xref: /aosp_15_r20/system/netd/server/Controllers.cpp (revision 8542734a0dd1db395a4d42aae09c37f3c3c3e7a1)
1*8542734aSAndroid Build Coastguard Worker /*
2*8542734aSAndroid Build Coastguard Worker  * Copyright (C) 2016 The Android Open Source Project
3*8542734aSAndroid Build Coastguard Worker  *
4*8542734aSAndroid Build Coastguard Worker  * Licensed under the Apache License, Version 2.0 (the "License");
5*8542734aSAndroid Build Coastguard Worker  * you may not use this file except in compliance with the License.
6*8542734aSAndroid Build Coastguard Worker  * You may obtain a copy of the License at
7*8542734aSAndroid Build Coastguard Worker  *
8*8542734aSAndroid Build Coastguard Worker  *      http://www.apache.org/licenses/LICENSE-2.0
9*8542734aSAndroid Build Coastguard Worker  *
10*8542734aSAndroid Build Coastguard Worker  * Unless required by applicable law or agreed to in writing, software
11*8542734aSAndroid Build Coastguard Worker  * distributed under the License is distributed on an "AS IS" BASIS,
12*8542734aSAndroid Build Coastguard Worker  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13*8542734aSAndroid Build Coastguard Worker  * See the License for the specific language governing permissions and
14*8542734aSAndroid Build Coastguard Worker  * limitations under the License.
15*8542734aSAndroid Build Coastguard Worker  */
16*8542734aSAndroid Build Coastguard Worker 
17*8542734aSAndroid Build Coastguard Worker #include <cinttypes>
18*8542734aSAndroid Build Coastguard Worker #include <regex>
19*8542734aSAndroid Build Coastguard Worker #include <set>
20*8542734aSAndroid Build Coastguard Worker #include <string>
21*8542734aSAndroid Build Coastguard Worker 
22*8542734aSAndroid Build Coastguard Worker #include <android-base/stringprintf.h>
23*8542734aSAndroid Build Coastguard Worker #include <android-base/strings.h>
24*8542734aSAndroid Build Coastguard Worker #include <netdutils/Stopwatch.h>
25*8542734aSAndroid Build Coastguard Worker 
26*8542734aSAndroid Build Coastguard Worker #define LOG_TAG "Netd"
27*8542734aSAndroid Build Coastguard Worker #include <log/log.h>
28*8542734aSAndroid Build Coastguard Worker 
29*8542734aSAndroid Build Coastguard Worker #include "ConnmarkFlags.h"
30*8542734aSAndroid Build Coastguard Worker #include "Controllers.h"
31*8542734aSAndroid Build Coastguard Worker #include "IdletimerController.h"
32*8542734aSAndroid Build Coastguard Worker #include "NetworkController.h"
33*8542734aSAndroid Build Coastguard Worker #include "RouteController.h"
34*8542734aSAndroid Build Coastguard Worker #include "XfrmController.h"
35*8542734aSAndroid Build Coastguard Worker #include "oem_iptables_hook.h"
36*8542734aSAndroid Build Coastguard Worker 
37*8542734aSAndroid Build Coastguard Worker namespace android {
38*8542734aSAndroid Build Coastguard Worker namespace net {
39*8542734aSAndroid Build Coastguard Worker 
40*8542734aSAndroid Build Coastguard Worker using android::base::Join;
41*8542734aSAndroid Build Coastguard Worker using android::base::StringAppendF;
42*8542734aSAndroid Build Coastguard Worker using android::base::StringPrintf;
43*8542734aSAndroid Build Coastguard Worker using android::netdutils::Stopwatch;
44*8542734aSAndroid Build Coastguard Worker 
45*8542734aSAndroid Build Coastguard Worker auto Controllers::execIptablesRestore  = ::execIptablesRestore;
46*8542734aSAndroid Build Coastguard Worker auto Controllers::execIptablesRestoreWithOutput = ::execIptablesRestoreWithOutput;
47*8542734aSAndroid Build Coastguard Worker 
48*8542734aSAndroid Build Coastguard Worker netdutils::Log gLog("netd");
49*8542734aSAndroid Build Coastguard Worker netdutils::Log gUnsolicitedLog("netdUnsolicited");
50*8542734aSAndroid Build Coastguard Worker 
51*8542734aSAndroid Build Coastguard Worker namespace {
52*8542734aSAndroid Build Coastguard Worker 
53*8542734aSAndroid Build Coastguard Worker static constexpr char CONNMARK_MANGLE_INPUT[] = "connmark_mangle_INPUT";
54*8542734aSAndroid Build Coastguard Worker static constexpr char CONNMARK_MANGLE_OUTPUT[] = "connmark_mangle_OUTPUT";
55*8542734aSAndroid Build Coastguard Worker 
56*8542734aSAndroid Build Coastguard Worker /**
57*8542734aSAndroid Build Coastguard Worker  * List of module chains to be created, along with explicit ordering. ORDERING
58*8542734aSAndroid Build Coastguard Worker  * IS CRITICAL, AND SHOULD BE TRIPLE-CHECKED WITH EACH CHANGE.
