RouteController.cpp revision eb27b7ec10faf47a93fbc2863092cc667b05e252
15c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran/* 25c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * Copyright (C) 2014 The Android Open Source Project 35c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * 45c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * Licensed under the Apache License, Version 2.0 (the "License"); 55c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * you may not use this file except in compliance with the License. 65c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * You may obtain a copy of the License at 75c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * 85c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * http://www.apache.org/licenses/LICENSE-2.0 95c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * 105c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * Unless required by applicable law or agreed to in writing, software 115c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * distributed under the License is distributed on an "AS IS" BASIS, 125c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 135c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * See the License for the specific language governing permissions and 145c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran * limitations under the License. 155c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran */ 165c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 175c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran#include "RouteController.h" 185c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 195c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran#include "Fwmark.h" 20b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran#include "UidRanges.h" 21f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 22f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#define LOG_TAG "Netd" 23f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#include "log/log.h" 24f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#include "logwrap/logwrap.h" 255c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 26ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti#include <arpa/inet.h> 274753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti#include <linux/fib_rules.h> 28a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen#include <map> 295c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran#include <net/if.h> 305c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 315c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandrannamespace { 325c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 33f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// BEGIN CONSTANTS -------------------------------------------------------------------------------- 34f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 35eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_VPN_OVERRIDES = 11000; 36eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_SECURE_VPN = 12000; 37eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_EXPLICIT_NETWORK = 13000; 38eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_OUTPUT_INTERFACE = 14000; 39eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_PRIVILEGED_LEGACY = 16000; 40eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_LEGACY = 17000; 41eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_IMPLICIT_NETWORK = 18000; 42eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_DEFAULT_NETWORK = 21000; 43eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_DIRECTLY_CONNECTED = 22000; 4456afacf838d24cf8e54d2cf0d8ab9182ab704125Sreeram Ramachandran// TODO: Uncomment once we are sure everything works. 4556afacf838d24cf8e54d2cf0d8ab9182ab704125Sreeram Ramachandran#if 0 46eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandranconst uint32_t RULE_PRIORITY_UNREACHABLE = 23000; 4756afacf838d24cf8e54d2cf0d8ab9182ab704125Sreeram Ramachandran#endif 485c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 495965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// TODO: These values aren't defined by the Linux kernel, because our UID routing changes are not 505965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// upstream (yet?), so we can't just pick them up from kernel headers. When (if?) the changes make 515965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// it upstream, we'll remove this and rely on the kernel header values. For now, add a static assert 525965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti// that will warn us if upstream has given these values some other meaning. 535965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitticonst uint16_t FRA_UID_START = 18; 545965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitticonst uint16_t FRA_UID_END = 19; 555965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colittistatic_assert(FRA_UID_START > FRA_MAX, 565965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti "Android-specific FRA_UID_{START,END} values also assigned in Linux uapi. " 575965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti "Check that these values match what the kernel does and then update this assertion."); 585965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti 5972723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitticonst uint16_t NETLINK_REQUEST_FLAGS = NLM_F_REQUEST | NLM_F_ACK; 6072723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitticonst uint16_t NETLINK_CREATE_REQUEST_FLAGS = NETLINK_REQUEST_FLAGS | NLM_F_CREATE | NLM_F_EXCL; 614753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 62f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconst sockaddr_nl NETLINK_ADDRESS = {AF_NETLINK, 0, 0, 0}; 63f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 64f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconst uint8_t AF_FAMILIES[] = {AF_INET, AF_INET6}; 65f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 66f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconst char* const IP_VERSIONS[] = {"-4", "-6"}; 67f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 68f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// Avoids "non-constant-expression cannot be narrowed from type 'unsigned int' to 'unsigned short'" 69f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// warnings when using RTA_LENGTH(x) inside static initializers (even when x is already uint16_t). 70f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranconstexpr uint16_t U16_RTA_LENGTH(uint16_t x) { 71f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return RTA_LENGTH(x); 72f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran} 73f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 74f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// These are practically const, but can't be declared so, because they are used to initialize 75f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// non-const pointers ("void* iov_base") in iovec arrays. 