NetdClient.cpp revision 31f4210e6fc5c9b749468a2af0bac94992352010
1/* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#include "NetdClient.h" 18 19#include "FwmarkClient.h" 20#include "FwmarkCommand.h" 21#include "resolv_netid.h" 22 23#include <atomic> 24#include <sys/socket.h> 25#include <unistd.h> 26 27namespace { 28 29std::atomic_uint netIdForProcess(NETID_UNSET); 30std::atomic_uint netIdForResolv(NETID_UNSET); 31 32typedef int (*Accept4FunctionType)(int, sockaddr*, socklen_t*, int); 33typedef int (*ConnectFunctionType)(int, const sockaddr*, socklen_t); 34typedef int (*SocketFunctionType)(int, int, int); 35typedef unsigned (*NetIdForResolvFunctionType)(unsigned); 36 37// These variables are only modified at startup (when libc.so is loaded) and never afterwards, so 38// it's okay that they are read later at runtime without a lock. 39Accept4FunctionType libcAccept4 = 0; 40ConnectFunctionType libcConnect = 0; 41SocketFunctionType libcSocket = 0; 42 43int closeFdAndSetErrno(int fd, int error) { 44 close(fd); 45 errno = error; 46 return -1; 47} 48 49int netdClientAccept4(int sockfd, sockaddr* addr, socklen_t* addrlen, int flags) { 50 int acceptedSocket = libcAccept4(sockfd, addr, addrlen, flags); 51 if (acceptedSocket == -1) { 52 return -1; 53 } 54 int family; 55 if (addr) { 56 family = addr->sa_family; 57 } else { 58 socklen_t familyLen = sizeof(family); 59 if (getsockopt(acceptedSocket, SOL_SOCKET, SO_DOMAIN, &family, &familyLen) == -1) { 60 return closeFdAndSetErrno(acceptedSocket, errno); 61 } 62 } 63 if (FwmarkClient::shouldSetFwmark(family)) { 64 FwmarkCommand command = {FwmarkCommand::ON_ACCEPT, 0}; 65 int error = FwmarkClient().send(&command, sizeof(command), acceptedSocket); 66 if (error) { 67 return closeFdAndSetErrno(acceptedSocket, error); 68 } 69 } 70 return acceptedSocket; 71} 72 73int netdClientConnect(int sockfd, const sockaddr* addr, socklen_t addrlen) { 74 if (sockfd >= 0 && addr && FwmarkClient::shouldSetFwmark(addr->sa_family)) { 75 FwmarkCommand command = {FwmarkCommand::ON_CONNECT, 0}; 76 int error = FwmarkClient().send(&command, sizeof(command), sockfd); 77 if (error) { 78 errno = error; 79 return -1; 80 } 81 } 82 return libcConnect(sockfd, addr, addrlen); 83} 84 85int netdClientSocket(int domain, int type, int protocol) { 86 int socketFd = libcSocket(domain, type, protocol); 87 if (socketFd == -1) { 88 return -1; 89 } 90 unsigned netId = netIdForProcess; 91 if (netId != NETID_UNSET && FwmarkClient::shouldSetFwmark(domain)) { 92 int error = setNetworkForSocket(netId, socketFd); 93 if (error) { 94 return closeFdAndSetErrno(socketFd, error); 95 } 96 } 97 return socketFd; 98} 99 100unsigned getNetworkForResolv(unsigned netId) { 101 if (netId != NETID_UNSET) { 102 return netId; 103 } 104 netId = netIdForProcess; 105 if (netId != NETID_UNSET) { 106 return netId; 107 } 108 return netIdForResolv; 109} 110 111int setNetworkForTarget(unsigned netId, std::atomic_uint* target) { 112 if (netId == NETID_UNSET) { 113 *target = netId; 114 return 0; 115 } 116 // Verify that we are allowed to use |netId|, by creating a socket and trying to have it marked 117 // with the netId. Call libcSocket() directly; else the socket creation (via netdClientSocket()) 118 // might itself cause another check with the fwmark server, which would be wasteful. 119 int socketFd; 120 if (libcSocket) { 121 socketFd = libcSocket(AF_INET6, SOCK_DGRAM, 0); 122 } else { 123 socketFd = socket(AF_INET6, SOCK_DGRAM, 0); 124 } 125 if (socketFd < 0) { 126 return errno; 127 } 128 int error = setNetworkForSocket(netId, socketFd); 129 if (!error) { 130 *target = netId; 131 } 132 close(socketFd); 133 return error; 134} 135 136} // namespace 137 138// accept() just calls accept4(..., 0), so there's no need to handle accept() separately. 139extern "C" void netdClientInitAccept4(Accept4FunctionType* function) { 140 if (function && *function) { 141 libcAccept4 = *function; 142 *function = netdClientAccept4; 143 } 144} 145 146extern "C" void netdClientInitConnect(ConnectFunctionType* function) { 147 if (function && *function) { 148 libcConnect = *function; 149 *function = netdClientConnect; 150 } 151} 152 153extern "C" void netdClientInitSocket(SocketFunctionType* function) { 154 if (function && *function) { 155 libcSocket = *function; 156 *function = netdClientSocket; 157 } 158} 159 160extern "C" void netdClientInitNetIdForResolv(NetIdForResolvFunctionType* function) { 161 if (function) { 162 *function = getNetworkForResolv; 163 } 164} 165 166extern "C" unsigned getNetworkForProcess() { 167 return netIdForProcess; 168} 169 170extern "C" int setNetworkForSocket(unsigned netId, int socketFd) { 171 if (socketFd < 0) { 172 return EBADF; 173 } 174 FwmarkCommand command = {FwmarkCommand::SELECT_NETWORK, netId}; 175 return FwmarkClient().send(&command, sizeof(command), socketFd); 176} 177 178extern "C" int setNetworkForProcess(unsigned netId) { 179 return setNetworkForTarget(netId, &netIdForProcess); 180} 181 182extern "C" int setNetworkForResolv(unsigned netId) { 183 return setNetworkForTarget(netId, &netIdForResolv); 184} 185 186extern "C" int protectFromVpn(int socketFd) { 187 if (socketFd < 0) { 188 return EBADF; 189 } 190 FwmarkCommand command = {FwmarkCommand::PROTECT_FROM_VPN, 0}; 191 return FwmarkClient().send(&command, sizeof(command), socketFd); 192} 193