Update routing rules.
As per the latest changes to: http://go/android-multinetwork-routing
Functional changes:
+ Add explicit=NO to the implicit network rules, though it's a no-op.
+ Remove most of the UID=0 (kernel access) rules since they are no longer
needed, except in one case to allow access to a VPN.
+ Add the explicit, protect and permissions bits to the incoming packet mark.
+ VPNs now don't need an implicit network rule.
+ Modifying network permissions now modifies the incoming packet mark as well.
Cosmetic changes:
+ Renamed the legacy tables to match their permissions (SYSTEM and NETWORK).
+ Renamed most functions and methods for clarity and consistency.
+ Renamed and adjusted some ule priorities.
+ Move most rule modifications into their own functions, to prevent brittle
reliance on the previous state of the fwmark/mask variables.
Change-Id: I958a7e158ee918d5254de606fcfa55fe23327438
diff --git a/server/PhysicalNetwork.cpp b/server/PhysicalNetwork.cpp
index 6fa953c..395bea4 100644
--- a/server/PhysicalNetwork.cpp
+++ b/server/PhysicalNetwork.cpp
@@ -25,7 +25,7 @@
WARN_UNUSED_RESULT int addToDefault(unsigned netId, const std::string& interface,
Permission permission) {
- if (int ret = RouteController::addToDefaultNetwork(interface.c_str(), permission)) {
+ if (int ret = RouteController::addInterfaceToDefaultNetwork(interface.c_str(), permission)) {
ALOGE("failed to add interface %s to default netId %u", interface.c_str(), netId);
return ret;
}
@@ -34,7 +34,8 @@
WARN_UNUSED_RESULT int removeFromDefault(unsigned netId, const std::string& interface,
Permission permission) {
- if (int ret = RouteController::removeFromDefaultNetwork(interface.c_str(), permission)) {
+ if (int ret = RouteController::removeInterfaceFromDefaultNetwork(interface.c_str(),
+ permission)) {
ALOGE("failed to remove interface %s from default netId %u", interface.c_str(), netId);
return ret;
}
@@ -59,8 +60,8 @@
return 0;
}
for (const std::string& interface : mInterfaces) {
- if (int ret = RouteController::modifyNetworkPermission(mNetId, interface.c_str(),
- mPermission, permission)) {
+ if (int ret = RouteController::modifyPhysicalNetworkPermission(mNetId, interface.c_str(),
+ mPermission, permission)) {
ALOGE("failed to change permission on interface %s of netId %u from %x to %x",
interface.c_str(), mNetId, mPermission, permission);
return ret;
@@ -114,7 +115,8 @@
if (hasInterface(interface)) {
return 0;
}
- if (int ret = RouteController::addInterfaceToNetwork(mNetId, interface.c_str(), mPermission)) {
+ if (int ret = RouteController::addInterfaceToPhysicalNetwork(mNetId, interface.c_str(),
+ mPermission)) {
ALOGE("failed to add interface %s to netId %u", interface.c_str(), mNetId);
return ret;
}
@@ -131,8 +133,8 @@
if (!hasInterface(interface)) {
return 0;
}
- if (int ret = RouteController::removeInterfaceFromNetwork(mNetId, interface.c_str(),
- mPermission)) {
+ if (int ret = RouteController::removeInterfaceFromPhysicalNetwork(mNetId, interface.c_str(),
+ mPermission)) {
ALOGE("failed to remove interface %s from netId %u", interface.c_str(), mNetId);
return ret;
}