59*8542734aSAndroid Build Coastguard Worker  */
60*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> FILTER_INPUT = {
61*8542734aSAndroid Build Coastguard Worker         // Bandwidth should always be early in input chain, to make sure we
62*8542734aSAndroid Build Coastguard Worker         // correctly count incoming traffic against data plan.
63*8542734aSAndroid Build Coastguard Worker         BandwidthController::LOCAL_INPUT,
64*8542734aSAndroid Build Coastguard Worker         FirewallController::LOCAL_INPUT,
65*8542734aSAndroid Build Coastguard Worker };
66*8542734aSAndroid Build Coastguard Worker 
67*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> FILTER_FORWARD = {
68*8542734aSAndroid Build Coastguard Worker         OEM_IPTABLES_FILTER_FORWARD,
69*8542734aSAndroid Build Coastguard Worker         FirewallController::LOCAL_FORWARD,
70*8542734aSAndroid Build Coastguard Worker         BandwidthController::LOCAL_FORWARD,
71*8542734aSAndroid Build Coastguard Worker         TetherController::LOCAL_FORWARD,
72*8542734aSAndroid Build Coastguard Worker };
73*8542734aSAndroid Build Coastguard Worker 
74*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> FILTER_OUTPUT = {
75*8542734aSAndroid Build Coastguard Worker         OEM_IPTABLES_FILTER_OUTPUT,
76*8542734aSAndroid Build Coastguard Worker         FirewallController::LOCAL_OUTPUT,
77*8542734aSAndroid Build Coastguard Worker         StrictController::LOCAL_OUTPUT,
78*8542734aSAndroid Build Coastguard Worker         BandwidthController::LOCAL_OUTPUT,
79*8542734aSAndroid Build Coastguard Worker };
80*8542734aSAndroid Build Coastguard Worker 
81*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> RAW_PREROUTING = {
82*8542734aSAndroid Build Coastguard Worker         IdletimerController::LOCAL_RAW_PREROUTING,
83*8542734aSAndroid Build Coastguard Worker         BandwidthController::LOCAL_RAW_PREROUTING,
84*8542734aSAndroid Build Coastguard Worker         TetherController::LOCAL_RAW_PREROUTING,
85*8542734aSAndroid Build Coastguard Worker };
86*8542734aSAndroid Build Coastguard Worker 
87*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> MANGLE_POSTROUTING = {
88*8542734aSAndroid Build Coastguard Worker         OEM_IPTABLES_MANGLE_POSTROUTING,
89*8542734aSAndroid Build Coastguard Worker         BandwidthController::LOCAL_MANGLE_POSTROUTING,
90*8542734aSAndroid Build Coastguard Worker         IdletimerController::LOCAL_MANGLE_POSTROUTING,
91*8542734aSAndroid Build Coastguard Worker };
92*8542734aSAndroid Build Coastguard Worker 
93*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> MANGLE_INPUT = {
94*8542734aSAndroid Build Coastguard Worker         CONNMARK_MANGLE_INPUT,
95*8542734aSAndroid Build Coastguard Worker         WakeupController::LOCAL_MANGLE_INPUT,
96*8542734aSAndroid Build Coastguard Worker         RouteController::LOCAL_MANGLE_INPUT,
97*8542734aSAndroid Build Coastguard Worker };
98*8542734aSAndroid Build Coastguard Worker 
99*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> MANGLE_FORWARD = {
100*8542734aSAndroid Build Coastguard Worker         TetherController::LOCAL_MANGLE_FORWARD,
101*8542734aSAndroid Build Coastguard Worker };
102*8542734aSAndroid Build Coastguard Worker 
103*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> MANGLE_OUTPUT = {
