1/* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#include "RouteController.h" 18 19#include <arpa/inet.h> 20#include <errno.h> 21#include <fcntl.h> 22#include <linux/fib_rules.h> 23#include <net/if.h> 24#include <sys/stat.h> 25 26#include <private/android_filesystem_config.h> 27 28#include <map> 29 30#include "DummyNetwork.h" 31#include "Fwmark.h" 32#include "NetdConstants.h" 33#include "NetlinkCommands.h" 34#include "UidRanges.h" 35 36#include "android-base/file.h" 37#include <android-base/stringprintf.h> 38#define LOG_TAG "Netd" 39#include "log/log.h" 40#include "logwrap/logwrap.h" 41#include "netutils/ifc.h" 42#include "resolv_netid.h" 43 44using android::base::StringPrintf; 45using android::base::WriteStringToFile; 46using android::net::UidRange; 47 48namespace android { 49namespace net { 50 51auto RouteController::iptablesRestoreCommandFunction = execIptablesRestoreCommand; 52 53// BEGIN CONSTANTS -------------------------------------------------------------------------------- 54 55const uint32_t RULE_PRIORITY_VPN_OVERRIDE_SYSTEM = 10000; 56const uint32_t RULE_PRIORITY_VPN_OVERRIDE_OIF = 10500; 57const uint32_t RULE_PRIORITY_VPN_OUTPUT_TO_LOCAL = 11000; 58const uint32_t RULE_PRIORITY_SECURE_VPN = 12000; 59const uint32_t RULE_PRIORITY_PROHIBIT_NON_VPN = 12500; 60const uint32_t RULE_PRIORITY_EXPLICIT_NETWORK = 13000; 61const uint32_t RULE_PRIORITY_OUTPUT_INTERFACE = 14000; 62const uint32_t RULE_PRIORITY_LEGACY_SYSTEM = 15000; 63const uint32_t RULE_PRIORITY_LEGACY_NETWORK = 16000; 64const uint32_t RULE_PRIORITY_LOCAL_NETWORK = 17000; 65const uint32_t RULE_PRIORITY_TETHERING = 18000; 66const uint32_t RULE_PRIORITY_IMPLICIT_NETWORK = 19000; 67const uint32_t RULE_PRIORITY_BYPASSABLE_VPN = 20000; 68const uint32_t RULE_PRIORITY_VPN_FALLTHROUGH = 21000; 69const uint32_t RULE_PRIORITY_DEFAULT_NETWORK = 22000; 70const uint32_t RULE_PRIORITY_DIRECTLY_CONNECTED = 23000; 71const uint32_t RULE_PRIORITY_UNREACHABLE = 32000; 72 73const uint32_t ROUTE_TABLE_LOCAL_NETWORK = 97; 74const uint32_t ROUTE_TABLE_LEGACY_NETWORK = 98; 75const uint32_t ROUTE_TABLE_LEGACY_SYSTEM = 99; 76 77const char* const ROUTE_TABLE_NAME_LOCAL_NETWORK = "local_network"; 78const char* const ROUTE_TABLE_NAME_LEGACY_NETWORK = "legacy_network"; 79const char* const ROUTE_TABLE_NAME_LEGACY_SYSTEM = "legacy_system"; 80 81const char* const ROUTE_TABLE_NAME_LOCAL = "local"; 82const char* const ROUTE_TABLE_NAME_MAIN = "main"; 83 84// None of our routes specify priority, which causes them to have the default 85// priority. For throw routes, we use a fixed priority of 100000. This is 86// because we use throw routes either for maximum-length routes (/32 for IPv4, 87// /128 for IPv6), which we never create with any other priority, or for 88// purposely-low-priority default routes that should never match if there is 89// any other route in the table. 90uint32_t PRIO_THROW = 100000; 91 92const char* const RouteController::LOCAL_MANGLE_INPUT = "routectrl_mangle_INPUT"; 93 94// These values are upstream, but not yet in our headers. 95// TODO: delete these definitions when updating the headers. 96const uint16_t FRA_UID_RANGE = 20; 97struct fib_rule_uid_range { 98 __u32 start; 99 __u32 end; 100}; 101 102const uint8_t AF_FAMILIES[] = {AF_INET, AF_INET6}; 103 104const uid_t UID_ROOT = 0; 105const char* const IIF_LOOPBACK = "lo"; 106const char* const IIF_NONE = NULL; 107const char* const OIF_NONE = NULL; 108const bool ACTION_ADD = true; 109const bool ACTION_DEL = false; 110const bool MODIFY_NON_UID_BASED_RULES = true; 111 112const char* const RT_TABLES_PATH = "/data/misc/net/rt_tables"; 113const mode_t RT_TABLES_MODE = S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH; // mode 0644, rw-r--r-- 114 115// Avoids "non-constant-expression cannot be narrowed from type 'unsigned int' to 'unsigned short'" 116// warnings when using RTA_LENGTH(x) inside static initializers (even when x is already uint16_t). 117constexpr uint16_t U16_RTA_LENGTH(uint16_t x) { 118 return RTA_LENGTH(x); 119} 120 121// These are practically const, but can't be declared so, because they are used to initialize 122// non-const pointers ("void* iov_base") in iovec arrays. 123rtattr FRATTR_PRIORITY = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_PRIORITY }; 124rtattr FRATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_TABLE }; 125rtattr FRATTR_FWMARK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMARK }; 126rtattr FRATTR_FWMASK = { U16_RTA_LENGTH(sizeof(uint32_t)), FRA_FWMASK }; 127rtattr FRATTR_UID_RANGE = { U16_RTA_LENGTH(sizeof(fib_rule_uid_range)), FRA_UID_RANGE }; 128 129rtattr RTATTR_TABLE = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_TABLE }; 130rtattr RTATTR_OIF = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_OIF }; 131rtattr RTATTR_PRIO = { U16_RTA_LENGTH(sizeof(uint32_t)), RTA_PRIORITY }; 132 133uint8_t PADDING_BUFFER[RTA_ALIGNTO] = {0, 0, 0, 0}; 134 135// END CONSTANTS ---------------------------------------------------------------------------------- 136 137const char *actionName(uint16_t action) { 138 static const char *ops[4] = {"adding", "deleting", "getting", "???"