RouteController.cpp revision cf891383224e420d99996f7e63728a7cc902415e
15c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran/* 25c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * Copyright (C) 2014 The Android Open Source Project 35c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * 45c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * Licensed under the Apache License, Version 2.0 (the "License"); 55c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * you may not use this file except in compliance with the License. 65c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * You may obtain a copy of the License at 75c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * 85c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * http://www.apache.org/licenses/LICENSE-2.0 95c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * 105c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * Unless required by applicable law or agreed to in writing, software 115c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * distributed under the License is distributed on an "AS IS" BASIS, 125c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 135c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * See the License for the specific language governing permissions and 145c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * limitations under the License. 155c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran */ 165c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 175c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran#include "RouteController.h" 185c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 195c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran#include "Fwmark.h" 20b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran#include "UidRanges.h" 21f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 22f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#define LOG_TAG "Netd" 23f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#include "log/log.h" 24f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#include "logwrap/logwrap.h" 255c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 26ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti#include <arpa/inet.h> 274753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti#include <linux/fib_rules.h> 28a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen#include <map> 295c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran#include <net/if.h> 305c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 315c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandrannamespace { 325c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 33f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// BEGIN CONSTANTS -------------------------------------------------------------------------------- 34f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 3538b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandranconst uint32_t RULE_PRIORITY_PRIVILEGED_LEGACY = 11000; 364043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandranconst uint32_t RULE_PRIORITY_SECURE_VPN = 12000; 378fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandranconst uint32_t RULE_PRIORITY_PER_NETWORK_EXPLICIT = 13000; 388fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandranconst uint32_t RULE_PRIORITY_PER_NETWORK_INTERFACE = 14000; 3938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandranconst uint32_t RULE_PRIORITY_LEGACY = 16000; 408fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandranconst uint32_t RULE_PRIORITY_PER_NETWORK_NORMAL = 17000; 418fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandranconst uint32_t RULE_PRIORITY_DEFAULT_NETWORK = 19000; 428fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandranconst uint32_t RULE_PRIORITY_MAIN = 20000; 4356afacf838d24cf8e54d2cf0d8ab9182ab704125Sreeram Ramachandran// TODO: Uncomment once we are sure everything works. 4456afacf838d24cf8e54d2cf0d8ab9182ab704125Sreeram Ramachandran#if 0 458fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandranconst uint32_t RULE_PRIORITY_UNREACHABLE = 21000; 4656afacf838d24cf8e54d2cf0d8ab9182ab704125Sreeram Ramachandran#endif 475c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 4838b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran// TODO: These should be turned into per-UID tables once the kernel supports UID-based routing. 4938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandranconst int ROUTE_TABLE_PRIVILEGED_LEGACY = RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX - 901; 5038b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandranconst int ROUTE_TABLE_LEGACY = RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX - 902; 5138b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 525965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// TODO: These values aren't defined by the Linux kernel, because our UID routing changes are not 535965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// upstream (yet?), so we can't just pick them up from kernel headers. When (if?) the changes make 545965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// it upstream, we'll remove this and rely on the kernel header values. For now, add a static assert 555965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// that will warn us if upstream has given these values some other meaning. 565965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitticonst uint16_t FRA_UID_START = 18; 575965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitticonst uint16_t FRA_UID_END = 19; 585965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colittistatic_assert(FRA_UID_START > FRA_MAX, 595965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti "Android-specific FRA_UID_{START,END} values also assigned in Linux uapi. " 605965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti "Check that these values match what the kernel does and then update this assertion."); 615965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti 6272723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitticonst uint16_t NETLINK_REQUEST_FLAGS = NLM_F_REQUEST | NLM_F_ACK; 6372723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitticonst uint16_t NETLINK_CREATE_REQUEST_FLAGS = NETLINK_REQUEST_FLAGS | NLM_F_CREATE | NLM_F_EXCL; 644753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 65f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconst sockaddr_nl NETLINK_ADDRESS = {AF_NETLINK, 0, 0, 0}; 66f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 67f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconst uint8_t AF_FAMILIES[] = {AF_INET, AF_INET6}; 68f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 69f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconst char* const IP_VERSIONS[] = {"-4", "-6"}; 70f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 71f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// Avoids "non-constant-expression cannot be narrowed from type 'unsigned int' to 'unsigned short'" 72f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// warnings when using RTA_LENGTH(x) inside static initializers (even when x is already uint16_t). 73f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconstexpr uint16_t U16_RTA_LENGTH(uint16_t x) { 74f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return RTA_LENGTH(x); 75f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran} 76f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 77f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// These are practically const, but can't be declared so, because they are used to initialize 78f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// non-const pointers ("void* iov_base") in iovec arrays. 