OSDN Git Service
Sreeram Ramachandran [Fri, 11 Jul 2014 22:29:49 +0000 (22:29 +0000)]
Merge "Add default routing tables to rt_tables."
Sreeram Ramachandran [Fri, 11 Jul 2014 18:45:14 +0000 (11:45 -0700)]
Add default routing tables to rt_tables.
This is so that these tables also get dumped by bugreport / dumpstate.
Change-Id: Ia5ed8a23911d7b34ba964934dec42849f4a73824
Sreeram Ramachandran [Fri, 11 Jul 2014 16:10:20 +0000 (09:10 -0700)]
Fix tethering in the case of a regular upstream connection.
Fixes tethering via Ethernet, Bluetooth and WiFi (hotspot).
Tethering when the upstream has a DUN-specific APN is likely still broken
(untested).
For now, assign a fixed NetId (a hack) until we can change the framework to
create a valid NetworkAgent and all that jazz.
Bug:
15968336
Bug:
14988803
Change-Id: Idcf4d492d9329a9c87913e27be6dd835a792bea2
Sreeram Ramachandran [Wed, 9 Jul 2014 14:39:30 +0000 (07:39 -0700)]
Cosmetic: Move constants into file scope.
Change-Id: Ic1398a5867693bb8f1e588e727869ec6a4574432
Sreeram Ramachandran [Tue, 8 Jul 2014 05:11:37 +0000 (22:11 -0700)]
Add symbolic table names for routing table numbers.
This makes the output from "ip rule" much more readable.
Companion changes are in AOSP.
Change-Id: I69deb1a64d5d6647470823405bf0cc55b24b22de
Sreeram Ramachandran [Sun, 6 Jul 2014 00:15:14 +0000 (17:15 -0700)]
Add full support for UIDs in VPNs.
Major:
+ Implement the functions mentioned in http://go/android-multinetwork-routing
correctly, including handling accept(), connect(), setNetworkForSocket()
and protect() and supporting functions like canUserSelectNetwork().
+ Eliminate the old code path of getting/setting UID ranges through
SecondaryTableController (which is currently unused) and mUidMap.
Minor:
+ Rename some methods/variables for clarity and consistency.
+ Moved some methods in .cpp files to match declaration order in the .h files.
Bug:
15409918
Change-Id: Ic6ce3646c58cf645db0d9a53cbeefdd7ffafff93
Sreeram Ramachandran [Thu, 3 Jul 2014 19:20:48 +0000 (12:20 -0700)]
Update routing rules.
As per the latest changes to: http://go/android-multinetwork-routing
Functional changes:
+ Add explicit=NO to the implicit network rules, though it's a no-op.
+ Remove most of the UID=0 (kernel access) rules since they are no longer
needed, except in one case to allow access to a VPN.
+ Add the explicit, protect and permissions bits to the incoming packet mark.
+ VPNs now don't need an implicit network rule.
+ Modifying network permissions now modifies the incoming packet mark as well.
Cosmetic changes:
+ Renamed the legacy tables to match their permissions (SYSTEM and NETWORK).
+ Renamed most functions and methods for clarity and consistency.
+ Renamed and adjusted some ule priorities.
+ Move most rule modifications into their own functions, to prevent brittle
reliance on the previous state of the fwmark/mask variables.
Change-Id: I958a7e158ee918d5254de606fcfa55fe23327438
Sreeram Ramachandran [Sat, 5 Jul 2014 19:31:05 +0000 (12:31 -0700)]
Fix permissions handling.
+ Rename the permissions as per: http://go/android-multinetwork-routing
+ Make the SYSTEM permission explicitly include NETWORK.
+ Grant the SYSTEM permission to system UIDs by default, but allow the framework
to override them if necessary.
+ Move the "string to permission" parsing to CommandListener.cpp, thus allowing
us to get rid of Permission.cpp.
+ There's no need to support multiple permissions string arguments, so tighten
that up.
Change-Id: I73d51b5e2f44a97e6d5ab5943ff198cebfbcc0c4
Sreeram Ramachandran [Sat, 5 Jul 2014 18:00:55 +0000 (11:00 -0700)]
Only add permissions in accept(); do not try to enforce anything.
Previously, we were enforcing that the user has access to the network over which
the socket is accepted. This has two problems:
1. We weren't handling the loopback interface ('lo') correctly. It's not part of
any network, so the NetId in the fwmark is NETID_UNSET. In
NetworkController::isUserPermittedOnNetwork(), we would fail to find a valid
network, and so we would return false.
2. We have decided that in fact, we don't want to enforce this even for other
interfaces, due to the SYN-ACK problem. See the comments and discussion at:
http://go/android-multinetwork-routing
Bug:
16079376
Change-Id: I3f07f67d06dd7b48bfdfa5616ee22e098e31f8af
Sreeram Ramachandran [Thu, 3 Jul 2014 01:06:34 +0000 (18:06 -0700)]
Fix regressions in flushRoutes().
http://ag/486276 left out a comma, causing the command to be "routeflush" (which
is invalid), instead of the correct "route flush".
http://ag/495068 changed the order, causing the interface to be removed from the
interfaceToIndex map before we are done using it in modifyPerNetworkRules().
