1 /*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <regex>
18 #include <set>
19 #include <string>
20
21 #include <android-base/strings.h>
22 #include <android-base/stringprintf.h>
23
24 #define LOG_TAG "Netd"
25 #include <cutils/log.h>
26
27 #include "Controllers.h"
28 #include "IdletimerController.h"
29 #include "NetworkController.h"
30 #include "RouteController.h"
31 #include "Stopwatch.h"
32 #include "oem_iptables_hook.h"
33 #include "XfrmController.h"
34
35 namespace android {
36 namespace net {
37
38 using android::base::Join;
39 using android::base::StringPrintf;
40 using android::base::StringAppendF;
41
42 auto Controllers::execIptablesRestore = ::execIptablesRestore;
43 auto Controllers::execIptablesRestoreWithOutput = ::execIptablesRestoreWithOutput;
44
45 namespace {
46
47 /**
48 * List of module chains to be created, along with explicit ordering. ORDERING
49 * IS CRITICAL, AND SHOULD BE TRIPLE-CHECKED WITH EACH CHANGE.
50 */
51 static const std::vector<const char*> FILTER_INPUT = {
52 // Bandwidth should always be early in input chain, to make sure we
53 // correctly count incoming traffic against data plan.
54 BandwidthController::LOCAL_INPUT,
55 FirewallController::LOCAL_INPUT,
56 };
57
58 static const std::vector<const char*> FILTER_FORWARD = {
59 OEM_IPTABLES_FILTER_FORWARD,
60 FirewallController::LOCAL_FORWARD,
61 BandwidthController::LOCAL_FORWARD,
62 TetherController::LOCAL_FORWARD,
63 };
64
65 static const std::vector<const char*> FILTER_OUTPUT = {
66 OEM_IPTABLES_FILTER_OUTPUT,
67 FirewallController::LOCAL_OUTPUT,
68 StrictController::LOCAL_OUTPUT,
69 BandwidthController::LOCAL_OUTPUT,
70 };
71
72 static const std::vector<const char*> RAW_PREROUTING = {
73 BandwidthController::LOCAL_RAW_PREROUTING,
74 IdletimerController::LOCAL_RAW_PREROUTING,
75 TetherController::LOCAL_RAW_PREROUTING,
76 };
77
78 static const std::vector<const char*> MANGLE_POSTROUTING = {
79 OEM_IPTABLES_MANGLE_POSTROUTING,
80 BandwidthController::LOCAL_MANGLE_POSTROUTING,
81 IdletimerController::LOCAL_MANGLE_POSTROUTING,
82 };
83
84 static const std::vector<const char*> MANGLE_INPUT = {
85 WakeupController::LOCAL_MANGLE_INPUT,
86 RouteController::LOCAL_MANGLE_INPUT,
87 };
88
89 static const std::vector<const char*> MANGLE_FORWARD = {
90 TetherController::LOCAL_MANGLE_FORWARD,
91 };
92
93 static const std::vector<const char*> NAT_PREROUTING = {
94 OEM_IPTABLES_NAT_PREROUTING,
95 };
96
97 static const std::vector<const char*> NAT_POSTROUTING = {
98 TetherController::LOCAL_NAT_POSTROUTING,
99 };
100
101 // Commands to create child chains and to match created chains in iptables -S output. Keep in sync.
102 static const char* CHILD_CHAIN_TEMPLATE = "-A %s -j %s\n";
103 static const std::regex CHILD_CHAIN_REGEX("^-A ([^ ]+) -j ([^ ]+)$",
104 std::regex_constants::extended);
105
106 } // namespace
107
108 /* static */
findExistingChildChains(const IptablesTarget target,const char * table,const char * parentChain)109 std::set<std::string> Controllers::findExistingChildChains(const IptablesTarget target,
110 const char* table,
111 const char* parentChain) {
112 if (target == V4V6) {
113 ALOGE("findExistingChildChains only supports one protocol at a time");
114 abort();
115 }
116
117 std::set<std::string> existing;
118
119 // List the current contents of parentChain.