79f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_PRIORITY = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_PRIORITY }; 80f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_TABLE }; 81f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_FWMARK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMARK }; 82f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_FWMASK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMASK }; 83f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_UID_START = { U16_RTA_LENGTH(sizeof(uid_t)), FRA_UID_START }; 84f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_UID_END = { U16_RTA_LENGTH(sizeof(uid_t)), FRA_UID_END }; 85f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 86f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr RTATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_TABLE }; 87f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr RTATTR_OIF = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_OIF }; 88f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 89f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranuint8_t PADDING_BUFFER[RTA_ALIGNTO] = {0, 0, 0, 0}; 90f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 91f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// END CONSTANTS ---------------------------------------------------------------------------------- 92f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 93a561e121c724e9163b2e256e15eef660e3a326daPaul Jensenstd::map<std::string, uint32_t> interfaceToIndex; 94a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen 955c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandranuint32_t getRouteTableForInterface(const char* interface) { 96a48118062412f16ae712bfc8c8a539d3b6a85e47Sreeram Ramachandran uint32_t index = if_nametoindex(interface); 97a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen if (index) { 98a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen interfaceToIndex[interface] = index; 99a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen } else { 100a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen // If the interface goes away if_nametoindex() will return 0 but we still need to know 101a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen // the index so we can remove the rules and routes. 102a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen std::map<std::string, uint32_t>::iterator it = interfaceToIndex.find(interface); 103f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (it != interfaceToIndex.end()) { 104a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen index = it->second; 105f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 106a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen } 107a48118062412f16ae712bfc8c8a539d3b6a85e47Sreeram Ramachandran return index ? index + RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX : 0; 1085c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 1095c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 1104753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// Sends a netlink request and expects an ack. 1114753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// |iov| is an array of struct iovec that contains the netlink message payload. 1124753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// The netlink header is generated by this function based on |action| and |flags|. 1134753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// Returns -errno if there was an error or if the kernel reported an error. 114f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int sendNetlinkRequest(uint16_t action, uint16_t flags, iovec* iov, int iovlen) { 1154753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsghdr nlmsg = { 1164753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti .nlmsg_type = action, 1174753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti .nlmsg_flags = flags, 1184753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti }; 1194753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti iov[0].iov_base = &nlmsg; 1204753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti iov[0].iov_len = sizeof(nlmsg); 1214753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti for (int i = 0; i < iovlen; ++i) { 1224753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsg.nlmsg_len += iov[i].iov_len; 1234753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1244753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1254753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti int ret; 1264753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti struct { 1274753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsghdr msg; 1284753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsgerr err; 1294753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } response; 1304753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1314753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti int sock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE); 1324753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (sock != -1 && 133f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran connect(sock, reinterpret_cast<const sockaddr*>(&NETLINK_ADDRESS), 134f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran sizeof(NETLINK_ADDRESS)) != -1 && 1354753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti writev(sock, iov, iovlen) != -1 && 1364753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti (ret = recv(sock, &response, sizeof(response), 0)) != -1) { 1374753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (ret == sizeof(response)) { 1384753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti ret = response.err.error; // Netlink errors are negative errno. 139f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (ret) { 140f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("netlink response contains error (%s)", strerror(-ret)); 141f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 1424753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } else { 1431201e84ebda52d8d82e5385644e9de0923e61aa3Sreeram Ramachandran ALOGE("bad netlink response message size (%d != %zu)", ret, sizeof(response)); 1444753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti ret = -EBADMSG; 1454753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1464753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } else { 147f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("netlink socket/connect/writev/recv failed (%s)", strerror(errno)); 1484753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti ret = -errno; 1494753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1504753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1514753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (sock != -1) { 1524753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti close(sock); 1534753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1544753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1554753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return ret; 1564753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti} 1574753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1588fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// Adds or removes a routing rule for IPv4 and IPv6. 1598fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// 1608fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// + If |table| is non-zero, the rule points at the specified routing table. Otherwise, the rule 1618fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// returns ENETUNREACH. 