server/FirewallController.cpp - platform/system/netd - Git at Google

 /*
  * Copyright (C) 2012 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #include <set>

 #include <cstdint>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>

 #define LOG_TAG "FirewallController"
 #define LOG_NDEBUG 0

 #include <android-base/strings.h>
 #include <android-base/stringprintf.h>
 #include <cutils/log.h>

 #include "Controllers.h"
 #include "FirewallController.h"
 #include "NetdConstants.h"
 #include "bpf/BpfUtils.h"

 using android::base::Join;
 using android::base::StringAppendF;
 using android::base::StringPrintf;
 using android::bpf::DOZABLE_UID_MAP_PATH;
 using android::bpf::POWERSAVE_UID_MAP_PATH;
 using android::bpf::STANDBY_UID_MAP_PATH;
 using android::net::gCtls;

 auto FirewallController::execIptablesRestore = ::execIptablesRestore;

 const char* FirewallController::TABLE = "filter";

 const char* FirewallController::LOCAL_INPUT = "fw_INPUT";
 const char* FirewallController::LOCAL_OUTPUT = "fw_OUTPUT";
 const char* FirewallController::LOCAL_FORWARD = "fw_FORWARD";

 const char* FirewallController::LOCAL_DOZABLE = "fw_dozable";
 const char* FirewallController::LOCAL_STANDBY = "fw_standby";
 const char* FirewallController::LOCAL_POWERSAVE = "fw_powersave";

 // ICMPv6 types that are required for any form of IPv6 connectivity to work. Note that because the
 // fw_dozable chain is called from both INPUT and OUTPUT, this includes both packets that we need
 // to be able to send (e.g., RS, NS), and packets that we need to receive (e.g., RA, NA).
 const char* FirewallController::ICMPV6_TYPES[] = {
     "packet-too-big",
     "router-solicitation",
     "router-advertisement",
     "neighbour-solicitation",
     "neighbour-advertisement",
     "redirect",
 };

 bool getBpfOwnerStatus() {
     return gCtls->trafficCtrl.checkBpfStatsEnable();
 }

 FirewallController::FirewallController(void) {
     // If no rules are set, it's in BLACKLIST mode
     mFirewallType = BLACKLIST;
     mIfaceRules = {};
 }

 int FirewallController::setupIptablesHooks(void) {
     int res = 0;
     mUseBpfOwnerMatch = getBpfOwnerStatus();
     if (mUseBpfOwnerMatch) {
         return res;
     }
     res |= createChain(LOCAL_DOZABLE, getFirewallType(DOZABLE));
     res |= createChain(LOCAL_STANDBY, getFirewallType(STANDBY));
     res |= createChain(LOCAL_POWERSAVE, getFirewallType(POWERSAVE));
     return res;
 }

 int FirewallController::enableFirewall(FirewallType ftype) {
     int res = 0;
     if (mFirewallType != ftype) {
         // flush any existing rules
         disableFirewall();

         if (ftype == WHITELIST) {
             // create default rule to drop all traffic
             std::string command =
                 "*filter\n"
                 "-A fw_INPUT -j DROP\n"
                 "-A fw_OUTPUT -j REJECT\n"
                 "-A fw_FORWARD -j REJECT\n"
                 "COMMIT\n";
             res = execIptablesRestore(V4V6, command.c_str());
         }

         // Set this after calling disableFirewall(), since it defaults to WHITELIST there
         mFirewallType = ftype;
     }
     return res;
 }

 int FirewallController::disableFirewall(void) {
     mFirewallType = WHITELIST;
     mIfaceRules.clear();

