RouteController.cpp revision 0bad1be08c2eac24231baab2a743b49024032629
1/* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#include "RouteController.h" 18 19#include <arpa/inet.h> 20#include <errno.h> 21#include <fcntl.h> 22#include <linux/fib_rules.h> 23#include <net/if.h> 24#include <sys/stat.h> 25 26#include <private/android_filesystem_config.h> 27 28#include <map> 29 30#include "Fwmark.h" 31#include "UidRanges.h" 32 33#include "base/file.h" 34#define LOG_TAG "Netd" 35#include "log/log.h" 36#include "logwrap/logwrap.h" 37#include "resolv_netid.h" 38 39using android::base::WriteStringToFile; 40 41namespace { 42 43// BEGIN CONSTANTS -------------------------------------------------------------------------------- 44 45const uint32_t RULE_PRIORITY_VPN_OVERRIDE_SYSTEM = 10000; 46const uint32_t RULE_PRIORITY_VPN_OUTPUT_TO_LOCAL = 11000; 47const uint32_t RULE_PRIORITY_SECURE_VPN = 12000; 48const uint32_t RULE_PRIORITY_EXPLICIT_NETWORK = 13000; 49const uint32_t RULE_PRIORITY_OUTPUT_INTERFACE = 14000; 50const uint32_t RULE_PRIORITY_LEGACY_SYSTEM = 15000; 51const uint32_t RULE_PRIORITY_LEGACY_NETWORK = 16000; 52const uint32_t RULE_PRIORITY_LOCAL_NETWORK = 17000; 53const uint32_t RULE_PRIORITY_TETHERING = 18000; 54const uint32_t RULE_PRIORITY_IMPLICIT_NETWORK = 19000; 55const uint32_t RULE_PRIORITY_BYPASSABLE_VPN = 20000; 56const uint32_t RULE_PRIORITY_VPN_FALLTHROUGH = 21000; 57const uint32_t RULE_PRIORITY_DEFAULT_NETWORK = 22000; 58const uint32_t RULE_PRIORITY_DIRECTLY_CONNECTED = 23000; 59const uint32_t RULE_PRIORITY_UNREACHABLE = 32000; 60 61const uint32_t ROUTE_TABLE_LOCAL_NETWORK = 97; 62const uint32_t ROUTE_TABLE_LEGACY_NETWORK = 98; 63const uint32_t ROUTE_TABLE_LEGACY_SYSTEM = 99; 64 65const char* const ROUTE_TABLE_NAME_LOCAL_NETWORK = "local_network"; 66const char* const ROUTE_TABLE_NAME_LEGACY_NETWORK = "legacy_network"; 67const char* const ROUTE_TABLE_NAME_LEGACY_SYSTEM = "legacy_system"; 68 69const char* const ROUTE_TABLE_NAME_LOCAL = "local"; 70const char* const ROUTE_TABLE_NAME_MAIN = "main"; 71 72// TODO: These values aren't defined by the Linux kernel, because our UID routing changes are not 73// upstream (yet?), so we can't just pick them up from kernel headers. When (if?) the changes make 74// it upstream, we'll remove this and rely on the kernel header values. For now, add a static assert 75// that will warn us if upstream has given these values some other meaning. 76const uint16_t FRA_UID_START = 18; 77const uint16_t FRA_UID_END = 19; 78static_assert(FRA_UID_START > FRA_MAX, 79 "Android-specific FRA_UID_{START,END} values also assigned in Linux uapi. " 80 "Check that these values match what the kernel does and then update this assertion."); 81 82const uint16_t NETLINK_REQUEST_FLAGS = NLM_F_REQUEST | NLM_F_ACK; 83const uint16_t NETLINK_CREATE_REQUEST_FLAGS = NETLINK_REQUEST_FLAGS | NLM_F_CREATE | NLM_F_EXCL; 84 85const sockaddr_nl NETLINK_ADDRESS = {AF_NETLINK, 0, 0, 0}; 86 87const uint8_t AF_FAMILIES[] = {AF_INET, AF_INET6}; 88 89const char* const IP_VERSIONS[] = {"-4", "-6"}; 90 91const uid_t UID_ROOT = 0; 92const char* const IIF_NONE = NULL; 93const char* const OIF_NONE = NULL; 94const bool ACTION_ADD = true; 95const bool ACTION_DEL = false; 96const bool MODIFY_NON_UID_BASED_RULES = true; 97 98const char* const RT_TABLES_PATH = "/data/misc/net/rt_tables"; 99const mode_t RT_TABLES_MODE = S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH; // mode 0644, rw-r--r-- 100 101const unsigned ROUTE_FLUSH_ATTEMPTS = 2; 102 103// Avoids "non-constant-expression cannot be narrowed from type 'unsigned int' to 'unsigned short'" 104// warnings when using RTA_LENGTH(x) inside static initializers (even when x is already uint16_t). 105constexpr uint16_t U16_RTA_LENGTH(uint16_t x) { 106 return RTA_LENGTH(x); 107} 108 109// These are practically const, but can't be declared so, because they are used to initialize 110// non-const pointers ("void* iov_base") in iovec arrays. 111rtattr FRATTR_PRIORITY = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_PRIORITY }; 112rtattr FRATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_TABLE }; 113rtattr FRATTR_FWMARK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMARK }; 114rtattr FRATTR_FWMASK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMASK }; 115rtattr FRATTR_UID_START = { U16_RTA_LENGTH(sizeof(uid_t)), FRA_UID_START }; 116rtattr FRATTR_UID_END = { U16_RTA_LENGTH(sizeof(uid_t)), FRA_UID_END }; 117 118rtattr RTATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_TABLE }; 119rtattr RTATTR_OIF = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_OIF }; 120 121uint8_t PADDING_BUFFER[RTA_ALIGNTO] = {0, 0, 0, 0}; 122 123// END CONSTANTS ---------------------------------------------------------------------------------- 124 125// No locks needed because RouteController is accessed only from one thread (in CommandListener). 