San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 17 | #include <errno.h> |
San Mehat | 1873784 | 2010-01-21 09:22:43 -0800 | [diff] [blame] | 18 | #include <fcntl.h> |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 19 | #include <inttypes.h> |
Lorenzo Colitti | c284128 | 2015-11-25 22:13:57 +0900 | [diff] [blame] | 20 | #include <netdb.h> |
Olivier Bailly | ff2c0d8 | 2010-11-17 11:45:07 -0800 | [diff] [blame] | 21 | #include <string.h> |
San Mehat | 1873784 | 2010-01-21 09:22:43 -0800 | [diff] [blame] | 22 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 23 | #include <sys/socket.h> |
| 24 | #include <sys/stat.h> |
San Mehat | 1873784 | 2010-01-21 09:22:43 -0800 | [diff] [blame] | 25 | #include <sys/types.h> |
| 26 | #include <sys/wait.h> |
| 27 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 28 | #include <netinet/in.h> |
| 29 | #include <arpa/inet.h> |
| 30 | |
Erik Kline | 5f0358b | 2018-02-16 15:08:09 +0900 | [diff] [blame] | 31 | #include <array> |
| 32 | #include <cstdlib> |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 33 | #include <regex> |
Erik Kline | 5f0358b | 2018-02-16 15:08:09 +0900 | [diff] [blame] | 34 | #include <string> |
| 35 | #include <vector> |
| 36 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 37 | #define LOG_TAG "TetherController" |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 38 | #include <android-base/strings.h> |
| 39 | #include <android-base/stringprintf.h> |
Kazuhiro Ondo | 6b858eb | 2011-06-24 20:31:03 -0500 | [diff] [blame] | 40 | #include <cutils/properties.h> |
Logan Chien | 3f46148 | 2018-04-23 14:31:32 +0800 | [diff] [blame] | 41 | #include <log/log.h> |
Lorenzo Colitti | 9a8a9ff | 2017-01-31 19:06:59 +0900 | [diff] [blame] | 42 | #include <netdutils/StatusOr.h> |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 43 | |
Erik Kline | b31fd69 | 2018-06-06 20:50:11 +0900 | [diff] [blame] | 44 | #include "Controllers.h" |
Lorenzo Colitti | 667c477 | 2014-08-26 14:13:07 -0700 | [diff] [blame] | 45 | #include "Fwmark.h" |
JP Abgrall | 69261cb | 2014-06-19 18:35:24 -0700 | [diff] [blame] | 46 | #include "NetdConstants.h" |
Lorenzo Colitti | 667c477 | 2014-08-26 14:13:07 -0700 | [diff] [blame] | 47 | #include "Permission.h" |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 48 | #include "InterfaceController.h" |
Lorenzo Colitti | e20a526 | 2017-05-09 18:30:44 +0900 | [diff] [blame] | 49 | #include "NetworkController.h" |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 50 | #include "ResponseCode.h" |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 51 | #include "TetherController.h" |
| 52 | |
Bernie Innocenti | 4debf3b | 2018-09-12 13:54:50 +0900 | [diff] [blame] | 53 | namespace android { |
| 54 | namespace net { |
| 55 | |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 56 | using android::base::Join; |
Erik Kline | b31fd69 | 2018-06-06 20:50:11 +0900 | [diff] [blame] | 57 | using android::base::StringPrintf; |
Lorenzo Colitti | 9a8a9ff | 2017-01-31 19:06:59 +0900 | [diff] [blame] | 58 | using android::netdutils::statusFromErrno; |
Erik Kline | b31fd69 | 2018-06-06 20:50:11 +0900 | [diff] [blame] | 59 | using android::netdutils::StatusOr; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 60 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 61 | namespace { |
| 62 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 63 | const char BP_TOOLS_MODE[] = "bp-tools"; |
| 64 | const char IPV4_FORWARDING_PROC_FILE[] = "/proc/sys/net/ipv4/ip_forward"; |
| 65 | const char IPV6_FORWARDING_PROC_FILE[] = "/proc/sys/net/ipv6/conf/all/forwarding"; |
| 66 | const char SEPARATOR[] = "|"; |
Erik Kline | 93f9b22 | 2017-10-22 21:24:58 +0900 | [diff] [blame] | 67 | constexpr const char kTcpBeLiberal[] = "/proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal"; |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 68 | |
Erik Kline | 5f0358b | 2018-02-16 15:08:09 +0900 | [diff] [blame] | 69 | // Chosen to match AID_DNS_TETHER, as made "friendly" by fs_config_generator.py. |
| 70 | constexpr const char kDnsmasqUsername[] = "dns_tether"; |
| 71 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 72 | bool writeToFile(const char* filename, const char* value) { |
Nick Kralevich | b95c60c | 2016-11-19 09:09:16 -0800 | [diff] [blame] | 73 | int fd = open(filename, O_WRONLY | O_CLOEXEC); |
Nicolas Geoffray | afd4037 | 2015-03-16 11:58:06 +0000 | [diff] [blame] | 74 | if (fd < 0) { |
| 75 | ALOGE("Failed to open %s: %s", filename, strerror(errno)); |
| 76 | return false; |
| 77 | } |
| 78 | |
| 79 | const ssize_t len = strlen(value); |
| 80 | if (write(fd, value, len) != len) { |
| 81 | ALOGE("Failed to write %s to %s: %s", value, filename, strerror(errno)); |
| 82 | close(fd); |
| 83 | return false; |
| 84 | } |
| 85 | close(fd); |
| 86 | return true; |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 87 | } |
| 88 | |
Erik Kline | 93f9b22 | 2017-10-22 21:24:58 +0900 | [diff] [blame] | 89 | // TODO: Consider altering TCP and UDP timeouts as well. |
| 90 | void configureForTethering(bool enabled) { |
| 91 | writeToFile(kTcpBeLiberal, enabled ? "1" : "0"); |
| 92 | } |
| 93 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 94 | bool configureForIPv6Router(const char *interface) { |
| 95 | return (InterfaceController::setEnableIPv6(interface, 0) == 0) |
| 96 | && (InterfaceController::setAcceptIPv6Ra(interface, 0) == 0) |
Erik Kline | 6cddf51 | 2016-08-09 15:28:42 +0900 | [diff] [blame] | 97 | && (InterfaceController::setAcceptIPv6Dad(interface, 0) == 0) |
| 98 | && (InterfaceController::setIPv6DadTransmits(interface, "0") == 0) |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 99 | && (InterfaceController::setEnableIPv6(interface, 1) == 0); |
| 100 | } |
| 101 | |
| 102 | void configureForIPv6Client(const char *interface) { |
| 103 | InterfaceController::setAcceptIPv6Ra(interface, 1); |
Erik Kline | 6cddf51 | 2016-08-09 15:28:42 +0900 | [diff] [blame] | 104 | InterfaceController::setAcceptIPv6Dad(interface, 1); |
| 105 | InterfaceController::setIPv6DadTransmits(interface, "1"); |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 106 | InterfaceController::setEnableIPv6(interface, 0); |