}; 139 return ops[action % 4]; 140} 141 142const char *familyName(uint8_t family) { 143 switch (family) { 144 case AF_INET: return "IPv4"; 145 case AF_INET6: return "IPv6"; 146 default: return "???"; 147 } 148} 149 150// No locks needed because RouteController is accessed only from one thread (in CommandListener). 151std::map<std::string, uint32_t> interfaceToTable; 152 153uint32_t getRouteTableForInterface(const char* interface) { 154 uint32_t index = if_nametoindex(interface); 155 if (index) { 156 index += RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX; 157 interfaceToTable[interface] = index; 158 return index; 159 } 160 // If the interface goes away if_nametoindex() will return 0 but we still need to know 161 // the index so we can remove the rules and routes. 162 auto iter = interfaceToTable.find(interface); 163 if (iter == interfaceToTable.end()) { 164 ALOGE("cannot find interface %s", interface); 165 return RT_TABLE_UNSPEC; 166 } 167 return iter->second; 168} 169 170void addTableName(uint32_t table, const std::string& name, std::string* contents) { 171 char tableString[UINT32_STRLEN]; 172 snprintf(tableString, sizeof(tableString), "%u", table); 173 *contents += tableString; 174 *contents += " "; 175 *contents += name; 176 *contents += "\n"; 177} 178 179// Doesn't return success/failure as the file is optional; it's okay if we fail to update it. 180void updateTableNamesFile() { 181 std::string contents; 182 183 addTableName(RT_TABLE_LOCAL, ROUTE_TABLE_NAME_LOCAL, &contents); 184 addTableName(RT_TABLE_MAIN, ROUTE_TABLE_NAME_MAIN, &contents); 185 186 addTableName(ROUTE_TABLE_LOCAL_NETWORK, ROUTE_TABLE_NAME_LOCAL_NETWORK, &contents); 187 addTableName(ROUTE_TABLE_LEGACY_NETWORK, ROUTE_TABLE_NAME_LEGACY_NETWORK, &contents); 188 addTableName(ROUTE_TABLE_LEGACY_SYSTEM, ROUTE_TABLE_NAME_LEGACY_SYSTEM, &contents); 189 190 for (const auto& entry : interfaceToTable) { 191 addTableName(entry.second, entry.first, &contents); 192 } 193 194 if (!WriteStringToFile(contents, RT_TABLES_PATH, RT_TABLES_MODE, AID_SYSTEM, AID_WIFI)) { 195 ALOGE("failed to write to %s (%s)", RT_TABLES_PATH, strerror(errno)); 196 return; 197 } 198} 199 200// Returns 0 on success or negative errno on failure. 201int padInterfaceName(const char* input, char* name, size_t* length, uint16_t* padding) { 202 if (!input) { 203 *length = 0; 204 *padding = 0; 205 return 0; 206 } 207 *length = strlcpy(name, input, IFNAMSIZ) + 1; 208 if (*length > IFNAMSIZ) { 209 ALOGE("interface name too long (%zu > %u)", *length, IFNAMSIZ); 210 return -ENAMETOOLONG; 211 } 212 *padding = RTA_SPACE(*length) - RTA_LENGTH(*length); 213 return 0; 214} 215 216// Adds or removes a routing rule for IPv4 and IPv6. 217// 218// + If |table| is non-zero, the rule points at the specified routing table. Otherwise, the table is 219// unspecified. An unspecified table is not allowed when creating an FR_ACT_TO_TBL rule. 220// + If |mask| is non-zero, the rule matches the specified fwmark and mask. Otherwise, |fwmark| is 221// ignored. 222// + If |iif| is non-NULL, the rule matches the specified incoming interface. 223// + If |oif| is non-NULL, the rule matches the specified outgoing interface. 224// + If |uidStart| and |uidEnd| are not INVALID_UID, the rule matches packets from UIDs in that 225// range (inclusive). Otherwise, the rule matches packets from all UIDs. 226// 227// Returns 0 on success or negative errno on failure. 228WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint8_t ruleType, 229 uint32_t table, uint32_t fwmark, uint32_t mask, const char* iif, 230 const char* oif, uid_t uidStart, uid_t uidEnd) { 231 // Ensure that if you set a bit in the fwmark, it's not being ignored by the mask. 232 if (fwmark & ~mask) { 233 ALOGE("mask 0x%x does not select all the bits set in fwmark 0x%x", mask, fwmark); 234 return -ERANGE; 235 } 236 237 // Interface names must include exactly one terminating NULL and be properly padded, or older 238 // kernels will refuse to delete rules. 239 char iifName[IFNAMSIZ], oifName[IFNAMSIZ]; 240 size_t iifLength, oifLength; 241 uint16_t iifPadding, oifPadding; 242 if (int ret = padInterfaceName(iif, iifName, &iifLength, &iifPadding)) { 243 return ret; 244 } 245 if (int ret = padInterfaceName(oif, oifName, &oifLength, &oifPadding)) { 246 return ret; 247 } 248 249 // Either both start and end UID must be specified, or neither. 250 if ((uidStart == INVALID_UID) != (uidEnd == INVALID_UID)) { 251 ALOGE("incompatible start and end UIDs (%u vs %u)", uidStart, uidEnd); 252 return -EUSERS; 253 } 254 255 bool isUidRule = (uidStart != INVALID_UID); 256 257 // Assemble a rule request and put it in an array of iovec structures. 258 fib_rule_hdr rule = { 259 .action = ruleType, 260 // Note that here we're implicitly setting rule.table to 0. When we want to specify a 261 // non-zero table, we do this via the FRATTR_TABLE attribute. 262 }; 263 264 // Don't ever create a rule that looks up table 0, because table 0 is the local table. 265 // It's OK to specify a table ID of 0 when deleting a rule, because that doesn't actually select 266 // table 0, it's a wildcard that matches anything. 