126std::map<std::string, uint32_t> interfaceToTable; 127 128uint32_t getRouteTableForInterface(const char* interface) { 129 uint32_t index = if_nametoindex(interface); 130 if (index) { 131 index += RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX; 132 interfaceToTable[interface] = index; 133 return index; 134 } 135 // If the interface goes away if_nametoindex() will return 0 but we still need to know 136 // the index so we can remove the rules and routes. 137 auto iter = interfaceToTable.find(interface); 138 if (iter == interfaceToTable.end()) { 139 ALOGE("cannot find interface %s", interface); 140 return RT_TABLE_UNSPEC; 141 } 142 return iter->second; 143} 144 145void addTableName(uint32_t table, const std::string& name, std::string* contents) { 146 char tableString[UINT32_STRLEN]; 147 snprintf(tableString, sizeof(tableString), "%u", table); 148 *contents += tableString; 149 *contents += " "; 150 *contents += name; 151 *contents += "\n"; 152} 153 154// Doesn't return success/failure as the file is optional; it's okay if we fail to update it. 155void updateTableNamesFile() { 156 std::string contents; 157 158 addTableName(RT_TABLE_LOCAL, ROUTE_TABLE_NAME_LOCAL, &contents); 159 addTableName(RT_TABLE_MAIN, ROUTE_TABLE_NAME_MAIN, &contents); 160 161 addTableName(ROUTE_TABLE_LOCAL_NETWORK, ROUTE_TABLE_NAME_LOCAL_NETWORK, &contents); 162 addTableName(ROUTE_TABLE_LEGACY_NETWORK, ROUTE_TABLE_NAME_LEGACY_NETWORK, &contents); 163 addTableName(ROUTE_TABLE_LEGACY_SYSTEM, ROUTE_TABLE_NAME_LEGACY_SYSTEM, &contents); 164 165 for (const auto& entry : interfaceToTable) { 166 addTableName(entry.second, entry.first, &contents); 167 } 168 169 if (!WriteStringToFile(contents, RT_TABLES_PATH, RT_TABLES_MODE, AID_SYSTEM, AID_WIFI)) { 170 ALOGE("failed to write to %s (%s)", RT_TABLES_PATH, strerror(errno)); 171 return; 172 } 173} 174 175// Sends a netlink request and expects an ack. 176// |iov| is an array of struct iovec that contains the netlink message payload. 177// The netlink header is generated by this function based on |action| and |flags|. 178// Returns -errno if there was an error or if the kernel reported an error. 179WARN_UNUSED_RESULT int sendNetlinkRequest(uint16_t action, uint16_t flags, iovec* iov, int iovlen) { 180 nlmsghdr nlmsg = { 181 .nlmsg_type = action, 182 .nlmsg_flags = flags, 183 }; 184 iov[0].iov_base = &nlmsg; 185 iov[0].iov_len = sizeof(nlmsg); 186 for (int i = 0; i < iovlen; ++i) { 187 nlmsg.nlmsg_len += iov[i].iov_len; 188 } 189 190 int ret; 191 struct { 192 nlmsghdr msg; 193 nlmsgerr err; 194 } response; 195 196 int sock = socket(AF_NETLINK, SOCK_DGRAM | SOCK_CLOEXEC, NETLINK_ROUTE); 197 if (sock != -1 && 198 connect(sock, reinterpret_cast<const sockaddr*>(&NETLINK_ADDRESS), 199 sizeof(NETLINK_ADDRESS)) != -1 && 200 writev(sock, iov, iovlen) != -1 && 201 (ret = recv(sock, &response, sizeof(response), 0)) != -1) { 202 if (ret == sizeof(response)) { 203 ret = response.err.error; // Netlink errors are negative errno. 204 if (ret) { 205 ALOGE("netlink response contains error (%s)", strerror(-ret)); 206 } 207 } else { 208 ALOGE("bad netlink response message size (%d != %zu)", ret, sizeof(response)); 209 ret = -EBADMSG; 210 } 211 } else { 212 ALOGE("netlink socket/connect/writev/recv failed (%s)", strerror(errno)); 213 ret = -errno; 214 } 215 216 if (sock != -1) { 217 close(sock); 218 } 219 220 return ret; 221} 222 223// Returns 0 on success or negative errno on failure. 224int padInterfaceName(const char* input, char* name, size_t* length, uint16_t* padding) { 225 if (!input) { 226 *length = 0; 227 *padding = 0; 228 return 0; 229 } 230 *length = strlcpy(name, input, IFNAMSIZ) + 1; 231 if (*length > IFNAMSIZ) { 232 ALOGE("interface name too long (%zu > %u)", *length, IFNAMSIZ); 233 return -ENAMETOOLONG; 234 } 235 *padding = RTA_SPACE(*length) - RTA_LENGTH(*length); 236 return 0; 237} 238 239// Adds or removes a routing rule for IPv4 and IPv6. 240// 241// + If |table| is non-zero, the rule points at the specified routing table. Otherwise, the rule 242// returns ENETUNREACH. 243// + If |mask| is non-zero, the rule matches the specified fwmark and mask. Otherwise, |fwmark| is 244// ignored. 245// + If |iif| is non-NULL, the rule matches the specified incoming interface. 