| 107 | } |
| 108 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 109 | bool inBpToolsMode() { |
| 110 | // In BP tools mode, do not disable IP forwarding |
| 111 | char bootmode[PROPERTY_VALUE_MAX] = {0}; |
| 112 | property_get("ro.bootmode", bootmode, "unknown"); |
| 113 | return !strcmp(BP_TOOLS_MODE, bootmode); |
| 114 | } |
| 115 | |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 116 | pid_t vfork_and_exec(const char* path, char* const argv[], int pipefd[2]) { |
| 117 | auto pid = vfork(); |
| 118 | if (pid) { |
| 119 | // Parent process, or vfork() failed. Let caller deal with it. |
| 120 | return pid; |
| 121 | } |
| 122 | |
| 123 | // Don't modify any memory between vfork and execv. |
| 124 | // Changing state of file descriptors would be fine. |
| 125 | // dup2 creates fd without CLOEXEC, dnsmasq will receive commands through the |
| 126 | // duplicated fd. |
| 127 | if (dup2(pipefd[0], STDIN_FILENO) != STDIN_FILENO) { |
| 128 | // dup2 failed |
| 129 | _exit(EXIT_FAILURE); |
| 130 | } |
| 131 | execv(path, argv); |
| 132 | // Should never get here! |
| 133 | _exit(EXIT_FAILURE); |
| 134 | return pid; |
| 135 | } |
| 136 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 137 | } // namespace |
| 138 | |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 139 | auto TetherController::iptablesRestoreFunction = execIptablesRestoreWithOutput; |
| 140 | |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 141 | const std::string GET_TETHER_STATS_COMMAND = StringPrintf( |
| 142 | "*filter\n" |
| 143 | "-nvx -L %s\n" |
| 144 | "COMMIT\n", android::net::TetherController::LOCAL_TETHER_COUNTERS_CHAIN); |
| 145 | |
Erik Kline | 15079dd | 2018-05-18 23:10:56 +0900 | [diff] [blame] | 146 | int TetherController::DnsmasqState::sendCmd(int daemonFd, const std::string& cmd) { |
| 147 | if (cmd.empty()) return 0; |
| 148 | |
Erik Kline | b31fd69 | 2018-06-06 20:50:11 +0900 | [diff] [blame] | 149 | gLog.log("Sending update msg to dnsmasq [%s]", cmd.c_str()); |
Erik Kline | 15079dd | 2018-05-18 23:10:56 +0900 | [diff] [blame] | 150 | // Send the trailing \0 as well. |
| 151 | if (write(daemonFd, cmd.c_str(), cmd.size() + 1) < 0) { |
Erik Kline | b31fd69 | 2018-06-06 20:50:11 +0900 | [diff] [blame] | 152 | gLog.error("Failed to send update command to dnsmasq (%s)", strerror(errno)); |
Erik Kline | 15079dd | 2018-05-18 23:10:56 +0900 | [diff] [blame] | 153 | errno = EREMOTEIO; |
| 154 | return -1; |
| 155 | } |
| 156 | return 0; |
| 157 | } |
| 158 | |
| 159 | void TetherController::DnsmasqState::clear() { |
| 160 | update_ifaces_cmd.clear(); |
| 161 | update_dns_cmd.clear(); |
| 162 | } |
| 163 | |
| 164 | int TetherController::DnsmasqState::sendAllState(int daemonFd) const { |
| 165 | return sendCmd(daemonFd, update_ifaces_cmd) | sendCmd(daemonFd, update_dns_cmd); |
| 166 | } |
| 167 | |
Sreeram Ramachandran | 87475a1 | 2014-07-15 16:20:28 -0700 | [diff] [blame] | 168 | TetherController::TetherController() { |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 169 | if (inBpToolsMode()) { |
| 170 | enableForwarding(BP_TOOLS_MODE); |
| 171 | } else { |
| 172 | setIpFwdEnabled(); |
| 173 | } |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 174 | } |
| 175 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 176 | bool TetherController::setIpFwdEnabled() { |
| 177 | bool success = true; |
Hugo Benichi | c4b3a0c | 2018-05-22 08:48:40 +0900 | [diff] [blame] | 178 | bool disable = mForwardingRequests.empty(); |
| 179 | const char* value = disable ? "0" : "1"; |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 180 | ALOGD("Setting IP forward enable = %s", value); |
| 181 | success &= writeToFile(IPV4_FORWARDING_PROC_FILE, value); |
| 182 | success &= writeToFile(IPV6_FORWARDING_PROC_FILE, value); |
Hugo Benichi | c4b3a0c | 2018-05-22 08:48:40 +0900 | [diff] [blame] | 183 | if (disable) { |
| 184 | // Turning off the forwarding sysconf in the kernel has the side effect |
| 185 | // of turning on ICMP redirect, which is a security hazard. |
| 186 | // Turn ICMP redirect back off immediately. |
| 187 | int rv = InterfaceController::disableIcmpRedirects(); |
| 188 | success &= (rv == 0); |
| 189 | } |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 190 | return success; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 191 | } |
| 192 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 193 | bool TetherController::enableForwarding(const char* requester) { |
| 194 | // Don't return an error if this requester already requested forwarding. Only return errors for |
| 195 | // things that the caller caller needs to care about, such as "couldn't write to the file to |
| 196 | // enable forwarding". |
| 197 | mForwardingRequests.insert(requester); |
| 198 | return setIpFwdEnabled(); |
| 199 | } |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 200 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 201 | bool TetherController::disableForwarding(const char* requester) { |
| 202 | mForwardingRequests.erase(requester); |
| 203 | return setIpFwdEnabled(); |
| 204 | } |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 205 | |
Lorenzo Colitti | 799625c | 2015-02-25 12:52:00 +0900 | [diff] [blame] | 206 | size_t TetherController::forwardingRequestCount() { |
| 207 | return mForwardingRequests.size(); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 208 | } |
| 209 | |
Erik Kline | 13fa01f | 2015-11-12 17:49:23 +0900 | [diff] [blame] | 210 | int TetherController::startTethering(int num_addrs, char **dhcp_ranges) { |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 211 | if (mDaemonPid != 0) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 212 | ALOGE("Tethering already started"); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 213 | errno = EBUSY; |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 214 | return -errno; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 215 | } |
| 216 | |
Steve Block | 7b984e3 | 2011-12-20 16:22:42 +0000 | [diff] [blame] | 217 | ALOGD("Starting tethering services"); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 218 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 219 | int pipefd[2]; |