104*8542734aSAndroid Build Coastguard Worker         CONNMARK_MANGLE_OUTPUT,
105*8542734aSAndroid Build Coastguard Worker };
106*8542734aSAndroid Build Coastguard Worker 
107*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> NAT_PREROUTING = {
108*8542734aSAndroid Build Coastguard Worker         OEM_IPTABLES_NAT_PREROUTING,
109*8542734aSAndroid Build Coastguard Worker };
110*8542734aSAndroid Build Coastguard Worker 
111*8542734aSAndroid Build Coastguard Worker static const std::vector<const char*> NAT_POSTROUTING = {
112*8542734aSAndroid Build Coastguard Worker         TetherController::LOCAL_NAT_POSTROUTING,
113*8542734aSAndroid Build Coastguard Worker };
114*8542734aSAndroid Build Coastguard Worker 
115*8542734aSAndroid Build Coastguard Worker // Commands to create child chains and to match created chains in iptables -S output. Keep in sync.
116*8542734aSAndroid Build Coastguard Worker static const char* CHILD_CHAIN_TEMPLATE = "-A %s -j %s\n";
117*8542734aSAndroid Build Coastguard Worker static const std::regex CHILD_CHAIN_REGEX("^-A ([^ ]+) -j ([^ ]+)$",
118*8542734aSAndroid Build Coastguard Worker                                           std::regex_constants::extended);
119*8542734aSAndroid Build Coastguard Worker 
120*8542734aSAndroid Build Coastguard Worker }  // namespace
121*8542734aSAndroid Build Coastguard Worker 
122*8542734aSAndroid Build Coastguard Worker /* static */
findExistingChildChains(const IptablesTarget target,const char * table,const char * parentChain)123*8542734aSAndroid Build Coastguard Worker std::set<std::string> Controllers::findExistingChildChains(const IptablesTarget target,
124*8542734aSAndroid Build Coastguard Worker                                                            const char* table,
125*8542734aSAndroid Build Coastguard Worker                                                            const char* parentChain) {
126*8542734aSAndroid Build Coastguard Worker     if (target == V4V6) {
127*8542734aSAndroid Build Coastguard Worker         ALOGE("findExistingChildChains only supports one protocol at a time");
128*8542734aSAndroid Build Coastguard Worker         abort();
129*8542734aSAndroid Build Coastguard Worker     }
130*8542734aSAndroid Build Coastguard Worker 
131*8542734aSAndroid Build Coastguard Worker     std::set<std::string> existing;
132*8542734aSAndroid Build Coastguard Worker 
133*8542734aSAndroid Build Coastguard Worker     // List the current contents of parentChain.
134*8542734aSAndroid Build Coastguard Worker     //
135*8542734aSAndroid Build Coastguard Worker     // TODO: there is no guarantee that nothing else modifies the chain in the few milliseconds
136*8542734aSAndroid Build Coastguard Worker     // between when we list the existing rules and when we delete them. However:
137*8542734aSAndroid Build Coastguard Worker     // - Since this code is only run on startup, nothing else in netd will be running.
138*8542734aSAndroid Build Coastguard Worker     // - While vendor code is known to add its own rules to chains created by netd, it should never
139*8542734aSAndroid Build Coastguard Worker     //   be modifying the rules in childChains or the rules that hook said chains into their parent
140*8542734aSAndroid Build Coastguard Worker     //   chains.
