fatal_errno(const char * fmt,...)70 void fatal_errno(const char *fmt, ...)
71 {
72     va_list ap;
73     va_start(ap, fmt);
74     fprintf(stderr, "error: %s: ", strerror(errno));
75     vfprintf(stderr, fmt, ap);
76     fprintf(stderr, "\n");
77     va_end(ap);
78     exit(-1);
79 }
80 
81 #if !ADB_HOST
start_device_log(void)82 void start_device_log(void) {
83     struct tm now;
84     time_t t;
85     tzset();
86     time(&t);
87     localtime_r(&t, &now);
88 
89     char timestamp[PATH_MAX];
90     strftime(timestamp, sizeof(timestamp), "%Y-%m-%d-%H-%M-%S", &now);
91 
92     std::string path = android::base::StringPrintf("/data/adb/adb-%s-%d", timestamp, getpid());
93     int fd = unix_open(path.c_str(), O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0640);
94     if (fd == -1) {
95         return;
96     }
97 
98     // redirect stdout and stderr to the log file
99     dup2(fd, STDOUT_FILENO);
100     dup2(fd, STDERR_FILENO);
101     fprintf(stderr, "--- adb starting (pid %d) ---\n", getpid());
102     adb_close(fd);
103 }
104 #endif
105 
106 int adb_trace_mask;
107 
get_trace_setting_from_env()108 std::string get_trace_setting_from_env() {
109     const char* setting = getenv("ADB_TRACE");
110     if (setting == nullptr) {
111         setting = "";
112     }
113 
114     return std::string(setting);
115 }
116 
117 #if !ADB_HOST
get_trace_setting_from_prop()118 std::string get_trace_setting_from_prop() {
119     char buf[PROPERTY_VALUE_MAX];
120     property_get("persist.adb.trace_mask", buf, "");
121     return std::string(buf);
122 }
123 #endif
124 
get_trace_setting()125 std::string get_trace_setting() {
126 #if ADB_HOST
127     return get_trace_setting_from_env();
128 #else
129     return get_trace_setting_from_prop();
130 #endif
131 }
132 
133 // Split the comma/space/colum/semi-column separated list of tags from the trace
134 // setting and build the trace mask from it. note that '1' and 'all' are special
135 // cases to enable all tracing.
136 //
137 // adb's trace setting comes from the ADB_TRACE environment variable, whereas
138 // adbd's comes from the system property persist.adb.trace_mask.
adb_trace_init()139 void adb_trace_init() {
140     const std::string trace_setting = get_trace_setting();
141 
142     static const struct {
143         const char*  tag;
144         int           flag;
145     } tags[] = {
146         { "1", 0 },
147         { "all", 0 },
148         { "adb", TRACE_ADB },
149         { "sockets", TRACE_SOCKETS },
150         { "packets", TRACE_PACKETS },
151         { "rwx", TRACE_RWX },
152         { "usb", TRACE_USB },
153         { "sync", TRACE_SYNC },
154         { "sysdeps", TRACE_SYSDEPS },
155         { "transport", TRACE_TRANSPORT },
156         { "jdwp", TRACE_JDWP },
157         { "services", TRACE_SERVICES },
158         { "auth", TRACE_AUTH },
159         { NULL, 0 }
160     };
161 
162     if (trace_setting.empty()) {
163         return;
164     }
165 
166     // Use a comma/colon/semi-colon/space separated list
167     const char* p = trace_setting.c_str();
168     while (*p) {
169         int  len, tagn;
170 
171         const char* q = strpbrk(p, " ,:;");
172         if (q == NULL) {
173             q = p + strlen(p);
174         }
175         len = q - p;
176 
177         for (tagn = 0; tags[tagn].tag != NULL; tagn++) {
178             int  taglen = strlen(tags[tagn].tag);
179 
180             if (len == taglen && !memcmp(tags[tagn].tag, p, len)) {
181                 int  flag = tags[tagn].flag;
182                 if (flag == 0) {
183                     adb_trace_mask = ~0;
184                     return;
185                 }
186                 adb_trace_mask |= (1 << flag);
187                 break;
188             }
189         }
190         p = q;
191         if (*p)
192             p++;
193     }
194 
195 #if !ADB_HOST
196     start_device_log();
197 #endif
198 }
199 
get_apacket(void)200 apacket* get_apacket(void)
201 {
202     apacket* p = reinterpret_cast<apacket*>(malloc(sizeof(apacket)));
