Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 1 | // Copyright 2019 The Chromium OS Authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
Garrick Evans | 3388a03 | 2020-03-24 11:25:55 +0900 | [diff] [blame] | 5 | #include "patchpanel/datapath.h" |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 6 | |
Garrick Evans | 3d97a39 | 2020-02-21 15:24:37 +0900 | [diff] [blame] | 7 | #include <arpa/inet.h> |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 8 | #include <fcntl.h> |
| 9 | #include <linux/if_tun.h> |
| 10 | #include <linux/sockios.h> |
| 11 | #include <net/if.h> |
| 12 | #include <net/if_arp.h> |
| 13 | #include <netinet/in.h> |
| 14 | #include <string.h> |
| 15 | #include <sys/ioctl.h> |
| 16 | #include <sys/socket.h> |
| 17 | |
Hugo Benichi | d82d883 | 2020-08-14 10:05:03 +0900 | [diff] [blame] | 18 | #include <vector> |
| 19 | |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 20 | #include <base/files/scoped_file.h> |
| 21 | #include <base/logging.h> |
Taoyu Li | 79871c9 | 2020-07-02 16:09:39 +0900 | [diff] [blame] | 22 | #include <base/posix/eintr_wrapper.h> |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 23 | #include <base/strings/string_number_conversions.h> |
Garrick Evans | 4f9f557 | 2019-11-26 10:25:16 +0900 | [diff] [blame] | 24 | #include <brillo/userdb_utils.h> |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 25 | |
Jason Jeremy Iman | a7273a3 | 2020-08-04 11:25:31 +0900 | [diff] [blame] | 26 | #include "patchpanel/adb_proxy.h" |
Garrick Evans | 3388a03 | 2020-03-24 11:25:55 +0900 | [diff] [blame] | 27 | #include "patchpanel/net_util.h" |
| 28 | #include "patchpanel/scoped_ns.h" |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 29 | |
Garrick Evans | 3388a03 | 2020-03-24 11:25:55 +0900 | [diff] [blame] | 30 | namespace patchpanel { |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 31 | |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 32 | namespace { |
Hugo Benichi | 7667559 | 2020-04-08 14:29:57 +0900 | [diff] [blame] | 33 | // TODO(hugobenichi) Consolidate this constant definition in a single place. |
| 34 | constexpr pid_t kTestPID = -2; |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 35 | constexpr char kDefaultIfname[] = "vmtap%d"; |
| 36 | constexpr char kTunDev[] = "/dev/net/tun"; |
Jason Jeremy Iman | a7273a3 | 2020-08-04 11:25:31 +0900 | [diff] [blame] | 37 | constexpr char kArcAddr[] = "100.115.92.2"; |
| 38 | constexpr char kLocalhostAddr[] = "127.0.0.1"; |
| 39 | constexpr uint16_t kAdbServerPort = 5555; |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 40 | |
Garrick Evans | 8a06756 | 2020-05-11 12:47:30 +0900 | [diff] [blame] | 41 | std::string PrefixIfname(const std::string& prefix, const std::string& ifname) { |
| 42 | std::string n = prefix + ifname; |
Garrick Evans | 2f581a0 | 2020-05-11 10:43:35 +0900 | [diff] [blame] | 43 | if (n.length() < IFNAMSIZ) |
| 44 | return n; |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 45 | |
Garrick Evans | 2f581a0 | 2020-05-11 10:43:35 +0900 | [diff] [blame] | 46 | // Best effort attempt to preserve the interface number, assuming it's the |
| 47 | // last char in the name. |
| 48 | auto c = ifname[ifname.length() - 1]; |
| 49 | n.resize(IFNAMSIZ - 1); |
| 50 | n[n.length() - 1] = c; |
| 51 | return n; |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 52 | } |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 53 | |
Garrick Evans | 8a06756 | 2020-05-11 12:47:30 +0900 | [diff] [blame] | 54 | } // namespace |
| 55 | |
| 56 | std::string ArcVethHostName(const std::string& ifname) { |
| 57 | return PrefixIfname("veth", ifname); |
| 58 | } |
| 59 | |
| 60 | std::string ArcBridgeName(const std::string& ifname) { |
| 61 | return PrefixIfname("arc_", ifname); |
| 62 | } |
| 63 | |
Jason Jeremy Iman | a7273a3 | 2020-08-04 11:25:31 +0900 | [diff] [blame] | 64 | Datapath::Datapath(MinijailedProcessRunner* process_runner, Firewall* firewall) |
| 65 | : Datapath(process_runner, firewall, ioctl) {} |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 66 | |
Jason Jeremy Iman | a7273a3 | 2020-08-04 11:25:31 +0900 | [diff] [blame] | 67 | Datapath::Datapath(MinijailedProcessRunner* process_runner, |
| 68 | Firewall* firewall, |
| 69 | ioctl_t ioctl_hook) |
| 70 | : process_runner_(process_runner), firewall_(firewall), ioctl_(ioctl_hook) { |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 71 | CHECK(process_runner_); |
| 72 | } |
| 73 | |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 74 | MinijailedProcessRunner& Datapath::runner() const { |
| 75 | return *process_runner_; |
| 76 | } |
| 77 | |
Hugo Benichi | 33860d7 | 2020-07-09 16:34:01 +0900 | [diff] [blame] | 78 | bool Datapath::NetnsAttachName(const std::string& netns_name, pid_t netns_pid) { |
| 79 | // Try first to delete any netns with name |netns_name| in case patchpanel |
