1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
/*
* Copyright (C) 2014 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "FwmarkClient.h"
#include "FwmarkCommand.h"
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>
#include <algorithm> // std::size()
#include <iterator>
namespace {
// Env flag to control whether FwmarkClient sends sockets to netd for marking.
// This can only be disabled when the process running as root and is meant for kernel testing.
inline constexpr char ANDROID_NO_USE_FWMARK_CLIENT[] = "ANDROID_NO_USE_FWMARK_CLIENT";
const sockaddr_un FWMARK_SERVER_PATH = {AF_UNIX, "/dev/socket/fwmarkd"};
bool commandHasFd(int cmdId) {
return (cmdId != FwmarkCommand::QUERY_USER_ACCESS);
}
} // namespace
bool FwmarkClient::shouldSetFwmark(int family) {
// Checking whether family is supported before checking whether this can be
// disabled. Because there are existing processes using AF_LOCAL socket but it
// doesn't have permission to call geteuid(). Reference b/135422468.
if (!FwmarkCommand::isSupportedFamily(family)) {
return false;
}
// Permit processes running as root to disable marking. This is required, for
// example, to run the kernel networking tests.
if (getenv(ANDROID_NO_USE_FWMARK_CLIENT) && geteuid() == 0) {
return false;
}
return true;
}
FwmarkClient::FwmarkClient() : mChannel(-1) {
}
FwmarkClient::~FwmarkClient() {
if (mChannel >= 0) {
close(mChannel);
}
}
int FwmarkClient::send(FwmarkCommand* data, int fd, FwmarkConnectInfo* connectInfo) {
mChannel = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
if (mChannel == -1) {
return -errno;
}
if (TEMP_FAILURE_RETRY(connect(mChannel, reinterpret_cast<const sockaddr*>(&FWMARK_SERVER_PATH),
sizeof(FWMARK_SERVER_PATH))) == -1) {
// If we are unable to connect to the fwmark server, assume there's no error. This protects
// against future changes if the fwmark server goes away.
// TODO: This means that fd will very likely be misrouted. See if we can delete this in a
// separate CL.
return 0;
}
iovec iov[2] = {
{ data, sizeof(*data) },
{ connectInfo, (connectInfo ? sizeof(*connectInfo) : 0) },
};
msghdr message;
memset(&message, 0, sizeof(message));
message.msg_iov = iov;
message.msg_iovlen = std::size(iov);
union {
cmsghdr cmh;
char cmsg[CMSG_SPACE(sizeof(fd))];
} cmsgu;
if (commandHasFd(data->cmdId)) {
memset(cmsgu.cmsg, 0, sizeof(cmsgu.cmsg));
message.msg_control = cmsgu.cmsg;
message.msg_controllen = sizeof(cmsgu.cmsg);
cmsghdr* const cmsgh = CMSG_FIRSTHDR(&message);
cmsgh->cmsg_len = CMSG_LEN(sizeof(fd));
cmsgh->cmsg_level = SOL_SOCKET;
cmsgh->cmsg_type = SCM_RIGHTS;
memcpy(CMSG_DATA(cmsgh), &fd, sizeof(fd));
}
if (TEMP_FAILURE_RETRY(sendmsg(mChannel, &message, 0)) == -1) {
return -errno;
}
int error = 0;
if (TEMP_FAILURE_RETRY(recv(mChannel, &error, sizeof(error), 0)) == -1) {
return -errno;
}
return error;
}
|