Change-Id: I65af0b5763b13e47b48e7e2b81d243dc19e1a03b
Sreeram Ramachandran [Wed, 2 Jul 2014 21:49:33 +0000 (14:49 -0700)]
Minor style change.
Change-Id: Ib1f89bff55506cf3881047dd876adbf97c789423
Sreeram Ramachandran [Wed, 2 Jul 2014 17:09:49 +0000 (10:09 -0700)]
Keep track of users allowed to call protect() explicitly.
This is an API change between ConnectivityService and Netd.
The ownerUid was meant for this purpose, but it's insufficient, as apps need to
call protect() _before_ they create a VPN.
Bug:
15409918
Change-Id: If804aa106002e96d5ffb623d32db35fd76928367
Sreeram Ramachandran [Wed, 2 Jul 2014 02:01:56 +0000 (19:01 -0700)]
Cosmetic: Add a way to query the type of a network.
This is a cosmetic change, i.e., there's no change in functionality.
This is the poor man's RTTI. It turns out that maintaining separate lists (or
maps) of the different types of networks gets burdensome pretty quickly
(especially in an upcoming CL where we add functions like
canUserSelectNetwork()).
Change-Id: If5250c0fc106045f681d0fd71278b793addbe1e3
Sreeram Ramachandran [Tue, 1 Jul 2014 21:30:30 +0000 (14:30 -0700)]
Fix routing rules.
Fix the rules in RouteController as per the latest iteration of the routing
design: http://go/android-multinetwork-routing. Changes include:
+ The legacy tables have to be global. So remove the UID being passed in to
modifyRoute() and remove the associated TODOs.
+ Add UID=0 rules to let the kernel access routes on privileged networks.
+ Add a UID=0 clause to the directly-connected hack, thus fixing the TODO.
+ Add the privileged_legacy table just above the legacy table, when overriding
the default network. (The same table remains added at the top of the rule
chain, to override VPNs, but only for CONNECTIVITY_INTERNAL-privileged apps).
Other cosmetic changes:
+ Update the names and values of the rule priorities.
+ Move the legacy table IDs to the .h file in anticipation of using them from
bugreport / dump commands.
+ Make 'action' the first parameter consistently.
Change-Id: I6634a19ddc8062b2ef55d926c7892fff8c586106
Sreeram Ramachandran [Tue, 1 Jul 2014 22:49:20 +0000 (15:49 -0700)]
Don't use %zu for uid_t. It's always unsigned int, so %u is correct.
Change-Id: I5be1d479b524495037c2aedc8336c794d2698914
Sreeram Ramachandran [Tue, 1 Jul 2014 22:06:05 +0000 (15:06 -0700)]
Use %zu to printf size_t correctly on both 32-bit and 64-bit platforms.
Change-Id: I5223e574084fca47606b844d74a99a642c7d66be
Sreeram Ramachandran [Tue, 24 Jun 2014 01:54:27 +0000 (18:54 -0700)]
Add UID range support to VPNs.
This adds the necessary routing rules.
Future CLs will add the ability to select the right netId for connect(),
setNetworkForSocket(), DNS resolutions, etc.
Bug:
15409918
Change-Id: I88a67660d49cecda834dd72ab947fbfed250f09d
Sreeram Ramachandran [Mon, 23 Jun 2014 19:41:37 +0000 (12:41 -0700)]
Introduce VPN support.
This change sets up the basic routing rules for VPNs. It doesn't yet handle UID
ranges (that are meant to apply to the VPN) correctly. That's forthcoming in
other CLs.
Bug:
15409918
Change-Id: I284de04f176dcf6ba702361de6a614266256d04e
Sreeram Ramachandran [Mon, 23 Jun 2014 16:54:06 +0000 (09:54 -0700)]
Refactor: Encapsulate permissions and interfaces into a Network class.
Currently, there's a lot of logic in NetworkController surrounding events such
as interface addition/removal, network creation/destruction and default network
change, because these events are interwined. For example, adding an interface
means also adding a corresponding default network rule if the interface is being
added to the current default network.
When we introduce VPNs into this mix, things will get hairy real quick for all
this logic in NetworkController.
In this refactor, we introduce an abstract base class Network which supports
adding and removing interfaces. The main concrete implementation of this is
PhysicalNetwork, which allows setting permissions and "default network" state.
Since we've moved network permissions into the above class, and user permissions
into NetworkController, PermissionsController is unused and has been removed.
Also fix a few bugs in RouteController:
+ Use uidEnd correctly.
+ Check for all error cases in inet_pton.
+ Check the return value of android_fork_execvp() correctly.
+ The "return cmd1() && cmd2()" pattern is wrong. Rewrite that code.