246// + If |oif| is non-NULL, the rule matches the specified outgoing interface. 247// + If |uidStart| and |uidEnd| are not INVALID_UID, the rule matches packets from UIDs in that 248// range (inclusive). Otherwise, the rule matches packets from all UIDs. 249// 250// Returns 0 on success or negative errno on failure. 251WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table, 252 uint32_t fwmark, uint32_t mask, const char* iif, 253 const char* oif, uid_t uidStart, uid_t uidEnd) { 254 // Ensure that if you set a bit in the fwmark, it's not being ignored by the mask. 255 if (fwmark & ~mask) { 256 ALOGE("mask 0x%x does not select all the bits set in fwmark 0x%x", mask, fwmark); 257 return -ERANGE; 258 } 259 260 // Interface names must include exactly one terminating NULL and be properly padded, or older 261 // kernels will refuse to delete rules. 262 char iifName[IFNAMSIZ], oifName[IFNAMSIZ]; 263 size_t iifLength, oifLength; 264 uint16_t iifPadding, oifPadding; 265 if (int ret = padInterfaceName(iif, iifName, &iifLength, &iifPadding)) { 266 return ret; 267 } 268 if (int ret = padInterfaceName(oif, oifName, &oifLength, &oifPadding)) { 269 return ret; 270 } 271 272 // Either both start and end UID must be specified, or neither. 273 if ((uidStart == INVALID_UID) != (uidEnd == INVALID_UID)) { 274 ALOGE("incompatible start and end UIDs (%u vs %u)", uidStart, uidEnd); 275 return -EUSERS; 276 } 277 bool isUidRule = (uidStart != INVALID_UID); 278 279 // Assemble a rule request and put it in an array of iovec structures. 280 fib_rule_hdr rule = { 281 .action = static_cast<uint8_t>(table != RT_TABLE_UNSPEC ? FR_ACT_TO_TBL : 282 FR_ACT_UNREACHABLE), 283 }; 284 285 rtattr fraIifName = { U16_RTA_LENGTH(iifLength), FRA_IIFNAME }; 286 rtattr fraOifName = { U16_RTA_LENGTH(oifLength), FRA_OIFNAME }; 287 288 iovec iov[] = { 289 { NULL, 0 }, 290 { &rule, sizeof(rule) }, 291 { &FRATTR_PRIORITY, sizeof(FRATTR_PRIORITY) }, 292 { &priority, sizeof(priority) }, 293 { &FRATTR_TABLE, table != RT_TABLE_UNSPEC ? sizeof(FRATTR_TABLE) : 0 }, 294 { &table, table != RT_TABLE_UNSPEC ? sizeof(table) : 0 }, 295 { &FRATTR_FWMARK, mask ? sizeof(FRATTR_FWMARK) : 0 }, 296 { &fwmark, mask ? sizeof(fwmark) : 0 }, 297 { &FRATTR_FWMASK, mask ? sizeof(FRATTR_FWMASK) : 0 }, 298 { &mask, mask ? sizeof(mask) : 0 }, 299 { &FRATTR_UID_START, isUidRule ? sizeof(FRATTR_UID_START) : 0 }, 300 { &uidStart, isUidRule ? sizeof(uidStart) : 0 }, 301 { &FRATTR_UID_END, isUidRule ? sizeof(FRATTR_UID_END) : 0 }, 302 { &uidEnd, isUidRule ? sizeof(uidEnd) : 0 }, 303 { &fraIifName, iif != IIF_NONE ? sizeof(fraIifName) : 0 }, 304 { iifName, iifLength }, 305 { PADDING_BUFFER, iifPadding }, 306 { &fraOifName, oif != OIF_NONE ? sizeof(fraOifName) : 0 }, 307 { oifName, oifLength }, 308 { PADDING_BUFFER, oifPadding }, 309 }; 310 311 uint16_t flags = (action == RTM_NEWRULE) ? NETLINK_CREATE_REQUEST_FLAGS : NETLINK_REQUEST_FLAGS; 312 for (size_t i = 0; i < ARRAY_SIZE(AF_FAMILIES); ++i) { 313 rule.family = AF_FAMILIES[i]; 314 if (int ret = sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov))) { 315 return ret; 316 } 317 } 318 319 return 0; 320} 321 322WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table, 323 uint32_t fwmark, uint32_t mask) { 324 return modifyIpRule(action, priority, table, fwmark, mask, IIF_NONE, OIF_NONE, INVALID_UID, 325 INVALID_UID); 326} 327 328// Adds or deletes an IPv4 or IPv6 route. 329// Returns 0 on success or negative errno on failure. 330WARN_UNUSED_RESULT int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, 331 const char* destination, const char* nexthop) { 332 // At least the destination must be non-null. 333 if (!destination) { 334 ALOGE("null destination"); 335 return -EFAULT; 336 } 337 338 // Parse the prefix. 339 uint8_t rawAddress[sizeof(in6_addr)]; 340 uint8_t family; 341 uint8_t prefixLength; 342 int rawLength = parsePrefix(destination, &family, rawAddress, sizeof(rawAddress), 343 &prefixLength); 344 if (rawLength < 0) { 345 ALOGE("parsePrefix failed for destination %s (%s)", destination, strerror(-rawLength)); 346 return rawLength; 347 } 348 349 if (static_cast<size_t>(rawLength) > sizeof(rawAddress)) { 350 ALOGE("impossible! address too long (%d vs %zu)", rawLength, sizeof(rawAddress)); 351 return -ENOBUFS; // Cannot happen; parsePrefix only supports IPv4 and IPv6. 