141*8542734aSAndroid Build Coastguard Worker     std::string command = StringPrintf("*%s\n-S %s\nCOMMIT\n", table, parentChain);
142*8542734aSAndroid Build Coastguard Worker     std::string output;
143*8542734aSAndroid Build Coastguard Worker     if (Controllers::execIptablesRestoreWithOutput(target, command, &output) == -1) {
144*8542734aSAndroid Build Coastguard Worker         ALOGE("Error listing chain %s in table %s", parentChain, table);
145*8542734aSAndroid Build Coastguard Worker         return existing;
146*8542734aSAndroid Build Coastguard Worker     }
147*8542734aSAndroid Build Coastguard Worker 
148*8542734aSAndroid Build Coastguard Worker     // The only rules added by createChildChains are of the simple form "-A <parent> -j <child>".
149*8542734aSAndroid Build Coastguard Worker     // Find those rules and add each one's child chain to existing.
150*8542734aSAndroid Build Coastguard Worker     std::smatch matches;
151*8542734aSAndroid Build Coastguard Worker     std::stringstream stream(output);
152*8542734aSAndroid Build Coastguard Worker     std::string rule;
153*8542734aSAndroid Build Coastguard Worker     while (std::getline(stream, rule, '\n')) {
154*8542734aSAndroid Build Coastguard Worker         if (std::regex_search(rule, matches, CHILD_CHAIN_REGEX) && matches[1] == parentChain) {
155*8542734aSAndroid Build Coastguard Worker             existing.insert(matches[2]);
156*8542734aSAndroid Build Coastguard Worker         }
157*8542734aSAndroid Build Coastguard Worker     }
158*8542734aSAndroid Build Coastguard Worker 
159*8542734aSAndroid Build Coastguard Worker     return existing;
160*8542734aSAndroid Build Coastguard Worker }
161*8542734aSAndroid Build Coastguard Worker 
162*8542734aSAndroid Build Coastguard Worker /* static */
createChildChains(IptablesTarget target,const char * table,const char * parentChain,const std::vector<const char * > & childChains,bool exclusive)163*8542734aSAndroid Build Coastguard Worker void Controllers::createChildChains(IptablesTarget target, const char* table,
164*8542734aSAndroid Build Coastguard Worker                                     const char* parentChain,
165*8542734aSAndroid Build Coastguard Worker                                     const std::vector<const char*>& childChains,
166*8542734aSAndroid Build Coastguard Worker                                     bool exclusive) {
167*8542734aSAndroid Build Coastguard Worker     std::string command = StringPrintf("*%s\n", table);
168*8542734aSAndroid Build Coastguard Worker 
169*8542734aSAndroid Build Coastguard Worker     // We cannot just clear all the chains we create because vendor code modifies filter OUTPUT and
170*8542734aSAndroid Build Coastguard Worker     // mangle POSTROUTING directly. So:
171*8542734aSAndroid Build Coastguard Worker     //
172*8542734aSAndroid Build Coastguard Worker     // - If we're the exclusive owner of this chain, simply clear it entirely.
173*8542734aSAndroid Build Coastguard Worker     // - If not, then list the chain's current contents to ensure that if we restart after a crash,
174*8542734aSAndroid Build Coastguard Worker     //   we leave the existing rules alone in the positions they currently occupy. This is faster
175*8542734aSAndroid Build Coastguard Worker     //   than blindly deleting our rules and recreating them, because deleting a rule that doesn't
176*8542734aSAndroid Build Coastguard Worker     //   exists causes iptables-restore to quit, which takes ~30ms per delete. It's also more
177*8542734aSAndroid Build Coastguard Worker     //   correct, because if we delete rules and re-add them, they'll be in the wrong position with
178*8542734aSAndroid Build Coastguard Worker     //   regards to the vendor rules.
179*8542734aSAndroid Build Coastguard Worker     //
180*8542734aSAndroid Build Coastguard Worker     // TODO: Make all chains exclusive once vendor code uses the oem_* rules.
181*8542734aSAndroid Build Coastguard Worker     std::set<std::string> existingChildChains;
182*8542734aSAndroid Build Coastguard Worker     if (exclusive) {
183*8542734aSAndroid Build Coastguard Worker         // Just running ":chain -" flushes user-defined chains, but not built-in chains like INPUT.