76f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_PRIORITY = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_PRIORITY }; 77f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_TABLE }; 78f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_FWMARK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMARK }; 79f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_FWMASK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMASK }; 80f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_UID_START = { U16_RTA_LENGTH(sizeof(uid_t)), FRA_UID_START }; 81f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr FRATTR_UID_END = { U16_RTA_LENGTH(sizeof(uid_t)), FRA_UID_END }; 82f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 83f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr RTATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_TABLE }; 84f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranrtattr RTATTR_OIF = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_OIF }; 85f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 86f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranuint8_t PADDING_BUFFER[RTA_ALIGNTO] = {0, 0, 0, 0}; 87f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 88f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// END CONSTANTS ---------------------------------------------------------------------------------- 89f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 90a561e121c724e9163b2e256e15eef660e3a326daPaul Jensenstd::map<std::string, uint32_t> interfaceToIndex; 91a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen 925c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandranuint32_t getRouteTableForInterface(const char* interface) { 93a48118062412f16ae712bfc8c8a539d3b6a85e47Sreeram Ramachandran uint32_t index = if_nametoindex(interface); 94a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen if (index) { 95a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen interfaceToIndex[interface] = index; 96a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen } else { 97a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen // If the interface goes away if_nametoindex() will return 0 but we still need to know 98a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen // the index so we can remove the rules and routes. 99a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen std::map<std::string, uint32_t>::iterator it = interfaceToIndex.find(interface); 100f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (it != interfaceToIndex.end()) { 101a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen index = it->second; 102f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 103a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen } 104a48118062412f16ae712bfc8c8a539d3b6a85e47Sreeram Ramachandran return index ? index + RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX : 0; 1055c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 1065c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 1074753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// Sends a netlink request and expects an ack. 1084753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// |iov| is an array of struct iovec that contains the netlink message payload. 1094753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// The netlink header is generated by this function based on |action| and |flags|. 1104753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti// Returns -errno if there was an error or if the kernel reported an error. 111f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int sendNetlinkRequest(uint16_t action, uint16_t flags, iovec* iov, int iovlen) { 1124753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsghdr nlmsg = { 1134753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti .nlmsg_type = action, 1144753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti .nlmsg_flags = flags, 1154753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti }; 1164753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti iov[0].iov_base = &nlmsg; 1174753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti iov[0].iov_len = sizeof(nlmsg); 1184753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti for (int i = 0; i < iovlen; ++i) { 1194753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsg.nlmsg_len += iov[i].iov_len; 1204753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1214753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1224753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti int ret; 1234753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti struct { 1244753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsghdr msg; 1254753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti nlmsgerr err; 1264753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } response; 1274753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1284753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti int sock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE); 1294753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (sock != -1 && 130f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran connect(sock, reinterpret_cast<const sockaddr*>(&NETLINK_ADDRESS), 131f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran sizeof(NETLINK_ADDRESS)) != -1 && 1324753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti writev(sock, iov, iovlen) != -1 && 1334753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti (ret = recv(sock, &response, sizeof(response), 0)) != -1) { 1344753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (ret == sizeof(response)) { 1354753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti ret = response.err.error; // Netlink errors are negative errno. 136f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (ret) { 137f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("netlink response contains error (%s)", strerror(-ret)); 138f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 1394753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } else { 1401201e84ebda52d8d82e5385644e9de0923e61aa3Sreeram Ramachandran ALOGE("bad netlink response message size (%d != %zu)", ret, sizeof(response)); 1414753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti ret = -EBADMSG; 1424753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1434753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } else { 144f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("netlink socket/connect/writev/recv failed (%s)", strerror(errno)); 1454753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti ret = -errno; 1464753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1474753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1484753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (sock != -1) { 1494753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti close(sock); 1504753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1514753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1524753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return ret; 1534753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti} 1544753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 1558fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// Adds or removes a routing rule for IPv4 and IPv6. 1568fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// 1578fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// + If |table| is non-zero, the rule points at the specified routing table. Otherwise, the rule 1588fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// returns ENETUNREACH. 1598fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// + If |mask| is non-zero, the rule matches the specified fwmark and mask. Otherwise, |fwmark| is 1608fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// ignored. 1618fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// + If |interface| is non-NULL, the rule matches the specified outgoing interface. 16296f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti// 16396f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti// Returns 0 on success or negative errno on failure. 164f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table, 165f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint32_t fwmark, uint32_t mask, const char* interface, 166f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uid_t uidStart, uid_t uidEnd) { 167f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // Ensure that if you set a bit in the fwmark, it's not being ignored by the mask. 168f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (fwmark & ~mask) { 169f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("mask 0x%x does not select all the bits set in fwmark 0x%x", mask, fwmark); 170f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return -ERANGE; 171f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 172f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 1734753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // The interface name must include exactly one terminating NULL and be properly padded, or older 1744753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // kernels will refuse to delete rules. 