1 /* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef NETD_SERVER_ROUTE_CONTROLLER_H 18 #define NETD_SERVER_ROUTE_CONTROLLER_H 19 20 #include "NetdConstants.h" 21 #include "Permission.h" 22 23 #include <map> 24 #include <sys/types.h> 25 #include <linux/netlink.h> 26 27 namespace android { 28 namespace net { 29 30 class UidRanges; 31 32 class RouteController { 33 public: 34 // How the routing table number is determined for route modification requests. 35 enum TableType { 36 INTERFACE, // Compute the table number based on the interface index. 37 LOCAL_NETWORK, // A fixed table used for routes to directly-connected clients/peers. 38 LEGACY_NETWORK, // Use a fixed table that's used to override the default network. 39 LEGACY_SYSTEM, // A fixed table, only modifiable by system apps; overrides VPNs too. 40 }; 41 42 static const int ROUTE_TABLE_OFFSET_FROM_INDEX = 1000; 43 44 static const char* const LOCAL_MANGLE_INPUT; 45 46 static int Init(unsigned localNetId) WARN_UNUSED_RESULT; 47 48 // Returns an ifindex given the interface name, by looking up in sInterfaceToTable. 49 // This is currently only used by NetworkController::addInterfaceToNetwork 50 // and should probabaly be changed to passing the ifindex into RouteController instead. 51 // We do this instead of calling if_nametoindex because the same interface name can 52 // correspond to different interface indices over time. This way, even if the interface 53 // index has changed, we can still free any map entries indexed by the ifindex that was 54 // used to add them. 55 static uint32_t getIfIndex(const char* interface); 56 57 static int addInterfaceToLocalNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; 58 static int removeInterfaceFromLocalNetwork(unsigned netId, 59 const char* interface) WARN_UNUSED_RESULT; 60 61 static int addInterfaceToPhysicalNetwork(unsigned netId, const char* interface, 62 Permission permission) WARN_UNUSED_RESULT; 63 static int removeInterfaceFromPhysicalNetwork(unsigned netId, const char* interface, 64 Permission permission) WARN_UNUSED_RESULT; 65 66 static int addInterfaceToVirtualNetwork(unsigned netId, const char* interface, bool secure, 67 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 68 static int removeInterfaceFromVirtualNetwork(unsigned netId, const char* interface, bool secure, 69 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 70 71 static int modifyPhysicalNetworkPermission(unsigned netId, const char* interface, 72 Permission oldPermission, 73 Permission newPermission) WARN_UNUSED_RESULT; 74 75 static int addUsersToVirtualNetwork(unsigned netId, const char* interface, bool secure, 76 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 77 static int removeUsersFromVirtualNetwork(unsigned netId, const char* interface, bool secure, 78 const UidRanges& uidRanges) WARN_UNUSED_RESULT; 79 80 static int addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges) 81 WARN_UNUSED_RESULT; 82 static int removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges) 83 WARN_UNUSED_RESULT; 84 85 static int addInterfaceToDefaultNetwork(const char* interface, 86 Permission permission) WARN_UNUSED_RESULT; 87 static int removeInterfaceFromDefaultNetwork(const char* interface, 88 Permission permission) WARN_UNUSED_RESULT; 89 90 // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a 91 // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address. 92 static int addRoute(const char* interface, const char* destination, const char* nexthop, 93 TableType tableType) WARN_UNUSED_RESULT; 94 static int removeRoute(const char* interface, const char* destination, const char* nexthop, 95 TableType tableType) WARN_UNUSED_RESULT; 96 97 static int enableTethering(const char* inputInterface, 98 const char* outputInterface) WARN_UNUSED_RESULT; 99 static int disableTethering(const char* inputInterface, 100 const char* outputInterface) WARN_UNUSED_RESULT; 101 102 static int addVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface, 103 Permission permission) WARN_UNUSED_RESULT; 104 static int removeVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface, 105 Permission permission) WARN_UNUSED_RESULT; 106 107 // For testing. 108 static int (*iptablesRestoreCommandFunction)(IptablesTarget, const std::string&, 109 const std::string&, std::string *); 110 111 private: 112 friend class RouteControllerTest; 113 114 // Protects access to interfaceToTable. 115 static android::RWLock sInterfaceToTableLock; 116 static std::map<std::string, uint32_t> sInterfaceToTable; 117 118 static int configureDummyNetwork(); 119 static int flushRoutes(const char* interface); 120 static int flushRoutes(uint32_t table); 121 static uint32_t getRouteTableForInterfaceLocked(const char *interface); 122 static uint32_t getRouteTableForInterface(const char *interface); 123 static int modifyDefaultNetwork(uint16_t action, const char* interface, Permission permission); 124 static int modifyPhysicalNetwork(unsigned netId, const char* interface, Permission permission, 125 bool add); 126 static int modifyRoute(uint16_t action, const char* interface, const char* destination, 127 const char* nexthop, TableType tableType); 128 static int modifyTetheredNetwork(uint16_t action, const char* inputInterface, 129 const char* outputInterface); 130 static int modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId, 131 const char* physicalInterface, Permission permission); 132 static int modifyVirtualNetwork(unsigned netId, const char* interface, 133 const UidRanges& uidRanges, bool secure, bool add, 134 bool modifyNonUidBasedRules); 135 static void updateTableNamesFile(); 136 }; 137 138 // Public because they are called by by RouteControllerTest.cpp. 139 // TODO: come up with a scheme of unit testing this code that does not rely on making all its 140 // functions public. 141 int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, const char* destination, 142 const char* nexthop) WARN_UNUSED_RESULT; 143 int flushRoutes(uint32_t table) WARN_UNUSED_RESULT; 144 uint32_t getRulePriority(const nlmsghdr *nlh); 145 WARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface, 146 Permission permission, bool add); 147 148 } // namespace net 149 } // namespace android 150 151 #endif // NETD_SERVER_ROUTE_CONTROLLER_H 152