| 80 | // did not exit cleanly. |
| 81 | if (process_runner_->ip_netns_delete(netns_name, false /*log_failures*/) == 0) |
| 82 | LOG(INFO) << "Deleted left over network namespace name " << netns_name; |
| 83 | return process_runner_->ip_netns_attach(netns_name, netns_pid) == 0; |
| 84 | } |
| 85 | |
| 86 | bool Datapath::NetnsDeleteName(const std::string& netns_name) { |
| 87 | return process_runner_->ip_netns_delete(netns_name) == 0; |
| 88 | } |
| 89 | |
Garrick Evans | 8a949dc | 2019-07-18 16:17:53 +0900 | [diff] [blame] | 90 | bool Datapath::AddBridge(const std::string& ifname, |
Garrick Evans | 7a1a9ee | 2020-01-28 11:03:57 +0900 | [diff] [blame] | 91 | uint32_t ipv4_addr, |
| 92 | uint32_t ipv4_prefix_len) { |
Garrick Evans | 8a949dc | 2019-07-18 16:17:53 +0900 | [diff] [blame] | 93 | // Configure the persistent Chrome OS bridge interface with static IP. |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 94 | if (process_runner_->brctl("addbr", {ifname}) != 0) { |
Garrick Evans | 8a949dc | 2019-07-18 16:17:53 +0900 | [diff] [blame] | 95 | return false; |
| 96 | } |
| 97 | |
Garrick Evans | 6f4fa3a | 2020-02-10 16:15:09 +0900 | [diff] [blame] | 98 | if (process_runner_->ip( |
| 99 | "addr", "add", |
| 100 | {IPv4AddressToCidrString(ipv4_addr, ipv4_prefix_len), "brd", |
| 101 | IPv4AddressToString(Ipv4BroadcastAddr(ipv4_addr, ipv4_prefix_len)), |
| 102 | "dev", ifname}) != 0) { |
Garrick Evans | 7a1a9ee | 2020-01-28 11:03:57 +0900 | [diff] [blame] | 103 | RemoveBridge(ifname); |
| 104 | return false; |
| 105 | } |
| 106 | |
| 107 | if (process_runner_->ip("link", "set", {ifname, "up"}) != 0) { |
Garrick Evans | 8a949dc | 2019-07-18 16:17:53 +0900 | [diff] [blame] | 108 | RemoveBridge(ifname); |
| 109 | return false; |
| 110 | } |
| 111 | |
| 112 | // See nat.conf in chromeos-nat-init for the rest of the NAT setup rules. |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 113 | if (!AddOutboundIPv4SNATMark(ifname)) { |
Garrick Evans | 8a949dc | 2019-07-18 16:17:53 +0900 | [diff] [blame] | 114 | RemoveBridge(ifname); |
| 115 | return false; |
| 116 | } |
| 117 | |
| 118 | return true; |
| 119 | } |
| 120 | |
| 121 | void Datapath::RemoveBridge(const std::string& ifname) { |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 122 | RemoveOutboundIPv4SNATMark(ifname); |
Garrick Evans | 7a1a9ee | 2020-01-28 11:03:57 +0900 | [diff] [blame] | 123 | process_runner_->ip("link", "set", {ifname, "down"}); |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 124 | process_runner_->brctl("delbr", {ifname}); |
Garrick Evans | 8a949dc | 2019-07-18 16:17:53 +0900 | [diff] [blame] | 125 | } |
| 126 | |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 127 | bool Datapath::AddToBridge(const std::string& br_ifname, |
| 128 | const std::string& ifname) { |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 129 | return (process_runner_->brctl("addif", {br_ifname, ifname}) == 0); |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 130 | } |
| 131 | |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 132 | std::string Datapath::AddTAP(const std::string& name, |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 133 | const MacAddress* mac_addr, |
| 134 | const SubnetAddress* ipv4_addr, |
Garrick Evans | 4f9f557 | 2019-11-26 10:25:16 +0900 | [diff] [blame] | 135 | const std::string& user) { |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 136 | base::ScopedFD dev(open(kTunDev, O_RDWR | O_NONBLOCK)); |
| 137 | if (!dev.is_valid()) { |
| 138 | PLOG(ERROR) << "Failed to open " << kTunDev; |
| 139 | return ""; |
| 140 | } |
| 141 | |
| 142 | struct ifreq ifr; |
| 143 | memset(&ifr, 0, sizeof(ifr)); |
| 144 | strncpy(ifr.ifr_name, name.empty() ? kDefaultIfname : name.c_str(), |
| 145 | sizeof(ifr.ifr_name)); |
| 146 | ifr.ifr_flags = IFF_TAP | IFF_NO_PI; |
| 147 | |
| 148 | // If a template was given as the name, ifr_name will be updated with the |
| 149 | // actual interface name. |
| 150 | if ((*ioctl_)(dev.get(), TUNSETIFF, &ifr) != 0) { |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 151 | PLOG(ERROR) << "Failed to create tap interface " << name; |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 152 | return ""; |
| 153 | } |
| 154 | const char* ifname = ifr.ifr_name; |
| 155 | |
| 156 | if ((*ioctl_)(dev.get(), TUNSETPERSIST, 1) != 0) { |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 157 | PLOG(ERROR) << "Failed to persist the interface " << ifname; |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 158 | return ""; |
| 159 | } |
| 160 | |
Garrick Evans | 4f9f557 | 2019-11-26 10:25:16 +0900 | [diff] [blame] | 161 | if (!user.empty()) { |
| 162 | uid_t uid = -1; |
| 163 | if (!brillo::userdb::GetUserInfo(user, &uid, nullptr)) { |
| 164 | PLOG(ERROR) << "Unable to look up UID for " << user; |
| 165 | RemoveTAP(ifname); |
| 166 | return ""; |