352 } 353 354 uint8_t type = RTN_UNICAST; 355 uint32_t ifindex; 356 uint8_t rawNexthop[sizeof(in6_addr)]; 357 358 if (nexthop && !strcmp(nexthop, "unreachable")) { 359 type = RTN_UNREACHABLE; 360 // 'interface' is likely non-NULL, as the caller (modifyRoute()) likely used it to lookup 361 // the table number. But it's an error to specify an interface ("dev ...") or a nexthop for 362 // unreachable routes, so nuke them. (IPv6 allows them to be specified; IPv4 doesn't.) 363 interface = OIF_NONE; 364 nexthop = NULL; 365 } else if (nexthop && !strcmp(nexthop, "throw")) { 366 type = RTN_THROW; 367 interface = OIF_NONE; 368 nexthop = NULL; 369 } else { 370 // If an interface was specified, find the ifindex. 371 if (interface != OIF_NONE) { 372 ifindex = if_nametoindex(interface); 373 if (!ifindex) { 374 ALOGE("cannot find interface %s", interface); 375 return -ENODEV; 376 } 377 } 378 379 // If a nexthop was specified, parse it as the same family as the prefix. 380 if (nexthop && inet_pton(family, nexthop, rawNexthop) <= 0) { 381 ALOGE("inet_pton failed for nexthop %s", nexthop); 382 return -EINVAL; 383 } 384 } 385 386 // Assemble a rtmsg and put it in an array of iovec structures. 387 rtmsg route = { 388 .rtm_protocol = RTPROT_STATIC, 389 .rtm_type = type, 390 .rtm_family = family, 391 .rtm_dst_len = prefixLength, 392 .rtm_scope = static_cast<uint8_t>(nexthop ? RT_SCOPE_UNIVERSE : RT_SCOPE_LINK), 393 }; 394 395 rtattr rtaDst = { U16_RTA_LENGTH(rawLength), RTA_DST }; 396 rtattr rtaGateway = { U16_RTA_LENGTH(rawLength), RTA_GATEWAY }; 397 398 iovec iov[] = { 399 { NULL, 0 }, 400 { &route, sizeof(route) }, 401 { &RTATTR_TABLE, sizeof(RTATTR_TABLE) }, 402 { &table, sizeof(table) }, 403 { &rtaDst, sizeof(rtaDst) }, 404 { rawAddress, static_cast<size_t>(rawLength) }, 405 { &RTATTR_OIF, interface != OIF_NONE ? sizeof(RTATTR_OIF) : 0 }, 406 { &ifindex, interface != OIF_NONE ? sizeof(ifindex) : 0 }, 407 { &rtaGateway, nexthop ? sizeof(rtaGateway) : 0 }, 408 { rawNexthop, nexthop ? static_cast<size_t>(rawLength) : 0 }, 409 }; 410 411 uint16_t flags = (action == RTM_NEWROUTE) ? NETLINK_CREATE_REQUEST_FLAGS : 412 NETLINK_REQUEST_FLAGS; 413 return sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov)); 414} 415 416// An iptables rule to mark incoming packets on a network with the netId of the network. 417// 418// This is so that the kernel can: 419// + Use the right fwmark for (and thus correctly route) replies (e.g.: TCP RST, ICMP errors, ping 420// replies, SYN-ACKs, etc). 421// + Mark sockets that accept connections from this interface so that the connection stays on the 422// same interface. 423WARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface, 424 Permission permission, bool add) { 425 Fwmark fwmark; 426 427 fwmark.netId = netId; 428 fwmark.explicitlySelected = true; 429 fwmark.protectedFromVpn = true; 430 fwmark.permission = permission; 431 432 char markString[UINT32_HEX_STRLEN]; 433 snprintf(markString, sizeof(markString), "0x%x", fwmark.intValue); 434 435 if (execIptables(V4V6, "-t", "mangle", add ? "-A" : "-D", "INPUT", "-i", interface, "-j", 436 "MARK", "--set-mark", markString, NULL)) { 437 ALOGE("failed to change iptables rule that sets incoming packet mark"); 438 return -EREMOTEIO; 439 } 440 441 return 0; 442} 443 444// A rule to route responses to the local network forwarded via the VPN. 445// 446// When a VPN is in effect, packets from the local network to upstream networks are forwarded into 447// the VPN's tunnel interface. When the VPN forwards the responses, they emerge out of the tunnel. 448WARN_UNUSED_RESULT int modifyVpnOutputToLocalRule(const char* vpnInterface, bool add) { 449 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_VPN_OUTPUT_TO_LOCAL, 450 ROUTE_TABLE_LOCAL_NETWORK, MARK_UNSET, MARK_UNSET, vpnInterface, OIF_NONE, 451 INVALID_UID, INVALID_UID); 452} 453 454// A rule to route all traffic from a given set of UIDs to go over the VPN. 455// 456// Notice that this rule doesn't use the netId. I.e., no matter what netId the user's socket may 457// have, if they are subject to this VPN, their traffic has to go through it. Allows the traffic to 458// bypass the VPN if the protectedFromVpn bit is set. 459WARN_UNUSED_RESULT int modifyVpnUidRangeRule(uint32_t table, uid_t uidStart, uid_t uidEnd, 460 bool secure, bool add) { 461 Fwmark fwmark; 462 Fwmark mask; 463 464 fwmark.protectedFromVpn = false; 465 mask.protectedFromVpn = true; 466 467 uint32_t priority; 468 469 if (secure) { 470 priority = RULE_PRIORITY_SECURE_VPN; 471 } else { 472 priority = RULE_PRIORITY_BYPASSABLE_VPN; 473 474 fwmark.explicitlySelected = false; 475 mask.explicitlySelected = true; 476 } 477 478 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, priority, table, fwmark.intValue, 479 mask.intValue, IIF_NONE, OIF_NONE, uidStart, uidEnd); 480} 481 482// A rule to