Also (non-functional changes):
+ Remove instantiations of RouteController. It has static methods only.
+ Reorder some blocks in CommandListener so that the most frequent commands are
checked first.
+ Remove unused paramError() and clearNetworkPreference().
+ Change all return codes to int (negative errno) wherever applicable.
+ Add WARN_UNUSED_RESULT everywhere.
+ Cleanup some style in RouteController and NetworkController.
+ Use uid_t instead of unsigned for user IDs.
+ Add clearer log messages at the source of failures.
+ Add a check for when fwmark bits are set without corresponding mask bits.
Bug:
15409918
Change-Id: Ibba78b0850160f9f3d17d476f16331a6db0025d1
Sreeram Ramachandran [Fri, 27 Jun 2014 13:42:11 +0000 (06:42 -0700)]
Don't fail when adding a duplicate legacy route.
This only affects calls to requestRouteToHost() by apps. We still fail if the
framework itself tries to add a non-legacy duplicate route, since the framework
should know better (we can consider relaxing that too in the future).
Bug:
15925532
Change-Id: I9ee434277e462d570f88e6fe63a096e5ae41eee9
Lorenzo Colitti [Thu, 26 Jun 2014 04:51:10 +0000 (13:51 +0900)]
Convert rta_* and fra_* variable names to camelCase.
Change-Id: I0ca539ac4c54bb71b033f288fb4229afd71b7989
Lorenzo Colitti [Tue, 24 Jun 2014 18:20:29 +0000 (03:20 +0900)]
Support adding and removing UID rules via netlink.
Change-Id: Idae13bceda869261689260759084b8d6ef1ff639
Lorenzo Colitti [Mon, 23 Jun 2014 06:09:54 +0000 (15:09 +0900)]
Pass rule modification errors back to CommandListener.
Change-Id: If01334dccad8b6230648713a57fd58be180ac66b
Lorenzo Colitti [Fri, 20 Jun 2014 14:03:29 +0000 (23:03 +0900)]
Use netlink to add/delete rules as well as routes.
Also change the indentation of the rtattrs used in modifyIpRoute
to make it easier to see what attributes are being used and in
what sequence.
This change does not yet pass the errors back to CommandListener;
that is done in the next change in the series.
Change-Id: Ib2e174386c63cb0647d838d9c7d731cd6df39c4f
Sreeram Ramachandran [Tue, 24 Jun 2014 23:09:21 +0000 (16:09 -0700)]
Unrevert the 'revert the "talk to netlink directly" change.'
http://ag/486277 was reverted in http://ag/491263 and is being unreverted in
this change. The bug in the original CL was a typo ("interface" instead of the
desired "ifindex"), which is now fixed.
Bug:
15840054
Change-Id: If66987c74cc86e9ba4f7a35d36f0a39afe939a68
Sreeram Ramachandran [Tue, 24 Jun 2014 22:03:52 +0000 (15:03 -0700)]
Temporarily revert the "talk to netlink directly" change.
The change being reverted is http://ag/486277. Instead, use /sbin/ip again. The
code to talk to netlink fails on volantis. I.e., instead of this:
$ ip route show table 1006
default via 100.110.191.254 dev wlan0
100.110.128.0/18 dev wlan0 scope link
we end up with this:
$ ip route show table 1006
default dev wlan0 proto static
100.110.128.0/18 dev wlan0 proto static
Notice the lack of the nexthop and the addition of "proto static". I think the
netlink message is somehow not properly aligned on volantis, causing the kernel
to misinterpret it.
Bug:
15840054
Change-Id: Ief60473e337410f7cb35890de0a5a74a21723a41
Sasha Levitskiy [Mon, 23 Jun 2014 17:51:05 +0000 (10:51 -0700)]
Netd: Interface controller: Demote a log message severity from warning to verbose.
Change-Id: Ia8b2e6a0b039c2bda418a5f7138c0aac6b6c643b
Signed-off-by: Sasha Levitskiy <sanek@google.com>
Lorenzo Colitti [Mon, 23 Jun 2014 16:41:13 +0000 (16:41 +0000)]
Merge "Pass route add/delete errors back to CommandListener."
Sreeram Ramachandran [Sun, 22 Jun 2014 18:02:57 +0000 (11:02 -0700)]
Return negative errno (instead of positive) on failure.
http://ag/489245 changed some return values from bools to errno values. However,
in forthcoming CLs, @lorenzo uses the convention of negative errno to indicate
failure. So, be consistent with that style.
Change-Id: I3eac8f142c36a2e779cda289c07ee374c49e2f6b
Lorenzo Colitti [Tue, 17 Jun 2014 15:41:58 +0000 (00:41 +0900)]
Pass route add/delete errors back to CommandListener.
Change-Id: Id1d6d578963080e141f71bc1303801fc53bce40a
Lorenzo Colitti [Tue, 17 Jun 2014 15:22:17 +0000 (00:22 +0900)]
Use native netlink code instead of /sbin/ip to manipulate routes
Shelling out to /sbin/ip is slow, and more importantly it does
not preserve the error messages returned by the kernel when
adding or deleting a route fails. Instead, use netlink directly.
