1 /* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef NETD_SERVER_ROUTE_CONTROLLER_H 18 #define NETD_SERVER_ROUTE_CONTROLLER_H 19 20 #include "NetdConstants.h" 21 #include "Permission.h" 22 23 #include <android-base/thread_annotations.h> 24 25 #include <linux/netlink.h> 26 #include <sys/types.h> 27 #include <map> 28 #include <mutex> 29 30 namespace android { 31 namespace net { 32 33 class UidRanges; 34 35 class RouteController { 36 public: 37 // How the routing table number is determined for route modification requests. 38 enum TableType { 39 INTERFACE, // Compute the table number based on the interface index. 40 LOCAL_NETWORK, // A fixed table used for routes to directly-connected clients/peers. 41 LEGACY_NETWORK, // Use a fixed table that's used to override the default network. 42 LEGACY_SYSTEM, // A fixed table, only modifiable by system apps; overrides VPNs too. 43 }; 44 45 static const int ROUTE_TABLE_OFFSET_FROM_INDEX = 1000; 46 47 static const char* const LOCAL_MANGLE_INPUT; 48 49 static int Init(unsigned localNetId) WARN_UNUSED_RESULT; 50 51 // Returns an ifindex given the interface name, by looking up in sInterfaceToTable. 52 // This is currently only used by NetworkController::addInterfaceToNetwork 53 // and should probabaly be changed to passing the ifindex into RouteController instead. 54 // We do this instead of calling if_nametoindex because the same interface name can 55 // correspond to different interface indices over time. This way, even if the interface 56 // index has changed, we can still free any map entries indexed by the ifindex that was 57 // used to add them. 58 static uint32_t getIfIndex(const char* interface) EXCLUDES(sInterfaceToTableLock); 59 60 static int addInterfaceToLocalNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; 61 static int removeInterfaceFromLocalNetwork(unsigned netId, 62 const char* interface) WARN_UNUSED_RESULT; 63 64 static int addInterfaceToPhysicalNetwork(unsigned netId, const char* interface, 65 Permission permission) WARN_UNUSED_RESULT; 66 static int removeInterfaceFromPhysicalNetwork(unsigned netId, const char* interface, 67 Permission permission) WARN_UNUSED_RESULT; 68 69 static int addInterfaceToVirtualNetwork(unsigned netId, const char* interface, bool secure, 70 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 71 static int removeInterfaceFromVirtualNetwork(unsigned netId, const char* interface, bool secure, 72 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 73 74 static int modifyPhysicalNetworkPermission(unsigned netId, const char* interface, 75 Permission oldPermission, 76 Permission newPermission) WARN_UNUSED_RESULT; 77 78 static int addUsersToVirtualNetwork(unsigned netId, const char* interface, bool secure, 79 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 80 static int removeUsersFromVirtualNetwork(unsigned netId, const char* interface, bool secure, 81 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 82 83 static int addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges) 84 WARN_UNUSED_RESULT; 85 static int removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges) 86 WARN_UNUSED_RESULT; 87 88 static int addInterfaceToDefaultNetwork(const char* interface, 89 Permission permission) WARN_UNUSED_RESULT; 90 static int removeInterfaceFromDefaultNetwork(const char* interface, 91 Permission permission) WARN_UNUSED_RESULT; 92 93 // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a 94 // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address. 95 static int addRoute(const char* interface, const char* destination, const char* nexthop, 96 TableType tableType) WARN_UNUSED_RESULT; 97 static int removeRoute(const char* interface, const char* destination, const char* nexthop, 98 TableType tableType) WARN_UNUSED_RESULT; 99 100 static int enableTethering(const char* inputInterface, 101 const char* outputInterface) WARN_UNUSED_RESULT; 102 static int disableTethering(const char* inputInterface, 103 const char* outputInterface) WARN_UNUSED_RESULT; 104 105 static int addVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface, 106 Permission permission) WARN_UNUSED_RESULT; 107 static int removeVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface, 108 Permission permission) WARN_UNUSED_RESULT; 109 110 // For testing. 111 static int (*iptablesRestoreCommandFunction)(IptablesTarget, const std::string&, 112 const std::string&, std::string *); 113 114 private: 115 friend class RouteControllerTest; 116 117 static std::mutex sInterfaceToTableLock; 118 static std::map<std::string, uint32_t> sInterfaceToTable GUARDED_BY(sInterfaceToTableLock); 119 120 static int configureDummyNetwork(); 121 static int flushRoutes(const char* interface) EXCLUDES(sInterfaceToTableLock); 122 static int flushRoutes(uint32_t table); 123 static uint32_t getRouteTableForInterfaceLocked(const char *interface) 124 REQUIRES(sInterfaceToTableLock); 125 static uint32_t getRouteTableForInterface(const char *interface) EXCLUDES(sInterfaceToTableLock); 126 static int modifyDefaultNetwork(uint16_t action, const char* interface, Permission permission); 127 static int modifyPhysicalNetwork(unsigned netId, const char* interface, Permission permission, 128 bool add); 129 static int modifyRoute(uint16_t action, const char* interface, const char* destination, 130 const char* nexthop, TableType tableType); 131 static int modifyTetheredNetwork(uint16_t action, const char* inputInterface, 132 const char* outputInterface); 133 static int modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId, 134 const char* physicalInterface, Permission permission); 135 static int modifyVirtualNetwork(unsigned netId, const char* interface, 136 const UidRanges& uidRanges, bool secure, bool add, 137 bool modifyNonUidBasedRules); 138 static void updateTableNamesFile() EXCLUDES(sInterfaceToTableLock); 139 }; 140 141 // Public because they are called by by RouteControllerTest.cpp. 142 // TODO: come up with a scheme of unit testing this code that does not rely on making all its 143 // functions public. 144 int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, const char* destination, 145 const char* nexthop) WARN_UNUSED_RESULT; 146 int flushRoutes(uint32_t table) WARN_UNUSED_RESULT; 147 uint32_t getRulePriority(const nlmsghdr *nlh); 148 WARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface, 149 Permission permission, bool add); 150 151 } // namespace net 152 } // namespace android 153 154 #endif // NETD_SERVER_ROUTE_CONTROLLER_H 155