| 220 | |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 221 | if (pipe2(pipefd, O_CLOEXEC) < 0) { |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 222 | int res = errno; |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 223 | ALOGE("pipe2() failed (%s)", strerror(errno)); |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 224 | return -res; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 225 | } |
| 226 | |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 227 | // Set parameters |
| 228 | Fwmark fwmark; |
| 229 | fwmark.netId = NetworkController::LOCAL_NET_ID; |
| 230 | fwmark.explicitlySelected = true; |
| 231 | fwmark.protectedFromVpn = true; |
| 232 | fwmark.permission = PERMISSION_SYSTEM; |
| 233 | char markStr[UINT32_HEX_STRLEN]; |
| 234 | snprintf(markStr, sizeof(markStr), "0x%x", fwmark.intValue); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 235 | |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 236 | std::vector<const std::string> argVector = { |
Erik Kline | 5f0358b | 2018-02-16 15:08:09 +0900 | [diff] [blame] | 237 | "/system/bin/dnsmasq", |
| 238 | "--keep-in-foreground", |
| 239 | "--no-resolv", |
| 240 | "--no-poll", |
| 241 | "--dhcp-authoritative", |
| 242 | // TODO: pipe through metered status from ConnService |
| 243 | "--dhcp-option-force=43,ANDROID_METERED", |
| 244 | "--pid-file", |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 245 | "--listen-mark", |
| 246 | markStr, |
| 247 | "--user", |
| 248 | kDnsmasqUsername, |
| 249 | }; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 250 | |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 251 | // DHCP server will be disabled if num_addrs == 0 and no --dhcp-range is |
| 252 | // passed. |
| 253 | for (int addrIndex = 0; addrIndex < num_addrs; addrIndex += 2) { |
| 254 | argVector.push_back(StringPrintf("--dhcp-range=%s,%s,1h", dhcp_ranges[addrIndex], |
| 255 | dhcp_ranges[addrIndex + 1])); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 256 | } |
| 257 | |
Luke Huang | 94c43a1 | 2019-02-14 19:51:38 +0800 | [diff] [blame^] | 258 | auto args = (char**)std::calloc(argVector.size() + 1, sizeof(char*)); |
| 259 | for (unsigned i = 0; i < argVector.size(); i++) { |
| 260 | args[i] = (char*)argVector[i].c_str(); |
| 261 | } |
| 262 | |
| 263 | /* |
| 264 | * TODO: Create a monitoring thread to handle and restart |
| 265 | * the daemon if it exits prematurely |
| 266 | */ |
| 267 | pid_t pid = vfork_and_exec(args[0], args, pipefd); |
| 268 | int res = errno; |
| 269 | close(pipefd[0]); |
| 270 | free(args); |
| 271 | if (pid < 0) { |
| 272 | ALOGE("vfork & exec failed (%s)", strerror(errno)); |
| 273 | close(pipefd[1]); |
| 274 | return -res; |
| 275 | } |
| 276 | |
| 277 | mDaemonPid = pid; |
| 278 | mDaemonFd = pipefd[1]; |
| 279 | configureForTethering(true); |
| 280 | applyDnsInterfaces(); |
| 281 | ALOGD("Tethering services running"); |
| 282 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 283 | return 0; |
| 284 | } |
| 285 | |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 286 | std::vector<char*> TetherController::toCstrVec(const std::vector<std::string>& addrs) { |
| 287 | std::vector<char*> addrsCstrVec{}; |
| 288 | addrsCstrVec.reserve(addrs.size()); |
| 289 | for (const auto& addr : addrs) { |
| 290 | addrsCstrVec.push_back(const_cast<char*>(addr.data())); |
| 291 | } |
| 292 | return addrsCstrVec; |
| 293 | } |
| 294 | |
| 295 | int TetherController::startTethering(const std::vector<std::string>& dhcpRanges) { |
| 296 | struct in_addr v4_addr; |
| 297 | for (const auto& dhcpRange : dhcpRanges) { |
| 298 | if (!inet_aton(dhcpRange.c_str(), &v4_addr)) { |
| 299 | return -EINVAL; |
| 300 | } |
| 301 | } |
| 302 | auto dhcp_ranges = toCstrVec(dhcpRanges); |
| 303 | return startTethering(dhcp_ranges.size(), dhcp_ranges.data()); |
| 304 | } |
| 305 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 306 | int TetherController::stopTethering() { |
Erik Kline | 93f9b22 | 2017-10-22 21:24:58 +0900 | [diff] [blame] | 307 | configureForTethering(false); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 308 | |
| 309 | if (mDaemonPid == 0) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 310 | ALOGE("Tethering already stopped"); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 311 | return 0; |
| 312 | } |
| 313 | |
Steve Block | 7b984e3 | 2011-12-20 16:22:42 +0000 | [diff] [blame] | 314 | ALOGD("Stopping tethering services"); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 315 | |
| 316 | kill(mDaemonPid, SIGTERM); |
Yi Kong | bdfd57e | 2018-07-25 13:26:10 -0700 | [diff] [blame] | 317 | waitpid(mDaemonPid, nullptr, 0); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 318 | mDaemonPid = 0; |
| 319 | close(mDaemonFd); |
| 320 | mDaemonFd = -1; |
Erik Kline | 15079dd | 2018-05-18 23:10:56 +0900 | [diff] [blame] | 321 | mDnsmasqState.clear(); |
Steve Block | 7b984e3 | 2011-12-20 16:22:42 +0000 | [diff] [blame] | 322 | ALOGD("Tethering services stopped"); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 323 | return 0; |
| 324 | } |
Matthew Xie | 1994410 | 2012-07-12 16:42:07 -0700 | [diff] [blame] | 325 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 326 | bool TetherController::isTetheringStarted() { |
| 327 | return (mDaemonPid == 0 ? false : true); |
| 328 | } |
| 329 | |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 330 | // dnsmasq can't parse commands larger than this due to the fixed-size buffer |
| 331 | // in check_android_listeners(). The receiving buffer is 1024 bytes long, but |
| 332 | // dnsmasq reads up to 1023 bytes. |
Bernie Innocenti | 45238a1 | 2018-12-04 14:57:48 +0900 | [diff] [blame] | 333 | const size_t MAX_CMD_SIZE = 1023; |
Kenny Root | cf52faf | 2010-02-18 09:59:55 -0800 | [diff] [blame] | 334 | |
Bernie Innocenti | 45238a1 | 2018-12-04 14:57:48 +0900 | [diff] [blame] | 335 | // TODO: convert callers to the overload taking a vector<string> |
Lorenzo Colitti | 667c477 | 2014-08-26 14:13:07 -0700 | [diff] [blame] | 336 | int TetherController::setDnsForwarders(unsigned netId, char **servers, int numServers) { |
Lorenzo Colitti | 667c477 | 2014-08-26 14:13:07 -0700 | [diff] [blame] | 337 | Fwmark fwmark; |
