server/IdletimerController.cpp

/*
 * Copyright (C) 2012 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/*
 * MODUS OPERANDI
 * --------------
 *
 * IPTABLES command sequence:
 *
 * iptables -F
 *
 * iptables -t raw -F idletimer_PREROUTING
 * iptables -t mangle -F idletimer_POSTROUTING
 *
 *
 * iptables -t raw -N idletimer_PREROUTING
 * iptables -t mangle -N idletimer_POSTROUTING
 *
 * iptables -t raw -D PREROUTING -j idletimer_PREROUTING
 * iptables -t mangle -D POSTROUTING -j idletimer_POSTROUTING
 *
 *
 * iptables -t raw -I PREROUTING -j idletimer_PREROUTING
 * iptables -t mangle -I POSTROUTING -j idletimer_POSTROUTING
 *
 * # For notifications to work the lable name must match the name of a valid interface.
 * # If the label name does match an interface, the rules will be a no-op.
 *
 * iptables -t raw -A idletimer_PREROUTING -i rmnet0 -j IDLETIMER  --timeout 5 --label test-chain --send_nl_msg 1
 * iptables -t mangle -A idletimer_POSTROUTING -o rmnet0 -j IDLETIMER  --timeout 5 --label test-chain --send_nl_msg 1
 *
 * iptables -nxvL -t raw
 * iptables -nxvL -t mangle
 *
 * =================
 *
 * ndc command sequence
 * ------------------
 * ndc idletimer enable
 * ndc idletimer add <iface> <timeout> <class label>
 * ndc idletimer remove <iface> <timeout> <class label>
 *
 * Monitor effect on the iptables chains after each step using:
 *     iptables -nxvL -t raw
 *     iptables -nxvL -t mangle
 *
 * Remember that the timeout value has to be same at the time of the
 * removal.
 *
 * =================
 *
 * Verifying the iptables rule
 * ---------------------------
 * We want to make sure the iptable rules capture every packet. It can be
 * verified with tcpdump. First take a note of the pkts count for the two rules:
 *
 * adb shell iptables -t mangle -L idletimer_mangle_POSTROUTING -v && adb shell iptables -t raw -L idletimer_raw_PREROUTING -v
 *
 * And then, before any network traffics happen on the device, run tcpdump:
 *
 * adb shell tcpdump | tee tcpdump.log
 *
 * After a while run iptables commands again, you could then count the number
 * of incoming and outgoing packets captured by tcpdump, and compare that with
 * the numbers reported by iptables command. There shouldn't be too much
 * difference on these numbers, i.e., with 2000 packets captured it should
 * differ by less than 5.
 *
 * =================
 *
 * Note that currently if the name of the iface is incorrect, iptables
 * will setup rules without checking if it is the name of a valid
 * interface (although no notifications will ever be received).  It is
 * the responsibility of code in Java land to ensure that the interface name
 * is correct. The benefit of this, is that idletimers can be setup on
 * interfaces than come and go.
 *
 * A remove should be called for each add command issued during cleanup, as duplicate
 * entries of the rule may exist and will all have to removed.
 *
 */

#define LOG_NDEBUG 0

#include <stdlib.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <cutils/properties.h>

#define LOG_TAG "IdletimerController"
#include <cutils/log.h>
#include <logwrap/logwrap.h>

#include "IdletimerController.h"
#include "NetdConstants.h"

const char* IdletimerController::LOCAL_RAW_PREROUTING = "idletimer_raw_PREROUTING";
const char* IdletimerController::LOCAL_MANGLE_POSTROUTING = "idletimer_mangle_POSTROUTING";

IdletimerController::IdletimerController() {
}

IdletimerController::~IdletimerController() {
}
/* return 0 or non-zero */
int IdletimerController::runIpxtablesCmd(int argc, const char **argv) {
    int resIpv4, resIpv6;

    // Running for IPv4
    argv[0] = IPTABLES_PATH;
    resIpv4 = android_fork_execvp(argc, (char **)argv, NULL, false, false);

