1/*
2 * Copyright (C) 2007 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define TRACE_TAG SERVICES
18
19#include "sysdeps.h"
20
21#include <errno.h>
22#include <stddef.h>
23#include <stdio.h>
24#include <stdlib.h>
25#include <string.h>
26
27#ifndef _WIN32
28#include <netdb.h>
29#include <netinet/in.h>
30#include <sys/ioctl.h>
31#include <unistd.h>
32#endif
33
34#include <android-base/file.h>
35#include <android-base/parsenetaddress.h>
36#include <android-base/stringprintf.h>
37#include <android-base/strings.h>
38#include <cutils/sockets.h>
39
40#if !ADB_HOST
41#include "cutils/android_reboot.h"
42#include "cutils/properties.h"
43#endif
44
45#include "adb.h"
46#include "adb_io.h"
47#include "adb_utils.h"
48#include "file_sync_service.h"
49#include "remount_service.h"
50#include "services.h"
51#include "shell_service.h"
52#include "sysdeps.h"
53#include "transport.h"
54
55struct stinfo {
56    void (*func)(int fd, void *cookie);
57    int fd;
58    void *cookie;
59};
60
61static void service_bootstrap_func(void* x) {
62    stinfo* sti = reinterpret_cast<stinfo*>(x);
63    adb_thread_setname(android::base::StringPrintf("service %d", sti->fd));
64    sti->func(sti->fd, sti->cookie);
65    free(sti);
66}
67
68#if !ADB_HOST
69
70void restart_root_service(int fd, void *cookie) {
71    if (getuid() == 0) {
72        WriteFdExactly(fd, "adbd is already running as root\n");
73        adb_close(fd);
74    } else {
75        char value[PROPERTY_VALUE_MAX];
76        property_get("ro.debuggable", value, "");
77        if (strcmp(value, "1") != 0) {
78            WriteFdExactly(fd, "adbd cannot run as root in production builds\n");
79            adb_close(fd);
80            return;
81        }
82
83        property_set("service.adb.root", "1");
84        WriteFdExactly(fd, "restarting adbd as root\n");
85        adb_close(fd);
86    }
87}
88
89void restart_unroot_service(int fd, void *cookie) {
90    if (getuid() != 0) {
91        WriteFdExactly(fd, "adbd not running as root\n");
92        adb_close(fd);
93    } else {
94        property_set("service.adb.root", "0");
95        WriteFdExactly(fd, "restarting adbd as non root\n");
96        adb_close(fd);
97    }
98}
99
100void restart_tcp_service(int fd, void *cookie) {
101    int port = (int) (uintptr_t) cookie;
102    if (port <= 0) {
103        WriteFdFmt(fd, "invalid port %d\n", port);
104        adb_close(fd);
105        return;
106    }
107
108    char value[PROPERTY_VALUE_MAX];
109    snprintf(value, sizeof(value), "%d", port);
110    property_set("service.adb.tcp.port", value);
111    WriteFdFmt(fd, "restarting in TCP mode port: %d\n", port);
112    adb_close(fd);
113}
114
115void restart_usb_service(int fd, void *cookie) {
116    property_set("service.adb.tcp.port", "0");
117    WriteFdExactly(fd, "restarting in USB mode\n");
118    adb_close(fd);
119}
120
121static bool reboot_service_impl(int fd, const char* arg) {
122    const char* reboot_arg = arg;
123    bool auto_reboot = false;
124
125    if (strcmp(reboot_arg, "sideload-auto-reboot") == 0) {
126        auto_reboot = true;
127        reboot_arg = "sideload";
128    }
129
130    // It reboots into sideload mode by setting "--sideload" or "--sideload_auto_reboot"
131    // in the command file.
132    if (strcmp(reboot_arg, "sideload") == 0) {
133        if (getuid() != 0) {
134            WriteFdExactly(fd, "'adb root' is required for 'adb reboot sideload'.\n");
135            return false;
136        }
137
138        const char* const recovery_dir = "/cache/recovery";
139        const char* const command_file = "/cache/recovery/command";
140        // Ensure /cache/recovery exists.
