123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402 |
- #include <set>
- #include <errno.h>
- #include <limits.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
- #include <cstdint>
- #define LOG_TAG "FirewallController"
- #define LOG_NDEBUG 0
- #include <android-base/file.h>
- #include <android-base/stringprintf.h>
- #include <android-base/strings.h>
- #include <log/log.h>
- #include "Controllers.h"
- #include "FirewallController.h"
- #include "NetdConstants.h"
- #include "bpf/BpfUtils.h"
- using android::base::Join;
- using android::base::ReadFileToString;
- using android::base::Split;
- using android::base::StringAppendF;
- using android::base::StringPrintf;
- using android::bpf::BpfLevel;
- using android::net::gCtls;
- namespace {
- constexpr const uid_t kDefaultMaximumUid = UID_MAX - 1;
- const char kUidMapProcFile[] = "/proc/self/uid_map";
- android::bpf::BpfLevel getBpfOwnerStatus() {
- return gCtls->trafficCtrl.getBpfLevel();
- }
- }
- namespace android {
- namespace net {
- auto FirewallController::execIptablesRestore = ::execIptablesRestore;
- const char* FirewallController::TABLE = "filter";
- const char* FirewallController::LOCAL_INPUT = "fw_INPUT";
- const char* FirewallController::LOCAL_OUTPUT = "fw_OUTPUT";
- const char* FirewallController::LOCAL_FORWARD = "fw_FORWARD";
- const char* FirewallController::LOCAL_DOZABLE = "fw_dozable";
- const char* FirewallController::LOCAL_STANDBY = "fw_standby";
- const char* FirewallController::LOCAL_POWERSAVE = "fw_powersave";
- const char* FirewallController::ICMPV6_TYPES[] = {
- "packet-too-big",
- "router-solicitation",
- "router-advertisement",
- "neighbour-solicitation",
- "neighbour-advertisement",
- "redirect",
- };
- FirewallController::FirewallController(void) : mMaxUid(discoverMaximumValidUid(kUidMapProcFile)) {
-
- mFirewallType = BLACKLIST;
- mIfaceRules = {};
- }
- int FirewallController::setupIptablesHooks(void) {
- int res = 0;
- mUseBpfOwnerMatch = getBpfOwnerStatus();
- if (mUseBpfOwnerMatch != BpfLevel::NONE) {
- return res;
- }
- res |= createChain(LOCAL_DOZABLE, getFirewallType(DOZABLE));
- res |= createChain(LOCAL_STANDBY, getFirewallType(STANDBY));
- res |= createChain(LOCAL_POWERSAVE, getFirewallType(POWERSAVE));
- return res;
- }
- int FirewallController::setFirewallType(FirewallType ftype) {
- int res = 0;
- if (mFirewallType != ftype) {
-
- resetFirewall();
- if (ftype == WHITELIST) {
-
- std::string command =
- "*filter\n"
- "-A fw_INPUT -j DROP\n"
- "-A fw_OUTPUT -j REJECT\n"
- "-A fw_FORWARD -j REJECT\n"
- "COMMIT\n";
- res = execIptablesRestore(V4V6, command.c_str());
- }
-
- mFirewallType = ftype;
- }
- return res ? -EREMOTEIO : 0;
- }
- int FirewallController::resetFirewall(void) {
- mFirewallType = WHITELIST;
- mIfaceRules.clear();
-
- std::string command =
- "*filter\n"
- ":fw_INPUT -\n"
- ":fw_OUTPUT -\n"
- ":fw_FORWARD -\n"
- "COMMIT\n";
- return (execIptablesRestore(V4V6, command.c_str()) == 0) ? 0 : -EREMOTEIO;
- }
- int FirewallController::enableChildChains(ChildChain chain, bool enable) {
- int res = 0;
- const char* name;
- switch(chain) {