184*8542734aSAndroid Build Coastguard Worker         // Since at this point we don't know if parentChain is a built-in chain, do both.
185*8542734aSAndroid Build Coastguard Worker         StringAppendF(&command, ":%s -\n", parentChain);
186*8542734aSAndroid Build Coastguard Worker         StringAppendF(&command, "-F %s\n", parentChain);
187*8542734aSAndroid Build Coastguard Worker     } else {
188*8542734aSAndroid Build Coastguard Worker         existingChildChains = findExistingChildChains(target, table, parentChain);
189*8542734aSAndroid Build Coastguard Worker     }
190*8542734aSAndroid Build Coastguard Worker 
191*8542734aSAndroid Build Coastguard Worker     for (const auto& childChain : childChains) {
192*8542734aSAndroid Build Coastguard Worker         // Always clear the child chain.
193*8542734aSAndroid Build Coastguard Worker         StringAppendF(&command, ":%s -\n", childChain);
194*8542734aSAndroid Build Coastguard Worker         // But only add it to the parent chain if it's not already there.
195*8542734aSAndroid Build Coastguard Worker         if (existingChildChains.find(childChain) == existingChildChains.end()) {
196*8542734aSAndroid Build Coastguard Worker             StringAppendF(&command, CHILD_CHAIN_TEMPLATE, parentChain, childChain);
197*8542734aSAndroid Build Coastguard Worker         }
198*8542734aSAndroid Build Coastguard Worker     }
199*8542734aSAndroid Build Coastguard Worker     command += "COMMIT\n";
200*8542734aSAndroid Build Coastguard Worker     execIptablesRestore(target, command);
201*8542734aSAndroid Build Coastguard Worker }
202*8542734aSAndroid Build Coastguard Worker 
Controllers()203*8542734aSAndroid Build Coastguard Worker Controllers::Controllers()
204*8542734aSAndroid Build Coastguard Worker     : wakeupCtrl(
205*8542734aSAndroid Build Coastguard Worker               [this](const WakeupController::ReportArgs& args) {
206*8542734aSAndroid Build Coastguard Worker                   const auto listener = eventReporter.getNetdEventListener();
207*8542734aSAndroid Build Coastguard Worker                   if (listener == nullptr) {
208*8542734aSAndroid Build Coastguard Worker                       gLog.error("getNetdEventListener() returned nullptr. dropping wakeup event");
209*8542734aSAndroid Build Coastguard Worker                       return;
210*8542734aSAndroid Build Coastguard Worker                   }
211*8542734aSAndroid Build Coastguard Worker                   String16 prefix = String16(args.prefix.c_str());
212*8542734aSAndroid Build Coastguard Worker                   String16 srcIp = String16(args.srcIp.c_str());
213*8542734aSAndroid Build Coastguard Worker                   String16 dstIp = String16(args.dstIp.c_str());
214*8542734aSAndroid Build Coastguard Worker                   listener->onWakeupEvent(prefix, args.uid, args.ethertype, args.ipNextHeader,
215*8542734aSAndroid Build Coastguard Worker                                           args.dstHw, srcIp, dstIp, args.srcPort, args.dstPort,
216*8542734aSAndroid Build Coastguard Worker                                           args.timestampNs);
217*8542734aSAndroid Build Coastguard Worker               },
218*8542734aSAndroid Build Coastguard Worker               &iptablesRestoreCtrl) {
219*8542734aSAndroid Build Coastguard Worker     InterfaceController::initializeAll();
220*8542734aSAndroid Build Coastguard Worker }
221*8542734aSAndroid Build Coastguard Worker 
initChildChains()222*8542734aSAndroid Build Coastguard Worker void Controllers::initChildChains() {
223*8542734aSAndroid Build Coastguard Worker     /*
224*8542734aSAndroid Build Coastguard Worker      * This is the only time we touch top-level chains in iptables; controllers
225*8542734aSAndroid Build Coastguard Worker      * should only mutate rules inside of their children chains, as created by
226*8542734aSAndroid Build Coastguard Worker      * the constants above.
