Android - NETD解读

service netd /system/bin/netd
    class main
    socket netd stream 0660 root system
    socket dnsproxyd stream 0660 root inet
    socket mdns stream 0660 root system
    socket fwmarkd stream 0660 root inet

int main() {

    CommandListener *cl;
    NetlinkManager *nm;
    DnsProxyListener *dpl;
    MDnsSdListener *mdnsl;

    ALOGI("Netd 1.0 starting");

    //为Netd进程屏蔽SIGPIPE信号
    blockSigpipe();

    //创建NetlinkManager
    if (!(nm = NetlinkManager::Instance())) {
        ALOGE("Unable to create NetlinkManager");
        exit(1);
    };
    //创建CommandListener，它将创建名为"netd"的监听socket
    cl = new CommandListener();
    //设置NetlinkManager的消息发送者（Broadcaster）为CommandListener。
    nm->setBroadcaster((SocketListener *) cl);
    //启动NetlinkManager
    if (nm->start()) {
        ALOGE("Unable to start NetlinkManager (%s)", strerror(errno));
        exit(1);
    }

    //Netd设置环境变量ANDROID_DNS_MODE为"local"
    // Set local DNS mode, to prevent bionic from proxying
    // back to this service, recursively.
    setenv("ANDROID_DNS_MODE", "local", 1);
    //创建DnsProxyListener，它将创建名为"dnsproxyd"的监听socket
    dpl = new DnsProxyListener();
    dpl->startListener();

    //创建MDnsSdListener并启动监听，它将创建名为"mdns"的监听socket
    mdnsl = new MDnsSdListener();
    mdnsl->startListener();

    cl->startListener();

    while(1) {
        sleep(1000);
    }
    exit(0);
}

int NetlinkManager::start() {
    //创建接收NETLINK_KOBJECT_UEVENT消息的socket，其值保存在mUeventSock中
    //其中，NETLINK_FORMAT_ASCII代表UEvent消息的内容为ASCII字符串
    if ((mUeventHandler = setupSocket(&mUeventSock, NETLINK_KOBJECT_UEVENT,
         0xffffffff, NetlinkListener::NETLINK_FORMAT_ASCII, false)) == NULL)     {
        return -1;
    }
    //创建接收RTMGPR_LINK消息的socket，其值保存在mRouteSock中
    //其中，NETLINK_FORMAT_BINARY代表UEvent消息的类型为结构体，故需要进行二进制解析
    if ((mRouteHandler = setupSocket(&mRouteSock, NETLINK_ROUTE,
                                     RTMGRP_LINK |
                                     RTMGRP_IPV4_IFADDR |
                                     RTMGRP_IPV6_IFADDR |
                                     RTMGRP_IPV6_ROUTE |
                                     (1 << (RTNLGRP_ND_USEROPT - 1)),
        NetlinkListener::NETLINK_FORMAT_BINARY, false)) == NULL) {
        return -1;
    }
    //创建接收NETLINK_NFLOG消息的socket，其值保存在mQuotaSock中
    if ((mQuotaHandler = setupSocket(&mQuotaSock, NETLINK_NFLOG,
            NFLOG_QUOTA_GROUP, NetlinkListener::NETLINK_FORMAT_BINARY, false)) == NULL) {
        ALOGE("Unable to open quota socket");
        // TODO: return -1 once the emulator gets a new kernel.
    }
    //创建接收NETLINK_NETFILTER消息的socket，其值保存在mStrictSock中
    if ((mStrictHandler = setupSocket(&mStrictSock, NETLINK_NETFILTER,
            0, NetlinkListener::NETLINK_FORMAT_BINARY_UNICAST, true)) == NULL) {
        ALOGE("Unable to open strict socket");
        // TODO: return -1 once the emulator gets a new kernel.
    }

    return 0;
}

graph TB
     A[kernel]-->B(NetLinkManager)    
     B-->C(NetlinkListener)
     C-->D(NetLinkEvent)
     D-->E(NetLinkHandle)
     E-->F(SocketListener)
     F-->G(NetworkManagementService)

void NetlinkHandler::onEvent(NetlinkEvent *evt) {
    const char *subsys = evt->getSubsystem();
    if (!subsys) {
        ALOGW("No subsystem found in netlink event");
        return;
    }
    //处理对应NETLINK_KOBJECT_UEVENT和NETLINK_ROUTE的信息
    if (!strcmp(subsys, "net")) {
        NetlinkEvent::Action action = evt->getAction();
        //查找消息中携带的网络设备名
        const char *iface = evt->findParam("INTERFACE");

