1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "IptablesRestoreController"
18 #include "IptablesRestoreController.h"
19
20 #include <poll.h>
21 #include <signal.h>
22 #include <sys/wait.h>
23 #include <unistd.h>
24
25 #include <android-base/logging.h>
26 #include <android-base/file.h>
27 #include <netdutils/Syscalls.h>
28
29 #include "Controllers.h"
30 #include "NetdConstants.h"
31
32 using android::netdutils::StatusOr;
33 using android::netdutils::sSyscalls;
34
35 constexpr char IPTABLES_RESTORE_PATH[] = "/system/bin/iptables-restore";
36 constexpr char IP6TABLES_RESTORE_PATH[] = "/system/bin/ip6tables-restore";
37
38 constexpr char PING[] = "#PING\n";
39
40 constexpr size_t PING_SIZE = sizeof(PING) - 1;
41
42 // Not compile-time constants because they are changed by the unit tests.
43 int IptablesRestoreController::MAX_RETRIES = 50;
44 int IptablesRestoreController::POLL_TIMEOUT_MS = 100;
45
46 class IptablesProcess {
47 public:
IptablesProcess(const IptablesRestoreController::IptablesProcessType type,pid_t pid,int stdIn,int stdOut,int stdErr)48 IptablesProcess(const IptablesRestoreController::IptablesProcessType type,
49 pid_t pid, int stdIn, int stdOut, int stdErr) :
50 type(type),
51 pid(pid),
52 stdIn(stdIn),
53 processTerminated(false) {
54
55 pollFds[STDOUT_IDX] = { .fd = stdOut, .events = POLLIN };
56 pollFds[STDERR_IDX] = { .fd = stdErr, .events = POLLIN };
57 }
58
~IptablesProcess()59 ~IptablesProcess() {
60 close(stdIn);
61 close(pollFds[STDOUT_IDX].fd);
62 close(pollFds[STDERR_IDX].fd);
63 }
64
outputReady()65 bool outputReady() {
66 struct pollfd pollfd = { .fd = stdIn, .events = POLLOUT };
67 int ret = poll(&pollfd, 1, 0);
68 if (ret == -1) {
69 ALOGE("outputReady poll failed: %s", strerror(errno));
70 return false;
71 }
72 return (ret == 1) && !(pollfd.revents & POLLERR);
73 }
74
stop()75 void stop() {
76 if (processTerminated) return;
77
78 // This can be called by drainAndWaitForAck (after a POLLHUP) or by sendCommand (if the
79 // process was killed by something else on the system). In both cases, it's safe to send the
80 // PID a SIGTERM, because the PID continues to exist until its parent (i.e., us) calls
81 // waitpid on it, so there's no risk that the PID is reused.
82 ::stopProcess(pid, (type == IptablesRestoreController::IPTABLES_PROCESS) ?
83 "iptables-restore" : "ip6tables-restore");
84
85 processTerminated = true;
86 }
87
88 const IptablesRestoreController::IptablesProcessType type;
89 const pid_t pid; // NOLINT(misc-non-private-member-variables-in-classes)
90 const int stdIn; // NOLINT(misc-non-private-member-variables-in-classes)
91
92 struct pollfd pollFds[2];
93 std::string errBuf;
94
95 std::atomic_bool processTerminated;
96
97 static constexpr size_t STDOUT_IDX = 0;
98 static constexpr size_t STDERR_IDX = 1;
99 };
100
IptablesRestoreController()101 IptablesRestoreController::IptablesRestoreController() {
102 Init();
103 }
104
~IptablesRestoreController()105 IptablesRestoreController::~IptablesRestoreController() {
106 }
107
Init()108 void IptablesRestoreController::Init() {
109 // We cannot fork these in parallel or a child process could inherit the pipe fds intended for
110 // use by the other child process. see https://android-review.googlesource.com/469559 for what
111 // breaks. This does not cause a latency hit, because the parent only has to wait for
112 // forkAndExec, which is sub-millisecond, and the child processes then call exec() in parallel.
113 mIpRestore.reset(forkAndExec(IPTABLES_PROCESS));
114 mIp6Restore.reset(forkAndExec(IP6TABLES_PROCESS));
115 }
116
117 /* static */
forkAndExec(const IptablesProcessType type)118 IptablesProcess* IptablesRestoreController::forkAndExec(const IptablesProcessType type) {
119 const char* const cmd = (type == IPTABLES_PROCESS) ?
120 IPTABLES_RESTORE_PATH : IP6TABLES_RESTORE_PATH;
121
122 // Create the pipes we'll use for communication with the child
123 // process. One each for the child's in, out and err files.