227*8542734aSAndroid Build Coastguard Worker      *
228*8542734aSAndroid Build Coastguard Worker      * Modules should never ACCEPT packets (except in well-justified cases);
229*8542734aSAndroid Build Coastguard Worker      * they should instead defer to any remaining modules using RETURN, or
230*8542734aSAndroid Build Coastguard Worker      * otherwise DROP/REJECT.
231*8542734aSAndroid Build Coastguard Worker      */
232*8542734aSAndroid Build Coastguard Worker 
233*8542734aSAndroid Build Coastguard Worker     // Create chains for child modules.
234*8542734aSAndroid Build Coastguard Worker     createChildChains(V4V6, "filter", "INPUT", FILTER_INPUT, true);
235*8542734aSAndroid Build Coastguard Worker     createChildChains(V4V6, "filter", "FORWARD", FILTER_FORWARD, true);
236*8542734aSAndroid Build Coastguard Worker     createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING, true);
237*8542734aSAndroid Build Coastguard Worker     createChildChains(V4V6, "mangle", "FORWARD", MANGLE_FORWARD, true);
238*8542734aSAndroid Build Coastguard Worker     createChildChains(V4V6, "mangle", "INPUT", MANGLE_INPUT, true);
239*8542734aSAndroid Build Coastguard Worker     createChildChains(V4V6, "mangle", "OUTPUT", MANGLE_OUTPUT, true);
240*8542734aSAndroid Build Coastguard Worker     createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING, true);
241*8542734aSAndroid Build Coastguard Worker     createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING, true);
242*8542734aSAndroid Build Coastguard Worker 
243*8542734aSAndroid Build Coastguard Worker     createChildChains(V4, "filter", "OUTPUT", FILTER_OUTPUT, false);
244*8542734aSAndroid Build Coastguard Worker     createChildChains(V6, "filter", "OUTPUT", FILTER_OUTPUT, false);
245*8542734aSAndroid Build Coastguard Worker     createChildChains(V4, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
246*8542734aSAndroid Build Coastguard Worker     createChildChains(V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING, false);
247*8542734aSAndroid Build Coastguard Worker }
248*8542734aSAndroid Build Coastguard Worker 
setupConnmarkIptablesHooks()249*8542734aSAndroid Build Coastguard Worker static void setupConnmarkIptablesHooks() {
250*8542734aSAndroid Build Coastguard Worker     // Rules to store parts of the fwmark (namely: netId, explicitlySelected, protectedFromVpn,
251*8542734aSAndroid Build Coastguard Worker     // permission) in connmark.
252*8542734aSAndroid Build Coastguard Worker     // Only saves the mark if no mark has been set before.
253*8542734aSAndroid Build Coastguard Worker     static_assert(std::string_view(CONNMARK_MANGLE_INPUT) == "connmark_mangle_INPUT");
254*8542734aSAndroid Build Coastguard Worker     static_assert(std::string_view(CONNMARK_MANGLE_OUTPUT) == "connmark_mangle_OUTPUT");
255*8542734aSAndroid Build Coastguard Worker     static_assert(CONNMARK_FWMARK_MASK == 0x000FFFFF);
256*8542734aSAndroid Build Coastguard Worker     const std::string cmd(
257*8542734aSAndroid Build Coastguard Worker             // CONNMARK:
258*8542734aSAndroid Build Coastguard Worker             // --save-mark [--nfmask nfmask] [--ctmask ctmask]
259*8542734aSAndroid Build Coastguard Worker             // Copy the packet mark (nfmark) to the connection mark (ctmark) using the given
260*8542734aSAndroid Build Coastguard Worker             // masks. The new nfmark value is determined as follows:
261*8542734aSAndroid Build Coastguard Worker             // ctmark = (ctmark & ~ctmask) ^ (nfmark & nfmask)
262*8542734aSAndroid Build Coastguard Worker             // i.e. ctmask defines what bits to clear and nfmask what bits of the nfmark to
263*8542734aSAndroid Build Coastguard Worker             // XOR into the ctmark. ctmask and nfmask default to 0xFFFFFFFF.
