aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src/wg-quick/android.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/wg-quick/android.c')
-rw-r--r--src/wg-quick/android.c129
1 files changed, 86 insertions, 43 deletions
diff --git a/src/wg-quick/android.c b/src/wg-quick/android.c
index 54ea81c..1263ee4 100644
--- a/src/wg-quick/android.c
+++ b/src/wg-quick/android.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
/*
- * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ * Copyright (C) 2015-2021 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
*
* This is a shell script written in C. It very intentionally still functions like
* a shell script, calling out to external executables such as ip(8).
@@ -25,6 +25,7 @@
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/param.h>
+#include <sys/system_properties.h>
#ifndef WG_PACKAGE_NAME
#define WG_PACKAGE_NAME "com.wireguard.android"
@@ -39,6 +40,7 @@
static bool is_exiting = false;
static bool binder_available = false;
+static unsigned int sdk_version;
static void *xmalloc(size_t size)
{
@@ -726,8 +728,8 @@ static void up_if(unsigned int *netid, const char *iface, uint16_t listen_port)
cmd("iptables -I INPUT 1 -p udp --dport %u -j ACCEPT -m comment --comment \"wireguard rule %s\"", listen_port, iface);
cmd("ip6tables -I INPUT 1 -p udp --dport %u -j %s -m comment --comment \"wireguard rule %s\"", listen_port, should_block_ipv6(iface) ? "DROP" : "ACCEPT", iface);
}
- cndc("interface setcfg %s up", iface);
- cndc("network create %u vpn 1 1", *netid);
+ cmd("ip link set up dev %s", iface);
+ cndc(sdk_version < 31 ? "network create %u vpn 1 1" : "network create %u vpn 1", *netid);
cndc("network interface add %u %s", *netid, iface);
}
@@ -782,31 +784,50 @@ static uid_t *get_uid_list(const char *selected_applications)
return uid_list;
}
-static void set_users(unsigned int netid, const char *excluded_applications)
+static void set_users(unsigned int netid, const char *excluded_applications, const char *included_applications)
{
- _cleanup_free_ uid_t *excluded_uids = get_uid_list(excluded_applications);
+ _cleanup_free_ uid_t *uids = NULL;
+ uid_t *uid;
unsigned int args_per_command = 0;
_cleanup_free_ char *ranges = NULL;
char range[22];
uid_t start;
- for (start = 0; *excluded_uids; start = *excluded_uids + 1, ++excluded_uids) {
- if (start > *excluded_uids - 1)
- continue;
- else if (start == *excluded_uids - 1)
- snprintf(range, sizeof(range), "%u", start);
- else
- snprintf(range, sizeof(range), "%u-%u", start, *excluded_uids - 1);
- ranges = concat_and_free(ranges, " ", range);
- if (++args_per_command % 18 == 0) {
- cndc("network users add %u %s", netid, ranges);
- free(ranges);
- ranges = NULL;
- }
+ if (excluded_applications && included_applications) {
+ fprintf(stderr, "Error: only one of ExcludedApplications and IncludedApplications may be specified, but not both\n");
+ exit(EEXIST);
}
- if (start < 99999) {
- snprintf(range, sizeof(range), "%u-99999", start);
- ranges = concat_and_free(ranges, " ", range);
+
+ if (excluded_applications || !included_applications) {