1628fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// + If |mask| is non-zero, the rule matches the specified fwmark and mask. Otherwise, |fwmark| is 1638fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// ignored. 1648fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// + If |interface| is non-NULL, the rule matches the specified outgoing interface. 16596f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti// 16696f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti// Returns 0 on success or negative errno on failure. 167f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table, 168f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint32_t fwmark, uint32_t mask, const char* interface, 169f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uid_t uidStart, uid_t uidEnd) { 170f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // Ensure that if you set a bit in the fwmark, it's not being ignored by the mask. 171f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (fwmark & ~mask) { 172f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("mask 0x%x does not select all the bits set in fwmark 0x%x", mask, fwmark); 173f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return -ERANGE; 174f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 175f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 1764753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // The interface name must include exactly one terminating NULL and be properly padded, or older 1774753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // kernels will refuse to delete rules. 1784753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti uint16_t paddingLength = 0; 1794753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti size_t interfaceLength = 0; 1804753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti char oifname[IFNAMSIZ]; 1814753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (interface) { 1824753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti interfaceLength = strlcpy(oifname, interface, IFNAMSIZ) + 1; 1834753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (interfaceLength > IFNAMSIZ) { 184cf891383224e420d99996f7e63728a7cc902415eSreeram Ramachandran ALOGE("interface name too long (%zu > %u)", interfaceLength, IFNAMSIZ); 1854753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return -ENAMETOOLONG; 1864753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1874753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti paddingLength = RTA_SPACE(interfaceLength) - RTA_LENGTH(interfaceLength); 1884753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1897619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 1905965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti // Either both start and end UID must be specified, or neither. 191f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if ((uidStart == INVALID_UID) != (uidEnd == INVALID_UID)) { 192cf891383224e420d99996f7e63728a7cc902415eSreeram Ramachandran ALOGE("incompatible start and end UIDs (%u vs %u)", uidStart, uidEnd); 1935965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti return -EUSERS; 1945965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti } 19572723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitti bool isUidRule = (uidStart != INVALID_UID); 1965965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti 1974753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // Assemble a rule request and put it in an array of iovec structures. 1984753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti fib_rule_hdr rule = { 1994753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti .action = static_cast<uint8_t>(table ? FR_ACT_TO_TBL : FR_ACT_UNREACHABLE), 2004753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti }; 201a10ac3214f6a582b7fdb66acc43c702731e53d81Lorenzo Colitti 202f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtattr fraOifname = { U16_RTA_LENGTH(interfaceLength), FRA_OIFNAME }; 203a10ac3214f6a582b7fdb66acc43c702731e53d81Lorenzo Colitti 2044753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti iovec iov[] = { 205f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { NULL, 0 }, 206f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &rule, sizeof(rule) }, 207f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_PRIORITY, sizeof(FRATTR_PRIORITY) }, 208f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &priority, sizeof(priority) }, 209f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_TABLE, table ? sizeof(FRATTR_TABLE) : 0 }, 210f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &table, table ? sizeof(table) : 0 }, 211f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_FWMARK, mask ? sizeof(FRATTR_FWMARK) : 0 }, 212f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &fwmark, mask ? sizeof(fwmark) : 0 }, 213f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_FWMASK, mask ? sizeof(FRATTR_FWMASK) : 0 }, 214f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &mask, mask ? sizeof(mask) : 0 }, 215f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_UID_START, isUidRule ? sizeof(FRATTR_UID_START) : 0 }, 216f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &uidStart, isUidRule ? sizeof(uidStart) : 0 }, 217f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_UID_END, isUidRule ? sizeof(FRATTR_UID_END) : 0 }, 218f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &uidEnd, isUidRule ? sizeof(uidEnd) : 0 }, 219f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &fraOifname, interface ? sizeof(fraOifname) : 0 }, 220f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { oifname, interfaceLength }, 221f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { PADDING_BUFFER, paddingLength }, 2224753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti }; 2234753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 22472723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitti uint16_t flags = (action == RTM_NEWRULE) ? NETLINK_CREATE_REQUEST_FLAGS : NETLINK_REQUEST_FLAGS; 225f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran for (size_t i = 0; i < ARRAY_SIZE(AF_FAMILIES); ++i) { 226f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rule.family = AF_FAMILIES[i]; 227f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov))) { 22896f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 2295c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 2305c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 2315c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 23296f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return 0; 2335c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 2345c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 235ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti// Adds or deletes an IPv4 or IPv6 route. 236ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti// Returns 0 on success or negative errno on failure. 237f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, 238f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran const char* destination, const char* nexthop) { 239ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // At least the destination must be non-null. 240ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (!destination) { 241f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("null destination"); 242ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -EFAULT; 243ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 244ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 245ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // Parse the prefix. 246ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti uint8_t rawAddress[sizeof(in6_addr)]; 247f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint8_t family; 248f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint8_t prefixLength; 249ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti int rawLength = parsePrefix(destination, &family, rawAddress, sizeof(rawAddress), 250ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti &prefixLength); 251ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (rawLength < 0) { 252f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("parsePrefix failed for destination %s (%s)", destination, strerror(-rawLength)); 253ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return rawLength; 254ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 2557619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 256ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (static_cast<size_t>(rawLength) > sizeof(rawAddress)) { 2571201e84ebda52d8d82e5385644e9de0923e61aa3Sreeram Ramachandran ALOGE("impossible! address too long (%d vs %zu)", rawLength, sizeof(rawAddress)); 258ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -ENOBUFS; // Cannot happen; parsePrefix only supports IPv4 and IPv6. 259ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 260ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 261ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // If an interface was specified, find the ifindex. 262ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti uint32_t ifindex; 263ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (interface) { 264ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti ifindex = if_nametoindex(interface); 265ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (!ifindex) { 266f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 267ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -ENODEV; 2687619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran } 2697619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran } 2707619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 271ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // If a nexthop was specified, parse it as the same family as the prefix. 272ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti uint8_t rawNexthop[sizeof(in6_addr)]; 273f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (nexthop && inet_pton(family, nexthop, rawNexthop) <= 0) { 274f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("inet_pton failed for nexthop %s", nexthop); 275ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -EINVAL; 276ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 277ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 2784753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // Assemble a rtmsg and put it in an array of iovec structures. 279f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtmsg route = { 280ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_protocol = RTPROT_STATIC, 281ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_type = RTN_UNICAST, 282ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_family = family, 283ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_dst_len = prefixLength, 284ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti }; 2854753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 286f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtattr rtaDst = { U16_RTA_LENGTH(rawLength), RTA_DST }; 287f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtattr rtaGateway = { U16_RTA_LENGTH(rawLength), RTA_GATEWAY }; 288ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 289ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti iovec iov[] = { 290f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { NULL, 0 }, 291f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &route, sizeof(route) }, 292f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &RTATTR_TABLE, sizeof(RTATTR_TABLE) }, 293f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &table, sizeof(table) }, 294f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &rtaDst, sizeof(rtaDst) }, 295f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { rawAddress, static_cast<size_t>(rawLength) }, 296f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &RTATTR_OIF, interface ? sizeof(RTATTR_OIF) : 0 }, 297f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &ifindex, interface ? sizeof(ifindex) : 0 }, 298f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &rtaGateway, nexthop ? sizeof(rtaGateway) : 0 }, 299f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { rawNexthop, nexthop ? static_cast<size_t>(rawLength) : 0 }, 300ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti }; 301ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 302f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint16_t flags = (action == RTM_NEWROUTE) ? NETLINK_CREATE_REQUEST_FLAGS : 303f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran NETLINK_REQUEST_FLAGS; 3044753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov)); 3057619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 3067619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 307b1425cc09f8a29350520db0d4f489331df5a689bSreeram RamachandranWARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface, bool add) { 308b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // An iptables rule to mark incoming packets on a network with the netId of the network. 309b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // 310b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // This is so that the kernel can: 311b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // + Use the right fwmark for (and thus correctly route) replies (e.g.: TCP RST, ICMP errors, 312b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // ping replies). 313b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // + Mark sockets that accept connections from this interface so that the connection stays on 314b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // the same interface. 315b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran char markString[UINT32_HEX_STRLEN]; 316b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran snprintf(markString, sizeof(markString), "0x%x", netId); 317b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (execIptables(V4V6, "-t", "mangle", add ? "-A" : "-D", "INPUT", "-i", interface, "-j", 318b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran "MARK", "--set-mark", markString, NULL)) { 319b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran ALOGE("failed to change iptables rule that sets incoming packet mark"); 320b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return -EREMOTEIO; 321b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 322b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return 0; 323b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran} 324b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 325b1425cc09f8a29350520db0d4f489331df5a689bSreeram RamachandranWARN_UNUSED_RESULT int modifyPerNetworkRules(unsigned netId, const char* interface, uint32_t table, 326b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran Permission permission, uid_t uidStart, uid_t uidEnd, 327b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran bool add, bool modifyIptables) { 3285c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran if (!table) { 329b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran table = getRouteTableForInterface(interface); 330b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (!table) { 331b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran ALOGE("cannot find interface %s", interface); 332b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return -ESRCH; 333b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 3345c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3355c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 3364753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti uint16_t action = add ? RTM_NEWRULE : RTM_DELRULE; 3375c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 338122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark fwmark; 339122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark mask; 3405c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 3415c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // A rule to route traffic based on a chosen outgoing interface. 