264*8542734aSAndroid Build Coastguard Worker             "*mangle\n"
265*8542734aSAndroid Build Coastguard Worker             "-A connmark_mangle_INPUT -m connmark --mark 0/0x000FFFFF "
266*8542734aSAndroid Build Coastguard Worker             "-j CONNMARK --save-mark --ctmask 0x000FFFFF --nfmask 0x000FFFFF\n"
267*8542734aSAndroid Build Coastguard Worker             "-A connmark_mangle_OUTPUT -m connmark --mark 0/0x000FFFFF "
268*8542734aSAndroid Build Coastguard Worker             "-j CONNMARK --save-mark --ctmask 0x000FFFFF --nfmask 0x000FFFFF\n"
269*8542734aSAndroid Build Coastguard Worker             "COMMIT\n");
270*8542734aSAndroid Build Coastguard Worker     execIptablesRestore(V4V6, cmd);
271*8542734aSAndroid Build Coastguard Worker }
272*8542734aSAndroid Build Coastguard Worker 
initIptablesRules()273*8542734aSAndroid Build Coastguard Worker void Controllers::initIptablesRules() {
274*8542734aSAndroid Build Coastguard Worker     Stopwatch s;
275*8542734aSAndroid Build Coastguard Worker     initChildChains();
276*8542734aSAndroid Build Coastguard Worker     gLog.info("Creating child chains: %" PRId64 "us", s.getTimeAndResetUs());
277*8542734aSAndroid Build Coastguard Worker 
278*8542734aSAndroid Build Coastguard Worker     // Let each module setup their child chains
279*8542734aSAndroid Build Coastguard Worker     setupOemIptablesHook();
280*8542734aSAndroid Build Coastguard Worker     gLog.info("Setting up OEM hooks: %" PRId64 "us", s.getTimeAndResetUs());
281*8542734aSAndroid Build Coastguard Worker 
282*8542734aSAndroid Build Coastguard Worker     /* When enabled, DROPs all packets except those matching rules. */
283*8542734aSAndroid Build Coastguard Worker     firewallCtrl.setupIptablesHooks();
284*8542734aSAndroid Build Coastguard Worker     gLog.info("Setting up FirewallController hooks: %" PRId64 "us", s.getTimeAndResetUs());
285*8542734aSAndroid Build Coastguard Worker 
286*8542734aSAndroid Build Coastguard Worker     /* Does DROPs in FORWARD by default */
287*8542734aSAndroid Build Coastguard Worker     tetherCtrl.setupIptablesHooks();
288*8542734aSAndroid Build Coastguard Worker     gLog.info("Setting up TetherController hooks: %" PRId64 "us", s.getTimeAndResetUs());
289*8542734aSAndroid Build Coastguard Worker 
290*8542734aSAndroid Build Coastguard Worker     /*
291*8542734aSAndroid Build Coastguard Worker      * Does REJECT in INPUT, OUTPUT. Does counting also.
292*8542734aSAndroid Build Coastguard Worker      * No DROP/REJECT allowed later in netfilter-flow hook order.
293*8542734aSAndroid Build Coastguard Worker      */
294*8542734aSAndroid Build Coastguard Worker     bandwidthCtrl.setupIptablesHooks();
295*8542734aSAndroid Build Coastguard Worker     gLog.info("Setting up BandwidthController hooks: %" PRId64 "us", s.getTimeAndResetUs());
296*8542734aSAndroid Build Coastguard Worker 
297*8542734aSAndroid Build Coastguard Worker     /*
298*8542734aSAndroid Build Coastguard Worker      * Counts in nat: PREROUTING, POSTROUTING.
299*8542734aSAndroid Build Coastguard Worker      * No DROP/REJECT allowed later in netfilter-flow hook order.