    // Running for IPv6
    argv[0] = IP6TABLES_PATH;
    resIpv6 = android_fork_execvp(argc, (char **)argv, NULL, false, false);

#if !LOG_NDEBUG
    std::string full_cmd = argv[0];
    argc--; argv++;
    for (; argc; argc--, argv++) {
        full_cmd += " ";
        full_cmd += argv[0];
    }
    ALOGV("runCmd(%s) res_ipv4=%d, res_ipv6=%d", full_cmd.c_str(), resIpv4, resIpv6);
#endif

    return (resIpv4 == 0 && resIpv6 == 0) ? 0 : -1;
}

bool IdletimerController::setupIptablesHooks() {
    return true;
}

int IdletimerController::setDefaults() {
  int res;
  const char *cmd1[] = {
      NULL, // To be filled inside runIpxtablesCmd
      "-w",
      "-W",
      IPTABLES_RETRY_INTERVAL,
      "-t",
      "raw",
      "-F",
      LOCAL_RAW_PREROUTING
  };
  res = runIpxtablesCmd(ARRAY_SIZE(cmd1), cmd1);

  if (res)
    return res;

  const char *cmd2[] = {
      NULL, // To be filled inside runIpxtablesCmd
      "-w",
      "-W",
      IPTABLES_RETRY_INTERVAL,
      "-t",
      "mangle",
      "-F",
      LOCAL_MANGLE_POSTROUTING
  };
  res = runIpxtablesCmd(ARRAY_SIZE(cmd2), cmd2);

  return res;
}

int IdletimerController::enableIdletimerControl() {
    int res = setDefaults();
    return res;
}

int IdletimerController::disableIdletimerControl() {
    int res = setDefaults();
    return res;
}

int IdletimerController::modifyInterfaceIdletimer(IptOp op, const char *iface,
                                                  uint32_t timeout,
                                                  const char *classLabel) {
  int res;
  char timeout_str[11]; //enough to store any 32-bit unsigned decimal

  if (!isIfaceName(iface)) {
    errno = ENOENT;
    return -1;
  }

  snprintf(timeout_str, sizeof(timeout_str), "%u", timeout);

  const char *cmd1[] = {
      NULL, // To be filled inside runIpxtablesCmd
      "-w",
      "-W",
      IPTABLES_RETRY_INTERVAL,
      "-t",
      "raw",
      (op == IptOpAdd) ? "-A" : "-D",
      LOCAL_RAW_PREROUTING,
      "-i",
      iface,
      "-j",
      "IDLETIMER",
      "--timeout",
      timeout_str,
      "--label",
      classLabel,
      "--send_nl_msg",
      "1"
  };
  res = runIpxtablesCmd(ARRAY_SIZE(cmd1), cmd1);

  if (res)
    return res;

  const char *cmd2[] = {
      NULL, // To be filled inside runIpxtablesCmd
      "-w",
      "-W",
      IPTABLES_RETRY_INTERVAL,
      "-t",
      "mangle",
      (op == IptOpAdd) ? "-A" : "-D",
      LOCAL_MANGLE_POSTROUTING,
      "-o",
      iface,
      "-j",
      "IDLETIMER",
      "--timeout",
      timeout_str,
      "--label",
      classLabel,
      "--send_nl_msg",
      "1"
  };
  res = runIpxtablesCmd(ARRAY_SIZE(cmd2), cmd2);

  return res;
}

int IdletimerController::addInterfaceIdletimer(const char *iface,
                                               uint32_t timeout,
                                               const char *classLabel) {
  return modifyInterfaceIdletimer(IptOpAdd, iface, timeout, classLabel);
}

int IdletimerController::removeInterfaceIdletimer(const char *iface,
                                                  uint32_t timeout,
                                                  const char *classLabel) {
  return modifyInterfaceIdletimer(IptOpDelete, iface, timeout, classLabel);
}