260 lines
7.3 KiB
C++
260 lines
7.3 KiB
C++
/*
|
|
* Copyright (C) 2012 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
/*
|
|
* MODUS OPERANDI
|
|
* --------------
|
|
*
|
|
* IPTABLES command sequence:
|
|
*
|
|
* iptables -F
|
|
*
|
|
* iptables -t raw -F idletimer_PREROUTING
|
|
* iptables -t mangle -F idletimer_POSTROUTING
|
|
*
|
|
*
|
|
* iptables -t raw -N idletimer_PREROUTING
|
|
* iptables -t mangle -N idletimer_POSTROUTING
|
|
*
|
|
* iptables -t raw -D PREROUTING -j idletimer_PREROUTING
|
|
* iptables -t mangle -D POSTROUTING -j idletimer_POSTROUTING
|
|
*
|
|
*
|
|
* iptables -t raw -I PREROUTING -j idletimer_PREROUTING
|
|
* iptables -t mangle -I POSTROUTING -j idletimer_POSTROUTING
|
|
*
|
|
* # For notifications to work the lable name must match the name of a valid interface.
|
|
* # If the label name does match an interface, the rules will be a no-op.
|
|
*
|
|
* iptables -t raw -A idletimer_PREROUTING -i rmnet0 -j IDLETIMER --timeout 5 --label test-chain --send_nl_msg 1
|
|
* iptables -t mangle -A idletimer_POSTROUTING -o rmnet0 -j IDLETIMER --timeout 5 --label test-chain --send_nl_msg 1
|
|
*
|
|
* iptables -nxvL -t raw
|
|
* iptables -nxvL -t mangle
|
|
*
|
|
* =================
|
|
*
|
|
* ndc command sequence
|
|
* ------------------
|
|
* ndc idletimer enable
|
|
* ndc idletimer add <iface> <timeout> <class label>
|
|
* ndc idletimer remove <iface> <timeout> <class label>
|
|
*
|
|
* Monitor effect on the iptables chains after each step using:
|
|
* iptables -nxvL -t raw
|
|
* iptables -nxvL -t mangle
|
|
*
|
|
* Remember that the timeout value has to be same at the time of the
|
|
* removal.
|
|
*
|
|
* =================
|
|
*
|
|
* Verifying the iptables rule
|
|
* ---------------------------
|
|
* We want to make sure the iptable rules capture every packet. It can be
|
|
* verified with tcpdump. First take a note of the pkts count for the two rules:
|
|
*
|
|
* adb shell iptables -t mangle -L idletimer_mangle_POSTROUTING -v && adb shell iptables -t raw -L idletimer_raw_PREROUTING -v
|
|
*
|
|
* And then, before any network traffics happen on the device, run tcpdump:
|
|
*
|
|
* adb shell tcpdump | tee tcpdump.log
|
|
*
|
|
* After a while run iptables commands again, you could then count the number
|
|
* of incoming and outgoing packets captured by tcpdump, and compare that with
|
|
* the numbers reported by iptables command. There shouldn't be too much
|
|
* difference on these numbers, i.e., with 2000 packets captured it should
|
|
* differ by less than 5.
|
|
*
|
|
* =================
|
|
*
|
|
* Note that currently if the name of the iface is incorrect, iptables
|
|
* will setup rules without checking if it is the name of a valid
|
|
* interface (although no notifications will ever be received). It is
|
|
* the responsibility of code in Java land to ensure that the interface name
|
|
* is correct. The benefit of this, is that idletimers can be setup on
|
|
* interfaces than come and go.
|
|
*
|
|
* A remove should be called for each add command issued during cleanup, as duplicate
|
|
* entries of the rule may exist and will all have to removed.