     // flush any existing rules
     std::string command =
         "*filter\n"
         ":fw_INPUT -\n"
         ":fw_OUTPUT -\n"
         ":fw_FORWARD -\n"
         "COMMIT\n";

     return execIptablesRestore(V4V6, command.c_str());
 }

 int FirewallController::enableChildChains(ChildChain chain, bool enable) {
     int res = 0;
     const char* name;
     switch(chain) {
         case DOZABLE:
             name = LOCAL_DOZABLE;
             break;
         case STANDBY:
             name = LOCAL_STANDBY;
             break;
         case POWERSAVE:
             name = LOCAL_POWERSAVE;
             break;
         default:
             return res;
     }

     if (mUseBpfOwnerMatch) {
         return gCtls->trafficCtrl.toggleUidOwnerMap(chain, enable);
     }

     std::string command = "*filter\n";
     for (const char *parent : { LOCAL_INPUT, LOCAL_OUTPUT }) {
         StringAppendF(&command, "%s %s -j %s\n", (enable ? "-A" : "-D"), parent, name);
     }
     StringAppendF(&command, "COMMIT\n");

     return execIptablesRestore(V4V6, command);
 }

 int FirewallController::isFirewallEnabled(void) {
     // TODO: verify that rules are still in place near top
     return -1;
 }

 int FirewallController::setInterfaceRule(const char* iface, FirewallRule rule) {
     if (mFirewallType == BLACKLIST) {
         // Unsupported in BLACKLIST mode
         return -1;
     }

     if (!isIfaceName(iface)) {
         errno = ENOENT;
         return -1;
     }

     // Only delete rules if we actually added them, because otherwise our iptables-restore
     // processes will terminate with "no such rule" errors and cause latency penalties while we
     // spin up new ones.
     const char* op;
     if (rule == ALLOW && mIfaceRules.find(iface) == mIfaceRules.end()) {
         op = "-I";
         mIfaceRules.insert(iface);
     } else if (rule == DENY && mIfaceRules.find(iface) != mIfaceRules.end()) {
         op = "-D";
         mIfaceRules.erase(iface);
     } else {
         return 0;
     }

     std::string command = Join(std::vector<std::string> {
         "*filter",
         StringPrintf("%s fw_INPUT -i %s -j RETURN", op, iface),
         StringPrintf("%s fw_OUTPUT -o %s -j RETURN", op, iface),
         "COMMIT\n"
     }, "\n");
     return execIptablesRestore(V4V6, command);
 }

 FirewallType FirewallController::getFirewallType(ChildChain chain) {
     switch(chain) {
         case DOZABLE:
             return WHITELIST;
         case STANDBY:
             return BLACKLIST;
         case POWERSAVE:
             return WHITELIST;
         case NONE:
             return mFirewallType;
         default:
             return BLACKLIST;
     }
 }

 int FirewallController::setUidRule(ChildChain chain, int uid, FirewallRule rule) {
     const char* op;
     const char* target;
     FirewallType firewallType = getFirewallType(chain);
     if (firewallType == WHITELIST) {
         target = "RETURN";
         // When adding, insert RETURN rules at the front, before the catch-all DROP at the end.
         op = (rule == ALLOW)? "-I" : "-D";
     } else { // BLACKLIST mode
         target = "DROP";
         // When adding, append DROP rules at the end, after the RETURN rule that matches TCP RSTs.
         op = (rule == DENY)? "-A" : "-D";
     }

     std::vector<std::string> chainNames;
     switch(chain) {
         case DOZABLE:
             chainNames = { LOCAL_DOZABLE };
             break;
         case STANDBY:
             chainNames = { LOCAL_STANDBY };
             break;
         case POWERSAVE:
             chainNames = { LOCAL_POWERSAVE };
             break;
         case NONE:
             chainNames = { LOCAL_INPUT, LOCAL_OUTPUT };
             break;
         default:
             ALOGW("Unknown child chain: %d", chain);
             return -1;
     }
     if (mUseBpfOwnerMatch) {
         return gCtls->trafficCtrl.changeUidOwnerRule(chain, uid, rule, firewallType);
     }

     std::string command = "*filter\n";
     for (std::string chainName : chainNames) {
         StringAppendF(&command, "%s %s -m owner --uid-owner %d -j %s\n",
                       op, chainName.c_str(), uid, target);
     }
     StringAppendF(&command, "COMMIT\n");

     return execIptablesRestore(V4V6, command);
 }

 int FirewallController::createChain(const char* chain, FirewallType type) {
     static const std::vector<int32_t> NO_UIDS;
     return replaceUidChain(chain, type == WHITELIST, NO_UIDS);
 }