+ uid = uids = get_uid_list(excluded_applications);
+ for (start = 0; *uid; start = *uid + 1, ++uid) {
+ if (start > *uid - 1)
+ continue;
+ else if (start == *uid - 1)
+ snprintf(range, sizeof(range), "%u", start);
+ else
+ snprintf(range, sizeof(range), "%u-%u", start, *uid - 1);
+ ranges = concat_and_free(ranges, " ", range);
+ if (++args_per_command % 18 == 0) {
+ cndc("network users add %u %s", netid, ranges);
+ free(ranges);
+ ranges = NULL;
+ }
+ }
+ if (start < 99999) {
+ snprintf(range, sizeof(range), "%u-99999", start);
+ ranges = concat_and_free(ranges, " ", range);
+ }
+ } else {
+ for (uid = uids = get_uid_list(included_applications); *uid; ++uid) {
+ snprintf(range, sizeof(range), "%u", *uid);
+ ranges = concat_and_free(ranges, " ", range);
+ if (++args_per_command % 18 == 0) {
+ cndc("network users add %u %s", netid, ranges);
+ free(ranges);
+ ranges = NULL;
+ }
+ }
}
if (ranges)
@@ -819,37 +840,49 @@ static void set_dnses(unsigned int netid, const char *dnses)
if (len > (1<<16))
return;
_cleanup_free_ char *mutable = xstrdup(dnses);
- _cleanup_free_ char *shell_arglist = xmalloc(len * 4 + 1);
- _cleanup_free_ char *function_arglist = xmalloc(len * 4 + 1);
+ _cleanup_free_ char *dns_shell_arglist = xmalloc(len * 4 + 1);
+ _cleanup_free_ char *dns_search_shell_arglist = xmalloc(len * 4 + 1);
+ _cleanup_free_ char *dns_function_arglist = xmalloc(len * 4 + 1);
+ _cleanup_free_ char *dns_search_function_arglist = xmalloc(len * 4 + 1);
_cleanup_free_ char *arg = xmalloc(len + 4);
_cleanup_free_ char **dns_list = NULL;
+ _cleanup_free_ char **dns_search_list = NULL;
_cleanup_binder_ AIBinder *handle = NULL;
- size_t dns_list_size = 0;
+ _cleanup_regfree_ regex_t regex_ipnothost = { 0 };
+ size_t dns_list_size = 0, dns_search_list_size = 0;
+ bool is_ip;
if (!len)
return;
+
+ xregcomp(&regex_ipnothost, "(^[0-9.]+$)|(^.*:.*$)", REG_EXTENDED | REG_NOSUB);
for (char *dns = strtok(mutable, ", \t\n"); dns; dns = strtok(NULL, ", \t\n")) {
if (strchr(dns, '\'') || strchr(dns, '\\'))
continue;
- ++dns_list_size;
+ ++*(!regexec(&regex_ipnothost, dns, 0, NULL, 0) ? &dns_list_size : &dns_search_list_size);
}
if (!dns_list_size)
return;
dns_list = xcalloc(dns_list_size + 1, sizeof(*dns_list));
+ dns_search_list = xcalloc(dns_search_list_size + 1, sizeof(*dns_search_list));
free(mutable);
mutable = xstrdup(dnses);
- shell_arglist[0] = '\0';
- function_arglist[0] = '\0';
+ dns_shell_arglist[0] = '\0';
+ dns_search_shell_arglist[0] = '\0';
+ dns_function_arglist[0] = '\0';
+ dns_search_function_arglist[0] = '\0';
dns_list_size = 0;
+ dns_search_list_size = 0;
for (char *dns = strtok(mutable, ", \t\n"); dns; dns = strtok(NULL, ", \t\n")) {
if (strchr(dns, '\'') || strchr(dns, '\\'))
continue;
+ is_ip = !regexec(&regex_ipnothost, dns, 0, NULL, 0);
snprintf(arg, len + 3, "'%s' ", dns);
- strncat(shell_arglist, arg, len * 4 - 1);
- snprintf(arg, len + 2, function_arglist[0] == '\0' ? "%s" : ", %s", dns);
- strncat(function_arglist, arg, len * 4 - 1);
- dns_list[dns_list_size++] = dns;
+ strncat(is_ip ? dns_shell_arglist : dns_search_shell_arglist, arg, len * 4 - 1);