3425c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // 3435c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // Supports apps that use SO_BINDTODEVICE or IP_PKTINFO options and the kernel that already 3445c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // knows the outgoing interface (typically for link-local communications). 345f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran fwmark.permission = permission; 346f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran mask.permission = permission; 347f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_PER_NETWORK_INTERFACE, table, fwmark.intValue, 348b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, interface, uidStart, uidEnd)) { 34996f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 3505c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3515c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 3525c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // A rule to route traffic based on the chosen network. 3535c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // 3545c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // This is for sockets that have not explicitly requested a particular network, but have been 3555c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // bound to one when they called connect(). This ensures that sockets connected on a particular 3565c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // network stay on that network even if the default network changes. 357122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran fwmark.netId = netId; 358122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 359f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_PER_NETWORK_NORMAL, table, fwmark.intValue, 360b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, uidStart, uidEnd)) { 36196f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 362122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran } 363122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran 364122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // A rule to route traffic based on an explicitly chosen network. 365122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // 366122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // Supports apps that use the multinetwork APIs to restrict their traffic to a network. 367122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // 368f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // Even though we check permissions at the time we set a netId into the fwmark of a socket, we 369f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // still need to check it again in the rules here, because a network's permissions may have been 370f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // updated via modifyNetworkPermission(). 371122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran fwmark.explicitlySelected = true; 372122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.explicitlySelected = true; 373f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_PER_NETWORK_EXPLICIT, table, fwmark.intValue, 374b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, uidStart, uidEnd)) { 37596f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 3765c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3775c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 378379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran if (modifyIptables) { 379b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIncomingPacketMark(netId, interface, add)) { 380b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 381379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran } 3825c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3835c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 38496f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return 0; 3855c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 3865c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 387b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// Adds or removes rules for VPNs that affect UIDs in |uidRanges|. If |modifyInterfaceBasedRules| 388b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// is true, also modifies the rules that are based only on the |interface| and not on |uidRanges|. 389b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// When adding or removing an interface to the VPN, set it to true. When adding or removing UIDs 390b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// without changing the VPN's interfaces, set it to false. 391b1425cc09f8a29350520db0d4f489331df5a689bSreeram RamachandranWARN_UNUSED_RESULT int modifyVpnRules(unsigned netId, const char* interface, 392b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges, bool add, 393b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran bool modifyInterfaceBasedRules) { 3944043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran uint32_t table = getRouteTableForInterface(interface); 3954043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran if (!table) { 3964043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 3974043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran return -ESRCH; 3984043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran } 3994043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 400b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran uint16_t action = add ? RTM_NEWRULE : RTM_DELRULE; 401b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 4024043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran Fwmark fwmark; 4034043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran Fwmark mask; 4044043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 4054043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran fwmark.protectedFromVpn = false; 4064043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran mask.protectedFromVpn = true; 407b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 408b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran for (const std::pair<uid_t, uid_t>& range : uidRanges.getRanges()) { 409b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyPerNetworkRules(netId, interface, table, PERMISSION_NONE, range.first, 410b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran range.second, add, false)) { 411b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 412b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 413b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 414b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // A rule to route all traffic from a given set of UIDs to go over the VPN. 415b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // 416b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // Notice that this rule doesn't use the netId. I.e., no matter what netId the user's socket 417b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // may have, if they are subject to this VPN, their traffic has to go through it. Allows the 