        if (action == NetlinkEvent::Action::kAdd) {
            //添加NIC（Network InterfaceCard）的消息
            notifyInterfaceAdded(iface);
        } else if (action == NetlinkEvent::Action::kRemove) {
            //NIC被移除的消息
            notifyInterfaceRemoved(iface);
        } else if (action == NetlinkEvent::Action::kChange) {
            //NIC变化消息
            evt->dump();
            notifyInterfaceChanged("nana", true);
        } else if (action == NetlinkEvent::Action::kLinkUp) {
            //链路启用（类似插网线）
            notifyInterfaceLinkChanged(iface, true);
        } else if (action == NetlinkEvent::Action::kLinkDown) {
            //链路断开（类似拔网线）
            notifyInterfaceLinkChanged(iface, false);
        } else if (action == NetlinkEvent::Action::kAddressUpdated ||
                   action == NetlinkEvent::Action::kAddressRemoved) {
            const char *address = evt->findParam("ADDRESS");
            const char *flags = evt->findParam("FLAGS");
            const char *scope = evt->findParam("SCOPE");
            if (action == NetlinkEvent::Action::kAddressRemoved && iface && address) {
                int resetMask = strchr(address, ':') ? RESET_IPV6_ADDRESSES : RESET_IPV4_ADDRESSES;
                resetMask |= RESET_IGNORE_INTERFACE_ADDRESS;
                if (int ret = ifc_reset_connections(iface, resetMask)) {
                    ALOGE("ifc_reset_connections failed on iface %s for
                    address %s (%s)", iface,
                          address, strerror(ret));
                }
            }
            if (iface && flags && scope) {
                //ip地址改变
                notifyAddressChanged(action, address, iface, flags, scope);
            }
        } else if (action == NetlinkEvent::Action::kRdnss) {
            const char *lifetime = evt->findParam("LIFETIME");
            const char *servers = evt->findParam("SERVERS");
            if (lifetime && servers) {
                //DNS服务器改变
                notifyInterfaceDnsServers(iface, lifetime, servers);
            }
        } else if (action == NetlinkEvent::Action::kRouteUpdated || action == NetlinkEvent::Action::kRouteRemoved) {
            const char *route = evt->findParam("ROUTE");
            const char *gateway = evt->findParam("GATEWAY");
            const char *iface = evt->findParam("INTERFACE");
            if (route && (gateway || iface)) {
                notifyRouteChange(action, route, gateway, iface);
            }
        }

    } else if (!strcmp(subsys, "qlog")) {
        const char *alertName = evt->findParam("ALERT_NAME");
        const char *iface = evt->findParam("INTERFACE");
        //当数据量超过预警值，则会收到该通知
        notifyQuotaLimitReached(alertName, iface);

    } else if (!strcmp(subsys, "strict")) {
        const char *uid = evt->findParam("UID");
        const char *hex = evt->findParam("HEX");
        notifyStrictCleartext(uid, hex);

    } else if (!strcmp(subsys, "xt_idletimer")) {
        //这个和idletimer有关，用于跟踪某个NIC的工作状态，即是“idle”还是“active”
        //检测时间按秒计算
        const char *label = evt->findParam("INTERFACE");
        const char *state = evt->findParam("STATE");
        const char *timestamp = evt->findParam("TIME_NS");
        const char *uid = evt->findParam("UID");
        if (state)
            notifyInterfaceClassActivity(label, !strcmp("active", state),
                                         timestamp, uid);
    .......
}

//构造函数
CommandListener::CommandListener() :
                 FrameworkListener("netd", true) {
    registerCmd(new InterfaceCmd());
    registerCmd(new IpFwdCmd());
    registerCmd(new TetherCmd());
    registerCmd(new NatCmd());
    registerCmd(new ListTtysCmd());
    registerCmd(new PppdCmd());
    registerCmd(new SoftapCmd());
    registerCmd(new BandwidthControlCmd());
    registerCmd(new IdletimerControlCmd());
    registerCmd(new ResolverCmd());
    registerCmd(new FirewallCmd());
    registerCmd(new ClatdCmd());
    registerCmd(new NetworkCommand());
    registerCmd(new StrictCmd());
    registerCmd(getQtiConnectivityCmd(this));

    if (!sNetCtrl)
        sNetCtrl = new NetworkController();
    if (!sTetherCtrl)
        sTetherCtrl = new TetherController();
    if (!sNatCtrl)
        sNatCtrl = new NatController();
    if (!sPppCtrl)
        sPppCtrl = new PppController();
    if (!sSoftapCtrl)
        sSoftapCtrl = new SoftapController(this);
    if (!sBandwidthCtrl)
        sBandwidthCtrl = new BandwidthController();
    if (!sIdletimerCtrl)
        sIdletimerCtrl = new IdletimerController();
    if (!sResolverCtrl)
        sResolverCtrl = new ResolverController();
    if (!sFirewallCtrl)
        sFirewallCtrl = new FirewallController();
    if (!sInterfaceCtrl)
        sInterfaceCtrl = new InterfaceController();
    if (!sClatdCtrl)
        sClatdCtrl = new ClatdController(sNetCtrl);
    if (!sStrictCtrl)
        sStrictCtrl = new StrictController();
}