1754753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti uint16_t paddingLength = 0; 1764753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti size_t interfaceLength = 0; 1774753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti char oifname[IFNAMSIZ]; 1784753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (interface) { 1794753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti interfaceLength = strlcpy(oifname, interface, IFNAMSIZ) + 1; 1804753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti if (interfaceLength > IFNAMSIZ) { 181cf891383224e420d99996f7e63728a7cc902415eSreeram Ramachandran ALOGE("interface name too long (%zu > %u)", interfaceLength, IFNAMSIZ); 1824753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return -ENAMETOOLONG; 1834753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1844753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti paddingLength = RTA_SPACE(interfaceLength) - RTA_LENGTH(interfaceLength); 1854753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti } 1867619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 1875965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti // Either both start and end UID must be specified, or neither. 188f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if ((uidStart == INVALID_UID) != (uidEnd == INVALID_UID)) { 189cf891383224e420d99996f7e63728a7cc902415eSreeram Ramachandran ALOGE("incompatible start and end UIDs (%u vs %u)", uidStart, uidEnd); 1905965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti return -EUSERS; 1915965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti } 19272723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitti bool isUidRule = (uidStart != INVALID_UID); 1935965651602fb8373b75b6ae2d59c6a4d753f2f49Lorenzo Colitti 1944753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // Assemble a rule request and put it in an array of iovec structures. 1954753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti fib_rule_hdr rule = { 1964753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti .action = static_cast<uint8_t>(table ? FR_ACT_TO_TBL : FR_ACT_UNREACHABLE), 1974753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti }; 198a10ac3214f6a582b7fdb66acc43c702731e53d81Lorenzo Colitti 199f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtattr fraOifname = { U16_RTA_LENGTH(interfaceLength), FRA_OIFNAME }; 200a10ac3214f6a582b7fdb66acc43c702731e53d81Lorenzo Colitti 2014753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti iovec iov[] = { 202f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { NULL, 0 }, 203f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &rule, sizeof(rule) }, 204f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_PRIORITY, sizeof(FRATTR_PRIORITY) }, 205f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &priority, sizeof(priority) }, 206f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_TABLE, table ? sizeof(FRATTR_TABLE) : 0 }, 207f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &table, table ? sizeof(table) : 0 }, 208f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_FWMARK, mask ? sizeof(FRATTR_FWMARK) : 0 }, 209f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &fwmark, mask ? sizeof(fwmark) : 0 }, 210f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_FWMASK, mask ? sizeof(FRATTR_FWMASK) : 0 }, 211f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &mask, mask ? sizeof(mask) : 0 }, 212f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_UID_START, isUidRule ? sizeof(FRATTR_UID_START) : 0 }, 213f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &uidStart, isUidRule ? sizeof(uidStart) : 0 }, 214f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &FRATTR_UID_END, isUidRule ? sizeof(FRATTR_UID_END) : 0 }, 215f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &uidEnd, isUidRule ? sizeof(uidEnd) : 0 }, 216f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &fraOifname, interface ? sizeof(fraOifname) : 0 }, 217f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { oifname, interfaceLength }, 218f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { PADDING_BUFFER, paddingLength }, 2194753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti }; 2204753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 22172723683be57b6d562dc96cde30cc33cc96b3e82Lorenzo Colitti uint16_t flags = (action == RTM_NEWRULE) ? NETLINK_CREATE_REQUEST_FLAGS : NETLINK_REQUEST_FLAGS; 222f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran for (size_t i = 0; i < ARRAY_SIZE(AF_FAMILIES); ++i) { 223f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rule.family = AF_FAMILIES[i]; 224f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (int ret = sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov))) { 22596f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 2265c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 2275c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 2285c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 22996f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return 0; 2305c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 2315c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 232ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti// Adds or deletes an IPv4 or IPv6 route. 233ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti// Returns 0 on success or negative errno on failure. 234f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, 235f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran const char* destination, const char* nexthop) { 236ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // At least the destination must be non-null. 237ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (!destination) { 238f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("null destination"); 239ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -EFAULT; 240ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 241ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 242ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // Parse the prefix. 243ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti uint8_t rawAddress[sizeof(in6_addr)]; 244f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint8_t family; 245f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint8_t prefixLength; 246ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti int rawLength = parsePrefix(destination, &family, rawAddress, sizeof(rawAddress), 247ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti &prefixLength); 248ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (rawLength < 0) { 249f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("parsePrefix failed for destination %s (%s)", destination, strerror(-rawLength)); 250ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return rawLength; 251ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 2527619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 253ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (static_cast<size_t>(rawLength) > sizeof(rawAddress)) { 2541201e84ebda52d8d82e5385644e9de0923e61aa3Sreeram Ramachandran ALOGE("impossible! address too long (%d vs %zu)", rawLength, sizeof(rawAddress)); 255ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -ENOBUFS; // Cannot happen; parsePrefix only supports IPv4 and IPv6. 256ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 257ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 258ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // If an interface was specified, find the ifindex. 259ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti uint32_t ifindex; 260ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (interface) { 261ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti ifindex = if_nametoindex(interface); 262ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti if (!ifindex) { 263f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 264ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -ENODEV; 2657619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran } 2667619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran } 2677619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 268ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti // If a nexthop was specified, parse it as the same family as the prefix. 269ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti uint8_t rawNexthop[sizeof(in6_addr)]; 270f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (nexthop && inet_pton(family, nexthop, rawNexthop) <= 0) { 271f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("inet_pton failed for nexthop %s", nexthop); 272ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti return -EINVAL; 273ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti } 274ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 2754753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti // Assemble a rtmsg and put it in an array of iovec structures. 276f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtmsg route = { 277ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_protocol = RTPROT_STATIC, 278ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_type = RTN_UNICAST, 279ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_family = family, 280ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti .rtm_dst_len = prefixLength, 281ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti }; 2824753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti 283f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtattr rtaDst = { U16_RTA_LENGTH(rawLength), RTA_DST }; 284f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran rtattr rtaGateway = { U16_RTA_LENGTH(rawLength), RTA_GATEWAY }; 285ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 286ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti iovec iov[] = { 287f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { NULL, 0 }, 288f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &route, sizeof(route) }, 289f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &RTATTR_TABLE, sizeof(RTATTR_TABLE) }, 290f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &table, sizeof(table) }, 291f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &rtaDst, sizeof(rtaDst) }, 292f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { rawAddress, static_cast<size_t>(rawLength) }, 293f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &RTATTR_OIF, interface ? sizeof(RTATTR_OIF) : 0 }, 294f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &ifindex, interface ? sizeof(ifindex) : 0 }, 295f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { &rtaGateway, nexthop ? sizeof(rtaGateway) : 0 }, 296f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran { rawNexthop, nexthop ? static_cast<size_t>(rawLength) : 0 }, 297ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti }; 298ba25df989b48f36b784ad39307a49a4fd9c3fd66Lorenzo Colitti 299f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran uint16_t flags = (action == RTM_NEWROUTE) ? NETLINK_CREATE_REQUEST_FLAGS : 300f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran NETLINK_REQUEST_FLAGS; 3014753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti return sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov)); 3027619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 3037619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 304b1425cc09f8a29350520db0d4f489331df5a689bSreeram RamachandranWARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface, bool add) { 305b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // An iptables rule to mark incoming packets on a network with the netId of the network. 306b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // 307b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // This is so that the kernel can: 308b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // + Use the right fwmark for (and thus correctly route) replies (e.g.: TCP RST, ICMP errors, 309eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran // ping replies, SYN-ACKs, etc). 310b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // + Mark sockets that accept connections from this interface so that the connection stays on 311b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // the same interface. 312b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran char markString[UINT32_HEX_STRLEN]; 313b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran snprintf(markString, sizeof(markString), "0x%x", netId); 314b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (execIptables(V4V6, "-t", "mangle", add ? "-A" : "-D", "INPUT", "-i", interface, "-j", 315b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran "MARK", "--set-mark", markString, NULL)) { 316b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran ALOGE("failed to change iptables rule that sets incoming packet mark"); 317b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return -EREMOTEIO; 318b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 319b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return 0; 320b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran} 321b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 322eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran// A rule to let UID 0 (as a proxy for the kernel) access the routes on a given network. 323eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram RamachandranWARN_UNUSED_RESULT int modifyKernelAccessRule(uint16_t action, unsigned netId, uint32_t priority, 324eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran uint32_t table) { 325eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran Fwmark fwmark; 326eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran Fwmark mask; 327eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 328eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran fwmark.netId = netId; 329eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 330eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 331eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return modifyIpRule(action, priority, table, fwmark.intValue, mask.intValue, NULL, 0, 0); 332eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran} 333eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 334b1425cc09f8a29350520db0d4f489331df5a689bSreeram RamachandranWARN_UNUSED_RESULT int modifyPerNetworkRules(unsigned netId, const char* interface, uint32_t table, 335b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran Permission permission, uid_t uidStart, uid_t uidEnd, 336eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran bool add, bool modifyInterfaceBasedRules) { 3375c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran if (!table) { 338b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran table = getRouteTableForInterface(interface); 339b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (!table) { 340b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran ALOGE("cannot find interface %s", interface); 341b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return -ESRCH; 342b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 3435c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3445c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 3454753afd79e130d5f1c888f549c36b4da92dbe680Lorenzo Colitti uint16_t action = add ? RTM_NEWRULE : RTM_DELRULE; 3465c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 347122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark fwmark; 348122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark mask; 3495c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 3505c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // A rule to route traffic based on a chosen outgoing interface. 