1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <regex>
18 #include <set>
19 #include <string>
20 
21 #include <android-base/strings.h>
22 #include <android-base/stringprintf.h>
23 
24 #define LOG_TAG "Netd"
25 #include <cutils/log.h>
26 
27 #include "Controllers.h"
28 #include "IdletimerController.h"
29 #include "NetworkController.h"
30 #include "RouteController.h"
31 #include "Stopwatch.h"
32 #include "oem_iptables_hook.h"
33 #include "XfrmController.h"
34 
35 namespace android {
36 namespace net {
37 
38 using android::base::Join;
39 using android::base::StringPrintf;
40 using android::base::StringAppendF;
41 
42 auto Controllers::execIptablesRestore  = ::execIptablesRestore;
43 auto Controllers::execIptablesRestoreWithOutput = ::execIptablesRestoreWithOutput;
44 
45 namespace {
46 
47 /**
48  * List of module chains to be created, along with explicit ordering. ORDERING
49  * IS CRITICAL, AND SHOULD BE TRIPLE-CHECKED WITH EACH CHANGE.
50  */
51 static const std::vector<const char*> FILTER_INPUT = {
52         // Bandwidth should always be early in input chain, to make sure we
53         // correctly count incoming traffic against data plan.
54         BandwidthController::LOCAL_INPUT,
55         FirewallController::LOCAL_INPUT,
56 };
57 
58 static const std::vector<const char*> FILTER_FORWARD = {
59         OEM_IPTABLES_FILTER_FORWARD,
60         FirewallController::LOCAL_FORWARD,
61         BandwidthController::LOCAL_FORWARD,
62         TetherController::LOCAL_FORWARD,
63 };
64 
65 static const std::vector<const char*> FILTER_OUTPUT = {
66         OEM_IPTABLES_FILTER_OUTPUT,
67         FirewallController::LOCAL_OUTPUT,
68         StrictController::LOCAL_OUTPUT,
69         BandwidthController::LOCAL_OUTPUT,
70 };
71 
72 static const std::vector<const char*> RAW_PREROUTING = {
73         BandwidthController::LOCAL_RAW_PREROUTING,
74         IdletimerController::LOCAL_RAW_PREROUTING,
75         TetherController::LOCAL_RAW_PREROUTING,
76 };
77 
78 static const std::vector<const char*> MANGLE_POSTROUTING = {
79         OEM_IPTABLES_MANGLE_POSTROUTING,
80         BandwidthController::LOCAL_MANGLE_POSTROUTING,
81         IdletimerController::LOCAL_MANGLE_POSTROUTING,
82 };
83 
84 static const std::vector<const char*> MANGLE_INPUT = {
85         WakeupController::LOCAL_MANGLE_INPUT,
86         RouteController::LOCAL_MANGLE_INPUT,
87 };
88 
89 static const std::vector<const char*> MANGLE_FORWARD = {
90         TetherController::LOCAL_MANGLE_FORWARD,
91 };
92 
93 static const std::vector<const char*> NAT_PREROUTING = {
94         OEM_IPTABLES_NAT_PREROUTING,
95 };
96 
97 static const std::vector<const char*> NAT_POSTROUTING = {
98         TetherController::LOCAL_NAT_POSTROUTING,
99 };
100 
101 // Commands to create child chains and to match created chains in iptables -S output. Keep in sync.
102 static const char* CHILD_CHAIN_TEMPLATE = "-A %s -j %s\n";
103 static const std::regex CHILD_CHAIN_REGEX("^-A ([^ ]+) -j ([^ ]+)$",
104                                           std::regex_constants::extended);
105 
106 }  // namespace
107 
108 /* static */
findExistingChildChains(const IptablesTarget target,const char * table,const char * parentChain)109 std::set<std::string> Controllers::findExistingChildChains(const IptablesTarget target,
110                                                            const char* table,
111                                                            const char* parentChain) {
112     if (target == V4V6) {
113         ALOGE("findExistingChildChains only supports one protocol at a time");
114         abort();
115     }
116 
117     std::set<std::string> existing;
118 
119     // List the current contents of parentChain.