This change does not yet pass the errors back to CommandListener;
that is done in the next change in the series.
Change-Id: I5ad3c8583580857be6386a620ff5c4f3872d685b
Lorenzo Colitti [Thu, 12 Jun 2014 04:51:05 +0000 (13:51 +0900)]
Notify network observers of route changes.
This reverts commit
20d3f5e856a38ef22851e32d7f9b6a7cd02eb459.
Bug:
9180552
Change-Id: I004448e2f0c731f6ca2c6d3535dc4dd51a622293
Sreeram Ramachandran [Fri, 20 Jun 2014 18:59:40 +0000 (11:59 -0700)]
Add getNetworkForSocket().
This doesn't require a roundtrip to netd, since anybody can read the SO_MARK.
Change-Id: I51dd17725c4534cb0d5dbc8e93e844e6a7847959
Sreeram Ramachandran [Fri, 20 Jun 2014 18:51:48 +0000 (11:51 -0700)]
Return errors explicitly instead of using errno.
Change-Id: Ia29f500e747a8c72d13a8f38c3b08c319c8c029a
Sreeram Ramachandran [Fri, 20 Jun 2014 17:23:46 +0000 (17:23 +0000)]
Merge "Add a client API to protect a socket from VPNs."
Lorenzo Colitti [Fri, 20 Jun 2014 07:03:19 +0000 (07:03 +0000)]
Merge "Revert "Notify network observers of route changes.""
Lorenzo Colitti [Fri, 20 Jun 2014 07:02:36 +0000 (07:02 +0000)]
Revert "Notify network observers of route changes."
This reverts commit
d2f23fb6285000831f14cacc16881d96f6046c33.
Change-Id: Ifabbc6848ab33842461465fccb9886863a08aec6
Lorenzo Colitti [Thu, 12 Jun 2014 04:51:05 +0000 (13:51 +0900)]
Notify network observers of route changes.
Bug:
9180552
Change-Id: Ic23025e4d7cb4e58ae59017777267ac45f00b434
Lorenzo Colitti [Fri, 20 Jun 2014 06:02:48 +0000 (06:02 +0000)]
Merge "Flush both IPv4 and IPv6 routes."
Lorenzo Colitti [Tue, 17 Jun 2014 07:14:17 +0000 (16:14 +0900)]
Flush both IPv4 and IPv6 routes.
The current code unintentionally flushes only IPv4 routes
because it reuses a function that is normally used to add and
remove routes (where the IP version is implicitly specified by
the route to add or remove).
Instead of fixing the runIpRouteCommand function, add a new
flushIpRoutes function because runIpRouteCommand will be
replaced by a netlink implementation in an upcoming CL.
Change-Id: Ie96ae4124baca3edb8e0d0841e7abadb6b3ee9ab
Lorenzo Colitti [Fri, 20 Jun 2014 05:52:15 +0000 (05:52 +0000)]
Merge "Notify network observers of route changes."
JP Abgrall [Fri, 20 Jun 2014 01:35:24 +0000 (18:35 -0700)]
server: check interface names in RPC arguments for validity
This patch introduces a method isIfaceName that checks interface
names from various RPCs for validity before e.g. using them as
part of iptables arguments or in filenames.
All of these RPC calls can only be called from applications
with at least the CONNECTIVITY_INTERNAL permission in recent
Android versions, so the impact of the missing checks luckily
isn't very high.
Orig-Author: Jann Horn <jann@thejh.net>
Change-Id: I80df8d745a3de99ad02d6649f0d10562c81f6b98
Signed-off-by: JP Abgrall <jpa@google.com>
Sreeram Ramachandran [Thu, 19 Jun 2014 17:03:07 +0000 (10:03 -0700)]
Add a client API to protect a socket from VPNs.
The server side hasn't been implemented yet (see FwmarkServer.cpp).
A UID can only be in a single VPN at any time, so there's no need
to specify a netId or vpnId.
Change-Id: Ie9c4590a9900e1ebf28418c4b9c4760cc0a5501a
Paul Jensen [Thu, 12 Jun 2014 20:46:37 +0000 (16:46 -0400)]
Cache interface indices in case interfaces go away.
Without caching them netd will fail to remove rules and routes,
for example, when the Bluetooth reverse-tether interface ("bt-pan")
goes away.
bug:
15407087
Change-Id: I99fcf00f9645a0b029455516a705b70110f62ff6
Lorenzo Colitti [Fri, 13 Jun 2014 02:35:29 +0000 (02:35 +0000)]
Merge "Pass a socket mark to clatd so it can bind to its network."
Lorenzo Colitti [Mon, 9 Jun 2014 05:09:20 +0000 (14:09 +0900)]
Pass a socket mark to clatd so it can bind to its network.