allow system apps to send traffic over this VPN even if they are not part of the target 483// set of UIDs. 484// 485// This is needed for DnsProxyListener to correctly resolve a request for a user who is in the 486// target set, but where the DnsProxyListener itself is not. 487WARN_UNUSED_RESULT int modifyVpnSystemPermissionRule(unsigned netId, uint32_t table, bool secure, 488 bool add) { 489 Fwmark fwmark; 490 Fwmark mask; 491 492 fwmark.netId = netId; 493 mask.netId = FWMARK_NET_ID_MASK; 494 495 fwmark.permission = PERMISSION_SYSTEM; 496 mask.permission = PERMISSION_SYSTEM; 497 498 uint32_t priority = secure ? RULE_PRIORITY_SECURE_VPN : RULE_PRIORITY_BYPASSABLE_VPN; 499 500 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, priority, table, fwmark.intValue, 501 mask.intValue); 502} 503 504// A rule to route traffic based on an explicitly chosen network. 505// 506// Supports apps that use the multinetwork APIs to restrict their traffic to a network. 507// 508// Even though we check permissions at the time we set a netId into the fwmark of a socket, we need 509// to check it again in the rules here, because a network's permissions may have been updated via 510// modifyNetworkPermission(). 511WARN_UNUSED_RESULT int modifyExplicitNetworkRule(unsigned netId, uint32_t table, 512 Permission permission, uid_t uidStart, 513 uid_t uidEnd, bool add) { 514 Fwmark fwmark; 515 Fwmark mask; 516 517 fwmark.netId = netId; 518 mask.netId = FWMARK_NET_ID_MASK; 519 520 fwmark.explicitlySelected = true; 521 mask.explicitlySelected = true; 522 523 fwmark.permission = permission; 524 mask.permission = permission; 525 526 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_EXPLICIT_NETWORK, table, 527 fwmark.intValue, mask.intValue, IIF_NONE, OIF_NONE, uidStart, uidEnd); 528} 529 530// A rule to route traffic based on a chosen outgoing interface. 531// 532// Supports apps that use SO_BINDTODEVICE or IP_PKTINFO options and the kernel that already knows 533// the outgoing interface (typically for link-local communications). 534WARN_UNUSED_RESULT int modifyOutputInterfaceRule(const char* interface, uint32_t table, 535 Permission permission, uid_t uidStart, 536 uid_t uidEnd, bool add) { 537 Fwmark fwmark; 538 Fwmark mask; 539 540 fwmark.permission = permission; 541 mask.permission = permission; 542 543 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_OUTPUT_INTERFACE, table, 544 fwmark.intValue, mask.intValue, IIF_NONE, interface, uidStart, uidEnd); 545} 546 547// A rule to route traffic based on the chosen network. 548// 549// This is for sockets that have not explicitly requested a particular network, but have been 550// bound to one when they called connect(). This ensures that sockets connected on a particular 551// network stay on that network even if the default network changes. 552WARN_UNUSED_RESULT int modifyImplicitNetworkRule(unsigned netId, uint32_t table, 553 Permission permission, bool add) { 554 Fwmark fwmark; 555 Fwmark mask; 556 557 fwmark.netId = netId; 558 mask.netId = FWMARK_NET_ID_MASK; 559 560 fwmark.explicitlySelected = false; 561 mask.explicitlySelected = true; 562 563 fwmark.permission = permission; 564 mask.permission = permission; 565 566 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_IMPLICIT_NETWORK, table, 567 fwmark.intValue, mask.intValue); 568} 569 570// A rule to enable split tunnel VPNs. 571// 572// If a packet with a VPN's netId doesn't find a route in the VPN's routing table, it's allowed to 573// go over the default network, provided it wasn't explicitly restricted to the VPN and has the 574// permissions required by the default network. 575WARN_UNUSED_RESULT int modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId, 576 const char* physicalInterface, 577 Permission permission) { 578 uint32_t table = getRouteTableForInterface(physicalInterface); 579 if (table == RT_TABLE_UNSPEC) { 580 return -ESRCH; 581 } 582 583 Fwmark fwmark; 584 Fwmark mask; 585 586 fwmark.netId = vpnNetId; 587 mask.netId = FWMARK_NET_ID_MASK; 588 589 fwmark.explicitlySelected = false; 590 mask.explicitlySelected = true; 591 592 fwmark.permission = permission; 593 mask.permission = permission; 594 595 return modifyIpRule(action, RULE_PRIORITY_VPN_FALLTHROUGH, table, fwmark.intValue, 596 mask.intValue); 597} 598 599// Add rules to allow legacy routes added through the requestRouteToHost() API. 600WARN_UNUSED_RESULT int addLegacyRouteRules() { 601 Fwmark fwmark; 602 Fwmark mask; 603 604 fwmark.explicitlySelected = false; 605 mask.explicitlySelected = true; 606 607 // Rules to allow legacy routes to override the default network. 