300*8542734aSAndroid Build Coastguard Worker      */
301*8542734aSAndroid Build Coastguard Worker     idletimerCtrl.setupIptablesHooks();
302*8542734aSAndroid Build Coastguard Worker     gLog.info("Setting up IdletimerController hooks: %" PRId64 "us", s.getTimeAndResetUs());
303*8542734aSAndroid Build Coastguard Worker 
304*8542734aSAndroid Build Coastguard Worker     /*
305*8542734aSAndroid Build Coastguard Worker      * Add rules for detecting IPv6/IPv4 TCP/UDP connections with TLS/DTLS header
306*8542734aSAndroid Build Coastguard Worker      */
307*8542734aSAndroid Build Coastguard Worker     strictCtrl.setupIptablesHooks();
308*8542734aSAndroid Build Coastguard Worker     gLog.info("Setting up StrictController hooks: %" PRId64 "us", s.getTimeAndResetUs());
309*8542734aSAndroid Build Coastguard Worker 
310*8542734aSAndroid Build Coastguard Worker     /*
311*8542734aSAndroid Build Coastguard Worker      * Add rules for storing netid in connmark.
312*8542734aSAndroid Build Coastguard Worker      */
313*8542734aSAndroid Build Coastguard Worker     setupConnmarkIptablesHooks();
314*8542734aSAndroid Build Coastguard Worker     gLog.info("Setting up connmark hooks: %" PRId64 "us", s.getTimeAndResetUs());
315*8542734aSAndroid Build Coastguard Worker }
316*8542734aSAndroid Build Coastguard Worker 
init()317*8542734aSAndroid Build Coastguard Worker void Controllers::init() {
318*8542734aSAndroid Build Coastguard Worker     initIptablesRules();
319*8542734aSAndroid Build Coastguard Worker     Stopwatch s;
320*8542734aSAndroid Build Coastguard Worker 
321*8542734aSAndroid Build Coastguard Worker     if (int ret = bandwidthCtrl.enableBandwidthControl()) {
322*8542734aSAndroid Build Coastguard Worker         gLog.error("Failed to initialize BandwidthController (%s)", strerror(-ret));
323*8542734aSAndroid Build Coastguard Worker         // A failure to init almost definitely means that iptables failed to load
324*8542734aSAndroid Build Coastguard Worker         // our static ruleset, which then basically means network accounting will not work.
325*8542734aSAndroid Build Coastguard Worker         // As such simply exit netd.  This may crash loop the system, but by failing
326*8542734aSAndroid Build Coastguard Worker         // to bootup we will trigger rollback and thus this offers us protection against
327*8542734aSAndroid Build Coastguard Worker         // a mainline update breaking things.
328*8542734aSAndroid Build Coastguard Worker         exit(1);
329*8542734aSAndroid Build Coastguard Worker     }
330*8542734aSAndroid Build Coastguard Worker     gLog.info("Enabling bandwidth control: %" PRId64 "us", s.getTimeAndResetUs());
331*8542734aSAndroid Build Coastguard Worker 
332*8542734aSAndroid Build Coastguard Worker     if (int ret = RouteController::Init(NetworkController::LOCAL_NET_ID)) {
333*8542734aSAndroid Build Coastguard Worker         gLog.error("Failed to initialize RouteController (%s)", strerror(-ret));
334*8542734aSAndroid Build Coastguard Worker     }
335*8542734aSAndroid Build Coastguard Worker     gLog.info("Initializing RouteController: %" PRId64 "us", s.getTimeAndResetUs());
336*8542734aSAndroid Build Coastguard Worker 
337*8542734aSAndroid Build Coastguard Worker     netdutils::Status xStatus = XfrmController::Init();
338*8542734aSAndroid Build Coastguard Worker     if (!isOk(xStatus)) {
339*8542734aSAndroid Build Coastguard Worker         gLog.error("Failed to initialize XfrmController (%s)", netdutils::toString(xStatus).c_str());
340*8542734aSAndroid Build Coastguard Worker     };
341*8542734aSAndroid Build Coastguard Worker     gLog.info("Initializing XfrmController: %" PRId64 "us", s.getTimeAndResetUs());
342*8542734aSAndroid Build Coastguard Worker }
343*8542734aSAndroid Build Coastguard Worker 
344*8542734aSAndroid Build Coastguard Worker Controllers* gCtls = nullptr;
345*8542734aSAndroid Build Coastguard Worker 
346*8542734aSAndroid Build Coastguard Worker }  // namespace net
347*8542734aSAndroid Build Coastguard Worker }  // namespace android
348