Bug:
15340961
Change-Id: If15e90cbd5526f6c8fd839d4d009846d64d9e77a
Paul Jensen [Thu, 12 Jun 2014 19:56:50 +0000 (19:56 +0000)]
am
b72f6d71: (-s ours) DO NOT MERGE: Fix use-after-free of interface name during network destruction.
* commit '
b72f6d71840afeb1923f64f8c44417f4f208c282':
DO NOT MERGE: Fix use-after-free of interface name during network destruction.
Paul Jensen [Wed, 11 Jun 2014 14:58:16 +0000 (10:58 -0400)]
DO NOT MERGE: Fix use-after-free of interface name during network destruction.
bug:
15560990
Change-Id: I899827c4f50847a3a60b6359f829bee5d6eb4f00
(cherry picked from commit
6ff16785ae1f67f44a73ad00d6c86690af6772d2)
Paul Jensen [Wed, 11 Jun 2014 14:58:16 +0000 (10:58 -0400)]
Fix use-after-free of interface name during network destruction.
bug:
15560990
Change-Id: I899827c4f50847a3a60b6359f829bee5d6eb4f00
Sreeram Ramachandran [Fri, 6 Jun 2014 15:50:13 +0000 (15:50 +0000)]
am
41417388: (-s ours) Use AF_INET sockets when checking netIds in setNetworkFor{Process,Resolv}(). DO NOT MERGE
* commit '
414173882a87ded2fdd4f5181cd7dff3842a8917':
Use AF_INET sockets when checking netIds in setNetworkFor{Process,Resolv}(). DO NOT MERGE
Dan Albert [Thu, 5 Jun 2014 20:33:08 +0000 (20:33 +0000)]
am
d42cdf50: am
437eb9c3: Merge "Changes uses of index() to strchr()"
* commit '
d42cdf50ab883acb74b17d63646f0228d881df3c':
Changes uses of index() to strchr()
Dan Albert [Thu, 5 Jun 2014 20:29:33 +0000 (20:29 +0000)]
am
437eb9c3: Merge "Changes uses of index() to strchr()"
* commit '
437eb9c3092c96c1828e326edb6574090fe37aaa':
Changes uses of index() to strchr()
Dan Albert [Thu, 5 Jun 2014 19:55:52 +0000 (19:55 +0000)]
Merge "Changes uses of index() to strchr()"
Dan Albert [Thu, 5 Jun 2014 18:35:41 +0000 (11:35 -0700)]
Changes uses of index() to strchr()
Bionic is geting rid of index() because it was removed from POSIX 2008.
Change-Id: I182523734f372d1c6ed052b1373422332587f8ff
Sreeram Ramachandran [Tue, 3 Jun 2014 19:51:08 +0000 (12:51 -0700)]
Use std::atomic<> instead of volatile sig_atomic_t.
std::atomic<> comes with true load/store barriers, so it's preferable.
Change-Id: Ife47b0e404f41aa74aeb168befd1ff4a6603f3ed
Sreeram Ramachandran [Tue, 3 Jun 2014 00:47:36 +0000 (17:47 -0700)]
Remove unnecessary includes.
Neither of these actually does anything.
Change-Id: I82ee09a4565a8e8e4dc5f54f278bf83e002d7387
Paul Jensen [Tue, 3 Jun 2014 17:24:46 +0000 (17:24 +0000)]
Merge "Pass NetID to clatd as a command line argument."
Paul Jensen [Fri, 30 May 2014 17:29:41 +0000 (13:29 -0400)]
Pass NetID to clatd as a command line argument.
Change-Id: I77a47b24e68c7786f790974f05787a40a4934af5
Sreeram Ramachandran [Sat, 31 May 2014 02:59:51 +0000 (19:59 -0700)]
Use AF_INET sockets when checking netIds in setNetworkFor{Process,Resolv}(). DO NOT MERGE
AF_UNIX sockets don't need to be marked, so we don't give netd the permission to
operate on them (cf: netd.te). I.e., netd doesn't expect to receive them.
Make sure that the creation of the AF_INET socket doesn't trigger another
wasteful check with netd by calling the libc version directly.
Bug:
13885501
Change-Id: I6b549232e57cacd47501edcefa4c0b4b79df9da0
(cherry picked from commit
2756045bebaac342f7cb70dad11519f896d44833)
Sreeram Ramachandran [Sat, 31 May 2014 02:59:51 +0000 (19:59 -0700)]
Use AF_INET sockets when checking netIds in setNetworkFor{Process,Resolv}().
AF_UNIX sockets don't need to be marked, so we don't give netd the permission to
operate on them (cf: netd.te). I.e., netd doesn't expect to receive them.
Make sure that the creation of the AF_INET socket doesn't trigger another
wasteful check with netd by calling the libc version directly.
Bug:
13885501
Change-Id: I6b549232e57cacd47501edcefa4c0b4b79df9da0
Sreeram Ramachandran [Fri, 30 May 2014 22:11:54 +0000 (15:11 -0700)]
Fix build.