608 if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LEGACY_SYSTEM, ROUTE_TABLE_LEGACY_SYSTEM, 609 fwmark.intValue, mask.intValue)) { 610 return ret; 611 } 612 if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LEGACY_NETWORK, 613 ROUTE_TABLE_LEGACY_NETWORK, fwmark.intValue, mask.intValue)) { 614 return ret; 615 } 616 617 fwmark.permission = PERMISSION_SYSTEM; 618 mask.permission = PERMISSION_SYSTEM; 619 620 // A rule to allow legacy routes from system apps to override VPNs. 621 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_VPN_OVERRIDE_SYSTEM, ROUTE_TABLE_LEGACY_SYSTEM, 622 fwmark.intValue, mask.intValue); 623} 624 625// Add rules to lookup the local network when specified explicitly or otherwise. 626WARN_UNUSED_RESULT int addLocalNetworkRules(unsigned localNetId) { 627 if (int ret = modifyExplicitNetworkRule(localNetId, ROUTE_TABLE_LOCAL_NETWORK, PERMISSION_NONE, 628 INVALID_UID, INVALID_UID, ACTION_ADD)) { 629 return ret; 630 } 631 632 Fwmark fwmark; 633 Fwmark mask; 634 635 fwmark.explicitlySelected = false; 636 mask.explicitlySelected = true; 637 638 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LOCAL_NETWORK, ROUTE_TABLE_LOCAL_NETWORK, 639 fwmark.intValue, mask.intValue); 640} 641 642// Add a new rule to look up the 'main' table, with the same selectors as the "default network" 643// rule, but with a lower priority. We will never create routes in the main table; it should only be 644// used for directly-connected routes implicitly created by the kernel when adding IP addresses. 645// This is necessary, for example, when adding a route through a directly-connected gateway: in 646// order to add the route, there must already be a directly-connected route that covers the gateway. 647WARN_UNUSED_RESULT int addDirectlyConnectedRule() { 648 Fwmark fwmark; 649 Fwmark mask; 650 651 fwmark.netId = NETID_UNSET; 652 mask.netId = FWMARK_NET_ID_MASK; 653 654 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_DIRECTLY_CONNECTED, RT_TABLE_MAIN, 655 fwmark.intValue, mask.intValue, IIF_NONE, OIF_NONE, UID_ROOT, UID_ROOT); 656} 657 658// Add an explicit unreachable rule close to the end of the prioriy list to make it clear that 659// relying on the kernel-default "from all lookup main" rule at priority 32766 is not intended 660// behaviour. We do flush the kernel-default rules at startup, but having an explicit unreachable 661// rule will hopefully make things even clearer. 662WARN_UNUSED_RESULT int addUnreachableRule() { 663 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_UNREACHABLE, RT_TABLE_UNSPEC, MARK_UNSET, 664 MARK_UNSET); 665} 666 667WARN_UNUSED_RESULT int modifyLocalNetwork(unsigned netId, const char* interface, bool add) { 668 if (int ret = modifyIncomingPacketMark(netId, interface, PERMISSION_NONE, add)) { 669 return ret; 670 } 671 return modifyOutputInterfaceRule(interface, ROUTE_TABLE_LOCAL_NETWORK, PERMISSION_NONE, 672 INVALID_UID, INVALID_UID, add); 673} 674 675WARN_UNUSED_RESULT int modifyPhysicalNetwork(unsigned netId, const char* interface, 676 Permission permission, bool add) { 677 uint32_t table = getRouteTableForInterface(interface); 678 if (table == RT_TABLE_UNSPEC) { 679 return -ESRCH; 680 } 681 682 if (int ret = modifyIncomingPacketMark(netId, interface, permission, add)) { 683 return ret; 684 } 685 if (int ret = modifyExplicitNetworkRule(netId, table, permission, INVALID_UID, INVALID_UID, 686 add)) { 687 return ret; 688 } 689 if (int ret = modifyOutputInterfaceRule(interface, table, permission, INVALID_UID, INVALID_UID, 690 add)) { 691 return ret; 692 } 693 return modifyImplicitNetworkRule(netId, table, permission, add); 694} 695 696WARN_UNUSED_RESULT int modifyVirtualNetwork(unsigned netId, const char* interface, 697 const UidRanges& uidRanges, bool secure, bool add, 698 bool modifyNonUidBasedRules) { 699 uint32_t table = getRouteTableForInterface(interface); 700 if (table == RT_TABLE_UNSPEC) { 701 return -ESRCH; 702 } 703 704 for (const UidRanges::Range& range : uidRanges.getRanges()) { 705 if (int ret = modifyVpnUidRangeRule(table, range.first, range.second, secure, add)) { 706 return ret; 707 } 708 if (int ret = modifyExplicitNetworkRule(netId, table, PERMISSION_NONE, range.first, 709 range.second, add)) { 710 return ret; 711 } 712 if (int ret = modifyOutputInterfaceRule(interface, table, PERMISSION_NONE, range.first, 713 range.second, add)) { 714 return ret; 715 } 716 } 717 718 if (modifyNonUidBasedRules) { 719 if (int ret = modifyIncomingPacketMark(netId, interface, PERMISSION_NONE, add)) { 720 return ret; 