203     if (p == nullptr) {
204       fatal("failed to allocate an apacket");
205     }
206 
207     memset(p, 0, sizeof(apacket) - MAX_PAYLOAD);
208     return p;
209 }
210 
put_apacket(apacket * p)211 void put_apacket(apacket *p)
212 {
213     free(p);
214 }
215 
handle_online(atransport * t)216 void handle_online(atransport *t)
217 {
218     D("adb: online\n");
219     t->online = 1;
220 }
221 
handle_offline(atransport * t)222 void handle_offline(atransport *t)
223 {
224     D("adb: offline\n");
225     //Close the associated usb
226     t->online = 0;
227     run_transport_disconnects(t);
228 }
229 
230 #if DEBUG_PACKETS
231 #define DUMPMAX 32
print_packet(const char * label,apacket * p)232 void print_packet(const char *label, apacket *p)
233 {
234     char *tag;
235     char *x;
236     unsigned count;
237 
238     switch(p->msg.command){
239     case A_SYNC: tag = "SYNC"; break;
240     case A_CNXN: tag = "CNXN" ; break;
241     case A_OPEN: tag = "OPEN"; break;
242     case A_OKAY: tag = "OKAY"; break;
243     case A_CLSE: tag = "CLSE"; break;
244     case A_WRTE: tag = "WRTE"; break;
245     case A_AUTH: tag = "AUTH"; break;
246     default: tag = "????"; break;
247     }
248 
249     fprintf(stderr, "%s: %s %08x %08x %04x \"",
250             label, tag, p->msg.arg0, p->msg.arg1, p->msg.data_length);
251     count = p->msg.data_length;
252     x = (char*) p->data;
253     if(count > DUMPMAX) {
254         count = DUMPMAX;
255         tag = "\n";
256     } else {
257         tag = "\"\n";
258     }
259     while(count-- > 0){
260         if((*x >= ' ') && (*x < 127)) {
261             fputc(*x, stderr);
262         } else {
263             fputc('.', stderr);
264         }
265         x++;
266     }
267     fputs(tag, stderr);
268 }
269 #endif
270 
send_ready(unsigned local,unsigned remote,atransport * t)271 static void send_ready(unsigned local, unsigned remote, atransport *t)
272 {
273     D("Calling send_ready \n");
274     apacket *p = get_apacket();
275     p->msg.command = A_OKAY;
276     p->msg.arg0 = local;
277     p->msg.arg1 = remote;
278     send_packet(p, t);
279 }
280 
send_close(unsigned local,unsigned remote,atransport * t)281 static void send_close(unsigned local, unsigned remote, atransport *t)
282 {
283     D("Calling send_close \n");
284     apacket *p = get_apacket();
285     p->msg.command = A_CLSE;
286     p->msg.arg0 = local;
287     p->msg.arg1 = remote;
288     send_packet(p, t);
289 }
290 
fill_connect_data(char * buf,size_t bufsize)291 static size_t fill_connect_data(char *buf, size_t bufsize)
292 {
293 #if ADB_HOST
294     return snprintf(buf, bufsize, "host::") + 1;
295 #else
296     static const char *cnxn_props[] = {
297         "ro.product.name",
298         "ro.product.model",
299         "ro.product.device",
300     };
301     static const int num_cnxn_props = ARRAY_SIZE(cnxn_props);
302     int i;
303     size_t remaining = bufsize;
304     size_t len;
305 
306     len = snprintf(buf, remaining, "%s::", adb_device_banner);
307     remaining -= len;
308     buf += len;
309     for (i = 0; i < num_cnxn_props; i++) {
310         char value[PROPERTY_VALUE_MAX];
311         property_get(cnxn_props[i], value, "");
312         len = snprintf(buf, remaining, "%s=%s;", cnxn_props[i], value);
313         remaining -= len;
314         buf += len;
315     }
316 
317     return bufsize - remaining + 1;
318 #endif
319 }
320 
send_connect(atransport * t)321 void send_connect(atransport *t)
322 {
323     D("Calling send_connect \n");
324     apacket *cp = get_apacket();
325     cp->msg.command = A_CNXN;
326     cp->msg.arg0 = A_VERSION;
327     cp->msg.arg1 = MAX_PAYLOAD;
328     cp->msg.data_length = fill_connect_data((char *)cp->data,
329                                             sizeof(cp->data));
330     send_packet(cp, t);
331 }
332 
333 // qual_overwrite is used to overwrite a qualifier string.  dst is a
334 // pointer to a char pointer.  It is assumed that if *dst is non-NULL, it
335 // was malloc'ed and needs to freed.  *dst will be set to a dup of src.
