1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <cinttypes>
18 #include <regex>
19 #include <set>
20 #include <string>
21 
22 #include <android-base/stringprintf.h>
23 #include <android-base/strings.h>
24 #include <netdutils/Stopwatch.h>
25 
26 #define LOG_TAG "Netd"
27 #include <log/log.h>
28 
29 #include "ConnmarkFlags.h"
30 #include "Controllers.h"
31 #include "IdletimerController.h"
32 #include "NetworkController.h"
33 #include "RouteController.h"
34 #include "XfrmController.h"
35 #include "oem_iptables_hook.h"
36 
37 namespace android {
38 namespace net {
39 
40 using android::base::Join;
41 using android::base::StringAppendF;
42 using android::base::StringPrintf;
43 using android::netdutils::Stopwatch;
44 
45 auto Controllers::execIptablesRestore  = ::execIptablesRestore;
46 auto Controllers::execIptablesRestoreWithOutput = ::execIptablesRestoreWithOutput;
47 
48 netdutils::Log gLog("netd");
49 netdutils::Log gUnsolicitedLog("netdUnsolicited");
50 
51 namespace {
52 
53 static constexpr char CONNMARK_MANGLE_INPUT[] = "connmark_mangle_INPUT";
54 static constexpr char CONNMARK_MANGLE_OUTPUT[] = "connmark_mangle_OUTPUT";
55 
56 /**
57  * List of module chains to be created, along with explicit ordering. ORDERING
58  * IS CRITICAL, AND SHOULD BE TRIPLE-CHECKED WITH EACH CHANGE.
59  */
60 static const std::vector<const char*> FILTER_INPUT = {
61         // Bandwidth should always be early in input chain, to make sure we
62         // correctly count incoming traffic against data plan.
63         BandwidthController::LOCAL_INPUT,
64         FirewallController::LOCAL_INPUT,
65 };
66 
67 static const std::vector<const char*> FILTER_FORWARD = {
68         OEM_IPTABLES_FILTER_FORWARD,
69         FirewallController::LOCAL_FORWARD,
70         BandwidthController::LOCAL_FORWARD,
71         TetherController::LOCAL_FORWARD,
72 };
73 
74 static const std::vector<const char*> FILTER_OUTPUT = {
75         OEM_IPTABLES_FILTER_OUTPUT,
76         FirewallController::LOCAL_OUTPUT,
77         StrictController::LOCAL_OUTPUT,
78         BandwidthController::LOCAL_OUTPUT,
79 };
80 
81 static const std::vector<const char*> RAW_PREROUTING = {
82         IdletimerController::LOCAL_RAW_PREROUTING,
83         BandwidthController::LOCAL_RAW_PREROUTING,
84         TetherController::LOCAL_RAW_PREROUTING,
85 };
86 
87 static const std::vector<const char*> MANGLE_POSTROUTING = {
88         OEM_IPTABLES_MANGLE_POSTROUTING,
89         BandwidthController::LOCAL_MANGLE_POSTROUTING,
90         IdletimerController::LOCAL_MANGLE_POSTROUTING,
91 };
92 
93 static const std::vector<const char*> MANGLE_INPUT = {
94         CONNMARK_MANGLE_INPUT,
95         WakeupController::LOCAL_MANGLE_INPUT,
96         RouteController::LOCAL_MANGLE_INPUT,
97 };
98 
99 static const std::vector<const char*> MANGLE_FORWARD = {
100         TetherController::LOCAL_MANGLE_FORWARD,
101 };
102 
103 static const std::vector<const char*> MANGLE_OUTPUT = {
104         CONNMARK_MANGLE_OUTPUT,
105 };
106 
107 static const std::vector<const char*> NAT_PREROUTING = {
108         OEM_IPTABLES_NAT_PREROUTING,
109 };
110 
111 static const std::vector<const char*> NAT_POSTROUTING = {
112         TetherController::LOCAL_NAT_POSTROUTING,
113 };
114 
115 // Commands to create child chains and to match created chains in iptables -S output. Keep in sync.
