Add more packet info to nflog packet wakeup events
This patch completes the onWakeupEvent() binder interface of
INetdEventListener with some L2, L3, L4 packet information:
- ethertype
- destination hardware address
- destination ip address if any
- ip protocol if any
- src and dst ports if any
Also for consistency applying globally the transformation:
be16toh -> ntohs
be32toh -> ntohl
htobe16toh -> htons
htobe32toh -> htonl
Bug: 66869042
Test: runtest -x system/netd/server/netd_unit_test.cpp
+ manual testing by monitoring $ dumpsys connmetrics list
Change-Id: I33ef54d5af2e5e667006d853f56f3fe2e82b6a0b
diff --git a/server/WakeupController.cpp b/server/WakeupController.cpp
index 9e1e43b..07ab87a 100644
--- a/server/WakeupController.cpp
+++ b/server/WakeupController.cpp
@@ -16,11 +16,19 @@
#define LOG_TAG "WakeupController"
-#include <endian.h>
+#include <arpa/inet.h>
+#include <iostream>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_log.h>
-#include <iostream>
+#include <sys/socket.h>
+#include <netinet/if_ether.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+#include <android-base/strings.h>
#include <android-base/stringprintf.h>
#include <cutils/log.h>
#include <netdutils/Netfilter.h>
@@ -39,6 +47,72 @@
const char WakeupController::LOCAL_MANGLE_INPUT[] = "wakeupctrl_mangle_INPUT";
+const uint32_t WakeupController::kDefaultPacketCopyRange =
+ sizeof(struct tcphdr) + sizeof(struct ip6_hdr);
+
+static void extractIpPorts(WakeupController::ReportArgs& args, Slice payload) {
+ switch (args.ipNextHeader) {
+ case IPPROTO_TCP: {
+ struct tcphdr header;
+ if (extract(payload, header) < sizeof(struct tcphdr)) {
+ return;
+ }
+ args.srcPort = ntohs(header.th_sport);
+ args.dstPort = ntohs(header.th_dport);
+ break;
+ }
+ case IPPROTO_UDP: {
+ struct udphdr header;
+ if (extract(payload, header) < sizeof(struct udphdr)) {
+ return;
+ }
+ args.srcPort = ntohs(header.uh_sport);
+ args.dstPort = ntohs(header.uh_dport);
+ break;
+ }
+ default:
+ break;
+ }
+}
+
+static void extractIpHeader(WakeupController::ReportArgs& args, Slice payload) {
+ switch (args.ethertype) {
+ case ETH_P_IP: {
+ struct iphdr header;
+ if (extract(payload, header) < sizeof(struct iphdr)) {
+ return;
+ }
+ args.ipNextHeader = header.protocol;
+ char addr[INET_ADDRSTRLEN] = {};
+ inet_ntop(AF_INET, &header.saddr, addr, sizeof(addr));
+ args.srcIp = addr;
+ inet_ntop(AF_INET, &header.daddr, addr, sizeof(addr));
+ args.dstIp = addr;
+ extractIpPorts(args, drop(payload, header.ihl * 4)); // ipv4 IHL counts 32 bit words.
+ break;
+ }
+ case ETH_P_IPV6: {
+ struct ip6_hdr header;
+ if (extract(payload, header) < sizeof(struct ip6_hdr)) {
+ return;
+ }
+ args.ipNextHeader = header.ip6_nxt;
+ char addr[INET6_ADDRSTRLEN] = {};
+ inet_ntop(AF_INET6, &header.ip6_src, addr, sizeof(addr));
+ args.srcIp = addr;
+ inet_ntop(AF_INET6, &header.ip6_dst, addr, sizeof(addr));
+ args.dstIp = addr;
+ // TODO: also deal with extension headers
+ if (args.ipNextHeader == IPPROTO_TCP || args.ipNextHeader == IPPROTO_UDP) {
+ extractIpPorts(args, drop(payload, sizeof(header)));
+ }
+ break;
+ }
+ default:
+ break;
+ }
+}
+
WakeupController::~WakeupController() {
expectOk(mListener->unsubscribe(NetlinkManager::NFLOG_WAKEUP_GROUP));
}
@@ -46,40 +120,75 @@
netdutils::Status WakeupController::init(NFLogListenerInterface* listener) {
mListener = listener;
const auto msgHandler = [this](const nlmsghdr&, const nfgenmsg&, const Slice msg) {
