Add Functions to flush SADB, Policy DB, and Ifaces
-Add ipSecFlushState() which flushes the kernel's
SA DB and Policy DB.
-Add ipSecFlushInterfaces() which seeks and removes
any interfaces that have the prefix 'ipsec'
-Automatically call these functions when netd restarts
-Make XfrmController's methods static
-Add integration tests to verify flushing of policy
states, and interfaces
-Convert XfrmController functions to static for easier
test-ability
Bug: 74560705
Test: runtest ...netd_integration_test.cpp
Merged-In: Id60e7c29ff9aeee7f5ccd505b86c94cce858745f
Change-Id: Id60e7c29ff9aeee7f5ccd505b86c94cce858745f
(cherry picked from commit f5646cde551de44ba10b61c2d5cecb414847d454)
diff --git a/server/XfrmController.cpp b/server/XfrmController.cpp
index 16af043..0317779 100644
--- a/server/XfrmController.cpp
+++ b/server/XfrmController.cpp
@@ -39,6 +39,7 @@
#include <sys/wait.h>
#include <linux/in.h>
+#include <linux/ipsec.h>
#include <linux/netlink.h>
#include <linux/xfrm.h>
@@ -47,6 +48,7 @@
#include "android-base/unique_fd.h"
#include <log/log_properties.h>
#define LOG_TAG "XfrmController"
+#include "InterfaceController.h"
#include "NetdConstants.h"
#include "NetlinkCommands.h"
#include "ResponseCode.h"
@@ -83,6 +85,9 @@
constexpr uint32_t INVALID_SPI = 0;
+// Must match TUNNEL_INTERFACE_PREFIX in IpSecService.java
+constexpr char const* TUNNEL_INTERFACE_PREFIX = "ipsec";
+
#define XFRM_MSG_TRANS(x) \
case x: \
return #x;
@@ -370,6 +375,45 @@
//
XfrmController::XfrmController(void) {}
+netdutils::Status XfrmController::Init() {
+ RETURN_IF_NOT_OK(flushInterfaces());
+ XfrmSocketImpl sock;
+ RETURN_IF_NOT_OK(sock.open());
+ RETURN_IF_NOT_OK(flushSaDb(sock));
+ return flushPolicyDb(sock);
+}
+
+netdutils::Status XfrmController::flushInterfaces() {
+ const auto& ifaces = InterfaceController::getIfaceNames();
+ RETURN_IF_NOT_OK(ifaces);
+
+ for (const std::string& iface : ifaces.value()) {
+ int status = 0;
+ // Look for the reserved interface prefix, which must be in the name at position 0
+ if (iface.find(TUNNEL_INTERFACE_PREFIX) == 0 &&
+ (status = removeVirtualTunnelInterface(iface)) < 0) {
+ ALOGE("Failed to delete ipsec tunnel %s.", iface.c_str());
+ return netdutils::statusFromErrno(status, "Failed to remove ipsec tunnel.");
+ }
+ }
+ return netdutils::status::ok;
+}
+
+netdutils::Status XfrmController::flushSaDb(const XfrmSocket& s) {
+ struct xfrm_usersa_flush flushUserSa = {.proto = IPSEC_PROTO_ANY};
+
+ std::vector<iovec> iov = {{NULL, 0}, // reserved for the eventual addition of a NLMSG_HDR
+ {&flushUserSa, sizeof(flushUserSa)}, // xfrm_usersa_flush structure
+ {kPadBytes, NLMSG_ALIGN(sizeof(flushUserSa)) - sizeof(flushUserSa)}};
+
+ return s.sendMessage(XFRM_MSG_FLUSHSA, NETLINK_REQUEST_FLAGS, 0, &iov);
+}
+
+netdutils::Status XfrmController::flushPolicyDb(const XfrmSocket& s) {
+ std::vector<iovec> iov = {{NULL, 0}}; // reserved for the eventual addition of a NLMSG_HDR
+ return s.sendMessage(XFRM_MSG_FLUSHPOLICY, NETLINK_REQUEST_FLAGS, 0, &iov);
+}
+
netdutils::Status XfrmController::ipSecSetEncapSocketOwner(const android::base::unique_fd& socket,
int newUid, uid_t callerUid) {
ALOGD("XfrmController:%s, line=%d", __FUNCTION__, __LINE__);