//构造函数
private NetworkManagementService(Context context, String socket) {
        mContext = context;

        ......
        //通过NativeDaemonConnector创建一个socket来通信
        mConnector = new NativeDaemonConnector(
                new NetdCallbackReceiver(), socket, 10, NETD_TAG, 160, wl, FgThread.get().getLooper());
        mThread = new Thread(mConnector, NETD_TAG);

        .......
    }

public boolean onEvent(int code, String raw, String[] cooked) {
        String errorMessage = String.format("Invalid event from daemon (%s)", raw);
        switch (code) {
            case NetdResponseCode.InterfaceChange:
                    /*
                     * a network interface change occured
                     * Format: "NNN Iface added <name>"
                     *         "NNN Iface removed <name>"
                     *         "NNN Iface changed <name> <up/down>"
                     *         "NNN Iface linkstatus <name> <up/down>"
                     */
                    if (cooked.length < 4 || !cooked[1].equals("Iface")) {
                        throw new IllegalStateException(errorMessage);
                    }
                    if (cooked[2].equals("added")) {
                        notifyInterfaceAdded(cooked[3]);
                        return true;
                    } else if (cooked[2].equals("removed")) {
                        notifyInterfaceRemoved(cooked[3]);
                        return true;
                    } else if (cooked[2].equals("changed") && cooked.length == 5) {
                        notifyInterfaceStatusChanged(cooked[3],
                        cooked[4].equals("up"));
                        return true;
                    } else if (cooked[2].equals("linkstate") && cooked.length == 5) {
                        notifyInterfaceLinkStateChanged(cooked[3],
                        cooked[4].equals("up"));
                        return true;
                    }
                    throw new IllegalStateException(errorMessage);
                    // break;
        ......
}

//NetworkManagementService.java
//firewall对应之前CommandListener的一个command类，后面是参数
mConnector.execute("firewall", "zeusis_instrument_test", rule);

//CommandListener.cpp
CommandListener::FirewallCmd::FirewallCmd() :
    //对应匹配firewall
    NetdCommand("firewall") {
}
......
int CommandListener::FirewallCmd::runCommand(SocketClient *cli, int argc,
        char **argv) {
    ......
        //对参数进行匹配
        if (!strcmp(argv[1], "zeusis_instrument_test")) {
        if (argc != 3) {
            cli->sendMsg(ResponseCode::CommandSyntaxError,
                         "Usage: firewall zeusis_dormant_mode
                         <enable|disable>",
                         false);
            return 0;
        }

        ALOGE("setInstrumentTesting: %s",argv[2]);

        int res = sFirewallCtrl->setInstrumentTesting(!strcmp(argv[2],"enable"));
        return sendGenericOkFail(cli, res);
    }

CommandListener::CommandListener() :
                 FrameworkListener("netd", true) {

    /*
     * This is the only time we touch top-level chains in iptables; controllers
     * should only mutate rules inside of their children chains, as created by
     * the constants above.
     *
     * Modules should never ACCEPT packets (except in well-justified cases);
     * they should instead defer to any remaining modules using RETURN, or
     * otherwise DROP/REJECT.
     */

    // Create chains for children modules
    createChildChains(V4V6, "filter", "INPUT", FILTER_INPUT);
    createChildChains(V4V6, "filter", "FORWARD", FILTER_FORWARD);
    createChildChains(V4V6, "filter", "OUTPUT", FILTER_OUTPUT);
    createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING);
    createChildChains(V4V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING);
    createChildChains(V4, "mangle", "FORWARD", MANGLE_FORWARD);
    createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING);
    createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING);

    // Let each module setup their child chains
    setupOemIptablesHook();
    // Support enhanced firewall @{
    createChildChains(V4V6, "filter", "firewall", FILTER_FIREWALL);
    ///@}

    /* When enabled, DROPs all packets except those matching rules. */
    sFirewallCtrl->setupIptablesHooks();
    sFirewallCtrl-> initInstrumentTesting();

    /* Does DROPs in FORWARD by default */
    sNatCtrl->setupIptablesHooks();
    /*
     * Does REJECT in INPUT, OUTPUT. Does counting also.
     * No DROP/REJECT allowed later in netfilter-flow hook order.
     */
    sBandwidthCtrl->setupIptablesHooks();
    /*
     * Counts in nat: PREROUTING, POSTROUTING.
     * No DROP/REJECT allowed later in netfilter-flow hook order.
     */
    sIdletimerCtrl->setupIptablesHooks();

    sBandwidthCtrl->enableBandwidthControl(false);

    if (int ret = RouteController::Init(NetworkController::LOCAL_NET_ID)) {
        ALOGE("failed to initialize RouteController (%s)", strerror(-ret));
    }
}