267 if (table == RT_TABLE_UNSPEC && rule.action == FR_ACT_TO_TBL && action != RTM_DELRULE) { 268 ALOGE("RT_TABLE_UNSPEC only allowed when deleting rules"); 269 return -ENOTUNIQ; 270 } 271 272 rtattr fraIifName = { U16_RTA_LENGTH(iifLength), FRA_IIFNAME }; 273 rtattr fraOifName = { U16_RTA_LENGTH(oifLength), FRA_OIFNAME }; 274 struct fib_rule_uid_range uidRange = { uidStart, uidEnd }; 275 276 iovec iov[] = { 277 { NULL, 0 }, 278 { &rule, sizeof(rule) }, 279 { &FRATTR_PRIORITY, sizeof(FRATTR_PRIORITY) }, 280 { &priority, sizeof(priority) }, 281 { &FRATTR_TABLE, table != RT_TABLE_UNSPEC ? sizeof(FRATTR_TABLE) : 0 }, 282 { &table, table != RT_TABLE_UNSPEC ? sizeof(table) : 0 }, 283 { &FRATTR_FWMARK, mask ? sizeof(FRATTR_FWMARK) : 0 }, 284 { &fwmark, mask ? sizeof(fwmark) : 0 }, 285 { &FRATTR_FWMASK, mask ? sizeof(FRATTR_FWMASK) : 0 }, 286 { &mask, mask ? sizeof(mask) : 0 }, 287 { &FRATTR_UID_RANGE, isUidRule ? sizeof(FRATTR_UID_RANGE) : 0 }, 288 { &uidRange, isUidRule ? sizeof(uidRange) : 0 }, 289 { &fraIifName, iif != IIF_NONE ? sizeof(fraIifName) : 0 }, 290 { iifName, iifLength }, 291 { PADDING_BUFFER, iifPadding }, 292 { &fraOifName, oif != OIF_NONE ? sizeof(fraOifName) : 0 }, 293 { oifName, oifLength }, 294 { PADDING_BUFFER, oifPadding }, 295 }; 296 297 uint16_t flags = (action == RTM_NEWRULE) ? NETLINK_CREATE_REQUEST_FLAGS : NETLINK_REQUEST_FLAGS; 298 for (size_t i = 0; i < ARRAY_SIZE(AF_FAMILIES); ++i) { 299 rule.family = AF_FAMILIES[i]; 300 if (int ret = sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov), nullptr)) { 301 if (!(action == RTM_DELRULE && ret == -ENOENT && priority == RULE_PRIORITY_TETHERING)) { 302 // Don't log when deleting a tethering rule that's not there. This matches the 303 // behaviour of clearTetheringRules, which ignores ENOENT in this case. 304 ALOGE("Error %s %s rule: %s", actionName(action), familyName(rule.family), 305 strerror(-ret)); 306 } 307 return ret; 308 } 309 } 310 311 return 0; 312} 313 314WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table, 315 uint32_t fwmark, uint32_t mask, const char* iif, 316 const char* oif, uid_t uidStart, uid_t uidEnd) { 317 return modifyIpRule(action, priority, FR_ACT_TO_TBL, table, fwmark, mask, iif, oif, uidStart, 318 uidEnd); 319} 320 321WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table, 322 uint32_t fwmark, uint32_t mask) { 323 return modifyIpRule(action, priority, table, fwmark, mask, IIF_NONE, OIF_NONE, INVALID_UID, 324 INVALID_UID); 325} 326 327// Adds or deletes an IPv4 or IPv6 route. 328// Returns 0 on success or negative errno on failure. 329WARN_UNUSED_RESULT int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, 330 const char* destination, const char* nexthop) { 331 // At least the destination must be non-null. 332 if (!destination) { 333 ALOGE("null destination"); 334 return -EFAULT; 335 } 336 337 // Parse the prefix. 338 uint8_t rawAddress[sizeof(in6_addr)]; 339 uint8_t family; 340 uint8_t prefixLength; 341 int rawLength = parsePrefix(destination, &family, rawAddress, sizeof(rawAddress), 342 &prefixLength); 343 if (rawLength < 0) { 344 ALOGE("parsePrefix failed for destination %s (%s)", destination, strerror(-rawLength)); 345 return rawLength; 346 } 347 348 if (static_cast<size_t>(rawLength) > sizeof(rawAddress)) { 349 ALOGE("impossible! address too long (%d vs %zu)", rawLength, sizeof(rawAddress)); 350 return -ENOBUFS; // Cannot happen; parsePrefix only supports IPv4 and IPv6. 351 } 352 353 uint8_t type = RTN_UNICAST; 354 uint32_t ifindex; 355 uint8_t rawNexthop[sizeof(in6_addr)]; 356 357 if (nexthop && !strcmp(nexthop, "unreachable")) { 358 type = RTN_UNREACHABLE; 359 // 'interface' is likely non-NULL, as the caller (modifyRoute()) likely used it to lookup 360 // the table number. But it's an error to specify an interface ("dev ...") or a nexthop for 361 // unreachable routes, so nuke them. (IPv6 allows them to be specified; IPv4 doesn't.) 362 interface = OIF_NONE; 363 nexthop = NULL; 364 } else if (nexthop && !strcmp(nexthop, "throw")) { 365 type = RTN_THROW; 366 interface = OIF_NONE; 367 nexthop = NULL; 368 } else { 369 // If an interface was specified, find the ifindex. 370 if (interface != OIF_NONE) { 371 ifindex = if_nametoindex(interface); 372 if (!ifindex) { 373 ALOGE("cannot find interface %s", interface); 374 return -ENODEV; 375 } 376 } 377 378 // If a nexthop was specified, parse it as the same family as the prefix. 379 if (nexthop && inet_pton(family, nexthop, rawNexthop) <= 0) { 380 ALOGE("inet_pton failed for nexthop %s", nexthop); 381 return -EINVAL; 382 } 383 } 384 385 bool isDefaultThrowRoute = (type == RTN_THROW && prefixLength == 0); 386 387 // Assemble a rtmsg and put it in an array of iovec structures. 