3515c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // 3525c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // Supports apps that use SO_BINDTODEVICE or IP_PKTINFO options and the kernel that already 3535c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // knows the outgoing interface (typically for link-local communications). 354f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran fwmark.permission = permission; 355f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran mask.permission = permission; 356eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_OUTPUT_INTERFACE, table, fwmark.intValue, 357b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, interface, uidStart, uidEnd)) { 35896f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 3595c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3605c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 3615c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // A rule to route traffic based on the chosen network. 3625c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // 3635c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // This is for sockets that have not explicitly requested a particular network, but have been 3645c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // bound to one when they called connect(). This ensures that sockets connected on a particular 3655c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran // network stay on that network even if the default network changes. 366122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran fwmark.netId = netId; 367122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 368eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_IMPLICIT_NETWORK, table, fwmark.intValue, 369b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, uidStart, uidEnd)) { 37096f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 371122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran } 372122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran 373122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // A rule to route traffic based on an explicitly chosen network. 374122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // 375122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // Supports apps that use the multinetwork APIs to restrict their traffic to a network. 376122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran // 377f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // Even though we check permissions at the time we set a netId into the fwmark of a socket, we 378f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // still need to check it again in the rules here, because a network's permissions may have been 379f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran // updated via modifyNetworkPermission(). 380122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran fwmark.explicitlySelected = true; 381122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.explicitlySelected = true; 382eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_EXPLICIT_NETWORK, table, fwmark.intValue, 383b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, uidStart, uidEnd)) { 38496f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return ret; 3855c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3865c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 387eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (permission != PERMISSION_NONE) { 388eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyKernelAccessRule(action, netId, RULE_PRIORITY_IMPLICIT_NETWORK, 389eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran table)) { 390eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return ret; 391eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran } 392eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran } 393eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 394eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (modifyInterfaceBasedRules) { 395b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIncomingPacketMark(netId, interface, add)) { 396b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 397379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran } 3985c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran } 3995c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 40096f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return 0; 4015c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 4025c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 403b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// Adds or removes rules for VPNs that affect UIDs in |uidRanges|. If |modifyInterfaceBasedRules| 404b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// is true, also modifies the rules that are based only on the |interface| and not on |uidRanges|. 405b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// When adding or removing an interface to the VPN, set it to true. When adding or removing UIDs 406b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran// without changing the VPN's interfaces, set it to false. 407b1425cc09f8a29350520db0d4f489331df5a689bSreeram RamachandranWARN_UNUSED_RESULT int modifyVpnRules(unsigned netId, const char* interface, 408b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges, bool add, 409b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran bool modifyInterfaceBasedRules) { 4104043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran uint32_t table = getRouteTableForInterface(interface); 4114043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran if (!table) { 4124043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 4134043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran return -ESRCH; 4144043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran } 4154043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 416b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran uint16_t action = add ? RTM_NEWRULE : RTM_DELRULE; 417b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 4184043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran Fwmark fwmark; 4194043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran Fwmark mask; 4204043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 4214043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran fwmark.protectedFromVpn = false; 4224043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran mask.protectedFromVpn = true; 423b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 424b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran for (const std::pair<uid_t, uid_t>& range : uidRanges.getRanges()) { 425b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyPerNetworkRules(netId, interface, table, PERMISSION_NONE, range.first, 426b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran range.second, add, false)) { 427b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 428b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 429b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 430b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // A rule to route all traffic from a given set of UIDs to go over the VPN. 431b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // 432b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // Notice that this rule doesn't use the netId. I.e., no matter what netId the user's socket 433b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // may have, if they are subject to this VPN, their traffic has to go through it. Allows the 434b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // traffic