1/* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#include <dirent.h> 18#include <errno.h> 19#include <malloc.h> 20#include <net/if.h> 21#include <sys/socket.h> 22 23#include <functional> 24 25#define LOG_TAG "InterfaceController" 26#include <android-base/file.h> 27#include <android-base/properties.h> 28#include <android-base/stringprintf.h> 29#include <cutils/log.h> 30#include <logwrap/logwrap.h> 31#include <netutils/ifc.h> 32 33#include <android/net/INetd.h> 34#include <netdutils/Misc.h> 35#include <netdutils/Slice.h> 36#include <netdutils/Syscalls.h> 37 38#include "InterfaceController.h" 39#include "RouteController.h" 40 41using android::base::ReadFileToString; 42using android::base::StringPrintf; 43using android::base::WriteStringToFile; 44using android::net::INetd; 45using android::net::RouteController; 46using android::netdutils::isOk; 47using android::netdutils::Status; 48using android::netdutils::StatusOr; 49using android::netdutils::makeSlice; 50using android::netdutils::sSyscalls; 51using android::netdutils::status::ok; 52using android::netdutils::statusFromErrno; 53using android::netdutils::toString; 54 55namespace { 56 57const char ipv6_proc_path[] = "/proc/sys/net/ipv6/conf"; 58 59const char ipv4_neigh_conf_dir[] = "/proc/sys/net/ipv4/neigh"; 60 61const char ipv6_neigh_conf_dir[] = "/proc/sys/net/ipv6/neigh"; 62 63const char proc_net_path[] = "/proc/sys/net"; 64const char sys_net_path[] = "/sys/class/net"; 65 66constexpr int kRouteInfoMinPrefixLen = 48; 67 68// RFC 7421 prefix length. 69constexpr int kRouteInfoMaxPrefixLen = 64; 70 71// Property used to persist RFC 7217 stable secret. Protected by SELinux policy. 72const char kStableSecretProperty[] = "persist.netd.stable_secret"; 73 74// RFC 7217 stable secret on linux is formatted as an IPv6 address. 75// This function uses 128 bits of high quality entropy to generate an 76// address for this purpose. This function should be not be called 77// frequently. 78StatusOr<std::string> randomIPv6Address() { 79 in6_addr addr = {}; 80 const auto& sys = sSyscalls.get(); 81 ASSIGN_OR_RETURN(auto fd, sys.open("/dev/random", O_RDONLY)); 82 RETURN_IF_NOT_OK(sys.read(fd, makeSlice(addr))); 83 return toString(addr); 84} 85 86inline bool isNormalPathComponent(const char *component) { 87 return (strcmp(component, ".") != 0) && 88 (strcmp(component, "..") != 0) && 89 (strchr(component, '/') == nullptr); 90} 91 92inline bool isAddressFamilyPathComponent(const char *component) { 93 return strcmp(component, "ipv4") == 0 || strcmp(component, "ipv6") == 0; 94} 95 96inline bool isInterfaceName(const char *name) { 97 return isNormalPathComponent(name) && 98 (strcmp(name, "default") != 0) && 99 (strcmp(name, "all") != 0); 100} 101 102int writeValueToPath( 103 const char* dirname, const char* subdirname, const char* basename, 104 const char* value) { 105 std::string path(StringPrintf("%s/%s/%s", dirname, subdirname, basename)); 106 return WriteStringToFile(value, path) ? 0 : -1; 107} 108 109// Run @fn on each interface as well as 'default' in the path @dirname. 110void forEachInterface(const std::string& dirname, 111 std::function<void(const std::string& path, const std::string& iface)> fn) { 112 // Run on default, which controls the behavior of any interfaces that are created in the future. 