388 rtmsg route = { 389 .rtm_protocol = RTPROT_STATIC, 390 .rtm_type = type, 391 .rtm_family = family, 392 .rtm_dst_len = prefixLength, 393 .rtm_scope = static_cast<uint8_t>(nexthop ? RT_SCOPE_UNIVERSE : RT_SCOPE_LINK), 394 }; 395 396 rtattr rtaDst = { U16_RTA_LENGTH(rawLength), RTA_DST }; 397 rtattr rtaGateway = { U16_RTA_LENGTH(rawLength), RTA_GATEWAY }; 398 399 iovec iov[] = { 400 { NULL, 0 }, 401 { &route, sizeof(route) }, 402 { &RTATTR_TABLE, sizeof(RTATTR_TABLE) }, 403 { &table, sizeof(table) }, 404 { &rtaDst, sizeof(rtaDst) }, 405 { rawAddress, static_cast<size_t>(rawLength) }, 406 { &RTATTR_OIF, interface != OIF_NONE ? sizeof(RTATTR_OIF) : 0 }, 407 { &ifindex, interface != OIF_NONE ? sizeof(ifindex) : 0 }, 408 { &rtaGateway, nexthop ? sizeof(rtaGateway) : 0 }, 409 { rawNexthop, nexthop ? static_cast<size_t>(rawLength) : 0 }, 410 { &RTATTR_PRIO, isDefaultThrowRoute ? sizeof(RTATTR_PRIO) : 0 }, 411 { &PRIO_THROW, isDefaultThrowRoute ? sizeof(PRIO_THROW) : 0 }, 412 }; 413 414 uint16_t flags = (action == RTM_NEWROUTE) ? NETLINK_CREATE_REQUEST_FLAGS : 415 NETLINK_REQUEST_FLAGS; 416 int ret = sendNetlinkRequest(action, flags, iov, ARRAY_SIZE(iov), nullptr); 417 if (ret) { 418 ALOGE("Error %s route %s -> %s %s to table %u: %s", 419 actionName(action), destination, nexthop, interface, table, strerror(-ret)); 420 } 421 return ret; 422} 423 424// An iptables rule to mark incoming packets on a network with the netId of the network. 425// 426// This is so that the kernel can: 427// + Use the right fwmark for (and thus correctly route) replies (e.g.: TCP RST, ICMP errors, ping 428// replies, SYN-ACKs, etc). 429// + Mark sockets that accept connections from this interface so that the connection stays on the 430// same interface. 431WARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface, 432 Permission permission, bool add) { 433 Fwmark fwmark; 434 435 fwmark.netId = netId; 436 fwmark.explicitlySelected = true; 437 fwmark.protectedFromVpn = true; 438 fwmark.permission = permission; 439 440 std::string cmd = StringPrintf("%s %s -i %s -j MARK --set-mark 0x%x", 441 add ? "-A" : "-D", RouteController::LOCAL_MANGLE_INPUT, 442 interface, fwmark.intValue); 443 if (RouteController::iptablesRestoreCommandFunction(V4V6, "mangle", cmd, nullptr) != 0) { 444 ALOGE("failed to change iptables rule that sets incoming packet mark"); 445 return -EREMOTEIO; 446 } 447 448 return 0; 449} 450 451// A rule to route responses to the local network forwarded via the VPN. 452// 453// When a VPN is in effect, packets from the local network to upstream networks are forwarded into 454// the VPN's tunnel interface. When the VPN forwards the responses, they emerge out of the tunnel. 455WARN_UNUSED_RESULT int modifyVpnOutputToLocalRule(const char* vpnInterface, bool add) { 456 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_VPN_OUTPUT_TO_LOCAL, 457 ROUTE_TABLE_LOCAL_NETWORK, MARK_UNSET, MARK_UNSET, vpnInterface, OIF_NONE, 458 INVALID_UID, INVALID_UID); 459} 460 461// A rule to route all traffic from a given set of UIDs to go over the VPN. 462// 463// Notice that this rule doesn't use the netId. I.e., no matter what netId the user's socket may 464// have, if they are subject to this VPN, their traffic has to go through it. Allows the traffic to 465// bypass the VPN if the protectedFromVpn bit is set. 466WARN_UNUSED_RESULT int modifyVpnUidRangeRule(uint32_t table, uid_t uidStart, uid_t uidEnd, 467 bool secure, bool add) { 468 Fwmark fwmark; 469 Fwmark mask; 470 471 fwmark.protectedFromVpn = false; 472 mask.protectedFromVpn = true; 473 474 uint32_t priority; 475 476 if (secure) { 477 priority = RULE_PRIORITY_SECURE_VPN; 478 } else { 479 priority = RULE_PRIORITY_BYPASSABLE_VPN; 480 481 fwmark.explicitlySelected = false; 482 mask.explicitlySelected = true; 483 } 484 485 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, priority, table, fwmark.intValue, 486 mask.intValue, IIF_LOOPBACK, OIF_NONE, uidStart, uidEnd); 487} 488 489// A rule to allow system apps to send traffic over this VPN even if they are not part of the target 490// set of UIDs. 491// 492// This is needed for DnsProxyListener to correctly resolve a request for a user who is in the 493// target set, but where the DnsProxyListener itself is not. 494WARN_UNUSED_RESULT int modifyVpnSystemPermissionRule(unsigned netId, uint32_t table, bool secure, 495 bool add) { 496 Fwmark fwmark; 497 Fwmark mask; 498 499 fwmark.netId = netId; 500 mask.netId = FWMARK_NET_ID_MASK; 501 502 fwmark.permission = PERMISSION_SYSTEM; 503 mask.permission = PERMISSION_SYSTEM; 504 505 uint32_t priority = secure ? RULE_PRIORITY_SECURE_VPN : RULE_PRIORITY_BYPASSABLE_VPN; 506 507 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, priority, table, fwmark.intValue, 508 mask.intValue); 509} 510 511// A rule to route traffic based on an explicitly chosen network. 512// 513// Supports apps that use the multinetwork APIs to restrict their traffic to a network. 514// 515// Even though we check permissions at the time we set a netId into the fwmark of a socket, we need 516// to check it again in the rules here, because a network's permissions may have been updated via 517// modifyNetworkPermission(). 518WARN_UNUSED_RESULT int modifyExplicitNetworkRule(unsigned netId, uint32_t table, 519 Permission permission, uid_t uidStart, 520 uid_t uidEnd, bool add) { 521 Fwmark fwmark; 522 Fwmark mask; 523 524 fwmark.netId = netId; 525 mask.netId = FWMARK_NET_ID_MASK; 526 527 fwmark.explicitlySelected = true; 528 mask.explicitlySelected = true; 529 530 fwmark.permission = permission; 531 mask.permission = permission; 532 533 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_EXPLICIT_NETWORK, table, 534 fwmark.intValue, mask.intValue, IIF_NONE, OIF_NONE, uidStart, uidEnd); 535} 536 537// A rule to route traffic based on a chosen outgoing interface. 