to bypass the VPN if the protectedFromVpn bit is set. 435b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_SECURE_VPN, table, fwmark.intValue, 436b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, range.first, range.second)) { 437b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 438b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 4394043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran } 4404043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 441b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (modifyInterfaceBasedRules) { 442eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyKernelAccessRule(action, netId, RULE_PRIORITY_IMPLICIT_NETWORK, 443eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran table)) { 444eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return ret; 445eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran } 446eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 447b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIncomingPacketMark(netId, interface, add)) { 448b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 449b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 4504043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 451b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // A rule to allow privileged apps to send traffic over this VPN even if they are not part 452b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // of the target set of UIDs. 453b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // 454b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // This is needed for DnsProxyListener to correctly resolve a request for a user who is in 455b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran // the target set, but where the DnsProxyListener itself is not. 456b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran fwmark.protectedFromVpn = false; 457b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.protectedFromVpn = false; 4584043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 459b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran fwmark.netId = netId; 460b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 461b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 462b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran fwmark.permission = PERMISSION_CONNECTIVITY_INTERNAL; 463b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.permission = PERMISSION_CONNECTIVITY_INTERNAL; 464b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 465b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_SECURE_VPN, table, fwmark.intValue, 466b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran mask.intValue, NULL, INVALID_UID, INVALID_UID)) { 467b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return ret; 468b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 469b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran } 4704043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 471b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return 0; 4724043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran} 4734043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 474eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram RamachandranWARN_UNUSED_RESULT int modifyDefaultNetworkRules(uint16_t action, const char* interface, 475eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran Permission permission) { 4769c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran uint32_t table = getRouteTableForInterface(interface); 4779c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran if (!table) { 478f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 47996f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti return -ESRCH; 4809c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran } 4819c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 482122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark fwmark; 483122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran Fwmark mask; 484f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 485f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran fwmark.netId = 0; 486122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.netId = FWMARK_NET_ID_MASK; 487f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran 488f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran fwmark.permission = permission; 489122f581eb16e06c70cbbc40bd40995775075151fSreeram Ramachandran mask.permission = permission; 4909c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 491eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyIpRule(action, RULE_PRIORITY_DEFAULT_NETWORK, table, fwmark.intValue, 492eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran mask.intValue, NULL, INVALID_UID, INVALID_UID)) { 493eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return ret; 494eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran } 495eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 496eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (permission != PERMISSION_NONE) { 497eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyKernelAccessRule(action, 0, RULE_PRIORITY_DEFAULT_NETWORK, table)) { 498eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return ret; 499eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran } 500eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran } 501eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 502eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return 0; 5037619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 5047619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 505f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// Adds or removes an IPv4 or IPv6 route to the specified table and, if it's a directly-connected 506f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti// route, to the main table as well. 507f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti// Returns 0 on success or negative errno on failure. 508eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram RamachandranWARN_UNUSED_RESULT int modifyRoute(uint16_t action, const char* interface, const char* destination, 509eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran const char* nexthop, RouteController::TableType tableType) { 51038b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran uint32_t table = 0; 51138b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran switch (tableType) { 51238b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran case RouteController::INTERFACE: { 51338b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran table = getRouteTableForInterface(interface); 51438b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran break; 51538b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 51638b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran case RouteController::LEGACY: { 517eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran table = RouteController::ROUTE_TABLE_LEGACY; 51838b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran break; 51938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 52038b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran case RouteController::PRIVILEGED_LEGACY: { 521eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran table = RouteController::ROUTE_TABLE_PRIVILEGED_LEGACY; 52238b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran break; 52338b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 52438b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran } 5257619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran if (!table) { 526f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find table for interface %s and tableType %d", interface, tableType); 527f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return -ESRCH; 5289c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran } 5299c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 530f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti int ret = modifyIpRoute(action, table, interface, destination, nexthop); 5311077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran // We allow apps to call requestRouteToHost() multiple times with the same route, so ignore 5321077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran // EEXIST failures when adding routes to legacy tables. 