256 lines
15 KiB
C++
256 lines
15 KiB
C++
/*
|
|
* Copyright (C) 2014 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include "InterfaceController.h" // getParameter
|
|
#include "NetdConstants.h" // IptablesTarget
|
|
#include "Network.h" // UidRangeMap
|
|
#include "Permission.h"
|
|
|
|
#include <android-base/thread_annotations.h>
|
|
|
|
#include <linux/netlink.h>
|
|
#include <sys/types.h>
|
|
#include <map>
|
|
#include <mutex>
|
|
|
|
namespace android::net {
|
|
|
|
// clang-format off
|
|
constexpr int32_t RULE_PRIORITY_VPN_OVERRIDE_SYSTEM = 10000;
|
|
constexpr int32_t RULE_PRIORITY_VPN_OVERRIDE_OIF = 11000;
|
|
constexpr int32_t RULE_PRIORITY_VPN_OUTPUT_TO_LOCAL = 12000;
|
|
constexpr int32_t RULE_PRIORITY_SECURE_VPN = 13000;
|
|
constexpr int32_t RULE_PRIORITY_PROHIBIT_NON_VPN = 14000;
|
|
// Rules used when applications explicitly select a network that they have permission to use only
|
|
// because they are in the list of UID ranges for that network.
|
|
//
|
|
// Sockets from these UIDs will not match RULE_PRIORITY_EXPLICIT_NETWORK rules because they will
|
|
// not have the necessary permission bits in the fwmark. We cannot just give any socket on any of
|
|
// these networks the permission bits, because if the UID that created the socket loses access to
|
|
// the network, then the socket must not match any rule that selects that network.
|
|
constexpr int32_t RULE_PRIORITY_UID_EXPLICIT_NETWORK = 15000;
|
|
constexpr int32_t RULE_PRIORITY_EXPLICIT_NETWORK = 16000;
|
|
constexpr int32_t RULE_PRIORITY_OUTPUT_INTERFACE = 17000;
|
|
constexpr int32_t RULE_PRIORITY_LEGACY_SYSTEM = 18000;
|
|
constexpr int32_t RULE_PRIORITY_LEGACY_NETWORK = 19000;
|
|
constexpr int32_t RULE_PRIORITY_LOCAL_NETWORK = 20000;
|
|
constexpr int32_t RULE_PRIORITY_TETHERING = 21000;
|
|
// Implicit rules for sockets that connected on a given network because the network was the default
|
|
// network for the UID.
|
|
constexpr int32_t RULE_PRIORITY_UID_IMPLICIT_NETWORK = 22000;
|
|
constexpr int32_t RULE_PRIORITY_IMPLICIT_NETWORK = 23000;
|
|
constexpr int32_t RULE_PRIORITY_BYPASSABLE_VPN_NO_LOCAL_EXCLUSION = 24000;
|
|
// Sets of rules used for excluding local routes from the VPN. Look up tables
|
|
// that contain directly-connected local routes taken from the default network.
|
|
// The first set is used for apps that have a per-UID default network. The rule
|
|
// UID ranges match those of the per-UID default network rule for that network.
|
|
// The second set has no UID ranges and is used for apps whose default network
|
|
// is the system default network network.
|
|
constexpr int32_t RULE_PRIORITY_UID_LOCAL_ROUTES = 25000;
|
|
constexpr int32_t RULE_PRIORITY_LOCAL_ROUTES = 26000;
|
|
constexpr int32_t RULE_PRIORITY_BYPASSABLE_VPN_LOCAL_EXCLUSION = 27000;
|
|
constexpr int32_t RULE_PRIORITY_VPN_FALLTHROUGH = 28000;
|
|
constexpr int32_t RULE_PRIORITY_UID_DEFAULT_NETWORK = 29000;
|
|
// Rule used when framework wants to disable default network from specified applications. There will
|
|
// be a small interval the same uid range exists in both UID_DEFAULT_UNREACHABLE and
|
|
// UID_DEFAULT_NETWORK when framework is switching user preferences.
|
|
//
|
|
// framework --> netd
|
|
// step 1: set uid to unreachable network
|
|
// step 2: remove uid from OEM-paid network list
|
|
// or
|
|
// step 1: add uid to OEM-paid network list
|
|
// step 2: remove uid from unreachable network
|
|
//
|
|
// The priority is lower than UID_DEFAULT_NETWORK. Otherwise, the app will be told by
|
|
// ConnectivityService that it has a network in step 1 of the second case. But if it tries to use
|
|
// the network, it will not work. That will potentially cause a user-visible error.