- std::string prefix;
- uid_t uid = -1;
- gid_t gid = -1;
- uint64_t timestampNs = -1;
- const auto attrHandler = [&prefix, &uid, &gid, ×tampNs](const nlattr attr,
- const Slice payload) {
+
+ struct WakeupController::ReportArgs args = {
+ .uid = -1,
+ .gid = -1,
+ .ethertype = -1,
+ .ipNextHeader = -1,
+ .srcPort = -1,
+ .dstPort = -1,
+ // and all other fields set to 0 as the default
+ };
+ bool parseAgain = false;
+
+ const auto attrHandler = [&args, &parseAgain](const nlattr attr, const Slice payload) {
switch (attr.nla_type) {
case NFULA_TIMESTAMP: {
timespec ts = {};
extract(payload, ts);
constexpr uint64_t kNsPerS = 1000000000ULL;
- timestampNs = be32toh(ts.tv_nsec) + (be32toh(ts.tv_sec) * kNsPerS);
+ args.timestampNs = ntohl(ts.tv_nsec) + (ntohl(ts.tv_sec) * kNsPerS);
break;
}
case NFULA_PREFIX:
// Strip trailing '\0'
- prefix = toString(take(payload, payload.size() - 1));
+ args.prefix = toString(take(payload, payload.size() - 1));
break;
case NFULA_UID:
- extract(payload, uid);
- uid = be32toh(uid);
+ extract(payload, args.uid);
+ args.uid = ntohl(args.uid);
break;
case NFULA_GID:
- extract(payload, gid);
- gid = be32toh(gid);
+ extract(payload, args.gid);
+ args.gid = ntohl(args.gid);
+ break;
+ case NFULA_HWADDR: {
+ struct nfulnl_msg_packet_hw hwaddr = {};
+ extract(payload, hwaddr);
+ size_t hwAddrLen = ntohs(hwaddr.hw_addrlen);
+ hwAddrLen = std::min(hwAddrLen, sizeof(hwaddr.hw_addr));
+ args.dstHw.assign(hwaddr.hw_addr, hwaddr.hw_addr + hwAddrLen);
+ break;
+ }
+ case NFULA_PACKET_HDR: {
+ struct nfulnl_msg_packet_hdr packetHdr = {};
+ extract(payload, packetHdr);
+ args.ethertype = ntohs(packetHdr.hw_protocol);
+ break;
+ }
+ case NFULA_PAYLOAD:
+ // The packet payload is expected to come last in the Netlink message.
+ // At that point NFULA_PACKET_HDR has already been parsed and processed.
+ // If this is not the case, set parseAgain to true.
+ parseAgain = (args.ethertype == -1);
+ extractIpHeader(args, payload);
break;
default:
break;
}
};
+
forEachNetlinkAttribute(msg, attrHandler);
- mReport(prefix, uid, gid, timestampNs);
+ if (parseAgain) {
+ // NFULA_PAYLOAD was parsed before NFULA_PACKET_HDR.
+ // Now that the ethertype is known, reparse msg for correctly extracting the payload.
+ forEachNetlinkAttribute(msg, attrHandler);
+ }
+ mReport(args);
};
- return mListener->subscribe(NetlinkManager::NFLOG_WAKEUP_GROUP, msgHandler);
+ return mListener->subscribe(NetlinkManager::NFLOG_WAKEUP_GROUP,
+ WakeupController::kDefaultPacketCopyRange, msgHandler);
}
Status WakeupController::addInterface(const std::string& ifName, const std::string& prefix,
@@ -100,10 +209,11 @@
constexpr int kRateLimit = 10;
const char kFormat[] =
"*mangle\n%s %s -i %s -j NFLOG --nflog-prefix %s --nflog-group %d --nflog-threshold %d"
- " -m mark --mark 0x%08x/0x%08x -m limit --limit %d/s\nCOMMIT\n";
+ " --nflog-range %d -m mark --mark 0x%08x/0x%08x -m limit --limit %d/s\nCOMMIT\n";
const auto cmd = StringPrintf(
- kFormat, action.c_str(), WakeupController::LOCAL_MANGLE_INPUT, ifName.c_str(),
- prefix.c_str(), NetlinkManager::NFLOG_WAKEUP_GROUP, kBatch, mark, mask, kRateLimit);
+ kFormat, action.c_str(), WakeupController::LOCAL_MANGLE_INPUT, ifName.c_str(),
+ prefix.c_str(), NetlinkManager::NFLOG_WAKEUP_GROUP, kBatch,
+ WakeupController::kDefaultPacketCopyRange, mark, mask, kRateLimit);
std::string out;
auto rv = mIptables->execute(V4V6, cmd, &out);