| 167 | } |
| 168 | if ((*ioctl_)(dev.get(), TUNSETOWNER, uid) != 0) { |
| 169 | PLOG(ERROR) << "Failed to set owner " << uid << " of tap interface " |
| 170 | << ifname; |
| 171 | RemoveTAP(ifname); |
| 172 | return ""; |
| 173 | } |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 174 | } |
| 175 | |
Hugo Benichi | b9b93fe | 2019-10-25 23:36:01 +0900 | [diff] [blame] | 176 | // Create control socket for configuring the interface. |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 177 | base::ScopedFD sock(socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0)); |
| 178 | if (!sock.is_valid()) { |
| 179 | PLOG(ERROR) << "Failed to create control socket for tap interface " |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 180 | << ifname; |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 181 | RemoveTAP(ifname); |
| 182 | return ""; |
| 183 | } |
| 184 | |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 185 | if (ipv4_addr) { |
| 186 | struct sockaddr_in* addr = |
| 187 | reinterpret_cast<struct sockaddr_in*>(&ifr.ifr_addr); |
| 188 | addr->sin_family = AF_INET; |
| 189 | addr->sin_addr.s_addr = static_cast<in_addr_t>(ipv4_addr->Address()); |
| 190 | if ((*ioctl_)(sock.get(), SIOCSIFADDR, &ifr) != 0) { |
| 191 | PLOG(ERROR) << "Failed to set ip address for vmtap interface " << ifname |
| 192 | << " {" << ipv4_addr->ToCidrString() << "}"; |
| 193 | RemoveTAP(ifname); |
| 194 | return ""; |
| 195 | } |
| 196 | |
| 197 | struct sockaddr_in* netmask = |
| 198 | reinterpret_cast<struct sockaddr_in*>(&ifr.ifr_netmask); |
| 199 | netmask->sin_family = AF_INET; |
| 200 | netmask->sin_addr.s_addr = static_cast<in_addr_t>(ipv4_addr->Netmask()); |
| 201 | if ((*ioctl_)(sock.get(), SIOCSIFNETMASK, &ifr) != 0) { |
| 202 | PLOG(ERROR) << "Failed to set netmask for vmtap interface " << ifname |
| 203 | << " {" << ipv4_addr->ToCidrString() << "}"; |
| 204 | RemoveTAP(ifname); |
| 205 | return ""; |
| 206 | } |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 207 | } |
| 208 | |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 209 | if (mac_addr) { |
| 210 | struct sockaddr* hwaddr = &ifr.ifr_hwaddr; |
| 211 | hwaddr->sa_family = ARPHRD_ETHER; |
| 212 | memcpy(&hwaddr->sa_data, mac_addr, sizeof(*mac_addr)); |
| 213 | if ((*ioctl_)(sock.get(), SIOCSIFHWADDR, &ifr) != 0) { |
| 214 | PLOG(ERROR) << "Failed to set mac address for vmtap interface " << ifname |
| 215 | << " {" << MacAddressToString(*mac_addr) << "}"; |
| 216 | RemoveTAP(ifname); |
| 217 | return ""; |
| 218 | } |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 219 | } |
| 220 | |
| 221 | if ((*ioctl_)(sock.get(), SIOCGIFFLAGS, &ifr) != 0) { |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 222 | PLOG(ERROR) << "Failed to get flags for tap interface " << ifname; |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 223 | RemoveTAP(ifname); |
| 224 | return ""; |
| 225 | } |
| 226 | |
| 227 | ifr.ifr_flags |= (IFF_UP | IFF_RUNNING); |
| 228 | if ((*ioctl_)(sock.get(), SIOCSIFFLAGS, &ifr) != 0) { |
Garrick Evans | 621ed26 | 2019-11-13 12:28:43 +0900 | [diff] [blame] | 229 | PLOG(ERROR) << "Failed to enable tap interface " << ifname; |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 230 | RemoveTAP(ifname); |
| 231 | return ""; |
| 232 | } |
| 233 | |
| 234 | return ifname; |
| 235 | } |
| 236 | |
| 237 | void Datapath::RemoveTAP(const std::string& ifname) { |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 238 | process_runner_->ip("tuntap", "del", {ifname, "mode", "tap"}); |
Garrick Evans | c7ae82c | 2019-09-04 16:25:10 +0900 | [diff] [blame] | 239 | } |
| 240 | |
Hugo Benichi | 33860d7 | 2020-07-09 16:34:01 +0900 | [diff] [blame] | 241 | bool Datapath::ConnectVethPair(pid_t netns_pid, |
| 242 | const std::string& netns_name, |
Hugo Benichi | 7667559 | 2020-04-08 14:29:57 +0900 | [diff] [blame] | 243 | const std::string& veth_ifname, |
| 244 | const std::string& peer_ifname, |
| 245 | const MacAddress& remote_mac_addr, |
| 246 | uint32_t remote_ipv4_addr, |
| 247 | uint32_t remote_ipv4_prefix_len, |
| 248 | bool remote_multicast_flag) { |
Hugo Benichi | 33860d7 | 2020-07-09 16:34:01 +0900 | [diff] [blame] | 249 | // Set up the virtual pair across the current namespace and |netns_name|. |
| 250 | if (!AddVirtualInterfacePair(netns_name, veth_ifname, peer_ifname)) { |
| 251 | LOG(ERROR) << "Failed to create veth pair " << veth_ifname << "," |
| 252 | << peer_ifname; |
| 253 | return false; |
| 254 | } |
| 255 | |
| 256 | // Configure the remote veth in namespace |netns_name|. |
Hugo Benichi | 7667559 | 2020-04-08 14:29:57 +0900 | [diff] [blame] | 257 | { |
Hugo Benichi | 33860d7 | 2020-07-09 16:34:01 +0900 | [diff] [blame] | 258 | ScopedNS ns(netns_pid); |
| 259 | if (!ns.IsValid() && netns_pid != kTestPID) { |
Hugo Benichi | 7667559 | 2020-04-08 14:29:57 +0900 | [diff] [blame] | 260 | LOG(ERROR) |
