• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef NETD_SERVER_ROUTE_CONTROLLER_H
18 #define NETD_SERVER_ROUTE_CONTROLLER_H
19 
20 #include "NetdConstants.h"
21 #include "Permission.h"
22 
23 #include <android-base/thread_annotations.h>
24 
25 #include <linux/netlink.h>
26 #include <sys/types.h>
27 #include <map>
28 #include <mutex>
29 
30 namespace android {
31 namespace net {
32 
33 class UidRanges;
34 
35 class RouteController {
36 public:
37     // How the routing table number is determined for route modification requests.
38     enum TableType {
39         INTERFACE,       // Compute the table number based on the interface index.
40         LOCAL_NETWORK,   // A fixed table used for routes to directly-connected clients/peers.
41         LEGACY_NETWORK,  // Use a fixed table that's used to override the default network.
42         LEGACY_SYSTEM,   // A fixed table, only modifiable by system apps; overrides VPNs too.
43     };
44 
45     static const int ROUTE_TABLE_OFFSET_FROM_INDEX = 1000;
46 
47     static const char* const LOCAL_MANGLE_INPUT;
48 
49     static int Init(unsigned localNetId) WARN_UNUSED_RESULT;
50 
51     // Returns an ifindex given the interface name, by looking up in sInterfaceToTable.
52     // This is currently only used by NetworkController::addInterfaceToNetwork
53     // and should probabaly be changed to passing the ifindex into RouteController instead.
54     // We do this instead of calling if_nametoindex because the same interface name can
55     // correspond to different interface indices over time. This way, even if the interface
56     // index has changed, we can still free any map entries indexed by the ifindex that was
57     // used to add them.
58     static uint32_t getIfIndex(const char* interface) EXCLUDES(sInterfaceToTableLock);
59 
60     static int addInterfaceToLocalNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
61     static int removeInterfaceFromLocalNetwork(unsigned netId,
62                                                const char* interface) WARN_UNUSED_RESULT;
63 
64     static int addInterfaceToPhysicalNetwork(unsigned netId, const char* interface,
65                                              Permission permission) WARN_UNUSED_RESULT;
66     static int removeInterfaceFromPhysicalNetwork(unsigned netId, const char* interface,
67                                                   Permission permission) WARN_UNUSED_RESULT;
68 
69     static int addInterfaceToVirtualNetwork(unsigned netId, const char* interface, bool secure,
70                                             const UidRanges& uidRanges) WARN_UNUSED_RESULT;
71     static int removeInterfaceFromVirtualNetwork(unsigned netId, const char* interface, bool secure,
72                                                  const UidRanges& uidRanges) WARN_UNUSED_RESULT;
73 
74     static int modifyPhysicalNetworkPermission(unsigned netId, const char* interface,
75                                                Permission oldPermission,
76                                                Permission newPermission) WARN_UNUSED_RESULT;
77 
78     static int addUsersToVirtualNetwork(unsigned netId, const char* interface, bool secure,
79                                         const UidRanges& uidRanges) WARN_UNUSED_RESULT;
80     static int removeUsersFromVirtualNetwork(unsigned netId, const char* interface, bool secure,
81                                              const UidRanges& uidRanges) WARN_UNUSED_RESULT;
82 
83     static int addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges)
84                                                     WARN_UNUSED_RESULT;
85     static int removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges)
86                                                          WARN_UNUSED_RESULT;
87 
88     static int addInterfaceToDefaultNetwork(const char* interface,
89                                             Permission permission) WARN_UNUSED_RESULT;
90     static int removeInterfaceFromDefaultNetwork(const char* interface,
91                                                  Permission permission) WARN_UNUSED_RESULT;
92 
93     // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
94     // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
95     static int addRoute(const char* interface, const char* destination, const char* nexthop,
96                         TableType tableType) WARN_UNUSED_RESULT;
97     static int removeRoute(const char* interface, const char* destination, const char* nexthop,
98                            TableType tableType) WARN_UNUSED_RESULT;
99 
100     static int enableTethering(const char* inputInterface,
101                                const char* outputInterface) WARN_UNUSED_RESULT;
102     static int disableTethering(const char* inputInterface,
103                                 const char* outputInterface) WARN_UNUSED_RESULT;
104 
105     static int addVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface,
106                                             Permission permission) WARN_UNUSED_RESULT;
107     static int removeVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface,
108                                                Permission permission) WARN_UNUSED_RESULT;
109 
110     // For testing.
111     static int (*iptablesRestoreCommandFunction)(IptablesTarget, const std::string&,
112                                                  const std::string&, std::string *);
113 
114 private:
115     friend class RouteControllerTest;
116 
117     static std::mutex sInterfaceToTableLock;
118     static std::map<std::string, uint32_t> sInterfaceToTable GUARDED_BY(sInterfaceToTableLock);
119 
120     static int configureDummyNetwork();
121     static int flushRoutes(const char* interface) EXCLUDES(sInterfaceToTableLock);
122     static int flushRoutes(uint32_t table);
123     static uint32_t getRouteTableForInterfaceLocked(const char *interface)
124             REQUIRES(sInterfaceToTableLock);
125     static uint32_t getRouteTableForInterface(const char *interface) EXCLUDES(sInterfaceToTableLock);
126     static int modifyDefaultNetwork(uint16_t action, const char* interface, Permission permission);
127     static int modifyPhysicalNetwork(unsigned netId, const char* interface, Permission permission,
128                                      bool add);
129     static int modifyRoute(uint16_t action, const char* interface, const char* destination,
130                            const char* nexthop, TableType tableType);
131     static int modifyTetheredNetwork(uint16_t action, const char* inputInterface,
132                                      const char* outputInterface);
133     static int modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId,
134                                         const char* physicalInterface, Permission permission);
135     static int modifyVirtualNetwork(unsigned netId, const char* interface,
136                                     const UidRanges& uidRanges, bool secure, bool add,
137                                     bool modifyNonUidBasedRules);
138     static void updateTableNamesFile() EXCLUDES(sInterfaceToTableLock);
139 };
140 
141 // Public because they are called by by RouteControllerTest.cpp.
142 // TODO: come up with a scheme of unit testing this code that does not rely on making all its
143 // functions public.
144 int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, const char* destination,
145                   const char* nexthop) WARN_UNUSED_RESULT;
146 int flushRoutes(uint32_t table) WARN_UNUSED_RESULT;
147 uint32_t getRulePriority(const nlmsghdr *nlh);
148 WARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface,
149                                                 Permission permission, bool add);
150 
151 }  // namespace net
152 }  // namespace android
153 
154 #endif  // NETD_SERVER_ROUTE_CONTROLLER_H
155