5331077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran if (ret != 0 && !(action == RTM_NEWROUTE && ret == -EEXIST && 5341077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran (tableType == RouteController::LEGACY || 5351077d298655efa7755925e788d49a73e9db10afcSreeram Ramachandran tableType == RouteController::PRIVILEGED_LEGACY))) { 536f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return ret; 537c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran } 538c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran 539c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran // If there's no nexthop, this is a directly connected route. Add it to the main table also, to 540f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // let the kernel find it when validating nexthops when global routes are added. 541f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti if (!nexthop) { 542f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti ret = modifyIpRoute(action, RT_TABLE_MAIN, interface, destination, NULL); 543f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // A failure with action == ADD && errno == EEXIST means that the route already exists in 544f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // the main table, perhaps because the kernel added it automatically as part of adding the 545f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti // IP address to the interface. Ignore this, but complain about everything else. 546f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (ret && !(action == RTM_NEWROUTE && ret == -EEXIST)) { 547f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return ret; 548f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti } 549c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran } 550c92133732378aae815120c39edd62a7b4eb773b3Sreeram Ramachandran 551f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colitti return 0; 5529c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran} 5539c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 554f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran// Returns 0 on success or negative errno on failure. 555f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram RamachandranWARN_UNUSED_RESULT int flushRoutes(const char* interface) { 55692b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran uint32_t table = getRouteTableForInterface(interface); 55792b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran if (!table) { 558f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("cannot find interface %s", interface); 559f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return -ESRCH; 56092b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran } 561a561e121c724e9163b2e256e15eef660e3a326daPaul Jensen interfaceToIndex.erase(interface); 56292b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran 563357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti char tableString[UINT32_STRLEN]; 564357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti snprintf(tableString, sizeof(tableString), "%u", table); 565357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti 566f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran for (size_t i = 0; i < ARRAY_SIZE(IP_VERSIONS); ++i) { 567357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti const char* argv[] = { 568357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti IP_PATH, 569f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran IP_VERSIONS[i], 570357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti "route" 571357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti "flush", 572357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti "table", 573357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti tableString, 574357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti }; 575f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran if (android_fork_execvp(ARRAY_SIZE(argv), const_cast<char**>(argv), NULL, false, false)) { 576f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran ALOGE("failed to flush routes"); 577f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return -EREMOTEIO; 578357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti } 579357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti } 580357e5629bb4c745296ab40340ec8679372337155Lorenzo Colitti 581f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return 0; 58292b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran} 58392b66c4990b4a0ab608aa9c31da946f36085203bSreeram Ramachandran 5845c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} // namespace 5855c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 586f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranint RouteController::Init() { 5878fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // Add a new rule to look up the 'main' table, with the same selectors as the "default network" 5888fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // rule, but with a lower priority. Since the default network rule points to a table with a 5898fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // default route, the rule we're adding will never be used for normal routing lookups. However, 5908fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // the kernel may fall-through to it to find directly-connected routes when it validates that a 5918fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran // nexthop (in a route being added) is reachable. 592eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyKernelAccessRule(RTM_NEWRULE, 0, RULE_PRIORITY_DIRECTLY_CONNECTED, 593eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran RT_TABLE_MAIN)) { 594f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 595f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 5968fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran 597eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran Fwmark fwmark; 598eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran Fwmark mask; 59938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 600eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran // Add rules to allow legacy routes to override the default network. 60138b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran fwmark.explicitlySelected = false; 60238b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran mask.explicitlySelected = true; 603eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 604eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_PRIVILEGED_LEGACY, 605eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran RouteController::ROUTE_TABLE_PRIVILEGED_LEGACY, fwmark.intValue, 606eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran mask.intValue, NULL, INVALID_UID, INVALID_UID)) { 607f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 608f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 60938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 610eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LEGACY, 611eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran RouteController::ROUTE_TABLE_LEGACY, fwmark.intValue, mask.intValue, 612eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran NULL, INVALID_UID, INVALID_UID)) { 613eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return ret; 614eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran } 615eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran 616eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran // Add a rule to allow legacy routes from privileged apps to override VPNs. 61738b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran fwmark.permission = PERMISSION_CONNECTIVITY_INTERNAL; 61838b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran mask.permission = PERMISSION_CONNECTIVITY_INTERNAL; 61938b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 620eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_VPN_OVERRIDES, 621eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran RouteController::ROUTE_TABLE_PRIVILEGED_LEGACY, fwmark.intValue, 622eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran mask.intValue, NULL, INVALID_UID, INVALID_UID)) { 623f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 624f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 62538b7af1f2cb9579895465fabc37865f5dadcac25Sreeram Ramachandran 6268fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran// TODO: Uncomment once we are sure everything works. 