418b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // traffic to bypass the VPN if the protectedFromVpn bit is set. 419b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_SECURE_VPN, table, fwmark.intValue, 420b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, range.first, range.second)) { 421b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 422b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 4234043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran } 4244043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 425b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (modifyInterfaceBasedRules) { 426b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIncomingPacketMark(netId, interface, add)) { 427b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 428b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 4294043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 430b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // A rule to allow privileged apps to send traffic over this VPN even if they are not part 431b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // of the target set of UIDs. 432b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // 433b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // This is needed for DnsProxyListener to correctly resolve a request for a user who is in 434b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // the target set, but where the DnsProxyListener itself is not. 435b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran fwmark.protectedFromVpn = false; 436b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.protectedFromVpn = false; 4374043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 438b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran fwmark.netId = netId; 439b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 440b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 441b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran fwmark.permission = PERMISSION_CONNECTIVITY_INTERNAL; 442b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.permission = PERMISSION_CONNECTIVITY_INTERNAL; 443b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 444b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_SECURE_VPN, table, fwmark.intValue, 445b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, INVALID_UID, INVALID_UID)) { 446b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 447b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 448b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 4494043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 450b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return 0; 4514043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran} 4524043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 453f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int modifyDefaultNetworkRules(const char* interface, Permission permission, 454f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint16_t action) { 4559c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran uint32_t table = getRouteTableForInterface(interface); 4569c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran if (!table) { 457f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 45896f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return -ESRCH; 4599c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran } 4609c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 461122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark fwmark; 462122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark mask; 463f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 464f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran fwmark.netId = 0; 465122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 466f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 467f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran fwmark.permission = permission; 468122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.permission = permission; 4699c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 4704753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return modifyIpRule(action, RULE_PRIORITY_DEFAULT_NETWORK, table, fwmark.intValue, 471f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran mask.intValue, NULL, INVALID_UID, INVALID_UID); 4727619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 4737619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 474f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// Adds or removes an IPv4 or IPv6 route to the specified table and, if it's a directly-connected 475f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti// route, to the main table as well. 476f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti// Returns 0 on success or negative errno on failure. 477f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int modifyRoute(const char* interface, const char* destination, 478f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran const char* nexthop, uint16_t action, 479f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran RouteController::TableType tableType, uid_t /*uid*/) { 48038b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran uint32_t table = 0; 48138b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran switch (tableType) { 48238b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran case RouteController::INTERFACE: { 48338b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran table = getRouteTableForInterface(interface); 48438b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran break; 48538b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 48638b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran case RouteController::LEGACY: { 48738b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran // TODO: Use the UID to assign a unique table per UID instead of this fixed table. 48838b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran table = ROUTE_TABLE_LEGACY; 48938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran break; 49038b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 49138b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran case RouteController::PRIVILEGED_LEGACY: { 49238b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran // TODO: Use the UID to assign a unique table per UID instead of this fixed table. 49338b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran table = ROUTE_TABLE_PRIVILEGED_LEGACY; 49438b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran break; 49538b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 49638b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 4977619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran if (!table) { 498f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find table for interface %s and tableType %d", interface, tableType); 499f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return -ESRCH; 5009c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran } 5019c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 502f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti int ret = modifyIpRoute(action, table, interface, destination, nexthop); 5031077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran // We allow apps to call requestRouteToHost() multiple times with the same route, so ignore 5041077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran // EEXIST failures when adding routes to legacy tables. 5051077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran if (ret != 0 && !