721 } 722 if (int ret = modifyVpnOutputToLocalRule(interface, add)) { 723 return ret; 724 } 725 if (int ret = modifyVpnSystemPermissionRule(netId, table, secure, add)) { 726 return ret; 727 } 728 return modifyExplicitNetworkRule(netId, table, PERMISSION_NONE, UID_ROOT, UID_ROOT, add); 729 } 730 731 return 0; 732} 733 734WARN_UNUSED_RESULT int modifyDefaultNetwork(uint16_t action, const char* interface, 735 Permission permission) { 736 uint32_t table = getRouteTableForInterface(interface); 737 if (table == RT_TABLE_UNSPEC) { 738 return -ESRCH; 739 } 740 741 Fwmark fwmark; 742 Fwmark mask; 743 744 fwmark.netId = NETID_UNSET; 745 mask.netId = FWMARK_NET_ID_MASK; 746 747 fwmark.permission = permission; 748 mask.permission = permission; 749 750 return modifyIpRule(action, RULE_PRIORITY_DEFAULT_NETWORK, table, fwmark.intValue, 751 mask.intValue); 752} 753 754WARN_UNUSED_RESULT int modifyTetheredNetwork(uint16_t action, const char* inputInterface, 755 const char* outputInterface) { 756 uint32_t table = getRouteTableForInterface(outputInterface); 757 if (table == RT_TABLE_UNSPEC) { 758 return -ESRCH; 759 } 760 761 return modifyIpRule(action, RULE_PRIORITY_TETHERING, table, MARK_UNSET, MARK_UNSET, 762 inputInterface, OIF_NONE, INVALID_UID, INVALID_UID); 763} 764 765// Returns 0 on success or negative errno on failure. 766WARN_UNUSED_RESULT int flushRules() { 767 for (size_t i = 0; i < ARRAY_SIZE(IP_VERSIONS); ++i) { 768 const char* argv[] = { 769 IP_PATH, 770 IP_VERSIONS[i], 771 "rule", 772 "flush", 773 }; 774 if (android_fork_execvp(ARRAY_SIZE(argv), const_cast<char**>(argv), NULL, false, false)) { 775 ALOGE("failed to flush rules"); 776 return -EREMOTEIO; 777 } 778 } 779 return 0; 780} 781 782// Adds or removes an IPv4 or IPv6 route to the specified table and, if it's a directly-connected 783// route, to the main table as well. 784// Returns 0 on success or negative errno on failure. 785WARN_UNUSED_RESULT int modifyRoute(uint16_t action, const char* interface, const char* destination, 786 const char* nexthop, RouteController::TableType tableType) { 787 uint32_t table; 788 switch (tableType) { 789 case RouteController::INTERFACE: { 790 table = getRouteTableForInterface(interface); 791 if (table == RT_TABLE_UNSPEC) { 792 return -ESRCH; 793 } 794 break; 795 } 796 case RouteController::LOCAL_NETWORK: { 797 table = ROUTE_TABLE_LOCAL_NETWORK; 798 break; 799 } 800 case RouteController::LEGACY_NETWORK: { 801 table = ROUTE_TABLE_LEGACY_NETWORK; 802 break; 803 } 804 case RouteController::LEGACY_SYSTEM: { 805 table = ROUTE_TABLE_LEGACY_SYSTEM; 806 break; 807 } 808 } 809 810 int ret = modifyIpRoute(action, table, interface, destination, nexthop); 811 // Trying to add a route that already exists shouldn't cause an error. 812 if (ret && !(action == RTM_NEWROUTE && ret == -EEXIST)) { 813 return ret; 814 } 815 816 return 0; 817} 818 819// Returns 0 on success or negative errno on failure. 820WARN_UNUSED_RESULT int flushRoutes(const char* interface) { 821 uint32_t table = getRouteTableForInterface(interface); 822 if (table == RT_TABLE_UNSPEC) { 823 return -ESRCH; 824 } 825 826 char tableString[UINT32_STRLEN]; 827 snprintf(tableString, sizeof(tableString), "%u", table); 828 829 int ret = 0; 830 for (size_t i = 0; i < ARRAY_SIZE(IP_VERSIONS); ++i) { 831 const char* argv[] = { 832 IP_PATH, 833 IP_VERSIONS[i], 834 "route", 835 "flush", 836 "table", 837 tableString, 838 }; 839 840 // A flush works by dumping routes and deleting each route as it's returned, and it can 841 // fail if something else deletes the route between the dump and the delete. This can 842 // happen, for example, if an interface goes down while we're trying to flush its routes. 843 // So try multiple times and only return an error if the last attempt fails. 844 // 845 // TODO: replace this with our own netlink code. 846 unsigned attempts = 0; 847 int err; 848 do { 849 err = android_fork_execvp(ARRAY_SIZE(argv), const_cast<char**>(argv), 850 NULL, false, false); 851 ++attempts; 852 } while (err != 0 && attempts < ROUTE_FLUSH_ATTEMPTS); 853 if (err) { 854 ALOGE("failed to flush %s routes in table %s after %d attempts", 855 IP_VERSIONS[i], tableString, attempts); 856 ret = -EREMOTEIO; 857 } 858 } 859 860 // If we failed to flush routes, the caller may elect to keep this interface around, so keep 861 // track of its name. 862 if (!ret) { 863 interfaceToTable.erase(interface); 864 } 865 866 return ret; 867} 868 869} // namespace 870 871int RouteController::Init(unsigned localNetId) { 872 if (int ret = flushRules()) { 873 return ret; 874 } 875 if (int ret = addLegacyRouteRules()) { 876 return ret; 877 } 878 if (int ret = addLocalNetworkRules(localNetId)) { 879 return ret; 880 } 881 if (int ret = addDirectlyConnectedRule()) { 882 return ret; 883 } 884 if (int ret = addUnreachableRule()) { 885 return ret; 886 } 887 updateTableNamesFile(); 888 return 0; 889} 890 891int RouteController::addInterfaceToLocalNetwork(unsigned netId, const char* interface) { 892 return modifyLocalNetwork(netId, interface, ACTION_ADD); 893} 894 895int RouteController::removeInterfaceFromLocalNetwork(unsigned netId, const char* interface) { 896 return modifyLocalNetwork(netId, interface, ACTION_DEL); 897} 898 899int RouteController::addInterfaceToPhysicalNetwork(unsigned netId, const char* interface, 900 Permission permission) { 901 if (int ret = modifyPhysicalNetwork(netId, interface, permission, ACTION_ADD)) { 902 return ret; 903 } 904 updateTableNamesFile(); 905 return 0; 906} 907 908int RouteController::removeInterfaceFromPhysicalNetwork(unsigned netId, const char* interface, 909 Permission permission) { 910 if (int ret = modifyPhysicalNetwork(netId, interface, permission, ACTION_DEL)) { 911 return ret; 912 } 913 if (int ret = flushRoutes(interface)) { 914 return ret; 915 } 916 updateTableNamesFile(); 917 return 0; 918} 919 920int RouteController::addInterfaceToVirtualNetwork(unsigned netId, const char* interface, 921 bool secure, const UidRanges& uidRanges) { 922 if (int ret = modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_ADD, 923 MODIFY_NON_UID_BASED_RULES)) { 924 return ret; 925 } 926 updateTableNamesFile(); 927 return 0; 928} 929 930int RouteController::removeInterfaceFromVirtualNetwork(unsigned netId, const char* interface, 931 bool secure, const UidRanges& uidRanges) { 932 if (int ret = modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_DEL, 933 MODIFY_NON_UID_BASED_RULES)) { 934 return ret; 935 } 936 if (int ret = flushRoutes(interface)) { 937 return ret; 938 } 939 updateTableNamesFile(); 940 return 0; 941} 942 943int RouteController::modifyPhysicalNetworkPermission(unsigned netId, const char* interface, 944 Permission oldPermission, 945 Permission newPermission) { 946 // Add the new rules before deleting the old ones, to avoid race conditions. 947 if (int ret = modifyPhysicalNetwork(netId, interface, newPermission, ACTION_ADD)) { 948 return ret; 949 } 950 return modifyPhysicalNetwork(netId, interface, oldPermission, ACTION_DEL); 951} 952 953int RouteController::addUsersToVirtualNetwork(unsigned netId, const char* interface, bool secure, 954 const UidRanges& uidRanges) { 955 return modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_ADD, 956 !MODIFY_NON_UID_BASED_RULES); 957} 958 959int RouteController::removeUsersFromVirtualNetwork(unsigned netId, const char* interface, 960 bool secure, const UidRanges& uidRanges) { 961 return modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_DEL, 962 !MODIFY_NON_UID_BASED_RULES); 963} 964 965int RouteController::addInterfaceToDefaultNetwork(const char* interface, Permission permission) { 966 return modifyDefaultNetwork(RTM_NEWRULE, interface, permission); 967} 968 969int RouteController::removeInterfaceFromDefaultNetwork(const char* interface, 970 Permission permission) { 971 return modifyDefaultNetwork(RTM_DELRULE, interface, permission); 972} 973 974int RouteController::addRoute(const char* interface, const char* destination, const char* nexthop, 975 TableType tableType) { 976 return modifyRoute(RTM_NEWROUTE, interface, destination, nexthop, tableType); 977} 978 979int RouteController::removeRoute(const char* interface, const char* destination, 980 const char* nexthop, TableType tableType) { 981 return modifyRoute(RTM_DELROUTE, interface, destination, nexthop, tableType); 982} 983 984int RouteController::enableTethering(const char* inputInterface, const char* outputInterface) { 985 return modifyTetheredNetwork(RTM_NEWRULE, inputInterface, outputInterface); 986} 987 988int RouteController::disableTethering(const char* inputInterface, const char* outputInterface) { 989 return modifyTetheredNetwork(RTM_DELRULE, inputInterface, outputInterface); 990} 991 992int RouteController::addVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface, 993 Permission permission) { 994 return modifyVpnFallthroughRule(RTM_NEWRULE, vpnNetId, physicalInterface, permission); 995} 996 997int RouteController::removeVirtualNetworkFallthrough(unsigned vpnNetId, 998 const char* physicalInterface, 999 Permission permission) { 1000 return modifyVpnFallthroughRule(RTM_DELRULE, vpnNetId, physicalInterface, permission); 1001} 1002