538// 539// Supports apps that use SO_BINDTODEVICE or IP_PKTINFO options and the kernel that already knows 540// the outgoing interface (typically for link-local communications). 541WARN_UNUSED_RESULT int modifyOutputInterfaceRules(const char* interface, uint32_t table, 542 Permission permission, uid_t uidStart, 543 uid_t uidEnd, bool add) { 544 Fwmark fwmark; 545 Fwmark mask; 546 547 fwmark.permission = permission; 548 mask.permission = permission; 549 550 // If this rule does not specify a UID range, then also add a corresponding high-priority rule 551 // for UID. This covers forwarded packets and system daemons such as the tethering DHCP server. 552 if (uidStart == INVALID_UID && uidEnd == INVALID_UID) { 553 if (int ret = modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_VPN_OVERRIDE_OIF, 554 table, fwmark.intValue, mask.intValue, IIF_NONE, interface, 555 UID_ROOT, UID_ROOT)) { 556 return ret; 557 } 558 } 559 560 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_OUTPUT_INTERFACE, table, 561 fwmark.intValue, mask.intValue, IIF_NONE, interface, uidStart, uidEnd); 562} 563 564// A rule to route traffic based on the chosen network. 565// 566// This is for sockets that have not explicitly requested a particular network, but have been 567// bound to one when they called connect(). This ensures that sockets connected on a particular 568// network stay on that network even if the default network changes. 569WARN_UNUSED_RESULT int modifyImplicitNetworkRule(unsigned netId, uint32_t table, bool add) { 570 Fwmark fwmark; 571 Fwmark mask; 572 573 fwmark.netId = netId; 574 mask.netId = FWMARK_NET_ID_MASK; 575 576 fwmark.explicitlySelected = false; 577 mask.explicitlySelected = true; 578 579 fwmark.permission = PERMISSION_NONE; 580 mask.permission = PERMISSION_NONE; 581 582 return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_IMPLICIT_NETWORK, table, 583 fwmark.intValue, mask.intValue); 584} 585 586// A rule to enable split tunnel VPNs. 587// 588// If a packet with a VPN's netId doesn't find a route in the VPN's routing table, it's allowed to 589// go over the default network, provided it wasn't explicitly restricted to the VPN and has the 590// permissions required by the default network. 591WARN_UNUSED_RESULT int modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId, 592 const char* physicalInterface, 593 Permission permission) { 594 uint32_t table = getRouteTableForInterface(physicalInterface); 595 if (table == RT_TABLE_UNSPEC) { 596 return -ESRCH; 597 } 598 599 Fwmark fwmark; 600 Fwmark mask; 601 602 fwmark.netId = vpnNetId; 603 mask.netId = FWMARK_NET_ID_MASK; 604 605 fwmark.explicitlySelected = false; 606 mask.explicitlySelected = true; 607 608 fwmark.permission = permission; 609 mask.permission = permission; 610 611 return modifyIpRule(action, RULE_PRIORITY_VPN_FALLTHROUGH, table, fwmark.intValue, 612 mask.intValue); 613} 614 615// Add rules to allow legacy routes added through the requestRouteToHost() API. 616WARN_UNUSED_RESULT int addLegacyRouteRules() { 617 Fwmark fwmark; 618 Fwmark mask; 619 620 fwmark.explicitlySelected = false; 621 mask.explicitlySelected = true; 622 623 // Rules to allow legacy routes to override the default network. 624 if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LEGACY_SYSTEM, ROUTE_TABLE_LEGACY_SYSTEM, 625 fwmark.intValue, mask.intValue)) { 626 return ret; 627 } 628 if (int ret = modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LEGACY_NETWORK, 629 ROUTE_TABLE_LEGACY_NETWORK, fwmark.intValue, mask.intValue)) { 630 return ret; 631 } 632 633 fwmark.permission = PERMISSION_SYSTEM; 634 mask.permission = PERMISSION_SYSTEM; 635 636 // A rule to allow legacy routes from system apps to override VPNs. 637 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_VPN_OVERRIDE_SYSTEM, ROUTE_TABLE_LEGACY_SYSTEM, 638 fwmark.intValue, mask.intValue); 639} 640 641// Add rules to lookup the local network when specified explicitly or otherwise. 642WARN_UNUSED_RESULT int addLocalNetworkRules(unsigned localNetId) { 643 if (int ret = modifyExplicitNetworkRule(localNetId, ROUTE_TABLE_LOCAL_NETWORK, PERMISSION_NONE, 644 INVALID_UID, INVALID_UID, ACTION_ADD)) { 645 return ret; 646 } 647 648 Fwmark fwmark; 649 Fwmark mask; 650 651 fwmark.explicitlySelected = false; 652 mask.explicitlySelected = true; 653 654 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_LOCAL_NETWORK, ROUTE_TABLE_LOCAL_NETWORK, 655 fwmark.intValue, mask.intValue); 656} 657 658int configureDummyNetwork() { 659 const char *interface = DummyNetwork::INTERFACE_NAME; 660 uint32_t table = getRouteTableForInterface(interface); 661 if (table == RT_TABLE_UNSPEC) { 662 // getRouteTableForInterface has already looged an error. 