116 static const char* CHILD_CHAIN_TEMPLATE = "-A %s -j %s\n";
117 static const std::regex CHILD_CHAIN_REGEX("^-A ([^ ]+) -j ([^ ]+)$",
118                                           std::regex_constants::extended);
119 
120 }  // namespace
121 
122 /* static */
findExistingChildChains(const IptablesTarget target,const char * table,const char * parentChain)123 std::set<std::string> Controllers::findExistingChildChains(const IptablesTarget target,
124                                                            const char* table,
125                                                            const char* parentChain) {
126     if (target == V4V6) {
127         ALOGE("findExistingChildChains only supports one protocol at a time");
128         abort();
129     }
130 
131     std::set<std::string> existing;
132 
133     // List the current contents of parentChain.
134     //
135     // TODO: there is no guarantee that nothing else modifies the chain in the few milliseconds
136     // between when we list the existing rules and when we delete them. However:
137     // - Since this code is only run on startup, nothing else in netd will be running.
138     // - While vendor code is known to add its own rules to chains created by netd, it should never
139     //   be modifying the rules in childChains or the rules that hook said chains into their parent
140     //   chains.
141     std::string command = StringPrintf("*%s\n-S %s\nCOMMIT\n", table, parentChain);
142     std::string output;
143     if (Controllers::execIptablesRestoreWithOutput(target, command, &output) == -1) {
144         ALOGE("Error listing chain %s in table %s", parentChain, table);
145         return existing;
146     }
147 
148     // The only rules added by createChildChains are of the simple form "-A <parent> -j <child>".
149     // Find those rules and add each one's child chain to existing.
150     std::smatch matches;
151     std::stringstream stream(output);
152     std::string rule;
153     while (std::getline(stream, rule, '\n')) {
154         if (std::regex_search(rule, matches, CHILD_CHAIN_REGEX) && matches[1] == parentChain) {
155             existing.insert(matches[2]);
156         }
157     }
158 
159     return existing;
160 }
161 
162 /* static */
createChildChains(IptablesTarget target,const char * table,const char * parentChain,const std::vector<const char * > & childChains,bool exclusive)163 void Controllers::createChildChains(IptablesTarget target, const char* table,
164                                     const char* parentChain,
165                                     const std::vector<const char*>& childChains,
166                                     bool exclusive) {
167     std::string command = StringPrintf("*%s\n", table);
168 
169     // We cannot just clear all the chains we create because vendor code modifies filter OUTPUT and
170     // mangle POSTROUTING directly. So:
171     //
172     // - If we're the exclusive owner of this chain, simply clear it entirely.
173     // - If not, then list the chain's current contents to ensure that if we restart after a crash,
174     //   we leave the existing rules alone in the positions they currently occupy. This is faster
175     //   than blindly deleting our rules and recreating them, because deleting a rule that doesn't
176     //   exists causes iptables-restore to quit, which takes ~30ms per delete. It's also more
177     //   correct, because if we delete rules and re-add them, they'll be in the wrong position with
178     //   regards to the vendor rules.
179     //
180     // TODO: Make all chains exclusive once vendor code uses the oem_* rules.
181     std::set<std::string> existingChildChains;
182     if (exclusive) {
183         // Just running ":chain -" flushes user-defined chains, but not built-in chains like INPUT.
184         // Since at this point we don't know if parentChain is a built-in chain, do both.
185         StringAppendF(&command, ":%s -\n", parentChain);
186         StringAppendF(&command, "-F %s\n", parentChain);
187     } else {
188         existingChildChains = findExistingChildChains(target, table, parentChain);
189     }
190 
191     for (const auto& childChain : childChains) {
192         // Always clear the child chain.
193         StringAppendF(&command, ":%s -\n", childChain);
194         // But only add it to the parent chain if it's not already there.