Change-Id: If170e46ff92c6a972bc1c2d838b1ac0eea6e23de
Sreeram Ramachandran [Fri, 30 May 2014 21:33:07 +0000 (21:33 +0000)]
am
82eab785: Support legacy routes added by apps via ensureRouteToHost().
* commit '
82eab785bd5cb2eff0a263f5b0dcde13e9139588':
Support legacy routes added by apps via ensureRouteToHost().
Sreeram Ramachandran [Thu, 22 May 2014 21:21:49 +0000 (14:21 -0700)]
Support legacy routes added by apps via ensureRouteToHost().
This adds the routes to two fixed tables:
+ LEGACY, which has higher priority than other non-explicit lookup tables
(per-network and default network).
+ PRIVILEGED_LEGACY, available only to system apps and has higher priority than
VPNs (system apps are those with the CONNECTIVITY_INTERNAL permission).
This will be changed to per-UID tables once the kernel supports UID-based
routing, so that these legacy routes are scoped to each app and not global.
Also, fix a TODO: The framework (as of http://ag/471599) will not set the
gateway argument if it's actually a direct-connected route.
Change-Id: I0ee1ca89fdc859d75a89021ca8c1902811b1e4a9
(cherry picked from commit
38b7af1f2cb9579895465fabc37865f5dadcac25)
Lorenzo Colitti [Fri, 30 May 2014 15:06:46 +0000 (15:06 +0000)]
am
ce8f583f: Set errno in NetworkController commands.
* commit '
ce8f583ff6620a19602d3c4604557e1b1501cafa':
Set errno in NetworkController commands.
The Android Automerger [Fri, 30 May 2014 15:06:46 +0000 (15:06 +0000)]
am
a5d68758: merge in master-release history after reset to
ec00884cac216d1cb79556ca23b21ce55e35af3e
* commit '
a5d6875887a63797711093a169e7ef19c5a1ab3b':
Fix for DNS resolutions when there is no default network set yet. We need to determine the actual netId to use prior to comparing it against the default netId. Also initialize the default network variable.
Sreeram Ramachandran [Wed, 28 May 2014 22:07:00 +0000 (15:07 -0700)]
Turn on C++11 and make all warnings into errors.
As a consequence:
+ Comment out the names of all unused parameters.
+ Remove all unused variables and functions.
In server/Android.mk, there are a couple of non-trivial changes:
+ Use libcxx instead of stlport. This is needed to fix a bunch of errors due to
specifying -std=c++11.
+ LOCAL_SHARED_LIBRARIES is sorted. Technically, the order in which libraries
are listed has an effect on linking, but nobody should be doing such brittle
things anyway.
Change-Id: I0aff5b745e04609da23144d0e8be4c5694321b8b
Sreeram Ramachandran [Thu, 22 May 2014 21:21:49 +0000 (14:21 -0700)]
Support legacy routes added by apps via ensureRouteToHost().
This adds the routes to two fixed tables:
+ LEGACY, which has higher priority than other non-explicit lookup tables
(per-network and default network).
+ PRIVILEGED_LEGACY, available only to system apps and has higher priority than
VPNs (system apps are those with the CONNECTIVITY_INTERNAL permission).
This will be changed to per-UID tables once the kernel supports UID-based
routing, so that these legacy routes are scoped to each app and not global.
Also, fix a TODO: The framework (as of http://ag/471599) will not set the
gateway argument if it's actually a direct-connected route.
Change-Id: I0ee1ca89fdc859d75a89021ca8c1902811b1e4a9
Lorenzo Colitti [Thu, 29 May 2014 03:20:55 +0000 (12:20 +0900)]
Set errno in NetworkController commands.
Set errno in the NetworkController functions that are called by
CommandListener and where failure causes an operationError. This
is because operationError always appends errno to its messages,
and
"400 481 addInterfaceToNetwork() failed (Device or resource busy)"
is more useful than:
"400 481 addInterfaceToNetwork() failed (Success)"
We already call ALOGE to put descriptive messages in the system
log, but the bugreport already conveniently aggregates all netd
commands in one place in the network_management service dump, and
it would help if the errno in those messages were accurate.
Unfortunately many of the route and iptables commands shell out
to /sbin/ip and we can't return meaningful values, but we'll
fix that when (if?) we replace that with a proper netlink
implementation.
Bug:
15316764
Change-Id: Ia47f451029d611491aa72bca602de77333f2c6a0
The Android Automerger [Thu, 22 May 2014 14:22:41 +0000 (07:22 -0700)]
merge in master-release history after reset to
ec00884cac216d1cb79556ca23b21ce55e35af3e
The Android Automerger [Thu, 22 May 2014 12:51:13 +0000 (05:51 -0700)]
merge in master-release history after reset to
ec00884cac216d1cb79556ca23b21ce55e35af3e
Sreeram Ramachandran [Wed, 21 May 2014 21:01:16 +0000 (14:01 -0700)]
Implement the "select network" fwmark command.