336 // TODO: switch to std::string for these atransport fields instead.
qual_overwrite(char ** dst,const std::string & src)337 static void qual_overwrite(char** dst, const std::string& src) {
338     free(*dst);
339     *dst = strdup(src.c_str());
340 }
341 
parse_banner(const char * banner,atransport * t)342 void parse_banner(const char* banner, atransport* t) {
343     D("parse_banner: %s\n", banner);
344 
345     // The format is something like:
346     // "device::ro.product.name=x;ro.product.model=y;ro.product.device=z;".
347     std::vector<std::string> pieces = android::base::Split(banner, ":");
348 
349     if (pieces.size() > 2) {
350         const std::string& props = pieces[2];
351         for (auto& prop : android::base::Split(props, ";")) {
352             // The list of properties was traditionally ;-terminated rather than ;-separated.
353             if (prop.empty()) continue;
354 
355             std::vector<std::string> key_value = android::base::Split(prop, "=");
356             if (key_value.size() != 2) continue;
357 
358             const std::string& key = key_value[0];
359             const std::string& value = key_value[1];
360             if (key == "ro.product.name") {
361                 qual_overwrite(&t->product, value);
362             } else if (key == "ro.product.model") {
363                 qual_overwrite(&t->model, value);
364             } else if (key == "ro.product.device") {
365                 qual_overwrite(&t->device, value);
366             }
367         }
368     }
369 
370     const std::string& type = pieces[0];
371     if (type == "bootloader") {
372         D("setting connection_state to CS_BOOTLOADER\n");
373         t->connection_state = CS_BOOTLOADER;
374         update_transports();
375     } else if (type == "device") {
376         D("setting connection_state to CS_DEVICE\n");
377         t->connection_state = CS_DEVICE;
378         update_transports();
379     } else if (type == "recovery") {
380         D("setting connection_state to CS_RECOVERY\n");
381         t->connection_state = CS_RECOVERY;
382         update_transports();
383     } else if (type == "sideload") {
384         D("setting connection_state to CS_SIDELOAD\n");
385         t->connection_state = CS_SIDELOAD;
386         update_transports();
387     } else {
388         D("setting connection_state to CS_HOST\n");
389         t->connection_state = CS_HOST;
390     }
391 }
392 
handle_packet(apacket * p,atransport * t)393 void handle_packet(apacket *p, atransport *t)
394 {
395     asocket *s;
396 
397     D("handle_packet() %c%c%c%c\n", ((char*) (&(p->msg.command)))[0],
398             ((char*) (&(p->msg.command)))[1],
399             ((char*) (&(p->msg.command)))[2],
400             ((char*) (&(p->msg.command)))[3]);
401     print_packet("recv", p);
402 
403     switch(p->msg.command){
404     case A_SYNC:
405         if(p->msg.arg0){
406             send_packet(p, t);
407             if(HOST) send_connect(t);
408         } else {
409             t->connection_state = CS_OFFLINE;
410             handle_offline(t);
411             send_packet(p, t);
412         }
413         return;
414 
415     case A_CNXN: /* CONNECT(version, maxdata, "system-id-string") */
416             /* XXX verify version, etc */
417         if(t->connection_state != CS_OFFLINE) {
418             t->connection_state = CS_OFFLINE;
419             handle_offline(t);
420         }
421 
422         parse_banner(reinterpret_cast<const char*>(p->data), t);
423 
424         if (HOST || !auth_required) {
425             handle_online(t);