| 261 | << "Cannot create virtual link -- invalid container namespace?"; |
| 262 | return false; |
| 263 | } |
| 264 | |
Hugo Benichi | 7667559 | 2020-04-08 14:29:57 +0900 | [diff] [blame] | 265 | if (!ConfigureInterface(peer_ifname, remote_mac_addr, remote_ipv4_addr, |
| 266 | remote_ipv4_prefix_len, true /* link up */, |
| 267 | remote_multicast_flag)) { |
| 268 | LOG(ERROR) << "Failed to configure interface " << peer_ifname; |
| 269 | RemoveInterface(peer_ifname); |
| 270 | return false; |
| 271 | } |
| 272 | } |
| 273 | |
Hugo Benichi | 7667559 | 2020-04-08 14:29:57 +0900 | [diff] [blame] | 274 | if (!ToggleInterface(veth_ifname, true /*up*/)) { |
| 275 | LOG(ERROR) << "Failed to bring up interface " << veth_ifname; |
| 276 | RemoveInterface(veth_ifname); |
| 277 | return false; |
| 278 | } |
Hugo Benichi | 33860d7 | 2020-07-09 16:34:01 +0900 | [diff] [blame] | 279 | |
Hugo Benichi | 7667559 | 2020-04-08 14:29:57 +0900 | [diff] [blame] | 280 | return true; |
| 281 | } |
| 282 | |
Hugo Benichi | 33860d7 | 2020-07-09 16:34:01 +0900 | [diff] [blame] | 283 | bool Datapath::AddVirtualInterfacePair(const std::string& netns_name, |
| 284 | const std::string& veth_ifname, |
Garrick Evans | 2470caa | 2020-03-04 14:15:41 +0900 | [diff] [blame] | 285 | const std::string& peer_ifname) { |
Hugo Benichi | 33860d7 | 2020-07-09 16:34:01 +0900 | [diff] [blame] | 286 | return process_runner_->ip("link", "add", |
| 287 | {veth_ifname, "type", "veth", "peer", "name", |
| 288 | peer_ifname, "netns", netns_name}) == 0; |
Garrick Evans | 2470caa | 2020-03-04 14:15:41 +0900 | [diff] [blame] | 289 | } |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 290 | |
Garrick Evans | 2470caa | 2020-03-04 14:15:41 +0900 | [diff] [blame] | 291 | bool Datapath::ToggleInterface(const std::string& ifname, bool up) { |
| 292 | const std::string link = up ? "up" : "down"; |
| 293 | return process_runner_->ip("link", "set", {ifname, link}) == 0; |
| 294 | } |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 295 | |
Garrick Evans | 2470caa | 2020-03-04 14:15:41 +0900 | [diff] [blame] | 296 | bool Datapath::ConfigureInterface(const std::string& ifname, |
| 297 | const MacAddress& mac_addr, |
| 298 | uint32_t ipv4_addr, |
| 299 | uint32_t ipv4_prefix_len, |
| 300 | bool up, |
| 301 | bool enable_multicast) { |
| 302 | const std::string link = up ? "up" : "down"; |
| 303 | const std::string multicast = enable_multicast ? "on" : "off"; |
| 304 | return (process_runner_->ip( |
| 305 | "addr", "add", |
| 306 | {IPv4AddressToCidrString(ipv4_addr, ipv4_prefix_len), "brd", |
| 307 | IPv4AddressToString( |
| 308 | Ipv4BroadcastAddr(ipv4_addr, ipv4_prefix_len)), |
| 309 | "dev", ifname}) == 0) && |
| 310 | (process_runner_->ip("link", "set", |
| 311 | { |
| 312 | "dev", |
| 313 | ifname, |
| 314 | link, |
| 315 | "addr", |
| 316 | MacAddressToString(mac_addr), |
| 317 | "multicast", |
| 318 | multicast, |
| 319 | }) == 0); |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 320 | } |
| 321 | |
| 322 | void Datapath::RemoveInterface(const std::string& ifname) { |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 323 | process_runner_->ip("link", "delete", {ifname}, false /*log_failures*/); |
Garrick Evans | 5486162 | 2019-07-19 09:05:09 +0900 | [diff] [blame] | 324 | } |
| 325 | |
Hugo Benichi | 8d622b5 | 2020-08-13 15:24:12 +0900 | [diff] [blame] | 326 | void Datapath::StartRoutingDevice(const std::string& ext_ifname, |
| 327 | const std::string& int_ifname, |
| 328 | uint32_t int_ipv4_addr, |
| 329 | TrafficSource source) { |
| 330 | if (!ext_ifname.empty() && |
| 331 | !AddInboundIPv4DNAT(ext_ifname, IPv4AddressToString(int_ipv4_addr))) |
| 332 | LOG(ERROR) << "Failed to configure ingress traffic rules for " << ext_ifname |
| 333 | << "->" << int_ifname; |
| 334 | |
Hugo Benichi | c6ae67c | 2020-08-14 15:02:13 +0900 | [diff] [blame^] | 335 | if (StartIpForwarding(IpFamily::IPv4, ext_ifname, int_ifname)) |
| 336 | LOG(ERROR) << "Failed to enable IP forwarding for " << ext_ifname << "->" |
| 337 | << int_ifname; |
Hugo Benichi | 8d622b5 | 2020-08-13 15:24:12 +0900 | [diff] [blame] | 338 | |
Hugo Benichi | c6ae67c | 2020-08-14 15:02:13 +0900 | [diff] [blame^] | 339 | if (StartIpForwarding(IpFamily::IPv4, int_ifname, ext_ifname)) |
| 340 | LOG(ERROR) << "Failed to enable IP forwarding for " << ext_ifname << "<-" |
| 341 | << int_ifname; |
Hugo Benichi | 8d622b5 | 2020-08-13 15:24:12 +0900 | [diff] [blame] | 342 | |
| 343 | // TODO(b/161507671) If ext_ifname is not null, mark egress traffic with the |
| 344 | // fwmark routing tag corresponding to |ext_ifname|, and set up strong routing |
| 345 | // in ip rule. |
| 346 | |
| 347 | // TODO(b/161507671) If ext_ifname is null, set up connection tracking for the |
| 348 | // current default interface. |
| 349 | |
