1 /* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #pragma once 18 19 #include "NetdConstants.h" // IptablesTarget 20 #include "Network.h" // UidRangeMap 21 #include "Permission.h" 22 23 #include <android-base/thread_annotations.h> 24 25 #include <linux/netlink.h> 26 #include <sys/types.h> 27 #include <map> 28 #include <mutex> 29 30 namespace android::net { 31 32 // clang-format off 33 const uint32_t RULE_PRIORITY_VPN_OVERRIDE_SYSTEM = 10000; 34 const uint32_t RULE_PRIORITY_VPN_OVERRIDE_OIF = 11000; 35 const uint32_t RULE_PRIORITY_VPN_OUTPUT_TO_LOCAL = 12000; 36 const uint32_t RULE_PRIORITY_SECURE_VPN = 13000; 37 const uint32_t RULE_PRIORITY_PROHIBIT_NON_VPN = 14000; 38 // Rules used when applications explicitly select a network that they have permission to use only 39 // because they are in the list of UID ranges for that network. 40 // 41 // Sockets from these UIDs will not match RULE_PRIORITY_EXPLICIT_NETWORK rules because they will 42 // not have the necessary permission bits in the fwmark. We cannot just give any socket on any of 43 // these networks the permission bits, because if the UID that created the socket loses access to 44 // the network, then the socket must not match any rule that selects that network. 45 const uint32_t RULE_PRIORITY_UID_EXPLICIT_NETWORK = 15000; 46 const uint32_t RULE_PRIORITY_EXPLICIT_NETWORK = 16000; 47 const uint32_t RULE_PRIORITY_OUTPUT_INTERFACE = 17000; 48 const uint32_t RULE_PRIORITY_LEGACY_SYSTEM = 18000; 49 const uint32_t RULE_PRIORITY_LEGACY_NETWORK = 19000; 50 const uint32_t RULE_PRIORITY_LOCAL_NETWORK = 20000; 51 const uint32_t RULE_PRIORITY_TETHERING = 21000; 52 // Implicit rules for sockets that connected on a given network because the network was the default 53 // network for the UID. 54 const uint32_t RULE_PRIORITY_UID_IMPLICIT_NETWORK = 22000; 55 const uint32_t RULE_PRIORITY_IMPLICIT_NETWORK = 23000; 56 const uint32_t RULE_PRIORITY_BYPASSABLE_VPN = 24000; 57 // reserved for RULE_PRIORITY_UID_VPN_FALLTHROUGH = 25000; 58 const uint32_t RULE_PRIORITY_VPN_FALLTHROUGH = 26000; 59 const uint32_t RULE_PRIORITY_UID_DEFAULT_NETWORK = 27000; 60 // Rule used when framework wants to disable default network from specified applications. There will 61 // be a small interval the same uid range exists in both UID_DEFAULT_UNREACHABLE and 62 // UID_DEFAULT_NETWORK when framework is switching user preferences. 63 // 64 // framework --> netd 65 // step 1: set uid to unreachable network 66 // step 2: remove uid from OEM-paid network list 67 // or 68 // step 1: add uid to OEM-paid network list 69 // step 2: remove uid from unreachable network 70 // 71 // The priority is lower than UID_DEFAULT_NETWORK. Otherwise, the app will be told by 72 // ConnectivityService that it has a network in step 1 of the second case. But if it tries to use 73 // the network, it will not work. That will potentially cause a user-visible error. 74 const uint32_t RULE_PRIORITY_UID_DEFAULT_UNREACHABLE = 28000; 75 const uint32_t RULE_PRIORITY_DEFAULT_NETWORK = 29000; 76 const uint32_t RULE_PRIORITY_UNREACHABLE = 32000; 77 // clang-format on 78 79 class UidRanges; 80 81 class RouteController { 82 public: 83 // How the routing table number is determined for route modification requests. 84 enum TableType { 85 INTERFACE, // Compute the table number based on the interface index. 86 LOCAL_NETWORK, // A fixed table used for routes to directly-connected clients/peers. 87 LEGACY_NETWORK, // Use a fixed table that's used to override the default network. 88 LEGACY_SYSTEM, // A fixed table, only modifiable by system apps; overrides VPNs too. 89 }; 90 91 static const int ROUTE_TABLE_OFFSET_FROM_INDEX = 1000; 92 93 static const char* const LOCAL_MANGLE_INPUT; 94 95 [[nodiscard]] static int Init(unsigned localNetId); 96 97 // Returns an ifindex given the interface name, by looking up in sInterfaceToTable. 98 // This is currently only used by NetworkController::addInterfaceToNetwork 99 // and should probabaly be changed to passing the ifindex into RouteController instead. 100 // We do this instead of calling if_nametoindex because the same interface name can 101 // correspond to different interface indices over time. This way, even if the interface 102 // index has changed, we can still free any map entries indexed by the ifindex that was 103 // used to add them. 104 static uint32_t getIfIndex(const char* interface) EXCLUDES(sInterfaceToTableLock); 105 106 [[nodiscard]] static int addInterfaceToLocalNetwork(unsigned netId, const char* interface); 107 [[nodiscard]] static int removeInterfaceFromLocalNetwork(unsigned netId, const char* interface); 108 109 [[nodiscard]] static int addInterfaceToPhysicalNetwork(unsigned netId, const char* interface, 110 Permission permission, 111 const UidRangeMap& uidRangeMap); 112 [[nodiscard]] static int removeInterfaceFromPhysicalNetwork(unsigned netId, 113 const char* interface, 114 Permission permission, 115 const UidRangeMap& uidRangeMap); 116 117 [[nodiscard]] static int addInterfaceToVirtualNetwork(unsigned netId, const char* interface, 