124 int stdin_pipe[2];
125 int stdout_pipe[2];
126 int stderr_pipe[2];
127
128 if (pipe2(stdin_pipe, O_CLOEXEC) == -1 ||
129 pipe2(stdout_pipe, O_NONBLOCK | O_CLOEXEC) == -1 ||
130 pipe2(stderr_pipe, O_NONBLOCK | O_CLOEXEC) == -1) {
131
132 ALOGE("pipe2() failed: %s", strerror(errno));
133 return nullptr;
134 }
135
136 const auto& sys = sSyscalls.get();
137 StatusOr<pid_t> child_pid = sys.fork();
138 if (!isOk(child_pid)) {
139 ALOGE("fork() failed: %s", strerror(child_pid.status().code()));
140 return nullptr;
141 }
142
143 if (child_pid.value() == 0) {
144 // The child process. Reads from stdin, writes to stderr and stdout.
145
146 // stdin_pipe[0] : The read end of the stdin pipe.
147 // stdout_pipe[1] : The write end of the stdout pipe.
148 // stderr_pipe[1] : The write end of the stderr pipe.
149 if (dup2(stdin_pipe[0], 0) == -1 ||
150 dup2(stdout_pipe[1], 1) == -1 ||
151 dup2(stderr_pipe[1], 2) == -1) {
152 ALOGE("dup2() failed: %s", strerror(errno));
153 abort();
154 }
155
156 if (execl(cmd,
157 cmd,
158 "--noflush", // Don't flush the whole table.
159 "-w", // Wait instead of failing if the lock is held.
160 "-v", // Verbose mode, to make sure our ping is echoed
161 // back to us.
162 nullptr) == -1) {
163 ALOGE("execl(%s, ...) failed: %s", cmd, strerror(errno));
164 abort();
165 }
166
167 // This statement is unreachable. We abort() upon error, and execl
168 // if everything goes well.
169 return nullptr;
170 }
171
172 // The parent process. Writes to stdout and stderr and reads from stdin.
173 // stdin_pipe[0] : The read end of the stdin pipe.
174 // stdout_pipe[1] : The write end of the stdout pipe.
175 // stderr_pipe[1] : The write end of the stderr pipe.
176 if (close(stdin_pipe[0]) == -1 ||
177 close(stdout_pipe[1]) == -1 ||
178 close(stderr_pipe[1]) == -1) {
179 ALOGW("close() failed: %s", strerror(errno));
180 }
181
182 return new IptablesProcess(type,
183 child_pid.value(), stdin_pipe[1], stdout_pipe[0], stderr_pipe[0]);
184 }
185
186 // TODO: Return -errno on failure instead of -1.
187 // TODO: Maybe we should keep a rotating buffer of the last N commands
188 // so that they can be dumped on dumpsys.
sendCommand(const IptablesProcessType type,const std::string & command,std::string * output)189 int IptablesRestoreController::sendCommand(const IptablesProcessType type,
190 const std::string& command,
191 std::string *output) {
192 std::unique_ptr<IptablesProcess> *process =
193 (type == IPTABLES_PROCESS) ? &mIpRestore : &mIp6Restore;
194
195
196 // We might need to fork a new process if we haven't forked one yet, or
197 // if the forked process terminated.
198 //
199 // NOTE: For a given command, this is the last point at which we try to
200 // recover from a child death. If the child dies at some later point during
201 // the execution of this method, we will receive an EPIPE and return an
202 // error. The command will then need to be retried at a higher level.
203 IptablesProcess *existingProcess = process->get();
204 if (existingProcess != nullptr && !existingProcess->outputReady()) {
205 existingProcess->stop();
206 existingProcess = nullptr;
207 }
208
209 if (existingProcess == nullptr) {
210 // Fork a new iptables[6]-restore process.
211 IptablesProcess *newProcess = IptablesRestoreController::forkAndExec(type);
212 if (newProcess == nullptr) {
213 LOG(ERROR) << "Unable to fork ip[6]tables-restore, type: " << type;
214 return -1;
215 }
216
217 process->reset(newProcess);
218 }
219
220 if (!android::base::WriteFully((*process)->stdIn, command.data(), command.length())) {
221 ALOGE("Unable to send command: %s", strerror(errno));
222 return -1;
223 }
224
225 if (!android::base::WriteFully((*process)->stdIn, PING, PING_SIZE)) {
226 ALOGE("Unable to send ping command: %s", strerror(errno));
227 return -1;
228 }
229
230 if (!drainAndWaitForAck(*process, command, output)) {
231 // drainAndWaitForAck has already logged an error.