113 fn(dirname, "default"); 114 DIR* dir = opendir(dirname.c_str()); 115 if (!dir) { 116 ALOGE("Can't list %s: %s", dirname.c_str(), strerror(errno)); 117 return; 118 } 119 while (true) { 120 const dirent *ent = readdir(dir); 121 if (!ent) { 122 break; 123 } 124 if ((ent->d_type != DT_DIR) || !isInterfaceName(ent->d_name)) { 125 continue; 126 } 127 fn(dirname, ent->d_name); 128 } 129 closedir(dir); 130} 131 132void setOnAllInterfaces(const char* dirname, const char* basename, const char* value) { 133 auto fn = [basename, value](const std::string& path, const std::string& iface) { 134 writeValueToPath(path.c_str(), iface.c_str(), basename, value); 135 }; 136 forEachInterface(dirname, fn); 137} 138 139void setIPv6UseOutgoingInterfaceAddrsOnly(const char *value) { 140 setOnAllInterfaces(ipv6_proc_path, "use_oif_addrs_only", value); 141} 142 143std::string getParameterPathname( 144 const char *family, const char *which, const char *interface, const char *parameter) { 145 if (!isAddressFamilyPathComponent(family)) { 146 errno = EAFNOSUPPORT; 147 return ""; 148 } else if (!isNormalPathComponent(which) || 149 !isInterfaceName(interface) || 150 !isNormalPathComponent(parameter)) { 151 errno = EINVAL; 152 return ""; 153 } 154 155 return StringPrintf("%s/%s/%s/%s/%s", proc_net_path, family, which, interface, parameter); 156} 157 158void setAcceptIPv6RIO(int min, int max) { 159 auto fn = [min, max](const std::string& prefix, const std::string& iface) { 160 int rv = writeValueToPath(prefix.c_str(), iface.c_str(), "accept_ra_rt_info_min_plen", 161 std::to_string(min).c_str()); 162 if (rv != 0) { 163 // Only update max_plen if the write to min_plen succeeded. This ordering will prevent 164 // RIOs from being accepted unless both min and max are written successfully. 165 return; 166 } 167 writeValueToPath(prefix.c_str(), iface.c_str(), "accept_ra_rt_info_max_plen", 168 std::to_string(max).c_str()); 169 }; 170 forEachInterface(ipv6_proc_path, fn); 171} 172 173// Ideally this function would return StatusOr<std::string>, however 174// there is no safe value for dflt that will always differ from the 175// stored property. Bugs code could conceivably end up persisting the 176// reserved value resulting in surprising behavior. 177std::string getProperty(const std::string& key, const std::string& dflt) { 178 return android::base::GetProperty(key, dflt); 179}; 180 181Status setProperty(const std::string& key, const std::string& val) { 182 // SetProperty does not dependably set errno to a meaningful value. Use our own error code so 183 // callers don't get confused. 184 return android::base::SetProperty(key, val) 185 ? ok 186 : statusFromErrno(EREMOTEIO, "SetProperty failed, see libc logs"); 187}; 188 189 190} // namespace 191 192android::netdutils::Status InterfaceController::enableStablePrivacyAddresses( 193 const std::string& iface, GetPropertyFn getProperty, SetPropertyFn setProperty) { 194 const auto& sys = sSyscalls.get(); 195 const std::string procTarget = std::string(ipv6_proc_path) + "/" + iface + "/stable_secret"; 196 auto procFd = sys.open(procTarget, O_CLOEXEC | O_WRONLY); 197 198 // Devices with old kernels (typically < 4.4) don't support 199 // RFC 7217 stable privacy addresses. 200 if (equalToErrno(procFd, ENOENT)) { 201 return statusFromErrno(EOPNOTSUPP, 202 "Failed to open stable_secret. Assuming unsupported kernel version"); 203 } 204 205 // If stable_secret exists but we can't open it, something strange is going on. 206 RETURN_IF_NOT_OK(procFd); 207 208 const char kUninitialized[] = "uninitialized"; 209 const auto oldSecret = getProperty(kStableSecretProperty, kUninitialized); 210 std::string secret = oldSecret; 211 212 // Generate a new secret if no persistent property existed. 213 if (oldSecret == kUninitialized) { 214 ASSIGN_OR_RETURN(secret, randomIPv6Address()); 215 } 216 217 // Ask the OS to generate SLAAC addresses on iface using secret. 218 RETURN_IF_NOT_OK(sys.write(procFd.value(), makeSlice(secret))); 219 220 // Don't persist an existing secret. 