141        if (adb_mkdir(recovery_dir, 0770) == -1 && errno != EEXIST) {
142            D("Failed to create directory '%s': %s", recovery_dir, strerror(errno));
143            return false;
144        }
145
146        bool write_status = android::base::WriteStringToFile(
147                auto_reboot ? "--sideload_auto_reboot" : "--sideload", command_file);
148        if (!write_status) {
149            return false;
150        }
151
152        reboot_arg = "recovery";
153    }
154
155    sync();
156
157    char property_val[PROPERTY_VALUE_MAX];
158    int ret = snprintf(property_val, sizeof(property_val), "reboot,%s", reboot_arg);
159    if (ret >= static_cast<int>(sizeof(property_val))) {
160        WriteFdFmt(fd, "reboot string too long: %d\n", ret);
161        return false;
162    }
163
164    ret = property_set(ANDROID_RB_PROPERTY, property_val);
165    if (ret < 0) {
166        WriteFdFmt(fd, "reboot failed: %d\n", ret);
167        return false;
168    }
169
170    return true;
171}
172
173void reboot_service(int fd, void* arg)
174{
175    if (reboot_service_impl(fd, static_cast<const char*>(arg))) {
176        // Don't return early. Give the reboot command time to take effect
177        // to avoid messing up scripts which do "adb reboot && adb wait-for-device"
178        while (true) {
179            pause();
180        }
181    }
182
183    free(arg);
184    adb_close(fd);
185}
186
187static void reconnect_service(int fd, void* arg) {
188    WriteFdExactly(fd, "done");
189    adb_close(fd);
190    atransport* t = static_cast<atransport*>(arg);
191    kick_transport(t);
192}
193
194int reverse_service(const char* command) {
195    int s[2];
196    if (adb_socketpair(s)) {
197        PLOG(ERROR) << "cannot create service socket pair.";
198        return -1;
199    }
200    VLOG(SERVICES) << "service socketpair: " << s[0] << ", " << s[1];
201    if (handle_forward_request(command, kTransportAny, nullptr, s[1]) < 0) {
202        SendFail(s[1], "not a reverse forwarding command");
203    }
204    adb_close(s[1]);
205    return s[0];
206}
207
208// Shell service string can look like:
209//   shell[,arg1,arg2,...]:[command]
210static int ShellService(const std::string& args, const atransport* transport) {
211    size_t delimiter_index = args.find(':');
212    if (delimiter_index == std::string::npos) {
213        LOG(ERROR) << "No ':' found in shell service arguments: " << args;
214        return -1;
215    }
216
217    const std::string service_args = args.substr(0, delimiter_index);
218    const std::string command = args.substr(delimiter_index + 1);
219
220    // Defaults:
221    //   PTY for interactive, raw for non-interactive.
222    //   No protocol.
223    //   $TERM set to "dumb".
224    SubprocessType type(command.empty() ? SubprocessType::kPty
225                                        : SubprocessType::kRaw);
226    SubprocessProtocol protocol = SubprocessProtocol::kNone;
227    std::string terminal_type = "dumb";
228
229    for (const std::string& arg : android::base::Split(service_args, ",")) {
230        if (arg == kShellServiceArgRaw) {
231            type = SubprocessType::kRaw;
232        } else if (arg == kShellServiceArgPty) {
233            type = SubprocessType::kPty;
234        } else if (arg == kShellServiceArgShellProtocol) {
235            protocol = SubprocessProtocol::kShell;
236        } else if (android::base::StartsWith(arg, "TERM=")) {
237            terminal_type = arg.substr(5);
238        } else if (!arg.empty()) {
239            // This is not an error to allow for future expansion.