(action == RTM_NEWROUTE && ret == -EEXIST && 5061077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran (tableType == RouteController::LEGACY || 5071077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran tableType == RouteController::PRIVILEGED_LEGACY))) { 508f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return ret; 509c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran } 510c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran 511c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran // If there's no nexthop, this is a directly connected route. Add it to the main table also, to 512f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // let the kernel find it when validating nexthops when global routes are added. 513f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti if (!nexthop) { 514f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti ret = modifyIpRoute(action, RT_TABLE_MAIN, interface, destination, NULL); 515f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // A failure with action == ADD && errno == EEXIST means that the route already exists in 516f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // the main table, perhaps because the kernel added it automatically as part of adding the 517f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // IP address to the interface. Ignore this, but complain about everything else. 518f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (ret && !(action == RTM_NEWROUTE && ret == -EEXIST)) { 519f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return ret; 520f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti } 521c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran } 522c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran 523f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return 0; 5249c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran} 5259c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 526f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// Returns 0 on success or negative errno on failure. 527f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int flushRoutes(const char* interface) { 52892b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran uint32_t table = getRouteTableForInterface(interface); 52992b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran if (!table) { 530f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 531f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return -ESRCH; 53292b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran } 533a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen interfaceToIndex.erase(interface); 53492b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran 535357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti char tableString[UINT32_STRLEN]; 536357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti snprintf(tableString, sizeof(tableString), "%u", table); 537357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti 538f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran for (size_t i = 0; i < ARRAY_SIZE(IP_VERSIONS); ++i) { 539357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti const char* argv[] = { 540357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti IP_PATH, 541f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran IP_VERSIONS[i], 542357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti "route" 543357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti "flush", 544357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti "table", 545357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti tableString, 546357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti }; 547f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (android_fork_execvp(ARRAY_SIZE(argv), const_cast<char**>(argv), NULL, false, false)) { 548f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("failed to flush routes"); 549f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return -EREMOTEIO; 550357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti } 551357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti } 552357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti 553f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return 0; 55492b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran} 55592b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran 5565c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} // namespace 5575c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 558f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranint RouteController::Init() { 559f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran Fwmark fwmark; 560f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran Fwmark mask; 561f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 5628fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // Add a new rule to look up the 'main' table, with the same selectors as the "default network" 5638fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // rule, but with a lower priority. Since the default network rule points to a table with a 5648fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // default route, the rule we're adding will never be used for normal routing lookups. However, 5658fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // the kernel may fall-through to it to find directly-connected routes when it validates that a 5668fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // nexthop (in a route being added) is reachable. 567f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // 568f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // TODO: This isn't true if the default network requires non-zero permissions. In that case, an 569f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // app without those permissions may still be able to access directly-connected routes, since 570f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // it won't match the default network rule. Fix this by only allowing the root UID (as a proxy 571f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // for the kernel) to lookup this main table rule. 572122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran fwmark.netId = 0; 573122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 574f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_MAIN, RT_TABLE_MAIN, fwmark.intValue, 575f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran mask.intValue, NULL, INVALID_UID, INVALID_UID)) { 576f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 577f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 5788fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran 57938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran // Add rules to allow lookup of legacy routes. 58038b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran // 58138b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran // TODO: Remove these once the kernel supports UID-based routing. Instead, add them on demand 58238b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran // when routes are added. 