120     //
121     // TODO: there is no guarantee that nothing else modifies the chain in the few milliseconds
122     // between when we list the existing rules and when we delete them. However:
123     // - Since this code is only run on startup, nothing else in netd will be running.
124     // - While vendor code is known to add its own rules to chains created by netd, it should never
125     //   be modifying the rules in childChains or the rules that hook said chains into their parent
126     //   chains.
127     std::string command = StringPrintf("*%s\n-S %s\nCOMMIT\n", table, parentChain);
128     std::string output;
129     if (Controllers::execIptablesRestoreWithOutput(target, command, &output) == -1) {
130         ALOGE("Error listing chain %s in table %s\n", parentChain, table);
131         return existing;
132     }
133 
134     // The only rules added by createChildChains are of the simple form "-A <parent> -j <child>".
135     // Find those rules and add each one's child chain to existing.
136     std::smatch matches;
137     std::stringstream stream(output);
138     std::string rule;
139     while (std::getline(stream, rule, '\n')) {
140         if (std::regex_search(rule, matches, CHILD_CHAIN_REGEX) && matches[1] == parentChain) {
141             existing.insert(matches[2]);
142         }
143     }
144 
145     return existing;
146 }
147 
148 /* static */
createChildChains(IptablesTarget target,const char * table,const char * parentChain,const std::vector<const char * > & childChains,bool exclusive)149 void Controllers::createChildChains(IptablesTarget target, const char* table,
150                                     const char* parentChain,
151                                     const std::vector<const char*>& childChains,
152                                     bool exclusive) {
153     std::string command = StringPrintf("*%s\n", table);
154 
155     // We cannot just clear all the chains we create because vendor code modifies filter OUTPUT and
156     // mangle POSTROUTING directly. So:
157     //
158     // - If we're the exclusive owner of this chain, simply clear it entirely.
159     // - If not, then list the chain's current contents to ensure that if we restart after a crash,
160     //   we leave the existing rules alone in the positions they currently occupy. This is faster
161     //   than blindly deleting our rules and recreating them, because deleting a rule that doesn't
162     //   exists causes iptables-restore to quit, which takes ~30ms per delete. It's also more
163     //   correct, because if we delete rules and re-add them, they'll be in the wrong position with
164     //   regards to the vendor rules.
165     //
166     // TODO: Make all chains exclusive once vendor code uses the oem_* rules.
167     std::set<std::string> existingChildChains;
168     if (exclusive) {
169         // Just running ":chain -" flushes user-defined chains, but not built-in chains like INPUT.
170         // Since at this point we don't know if parentChain is a built-in chain, do both.
171         StringAppendF(&command, ":%s -\n", parentChain);
172         StringAppendF(&command, "-F %s\n", parentChain);
173     } else {
174         existingChildChains = findExistingChildChains(target, table, parentChain);
175     }
176 
177     for (const auto& childChain : childChains) {
178         // Always clear the child chain.
179         StringAppendF(&command, ":%s -\n", childChain);
180         // But only add it to the parent chain if it's not already there.
181         if (existingChildChains.find(childChain) == existingChildChains.end()) {
182             StringAppendF(&command, CHILD_CHAIN_TEMPLATE, parentChain, childChain);
183         }
184     }
185     command += "COMMIT\n";
186     execIptablesRestore(target, command);
187 }
188 
Controllers()189 Controllers::Controllers()
190     : clatdCtrl(&netCtrl),
191       wakeupCtrl(
192           [this](const WakeupController::ReportArgs& args) {
193               const auto listener = eventReporter.getNetdEventListener();
194               if (listener == nullptr) {
195                   ALOGE("getNetdEventListener() returned nullptr. dropping wakeup event");
196                   return;
197               }
198               String16 prefix = String16(args.prefix.c_str());
199               String16 srcIp = String16(args.srcIp.c_str());
200               String16 dstIp = String16(args.dstIp.c_str());
201               listener->onWakeupEvent(prefix, args.uid, args.ethertype, args.ipNextHeader,
202                                       args.dstHw, srcIp, dstIp, args.srcPort, args.dstPort,
203                                       args.timestampNs);
204           },
205           &iptablesRestoreCtrl) {
206     InterfaceController::initializeAll();
207 }
208 
initChildChains()209 void Controllers::initChildChains() {
210     /*
211      * This is the only time we touch top-level chains in iptables; controllers
212      * should only mutate rules inside of their children chains, as created by
213      * the constants above.