| 350 | // TODO(b/161508179) Start marking egress traffic with the corresponding |
| 351 | // source fwmark in mangle PREROUTING. |
| 352 | } |
| 353 | |
| 354 | void Datapath::StopRoutingDevice(const std::string& ext_ifname, |
| 355 | const std::string& int_ifname, |
| 356 | uint32_t int_ipv4_addr, |
| 357 | TrafficSource source) { |
| 358 | if (!ext_ifname.empty()) |
| 359 | RemoveInboundIPv4DNAT(ext_ifname, IPv4AddressToString(int_ipv4_addr)); |
Hugo Benichi | c6ae67c | 2020-08-14 15:02:13 +0900 | [diff] [blame^] | 360 | StopIpForwarding(IpFamily::IPv4, ext_ifname, int_ifname); |
| 361 | StopIpForwarding(IpFamily::IPv4, int_ifname, ext_ifname); |
Hugo Benichi | 8d622b5 | 2020-08-13 15:24:12 +0900 | [diff] [blame] | 362 | // TODO(b/161508179) Remove source marking for egress traffic. |
| 363 | // TODO(b/161507671) Remove routing tag marking for egress traffic. |
| 364 | } |
| 365 | |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 366 | bool Datapath::AddInboundIPv4DNAT(const std::string& ifname, |
| 367 | const std::string& ipv4_addr) { |
| 368 | // Direct ingress IP traffic to existing sockets. |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 369 | if (process_runner_->iptables( |
| 370 | "nat", {"-A", "PREROUTING", "-i", ifname, "-m", "socket", |
| 371 | "--nowildcard", "-j", "ACCEPT", "-w"}) != 0) |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 372 | return false; |
| 373 | |
| 374 | // Direct ingress TCP & UDP traffic to ARC interface for new connections. |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 375 | if (process_runner_->iptables( |
| 376 | "nat", {"-A", "PREROUTING", "-i", ifname, "-p", "tcp", "-j", "DNAT", |
| 377 | "--to-destination", ipv4_addr, "-w"}) != 0) { |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 378 | RemoveInboundIPv4DNAT(ifname, ipv4_addr); |
| 379 | return false; |
| 380 | } |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 381 | if (process_runner_->iptables( |
| 382 | "nat", {"-A", "PREROUTING", "-i", ifname, "-p", "udp", "-j", "DNAT", |
| 383 | "--to-destination", ipv4_addr, "-w"}) != 0) { |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 384 | RemoveInboundIPv4DNAT(ifname, ipv4_addr); |
| 385 | return false; |
| 386 | } |
| 387 | |
| 388 | return true; |
| 389 | } |
| 390 | |
| 391 | void Datapath::RemoveInboundIPv4DNAT(const std::string& ifname, |
| 392 | const std::string& ipv4_addr) { |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 393 | process_runner_->iptables( |
| 394 | "nat", {"-D", "PREROUTING", "-i", ifname, "-p", "udp", "-j", "DNAT", |
| 395 | "--to-destination", ipv4_addr, "-w"}); |
| 396 | process_runner_->iptables( |
| 397 | "nat", {"-D", "PREROUTING", "-i", ifname, "-p", "tcp", "-j", "DNAT", |
| 398 | "--to-destination", ipv4_addr, "-w"}); |
| 399 | process_runner_->iptables( |
| 400 | "nat", {"-D", "PREROUTING", "-i", ifname, "-m", "socket", "--nowildcard", |
| 401 | "-j", "ACCEPT", "-w"}); |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 402 | } |
| 403 | |
Hugo Benichi | 8d622b5 | 2020-08-13 15:24:12 +0900 | [diff] [blame] | 404 | // TODO(hugobenichi) The name incorrectly refers to egress traffic, but this |
| 405 | // FORWARD rule actually enables forwarding for ingress traffic. Fix the name. |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 406 | bool Datapath::AddOutboundIPv4(const std::string& ifname) { |
Hugo Benichi | d82d883 | 2020-08-14 10:05:03 +0900 | [diff] [blame] | 407 | return StartIpForwarding(IpFamily::IPv4, "", ifname); |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 408 | } |
| 409 | |
| 410 | void Datapath::RemoveOutboundIPv4(const std::string& ifname) { |
Hugo Benichi | d82d883 | 2020-08-14 10:05:03 +0900 | [diff] [blame] | 411 | StopIpForwarding(IpFamily::IPv4, "", ifname); |
Garrick Evans | f0ab713 | 2019-06-18 14:50:42 +0900 | [diff] [blame] | 412 | } |
| 413 | |
Hugo Benichi | c6ae67c | 2020-08-14 15:02:13 +0900 | [diff] [blame^] | 414 | // TODO(b/161507671) Stop relying on the traffic fwmark 1/1 once forwarded |
| 415 | // egress traffic is routed through the fwmark routing tag. |
Garrick Evans | d291af6 | 2020-05-25 10:39:06 +0900 | [diff] [blame] | 416 | bool Datapath::AddSNATMarkRules() { |
Taoyu Li | 79871c9 | 2020-07-02 16:09:39 +0900 | [diff] [blame] | 417 | // chromium:1050579: INVALID packets cannot be tracked by conntrack therefore |
| 418 | // need to be explicitly dropped. |
| 419 | if (process_runner_->iptables( |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 420 | "filter", {"-A", "FORWARD", "-m", "mark", "--mark", "1/1", "-m", |
Taoyu Li | 79871c9 | 2020-07-02 16:09:39 +0900 | [diff] [blame] | 421 | "state", "--state", "INVALID", "-j", "DROP", "-w"}) != 0) { |
| 422 | return false; |
| 423 | } |
Garrick Evans | d291af6 | 2020-05-25 10:39:06 +0900 | [diff] [blame] | 424 | if (process_runner_->iptables( |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 425 | "filter", {"-A", "FORWARD", "-m", "mark", "--mark", "1/1", "-j", |