195         if (existingChildChains.find(childChain) == existingChildChains.end()) {
196             StringAppendF(&command, CHILD_CHAIN_TEMPLATE, parentChain, childChain);
197         }
198     }
199     command += "COMMIT\n";
200     execIptablesRestore(target, command);
201 }
202 
Controllers()203 Controllers::Controllers()
204     : wakeupCtrl(
205               [this](const WakeupController::ReportArgs& args) {
206                   const auto listener = eventReporter.getNetdEventListener();
207                   if (listener == nullptr) {
208                       gLog.error("getNetdEventListener() returned nullptr. dropping wakeup event");
209                       return;
210                   }
211                   String16 prefix = String16(args.prefix.c_str());
212                   String16 srcIp = String16(args.srcIp.c_str());
213                   String16 dstIp = String16(args.dstIp.c_str());
214                   listener->onWakeupEvent(prefix, args.uid, args.ethertype, args.ipNextHeader,
215                                           args.dstHw, srcIp, dstIp, args.srcPort, args.dstPort,
216                                           args.timestampNs);
217               },
218               &iptablesRestoreCtrl) {
219     InterfaceController::initializeAll();
220 }
221 
initChildChains()222 void Controllers::initChildChains() {
223     /*
224      * This is the only time we touch top-level chains in iptables; controllers
225      * should only mutate rules inside of their children chains, as created by
226      * the constants above.
227      *
228      * Modules should never ACCEPT packets (except in well-justified cases);
229      * they should instead defer to any remaining modules using RETURN, or
230      * otherwise DROP/REJECT.
231      */
232 
233     // Create chains for child modules.
234     createChildChains(V4V6, "filter", "INPUT", FILTER_INPUT, true);
235     createChildChains(V4V6, "filter", "FORWARD", FILTER_FORWARD, true);
236     createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING, true);
237     createChildChains(V4V6, "mangle", "FORWARD", MANGLE_FORWARD, true);
238     createChildChains(V4V6, "mangle", "INPUT", MANGLE_INPUT, true);
239     createChildChains(V4V6, "mangle", "OUTPUT", MANGLE_OUTPUT, true);
240     createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING, true);
241     createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING, true);
242 
243     createChildChains(V4, "filter", "OUTPUT", FILTER_OUTPUT, false);
244     createChildChains(V6, "filter", "OUTPUT", FILTER_OUTPUT, false);
245     createChildChains(V4, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
246     createChildChains(V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
247 }
248 
setupConnmarkIptablesHooks()249 static void setupConnmarkIptablesHooks() {
250     // Rules to store parts of the fwmark (namely: netId, explicitlySelected, protectedFromVpn,
251     // permission) in connmark.
252     // Only saves the mark if no mark has been set before.
253     static_assert(std::string_view(CONNMARK_MANGLE_INPUT) == "connmark_mangle_INPUT");
254     static_assert(std::string_view(CONNMARK_MANGLE_OUTPUT) == "connmark_mangle_OUTPUT");
255     static_assert(CONNMARK_FWMARK_MASK == 0x000FFFFF);
256     const std::string cmd(
257             // CONNMARK:
258             // --save-mark [--nfmask nfmask] [--ctmask ctmask]
259             // Copy the packet mark (nfmark) to the connection mark (ctmark) using the given
260             // masks. The new nfmark value is determined as follows:
261             // ctmark = (ctmark & ~ctmask) ^ (nfmark & nfmask)
262             // i.e. ctmask defines what bits to clear and nfmask what bits of the nfmark to
263             // XOR into the ctmark. ctmask and nfmask default to 0xFFFFFFFF.