| 338 | fwmark.netId = netId; |
| 339 | fwmark.explicitlySelected = true; |
| 340 | fwmark.protectedFromVpn = true; |
| 341 | fwmark.permission = PERMISSION_SYSTEM; |
| 342 | |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 343 | std::string daemonCmd = StringPrintf("update_dns%s0x%x", SEPARATOR, fwmark.intValue); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 344 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 345 | mDnsForwarders.clear(); |
Bernie Innocenti | 45238a1 | 2018-12-04 14:57:48 +0900 | [diff] [blame] | 346 | for (int i = 0; i < numServers; i++) { |
Lorenzo Colitti | 667c477 | 2014-08-26 14:13:07 -0700 | [diff] [blame] | 347 | ALOGD("setDnsForwarders(0x%x %d = '%s')", fwmark.intValue, i, servers[i]); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 348 | |
Lorenzo Colitti | c284128 | 2015-11-25 22:13:57 +0900 | [diff] [blame] | 349 | addrinfo *res, hints = { .ai_flags = AI_NUMERICHOST }; |
Yi Kong | bdfd57e | 2018-07-25 13:26:10 -0700 | [diff] [blame] | 350 | int ret = getaddrinfo(servers[i], nullptr, &hints, &res); |
Lorenzo Colitti | c284128 | 2015-11-25 22:13:57 +0900 | [diff] [blame] | 351 | freeaddrinfo(res); |
| 352 | if (ret) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 353 | ALOGE("Failed to parse DNS server '%s'", servers[i]); |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 354 | mDnsForwarders.clear(); |
Lorenzo Colitti | c284128 | 2015-11-25 22:13:57 +0900 | [diff] [blame] | 355 | errno = EINVAL; |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 356 | return -errno; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 357 | } |
Kenny Root | cf52faf | 2010-02-18 09:59:55 -0800 | [diff] [blame] | 358 | |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 359 | if (daemonCmd.size() + 1 + strlen(servers[i]) >= MAX_CMD_SIZE) { |
| 360 | ALOGE("Too many DNS servers listed"); |
Kenny Root | cf52faf | 2010-02-18 09:59:55 -0800 | [diff] [blame] | 361 | break; |
| 362 | } |
| 363 | |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 364 | daemonCmd += SEPARATOR; |
| 365 | daemonCmd += servers[i]; |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 366 | mDnsForwarders.push_back(servers[i]); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 367 | } |
| 368 | |
Lorenzo Colitti | 667c477 | 2014-08-26 14:13:07 -0700 | [diff] [blame] | 369 | mDnsNetId = netId; |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 370 | mDnsmasqState.update_dns_cmd = std::move(daemonCmd); |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 371 | if (mDaemonFd != -1) { |
Erik Kline | 15079dd | 2018-05-18 23:10:56 +0900 | [diff] [blame] | 372 | if (mDnsmasqState.sendAllState(mDaemonFd) != 0) { |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 373 | mDnsForwarders.clear(); |
Lorenzo Colitti | c284128 | 2015-11-25 22:13:57 +0900 | [diff] [blame] | 374 | errno = EREMOTEIO; |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 375 | return -errno; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 376 | } |
| 377 | } |
| 378 | return 0; |
| 379 | } |
| 380 | |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 381 | int TetherController::setDnsForwarders(unsigned netId, const std::vector<std::string>& servers) { |
| 382 | struct in_addr v4_addr; |
| 383 | struct in6_addr v6_addr; |
| 384 | for (const auto& server : servers) { |
| 385 | if (!inet_pton(AF_INET, server.c_str(), &v4_addr) && |
| 386 | !inet_pton(AF_INET6, server.c_str(), &v6_addr)) { |
| 387 | return -EINVAL; |
| 388 | } |
| 389 | } |
| 390 | auto dnsServers = toCstrVec(servers); |
| 391 | return setDnsForwarders(netId, dnsServers.data(), dnsServers.size()); |
| 392 | } |
| 393 | |
Lorenzo Colitti | 667c477 | 2014-08-26 14:13:07 -0700 | [diff] [blame] | 394 | unsigned TetherController::getDnsNetId() { |
| 395 | return mDnsNetId; |
| 396 | } |
| 397 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 398 | const std::list<std::string> &TetherController::getDnsForwarders() const { |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 399 | return mDnsForwarders; |
| 400 | } |
| 401 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 402 | bool TetherController::applyDnsInterfaces() { |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 403 | std::string daemonCmd = "update_ifaces"; |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 404 | bool haveInterfaces = false; |
| 405 | |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 406 | for (const auto& ifname : mInterfaces) { |
| 407 | if (daemonCmd.size() + 1 + ifname.size() >= MAX_CMD_SIZE) { |
| 408 | ALOGE("Too many DNS servers listed"); |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 409 | break; |
| 410 | } |
| 411 | |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 412 | daemonCmd += SEPARATOR; |
| 413 | daemonCmd += ifname; |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 414 | haveInterfaces = true; |
| 415 | } |
| 416 | |
Erik Kline | 15079dd | 2018-05-18 23:10:56 +0900 | [diff] [blame] | 417 | if (!haveInterfaces) { |
| 418 | mDnsmasqState.update_ifaces_cmd.clear(); |
| 419 | } else { |
Bernie Innocenti | 15bb55c | 2018-06-03 16:19:51 +0900 | [diff] [blame] | 420 | mDnsmasqState.update_ifaces_cmd = std::move(daemonCmd); |
Erik Kline | 15079dd | 2018-05-18 23:10:56 +0900 | [diff] [blame] | 421 | if (mDaemonFd != -1) return (mDnsmasqState.sendAllState(mDaemonFd) == 0); |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 422 | } |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 423 | return true; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 424 | } |
| 425 | |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 426 | int TetherController::tetherInterface(const char *interface) { |
| 427 | ALOGD("tetherInterface(%s)", interface); |
JP Abgrall | 69261cb | 2014-06-19 18:35:24 -0700 | [diff] [blame] | 428 | if (!isIfaceName(interface)) { |
| 429 | errno = ENOENT; |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 430 | return -errno; |
JP Abgrall | 69261cb | 2014-06-19 18:35:24 -0700 | [diff] [blame] | 431 | } |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 432 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 433 | if (!configureForIPv6Router(interface)) { |