240            LOG(WARNING) << "Ignoring unknown shell service argument: " << arg;
241        }
242    }
243
244    return StartSubprocess(command.c_str(), terminal_type.c_str(), type, protocol);
245}
246
247#endif  // !ADB_HOST
248
249static int create_service_thread(void (*func)(int, void *), void *cookie)
250{
251    int s[2];
252    if (adb_socketpair(s)) {
253        printf("cannot create service socket pair\n");
254        return -1;
255    }
256    D("socketpair: (%d,%d)", s[0], s[1]);
257
258    stinfo* sti = reinterpret_cast<stinfo*>(malloc(sizeof(stinfo)));
259    if (sti == nullptr) {
260        fatal("cannot allocate stinfo");
261    }
262    sti->func = func;
263    sti->cookie = cookie;
264    sti->fd = s[1];
265
266    if (!adb_thread_create(service_bootstrap_func, sti)) {
267        free(sti);
268        adb_close(s[0]);
269        adb_close(s[1]);
270        printf("cannot create service thread\n");
271        return -1;
272    }
273
274    D("service thread started, %d:%d",s[0], s[1]);
275    return s[0];
276}
277
278int service_to_fd(const char* name, const atransport* transport) {
279    int ret = -1;
280
281    if(!strncmp(name, "tcp:", 4)) {
282        int port = atoi(name + 4);
283        name = strchr(name + 4, ':');
284        if(name == 0) {
285            std::string error;
286            ret = network_loopback_client(port, SOCK_STREAM, &error);
287            if (ret >= 0)
288                disable_tcp_nagle(ret);
289        } else {
290#if ADB_HOST
291            std::string error;
292            ret = network_connect(name + 1, port, SOCK_STREAM, 0, &error);
293#else
294            return -1;
295#endif
296        }
297#if !defined(_WIN32)   /* winsock doesn't implement unix domain sockets */
298    } else if(!strncmp(name, "local:", 6)) {
299        ret = socket_local_client(name + 6,
300                ANDROID_SOCKET_NAMESPACE_RESERVED, SOCK_STREAM);
301    } else if(!strncmp(name, "localreserved:", 14)) {
302        ret = socket_local_client(name + 14,
303                ANDROID_SOCKET_NAMESPACE_RESERVED, SOCK_STREAM);
304    } else if(!strncmp(name, "localabstract:", 14)) {
305        ret = socket_local_client(name + 14,
306                ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM);
307    } else if(!strncmp(name, "localfilesystem:", 16)) {
308        ret = socket_local_client(name + 16,
309                ANDROID_SOCKET_NAMESPACE_FILESYSTEM, SOCK_STREAM);
310#endif
311#if !ADB_HOST
312    } else if(!strncmp("dev:", name, 4)) {
313        ret = unix_open(name + 4, O_RDWR | O_CLOEXEC);
314    } else if(!strncmp(name, "framebuffer:", 12)) {
315        ret = create_service_thread(framebuffer_service, 0);
316    } else if (!strncmp(name, "jdwp:", 5)) {
317        ret = create_jdwp_connection_fd(atoi(name+5));
318    } else if(!strncmp(name, "shell", 5)) {
319        ret = ShellService(name + 5, transport);
320    } else if(!strncmp(name, "exec:", 5)) {
321        ret = StartSubprocess(name + 5, nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
322    } else if(!strncmp(name, "sync:", 5)) {
323        ret = create_service_thread(file_sync_service, NULL);
324    } else if(!strncmp(name, "remount:", 8)) {
325        ret = create_service_thread(remount_service, NULL);
326    } else if(!strncmp(name, "reboot:", 7)) {
327        void* arg = strdup(name + 7);
328        if (arg == NULL) return -1;
329        ret = create_service_thread(reboot_service, arg);
330    } else if(!strncmp(name, "root:", 5)) {
331        ret = create_service_thread(restart_root_service, NULL);
332    } else if(!strncmp(name, "unroot:", 7)) {
333        ret = create_service_thread(restart_unroot_service, NULL);
334    } else if(!strncmp(name, "backup:", 7)) {
335        ret = StartSubprocess(android::base::StringPrintf("/system/bin/bu backup %s",
336                                                          (name + 7)).c_str(),
337                              nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
338    } else if(!strncmp(name, "restore:", 8)) {
339        ret = StartSubprocess("/system/bin/bu restore", nullptr, SubprocessType::kRaw,
340                              SubprocessProtocol::kNone);
341    } else if(!strncmp(name, "tcpip:", 6)) {
342        int port;
343        if (sscanf(name + 6, "%d", &port) != 1) {
344            return -1;
345        }
346        ret = create_service_thread(restart_tcp_service, (void *) (uintptr_t) port);