426             if (!HOST) send_connect(t);
427         } else {
428             send_auth_request(t);
429         }
430         break;
431 
432     case A_AUTH:
433         if (p->msg.arg0 == ADB_AUTH_TOKEN) {
434             t->connection_state = CS_UNAUTHORIZED;
435             t->key = adb_auth_nextkey(t->key);
436             if (t->key) {
437                 send_auth_response(p->data, p->msg.data_length, t);
438             } else {
439                 /* No more private keys to try, send the public key */
440                 send_auth_publickey(t);
441             }
442         } else if (p->msg.arg0 == ADB_AUTH_SIGNATURE) {
443             if (adb_auth_verify(t->token, p->data, p->msg.data_length)) {
444                 adb_auth_verified(t);
445                 t->failed_auth_attempts = 0;
446             } else {
447                 if (t->failed_auth_attempts++ > 10)
448                     adb_sleep_ms(1000);
449                 send_auth_request(t);
450             }
451         } else if (p->msg.arg0 == ADB_AUTH_RSAPUBLICKEY) {
452             adb_auth_confirm_key(p->data, p->msg.data_length, t);
453         }
454         break;
455 
456     case A_OPEN: /* OPEN(local-id, 0, "destination") */
457         if (t->online && p->msg.arg0 != 0 && p->msg.arg1 == 0) {
458             char *name = (char*) p->data;
459             name[p->msg.data_length > 0 ? p->msg.data_length - 1 : 0] = 0;
460             s = create_local_service_socket(name);
461             if(s == 0) {
462                 send_close(0, p->msg.arg0, t);
463             } else {
464                 s->peer = create_remote_socket(p->msg.arg0, t);
465                 s->peer->peer = s;
466                 send_ready(s->id, s->peer->id, t);
467                 s->ready(s);
468             }
469         }
470         break;
471 
472     case A_OKAY: /* READY(local-id, remote-id, "") */
473         if (t->online && p->msg.arg0 != 0 && p->msg.arg1 != 0) {
474             if((s = find_local_socket(p->msg.arg1, 0))) {
475                 if(s->peer == 0) {
476                     /* On first READY message, create the connection. */
477                     s->peer = create_remote_socket(p->msg.arg0, t);
478                     s->peer->peer = s;
479                     s->ready(s);
480                 } else if (s->peer->id == p->msg.arg0) {
481                     /* Other READY messages must use the same local-id */
482                     s->ready(s);
483                 } else {
484                     D("Invalid A_OKAY(%d,%d), expected A_OKAY(%d,%d) on transport %s\n",
485                       p->msg.arg0, p->msg.arg1, s->peer->id, p->msg.arg1, t->serial);
486                 }
487             }
488         }
489         break;
490 
491     case A_CLSE: /* CLOSE(local-id, remote-id, "") or CLOSE(0, remote-id, "") */
492         if (t->online && p->msg.arg1 != 0) {
493             if((s = find_local_socket(p->msg.arg1, p->msg.arg0))) {
494                 /* According to protocol.txt, p->msg.arg0 might be 0 to indicate
495                  * a failed OPEN only. However, due to a bug in previous ADB
496                  * versions, CLOSE(0, remote-id, "") was also used for normal
497                  * CLOSE() operations.
498                  *
499                  * This is bad because it means a compromised adbd could
500                  * send packets to close connections between the host and
501                  * other devices. To avoid this, only allow this if the local
502                  * socket has a peer on the same transport.