Garrick Evans | d291af6 | 2020-05-25 10:39:06 +0900 | [diff] [blame] | 426 | "ACCEPT", "-w"}) != 0) { |
| 427 | return false; |
| 428 | } |
| 429 | if (process_runner_->iptables( |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 430 | "nat", {"-A", "POSTROUTING", "-m", "mark", "--mark", "1/1", "-j", |
Garrick Evans | d291af6 | 2020-05-25 10:39:06 +0900 | [diff] [blame] | 431 | "MASQUERADE", "-w"}) != 0) { |
| 432 | RemoveSNATMarkRules(); |
| 433 | return false; |
| 434 | } |
| 435 | return true; |
| 436 | } |
| 437 | |
| 438 | void Datapath::RemoveSNATMarkRules() { |
| 439 | process_runner_->iptables("nat", {"-D", "POSTROUTING", "-m", "mark", "--mark", |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 440 | "1/1", "-j", "MASQUERADE", "-w"}); |
Garrick Evans | d291af6 | 2020-05-25 10:39:06 +0900 | [diff] [blame] | 441 | process_runner_->iptables("filter", {"-D", "FORWARD", "-m", "mark", "--mark", |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 442 | "1/1", "-j", "ACCEPT", "-w"}); |
Taoyu Li | 79871c9 | 2020-07-02 16:09:39 +0900 | [diff] [blame] | 443 | process_runner_->iptables( |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 444 | "filter", {"-D", "FORWARD", "-m", "mark", "--mark", "1/1", "-m", "state", |
Taoyu Li | 79871c9 | 2020-07-02 16:09:39 +0900 | [diff] [blame] | 445 | "--state", "INVALID", "-j", "DROP", "-w"}); |
Garrick Evans | d291af6 | 2020-05-25 10:39:06 +0900 | [diff] [blame] | 446 | } |
| 447 | |
Garrick Evans | ff6e37f | 2020-05-25 10:54:47 +0900 | [diff] [blame] | 448 | bool Datapath::AddInterfaceSNAT(const std::string& ifname) { |
| 449 | return process_runner_->iptables("nat", {"-A", "POSTROUTING", "-o", ifname, |
| 450 | "-j", "MASQUERADE", "-w"}) == 0; |
| 451 | } |
| 452 | |
| 453 | void Datapath::RemoveInterfaceSNAT(const std::string& ifname) { |
| 454 | process_runner_->iptables( |
| 455 | "nat", {"-D", "POSTROUTING", "-o", ifname, "-j", "MASQUERADE", "-w"}); |
| 456 | } |
| 457 | |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 458 | bool Datapath::AddOutboundIPv4SNATMark(const std::string& ifname) { |
| 459 | return process_runner_->iptables( |
| 460 | "mangle", {"-A", "PREROUTING", "-i", ifname, "-j", "MARK", |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 461 | "--set-mark", "1/1", "-w"}) == 0; |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 462 | } |
| 463 | |
| 464 | void Datapath::RemoveOutboundIPv4SNATMark(const std::string& ifname) { |
| 465 | process_runner_->iptables("mangle", {"-D", "PREROUTING", "-i", ifname, "-j", |
Hugo Benichi | 6c44532 | 2020-08-12 16:46:19 +0900 | [diff] [blame] | 466 | "MARK", "--set-mark", "1/1", "-w"}); |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 467 | } |
| 468 | |
Garrick Evans | d291af6 | 2020-05-25 10:39:06 +0900 | [diff] [blame] | 469 | bool Datapath::AddForwardEstablishedRule() { |
| 470 | return process_runner_->iptables( |
| 471 | "filter", {"-A", "FORWARD", "-m", "state", "--state", |
| 472 | "ESTABLISHED,RELATED", "-j", "ACCEPT", "-w"}) == 0; |
| 473 | } |
| 474 | |
| 475 | void Datapath::RemoveForwardEstablishedRule() { |
| 476 | process_runner_->iptables("filter", |
| 477 | {"-D", "FORWARD", "-m", "state", "--state", |
| 478 | "ESTABLISHED,RELATED", "-j", "ACCEPT", "-w"}); |
| 479 | } |
| 480 | |
Garrick Evans | 664a82f | 2019-12-17 12:18:05 +0900 | [diff] [blame] | 481 | bool Datapath::MaskInterfaceFlags(const std::string& ifname, |
| 482 | uint16_t on, |
| 483 | uint16_t off) { |
Taoyu Li | 90c1391 | 2019-11-26 17:56:54 +0900 | [diff] [blame] | 484 | base::ScopedFD sock(socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0)); |
| 485 | if (!sock.is_valid()) { |
| 486 | PLOG(ERROR) << "Failed to create control socket"; |
| 487 | return false; |
| 488 | } |
| 489 | ifreq ifr; |
| 490 | snprintf(ifr.ifr_name, IFNAMSIZ, "%s", ifname.c_str()); |
| 491 | if ((*ioctl_)(sock.get(), SIOCGIFFLAGS, &ifr) < 0) { |
| 492 | PLOG(WARNING) << "ioctl() failed to get interface flag on " << ifname; |
| 493 | return false; |
| 494 | } |
Garrick Evans | 664a82f | 2019-12-17 12:18:05 +0900 | [diff] [blame] | 495 | ifr.ifr_flags |= on; |
| 496 | ifr.ifr_flags &= ~off; |
Taoyu Li | 90c1391 | 2019-11-26 17:56:54 +0900 | [diff] [blame] | 497 | if ((*ioctl_)(sock.get(), SIOCSIFFLAGS, &ifr) < 0) { |
Garrick Evans | 664a82f | 2019-12-17 12:18:05 +0900 | [diff] [blame] | 498 | PLOG(WARNING) << "ioctl() failed to set flag 0x" << std::hex << on |
| 499 | << " unset flag 0x" << std::hex << off << " on " << ifname; |
Taoyu Li | 90c1391 | 2019-11-26 17:56:54 +0900 | [diff] [blame] | 500 | return false; |
| 501 | } |
| 502 | return true; |
| 503 | } |
| 504 | |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 505 | bool Datapath::AddIPv6HostRoute(const std::string& ifname, |