 /* static */
 std::string FirewallController::makeCriticalCommands(IptablesTarget target, const char* chainName) {
     // Allow ICMPv6 packets necessary to make IPv6 connectivity work. http://b/23158230 .
     std::string commands;
     if (target == V6) {
         for (size_t i = 0; i < ARRAY_SIZE(ICMPV6_TYPES); i++) {
             StringAppendF(&commands, "-A %s -p icmpv6 --icmpv6-type %s -j RETURN\n",
                    chainName, ICMPV6_TYPES[i]);
         }
     }
     return commands;
 }

 std::string FirewallController::makeUidRules(IptablesTarget target, const char *name,
         bool isWhitelist, const std::vector<int32_t>& uids) {
     std::string commands;
     StringAppendF(&commands, "*filter\n:%s -\n", name);

     // Whitelist chains have UIDs at the beginning, and new UIDs are added with '-I'.
     if (isWhitelist) {
         for (auto uid : uids) {
             StringAppendF(&commands, "-A %s -m owner --uid-owner %d -j RETURN\n", name, uid);
         }

         // Always whitelist system UIDs.
         StringAppendF(&commands,
                 "-A %s -m owner --uid-owner %d-%d -j RETURN\n", name, 0, MAX_SYSTEM_UID);

         // This rule inverts the match for all UIDs; ie, if there is no UID match here,
         // there is no socket to be found
         StringAppendF(&commands,
                 "-A %s -m owner ! --uid-owner %d-%u -j RETURN\n", name, 0, UINT32_MAX-1);

         // Always whitelist traffic with protocol ESP, or no known socket - required for IPSec
         StringAppendF(&commands, "-A %s -p esp -j RETURN\n", name);
     }

     // Always allow networking on loopback.
     StringAppendF(&commands, "-A %s -i lo -j RETURN\n", name);
     StringAppendF(&commands, "-A %s -o lo -j RETURN\n", name);

     // Allow TCP RSTs so we can cleanly close TCP connections of apps that no longer have network
     // access. Both incoming and outgoing RSTs are allowed.
     StringAppendF(&commands, "-A %s -p tcp --tcp-flags RST RST -j RETURN\n", name);

     if (isWhitelist) {
         commands.append(makeCriticalCommands(target, name));
     }

     // Blacklist chains have UIDs at the end, and new UIDs are added with '-A'.
     if (!isWhitelist) {
         for (auto uid : uids) {
             StringAppendF(&commands, "-A %s -m owner --uid-owner %d -j DROP\n", name, uid);
         }
     }

     // If it's a whitelist chain, add a default DROP at the end. This is not necessary for a
     // blacklist chain, because all user-defined chains implicitly RETURN at the end.
     if (isWhitelist) {
         StringAppendF(&commands, "-A %s -j DROP\n", name);
     }

     StringAppendF(&commands, "COMMIT\n");

     return commands;
 }

 int FirewallController::replaceUidChain(
         const char *name, bool isWhitelist, const std::vector<int32_t>& uids) {
    if (mUseBpfOwnerMatch) {
        return gCtls->trafficCtrl.replaceUidOwnerMap(name, isWhitelist, uids);
    }
    std::string commands4 = makeUidRules(V4, name, isWhitelist, uids);
    std::string commands6 = makeUidRules(V6, name, isWhitelist, uids);
    return execIptablesRestore(V4, commands4.c_str()) | execIptablesRestore(V6, commands6.c_str());
 }
	/*
	* Copyright (C) 2012 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include <set>