503                  */
504                 if (p->msg.arg0 == 0 && s->peer && s->peer->transport != t) {
505                     D("Invalid A_CLSE(0, %u) from transport %s, expected transport %s\n",
506                       p->msg.arg1, t->serial, s->peer->transport->serial);
507                 } else {
508                     s->close(s);
509                 }
510             }
511         }
512         break;
513 
514     case A_WRTE: /* WRITE(local-id, remote-id, <data>) */
515         if (t->online && p->msg.arg0 != 0 && p->msg.arg1 != 0) {
516             if((s = find_local_socket(p->msg.arg1, p->msg.arg0))) {
517                 unsigned rid = p->msg.arg0;
518                 p->len = p->msg.data_length;
519 
520                 if(s->enqueue(s, p) == 0) {
521                     D("Enqueue the socket\n");
522                     send_ready(s->id, rid, t);
523                 }
524                 return;
525             }
526         }
527         break;
528 
529     default:
530         printf("handle_packet: what is %08x?!\n", p->msg.command);
531     }
532 
533     put_apacket(p);
534 }
535 
536 #if ADB_HOST
537 
launch_server(int server_port)538 int launch_server(int server_port)
539 {
540 #if defined(_WIN32)
541     /* we need to start the server in the background                    */
542     /* we create a PIPE that will be used to wait for the server's "OK" */
543     /* message since the pipe handles must be inheritable, we use a     */
544     /* security attribute                                               */
545     HANDLE                pipe_read, pipe_write;
546     HANDLE                stdout_handle, stderr_handle;
547     SECURITY_ATTRIBUTES   sa;
548     STARTUPINFO           startup;
549     PROCESS_INFORMATION   pinfo;
550     char                  program_path[ MAX_PATH ];
551     int                   ret;
552 
553     sa.nLength = sizeof(sa);
554     sa.lpSecurityDescriptor = NULL;
555     sa.bInheritHandle = TRUE;
556 
557     /* create pipe, and ensure its read handle isn't inheritable */
558     ret = CreatePipe( &pipe_read, &pipe_write, &sa, 0 );
559     if (!ret) {
560         fprintf(stderr, "CreatePipe() failure, error %ld\n", GetLastError() );
561         return -1;
562     }
563 
564     SetHandleInformation( pipe_read, HANDLE_FLAG_INHERIT, 0 );
565 
566     /* Some programs want to launch an adb command and collect its output by
567      * calling CreateProcess with inheritable stdout/stderr handles, then
568      * using read() to get its output. When this happens, the stdout/stderr
569      * handles passed to the adb client process will also be inheritable.
570      * When starting the adb server here, care must be taken to reset them
571      * to non-inheritable.
572      * Otherwise, something bad happens: even if the adb command completes,
573      * the calling process is stuck while read()-ing from the stdout/stderr
574      * descriptors, because they're connected to corresponding handles in the
575      * adb server process (even if the latter never uses/writes to them).
576      */
577     stdout_handle = GetStdHandle( STD_OUTPUT_HANDLE );
578     stderr_handle = GetStdHandle( STD_ERROR_HANDLE );
579     if (stdout_handle != INVALID_HANDLE_VALUE) {
580         SetHandleInformation( stdout_handle, HANDLE_FLAG_INHERIT, 0 );
581     }
582     if (stderr_handle != INVALID_HANDLE_VALUE) {
583         SetHandleInformation( stderr_handle, HANDLE_FLAG_INHERIT, 0 );
584     }
585 
586     ZeroMemory( &startup, sizeof(startup) );
587     startup.cb = sizeof(startup);
588     startup.hStdInput  = GetStdHandle( STD_INPUT_HANDLE );
589     startup.hStdOutput = pipe_write;
590     startup.hStdError  = GetStdHandle( STD_ERROR_HANDLE );
591     startup.dwFlags    = STARTF_USESTDHANDLES;
592 
593     ZeroMemory( &pinfo, sizeof(pinfo) );
594 
595     /* get path of current program */
596     GetModuleFileName( NULL, program_path, sizeof(program_path) );
597     char args[64];
598     snprintf(args, sizeof(args), "adb -P %d fork-server server",  server_port);
599     ret = CreateProcess(