|
|
constexpr int32_t RULE_PRIORITY_UID_DEFAULT_UNREACHABLE = 30000;
|
|
constexpr int32_t RULE_PRIORITY_DEFAULT_NETWORK = 31000;
|
|
constexpr int32_t RULE_PRIORITY_UNREACHABLE = 32000;
|
|
// clang-format on
|
|
|
|
static const char* V4_FIXED_LOCAL_PREFIXES[] = {
|
|
// The multicast range is 224.0.0.0/4 but only limit it to 224.0.0.0/24 since the IPv4
|
|
// definitions are not as precise as for IPv6, it is the only range that the standards
|
|
// (RFC 2365 and RFC 5771) specify is link-local and must not be forwarded.
|
|
"224.0.0.0/24" // Link-local multicast; non-internet routable
|
|
};
|
|
|
|
class UidRanges;
|
|
|
|
class RouteController {
|
|
public:
|
|
// How the routing table number is determined for route modification requests.
|
|
enum TableType {
|
|
INTERFACE, // Compute the table number based on the interface index.
|
|
LOCAL_NETWORK, // A fixed table used for routes to directly-connected clients/peers.
|
|
LEGACY_NETWORK, // Use a fixed table that's used to override the default network.
|
|
LEGACY_SYSTEM, // A fixed table, only modifiable by system apps; overrides VPNs too.
|
|
};
|
|
|
|
static const int ROUTE_TABLE_OFFSET_FROM_INDEX = 1000;
|
|
// Offset for the table of virtual local network created from the physical interface.
|
|
static const int ROUTE_TABLE_OFFSET_FROM_INDEX_FOR_LOCAL = 1000000000;
|
|
|
|
static constexpr const char* INTERFACE_LOCAL_SUFFIX = "_local";
|
|
static constexpr const char* RT_TABLES_PATH = "/data/misc/net/rt_tables";
|
|
static const char* const LOCAL_MANGLE_INPUT;
|
|
|
|
[[nodiscard]] static int Init(unsigned localNetId);
|
|
|
|
// Returns an ifindex given the interface name, by looking up in sInterfaceToTable.
|
|
// This is currently only used by NetworkController::addInterfaceToNetwork
|
|
// and should probabaly be changed to passing the ifindex into RouteController instead.
|
|
// We do this instead of calling if_nametoindex because the same interface name can
|
|
// correspond to different interface indices over time. This way, even if the interface
|
|
// index has changed, we can still free any map entries indexed by the ifindex that was
|
|
// used to add them.
|
|
static uint32_t getIfIndex(const char* interface) EXCLUDES(sInterfaceToTableLock);
|
|
|
|
[[nodiscard]] static int addInterfaceToLocalNetwork(unsigned netId, const char* interface);
|
|
[[nodiscard]] static int removeInterfaceFromLocalNetwork(unsigned netId, const char* interface);
|
|
|
|
[[nodiscard]] static int addInterfaceToPhysicalNetwork(unsigned netId, const char* interface,
|
|
Permission permission,
|
|
const UidRangeMap& uidRangeMap);
|
|
[[nodiscard]] static int removeInterfaceFromPhysicalNetwork(unsigned netId,
|
|
const char* interface,
|
|
Permission permission,
|
|
const UidRangeMap& uidRangeMap);
|
|
|
|
[[nodiscard]] static int addInterfaceToVirtualNetwork(unsigned netId, const char* interface,
|
|
bool secure,
|
|
const UidRangeMap& uidRangeMap,
|
|
bool excludeLocalRoutes);
|
|
[[nodiscard]] static int removeInterfaceFromVirtualNetwork(unsigned netId,
|
|
const char* interface, bool secure,
|
|
const UidRangeMap& uidRangeMap,
|
|
bool excludeLocalRoutes);
|
|
|
|
[[nodiscard]] static int modifyPhysicalNetworkPermission(unsigned netId, const char* interface,
|
|
Permission oldPermission,
|
|
Permission newPermission);
|
|
|
|
[[nodiscard]] static int addUsersToVirtualNetwork(unsigned netId, const char* interface,
|
|
bool secure, const UidRangeMap& uidRangeMap,
|
|
bool excludeLocalRoutes);
|
|
[[nodiscard]] static int removeUsersFromVirtualNetwork(unsigned netId, const char* interface,
|
|
bool secure,
|
|
const UidRangeMap& uidRangeMap,
|
|
bool excludeLocalRoutes);
|
|
|
|
[[nodiscard]] static int addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges);
|
|
[[nodiscard]] static int removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges);
|
|
|
|
[[nodiscard]] static int addInterfaceToDefaultNetwork(const char* interface,
|
|
Permission permission);
|
|
[[nodiscard]] static int removeInterfaceFromDefaultNetwork(const char* interface,
|
|
Permission permission);
|
|
|
|
// |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
|
|
// route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
|
|
[[nodiscard]] static int addRoute(const char* interface, const char* destination,
|
|
const char* nexthop, TableType tableType, int mtu,
|
|
int priority);
|
|
[[nodiscard]] static int removeRoute(const char* interface, const char* destination,
|
|
const char* nexthop, TableType tableType, int priority);
|
|
[[nodiscard]] static int updateRoute(const char* interface, const char* destination,
|
|
const char* nexthop, TableType tableType, int mtu);
|
|
|
|
[[nodiscard]] static int enableTethering(const char* inputInterface,
|
|
const char* outputInterface);
|
|
[[nodiscard]] static int disableTethering(const char* inputInterface,
|
|
const char* outputInterface);
|
|
|
|
[[nodiscard]] static int addVirtualNetworkFallthrough(unsigned vpnNetId,
|
|
const char* physicalInterface,
|
|
Permission permission);
|
|
[[nodiscard]] static int removeVirtualNetworkFallthrough(unsigned vpnNetId,
|
|
const char* physicalInterface,
|
|
Permission permission);
|
|
|
|
[[nodiscard]] static int addUsersToPhysicalNetwork(unsigned netId, const char* interface,
|
|
const UidRangeMap& uidRangeMap);
|
|
|
|
[[nodiscard]] static int removeUsersFromPhysicalNetwork(unsigned netId, const char* interface,
|
|
const UidRangeMap& uidRangeMap);
|
|
|
|
[[nodiscard]] static int addUsersToUnreachableNetwork(unsigned netId,
|
|
const UidRangeMap& uidRangeMap);
|
|
|
|
[[nodiscard]] static int removeUsersFromUnreachableNetwork(unsigned netId,
|
|
const UidRangeMap& uidRangeMap);
|
|
|
|
// For testing.