663 return -ESRCH; 664 } 665 666 ifc_init(); 667 int ret = ifc_up(interface); 668 ifc_close(); 669 if (ret) { 670 ALOGE("Can't bring up %s: %s", interface, strerror(errno)); 671 return -errno; 672 } 673 674 if ((ret = modifyOutputInterfaceRules(interface, table, PERMISSION_NONE, 675 INVALID_UID, INVALID_UID, ACTION_ADD))) { 676 ALOGE("Can't create oif rules for %s: %s", interface, strerror(-ret)); 677 return ret; 678 } 679 680 if ((ret = modifyIpRoute(RTM_NEWROUTE, table, interface, "0.0.0.0/0", NULL))) { 681 return ret; 682 } 683 684 if ((ret = modifyIpRoute(RTM_NEWROUTE, table, interface, "::/0", NULL))) { 685 return ret; 686 } 687 688 return 0; 689} 690 691// Add a new rule to look up the 'main' table, with the same selectors as the "default network" 692// rule, but with a lower priority. We will never create routes in the main table; it should only be 693// used for directly-connected routes implicitly created by the kernel when adding IP addresses. 694// This is necessary, for example, when adding a route through a directly-connected gateway: in 695// order to add the route, there must already be a directly-connected route that covers the gateway. 696WARN_UNUSED_RESULT int addDirectlyConnectedRule() { 697 Fwmark fwmark; 698 Fwmark mask; 699 700 fwmark.netId = NETID_UNSET; 701 mask.netId = FWMARK_NET_ID_MASK; 702 703 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_DIRECTLY_CONNECTED, RT_TABLE_MAIN, 704 fwmark.intValue, mask.intValue, IIF_NONE, OIF_NONE, UID_ROOT, UID_ROOT); 705} 706 707// Add an explicit unreachable rule close to the end of the prioriy list to make it clear that 708// relying on the kernel-default "from all lookup main" rule at priority 32766 is not intended 709// behaviour. We do flush the kernel-default rules at startup, but having an explicit unreachable 710// rule will hopefully make things even clearer. 711WARN_UNUSED_RESULT int addUnreachableRule() { 712 return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_UNREACHABLE, FR_ACT_UNREACHABLE, RT_TABLE_UNSPEC, 713 MARK_UNSET, MARK_UNSET, IIF_NONE, OIF_NONE, INVALID_UID, INVALID_UID); 714} 715 716WARN_UNUSED_RESULT int modifyLocalNetwork(unsigned netId, const char* interface, bool add) { 717 if (int ret = modifyIncomingPacketMark(netId, interface, PERMISSION_NONE, add)) { 718 return ret; 719 } 720 return modifyOutputInterfaceRules(interface, ROUTE_TABLE_LOCAL_NETWORK, PERMISSION_NONE, 721 INVALID_UID, INVALID_UID, add); 722} 723 724WARN_UNUSED_RESULT int modifyPhysicalNetwork(unsigned netId, const char* interface, 725 Permission permission, bool add) { 726 uint32_t table = getRouteTableForInterface(interface); 727 if (table == RT_TABLE_UNSPEC) { 728 return -ESRCH; 729 } 730 731 if (int ret = modifyIncomingPacketMark(netId, interface, permission, add)) { 732 return ret; 733 } 734 if (int ret = modifyExplicitNetworkRule(netId, table, permission, INVALID_UID, INVALID_UID, 735 add)) { 736 return ret; 737 } 738 if (int ret = modifyOutputInterfaceRules(interface, table, permission, INVALID_UID, INVALID_UID, 739 add)) { 740 return ret; 741 } 742 743 // Only set implicit rules for networks that don't require permissions. 744 // 745 // This is so that if the default network ceases to be the default network and then switches 746 // from requiring no permissions to requiring permissions, we ensure that apps only use the 747 // network if they explicitly select it. This is consistent with destroySocketsLackingPermission 748 // - it closes all sockets on the network except sockets that are explicitly selected. 749 // 750 // The lack of this rule only affects the special case above, because: 751 // - The only cases where we implicitly bind a socket to a network are the default network and 752 // the bypassable VPN that applies to the app, if any. 753 // - This rule doesn't affect VPNs because they don't support permissions at all. 754 // - The default network doesn't require permissions. While we support doing this, the framework 755 // never does it (partly because we'd end up in the situation where we tell apps that there is 756 // a default network, but they can't use it). 757 // - If the network is still the default network, the presence or absence of this rule does not 758 // matter. 759 // 760 // Therefore, for the lack of this rule to affect a socket, the socket has to have been 761 // implicitly bound to a network because at the time of connect() it was the default, and that 762 // network must no longer be the default, and must now require permissions. 763 if (permission == PERMISSION_NONE) { 764 return modifyImplicitNetworkRule(netId, table, add); 765 } 766 return 0; 767} 768 769WARN_UNUSED_RESULT int modifyRejectNonSecureNetworkRule(const UidRanges& uidRanges, bool add) { 770 Fwmark fwmark; 771 Fwmark mask; 772 fwmark.protectedFromVpn = false; 773 mask.protectedFromVpn = true; 774 775 for (const UidRange& range : uidRanges.getRanges()) { 776 if (int ret = modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, 777 RULE_PRIORITY_PROHIBIT_NON_VPN, FR_ACT_PROHIBIT, RT_TABLE_UNSPEC, 778 fwmark.intValue, mask.intValue, IIF_LOOPBACK, OIF_NONE, 779 range.getStart(), range.getStop())) { 780 return ret; 781 } 782 } 783 784 return 0; 785} 786 787WARN_UNUSED_RESULT int modifyVirtualNetwork(unsigned netId, const char* interface, 788 