600             program_path,                              /* program path  */
601             args,
602                                     /* the fork-server argument will set the
603                                        debug = 2 in the child           */
604             NULL,                   /* process handle is not inheritable */
605             NULL,                    /* thread handle is not inheritable */
606             TRUE,                          /* yes, inherit some handles */
607             DETACHED_PROCESS, /* the new process doesn't have a console */
608             NULL,                     /* use parent's environment block */
609             NULL,                    /* use parent's starting directory */
610             &startup,                 /* startup info, i.e. std handles */
611             &pinfo );
612 
613     CloseHandle( pipe_write );
614 
615     if (!ret) {
616         fprintf(stderr, "CreateProcess failure, error %ld\n", GetLastError() );
617         CloseHandle( pipe_read );
618         return -1;
619     }
620 
621     CloseHandle( pinfo.hProcess );
622     CloseHandle( pinfo.hThread );
623 
624     /* wait for the "OK\n" message */
625     {
626         char  temp[3];
627         DWORD  count;
628 
629         ret = ReadFile( pipe_read, temp, 3, &count, NULL );
630         CloseHandle( pipe_read );
631         if ( !ret ) {
632             fprintf(stderr, "could not read ok from ADB Server, error = %ld\n", GetLastError() );
633             return -1;
634         }
635         if (count != 3 || temp[0] != 'O' || temp[1] != 'K' || temp[2] != '\n') {
636             fprintf(stderr, "ADB server didn't ACK\n" );
637             return -1;
638         }
639     }
640 #else /* !defined(_WIN32) */
641     char    path[PATH_MAX];
642     int     fd[2];
643 
644     // set up a pipe so the child can tell us when it is ready.
645     // fd[0] will be parent's end, and fd[1] will get mapped to stderr in the child.
646     if (pipe(fd)) {
647         fprintf(stderr, "pipe failed in launch_server, errno: %d\n", errno);
648         return -1;
649     }
650     get_my_path(path, PATH_MAX);
651     pid_t pid = fork();
652     if(pid < 0) return -1;
653 
654     if (pid == 0) {
655         // child side of the fork
656 
657         // redirect stderr to the pipe
658         // we use stderr instead of stdout due to stdout's buffering behavior.
659         adb_close(fd[0]);
660         dup2(fd[1], STDERR_FILENO);
661         adb_close(fd[1]);
662 
663         char str_port[30];
664         snprintf(str_port, sizeof(str_port), "%d",  server_port);
665         // child process
666         int result = execl(path, "adb", "-P", str_port, "fork-server", "server", NULL);
667         // this should not return
668         fprintf(stderr, "OOPS! execl returned %d, errno: %d\n", result, errno);
669     } else  {
670         // parent side of the fork
671 
672         char  temp[3];
673 
674         temp[0] = 'A'; temp[1] = 'B'; temp[2] = 'C';
675         // wait for the "OK\n" message
676         adb_close(fd[1]);
677         int ret = adb_read(fd[0], temp, 3);
678         int saved_errno = errno;
679         adb_close(fd[0]);
680         if (ret < 0) {
681             fprintf(stderr, "could not read ok from ADB Server, errno = %d\n", saved_errno);
682             return -1;
683         }
684         if (ret != 3 || temp[0] != 'O' || temp[1] != 'K' || temp[2] != '\n') {
685             fprintf(stderr, "ADB server didn't ACK\n" );
686             return -1;
687         }
688 
689         setsid();
690     }
691 #endif /* !defined(_WIN32) */
692     return 0;
693 }
694 #endif /* ADB_HOST */
695 
696 // Try to handle a network forwarding request.
697 // This returns 1 on success, 0 on failure, and -1 to indicate this is not
698 // a forwarding-related request.
handle_forward_request(const char * service,transport_type ttype,char * serial,int reply_fd)699 int handle_forward_request(const char* service, transport_type ttype, char* serial, int reply_fd)
700 {
701     if (!strcmp(service, "list-forward")) {
702         // Create the list of forward redirections.