6278fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran#if 0 628eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran // Add a rule to preempt the pre-defined "from all lookup main" rule. Packets that reach this 629eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran // rule will be null-routed, and won't fall-through to the main table. 630f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_UNREACHABLE, 0, 0, 0, NULL, INVALID_UID, 631f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran INVALID_UID); 632f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran#else 633f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return 0; 6348fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran#endif 6358fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran} 6368fe9c8e0a2b1c5cd2a34720efaccc641d9ab8fb6Sreeram Ramachandran 63796f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::addInterfaceToNetwork(unsigned netId, const char* interface, 63896f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti Permission permission) { 639b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyPerNetworkRules(netId, interface, 0, permission, INVALID_UID, INVALID_UID, true, 640b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran true); 6415c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 6425c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran 64396f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::removeInterfaceFromNetwork(unsigned netId, const char* interface, 64496f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti Permission permission) { 645eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = flushRoutes(interface)) { 646f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 647f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 648eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return modifyPerNetworkRules(netId, interface, 0, permission, INVALID_UID, INVALID_UID, false, 649eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran true); 650379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran} 651379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran 652b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::addInterfaceToVpn(unsigned netId, const char* interface, 653b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 654b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyVpnRules(netId, interface, uidRanges, true, true); 6554043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran} 6564043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 657b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::removeInterfaceFromVpn(unsigned netId, const char* interface, 658b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 659eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran if (int ret = flushRoutes(interface)) { 6604043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran return ret; 6614043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran } 662eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return modifyVpnRules(netId, interface, uidRanges, false, true); 6634043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran} 6644043f01f8e25f24246efadc710ad7440aab75529Sreeram Ramachandran 66596f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::modifyNetworkPermission(unsigned netId, const char* interface, 66696f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colitti Permission oldPermission, Permission newPermission) { 667379bd33f7640e2c4bef902be0ed6cb96378c8c2eSreeram Ramachandran // Add the new rules before deleting the old ones, to avoid race conditions. 668b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran if (int ret = modifyPerNetworkRules(netId, interface, 0, newPermission, INVALID_UID, 669b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran INVALID_UID, true, false)) { 670f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran return ret; 671f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandran } 672b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyPerNetworkRules(netId, interface, 0, oldPermission, INVALID_UID, INVALID_UID, 673b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran false, false); 674b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran} 675b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 676b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::addUsersToVpn(unsigned netId, const char* interface, 677b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 678b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyVpnRules(netId, interface, uidRanges, true, false); 679b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran} 680b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran 681b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandranint RouteController::removeUsersFromVpn(unsigned netId, const char* interface, 682b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran const UidRanges& uidRanges) { 683b1425cc09f8a29350520db0d4f489331df5a689bSreeram Ramachandran return modifyVpnRules(netId, interface, uidRanges, false, false); 6849c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran} 6859c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 68696f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::addToDefaultNetwork(const char* interface, Permission permission) { 687eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return modifyDefaultNetworkRules(RTM_NEWRULE, interface, permission); 6889c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran} 6899c0d313de6a3157fadd3b52a9927c77216ca435eSreeram Ramachandran 69096f261e8b28048b8cb48f5a4e81822c73bb813f4Lorenzo Colittiint RouteController::removeFromDefaultNetwork(const char* interface, Permission permission) { 691eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return modifyDefaultNetworkRules(RTM_DELRULE, interface, permission); 6925c181bf8ca0c89bd9e3e6d8e40bac53d0ee7082fSreeram Ramachandran} 6937619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 694f4f6c8de3f091be4b91a5a9d7f14e8882ec6d502Sreeram Ramachandranint RouteController::addRoute(const char* interface, const char* destination, const char* nexthop, 695eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran TableType tableType) { 696eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return modifyRoute(RTM_NEWROUTE, interface, destination, nexthop, tableType); 6977619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 6987619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran 699f7fc8eccb0a6a4fbca4cafdf53f5c167c8f1d755Lorenzo Colittiint RouteController::removeRoute(const char* interface, const char* destination, 700eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran const char* nexthop, TableType tableType) { 701eb27b7ec10faf47a93fbc2863092cc667b05e252Sreeram Ramachandran return modifyRoute(RTM_DELROUTE, interface, destination, nexthop, tableType); 7027619e1bbebdfe643c35ee6be4ac054f5255f0706Sreeram Ramachandran} 703