| 506 | const std::string& ipv6_addr, |
| 507 | int ipv6_prefix_len) { |
| 508 | std::string ipv6_addr_cidr = |
| 509 | ipv6_addr + "/" + std::to_string(ipv6_prefix_len); |
| 510 | |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 511 | return process_runner_->ip6("route", "replace", |
| 512 | {ipv6_addr_cidr, "dev", ifname}) == 0; |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 513 | } |
| 514 | |
| 515 | void Datapath::RemoveIPv6HostRoute(const std::string& ifname, |
| 516 | const std::string& ipv6_addr, |
| 517 | int ipv6_prefix_len) { |
| 518 | std::string ipv6_addr_cidr = |
| 519 | ipv6_addr + "/" + std::to_string(ipv6_prefix_len); |
| 520 | |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 521 | process_runner_->ip6("route", "del", {ipv6_addr_cidr, "dev", ifname}); |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 522 | } |
| 523 | |
| 524 | bool Datapath::AddIPv6Neighbor(const std::string& ifname, |
| 525 | const std::string& ipv6_addr) { |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 526 | return process_runner_->ip6("neigh", "add", |
| 527 | {"proxy", ipv6_addr, "dev", ifname}) == 0; |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 528 | } |
| 529 | |
| 530 | void Datapath::RemoveIPv6Neighbor(const std::string& ifname, |
| 531 | const std::string& ipv6_addr) { |
Garrick Evans | 8e8e347 | 2020-01-23 14:03:50 +0900 | [diff] [blame] | 532 | process_runner_->ip6("neigh", "del", {"proxy", ipv6_addr, "dev", ifname}); |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 533 | } |
| 534 | |
Hugo Benichi | d82d883 | 2020-08-14 10:05:03 +0900 | [diff] [blame] | 535 | bool Datapath::ModifyIpForwarding(IpFamily family, |
| 536 | const std::string& op, |
| 537 | const std::string& iif, |
| 538 | const std::string& oif, |
| 539 | bool log_failures) { |
| 540 | if (iif.empty() && oif.empty()) { |
| 541 | LOG(ERROR) << "Cannot change IP forwarding with no input or output " |
| 542 | "interface specified"; |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 543 | return false; |
| 544 | } |
| 545 | |
Hugo Benichi | d82d883 | 2020-08-14 10:05:03 +0900 | [diff] [blame] | 546 | switch (family) { |
| 547 | case IPv4: |
| 548 | case IPv6: |
| 549 | case Dual: |
| 550 | break; |
| 551 | default: |
| 552 | |
| 553 | LOG(ERROR) << "Cannot change IP forwarding from \"" << iif << "\" to \"" |
| 554 | << oif << "\": incorrect IP family " << family; |
| 555 | return false; |
| 556 | } |
| 557 | |
| 558 | std::vector<std::string> args = {op, "FORWARD"}; |
| 559 | if (!iif.empty()) { |
| 560 | args.push_back("-i"); |
| 561 | args.push_back(iif); |
| 562 | } |
| 563 | if (!oif.empty()) { |
| 564 | args.push_back("-o"); |
| 565 | args.push_back(oif); |
| 566 | } |
| 567 | args.push_back("-j"); |
| 568 | args.push_back("ACCEPT"); |
| 569 | args.push_back("-w"); |
| 570 | |
| 571 | bool success = true; |
| 572 | if (family & IpFamily::IPv4) |
| 573 | success &= process_runner_->iptables("filter", args, log_failures) == 0; |
| 574 | if (family & IpFamily::IPv6) |
| 575 | success &= process_runner_->ip6tables("filter", args, log_failures) == 0; |
| 576 | return success; |
| 577 | } |
| 578 | |
| 579 | bool Datapath::StartIpForwarding(IpFamily family, |
| 580 | const std::string& iif, |
| 581 | const std::string& oif) { |
| 582 | return ModifyIpForwarding(family, "-A", iif, oif); |
| 583 | } |
| 584 | |
| 585 | bool Datapath::StopIpForwarding(IpFamily family, |
| 586 | const std::string& iif, |
| 587 | const std::string& oif) { |
| 588 | return ModifyIpForwarding(family, "-D", iif, oif); |
| 589 | } |
| 590 | |
| 591 | bool Datapath::AddIPv6Forwarding(const std::string& ifname1, |
| 592 | const std::string& ifname2) { |
| 593 | // Only start Ipv6 forwarding if -C returns false and it had not been |
| 594 | // started yet. |
| 595 | if (!ModifyIpForwarding(IpFamily::IPv6, "-C", ifname1, ifname2, |
| 596 | false /*log_failures*/) && |
| 597 | !StartIpForwarding(IpFamily::IPv6, ifname1, ifname2)) { |
| 598 | return false; |
| 599 | } |
| 600 | |
| 601 | if (!ModifyIpForwarding(IpFamily::IPv6, "-C", ifname2, ifname1, |
| 602 | false /*log_failures*/) && |
| 603 | !StartIpForwarding(IpFamily::IPv6, ifname2, ifname1)) { |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 604 | RemoveIPv6Forwarding(ifname1, ifname2); |
| 605 | return false; |
| 606 | } |
| 607 | |
| 608 | return true; |
| 609 | } |
| 610 | |
| 611 | void Datapath::RemoveIPv6Forwarding(const std::string& ifname1, |
| 612 | const std::string& ifname2) { |
Hugo Benichi | d82d883 | 2020-08-14 10:05:03 +0900 | [diff] [blame] | 613 | StopIpForwarding(IpFamily::IPv6, ifname1, ifname2); |
| 614 | StopIpForwarding(IpFamily::IPv6, ifname2, ifname1); |
Garrick Evans | 260ff30 | 2019-07-25 11:22:50 +0900 | [diff] [blame] | 615 | } |
| 616 | |
Garrick Evans | 3d97a39 | 2020-02-21 15:24:37 +0900 | [diff] [blame] | 617 | bool Datapath::AddIPv4Route(uint32_t gateway_addr, |
