blob: 8e6a67f9da859b54b49b038d8a57d332ebb3af33 [file] [log] [blame]
/*
* Copyright (C) 2012 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
// #define LOG_NDEBUG 0
/*
* MODUS OPERANDI
* --------------
*
* IPTABLES command sequence:
*
* iptables -F
*
* iptables -t nat -F idletimer_PREROUTING
* iptables -t nat -F idletimer_POSTROUTING
*
*
* iptables -t nat -N idletimer_PREROUTING
* iptables -t nat -N idletimer_POSTROUTING
*
* iptables -t nat -D PREROUTING -j idletimer_PREROUTING
* iptables -t nat -D POSTROUTING -j idletimer_POSTROUTING
*
*
* iptables -t nat -I PREROUTING -j idletimer_PREROUTING
* iptables -t nat -I POSTROUTING -j idletimer_POSTROUTING
*
* # For notifications to work the lable name must match the name of a valid interface.
* # If the label name does match an interface, the rules will be a no-op.
*
* iptables -t nat -A idletimer_PREROUTING -i rmnet0 -j IDLETIMER --timeout 5 --label test-chain --send_nl_msg 1
* iptables -t nat -A idletimer_POSTROUTING -o rmnet0 -j IDLETIMER --timeout 5 --label test-chain --send_nl_msg 1
*
* iptables -nxvL -t nat
*
* =================
*
* ndc command sequence
* ------------------
* ndc idletimer enable
* ndc idletimer add <iface> <timeout> <class label>
* ndc idletimer remove <iface> <timeout> <class label>
*
* Monitor effect on the iptables chains after each step using:
* iptables -nxvL -t nat
*
* Remember that the timeout value has to be same at the time of the
* removal.
*
* Note that currently if the name of the iface is incorrect, iptables
* will setup rules without checking if it is the name of a valid
* interface (although no notifications will ever be received). It is
* the responsibility of code in Java land to ensure that the interface name
* is correct. The benefit of this, is that idletimers can be setup on
* interfaces than come and go.
*
* A remove should be called for each add command issued during cleanup, as duplicate
* entries of the rule may exist and will all have to removed.
*
*/
#include <stdlib.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <cutils/properties.h>
#define LOG_TAG "IdletimerController"
#include <cutils/log.h>
#include "IdletimerController.h"
#include "NetdConstants.h"
extern "C" int system_nosh(const char *command);
const char* IdletimerController::LOCAL_NAT_PREROUTING = "idletimer_nat_PREROUTING";
const char* IdletimerController::LOCAL_NAT_POSTROUTING = "idletimer_nat_POSTROUTING";
IdletimerController::IdletimerController() {
}
IdletimerController::~IdletimerController() {
}
/* return 0 or non-zero */
int IdletimerController::runIpxtablesCmd(const char *cmd) {
char *buffer;
size_t len = strnlen(cmd, 255);
int res;
if (len == 255) {
ALOGE("command too long");
return -1;
}
asprintf(&buffer, "%s %s", IPTABLES_PATH, cmd);
res = system_nosh(buffer);
ALOGV("%s #%d", buffer, res);
free(buffer);
return res;
}
bool IdletimerController::setupIptablesHooks() {
return true;
}
int IdletimerController::setDefaults() {
if (runIpxtablesCmd("-t nat -F idletimer_nat_PREROUTING")
|| runIpxtablesCmd("-t nat -F idletimer_nat_POSTROUTING") )
return -1;
return 0;
}
int IdletimerController::enableIdletimerControl() {
int res = setDefaults();
return res;
}
int IdletimerController::disableIdletimerControl() {
int res = setDefaults();
return res;
}
int IdletimerController::modifyInterfaceIdletimer(IptOp op, const char *iface,
uint32_t timeout,
const char *classLabel) {
int res;
char *buffer;
asprintf(&buffer, "-t nat -%c idletimer_nat_PREROUTING -i %s -j IDLETIMER"
" --timeout %u --label %s --send_nl_msg 1",
(op == IptOpAdd) ? 'A' : 'D', iface, timeout, classLabel);
res = runIpxtablesCmd(buffer);
free(buffer);
asprintf(&buffer, "-t nat -%c idletimer_nat_POSTROUTING -o %s -j IDLETIMER"
" --timeout %u --label %s --send_nl_msg 1",
(op == IptOpAdd) ? 'A' : 'D', iface, timeout, classLabel);
res |= runIpxtablesCmd(buffer);
free(buffer);
return res;
}
int IdletimerController::addInterfaceIdletimer(const char *iface,
uint32_t timeout,
const char *classLabel) {
return modifyInterfaceIdletimer(IptOpAdd, iface, timeout, classLabel);
}
int IdletimerController::removeInterfaceIdletimer(const char *iface,
uint32_t timeout,
const char *classLabel) {
return modifyInterfaceIdletimer(IptOpDelete, iface, timeout, classLabel);
}