134 lines
4.2 KiB
C++
134 lines
4.2 KiB
C++
/*
|
|
* Copyright (C) 2017 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#include <regex>
|
|
#include <string>
|
|
|
|
#include <libgen.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
#include <android-base/strings.h>
|
|
|
|
#define LOG_TAG "NetUtilsWrapper"
|
|
#include <log/log.h>
|
|
|
|
#include "NetUtilsWrapper.h"
|
|
|
|
#define SYSTEM_DIRNAME "/system/bin/"
|
|
|
|
#define OEM_IFACE "[^ ]*oem[0-9]+"
|
|
#define RMNET_IFACE "(r_)?rmnet_(data)?[0-9]+"
|
|
#define CCMNI_IFACE "cc(3)?mni[0-9]+"
|
|
#define VENDOR_IFACE "(" OEM_IFACE "|" RMNET_IFACE "|" CCMNI_IFACE ")"
|
|
#define VENDOR_CHAIN "(oem_.*|nm_.*|qcom_.*)"
|
|
|
|
// List of net utils wrapped by this program
|
|
// The list MUST be in descending order of string length
|
|
const char *netcmds[] = {
|
|
"ip6tables",
|
|
"iptables",
|
|
"ndc",
|
|
"tc",
|
|
"ip",
|
|
nullptr,
|
|
};
|
|
|
|
// List of regular expressions of expected commands.
|
|
const char *EXPECTED_REGEXPS[] = {
|
|
#define CMD "^" SYSTEM_DIRNAME
|
|
// Create, delete, and manage OEM networks.
|
|
CMD "ndc network (create|destroy) (oem|handle)[0-9]+( |$)",
|
|
CMD "ndc network interface (add|remove) (oem|handle)[0-9]+ " VENDOR_IFACE,
|
|
CMD "ndc network route (add|remove) (oem|handle)[0-9]+ ",
|
|
CMD "ndc ipfwd (enable|disable) ",
|
|
CMD "ndc ipfwd (add|remove) .*" VENDOR_IFACE,
|
|
|
|
// Manage vendor iptables rules.
|
|
CMD "ip(6)?tables -w.* (-A|-D|-F|-I|-N|-X) " VENDOR_CHAIN,
|
|
CMD "ip(6)?tables -w.* (-i|-o) " VENDOR_IFACE,
|
|
|
|
// Manage IPsec state.
|
|
CMD "ip xfrm .*",
|
|
|
|
// Manage vendor interfaces.
|
|
CMD "tc .* dev " VENDOR_IFACE,
|
|
CMD "ip( -4| -6)? (addr|address) (add|del|delete|flush).* dev " VENDOR_IFACE,
|
|
|
|
// Other activities observed on current devices. In future releases, these should be supported
|
|
// in a way that is less likely to interfere with general Android networking behaviour.
|
|
CMD "tc qdisc del dev root",
|
|
CMD "ip(6)?tables -w .* -j " VENDOR_CHAIN,
|
|
CMD "iptables -w -t mangle -[AD] PREROUTING -m socket --nowildcard --restore-skmark -j ACCEPT",
|
|
CMD "ndc network interface (add|remove) oem[0-9]+$", // Invalid command: no interface removed.
|
|
#undef CMD
|
|
};
|
|
|
|
bool checkExpectedCommand(int argc, char **argv) {
|
|
static bool loggedError = false;
|
|
std::vector<const char*> allArgs(argc);
|
|
for (int i = 0; i < argc; i++) {
|
|
allArgs[i] = argv[i];
|
|
}
|
|
std::string fullCmd = android::base::Join(allArgs, ' ');
|
|
for (size_t i = 0; i < ARRAY_SIZE(EXPECTED_REGEXPS); i++) {
|
|
const std::regex expectedRegexp(EXPECTED_REGEXPS[i], std::regex_constants::extended);
|
|
if (std::regex_search(fullCmd, expectedRegexp)) {
|
|
return true;
|
|
}
|
|
}
|
|
if (!loggedError) {
|
|
ALOGI("Unexpected command: %s", fullCmd.c_str());
|
|
fprintf(stderr, LOG_TAG ": Unexpected command: %s\n", fullCmd.c_str());
|
|
loggedError = true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
|
|
// This is the only gateway for vendor programs to reach net utils.
|
|
int doMain(int argc, char **argv) {
|
|
char *progname = argv[0];
|
|
char *basename = nullptr;
|
|
|
|
basename = strrchr(progname, '/');
|
|
basename = basename ? basename + 1 : progname;
|
|
|
|
for (int i = 0; netcmds[i]; ++i) {
|
|
size_t len = strlen(netcmds[i]);
|
|
if (!strncmp(basename, netcmds[i], len)) {
|
|
// truncate to match netcmds[i]
|
|
basename[len] = '\0';
|
|
|
|
// hardcode the path to /system so it cannot be overwritten
|
|
char *cmd;
|
|
if (asprintf(&cmd, "%s%s", SYSTEM_DIRNAME, basename) == -1) {
|
|
perror("asprintf");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
argv[0] = cmd;
|
|
if (checkExpectedCommand(argc, argv)) {
|
|
execv(cmd, argv);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Invalid command. Reject and fail.
|
|
exit(EXIT_FAILURE);
|
|
}
|