- case DOZABLE:
- name = LOCAL_DOZABLE;
- break;
- case STANDBY:
- name = LOCAL_STANDBY;
- break;
- case POWERSAVE:
- name = LOCAL_POWERSAVE;
- break;
- default:
- return res;
- }
- if (mUseBpfOwnerMatch != BpfLevel::NONE) {
- return gCtls->trafficCtrl.toggleUidOwnerMap(chain, enable);
- }
- std::string command = "*filter\n";
- for (const char *parent : { LOCAL_INPUT, LOCAL_OUTPUT }) {
- StringAppendF(&command, "%s %s -j %s\n", (enable ? "-A" : "-D"), parent, name);
- }
- StringAppendF(&command, "COMMIT\n");
- return execIptablesRestore(V4V6, command);
- }
- int FirewallController::isFirewallEnabled(void) {
-
- return -1;
- }
- int FirewallController::setInterfaceRule(const char* iface, FirewallRule rule) {
- if (mFirewallType == BLACKLIST) {
-
- return -EINVAL;
- }
- if (!isIfaceName(iface)) {
- errno = ENOENT;
- return -ENOENT;
- }
-
-
-
- const char* op;
- if (rule == ALLOW && mIfaceRules.find(iface) == mIfaceRules.end()) {
- op = "-I";
- mIfaceRules.insert(iface);
- } else if (rule == DENY && mIfaceRules.find(iface) != mIfaceRules.end()) {
- op = "-D";
- mIfaceRules.erase(iface);
- } else {
- return 0;
- }
- std::string command = Join(std::vector<std::string> {
- "*filter",
- StringPrintf("%s fw_INPUT -i %s -j RETURN", op, iface),
- StringPrintf("%s fw_OUTPUT -o %s -j RETURN", op, iface),
- "COMMIT\n"
- }, "\n");
- return (execIptablesRestore(V4V6, command) == 0) ? 0 : -EREMOTEIO;
- }
- FirewallType FirewallController::getFirewallType(ChildChain chain) {
- switch(chain) {
- case DOZABLE:
- return WHITELIST;
- case STANDBY:
- return BLACKLIST;
- case POWERSAVE:
- return WHITELIST;
- case NONE:
- return mFirewallType;
- default:
- return BLACKLIST;
- }
- }
- int FirewallController::setUidRule(ChildChain chain, int uid, FirewallRule rule) {
- const char* op;
- const char* target;
- FirewallType firewallType = getFirewallType(chain);
- if (firewallType == WHITELIST) {
- target = "RETURN";
-
- op = (rule == ALLOW)? "-I" : "-D";
- } else {
- target = "DROP";
-
- op = (rule == DENY)? "-A" : "-D";
- }
- std::vector<std::string> chainNames;
- switch(chain) {
- case DOZABLE:
- chainNames = { LOCAL_DOZABLE };
- break;
- case STANDBY:
- chainNames = { LOCAL_STANDBY };
- break;
- case POWERSAVE:
- chainNames = { LOCAL_POWERSAVE };
- break;
- case NONE:
- chainNames = { LOCAL_INPUT, LOCAL_OUTPUT };
- break;
- default:
- ALOGW("Unknown child chain: %d", chain);
- return -EINVAL;
- }
- if (mUseBpfOwnerMatch != BpfLevel::NONE) {
- return gCtls->trafficCtrl.changeUidOwnerRule(chain, uid, rule, firewallType);
- }
- std::string command = "*filter\n";
- for (const std::string& chainName : chainNames) {
- StringAppendF(&command, "%s %s -m owner --uid-owner %d -j %s\n",
- op, chainName.c_str(), uid, target);
- }
- StringAppendF(&command, "COMMIT\n");
- return (execIptablesRestore(V4V6, command) == 0) ? 0 : -EREMOTEIO;
- }
- int FirewallController::createChain(const char* chain, FirewallType type) {
- static const std::vector<int32_t> NO_UIDS;
- return replaceUidChain(chain, type == WHITELIST, NO_UIDS);
- }
- std::string FirewallController::makeCriticalCommands(IptablesTarget target, const char* chainName) {