120 //
121 // TODO: there is no guarantee that nothing else modifies the chain in the few milliseconds
122 // between when we list the existing rules and when we delete them. However:
123 // - Since this code is only run on startup, nothing else in netd will be running.
124 // - While vendor code is known to add its own rules to chains created by netd, it should never
125 // be modifying the rules in childChains or the rules that hook said chains into their parent
126 // chains.
127 std::string command = StringPrintf("*%s\n-S %s\nCOMMIT\n", table, parentChain);
128 std::string output;
129 if (Controllers::execIptablesRestoreWithOutput(target, command, &output) == -1) {
130 ALOGE("Error listing chain %s in table %s\n", parentChain, table);
131 return existing;
132 }
133
134 // The only rules added by createChildChains are of the simple form "-A <parent> -j <child>".
135 // Find those rules and add each one's child chain to existing.
136 std::smatch matches;
137 std::stringstream stream(output);
138 std::string rule;
139 while (std::getline(stream, rule, '\n')) {
140 if (std::regex_search(rule, matches, CHILD_CHAIN_REGEX) && matches[1] == parentChain) {
141 existing.insert(matches[2]);
142 }
143 }
144
145 return existing;
146 }
147
148 /* static */
createChildChains(IptablesTarget target,const char * table,const char * parentChain,const std::vector<const char * > & childChains,bool exclusive)149 void Controllers::createChildChains(IptablesTarget target, const char* table,
150 const char* parentChain,
151 const std::vector<const char*>& childChains,
152 bool exclusive) {
153 std::string command = StringPrintf("*%s\n", table);
154
155 // We cannot just clear all the chains we create because vendor code modifies filter OUTPUT and
156 // mangle POSTROUTING directly. So:
157 //
158 // - If we're the exclusive owner of this chain, simply clear it entirely.
159 // - If not, then list the chain's current contents to ensure that if we restart after a crash,
160 // we leave the existing rules alone in the positions they currently occupy. This is faster
161 // than blindly deleting our rules and recreating them, because deleting a rule that doesn't
162 // exists causes iptables-restore to quit, which takes ~30ms per delete. It's also more
163 // correct, because if we delete rules and re-add them, they'll be in the wrong position with
164 // regards to the vendor rules.
165 //
166 // TODO: Make all chains exclusive once vendor code uses the oem_* rules.
167 std::set<std::string> existingChildChains;
168 if (exclusive) {
169 // Just running ":chain -" flushes user-defined chains, but not built-in chains like INPUT.
170 // Since at this point we don't know if parentChain is a built-in chain, do both.
171 StringAppendF(&command, ":%s -\n", parentChain);
172 StringAppendF(&command, "-F %s\n", parentChain);
173 } else {
174 existingChildChains = findExistingChildChains(target, table, parentChain);
175 }
176
177 for (const auto& childChain : childChains) {
178 // Always clear the child chain.
179 StringAppendF(&command, ":%s -\n", childChain);
180 // But only add it to the parent chain if it's not already there.
181 if (existingChildChains.find(childChain) == existingChildChains.end()) {
182 StringAppendF(&command, CHILD_CHAIN_TEMPLATE, parentChain, childChain);
183 }
184 }
185 command += "COMMIT\n";
186 execIptablesRestore(target, command);
187 }
188
Controllers()189 Controllers::Controllers()
190 : clatdCtrl(&netCtrl),
191 wakeupCtrl(
192 [this](const WakeupController::ReportArgs& args) {
193 const auto listener = eventReporter.getNetdEventListener();
194 if (listener == nullptr) {
195 ALOGE("getNetdEventListener() returned nullptr. dropping wakeup event");
196 return;
197 }
198 String16 prefix = String16(args.prefix.c_str());
199 String16 srcIp = String16(args.srcIp.c_str());
200 String16 dstIp = String16(args.dstIp.c_str());
201 listener->onWakeupEvent(prefix, args.uid, args.ethertype, args.ipNextHeader,
202 args.dstHw, srcIp, dstIp, args.srcPort, args.dstPort,
203 args.timestampNs);
204 },
205 &iptablesRestoreCtrl) {
206 InterfaceController::initializeAll();
207 }
208
initChildChains()209 void Controllers::initChildChains() {
210 /*
211 * This is the only time we touch top-level chains in iptables; controllers
212 * should only mutate rules inside of their children chains, as created by
213 * the constants above.