703         std::string listeners = format_listeners();
704 #if ADB_HOST
705         SendOkay(reply_fd);
706 #endif
707         SendProtocolString(reply_fd, listeners);
708         return 1;
709     }
710 
711     if (!strcmp(service, "killforward-all")) {
712         remove_all_listeners();
713 #if ADB_HOST
714         /* On the host: 1st OKAY is connect, 2nd OKAY is status */
715         SendOkay(reply_fd);
716 #endif
717         SendOkay(reply_fd);
718         return 1;
719     }
720 
721     if (!strncmp(service, "forward:",8) ||
722         !strncmp(service, "killforward:",12)) {
723         char *local, *remote;
724         atransport *transport;
725 
726         int createForward = strncmp(service, "kill", 4);
727         int no_rebind = 0;
728 
729         local = strchr(service, ':') + 1;
730 
731         // Handle forward:norebind:<local>... here
732         if (createForward && !strncmp(local, "norebind:", 9)) {
733             no_rebind = 1;
734             local = strchr(local, ':') + 1;
735         }
736 
737         remote = strchr(local,';');
738 
739         if (createForward) {
740             // Check forward: parameter format: '<local>;<remote>'
741             if(remote == 0) {
742                 SendFail(reply_fd, "malformed forward spec");
743                 return 1;
744             }
745 
746             *remote++ = 0;
747             if((local[0] == 0) || (remote[0] == 0) || (remote[0] == '*')) {
748                 SendFail(reply_fd, "malformed forward spec");
749                 return 1;
750             }
751         } else {
752             // Check killforward: parameter format: '<local>'
753             if (local[0] == 0) {
754                 SendFail(reply_fd, "malformed forward spec");
755                 return 1;
756             }
757         }
758 
759         std::string error_msg;
760         transport = acquire_one_transport(CS_ANY, ttype, serial, &error_msg);
761         if (!transport) {
762             SendFail(reply_fd, error_msg);
763             return 1;
764         }
765 
766         install_status_t r;
767         if (createForward) {
768             r = install_listener(local, remote, transport, no_rebind);
769         } else {
770             r = remove_listener(local, transport);
771         }
772         if (r == INSTALL_STATUS_OK) {
773 #if ADB_HOST
774             /* On the host: 1st OKAY is connect, 2nd OKAY is status */
775             SendOkay(reply_fd);
776 #endif
777             SendOkay(reply_fd);
778             return 1;
779         }
780 
781         std::string message;
782         switch (r) {
783           case INSTALL_STATUS_OK: message = " "; break;
784           case INSTALL_STATUS_INTERNAL_ERROR: message = "internal error"; break;
785           case INSTALL_STATUS_CANNOT_BIND:
786             message = android::base::StringPrintf("cannot bind to socket: %s", strerror(errno));
787             break;
788           case INSTALL_STATUS_CANNOT_REBIND:
789             message = android::base::StringPrintf("cannot rebind existing socket: %s", strerror(errno));
790             break;
791           case INSTALL_STATUS_LISTENER_NOT_FOUND: message = "listener not found"; break;
792         }
793         SendFail(reply_fd, message);
794         return 1;
795     }
796     return 0;
797 }
798 
handle_host_request(char * service,transport_type ttype,char * serial,int reply_fd,asocket * s)799 int handle_host_request(char *service, transport_type ttype, char* serial, int reply_fd, asocket *s)
800 {
801     if(!strcmp(service, "kill")) {
802         fprintf(stderr,"adb server killed by remote request\n");
803         fflush(stdout);
804         SendOkay(reply_fd);
805         usb_cleanup();
806         exit(0);
807     }
808 
809 #if ADB_HOST
810     atransport *transport = NULL;
811     // "transport:" is used for switching transport with a specified serial number
812     // "transport-usb:" is used for switching transport to the only USB transport
813     // "transport-local:" is used for switching transport to the only local transport
814     // "transport-any:" is used for switching transport to the only transport
815     if (!strncmp(service, "transport", strlen("transport"))) {
816         transport_type type = kTransportAny;
817 