-
- std::string commands;
- if (target == V6) {
- for (size_t i = 0; i < ARRAY_SIZE(ICMPV6_TYPES); i++) {
- StringAppendF(&commands, "-A %s -p icmpv6 --icmpv6-type %s -j RETURN\n",
- chainName, ICMPV6_TYPES[i]);
- }
- }
- return commands;
- }
- std::string FirewallController::makeUidRules(IptablesTarget target, const char *name,
- bool isWhitelist, const std::vector<int32_t>& uids) {
- std::string commands;
- StringAppendF(&commands, "*filter\n:%s -\n", name);
-
- if (isWhitelist) {
- for (auto uid : uids) {
- StringAppendF(&commands, "-A %s -m owner --uid-owner %d -j RETURN\n", name, uid);
- }
-
- StringAppendF(&commands,
- "-A %s -m owner --uid-owner %d-%d -j RETURN\n", name, 0, MAX_SYSTEM_UID);
-
-
- StringAppendF(&commands,
- "-A %s -m owner ! --uid-owner %d-%u -j RETURN\n", name, 0, mMaxUid);
-
- StringAppendF(&commands, "-A %s -p esp -j RETURN\n", name);
- }
-
- StringAppendF(&commands, "-A %s -i lo -j RETURN\n", name);
- StringAppendF(&commands, "-A %s -o lo -j RETURN\n", name);
-
-
- StringAppendF(&commands, "-A %s -p tcp --tcp-flags RST RST -j RETURN\n", name);
- if (isWhitelist) {
- commands.append(makeCriticalCommands(target, name));
- }
-
- if (!isWhitelist) {
- for (auto uid : uids) {
- StringAppendF(&commands, "-A %s -m owner --uid-owner %d -j DROP\n", name, uid);
- }
- }
-
-
- if (isWhitelist) {
- StringAppendF(&commands, "-A %s -j DROP\n", name);
- }
- StringAppendF(&commands, "COMMIT\n");
- return commands;
- }
- int FirewallController::replaceUidChain(
- const std::string &name, bool isWhitelist, const std::vector<int32_t>& uids) {
- if (mUseBpfOwnerMatch != BpfLevel::NONE) {
- return gCtls->trafficCtrl.replaceUidOwnerMap(name, isWhitelist, uids);
- }
- std::string commands4 = makeUidRules(V4, name.c_str(), isWhitelist, uids);
- std::string commands6 = makeUidRules(V6, name.c_str(), isWhitelist, uids);
- return execIptablesRestore(V4, commands4.c_str()) | execIptablesRestore(V6, commands6.c_str());
- }
- uid_t FirewallController::discoverMaximumValidUid(const std::string& fileName) {
- std::string content;
- if (!ReadFileToString(fileName, &content, false)) {
-
- ALOGD("Could not read %s, max uid defaulting to %u", fileName.c_str(), kDefaultMaximumUid);
- return kDefaultMaximumUid;
- }
- std::vector<std::string> lines = Split(content, "\n");
- if (lines.empty()) {
- ALOGD("%s was empty, max uid defaulting to %u", fileName.c_str(), kDefaultMaximumUid);
- return kDefaultMaximumUid;
- }
- uint32_t maxUid = 0;
- for (const auto& line : lines) {
- if (line.empty()) {
- continue;
- }
-
- uint32_t start;
- uint32_t ignored;
- uint32_t rangeLength;
- int items = sscanf(line.c_str(), "%u %u %u", &start, &ignored, &rangeLength);
- if (items != 3) {
-
- ALOGD("Format of %s unrecognized, max uid defaulting to %u", fileName.c_str(),
- kDefaultMaximumUid);
- return kDefaultMaximumUid;
- }
- maxUid = std::max(maxUid, start + rangeLength - 1);
- }
- if (maxUid == 0) {
- ALOGD("No max uid found, max uid defaulting to %u", kDefaultMaximumUid);
- return kDefaultMaximumUid;
- }
- return maxUid;
- }
- }
- }
|