| 618 | uint32_t addr, |
| 619 | uint32_t netmask) { |
| 620 | struct rtentry route; |
| 621 | memset(&route, 0, sizeof(route)); |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 622 | SetSockaddrIn(&route.rt_gateway, gateway_addr); |
| 623 | SetSockaddrIn(&route.rt_dst, addr & netmask); |
| 624 | SetSockaddrIn(&route.rt_genmask, netmask); |
Garrick Evans | 3d97a39 | 2020-02-21 15:24:37 +0900 | [diff] [blame] | 625 | route.rt_flags = RTF_UP | RTF_GATEWAY; |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 626 | return ModifyRtentry(SIOCADDRT, &route); |
| 627 | } |
Garrick Evans | 3d97a39 | 2020-02-21 15:24:37 +0900 | [diff] [blame] | 628 | |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 629 | bool Datapath::DeleteIPv4Route(uint32_t gateway_addr, |
| 630 | uint32_t addr, |
| 631 | uint32_t netmask) { |
| 632 | struct rtentry route; |
| 633 | memset(&route, 0, sizeof(route)); |
| 634 | SetSockaddrIn(&route.rt_gateway, gateway_addr); |
| 635 | SetSockaddrIn(&route.rt_dst, addr & netmask); |
| 636 | SetSockaddrIn(&route.rt_genmask, netmask); |
| 637 | route.rt_flags = RTF_UP | RTF_GATEWAY; |
| 638 | return ModifyRtentry(SIOCDELRT, &route); |
| 639 | } |
| 640 | |
| 641 | bool Datapath::AddIPv4Route(const std::string& ifname, |
| 642 | uint32_t addr, |
| 643 | uint32_t netmask) { |
| 644 | struct rtentry route; |
| 645 | memset(&route, 0, sizeof(route)); |
| 646 | SetSockaddrIn(&route.rt_dst, addr & netmask); |
| 647 | SetSockaddrIn(&route.rt_genmask, netmask); |
| 648 | char rt_dev[IFNAMSIZ]; |
| 649 | strncpy(rt_dev, ifname.c_str(), IFNAMSIZ); |
| 650 | rt_dev[IFNAMSIZ - 1] = '\0'; |
| 651 | route.rt_dev = rt_dev; |
| 652 | route.rt_flags = RTF_UP | RTF_GATEWAY; |
| 653 | return ModifyRtentry(SIOCADDRT, &route); |
| 654 | } |
| 655 | |
| 656 | bool Datapath::DeleteIPv4Route(const std::string& ifname, |
| 657 | uint32_t addr, |
| 658 | uint32_t netmask) { |
| 659 | struct rtentry route; |
| 660 | memset(&route, 0, sizeof(route)); |
| 661 | SetSockaddrIn(&route.rt_dst, addr & netmask); |
| 662 | SetSockaddrIn(&route.rt_genmask, netmask); |
| 663 | char rt_dev[IFNAMSIZ]; |
| 664 | strncpy(rt_dev, ifname.c_str(), IFNAMSIZ); |
| 665 | rt_dev[IFNAMSIZ - 1] = '\0'; |
| 666 | route.rt_dev = rt_dev; |
| 667 | route.rt_flags = RTF_UP | RTF_GATEWAY; |
| 668 | return ModifyRtentry(SIOCDELRT, &route); |
| 669 | } |
| 670 | |
| 671 | bool Datapath::ModifyRtentry(unsigned long op, struct rtentry* route) { |
| 672 | DCHECK(route); |
| 673 | if (op != SIOCADDRT && op != SIOCDELRT) { |
Andreea Costinas | 34aa7a9 | 2020-08-04 10:36:10 +0200 | [diff] [blame] | 674 | LOG(ERROR) << "Invalid operation " << op << " for rtentry " << *route; |
Garrick Evans | 3d97a39 | 2020-02-21 15:24:37 +0900 | [diff] [blame] | 675 | return false; |
| 676 | } |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 677 | base::ScopedFD fd(socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0)); |
| 678 | if (!fd.is_valid()) { |
Andreea Costinas | 34aa7a9 | 2020-08-04 10:36:10 +0200 | [diff] [blame] | 679 | PLOG(ERROR) << "Failed to create socket for adding rtentry " << *route; |
Hugo Benichi | e8758b5 | 2020-04-03 14:49:01 +0900 | [diff] [blame] | 680 | return false; |
| 681 | } |
| 682 | if (HANDLE_EINTR(ioctl_(fd.get(), op, route)) != 0) { |
| 683 | std::string opname = op == SIOCADDRT ? "add" : "delete"; |
Andreea Costinas | 34aa7a9 | 2020-08-04 10:36:10 +0200 | [diff] [blame] | 684 | PLOG(ERROR) << "Failed to " << opname << " rtentry " << *route; |
Garrick Evans | 3d97a39 | 2020-02-21 15:24:37 +0900 | [diff] [blame] | 685 | return false; |
| 686 | } |
| 687 | return true; |
| 688 | } |
| 689 | |
Jason Jeremy Iman | a7273a3 | 2020-08-04 11:25:31 +0900 | [diff] [blame] | 690 | bool Datapath::AddAdbPortForwardRule(const std::string& ifname) { |
| 691 | return firewall_->AddIpv4ForwardRule(patchpanel::ModifyPortRuleRequest::TCP, |
| 692 | kArcAddr, kAdbServerPort, ifname, |
| 693 | kLocalhostAddr, kAdbProxyTcpListenPort); |
| 694 | } |
| 695 | |
| 696 | void Datapath::DeleteAdbPortForwardRule(const std::string& ifname) { |
| 697 | firewall_->DeleteIpv4ForwardRule(patchpanel::ModifyPortRuleRequest::TCP, |
| 698 | kArcAddr, kAdbServerPort, ifname, |
| 699 | kLocalhostAddr, kAdbProxyTcpListenPort); |
| 700 | } |
| 701 | |
| 702 | bool Datapath::AddAdbPortAccessRule(const std::string& ifname) { |
| 703 | return firewall_->AddAcceptRules(patchpanel::ModifyPortRuleRequest::TCP, |
| 704 | kAdbProxyTcpListenPort, ifname); |
| 705 | } |
| 706 | |
| 707 | void Datapath::DeleteAdbPortAccessRule(const std::string& ifname) { |
| 708 | firewall_->DeleteAcceptRules(patchpanel::ModifyPortRuleRequest::TCP, |
| 709 | kAdbProxyTcpListenPort, ifname); |
| 710 | } |
| 711 | |
Garrick Evans | 3388a03 | 2020-03-24 11:25:55 +0900 | [diff] [blame] | 712 | } // namespace patchpanel |