232 return -1;
233 }
234
235 return 0;
236 }
237
maybeLogStderr(const std::unique_ptr<IptablesProcess> & process,const std::string & command)238 void IptablesRestoreController::maybeLogStderr(const std::unique_ptr<IptablesProcess> &process,
239 const std::string& command) {
240 if (process->errBuf.empty()) {
241 return;
242 }
243
244 ALOGE("iptables error:");
245 ALOGE("------- COMMAND -------");
246 ALOGE("%s", command.c_str());
247 ALOGE("------- ERROR -------");
248 ALOGE("%s", process->errBuf.c_str());
249 ALOGE("----------------------");
250 process->errBuf.clear();
251 }
252
253 /* static */
drainAndWaitForAck(const std::unique_ptr<IptablesProcess> & process,const std::string & command,std::string * output)254 bool IptablesRestoreController::drainAndWaitForAck(const std::unique_ptr<IptablesProcess> &process,
255 const std::string& command,
256 std::string *output) {
257 bool receivedAck = false;
258 int timeout = 0;
259 while (!receivedAck && (timeout++ < MAX_RETRIES)) {
260 int numEvents = TEMP_FAILURE_RETRY(
261 poll(process->pollFds, ARRAY_SIZE(process->pollFds), POLL_TIMEOUT_MS));
262 if (numEvents == -1) {
263 ALOGE("Poll failed: %s", strerror(errno));
264 return false;
265 }
266
267 // We've timed out, which means something has gone wrong - we know that stdout should have
268 // become available to read with the ACK message, or that stderr should have been available
269 // to read with an error message.
270 if (numEvents == 0) {
271 continue;
272 }
273
274 char buffer[PIPE_BUF];
275 for (size_t i = 0; i < ARRAY_SIZE(process->pollFds); ++i) {
276 const struct pollfd &pollfd = process->pollFds[i];
277 if (pollfd.revents & POLLIN) {
278 ssize_t size;
279 do {
280 size = TEMP_FAILURE_RETRY(read(pollfd.fd, buffer, sizeof(buffer)));
281
282 if (size == -1) {
283 if (errno != EAGAIN) {
284 ALOGE("Unable to read from descriptor: %s", strerror(errno));
285 }
286 break;
287 }
288
289 if (i == IptablesProcess::STDOUT_IDX) {
290 // i == STDOUT_IDX: accumulate stdout into *output, and look
291 // for the ping response.
292 output->append(buffer, size);
293 size_t pos = output->find(PING);
294 if (pos != std::string::npos) {
295 if (output->size() > pos + PING_SIZE) {
296 size_t extra = output->size() - (pos + PING_SIZE);
297 ALOGW("%zd extra characters after iptables response: '%s...'",
298 extra, output->substr(pos + PING_SIZE, 128).c_str());
299 }
300 output->resize(pos);
301 receivedAck = true;
302 }
303 } else {
304 // i == STDERR_IDX: accumulate stderr into errBuf.
305 process->errBuf.append(buffer, size);
306 }
307 } while (size > 0);
308 }
309 if (pollfd.revents & POLLHUP) {
310 // The pipe was closed. This likely means the subprocess is exiting, since
311 // iptables-restore only closes stdin on error.
312 process->stop();
313 break;
314 }
315 }
316 }
317
318 if (!receivedAck && !process->processTerminated) {
319 ALOGE("Timed out waiting for response from iptables process %d", process->pid);
320 // Kill the process so that if it eventually recovers, we don't misinterpret the ping
321 // response (or any output) of the command we just sent as coming from future commands.
322 process->stop();
323 }
324
325 maybeLogStderr(process, command);
326
327 return receivedAck;
328 }
329
execute(const IptablesTarget target,const std::string & command,std::string * output)330 int IptablesRestoreController::execute(const IptablesTarget target, const std::string& command,
331 std::string *output) {
332 std::lock_guard lock(mLock);
333
334 std::string buffer;
335 if (output == nullptr) {
336 output = &buffer;
337 } else {
338 output->clear();
339 }
340
341 int res = 0;
342 if (target == V4 || target == V4V6) {
343 res |= sendCommand(IPTABLES_PROCESS, command, output);
344 }
345 if (target == V6 || target == V4V6) {
346 res |= sendCommand(IP6TABLES_PROCESS, command, output);
347 }
348 return res;
349 }
350
getIpRestorePid(const IptablesProcessType type)351 int IptablesRestoreController::getIpRestorePid(const IptablesProcessType type) {
352 return type == IPTABLES_PROCESS ? mIpRestore->pid : mIp6Restore->pid;
353 }
354