Change-Id: Id4a49eb288b18022d53014d1ae2211ed7d1099a6
Sreeram Ramachandran [Wed, 21 May 2014 20:19:43 +0000 (13:19 -0700)]
Rework the determination of a "valid network".
+ isNetIdValid() doesn't make much sense. What we want is whether the netId has
actually been created (via createNetwork()).
+ It isn't an error to call deleteNetwork() or setDefaultNetwork() even when
there are no interfaces assigned to the network.
+ Secure all accesses to the maps in PermissionsController with locks; they are
called from many threads (CommandListener, DnsProxyListener and FwmarkServer).
+ Remove the redundant mIfaceNetidMap.
+ Minor cosmetic changes to things such as #includes and log messages.
Change-Id: Ieb154589b24f00ba8067eaaec4def3534aec4923
Sreeram Ramachandran [Wed, 21 May 2014 20:08:34 +0000 (13:08 -0700)]
Mark sockets on creation (socket()) and accept4().
Continued from: https://android-review.git.corp.google.com/#/c/95094/
Change-Id: Ib0b8f5d7c5013b91eae6bbc3847852eb355c7714
Sreeram Ramachandran [Wed, 21 May 2014 18:41:39 +0000 (11:41 -0700)]
New network selection APIs.
Continued from: https://android-review.git.corp.google.com/#/c/94977/
Change-Id: Ie0576888f50a8ce91bbb0a4794708b406eb0aa35
Sreeram Ramachandran [Wed, 21 May 2014 15:54:07 +0000 (08:54 -0700)]
Move netd_client into netd.
Change-Id: Ie4b6b303225c93f2448a503d6ea9cebb552cbad5
The Android Automerger [Wed, 21 May 2014 12:51:08 +0000 (05:51 -0700)]
merge in master-release history after reset to
5ff58d494a5ddf7e544adc77590300f04daf8e31
The Android Automerger [Tue, 20 May 2014 12:51:24 +0000 (05:51 -0700)]
merge in master-release history after reset to
5ff58d494a5ddf7e544adc77590300f04daf8e31
The Android Automerger [Mon, 19 May 2014 12:50:25 +0000 (05:50 -0700)]
merge in master-release history after reset to
5ff58d494a5ddf7e544adc77590300f04daf8e31
The Android Automerger [Sun, 18 May 2014 12:50:12 +0000 (05:50 -0700)]
merge in master-release history after reset to
5ff58d494a5ddf7e544adc77590300f04daf8e31
The Android Automerger [Sat, 17 May 2014 12:51:51 +0000 (05:51 -0700)]
merge in master-release history after reset to
5ff58d494a5ddf7e544adc77590300f04daf8e31
The Android Automerger [Thu, 15 May 2014 12:51:28 +0000 (05:51 -0700)]
merge in master-release history after reset to
5ff58d494a5ddf7e544adc77590300f04daf8e31
Sreeram Ramachandran [Wed, 14 May 2014 16:57:31 +0000 (09:57 -0700)]
Fix build by using the right type (socklen_t instead of int).
Change-Id: Ia4a56ef679269755a3787408821c0cda6aec9420
Sreeram Ramachandran [Tue, 13 May 2014 20:25:34 +0000 (13:25 -0700)]
Mark sockets on accept().
The kernel marks the netId into the accepted socket, so we just set the socket
owner's permission bits here in userspace.
We also check the permissions required by the network and return an error if
they are not satisfied. This avoids the "half-open" problem where an app listens
on all networks (interfaces) with bind(0), and receives an incoming connection
on a privileged interface that it can't send responses over.
(cherry picked from commit
920747a009efbb815465d980ec6a918531e74e9f)
Change-Id: I5d09be413cf720fbed905f96313b007997ada76c
Sreeram Ramachandran [Mon, 12 May 2014 04:04:03 +0000 (21:04 -0700)]
Introduce fwmarkd: a service to set the fwmark of sockets.
At connect(), mark sockets with the default network's netId.
(cherry picked from commit
361154d38016ebeaabf1bb75534dabbacf5de5fa)
Change-Id: Ib6198e19dbc306521a26fcecfdf6e8424d163fc9
Sreeram Ramachandran [Wed, 14 May 2014 15:36:26 +0000 (08:36 -0700)]
Remove redundant cache deletion.
This was added in http://ag/465643 as part of the merge from
master-multinetwork-dev to master, but was unnecessary, since it was already
added to NetworkController.cpp in http://ag/465593.
Change-Id: Ic9a56a5276ca6d58cf5fec60f89f30c2285aa35e
Sreeram Ramachandran [Wed, 14 May 2014 15:31:55 +0000 (08:31 -0700)]
Initialize mDefaultNetId.
This was accidentally dropped in the merge from master-multinetwork-dev to
master, in http://ag/465644.