347    } else if(!strncmp(name, "usb:", 4)) {
348        ret = create_service_thread(restart_usb_service, NULL);
349    } else if (!strncmp(name, "reverse:", 8)) {
350        ret = reverse_service(name + 8);
351    } else if(!strncmp(name, "disable-verity:", 15)) {
352        ret = create_service_thread(set_verity_enabled_state_service, (void*)0);
353    } else if(!strncmp(name, "enable-verity:", 15)) {
354        ret = create_service_thread(set_verity_enabled_state_service, (void*)1);
355    } else if (!strcmp(name, "reconnect")) {
356        ret = create_service_thread(reconnect_service, const_cast<atransport*>(transport));
357#endif
358    }
359    if (ret >= 0) {
360        close_on_exec(ret);
361    }
362    return ret;
363}
364
365#if ADB_HOST
366struct state_info {
367    TransportType transport_type;
368    std::string serial;
369    ConnectionState state;
370};
371
372static void wait_for_state(int fd, void* data) {
373    std::unique_ptr<state_info> sinfo(reinterpret_cast<state_info*>(data));
374
375    D("wait_for_state %d", sinfo->state);
376
377    while (true) {
378        bool is_ambiguous = false;
379        std::string error = "unknown error";
380        const char* serial = sinfo->serial.length() ? sinfo->serial.c_str() : NULL;
381        atransport* t = acquire_one_transport(sinfo->transport_type, serial, &is_ambiguous, &error);
382        if (t != nullptr && (sinfo->state == kCsAny || sinfo->state == t->connection_state)) {
383            SendOkay(fd);
384            break;
385        } else if (!is_ambiguous) {
386            adb_pollfd pfd = {.fd = fd, .events = POLLIN };
387            int rc = adb_poll(&pfd, 1, 1000);
388            if (rc < 0) {
389                SendFail(fd, error);
390                break;
391            } else if (rc > 0 && (pfd.revents & POLLHUP) != 0) {
392                // The other end of the socket is closed, probably because the other side was
393                // terminated, bail out.
394                break;
395            }
396
397            // Try again...
398        } else {
399            SendFail(fd, error);
400            break;
401        }
402    }
403
404    adb_close(fd);
405    D("wait_for_state is done");
406}
407
408static void connect_device(const std::string& address, std::string* response) {
409    if (address.empty()) {
410        *response = "empty address";
411        return;
412    }
413
414    std::string serial;
415    std::string host;
416    int port = DEFAULT_ADB_LOCAL_TRANSPORT_PORT;
417    if (!android::base::ParseNetAddress(address, &host, &port, &serial, response)) {
418        return;
419    }
420
421    std::string error;
422    int fd = network_connect(host.c_str(), port, SOCK_STREAM, 10, &error);
423    if (fd == -1) {
424        *response = android::base::StringPrintf("unable to connect to %s: %s",
425                                                serial.c_str(), error.c_str());
426        return;
427    }
428
429    D("client: connected %s remote on fd %d", serial.c_str(), fd);
430    close_on_exec(fd);
431    disable_tcp_nagle(fd);
432
433    // Send a TCP keepalive ping to the device every second so we can detect disconnects.
434    if (!set_tcp_keepalive(fd, 1)) {
435        D("warning: failed to configure TCP keepalives (%s)", strerror(errno));
436    }
437
438    int ret = register_socket_transport(fd, serial.c_str(), port, 0);
439    if (ret < 0) {
440        adb_close(fd);
441        *response = android::base::StringPrintf("already connected to %s", serial.c_str());
442    } else {
443        *response = android::base::StringPrintf("connected to %s", serial.c_str());
444    }
445}
446
447void connect_emulator(const std::string& port_spec, std::string* response) {
448    std::vector<std::string> pieces = android::base::Split(port_spec, ",");
449    if (pieces.size() != 2) {
450        *response = android::base::StringPrintf("unable to parse '%s' as <console port>,<adb port>",
451                                                port_spec.c_str());
452        return;
453    }
454
455    int console_port = strtol(pieces[0].c_str(), NULL, 0);
456    int adb_port = strtol(pieces[1].c_str(), NULL, 0);
457    if (console_port <= 0 || adb_port <= 0) {
458        *response = android::base::StringPrintf("Invalid port numbers: %s", port_spec.c_str());
459        return;
460    }
461
462    // Check if the emulator is already known.