221 if (oldSecret != kUninitialized) { 222 return ok; 223 } 224 225 return setProperty(kStableSecretProperty, secret); 226} 227 228void InterfaceController::initializeAll() { 229 // Initial IPv6 settings. 230 // By default, accept_ra is set to 1 (accept RAs unless forwarding is on) on all interfaces. 231 // This causes RAs to work or not work based on whether forwarding is on, and causes routes 232 // learned from RAs to go away when forwarding is turned on. Make this behaviour predictable 233 // by always setting accept_ra to 2. 234 setAcceptRA("2"); 235 236 // Accept RIOs with prefix length in the closed interval [48, 64]. 237 setAcceptIPv6RIO(kRouteInfoMinPrefixLen, kRouteInfoMaxPrefixLen); 238 239 setAcceptRARouteTable(-RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX); 240 241 // Enable optimistic DAD for IPv6 addresses on all interfaces. 242 setIPv6OptimisticMode("1"); 243 244 // Reduce the ARP/ND base reachable time from the default (30sec) to 15sec. 245 setBaseReachableTimeMs(15 * 1000); 246 247 // When sending traffic via a given interface use only addresses configured 248 // on that interface as possible source addresses. 249 setIPv6UseOutgoingInterfaceAddrsOnly("1"); 250} 251 252int InterfaceController::setEnableIPv6(const char *interface, const int on) { 253 if (!isIfaceName(interface)) { 254 errno = ENOENT; 255 return -1; 256 } 257 // When disable_ipv6 changes from 1 to 0, the kernel starts autoconf. 258 // When disable_ipv6 changes from 0 to 1, the kernel clears all autoconf 259 // addresses and routes and disables IPv6 on the interface. 260 const char *disable_ipv6 = on ? "0" : "1"; 261 return writeValueToPath(ipv6_proc_path, interface, "disable_ipv6", disable_ipv6); 262} 263 264// Changes to addrGenMode will not fully take effect until the next 265// time disable_ipv6 transitions from 1 to 0. 266Status InterfaceController::setIPv6AddrGenMode(const std::string& interface, int mode) { 267 if (!isIfaceName(interface)) { 268 return statusFromErrno(ENOENT, "invalid iface name: " + interface); 269 } 270 271 switch (mode) { 272 case INetd::IPV6_ADDR_GEN_MODE_EUI64: 273 // Ignore return value. If /proc/.../stable_secret is 274 // missing we're probably in EUI64 mode already. 275 writeValueToPath(ipv6_proc_path, interface.c_str(), "stable_secret", ""); 276 break; 277 case INetd::IPV6_ADDR_GEN_MODE_STABLE_PRIVACY: { 278 return enableStablePrivacyAddresses(interface, getProperty, setProperty); 279 } 280 case INetd::IPV6_ADDR_GEN_MODE_NONE: 281 case INetd::IPV6_ADDR_GEN_MODE_RANDOM: 282 default: 283 return statusFromErrno(EOPNOTSUPP, "unsupported addrGenMode"); 284 } 285 286 return ok; 287} 288 289int InterfaceController::setAcceptIPv6Ra(const char *interface, const int on) { 290 if (!isIfaceName(interface)) { 291 errno = ENOENT; 292 return -1; 293 } 294 // Because forwarding can be enabled even when tethering is off, we always 295 // use mode "2" (accept RAs, even if forwarding is enabled). 296 const char *accept_ra = on ? "2" : "0"; 297 return writeValueToPath(ipv6_proc_path, interface, "accept_ra", accept_ra); 298} 299 300int InterfaceController::setAcceptIPv6Dad(const char *interface, const int on) { 301 if (!isIfaceName(interface)) { 302 errno = ENOENT; 303 return -1; 304 } 305 const char *accept_dad = on ? "1" : "0"; 306 return writeValueToPath(ipv6_proc_path, interface, "accept_dad", accept_dad); 307} 308 309int InterfaceController::setIPv6DadTransmits(const char *interface, const char *value) { 310 if (!isIfaceName(interface)) { 311 errno = ENOENT; 312 return -1; 313 } 314 return writeValueToPath(ipv6_proc_path, interface, "dad_transmits", value); 315} 316 317int InterfaceController::setIPv6PrivacyExtensions(const char *interface, const int on) { 318 if (!isIfaceName(interface)) { 319 errno = ENOENT; 320 return -1; 321 } 322 // 0: disable IPv6 privacy addresses 323 // 2: enable IPv6 privacy addresses and prefer them over non-privacy ones. 324 return writeValueToPath(ipv6_proc_path, interface, "use_tempaddr", on ? "2" : "0"); 325} 326 327void InterfaceController::setAcceptRA(const char *value) { 328 setOnAllInterfaces(ipv6_proc_path, "accept_ra", value); 329} 330 331// |tableOrOffset| is interpreted as: 332// If == 0: default. Routes go into RT6_TABLE_MAIN. 333// If > 0: user set. Routes go into the specified table. 