| 434 | configureForIPv6Client(interface); |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 435 | return -EREMOTEIO; |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 436 | } |
| 437 | mInterfaces.push_back(interface); |
| 438 | |
| 439 | if (!applyDnsInterfaces()) { |
| 440 | mInterfaces.pop_back(); |
| 441 | configureForIPv6Client(interface); |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 442 | return -EREMOTEIO; |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 443 | } else { |
| 444 | return 0; |
| 445 | } |
| 446 | } |
| 447 | |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 448 | int TetherController::untetherInterface(const char *interface) { |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 449 | ALOGD("untetherInterface(%s)", interface); |
| 450 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 451 | for (auto it = mInterfaces.cbegin(); it != mInterfaces.cend(); ++it) { |
| 452 | if (!strcmp(interface, it->c_str())) { |
| 453 | mInterfaces.erase(it); |
Robert Greenwalt | 3d4c758 | 2012-12-11 12:33:37 -0800 | [diff] [blame] | 454 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 455 | configureForIPv6Client(interface); |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 456 | return applyDnsInterfaces() ? 0 : -EREMOTEIO; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 457 | } |
| 458 | } |
| 459 | errno = ENOENT; |
Luke Huang | b5733d7 | 2018-08-21 17:17:19 +0800 | [diff] [blame] | 460 | return -errno; |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 461 | } |
| 462 | |
Erik Kline | 1d065ba | 2016-06-08 13:24:45 +0900 | [diff] [blame] | 463 | const std::list<std::string> &TetherController::getTetheredInterfaceList() const { |
San Mehat | 9d10b34 | 2010-01-18 09:51:02 -0800 | [diff] [blame] | 464 | return mInterfaces; |
| 465 | } |
Lorenzo Colitti | e20a526 | 2017-05-09 18:30:44 +0900 | [diff] [blame] | 466 | |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 467 | int TetherController::setupIptablesHooks() { |
| 468 | int res; |
| 469 | res = setDefaults(); |
| 470 | if (res < 0) { |
| 471 | return res; |
| 472 | } |
| 473 | |
| 474 | // Used to limit downstream mss to the upstream pmtu so we don't end up fragmenting every large |
| 475 | // packet tethered devices send. This is IPv4-only, because in IPv6 we send the MTU in the RA. |
| 476 | // This is no longer optional and tethering will fail to start if it fails. |
| 477 | std::string mssRewriteCommand = StringPrintf( |
| 478 | "*mangle\n" |
| 479 | "-A %s -p tcp --tcp-flags SYN SYN -j TCPMSS --clamp-mss-to-pmtu\n" |
| 480 | "COMMIT\n", LOCAL_MANGLE_FORWARD); |
| 481 | |
| 482 | // This is for tethering counters. This chain is reached via --goto, and then RETURNS. |
| 483 | std::string defaultCommands = StringPrintf( |
| 484 | "*filter\n" |
| 485 | ":%s -\n" |
| 486 | "COMMIT\n", LOCAL_TETHER_COUNTERS_CHAIN); |
| 487 | |
| 488 | res = iptablesRestoreFunction(V4, mssRewriteCommand, nullptr); |
| 489 | if (res < 0) { |
| 490 | return res; |
| 491 | } |
| 492 | |
| 493 | res = iptablesRestoreFunction(V4V6, defaultCommands, nullptr); |
| 494 | if (res < 0) { |
| 495 | return res; |
| 496 | } |
| 497 | |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 498 | mFwdIfaces.clear(); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 499 | |
| 500 | return 0; |
| 501 | } |
| 502 | |
| 503 | int TetherController::setDefaults() { |
| 504 | std::string v4Cmd = StringPrintf( |
| 505 | "*filter\n" |
| 506 | ":%s -\n" |
| 507 | "-A %s -j DROP\n" |
| 508 | "COMMIT\n" |
| 509 | "*nat\n" |
| 510 | ":%s -\n" |
| 511 | "COMMIT\n", LOCAL_FORWARD, LOCAL_FORWARD, LOCAL_NAT_POSTROUTING); |
| 512 | |
| 513 | std::string v6Cmd = StringPrintf( |
Luke Huang | ae038f8 | 2018-11-05 11:17:31 +0900 | [diff] [blame] | 514 | "*filter\n" |
| 515 | ":%s -\n" |
| 516 | "COMMIT\n" |
| 517 | "*raw\n" |
| 518 | ":%s -\n" |
| 519 | "COMMIT\n", |
| 520 | LOCAL_FORWARD, LOCAL_RAW_PREROUTING); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 521 | |
| 522 | int res = iptablesRestoreFunction(V4, v4Cmd, nullptr); |
| 523 | if (res < 0) { |
| 524 | return res; |
| 525 | } |
| 526 | |
| 527 | res = iptablesRestoreFunction(V6, v6Cmd, nullptr); |
| 528 | if (res < 0) { |
| 529 | return res; |
| 530 | } |
| 531 | |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 532 | return 0; |
| 533 | } |
| 534 | |
| 535 | int TetherController::enableNat(const char* intIface, const char* extIface) { |
| 536 | ALOGV("enableNat(intIface=<%s>, extIface=<%s>)",intIface, extIface); |
| 537 | |
| 538 | if (!isIfaceName(intIface) || !isIfaceName(extIface)) { |
Luke Huang | 19b49c5 | 2018-10-22 12:12:05 +0900 | [diff] [blame] | 539 | return -ENODEV; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 540 | } |
| 541 | |
| 542 | /* Bug: b/9565268. "enableNat wlan0 wlan0". For now we fail until java-land is fixed */ |
| 543 | if (!strcmp(intIface, extIface)) { |
| 544 | ALOGE("Duplicate interface specified: %s %s", intIface, extIface); |
Luke Huang | 19b49c5 | 2018-10-22 12:12:05 +0900 | [diff] [blame] | 545 | return -EINVAL; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 546 | } |
| 547 | |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 548 | if (isForwardingPairEnabled(intIface, extIface)) { |
| 549 | return 0; |
| 550 | } |
| 551 | |
| 552 | // add this if we are the first enabled nat for this upstream |
| 553 | if (!isAnyForwardingEnabledOnUpstream(extIface)) { |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 554 | std::vector<std::string> v4Cmds = { |
| 555 | "*nat", |
| 556 | StringPrintf("-A %s -o %s -j MASQUERADE", LOCAL_NAT_POSTROUTING, extIface), |
| 557 | "COMMIT\n" |
| 558 | }; |
| 559 | |
Luke Huang | ae038f8 | 2018-11-05 11:17:31 +0900 | [diff] [blame] | 560 | if (iptablesRestoreFunction(V4, Join(v4Cmds, '\n'), nullptr) || setupIPv6CountersChain() || |
| 561 | setTetherGlobalAlertRule()) { |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 562 | ALOGE("Error setting postroute rule: iface=%s", extIface); |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 563 | if (!isAnyForwardingPairEnabled()) { |
| 564 | // unwind what's been done, but don't care about success - what more could we do? |