	#include <cstdint>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#define LOG_TAG "FirewallController"
	#define LOG_NDEBUG 0

	#include <android-base/strings.h>
	#include <android-base/stringprintf.h>
	#include <cutils/log.h>

	#include "Controllers.h"
	#include "FirewallController.h"
	#include "NetdConstants.h"
	#include "bpf/BpfUtils.h"

	using android::base::Join;
	using android::base::StringAppendF;
	using android::base::StringPrintf;
	using android::bpf::DOZABLE_UID_MAP_PATH;
	using android::bpf::POWERSAVE_UID_MAP_PATH;
	using android::bpf::STANDBY_UID_MAP_PATH;
	using android::net::gCtls;

	auto FirewallController::execIptablesRestore = ::execIptablesRestore;

	const char* FirewallController::TABLE = "filter";

	const char* FirewallController::LOCAL_INPUT = "fw_INPUT";
	const char* FirewallController::LOCAL_OUTPUT = "fw_OUTPUT";
	const char* FirewallController::LOCAL_FORWARD = "fw_FORWARD";

	const char* FirewallController::LOCAL_DOZABLE = "fw_dozable";
	const char* FirewallController::LOCAL_STANDBY = "fw_standby";
	const char* FirewallController::LOCAL_POWERSAVE = "fw_powersave";

	// ICMPv6 types that are required for any form of IPv6 connectivity to work. Note that because the
	// fw_dozable chain is called from both INPUT and OUTPUT, this includes both packets that we need
	// to be able to send (e.g., RS, NS), and packets that we need to receive (e.g., RA, NA).
	const char* FirewallController::ICMPV6_TYPES[] = {
	"packet-too-big",
	"router-solicitation",
	"router-advertisement",
	"neighbour-solicitation",
	"neighbour-advertisement",
	"redirect",
	};

	bool getBpfOwnerStatus() {
	return gCtls->trafficCtrl.checkBpfStatsEnable();
	}

	FirewallController::FirewallController(void) {
	// If no rules are set, it's in BLACKLIST mode
	mFirewallType = BLACKLIST;
	mIfaceRules = {};
	}

	int FirewallController::setupIptablesHooks(void) {
	int res = 0;
	mUseBpfOwnerMatch = getBpfOwnerStatus();
	if (mUseBpfOwnerMatch) {
	return res;
	}
	res \|= createChain(LOCAL_DOZABLE, getFirewallType(DOZABLE));
	res \|= createChain(LOCAL_STANDBY, getFirewallType(STANDBY));
	res \|= createChain(LOCAL_POWERSAVE, getFirewallType(POWERSAVE));
	return res;
	}

	int FirewallController::enableFirewall(FirewallType ftype) {
	int res = 0;
	if (mFirewallType != ftype) {
	// flush any existing rules
	disableFirewall();

	if (ftype == WHITELIST) {
	// create default rule to drop all traffic
	std::string command =
	"*filter\n"
	"-A fw_INPUT -j DROP\n"
	"-A fw_OUTPUT -j REJECT\n"
	"-A fw_FORWARD -j REJECT\n"
	"COMMIT\n";
	res = execIptablesRestore(V4V6, command.c_str());
	}

	// Set this after calling disableFirewall(), since it defaults to WHITELIST there
	mFirewallType = ftype;
	}
	return res;
	}

	int FirewallController::disableFirewall(void) {
	mFirewallType = WHITELIST;
	mIfaceRules.clear();