const UidRanges& uidRanges, bool secure, bool add, 789 bool modifyNonUidBasedRules) { 790 uint32_t table = getRouteTableForInterface(interface); 791 if (table == RT_TABLE_UNSPEC) { 792 return -ESRCH; 793 } 794 795 for (const UidRange& range : uidRanges.getRanges()) { 796 if (int ret = modifyVpnUidRangeRule(table, range.getStart(), range.getStop(), secure, add)) 797 { 798 return ret; 799 } 800 if (int ret = modifyExplicitNetworkRule(netId, table, PERMISSION_NONE, range.getStart(), 801 range.getStop(), add)) { 802 return ret; 803 } 804 if (int ret = modifyOutputInterfaceRules(interface, table, PERMISSION_NONE, 805 range.getStart(), range.getStop(), add)) { 806 return ret; 807 } 808 } 809 810 if (modifyNonUidBasedRules) { 811 if (int ret = modifyIncomingPacketMark(netId, interface, PERMISSION_NONE, add)) { 812 return ret; 813 } 814 if (int ret = modifyVpnOutputToLocalRule(interface, add)) { 815 return ret; 816 } 817 if (int ret = modifyVpnSystemPermissionRule(netId, table, secure, add)) { 818 return ret; 819 } 820 return modifyExplicitNetworkRule(netId, table, PERMISSION_NONE, UID_ROOT, UID_ROOT, add); 821 } 822 823 return 0; 824} 825 826WARN_UNUSED_RESULT int modifyDefaultNetwork(uint16_t action, const char* interface, 827 Permission permission) { 828 uint32_t table = getRouteTableForInterface(interface); 829 if (table == RT_TABLE_UNSPEC) { 830 return -ESRCH; 831 } 832 833 Fwmark fwmark; 834 Fwmark mask; 835 836 fwmark.netId = NETID_UNSET; 837 mask.netId = FWMARK_NET_ID_MASK; 838 839 fwmark.permission = permission; 840 mask.permission = permission; 841 842 return modifyIpRule(action, RULE_PRIORITY_DEFAULT_NETWORK, table, fwmark.intValue, 843 mask.intValue); 844} 845 846WARN_UNUSED_RESULT int modifyTetheredNetwork(uint16_t action, const char* inputInterface, 847 const char* outputInterface) { 848 uint32_t table = getRouteTableForInterface(outputInterface); 849 if (table == RT_TABLE_UNSPEC) { 850 return -ESRCH; 851 } 852 853 return modifyIpRule(action, RULE_PRIORITY_TETHERING, table, MARK_UNSET, MARK_UNSET, 854 inputInterface, OIF_NONE, INVALID_UID, INVALID_UID); 855} 856 857// Adds or removes an IPv4 or IPv6 route to the specified table and, if it's a directly-connected 858// route, to the main table as well. 859// Returns 0 on success or negative errno on failure. 860WARN_UNUSED_RESULT int modifyRoute(uint16_t action, const char* interface, const char* destination, 861 const char* nexthop, RouteController::TableType tableType) { 862 uint32_t table; 863 switch (tableType) { 864 case RouteController::INTERFACE: { 865 table = getRouteTableForInterface(interface); 866 if (table == RT_TABLE_UNSPEC) { 867 return -ESRCH; 868 } 869 break; 870 } 871 case RouteController::LOCAL_NETWORK: { 872 table = ROUTE_TABLE_LOCAL_NETWORK; 873 break; 874 } 875 case RouteController::LEGACY_NETWORK: { 876 table = ROUTE_TABLE_LEGACY_NETWORK; 877 break; 878 } 879 case RouteController::LEGACY_SYSTEM: { 880 table = ROUTE_TABLE_LEGACY_SYSTEM; 881 break; 882 } 883 } 884 885 int ret = modifyIpRoute(action, table, interface, destination, nexthop); 886 // Trying to add a route that already exists shouldn't cause an error. 887 if (ret && !(action == RTM_NEWROUTE && ret == -EEXIST)) { 888 return ret; 889 } 890 891 return 0; 892} 893 894WARN_UNUSED_RESULT int clearTetheringRules(const char* inputInterface) { 895 int ret = 0; 896 while (ret == 0) { 897 ret = modifyIpRule(RTM_DELRULE, RULE_PRIORITY_TETHERING, 0, MARK_UNSET, MARK_UNSET, 898 inputInterface, OIF_NONE, INVALID_UID, INVALID_UID); 899 } 900 901 if (ret == -ENOENT) { 902 return 0; 903 } else { 904 return ret; 905 } 906} 907 908uint32_t getRulePriority(const nlmsghdr *nlh) { 909 return getRtmU32Attribute(nlh, FRA_PRIORITY); 910} 911 912uint32_t getRouteTable(const nlmsghdr *nlh) { 913 return getRtmU32Attribute(nlh, RTA_TABLE); 914} 915 916WARN_UNUSED_RESULT int flushRules() { 917 NetlinkDumpFilter shouldDelete = [] (nlmsghdr *nlh) { 918 // Don't touch rules at priority 0 because by default they are used for local input. 919 return getRulePriority(nlh) != 0; 920 }; 921 return rtNetlinkFlush(RTM_GETRULE, RTM_DELRULE, "rules", shouldDelete); 922} 923 924WARN_UNUSED_RESULT int flushRoutes(uint32_t table) { 925 NetlinkDumpFilter shouldDelete = [table] (nlmsghdr *nlh) { 926 return getRouteTable(nlh) == table; 927 }; 928 929 return rtNetlinkFlush(RTM_GETROUTE, RTM_DELROUTE, "routes", shouldDelete); 930} 931 932// Returns 0 on success or negative errno on failure. 