118 bool secure, 119 const UidRangeMap& uidRangeMap); 120 [[nodiscard]] static int removeInterfaceFromVirtualNetwork(unsigned netId, 121 const char* interface, bool secure, 122 const UidRangeMap& uidRangeMap); 123 124 [[nodiscard]] static int modifyPhysicalNetworkPermission(unsigned netId, const char* interface, 125 Permission oldPermission, 126 Permission newPermission); 127 128 [[nodiscard]] static int addUsersToVirtualNetwork(unsigned netId, const char* interface, 129 bool secure, const UidRangeMap& uidRangeMap); 130 [[nodiscard]] static int removeUsersFromVirtualNetwork(unsigned netId, const char* interface, 131 bool secure, 132 const UidRangeMap& uidRangeMap); 133 134 [[nodiscard]] static int addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges); 135 [[nodiscard]] static int removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges); 136 137 [[nodiscard]] static int addInterfaceToDefaultNetwork(const char* interface, 138 Permission permission); 139 [[nodiscard]] static int removeInterfaceFromDefaultNetwork(const char* interface, 140 Permission permission); 141 142 // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a 143 // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address. 144 [[nodiscard]] static int addRoute(const char* interface, const char* destination, 145 const char* nexthop, TableType tableType, int mtu); 146 [[nodiscard]] static int removeRoute(const char* interface, const char* destination, 147 const char* nexthop, TableType tableType); 148 [[nodiscard]] static int updateRoute(const char* interface, const char* destination, 149 const char* nexthop, TableType tableType, int mtu); 150 151 [[nodiscard]] static int enableTethering(const char* inputInterface, 152 const char* outputInterface); 153 [[nodiscard]] static int disableTethering(const char* inputInterface, 154 const char* outputInterface); 155 156 [[nodiscard]] static int addVirtualNetworkFallthrough(unsigned vpnNetId, 157 const char* physicalInterface, 158 Permission permission); 159 [[nodiscard]] static int removeVirtualNetworkFallthrough(unsigned vpnNetId, 160 const char* physicalInterface, 161 Permission permission); 162 163 [[nodiscard]] static int addUsersToPhysicalNetwork(unsigned netId, const char* interface, 164 const UidRangeMap& uidRangeMap); 165 166 [[nodiscard]] static int removeUsersFromPhysicalNetwork(unsigned netId, const char* interface, 167 const UidRangeMap& uidRangeMap); 168 169 [[nodiscard]] static int addUsersToUnreachableNetwork(unsigned netId, 170 const UidRangeMap& uidRangeMap); 171 172 [[nodiscard]] static int removeUsersFromUnreachableNetwork(unsigned netId, 173 const UidRangeMap& uidRangeMap); 174 175 // For testing. 176 static int (*iptablesRestoreCommandFunction)(IptablesTarget, const std::string&, 177 const std::string&, std::string *); 178 179 private: 180 friend class RouteControllerTest; 181 182 static std::mutex sInterfaceToTableLock; 183 static std::map<std::string, uint32_t> sInterfaceToTable GUARDED_BY(sInterfaceToTableLock); 184 185 static int configureDummyNetwork(); 186 [[nodiscard]] static int flushRoutes(const char* interface) EXCLUDES(sInterfaceToTableLock); 187 [[nodiscard]] static int flushRoutes(uint32_t table); 188 static uint32_t getRouteTableForInterfaceLocked(const char* interface) 189 REQUIRES(sInterfaceToTableLock); 190 static uint32_t getRouteTableForInterface(const char *interface) EXCLUDES(sInterfaceToTableLock); 191 static int modifyDefaultNetwork(uint16_t action, const char* interface, Permission permission); 192 static int modifyPhysicalNetwork(unsigned netId, const char* interface, 193 const UidRangeMap& uidRangeMap, Permission permission, 194 bool add, bool modifyNonUidBasedRules); 195 static int modifyUnreachableNetwork(unsigned netId, const UidRangeMap& uidRangeMap, bool add); 196 static int modifyRoute(uint16_t action, uint16_t flags, const char* interface, 197 const char* destination, const char* nexthop, TableType tableType, 198 int mtu); 199 static int modifyTetheredNetwork(uint16_t action, const char* inputInterface, 200 const char* outputInterface); 201 static int modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId, 202 const char* physicalInterface, Permission permission); 203 static int modifyVirtualNetwork(unsigned netId, const char* interface, 204 const UidRangeMap& uidRangeMap, bool secure, bool add, 205 bool modifyNonUidBasedRules); 206 static void updateTableNamesFile() EXCLUDES(sInterfaceToTableLock); 207 }; 208 209 // Public because they are called by by RouteControllerTest.cpp. 210 // TODO: come up with a scheme of unit testing this code that does not rely on making all its 211 // functions public. 212 [[nodiscard]] int modifyIpRoute(uint16_t action, uint16_t flags, uint32_t table, 213 const char* interface, const char* destination, const char* nexthop, 214 uint32_t mtu); 215 uint32_t getRulePriority(const nlmsghdr *nlh); 216 [[nodiscard]] int modifyIncomingPacketMark(unsigned netId, const char* interface, 217 Permission permission, bool add); 218 219 } // namespace android::net 220