818         if (!strncmp(service, "transport-usb", strlen("transport-usb"))) {
819             type = kTransportUsb;
820         } else if (!strncmp(service, "transport-local", strlen("transport-local"))) {
821             type = kTransportLocal;
822         } else if (!strncmp(service, "transport-any", strlen("transport-any"))) {
823             type = kTransportAny;
824         } else if (!strncmp(service, "transport:", strlen("transport:"))) {
825             service += strlen("transport:");
826             serial = service;
827         }
828 
829         std::string error_msg = "unknown failure";
830         transport = acquire_one_transport(CS_ANY, type, serial, &error_msg);
831 
832         if (transport) {
833             s->transport = transport;
834             SendOkay(reply_fd);
835         } else {
836             SendFail(reply_fd, error_msg);
837         }
838         return 1;
839     }
840 
841     // return a list of all connected devices
842     if (!strncmp(service, "devices", 7)) {
843         bool long_listing = (strcmp(service+7, "-l") == 0);
844         if (long_listing || service[7] == 0) {
845             D("Getting device list...\n");
846             std::string device_list = list_transports(long_listing);
847             D("Sending device list...\n");
848             SendOkay(reply_fd);
849             SendProtocolString(reply_fd, device_list);
850             return 0;
851         }
852         return 1;
853     }
854 
855     // remove TCP transport
856     if (!strncmp(service, "disconnect:", 11)) {
857         char buffer[4096];
858         memset(buffer, 0, sizeof(buffer));
859         char* serial = service + 11;
860         if (serial[0] == 0) {
861             // disconnect from all TCP devices
862             unregister_all_tcp_transports();
863         } else {
864             char hostbuf[100];
865             // assume port 5555 if no port is specified
866             if (!strchr(serial, ':')) {
867                 snprintf(hostbuf, sizeof(hostbuf) - 1, "%s:5555", serial);
868                 serial = hostbuf;
869             }
870             atransport *t = find_transport(serial);
871 
872             if (t) {
873                 unregister_transport(t);
874             } else {
875                 snprintf(buffer, sizeof(buffer), "No such device %s", serial);
876             }
877         }
878 
879         SendOkay(reply_fd);
880         SendProtocolString(reply_fd, buffer);
881         return 0;
882     }
883 
884     // returns our value for ADB_SERVER_VERSION
885     if (!strcmp(service, "version")) {
886         SendOkay(reply_fd);
887         SendProtocolString(reply_fd, android::base::StringPrintf("%04x", ADB_SERVER_VERSION));
888         return 0;
889     }
890 
891     if(!strncmp(service,"get-serialno",strlen("get-serialno"))) {
892         const char *out = "unknown";
893         transport = acquire_one_transport(CS_ANY, ttype, serial, NULL);
894         if (transport && transport->serial) {
895             out = transport->serial;
896         }
897         SendOkay(reply_fd);
898         SendProtocolString(reply_fd, out);
899         return 0;
900     }
901     if(!strncmp(service,"get-devpath",strlen("get-devpath"))) {
902         const char *out = "unknown";
903         transport = acquire_one_transport(CS_ANY, ttype, serial, NULL);
904         if (transport && transport->devpath) {
905             out = transport->devpath;
906         }
907         SendOkay(reply_fd);
908         SendProtocolString(reply_fd, out);
909         return 0;
910     }
911     // indicates a new emulator instance has started
912     if (!strncmp(service,"emulator:",9)) {
913         int  port = atoi(service+9);
914         local_connect(port);
915         /* we don't even need to send a reply */
916         return 0;
917     }
918 
919     if(!strncmp(service,"get-state",strlen("get-state"))) {
920         transport = acquire_one_transport(CS_ANY, ttype, serial, NULL);
921         SendOkay(reply_fd);
922         SendProtocolString(reply_fd, transport->connection_state_name());
923         return 0;
924     }
925 #endif // ADB_HOST
926 
927     int ret = handle_forward_request(service, ttype, serial, reply_fd);
928     if (ret >= 0)
929       return ret - 1;
930     return -1;
931 }
932