1 /*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 /*
18 * MODUS OPERANDI
19 * --------------
20 *
21 * IPTABLES command sequence:
22 *
23 * iptables -F
24 *
25 * iptables -t raw -F idletimer_PREROUTING
26 * iptables -t mangle -F idletimer_POSTROUTING
27 *
28 *
29 * iptables -t raw -N idletimer_PREROUTING
30 * iptables -t mangle -N idletimer_POSTROUTING
31 *
32 * iptables -t raw -D PREROUTING -j idletimer_PREROUTING
33 * iptables -t mangle -D POSTROUTING -j idletimer_POSTROUTING
34 *
35 *
36 * iptables -t raw -I PREROUTING -j idletimer_PREROUTING
37 * iptables -t mangle -I POSTROUTING -j idletimer_POSTROUTING
38 *
39 * # For notifications to work the lable name must match the name of a valid interface.
40 * # If the label name does match an interface, the rules will be a no-op.
41 *
42 * iptables -t raw -A idletimer_PREROUTING -i rmnet0 -j IDLETIMER --timeout 5 --label test-chain --send_nl_msg
43 * iptables -t mangle -A idletimer_POSTROUTING -o rmnet0 -j IDLETIMER --timeout 5 --label test-chain --send_nl_msg
44 *
45 * iptables -nxvL -t raw
46 * iptables -nxvL -t mangle
47 *
48 * =================
49 *
50 * ndc command sequence
51 * ------------------
52 * ndc idletimer enable
53 * ndc idletimer add <iface> <timeout> <class label>
54 * ndc idletimer remove <iface> <timeout> <class label>
55 *
56 * Monitor effect on the iptables chains after each step using:
57 * iptables -nxvL -t raw
58 * iptables -nxvL -t mangle
59 *
60 * Remember that the timeout value has to be same at the time of the
61 * removal.
62 *
63 * =================
64 *
65 * Verifying the iptables rule
66 * ---------------------------
67 * We want to make sure the iptable rules capture every packet. It can be
68 * verified with tcpdump. First take a note of the pkts count for the two rules:
69 *
70 * adb shell iptables -t mangle -L idletimer_mangle_POSTROUTING -v && adb shell iptables -t raw -L idletimer_raw_PREROUTING -v
71 *
72 * And then, before any network traffics happen on the device, run tcpdump:
73 *
74 * adb shell tcpdump | tee tcpdump.log
75 *
76 * After a while run iptables commands again, you could then count the number
77 * of incoming and outgoing packets captured by tcpdump, and compare that with
78 * the numbers reported by iptables command. There shouldn't be too much
79 * difference on these numbers, i.e., with 2000 packets captured it should
80 * differ by less than 5.
81 *
82 * =================
83 *
84 * Note that currently if the name of the iface is incorrect, iptables
85 * will setup rules without checking if it is the name of a valid
86 * interface (although no notifications will ever be received). It is
87 * the responsibility of code in Java land to ensure that the interface name
88 * is correct. The benefit of this, is that idletimers can be setup on
89 * interfaces than come and go.
90 *
91 * A remove should be called for each add command issued during cleanup, as duplicate
92 * entries of the rule may exist and will all have to removed.
93 *
94 */
95
96 #define LOG_NDEBUG 0
97
98 #include <string>
99 #include <vector>
100
101 #include <stdint.h>
102 #include <stdlib.h>
103 #include <errno.h>
104 #include <sys/socket.h>
105 #include <sys/stat.h>
106 #include <sys/wait.h>
107 #include <fcntl.h>
108 #include <netinet/in.h>
109 #include <arpa/inet.h>
110 #include <string.h>
111 #include <cutils/properties.h>
112
113 #include <android-base/strings.h>
114 #include <android-base/stringprintf.h>
115
116 #define LOG_TAG "IdletimerController"
117 #include <log/log.h>
118
119 #include "IdletimerController.h"
120 #include "NetdConstants.h"
121
122 using android::base::Join;
123 using android::base::StringPrintf;
124
125 const char* IdletimerController::LOCAL_RAW_PREROUTING = "idletimer_raw_PREROUTING";
126 const char* IdletimerController::LOCAL_MANGLE_POSTROUTING = "idletimer_mangle_POSTROUTING";
127
128 auto IdletimerController::execIptablesRestore = ::execIptablesRestore;
129
IdletimerController()130 IdletimerController::IdletimerController() {
131 }
132
~IdletimerController()133 IdletimerController::~IdletimerController() {
134 }
135
setupIptablesHooks()136 bool IdletimerController::setupIptablesHooks() {
137 return true;
138 }
139
modifyInterfaceIdletimer(IptOp op,const char * iface,uint32_t timeout,const char * classLabel)140 int IdletimerController::modifyInterfaceIdletimer(IptOp op, const char *iface,
141 uint32_t timeout,
142 const char *classLabel) {
143 if (!isIfaceName(iface)) {
144 errno = ENOENT;
145 return -1;
146 }
147
148 const char *addRemove = (op == IptOpAdd) ? "-A" : "-D";
149 std::vector<std::string> cmds = {
150 "*raw",
151 StringPrintf("%s %s -i %s -j IDLETIMER --timeout %u --label %s --send_nl_msg",
152 addRemove, LOCAL_RAW_PREROUTING, iface, timeout, classLabel),
153 "COMMIT",
154 "*mangle",
155 StringPrintf("%s %s -o %s -j IDLETIMER --timeout %u --label %s --send_nl_msg",
156 addRemove, LOCAL_MANGLE_POSTROUTING, iface, timeout, classLabel),
157 "COMMIT\n",
158 };
159
160 return (execIptablesRestore(V4V6, Join(cmds, '\n')) == 0) ? 0 : -EREMOTEIO;
161 }
162
addInterfaceIdletimer(const char * iface,uint32_t timeout,const char * classLabel)163 int IdletimerController::addInterfaceIdletimer(const char *iface,
164 uint32_t timeout,
165 const char *classLabel) {
166 return modifyInterfaceIdletimer(IptOpAdd, iface, timeout, classLabel);
167 }
168
removeInterfaceIdletimer(const char * iface,uint32_t timeout,const char * classLabel)169 int IdletimerController::removeInterfaceIdletimer(const char *iface,
170 uint32_t timeout,
171 const char *classLabel) {
172 return modifyInterfaceIdletimer(IptOpDelete, iface, timeout, classLabel);
173 }
174