214 *
215 * Modules should never ACCEPT packets (except in well-justified cases);
216 * they should instead defer to any remaining modules using RETURN, or
217 * otherwise DROP/REJECT.
218 */
219
220 // Create chains for child modules.
221 createChildChains(V4V6, "filter", "INPUT", FILTER_INPUT, true);
222 createChildChains(V4V6, "filter", "FORWARD", FILTER_FORWARD, true);
223 createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING, true);
224 createChildChains(V4V6, "mangle", "FORWARD", MANGLE_FORWARD, true);
225 createChildChains(V4V6, "mangle", "INPUT", MANGLE_INPUT, true);
226 createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING, true);
227 createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING, true);
228
229 createChildChains(V4, "filter", "OUTPUT", FILTER_OUTPUT, false);
230 createChildChains(V6, "filter", "OUTPUT", FILTER_OUTPUT, false);
231 createChildChains(V4, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
232 createChildChains(V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
233 }
234
initIptablesRules()235 void Controllers::initIptablesRules() {
236 Stopwatch s;
237 initChildChains();
238 ALOGI("Creating child chains: %.1fms", s.getTimeAndReset());
239
240 // Let each module setup their child chains
241 setupOemIptablesHook();
242 ALOGI("Setting up OEM hooks: %.1fms", s.getTimeAndReset());
243
244 /* When enabled, DROPs all packets except those matching rules. */
245 firewallCtrl.setupIptablesHooks();
246 ALOGI("Setting up FirewallController hooks: %.1fms", s.getTimeAndReset());
247
248 /* Does DROPs in FORWARD by default */
249 tetherCtrl.setupIptablesHooks();
250 ALOGI("Setting up TetherController hooks: %.1fms", s.getTimeAndReset());
251
252 /*
253 * Does REJECT in INPUT, OUTPUT. Does counting also.
254 * No DROP/REJECT allowed later in netfilter-flow hook order.
255 */
256 bandwidthCtrl.setupIptablesHooks();
257 ALOGI("Setting up BandwidthController hooks: %.1fms", s.getTimeAndReset());
258
259 /*
260 * Counts in nat: PREROUTING, POSTROUTING.
261 * No DROP/REJECT allowed later in netfilter-flow hook order.
262 */
263 idletimerCtrl.setupIptablesHooks();
264 ALOGI("Setting up IdletimerController hooks: %.1fms", s.getTimeAndReset());
265 }
266
init()267 void Controllers::init() {
268 initIptablesRules();
269 Stopwatch s;
270 netdutils::Status tcStatus = trafficCtrl.start();
271 if (!isOk(tcStatus)) {
272 ALOGE("failed to start trafficcontroller: (%s)", toString(tcStatus).c_str());
273 }
274 ALOGI("initializing traffic control: %.1fms", s.getTimeAndReset());
275
276 bandwidthCtrl.enableBandwidthControl(false);
277 ALOGI("Disabling bandwidth control: %.1fms", s.getTimeAndReset());
278
279 if (int ret = RouteController::Init(NetworkController::LOCAL_NET_ID)) {
280 ALOGE("failed to initialize RouteController (%s)", strerror(-ret));
281 }
282 ALOGI("Initializing RouteController: %.1fms", s.getTimeAndReset());
283
284 netdutils::Status xStatus = XfrmController::Init();
285 if (!isOk(xStatus)) {
286 ALOGE("Failed to initialize XfrmController (%s)", netdutils::toString(xStatus).c_str());
287 };
288 ALOGI("Initializing XfrmController: %.1fms", s.getTimeAndReset());
289 }
290
291 Controllers* gCtls = nullptr;
292
293 } // namespace net
294 } // namespace android
295