| 565 | setDefaults(); |
| 566 | } |
Luke Huang | 19b49c5 | 2018-10-22 12:12:05 +0900 | [diff] [blame] | 567 | return -EREMOTEIO; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 568 | } |
| 569 | } |
| 570 | |
| 571 | if (setForwardRules(true, intIface, extIface) != 0) { |
| 572 | ALOGE("Error setting forward rules"); |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 573 | if (!isAnyForwardingPairEnabled()) { |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 574 | setDefaults(); |
| 575 | } |
Luke Huang | 19b49c5 | 2018-10-22 12:12:05 +0900 | [diff] [blame] | 576 | return -ENODEV; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 577 | } |
| 578 | |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 579 | return 0; |
| 580 | } |
| 581 | |
Luke Huang | ae038f8 | 2018-11-05 11:17:31 +0900 | [diff] [blame] | 582 | int TetherController::setTetherGlobalAlertRule() { |
| 583 | // Only add this if we are the first enabled nat |
| 584 | if (isAnyForwardingPairEnabled()) { |
| 585 | return 0; |
| 586 | } |
| 587 | const std::string cmds = |
| 588 | "*filter\n" + |
| 589 | StringPrintf("-I %s -j %s\n", LOCAL_FORWARD, BandwidthController::LOCAL_GLOBAL_ALERT) + |
| 590 | "COMMIT\n"; |
| 591 | |
| 592 | return iptablesRestoreFunction(V4V6, cmds, nullptr); |
| 593 | } |
| 594 | |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 595 | int TetherController::setupIPv6CountersChain() { |
| 596 | // Only add this if we are the first enabled nat |
| 597 | if (isAnyForwardingPairEnabled()) { |
| 598 | return 0; |
| 599 | } |
| 600 | |
| 601 | /* |
| 602 | * IPv6 tethering doesn't need the state-based conntrack rules, so |
| 603 | * it unconditionally jumps to the tether counters chain all the time. |
| 604 | */ |
Luke Huang | ae038f8 | 2018-11-05 11:17:31 +0900 | [diff] [blame] | 605 | const std::string v6Cmds = |
| 606 | "*filter\n" + |
| 607 | StringPrintf("-A %s -g %s\n", LOCAL_FORWARD, LOCAL_TETHER_COUNTERS_CHAIN) + "COMMIT\n"; |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 608 | |
Luke Huang | ae038f8 | 2018-11-05 11:17:31 +0900 | [diff] [blame] | 609 | return iptablesRestoreFunction(V6, v6Cmds, nullptr); |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 610 | } |
| 611 | |
| 612 | // Gets a pointer to the ForwardingDownstream for an interface pair in the map, or nullptr |
| 613 | TetherController::ForwardingDownstream* TetherController::findForwardingDownstream( |
| 614 | const std::string& intIface, const std::string& extIface) { |
| 615 | auto extIfaceMatches = mFwdIfaces.equal_range(extIface); |
| 616 | for (auto it = extIfaceMatches.first; it != extIfaceMatches.second; ++it) { |
| 617 | if (it->second.iface == intIface) { |
| 618 | return &(it->second); |
| 619 | } |
| 620 | } |
| 621 | return nullptr; |
| 622 | } |
| 623 | |
| 624 | void TetherController::addForwardingPair(const std::string& intIface, const std::string& extIface) { |
| 625 | ForwardingDownstream* existingEntry = findForwardingDownstream(intIface, extIface); |
| 626 | if (existingEntry != nullptr) { |
| 627 | existingEntry->active = true; |
| 628 | return; |
| 629 | } |
| 630 | |
| 631 | mFwdIfaces.insert(std::pair<std::string, ForwardingDownstream>(extIface, { |
| 632 | .iface = intIface, |
| 633 | .active = true |
| 634 | })); |
| 635 | } |
| 636 | |
| 637 | void TetherController::markForwardingPairDisabled( |
| 638 | const std::string& intIface, const std::string& extIface) { |
| 639 | ForwardingDownstream* existingEntry = findForwardingDownstream(intIface, extIface); |
| 640 | if (existingEntry == nullptr) { |
| 641 | return; |
| 642 | } |
| 643 | |
| 644 | existingEntry->active = false; |
| 645 | } |
| 646 | |
| 647 | bool TetherController::isForwardingPairEnabled( |
| 648 | const std::string& intIface, const std::string& extIface) { |
| 649 | ForwardingDownstream* existingEntry = findForwardingDownstream(intIface, extIface); |
| 650 | return existingEntry != nullptr && existingEntry->active; |
| 651 | } |
| 652 | |
| 653 | bool TetherController::isAnyForwardingEnabledOnUpstream(const std::string& extIface) { |
| 654 | auto extIfaceMatches = mFwdIfaces.equal_range(extIface); |
| 655 | for (auto it = extIfaceMatches.first; it != extIfaceMatches.second; ++it) { |
| 656 | if (it->second.active) { |
| 657 | return true; |
| 658 | } |
| 659 | } |
| 660 | return false; |
| 661 | } |
| 662 | |
| 663 | bool TetherController::isAnyForwardingPairEnabled() { |
| 664 | for (auto& it : mFwdIfaces) { |
| 665 | if (it.second.active) { |
| 666 | return true; |
| 667 | } |
| 668 | } |
| 669 | return false; |
| 670 | } |
| 671 | |
| 672 | bool TetherController::tetherCountingRuleExists( |
| 673 | const std::string& iface1, const std::string& iface2) { |
| 674 | // A counting rule exists if NAT was ever enabled for this interface pair, so if the pair |
| 675 | // is in the map regardless of its active status. Rules are added both ways so we check with |
| 676 | // the 2 combinations. |
| 677 | return findForwardingDownstream(iface1, iface2) != nullptr |
| 678 | || findForwardingDownstream(iface2, iface1) != nullptr; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 679 | } |
| 680 | |
| 681 | /* static */ |
| 682 | std::string TetherController::makeTetherCountingRule(const char *if1, const char *if2) { |
| 683 | return StringPrintf("-A %s -i %s -o %s -j RETURN", LOCAL_TETHER_COUNTERS_CHAIN, if1, if2); |
| 684 | } |
| 685 | |
| 686 | int TetherController::setForwardRules(bool add, const char *intIface, const char *extIface) { |
| 687 | const char *op = add ? "-A" : "-D"; |
| 688 | |
| 689 | std::string rpfilterCmd = StringPrintf( |
| 690 | "*raw\n" |
| 691 | "%s %s -i %s -m rpfilter --invert ! -s fe80::/64 -j DROP\n" |
| 692 | "COMMIT\n", op, LOCAL_RAW_PREROUTING, intIface); |
| 693 | if (iptablesRestoreFunction(V6, rpfilterCmd, nullptr) == -1 && add) { |
Luke Huang | 19b49c5 | 2018-10-22 12:12:05 +0900 | [diff] [blame] | 694 | return -EREMOTEIO; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 695 | } |
| 696 | |
| 697 | std::vector<std::string> v4 = { |
hiroaki.yokoyama | 04f2cb5 | 2018-06-13 18:47:30 +0900 | [diff] [blame] | 698 | "*raw", |
| 699 | StringPrintf("%s %s -p tcp --dport 21 -i %s -j CT --helper ftp", op, |