264             "*mangle\n"
265             "-A connmark_mangle_INPUT -m connmark --mark 0/0x000FFFFF "
266             "-j CONNMARK --save-mark --ctmask 0x000FFFFF --nfmask 0x000FFFFF\n"
267             "-A connmark_mangle_OUTPUT -m connmark --mark 0/0x000FFFFF "
268             "-j CONNMARK --save-mark --ctmask 0x000FFFFF --nfmask 0x000FFFFF\n"
269             "COMMIT\n");
270     execIptablesRestore(V4V6, cmd);
271 }
272 
initIptablesRules()273 void Controllers::initIptablesRules() {
274     Stopwatch s;
275     initChildChains();
276     gLog.info("Creating child chains: %" PRId64 "us", s.getTimeAndResetUs());
277 
278     // Let each module setup their child chains
279     setupOemIptablesHook();
280     gLog.info("Setting up OEM hooks: %" PRId64 "us", s.getTimeAndResetUs());
281 
282     /* When enabled, DROPs all packets except those matching rules. */
283     firewallCtrl.setupIptablesHooks();
284     gLog.info("Setting up FirewallController hooks: %" PRId64 "us", s.getTimeAndResetUs());
285 
286     /* Does DROPs in FORWARD by default */
287     tetherCtrl.setupIptablesHooks();
288     gLog.info("Setting up TetherController hooks: %" PRId64 "us", s.getTimeAndResetUs());
289 
290     /*
291      * Does REJECT in INPUT, OUTPUT. Does counting also.
292      * No DROP/REJECT allowed later in netfilter-flow hook order.
293      */
294     bandwidthCtrl.setupIptablesHooks();
295     gLog.info("Setting up BandwidthController hooks: %" PRId64 "us", s.getTimeAndResetUs());
296 
297     /*
298      * Counts in nat: PREROUTING, POSTROUTING.
299      * No DROP/REJECT allowed later in netfilter-flow hook order.
300      */
301     idletimerCtrl.setupIptablesHooks();
302     gLog.info("Setting up IdletimerController hooks: %" PRId64 "us", s.getTimeAndResetUs());
303 
304     /*
305      * Add rules for detecting IPv6/IPv4 TCP/UDP connections with TLS/DTLS header
306      */
307     strictCtrl.setupIptablesHooks();
308     gLog.info("Setting up StrictController hooks: %" PRId64 "us", s.getTimeAndResetUs());
309 
310     /*
311      * Add rules for storing netid in connmark.
312      */
313     setupConnmarkIptablesHooks();
314     gLog.info("Setting up connmark hooks: %" PRId64 "us", s.getTimeAndResetUs());
315 }
316 
init()317 void Controllers::init() {
318     initIptablesRules();
319     Stopwatch s;
320 
321     if (int ret = bandwidthCtrl.enableBandwidthControl()) {
322         gLog.error("Failed to initialize BandwidthController (%s)", strerror(-ret));
323         // A failure to init almost definitely means that iptables failed to load
324         // our static ruleset, which then basically means network accounting will not work.
325         // As such simply exit netd.  This may crash loop the system, but by failing
326         // to bootup we will trigger rollback and thus this offers us protection against
327         // a mainline update breaking things.
328         exit(1);
329     }
330     gLog.info("Enabling bandwidth control: %" PRId64 "us", s.getTimeAndResetUs());
331 
332     if (int ret = RouteController::Init(NetworkController::LOCAL_NET_ID)) {
333         gLog.error("Failed to initialize RouteController (%s)", strerror(-ret));
334     }
335     gLog.info("Initializing RouteController: %" PRId64 "us", s.getTimeAndResetUs());
336 
337     netdutils::Status xStatus = XfrmController::Init();
338     if (!isOk(xStatus)) {
339         gLog.error("Failed to initialize XfrmController (%s)", netdutils::toString(xStatus).c_str());
340     };
341     gLog.info("Initializing XfrmController: %" PRId64 "us", s.getTimeAndResetUs());
342 }
343 
344 Controllers* gCtls = nullptr;
345 
346 }  // namespace net
347 }  // namespace android
348