|
|
*
|
|
*/
|
|
|
|
#define LOG_NDEBUG 0
|
|
|
|
#include <stdlib.h>
|
|
#include <errno.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/wait.h>
|
|
#include <fcntl.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include <string.h>
|
|
#include <cutils/properties.h>
|
|
|
|
#define LOG_TAG "IdletimerController"
|
|
#include <cutils/log.h>
|
|
#include <logwrap/logwrap.h>
|
|
|
|
#include "IdletimerController.h"
|
|
#include "NetdConstants.h"
|
|
|
|
const char* IdletimerController::LOCAL_RAW_PREROUTING = "idletimer_raw_PREROUTING";
|
|
const char* IdletimerController::LOCAL_MANGLE_POSTROUTING = "idletimer_mangle_POSTROUTING";
|
|
|
|
IdletimerController::IdletimerController() {
|
|
}
|
|
|
|
IdletimerController::~IdletimerController() {
|
|
}
|
|
/* return 0 or non-zero */
|
|
int IdletimerController::runIpxtablesCmd(int argc, const char **argv) {
|
|
int resIpv4, resIpv6;
|
|
|
|
// Running for IPv4
|
|
argv[0] = IPTABLES_PATH;
|
|
resIpv4 = android_fork_execvp(argc, (char **)argv, NULL, false, false);
|
|
|
|
// Running for IPv6
|
|
argv[0] = IP6TABLES_PATH;
|
|
resIpv6 = android_fork_execvp(argc, (char **)argv, NULL, false, false);
|
|
|
|
#if !LOG_NDEBUG
|
|
std::string full_cmd = argv[0];
|
|
argc--; argv++;
|
|
for (; argc; argc--, argv++) {
|
|
full_cmd += " ";
|
|
full_cmd += argv[0];
|
|
}
|
|
ALOGV("runCmd(%s) res_ipv4=%d, res_ipv6=%d", full_cmd.c_str(), resIpv4, resIpv6);
|
|
#endif
|
|
|
|
return (resIpv4 == 0 && resIpv6 == 0) ? 0 : -1;
|
|
}
|
|
|
|
bool IdletimerController::setupIptablesHooks() {
|
|
return true;
|
|
}
|
|
|
|
int IdletimerController::setDefaults() {
|
|
int res;
|
|
const char *cmd1[] = {
|
|
NULL, // To be filled inside runIpxtablesCmd
|
|
"-w",
|
|
"-t",
|
|
"raw",
|
|
"-F",
|
|
LOCAL_RAW_PREROUTING
|
|
};
|
|
res = runIpxtablesCmd(ARRAY_SIZE(cmd1), cmd1);
|
|
|
|
if (res)
|
|
return res;
|
|
|
|
const char *cmd2[] = {
|
|
NULL, // To be filled inside runIpxtablesCmd
|
|
"-w",
|
|
"-t",
|
|
"mangle",
|
|
"-F",
|
|
LOCAL_MANGLE_POSTROUTING
|
|
};
|
|
res = runIpxtablesCmd(ARRAY_SIZE(cmd2), cmd2);
|
|
|
|
return res;
|
|
}
|
|
|
|
int IdletimerController::enableIdletimerControl() {
|
|
int res = setDefaults();
|
|
return res;
|
|
}
|
|
|
|
int IdletimerController::disableIdletimerControl() {
|
|
int res = setDefaults();
|
|
return res;
|
|
}
|
|
|
|
int IdletimerController::modifyInterfaceIdletimer(IptOp op, const char *iface,
|
|
uint32_t timeout,
|
|
const char *classLabel) {
|
|
int res;
|
|
char timeout_str[11]; //enough to store any 32-bit unsigned decimal
|
|
|
|
if (!isIfaceName(iface)) {
|
|
errno = ENOENT;
|
|
return -1;
|
|
}
|
|
|
|
snprintf(timeout_str, sizeof(timeout_str), "%u", timeout);
|
|
|
|
const char *cmd1[] = {
|
|
NULL, // To be filled inside runIpxtablesCmd
|
|
"-w",
|
|
"-t",
|
|
"raw",
|
|
(op == IptOpAdd) ? "-A" : "-D",
|
|
LOCAL_RAW_PREROUTING,
|
|
"-i",
|
|
iface,
|
|
"-j",
|
|
"IDLETIMER",
|
|
"--timeout",
|
|
timeout_str,
|
|
"--label",
|
|
classLabel,
|
|
"--send_nl_msg",
|
|
"1"
|
|
};
|
|
res = runIpxtablesCmd(ARRAY_SIZE(cmd1), cmd1);
|
|
|
|
if (res)
|
|
return res;
|
|
|
|
const char *cmd2[] = {
|
|
NULL, // To be filled inside runIpxtablesCmd
|
|
"-w",
|
|
"-t",
|
|
"mangle",
|
|
(op == IptOpAdd) ? "-A" : "-D",
|
|
LOCAL_MANGLE_POSTROUTING,
|
|
"-o",
|
|
iface,
|
|
"-j",
|
|
"IDLETIMER",
|
|
"--timeout",
|
|
timeout_str,
|
|
"--label",
|
|
classLabel,
|
|
"--send_nl_msg",
|
|
"1"
|
|
};
|
|
res = runIpxtablesCmd(ARRAY_SIZE(cmd2), cmd2);
|
|
|
|
return res;
|
|
}
|
|
|
|
int IdletimerController::addInterfaceIdletimer(const char *iface,
|
|
uint32_t timeout,
|
|
const char *classLabel) {
|
|
return modifyInterfaceIdletimer(IptOpAdd, iface, timeout, classLabel);
|
|
}
|
|
|
|
int IdletimerController::removeInterfaceIdletimer(const char *iface,
|
|
uint32_t timeout,
|
|
const char *classLabel) {
|
|
return modifyInterfaceIdletimer(IptOpDelete, iface, timeout, classLabel);
|
|
}
|