	// flush any existing rules
	std::string command =
	"*filter\n"
	":fw_INPUT -\n"
	":fw_OUTPUT -\n"
	":fw_FORWARD -\n"
	"COMMIT\n";

	return execIptablesRestore(V4V6, command.c_str());
	}

	int FirewallController::enableChildChains(ChildChain chain, bool enable) {
	int res = 0;
	const char* name;
	switch(chain) {
	case DOZABLE:
	name = LOCAL_DOZABLE;
	break;
	case STANDBY:
	name = LOCAL_STANDBY;
	break;
	case POWERSAVE:
	name = LOCAL_POWERSAVE;
	break;
	default:
	return res;
	}

	if (mUseBpfOwnerMatch) {
	return gCtls->trafficCtrl.toggleUidOwnerMap(chain, enable);
	}

	std::string command = "*filter\n";
	for (const char *parent : { LOCAL_INPUT, LOCAL_OUTPUT }) {
	StringAppendF(&command, "%s %s -j %s\n", (enable ? "-A" : "-D"), parent, name);
	}
	StringAppendF(&command, "COMMIT\n");

	return execIptablesRestore(V4V6, command);
	}

	int FirewallController::isFirewallEnabled(void) {
	// TODO: verify that rules are still in place near top
	return -1;
	}

	int FirewallController::setInterfaceRule(const char* iface, FirewallRule rule) {
	if (mFirewallType == BLACKLIST) {
	// Unsupported in BLACKLIST mode
	return -1;
	}

	if (!isIfaceName(iface)) {
	errno = ENOENT;
	return -1;
	}

	// Only delete rules if we actually added them, because otherwise our iptables-restore
	// processes will terminate with "no such rule" errors and cause latency penalties while we
	// spin up new ones.
	const char* op;
	if (rule == ALLOW && mIfaceRules.find(iface) == mIfaceRules.end()) {
	op = "-I";
	mIfaceRules.insert(iface);
	} else if (rule == DENY && mIfaceRules.find(iface) != mIfaceRules.end()) {
	op = "-D";
	mIfaceRules.erase(iface);
	} else {
	return 0;
	}

	std::string command = Join(std::vector<std::string> {
	"*filter",
	StringPrintf("%s fw_INPUT -i %s -j RETURN", op, iface),
	StringPrintf("%s fw_OUTPUT -o %s -j RETURN", op, iface),
	"COMMIT\n"
	}, "\n");
	return execIptablesRestore(V4V6, command);
	}

	FirewallType FirewallController::getFirewallType(ChildChain chain) {
	switch(chain) {
	case DOZABLE:
	return WHITELIST;
	case STANDBY:
	return BLACKLIST;
	case POWERSAVE:
	return WHITELIST;
	case NONE:
	return mFirewallType;
	default:
	return BLACKLIST;
	}
	}

	int FirewallController::setUidRule(ChildChain chain, int uid, FirewallRule rule) {
	const char* op;
	const char* target;
	FirewallType firewallType = getFirewallType(chain);
	if (firewallType == WHITELIST) {
	target = "RETURN";
	// When adding, insert RETURN rules at the front, before the catch-all DROP at the end.
	op = (rule == ALLOW)? "-I" : "-D";
	} else { // BLACKLIST mode
	target = "DROP";
	// When adding, append DROP rules at the end, after the RETURN rule that matches TCP RSTs.
	op = (rule == DENY)? "-A" : "-D";
	}

	std::vector<std::string> chainNames;
	switch(chain) {
	case DOZABLE:
	chainNames = { LOCAL_DOZABLE };
	break;
	case STANDBY:
	chainNames = { LOCAL_STANDBY };
	break;
	case POWERSAVE:
	chainNames = { LOCAL_POWERSAVE };
	break;
	case NONE:
	chainNames = { LOCAL_INPUT, LOCAL_OUTPUT };
	break;
	default:
	ALOGW("Unknown child chain: %d", chain);
	return -1;
	}
	if (mUseBpfOwnerMatch) {
	return gCtls->trafficCtrl.changeUidOwnerRule(chain, uid, rule, firewallType);
	}

	std::string command = "*filter\n";
	for (std::string chainName : chainNames) {
	StringAppendF(&command, "%s %s -m owner --uid-owner %d -j %s\n",
	op, chainName.c_str(), uid, target);
	}
	StringAppendF(&command, "COMMIT\n");

	return execIptablesRestore(V4V6, command);
	}

	int FirewallController::createChain(const char* chain, FirewallType type) {
	static const std::vector<int32_t> NO_UIDS;
	return replaceUidChain(chain, type == WHITELIST, NO_UIDS);
	}