Change-Id: I0699604923477e6b19dfc8c70a84c50a79fe3d72
The Android Automerger [Wed, 14 May 2014 12:51:47 +0000 (05:51 -0700)]
merge in master-release history after reset to
3ced06906759b3ce252e114fcc9c98fa36228911
Lorenzo Colitti [Wed, 14 May 2014 11:44:46 +0000 (04:44 -0700)]
Address TODO to uncomment _resolv_delete_cache_for_net.
Change-Id: I581e6f2afaac25db04a87ac70703a02a669b5edf
Sreeram Ramachandran [Mon, 12 May 2014 03:29:49 +0000 (20:29 -0700)]
Refactor the fwmark stuff to use an explicit union of bit-fields.
This is a pure refactor. There's no effect on any functionality.
Change-Id: I99d1f3fb76781cf84f67c2dff44eaf3a2cf50a9f
Paul Jensen [Mon, 28 Apr 2014 14:35:51 +0000 (10:35 -0400)]
Separate network and interface addition/removal netd APIs.
This should facilitate stacked interfaces (i.e. clatd).
Change-Id: Ib3e7a4d3847ef6ec4449451f6da42e75959baa4f
Sreeram Ramachandran [Thu, 24 Apr 2014 23:23:35 +0000 (16:23 -0700)]
Ignore failure when adding directly-connected routes to the main table.
Change-Id: I12f65cdfbe2285820bd24b047f794ec9b9b5110f
Sreeram Ramachandran [Thu, 24 Apr 2014 22:55:26 +0000 (15:55 -0700)]
Fixes for stupid mistakes (by me).
+ Only remove netId/permission after doing everything that references them.
+ Return success/failure correctly based on return value of fork/exec.
Conflicts:
NetworkController.cpp
Change-Id: Iddb8ccdffc104ffed1058ecc2421006beebd568d
Sreeram Ramachandran [Wed, 16 Apr 2014 19:32:18 +0000 (12:32 -0700)]
Add directly-connected routes to the main table.
Change-Id: I545555d273ea9d321eab08fef12a32ca17e33dff
Paul Jensen [Thu, 17 Apr 2014 21:25:43 +0000 (17:25 -0400)]
Use proper socket mark for DNS resolution.
Change-Id: I531ff0fbce6e7172b82bc2d4c7406a324603eb8a
Paul Jensen [Thu, 10 Apr 2014 18:57:54 +0000 (14:57 -0400)]
netd: Accept NetId instead of interface name in DNS resolver commands.
Conflicts:
DnsProxyListener.cpp
NetworkController.cpp
NetworkController.h
Change-Id: Ic82b73de6f50d39d56c5e1a32f5b1f3ebb80bb7d
Paul Jensen [Thu, 17 Apr 2014 20:05:35 +0000 (16:05 -0400)]
When deleteing a network also delete the resolver cache for that
network.
Change-Id: I99d058bafea5de743e56075dbed74031da4df63f
Sreeram Ramachandran [Fri, 18 Apr 2014 16:49:13 +0000 (09:49 -0700)]
Cosmetic: Move logic from CommandListener into NetworkController.
CommandListener should just unmarshal params, and delegate all functional logic
to NetworkController (or other such classes). So, for example, if you call
destroyNetwork() directly from a unit test, you should get the same effect as if
you sent a "network destroy" command to CommandListener.
(cherry picked from commit
f7743bf18672d654e79565e85c7d3770e2f0f26c)
Change-Id: Ic61ae9141e2eea95394a3a38e30a72fe964cdc81
Sreeram Ramachandran [Wed, 16 Apr 2014 19:08:05 +0000 (12:08 -0700)]
Update the "lookup main" rule to include a fwmark clause.
If a packet is marked with a non-zero NetId, and doesn't find a route in its
per-network table, it will now not match the main table rule, and so will
fallthrough to the "unreachable" rule, resulting in ENETUNREACH, as desired.
If a packet has a zero NetId (e.g.: sent on an unconnected UDP socket), it will
find the "default network" rule first, which should have a default route, so it
will never need to fall through any further to the main table.
This makes the main table effectively unused for all normal routing lookups.
Only the kernel will still use this table, when trying to find a directly
connected route to validate the nexthop when a route is added anywhere.
(cherry picked from commit
4594dbba433dadba953c1c7b43fdd99e77fb1f2b)
Change-Id: Ib0784ff0848854be0575c64a59bbd0a4d3bf93e0
Sreeram Ramachandran [Tue, 15 Apr 2014 21:28:55 +0000 (14:28 -0700)]
Flush (delete) routing tables when destroying a network.
(cherry picked from commit
7ee2c3fe24f9a643584ddf5f759a7acb73e35e8d)
Change-Id: I1b222b474b1ae7a551250f8f02d7900c493b5b16
Sreeram Ramachandran [Tue, 15 Apr 2014 21:23:08 +0000 (14:23 -0700)]
Implement the "network route add/remove" API.
(cherry picked from commit
909c52248a4ad832548c5feb5e9a58323e30ab7b)
Change-Id: Idb09b0c22a3a519dda232995ced406e470ab9768