| 700 | LOCAL_RAW_PREROUTING, intIface), |
| 701 | StringPrintf("%s %s -p tcp --dport 1723 -i %s -j CT --helper pptp", op, |
| 702 | LOCAL_RAW_PREROUTING, intIface), |
| 703 | "COMMIT", |
| 704 | "*filter", |
| 705 | StringPrintf("%s %s -i %s -o %s -m state --state ESTABLISHED,RELATED -g %s", op, |
| 706 | LOCAL_FORWARD, extIface, intIface, LOCAL_TETHER_COUNTERS_CHAIN), |
| 707 | StringPrintf("%s %s -i %s -o %s -m state --state INVALID -j DROP", op, LOCAL_FORWARD, |
| 708 | intIface, extIface), |
| 709 | StringPrintf("%s %s -i %s -o %s -g %s", op, LOCAL_FORWARD, intIface, extIface, |
| 710 | LOCAL_TETHER_COUNTERS_CHAIN), |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 711 | }; |
| 712 | |
| 713 | std::vector<std::string> v6 = { |
| 714 | "*filter", |
| 715 | }; |
| 716 | |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 717 | // We only ever add tethering quota rules so that they stick. |
| 718 | if (add && !tetherCountingRuleExists(intIface, extIface)) { |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 719 | v4.push_back(makeTetherCountingRule(intIface, extIface)); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 720 | v4.push_back(makeTetherCountingRule(extIface, intIface)); |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 721 | v6.push_back(makeTetherCountingRule(intIface, extIface)); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 722 | v6.push_back(makeTetherCountingRule(extIface, intIface)); |
| 723 | } |
| 724 | |
| 725 | // Always make sure the drop rule is at the end. |
| 726 | // TODO: instead of doing this, consider just rebuilding LOCAL_FORWARD completely from scratch |
Lorenzo Colitti | 4604b4a | 2017-08-24 19:21:50 +0900 | [diff] [blame] | 727 | // every time, starting with ":tetherctrl_FORWARD -\n". This would likely be a bit simpler. |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 728 | if (add) { |
| 729 | v4.push_back(StringPrintf("-D %s -j DROP", LOCAL_FORWARD)); |
| 730 | v4.push_back(StringPrintf("-A %s -j DROP", LOCAL_FORWARD)); |
| 731 | } |
| 732 | |
| 733 | v4.push_back("COMMIT\n"); |
| 734 | v6.push_back("COMMIT\n"); |
| 735 | |
| 736 | // We only add IPv6 rules here, never remove them. |
| 737 | if (iptablesRestoreFunction(V4, Join(v4, '\n'), nullptr) == -1 || |
| 738 | (add && iptablesRestoreFunction(V6, Join(v6, '\n'), nullptr) == -1)) { |
| 739 | // unwind what's been done, but don't care about success - what more could we do? |
| 740 | if (add) { |
| 741 | setForwardRules(false, intIface, extIface); |
| 742 | } |
Luke Huang | 19b49c5 | 2018-10-22 12:12:05 +0900 | [diff] [blame] | 743 | return -EREMOTEIO; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 744 | } |
| 745 | |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 746 | if (add) { |
| 747 | addForwardingPair(intIface, extIface); |
| 748 | } else { |
| 749 | markForwardingPairDisabled(intIface, extIface); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 750 | } |
| 751 | |
| 752 | return 0; |
| 753 | } |
| 754 | |
| 755 | int TetherController::disableNat(const char* intIface, const char* extIface) { |
| 756 | if (!isIfaceName(intIface) || !isIfaceName(extIface)) { |
Luke Huang | ae038f8 | 2018-11-05 11:17:31 +0900 | [diff] [blame] | 757 | errno = ENODEV; |
| 758 | return -errno; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 759 | } |
| 760 | |
| 761 | setForwardRules(false, intIface, extIface); |
Remi NGUYEN VAN | 3b47c79 | 2018-03-20 14:44:12 +0900 | [diff] [blame] | 762 | if (!isAnyForwardingPairEnabled()) { |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 763 | setDefaults(); |
| 764 | } |
| 765 | return 0; |
| 766 | } |
| 767 | |
| 768 | void TetherController::addStats(TetherStatsList& statsList, const TetherStats& stats) { |
| 769 | for (TetherStats& existing : statsList) { |
| 770 | if (existing.addStatsIfMatch(stats)) { |
| 771 | return; |
| 772 | } |
| 773 | } |
| 774 | // No match. Insert a new interface pair. |
| 775 | statsList.push_back(stats); |
| 776 | } |
| 777 | |
| 778 | /* |
| 779 | * Parse the ptks and bytes out of: |
Lorenzo Colitti | 4604b4a | 2017-08-24 19:21:50 +0900 | [diff] [blame] | 780 | * Chain tetherctrl_counters (4 references) |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 781 | * pkts bytes target prot opt in out source destination |
| 782 | * 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0 |
| 783 | * 27 2002 RETURN all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0 |
| 784 | * 1040 107471 RETURN all -- bt-pan rmnet0 0.0.0.0/0 0.0.0.0/0 |
| 785 | * 1450 1708806 RETURN all -- rmnet0 bt-pan 0.0.0.0/0 0.0.0.0/0 |
| 786 | * or: |
Lorenzo Colitti | 4604b4a | 2017-08-24 19:21:50 +0900 | [diff] [blame] | 787 | * Chain tetherctrl_counters (0 references) |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 788 | * pkts bytes target prot opt in out source destination |
| 789 | * 0 0 RETURN all wlan0 rmnet_data0 ::/0 ::/0 |
| 790 | * 0 0 RETURN all rmnet_data0 wlan0 ::/0 ::/0 |
| 791 | * |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 792 | */ |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 793 | int TetherController::addForwardChainStats(TetherStatsList& statsList, |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 794 | const std::string& statsOutput, |
| 795 | std::string &extraProcessingInfo) { |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 796 | enum IndexOfIptChain { |
| 797 | ORIG_LINE, |
| 798 | PACKET_COUNTS, |
| 799 | BYTE_COUNTS, |
| 800 | HYPHEN, |
| 801 | IFACE0_NAME, |
| 802 | IFACE1_NAME, |
| 803 | SOURCE, |
| 804 | DESTINATION |
| 805 | }; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 806 | TetherStats stats; |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 807 | const TetherStats empty; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 808 | |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 809 | static const std::string NUM = "(\\d+)"; |
| 810 | static const std::string IFACE = "([^\\s]+)"; |
| 811 | static const std::string DST = "(0.0.0.0/0|::/0)"; |
| 812 | static const std::string COUNTERS = "\\s*" + NUM + "\\s+" + NUM + |
| 813 | " RETURN all( -- | )" + IFACE + "\\s+" + IFACE + |
| 814 | "\\s+" + DST + "\\s+" + DST; |