	/* static */
	std::string FirewallController::makeCriticalCommands(IptablesTarget target, const char* chainName) {
	// Allow ICMPv6 packets necessary to make IPv6 connectivity work. http://b/23158230 .
	std::string commands;
	if (target == V6) {
	for (size_t i = 0; i < ARRAY_SIZE(ICMPV6_TYPES); i++) {
	StringAppendF(&commands, "-A %s -p icmpv6 --icmpv6-type %s -j RETURN\n",
	chainName, ICMPV6_TYPES[i]);
	}
	}
	return commands;
	}

	std::string FirewallController::makeUidRules(IptablesTarget target, const char *name,
	bool isWhitelist, const std::vector<int32_t>& uids) {
	std::string commands;
	StringAppendF(&commands, "*filter\n:%s -\n", name);

	// Whitelist chains have UIDs at the beginning, and new UIDs are added with '-I'.
	if (isWhitelist) {
	for (auto uid : uids) {
	StringAppendF(&commands, "-A %s -m owner --uid-owner %d -j RETURN\n", name, uid);
	}

	// Always whitelist system UIDs.
	StringAppendF(&commands,
	"-A %s -m owner --uid-owner %d-%d -j RETURN\n", name, 0, MAX_SYSTEM_UID);

	// This rule inverts the match for all UIDs; ie, if there is no UID match here,
	// there is no socket to be found
	StringAppendF(&commands,
	"-A %s -m owner ! --uid-owner %d-%u -j RETURN\n", name, 0, UINT32_MAX-1);

	// Always whitelist traffic with protocol ESP, or no known socket - required for IPSec
	StringAppendF(&commands, "-A %s -p esp -j RETURN\n", name);
	}

	// Always allow networking on loopback.
	StringAppendF(&commands, "-A %s -i lo -j RETURN\n", name);
	StringAppendF(&commands, "-A %s -o lo -j RETURN\n", name);

	// Allow TCP RSTs so we can cleanly close TCP connections of apps that no longer have network
	// access. Both incoming and outgoing RSTs are allowed.
	StringAppendF(&commands, "-A %s -p tcp --tcp-flags RST RST -j RETURN\n", name);

	if (isWhitelist) {
	commands.append(makeCriticalCommands(target, name));
	}

	// Blacklist chains have UIDs at the end, and new UIDs are added with '-A'.
	if (!isWhitelist) {
	for (auto uid : uids) {
	StringAppendF(&commands, "-A %s -m owner --uid-owner %d -j DROP\n", name, uid);
	}
	}

	// If it's a whitelist chain, add a default DROP at the end. This is not necessary for a
	// blacklist chain, because all user-defined chains implicitly RETURN at the end.
	if (isWhitelist) {
	StringAppendF(&commands, "-A %s -j DROP\n", name);
	}

	StringAppendF(&commands, "COMMIT\n");

	return commands;
	}

	int FirewallController::replaceUidChain(
	const char *name, bool isWhitelist, const std::vector<int32_t>& uids) {
	if (mUseBpfOwnerMatch) {
	return gCtls->trafficCtrl.replaceUidOwnerMap(name, isWhitelist, uids);
	}
	std::string commands4 = makeUidRules(V4, name, isWhitelist, uids);
	std::string commands6 = makeUidRules(V6, name, isWhitelist, uids);
	return execIptablesRestore(V4, commands4.c_str()) \| execIptablesRestore(V6, commands6.c_str());
	}