|
|
static int (*iptablesRestoreCommandFunction)(IptablesTarget, const std::string&,
|
|
const std::string&, std::string *);
|
|
static uint32_t (*ifNameToIndexFunction)(const char*);
|
|
|
|
private:
|
|
friend class RouteControllerTest;
|
|
|
|
static std::mutex sInterfaceToTableLock;
|
|
static std::map<std::string, uint32_t> sInterfaceToTable GUARDED_BY(sInterfaceToTableLock);
|
|
|
|
static int configureDummyNetwork();
|
|
[[nodiscard]] static int flushRoutes(const char* interface) EXCLUDES(sInterfaceToTableLock);
|
|
[[nodiscard]] static int flushRoutes(const char* interface, bool local)
|
|
EXCLUDES(sInterfaceToTableLock);
|
|
[[nodiscard]] static int flushRoutes(uint32_t table);
|
|
static uint32_t getRouteTableForInterfaceLocked(const char* interface, bool local)
|
|
REQUIRES(sInterfaceToTableLock);
|
|
static uint32_t getRouteTableForInterface(const char* interface, bool local)
|
|
EXCLUDES(sInterfaceToTableLock);
|
|
static int modifyDefaultNetwork(uint16_t action, const char* interface, Permission permission);
|
|
static int modifyPhysicalNetwork(unsigned netId, const char* interface,
|
|
const UidRangeMap& uidRangeMap, Permission permission,
|
|
bool add, bool modifyNonUidBasedRules);
|
|
static int modifyUnreachableNetwork(unsigned netId, const UidRangeMap& uidRangeMap, bool add);
|
|
static int modifyRoute(uint16_t action, uint16_t flags, const char* interface,
|
|
const char* destination, const char* nexthop, TableType tableType,
|
|
int mtu, int priority, bool isLocal);
|
|
static int modifyTetheredNetwork(uint16_t action, const char* inputInterface,
|
|
const char* outputInterface);
|
|
static int modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId,
|
|
const char* physicalInterface, Permission permission);
|
|
static int modifyVirtualNetwork(unsigned netId, const char* interface,
|
|
const UidRangeMap& uidRangeMap, bool secure, bool add,
|
|
bool modifyNonUidBasedRules, bool excludeLocalRoutes);
|
|
static void updateTableNamesFile() EXCLUDES(sInterfaceToTableLock);
|
|
static int modifyVpnLocalExclusionRule(bool add, const char* physicalInterface);
|
|
|
|
static int modifyUidLocalNetworkRule(const char* interface, uid_t uidStart, uid_t uidEnd,
|
|
bool add);
|
|
static bool isLocalRoute(TableType tableType, const char* destination, const char* nexthop);
|
|
static bool isWithinIpv4LocalPrefix(const char* addrstr);
|
|
static int addFixedLocalRoutes(const char* interface);
|
|
};
|
|
|
|
// Public because they are called by by RouteControllerTest.cpp.
|
|
// TODO: come up with a scheme of unit testing this code that does not rely on making all its
|
|
// functions public.
|
|
[[nodiscard]] int modifyIpRoute(uint16_t action, uint16_t flags, uint32_t table,
|
|
const char* interface, const char* destination, const char* nexthop,
|
|
uint32_t mtu, uint32_t priority);
|
|
uint32_t getRulePriority(const nlmsghdr *nlh);
|
|
[[nodiscard]] int modifyIncomingPacketMark(unsigned netId, const char* interface,
|
|
Permission permission, bool add);
|
|
|
|
} // namespace android::net
|