463    // Note: There's a small but harmless race condition here: An emulator not
464    // present just yet could be registered by another invocation right
465    // after doing this check here. However, local_connect protects
466    // against double-registration too. From here, a better error message
467    // can be produced. In the case of the race condition, the very specific
468    // error message won't be shown, but the data doesn't get corrupted.
469    atransport* known_emulator = find_emulator_transport_by_adb_port(adb_port);
470    if (known_emulator != nullptr) {
471        *response = android::base::StringPrintf("Emulator already registered on port %d", adb_port);
472        return;
473    }
474
475    // Check if more emulators can be registered. Similar unproblematic
476    // race condition as above.
477    int candidate_slot = get_available_local_transport_index();
478    if (candidate_slot < 0) {
479        *response = "Cannot accept more emulators";
480        return;
481    }
482
483    // Preconditions met, try to connect to the emulator.
484    std::string error;
485    if (!local_connect_arbitrary_ports(console_port, adb_port, &error)) {
486        *response = android::base::StringPrintf("Connected to emulator on ports %d,%d",
487                                                console_port, adb_port);
488    } else {
489        *response = android::base::StringPrintf("Could not connect to emulator on ports %d,%d: %s",
490                                                console_port, adb_port, error.c_str());
491    }
492}
493
494static void connect_service(int fd, void* data) {
495    char* host = reinterpret_cast<char*>(data);
496    std::string response;
497    if (!strncmp(host, "emu:", 4)) {
498        connect_emulator(host + 4, &response);
499    } else {
500        connect_device(host, &response);
501    }
502    free(host);
503
504    // Send response for emulator and device
505    SendProtocolString(fd, response);
506    adb_close(fd);
507}
508#endif
509
510#if ADB_HOST
511asocket* host_service_to_socket(const char* name, const char* serial) {
512    if (!strcmp(name,"track-devices")) {
513        return create_device_tracker();
514    } else if (android::base::StartsWith(name, "wait-for-")) {
515        name += strlen("wait-for-");
516
517        std::unique_ptr<state_info> sinfo(new state_info);
518        if (sinfo == nullptr) {
519            fprintf(stderr, "couldn't allocate state_info: %s", strerror(errno));
520            return nullptr;
521        }
522
523        if (serial) sinfo->serial = serial;
524
525        if (android::base::StartsWith(name, "local")) {
526            name += strlen("local");
527            sinfo->transport_type = kTransportLocal;
528        } else if (android::base::StartsWith(name, "usb")) {
529            name += strlen("usb");
530            sinfo->transport_type = kTransportUsb;
531        } else if (android::base::StartsWith(name, "any")) {
532            name += strlen("any");
533            sinfo->transport_type = kTransportAny;
534        } else {
535            return nullptr;
536        }
537
538        if (!strcmp(name, "-device")) {
539            sinfo->state = kCsDevice;
540        } else if (!strcmp(name, "-recovery")) {
541            sinfo->state = kCsRecovery;
542        } else if (!strcmp(name, "-sideload")) {
543            sinfo->state = kCsSideload;
544        } else if (!strcmp(name, "-bootloader")) {
545            sinfo->state = kCsBootloader;
546        } else if (!strcmp(name, "-any")) {
547            sinfo->state = kCsAny;
548        } else {
549            return nullptr;
550        }
551
552        int fd = create_service_thread(wait_for_state, sinfo.release());
553        return create_local_socket(fd);
554    } else if (!strncmp(name, "connect:", 8)) {
555        char* host = strdup(name + 8);
556        int fd = create_service_thread(connect_service, host);
557        return create_local_socket(fd);
558    }
559    return NULL;
560}
561#endif /* ADB_HOST */
562