58338b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran fwmark.netId = 0; 58438b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran mask.netId = 0; 58538b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 58638b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran fwmark.explicitlySelected = false; 58738b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran mask.explicitlySelected = true; 588f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LEGACY, ROUTE_TABLE_LEGACY, 589f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran fwmark.intValue, mask.intValue, NULL, INVALID_UID, INVALID_UID)) { 590f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 591f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 59238b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 59338b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran fwmark.permission = PERMISSION_CONNECTIVITY_INTERNAL; 59438b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran mask.permission = PERMISSION_CONNECTIVITY_INTERNAL; 59538b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 596f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_PRIVILEGED_LEGACY, 597f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ROUTE_TABLE_PRIVILEGED_LEGACY, fwmark.intValue, mask.intValue, NULL, 598f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran INVALID_UID, INVALID_UID)) { 599f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 600f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 60138b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 6028fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// TODO: Uncomment once we are sure everything works. 6038fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran#if 0 6048fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // Add a rule to preempt the pre-defined "from all lookup main" rule. This ensures that packets 6058fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // that are already marked with a specific NetId don't fall-through to the main table. 606f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_UNREACHABLE, 0, 0, 0, NULL, INVALID_UID, 607f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran INVALID_UID); 608f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#else 609f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return 0; 6108fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran#endif 6118fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran} 6128fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran 61396f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::addInterfaceToNetwork(unsigned netId, const char* interface, 61496f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti Permission permission) { 615b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyPerNetworkRules(netId, interface, 0, permission, INVALID_UID, INVALID_UID, true, 616b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran true); 6175c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 6185c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 61996f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::removeInterfaceFromNetwork(unsigned netId, const char* interface, 62096f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti Permission permission) { 621b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyPerNetworkRules(netId, interface, 0, permission, INVALID_UID, INVALID_UID, 622b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran false, true)) { 623f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 624f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 625f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return flushRoutes(interface); 626379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran} 627379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran 628b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::addInterfaceToVpn(unsigned netId, const char* interface, 629b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 630b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyVpnRules(netId, interface, uidRanges, true, true); 6314043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran} 6324043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 633b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::removeInterfaceFromVpn(unsigned netId, const char* interface, 634b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 635b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyVpnRules(netId, interface, uidRanges, false, true)) { 6364043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran return ret; 6374043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran } 6384043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran return flushRoutes(interface); 6394043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran} 6404043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 64196f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::modifyNetworkPermission(unsigned netId, const char* interface, 64296f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti Permission oldPermission, Permission newPermission) { 643379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran // Add the new rules before deleting the old ones, to avoid race conditions. 644b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyPerNetworkRules(netId, interface, 0, newPermission, INVALID_UID, 645b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran INVALID_UID, true, false)) { 646f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 647f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 648b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyPerNetworkRules(netId, interface, 0, oldPermission, INVALID_UID, INVALID_UID, 649b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran false, false); 650b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran} 651b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 652b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::addUsersToVpn(unsigned netId, const char* interface, 653b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 654b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyVpnRules(netId, interface, uidRanges, true, false); 655b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran} 656b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 657b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::removeUsersFromVpn(unsigned netId, const char* interface, 658b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 659b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyVpnRules(netId, interface, uidRanges, false, false); 6609c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran} 6619c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 66296f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::addToDefaultNetwork(const char* interface, Permission permission) { 6634753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return modifyDefaultNetworkRules(interface, permission, RTM_NEWRULE); 6649c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran} 6659c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 66696f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::removeFromDefaultNetwork(const char* interface, Permission permission) { 6674753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return modifyDefaultNetworkRules(interface, permission, RTM_DELRULE); 6685c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 6697619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 670f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranint RouteController::addRoute(const char* interface, const char* destination, const char* nexthop, 671f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran TableType tableType, uid_t uid) { 672ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return modifyRoute(interface, destination, nexthop, RTM_NEWROUTE, tableType, uid); 6737619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 6747619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 675f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colittiint RouteController::removeRoute(const char* interface, const char* destination, 676f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran const char* nexthop, TableType tableType, uid_t uid) { 677ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return modifyRoute(interface, destination, nexthop, RTM_DELROUTE, tableType, uid); 6787619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 679