| 815 | static const std::regex IP_RE(COUNTERS); |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 816 | |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 817 | const std::vector<std::string> lines = base::Split(statsOutput, "\n"); |
| 818 | int headerLine = 0; |
| 819 | for (const std::string& line : lines) { |
| 820 | // Skip headers. |
| 821 | if (headerLine < 2) { |
| 822 | if (line.empty()) { |
| 823 | ALOGV("Empty header while parsing tethering stats"); |
| 824 | return -EREMOTEIO; |
| 825 | } |
| 826 | headerLine++; |
| 827 | continue; |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 828 | } |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 829 | |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 830 | if (line.empty()) continue; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 831 | |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 832 | extraProcessingInfo = line; |
| 833 | std::smatch matches; |
| 834 | if (!std::regex_search(line, matches, IP_RE)) return -EREMOTEIO; |
| 835 | // Here use IP_RE to distiguish IPv4 and IPv6 iptables. |
| 836 | // IPv4 has "--" indicating what to do with fragments... |
| 837 | // 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0 |
| 838 | // ... but IPv6 does not. |
| 839 | // 26 2373 RETURN all wlan0 rmnet0 ::/0 ::/0 |
| 840 | // TODO: Replace strtoXX() calls with ParseUint() /ParseInt() |
| 841 | int64_t packets = strtoul(matches[PACKET_COUNTS].str().c_str(), nullptr, 10); |
| 842 | int64_t bytes = strtoul(matches[BYTE_COUNTS].str().c_str(), nullptr, 10); |
| 843 | std::string iface0 = matches[IFACE0_NAME].str(); |
| 844 | std::string iface1 = matches[IFACE1_NAME].str(); |
| 845 | std::string rest = matches[SOURCE].str(); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 846 | |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 847 | ALOGV("parse iface0=<%s> iface1=<%s> pkts=%" PRId64 " bytes=%" PRId64 |
| 848 | " rest=<%s> orig line=<%s>", |
| 849 | iface0.c_str(), iface1.c_str(), packets, bytes, rest.c_str(), line.c_str()); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 850 | /* |
| 851 | * The following assumes that the 1st rule has in:extIface out:intIface, |
| 852 | * which is what TetherController sets up. |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 853 | * The 1st matches rx, and sets up the pair for the tx side. |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 854 | */ |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 855 | if (!stats.intIface[0]) { |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 856 | ALOGV("0Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64 " rx_packets=%" PRId64 |
| 857 | " ", iface0.c_str(), iface1.c_str(), bytes, packets); |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 858 | stats.intIface = iface0; |
| 859 | stats.extIface = iface1; |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 860 | stats.txPackets = packets; |
| 861 | stats.txBytes = bytes; |
Lorenzo Colitti | 9a65ac6 | 2017-09-04 18:07:56 +0900 | [diff] [blame] | 862 | } else if (stats.intIface == iface1 && stats.extIface == iface0) { |
waynema | 71a0b59 | 2018-11-21 13:31:34 +0800 | [diff] [blame] | 863 | ALOGV("0Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64 " rx_packets=%" PRId64 |
| 864 | " ", iface0.c_str(), iface1.c_str(), bytes, packets); |
Lorenzo Colitti | 9a65ac6 | 2017-09-04 18:07:56 +0900 | [diff] [blame] | 865 | stats.rxPackets = packets; |
| 866 | stats.rxBytes = bytes; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 867 | } |
| 868 | if (stats.rxBytes != -1 && stats.txBytes != -1) { |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 869 | ALOGV("rx_bytes=%" PRId64" tx_bytes=%" PRId64, stats.rxBytes, stats.txBytes); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 870 | addStats(statsList, stats); |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 871 | stats = empty; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 872 | } |
| 873 | } |
| 874 | |
| 875 | /* It is always an error to find only one side of the stats. */ |
Lorenzo Colitti | 38fd136 | 2017-09-15 11:40:01 +0900 | [diff] [blame] | 876 | if (((stats.rxBytes == -1) != (stats.txBytes == -1))) { |
Lorenzo Colitti | 9a8a9ff | 2017-01-31 19:06:59 +0900 | [diff] [blame] | 877 | return -EREMOTEIO; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 878 | } |
| 879 | return 0; |
| 880 | } |
| 881 | |
Lorenzo Colitti | 5192bf7 | 2017-09-04 13:30:59 +0900 | [diff] [blame] | 882 | StatusOr<TetherController::TetherStatsList> TetherController::getTetherStats() { |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 883 | TetherStatsList statsList; |
Lorenzo Colitti | 5192bf7 | 2017-09-04 13:30:59 +0900 | [diff] [blame] | 884 | std::string parsedIptablesOutput; |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 885 | |
| 886 | for (const IptablesTarget target : {V4, V6}) { |
| 887 | std::string statsString; |
Lorenzo Colitti | 0935339 | 2017-08-24 14:20:32 +0900 | [diff] [blame] | 888 | if (int ret = iptablesRestoreFunction(target, GET_TETHER_STATS_COMMAND, &statsString)) { |
Lorenzo Colitti | 9a8a9ff | 2017-01-31 19:06:59 +0900 | [diff] [blame] | 889 | return statusFromErrno(-ret, StringPrintf("failed to fetch tether stats (%d): %d", |
| 890 | target, ret)); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 891 | } |
| 892 | |
Lorenzo Colitti | 5192bf7 | 2017-09-04 13:30:59 +0900 | [diff] [blame] | 893 | if (int ret = addForwardChainStats(statsList, statsString, parsedIptablesOutput)) { |
Lorenzo Colitti | 9a8a9ff | 2017-01-31 19:06:59 +0900 | [diff] [blame] | 894 | return statusFromErrno(-ret, StringPrintf("failed to parse %s tether stats:\n%s", |
| 895 | target == V4 ? "IPv4": "IPv6", |
Lorenzo Colitti | 5192bf7 | 2017-09-04 13:30:59 +0900 | [diff] [blame] | 896 | parsedIptablesOutput.c_str())); |
Lorenzo Colitti | a93126d | 2017-08-24 13:28:19 +0900 | [diff] [blame] | 897 | } |
| 898 | } |
| 899 | |
Lorenzo Colitti | 9a8a9ff | 2017-01-31 19:06:59 +0900 | [diff] [blame] | 900 | return statsList; |
| 901 | } |
| 902 | |
Lorenzo Colitti | e20a526 | 2017-05-09 18:30:44 +0900 | [diff] [blame] | 903 | } // namespace net |
| 904 | } // namespace android |