334// If < 0: automatic. The absolute value is intepreted as an offset and added to the interface 335// ID to get the table. If it's set to -1000, routes from interface ID 5 will go into 336// table 1005, etc. 337void InterfaceController::setAcceptRARouteTable(int tableOrOffset) { 338 std::string value(StringPrintf("%d", tableOrOffset)); 339 setOnAllInterfaces(ipv6_proc_path, "accept_ra_rt_table", value.c_str()); 340} 341 342int InterfaceController::setMtu(const char *interface, const char *mtu) 343{ 344 if (!isIfaceName(interface)) { 345 errno = ENOENT; 346 return -1; 347 } 348 return writeValueToPath(sys_net_path, interface, "mtu", mtu); 349} 350 351int InterfaceController::addAddress(const char *interface, 352 const char *addrString, int prefixLength) { 353 return ifc_add_address(interface, addrString, prefixLength); 354} 355 356int InterfaceController::delAddress(const char *interface, 357 const char *addrString, int prefixLength) { 358 return ifc_del_address(interface, addrString, prefixLength); 359} 360 361int InterfaceController::getParameter( 362 const char *family, const char *which, const char *interface, const char *parameter, 363 std::string *value) { 364 const std::string path(getParameterPathname(family, which, interface, parameter)); 365 if (path.empty()) { 366 return -errno; 367 } 368 return ReadFileToString(path, value) ? 0 : -errno; 369} 370 371int InterfaceController::setParameter( 372 const char *family, const char *which, const char *interface, const char *parameter, 373 const char *value) { 374 const std::string path(getParameterPathname(family, which, interface, parameter)); 375 if (path.empty()) { 376 return -errno; 377 } 378 return WriteStringToFile(value, path) ? 0 : -errno; 379} 380 381void InterfaceController::setBaseReachableTimeMs(unsigned int millis) { 382 std::string value(StringPrintf("%u", millis)); 383 setOnAllInterfaces(ipv4_neigh_conf_dir, "base_reachable_time_ms", value.c_str()); 384 setOnAllInterfaces(ipv6_neigh_conf_dir, "base_reachable_time_ms", value.c_str()); 385} 386 387void InterfaceController::setIPv6OptimisticMode(const char *value) { 388 setOnAllInterfaces(ipv6_proc_path, "optimistic_dad", value); 389 setOnAllInterfaces(ipv6_proc_path, "use_optimistic", value); 390} 391 392StatusOr<std::vector<std::string>> InterfaceController::getIfaceNames() { 393 std::vector<std::string> ifaceNames; 394 DIR* d; 395 struct dirent* de; 396 397 if (!(d = opendir("/sys/class/net"))) { 398 return statusFromErrno(errno, "Cannot open iface directory"); 399 } 400 while ((de = readdir(d))) { 401 if (de->d_name[0] == '.') continue; 402 ifaceNames.push_back(std::string(de->d_name)); 403 } 404 closedir(d); 405 return ifaceNames; 406} 407 408StatusOr<std::map<std::string, uint32_t>> InterfaceController::getIfaceList() { 409 std::map<std::string, uint32_t> ifacePairs; 410 411 ASSIGN_OR_RETURN(auto ifaceNames, getIfaceNames()); 412 413 for (const auto& name : ifaceNames) { 414 uint32_t ifaceIndex = if_nametoindex(name.c_str()); 415 if (ifaceIndex) { 416 ifacePairs.insert(std::pair<std::string, uint32_t>(name, ifaceIndex)); 417 } 418 } 419 return ifacePairs; 420} 421