214      *
215      * Modules should never ACCEPT packets (except in well-justified cases);
216      * they should instead defer to any remaining modules using RETURN, or
217      * otherwise DROP/REJECT.
218      */
219 
220     // Create chains for child modules.
221     createChildChains(V4V6, "filter", "INPUT", FILTER_INPUT, true);
222     createChildChains(V4V6, "filter", "FORWARD", FILTER_FORWARD, true);
223     createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING, true);
224     createChildChains(V4V6, "mangle", "FORWARD", MANGLE_FORWARD, true);
225     createChildChains(V4V6, "mangle", "INPUT", MANGLE_INPUT, true);
226     createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING, true);
227     createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING, true);
228 
229     createChildChains(V4, "filter", "OUTPUT", FILTER_OUTPUT, false);
230     createChildChains(V6, "filter", "OUTPUT", FILTER_OUTPUT, false);
231     createChildChains(V4, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
232     createChildChains(V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
233 }
234 
initIptablesRules()235 void Controllers::initIptablesRules() {
236     Stopwatch s;
237     initChildChains();
238     ALOGI("Creating child chains: %.1fms", s.getTimeAndReset());
239 
240     // Let each module setup their child chains
241     setupOemIptablesHook();
242     ALOGI("Setting up OEM hooks: %.1fms", s.getTimeAndReset());
243 
244     /* When enabled, DROPs all packets except those matching rules. */
245     firewallCtrl.setupIptablesHooks();
246     ALOGI("Setting up FirewallController hooks: %.1fms", s.getTimeAndReset());
247 
248     /* Does DROPs in FORWARD by default */
249     tetherCtrl.setupIptablesHooks();
250     ALOGI("Setting up TetherController hooks: %.1fms", s.getTimeAndReset());
251 
252     /*
253      * Does REJECT in INPUT, OUTPUT. Does counting also.
254      * No DROP/REJECT allowed later in netfilter-flow hook order.
255      */
256     bandwidthCtrl.setupIptablesHooks();
257     ALOGI("Setting up BandwidthController hooks: %.1fms", s.getTimeAndReset());
258 
259     /*
260      * Counts in nat: PREROUTING, POSTROUTING.
261      * No DROP/REJECT allowed later in netfilter-flow hook order.
262      */
263     idletimerCtrl.setupIptablesHooks();
264     ALOGI("Setting up IdletimerController hooks: %.1fms", s.getTimeAndReset());
265 }
266 
init()267 void Controllers::init() {
268     initIptablesRules();
269     Stopwatch s;
270     netdutils::Status tcStatus = trafficCtrl.start();
271     if (!isOk(tcStatus)) {
272         ALOGE("failed to start trafficcontroller: (%s)", toString(tcStatus).c_str());
273     }
274     ALOGI("initializing traffic control: %.1fms", s.getTimeAndReset());
275 
276     bandwidthCtrl.enableBandwidthControl(false);
277     ALOGI("Disabling bandwidth control: %.1fms", s.getTimeAndReset());
278 
279     if (int ret = RouteController::Init(NetworkController::LOCAL_NET_ID)) {
280         ALOGE("failed to initialize RouteController (%s)", strerror(-ret));
281     }
282     ALOGI("Initializing RouteController: %.1fms", s.getTimeAndReset());
283 
284     netdutils::Status xStatus = XfrmController::Init();
285     if (!isOk(xStatus)) {
286         ALOGE("Failed to initialize XfrmController (%s)", netdutils::toString(xStatus).c_str());
287     };
288     ALOGI("Initializing XfrmController: %.1fms", s.getTimeAndReset());
289 }
290 
291 Controllers* gCtls = nullptr;
292 
293 }  // namespace net
294 }  // namespace android
295