1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef NETD_SERVER_IPTABLES_RESTORE_CONTROLLER_H 18 #define NETD_SERVER_IPTABLES_RESTORE_CONTROLLER_H 19 20 #include <memory> 21 #include <mutex> 22 #include <sys/types.h> 23 24 #include "NetdConstants.h" 25 26 class IptablesProcess; 27 28 class IptablesRestoreInterface { 29 public: 30 virtual ~IptablesRestoreInterface() = default; 31 32 // Execute |commands| on the given |target|, and populate |output| with stdout. 33 virtual int execute(const IptablesTarget target, const std::string& commands, 34 std::string* output) = 0; 35 }; 36 37 class IptablesRestoreController final : public IptablesRestoreInterface { 38 public: 39 // Not for general use. Use gCtls->iptablesRestoreCtrl 40 // to get an instance of this class. 41 IptablesRestoreController(); 42 43 ~IptablesRestoreController() override; 44 45 int execute(const IptablesTarget target, const std::string& commands, 46 std::string* output) override; 47 48 enum IptablesProcessType { 49 IPTABLES_PROCESS, 50 IP6TABLES_PROCESS, 51 INVALID_PROCESS = -1, 52 }; 53 54 // Called by the SIGCHLD signal handler when it detects that one 55 // of the forked iptables[6]-restore process has died. 56 IptablesProcessType notifyChildTermination(pid_t pid); 57 58 protected: 59 friend class IptablesRestoreControllerTest; 60 pid_t getIpRestorePid(const IptablesProcessType type); 61 62 // The maximum number of times we poll(2) for a response on our set of polled 63 // fds. Chosen so that the overall timeout is 5s. The timeout is so high because 64 // our version of iptables still polls every second in xtables_lock. 65 static int MAX_RETRIES; 66 67 // The timeout (in millis) for each call to poll. The maximum wait is 68 // |POLL_TIMEOUT_MS * MAX_RETRIES|. Chosen so that the overall timeout is 1s. 69 static int POLL_TIMEOUT_MS; 70 71 void Init(); 72 73 private: 74 static IptablesProcess* forkAndExec(const IptablesProcessType type); 75 76 int sendCommand(const IptablesProcessType type, const std::string& command, 77 std::string *output); 78 79 static bool drainAndWaitForAck(const std::unique_ptr<IptablesProcess> &process, 80 const std::string& command, 81 std::string *output); 82 83 static void maybeLogStderr(const std::unique_ptr<IptablesProcess> &process, 84 const std::string& command); 85 86 // Guards calls to execute(). 87 std::mutex mLock; 88 89 std::unique_ptr<IptablesProcess> mIpRestore; 90 std::unique_ptr<IptablesProcess> mIp6Restore; 91 }; 92 93 #endif // NETD_SERVER_IPTABLES_RESTORE_CONTROLLER_H 94