933WARN_UNUSED_RESULT int flushRoutes(const char* interface) { 934 uint32_t table = getRouteTableForInterface(interface); 935 if (table == RT_TABLE_UNSPEC) { 936 return -ESRCH; 937 } 938 939 int ret = flushRoutes(table); 940 941 // If we failed to flush routes, the caller may elect to keep this interface around, so keep 942 // track of its name. 943 if (ret == 0) { 944 interfaceToTable.erase(interface); 945 } 946 947 return ret; 948} 949 950int RouteController::Init(unsigned localNetId) { 951 if (int ret = flushRules()) { 952 return ret; 953 } 954 if (int ret = addLegacyRouteRules()) { 955 return ret; 956 } 957 if (int ret = addLocalNetworkRules(localNetId)) { 958 return ret; 959 } 960 if (int ret = addDirectlyConnectedRule()) { 961 return ret; 962 } 963 if (int ret = addUnreachableRule()) { 964 return ret; 965 } 966 // Don't complain if we can't add the dummy network, since not all devices support it. 967 configureDummyNetwork(); 968 969 updateTableNamesFile(); 970 return 0; 971} 972 973int RouteController::addInterfaceToLocalNetwork(unsigned netId, const char* interface) { 974 return modifyLocalNetwork(netId, interface, ACTION_ADD); 975} 976 977int RouteController::removeInterfaceFromLocalNetwork(unsigned netId, const char* interface) { 978 return modifyLocalNetwork(netId, interface, ACTION_DEL); 979} 980 981int RouteController::addInterfaceToPhysicalNetwork(unsigned netId, const char* interface, 982 Permission permission) { 983 if (int ret = modifyPhysicalNetwork(netId, interface, permission, ACTION_ADD)) { 984 return ret; 985 } 986 updateTableNamesFile(); 987 return 0; 988} 989 990int RouteController::removeInterfaceFromPhysicalNetwork(unsigned netId, const char* interface, 991 Permission permission) { 992 if (int ret = modifyPhysicalNetwork(netId, interface, permission, ACTION_DEL)) { 993 return ret; 994 } 995 if (int ret = flushRoutes(interface)) { 996 return ret; 997 } 998 if (int ret = clearTetheringRules(interface)) { 999 return ret; 1000 } 1001 updateTableNamesFile(); 1002 return 0; 1003} 1004 1005int RouteController::addInterfaceToVirtualNetwork(unsigned netId, const char* interface, 1006 bool secure, const UidRanges& uidRanges) { 1007 if (int ret = modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_ADD, 1008 MODIFY_NON_UID_BASED_RULES)) { 1009 return ret; 1010 } 1011 updateTableNamesFile(); 1012 return 0; 1013} 1014 1015int RouteController::removeInterfaceFromVirtualNetwork(unsigned netId, const char* interface, 1016 bool secure, const UidRanges& uidRanges) { 1017 if (int ret = modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_DEL, 1018 MODIFY_NON_UID_BASED_RULES)) { 1019 return ret; 1020 } 1021 if (int ret = flushRoutes(interface)) { 1022 return ret; 1023 } 1024 updateTableNamesFile(); 1025 return 0; 1026} 1027 1028int RouteController::modifyPhysicalNetworkPermission(unsigned netId, const char* interface, 1029 Permission oldPermission, 1030 Permission newPermission) { 1031 // Add the new rules before deleting the old ones, to avoid race conditions. 1032 if (int ret = modifyPhysicalNetwork(netId, interface, newPermission, ACTION_ADD)) { 1033 return ret; 1034 } 1035 return modifyPhysicalNetwork(netId, interface, oldPermission, ACTION_DEL); 1036} 1037 1038int RouteController::addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges) { 1039 return modifyRejectNonSecureNetworkRule(uidRanges, true); 1040} 1041 1042int RouteController::removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges) { 1043 return modifyRejectNonSecureNetworkRule(uidRanges, false); 1044} 1045 1046int RouteController::addUsersToVirtualNetwork(unsigned netId, const char* interface, bool secure, 1047 const UidRanges& uidRanges) { 1048 return modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_ADD, 1049 !MODIFY_NON_UID_BASED_RULES); 1050} 1051 1052int RouteController::removeUsersFromVirtualNetwork(unsigned netId, const char* interface, 1053 bool secure, const UidRanges& uidRanges) { 1054 return modifyVirtualNetwork(netId, interface, uidRanges, secure, ACTION_DEL, 1055 !MODIFY_NON_UID_BASED_RULES); 1056} 1057 1058int RouteController::addInterfaceToDefaultNetwork(const char* interface, Permission permission) { 1059 return modifyDefaultNetwork(RTM_NEWRULE, interface, permission); 1060} 1061 1062int RouteController::removeInterfaceFromDefaultNetwork(const char* interface, 1063 Permission permission) { 1064 return modifyDefaultNetwork(RTM_DELRULE, interface, permission); 1065} 1066 1067int RouteController::addRoute(const char* interface, const char* destination, const char* nexthop, 1068 TableType tableType) { 1069 return modifyRoute(RTM_NEWROUTE, interface, destination, nexthop, tableType); 1070} 1071 1072int RouteController::removeRoute(const char* interface, const char* destination, 1073 const char* nexthop, TableType tableType) { 1074 return modifyRoute(RTM_DELROUTE, interface, destination, nexthop, tableType); 1075} 1076 1077int RouteController::enableTethering(const char* inputInterface, const char* outputInterface) { 1078 return modifyTetheredNetwork(RTM_NEWRULE, inputInterface, outputInterface); 1079} 1080 1081int RouteController::disableTethering(const char* inputInterface, const char* outputInterface) { 1082 return modifyTetheredNetwork(RTM_DELRULE, inputInterface, outputInterface); 1083} 1084 1085int RouteController::addVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface, 1086 Permission permission) { 1087 return modifyVpnFallthroughRule(RTM_NEWRULE, vpnNetId, physicalInterface, permission); 1088} 1089 1090int RouteController::removeVirtualNetworkFallthrough(unsigned vpnNetId, 1091 const char* physicalInterface, 1092 Permission permission) { 1093 return modifyVpnFallthroughRule(RTM_DELRULE, vpnNetId, physicalInterface, permission); 1094} 1095 1096} // namespace net 1097} // namespace android 1098