+ snprintf(arg, len + 2, (is_ip ? dns_function_arglist[0] : dns_search_function_arglist[0]) == '\0' ? "%s" : ", %s", dns);
+ strncat(is_ip ? dns_function_arglist : dns_search_function_arglist, arg, len * 4 - 1);
+ *(is_ip ? &dns_list[dns_list_size++] : &dns_search_list[dns_search_list_size++]) = dns;
}
if ((handle = dnsresolver_get_handle())) {
@@ -871,15 +904,16 @@ static void set_dnses(unsigned int netid, const char *dnses)
.base_timeout_msec = DNSRESOLVER_BASE_TIMEOUT,
.retry_count = DNSRESOLVER_RETRY_COUNT,
.servers = dns_list,
- .domains = (char *[]){NULL},
+ .domains = dns_search_list,
.tls_name = "",
.tls_servers = (char *[]){NULL},
.tls_fingerprints = (char *[]){NULL}
};
- printf("[#] <binder>::dnsResolver->setResolverConfiguration(%u, [%s], [], %d, %d, %d, %d, %d, %d, [], [])\n",
- netid, function_arglist, DNSRESOLVER_SAMPLE_VALIDITY, DNSRESOLVER_SUCCESS_THRESHOLD,
- DNSRESOLVER_MIN_SAMPLES, DNSRESOLVER_MAX_SAMPLES, DNSRESOLVER_BASE_TIMEOUT, DNSRESOLVER_RETRY_COUNT);
+ printf("[#] <binder>::dnsResolver->setResolverConfiguration(%u, [%s], [%s], %d, %d, %d, %d, %d, %d, [], [])\n",
+ netid, dns_function_arglist, dns_search_function_arglist, DNSRESOLVER_SAMPLE_VALIDITY,
+ DNSRESOLVER_SUCCESS_THRESHOLD, DNSRESOLVER_MIN_SAMPLES, DNSRESOLVER_MAX_SAMPLES,
+ DNSRESOLVER_BASE_TIMEOUT, DNSRESOLVER_RETRY_COUNT);
status = dnsresolver_set_resolver_configuration(handle, &params);
if (status != 0) {
@@ -887,7 +921,7 @@ static void set_dnses(unsigned int netid, const char *dnses)
exit(ENONET);
}
} else
- cndc("resolver setnetdns %u '' %s", netid, shell_arglist);
+ cndc("resolver setnetdns %u '%s' %s", netid, dns_search_shell_arglist, dns_shell_arglist);
}
static void add_addr(const char *iface, const char *addr)
@@ -1063,7 +1097,8 @@ static void cmd_usage(const char *program)
" IP addresses (with an optional CIDR mask) to be set for the interface.\n"
" - MTU: an optional MTU for the interface; if unspecified, auto-calculated.\n"
" - DNS: an optional DNS server to use while the device is up.\n"
- " - ExcludedApplications: optional applications to exclude from the tunnel.\n\n"
+ " - ExcludedApplications: optional blacklist of applications to exclude from the tunnel.\n\n"
+ " - IncludedApplications: optional whitelist of applications to include in the tunnel.\n\n"
" See wg-quick(8) for more info and examples.\n");
}
@@ -1077,7 +1112,7 @@ static void cmd_up_cleanup(void)
free(cleanup_iface);
}
-static void cmd_up(const char *iface, const char *config, unsigned int mtu, const char *addrs, const char *dnses, const char *excluded_applications)
+static void cmd_up(const char *iface, const char *config, unsigned int mtu, const char *addrs, const char *dnses, const char *excluded_applications, const char *included_applications)
{
DEFINE_CMD(c);
unsigned int netid = 0;
@@ -1099,7 +1134,7 @@ static void cmd_up(const char *iface, const char *config, unsigned int mtu, cons
set_dnses(netid, dnses);
set_routes(iface, netid);
set_mtu(iface, mtu);
- set_users(netid, excluded_applications);
+ set_users(netid, excluded_applications, included_applications);
broadcast_change();
free(cleanup_iface);
@@ -1131,7 +1166,7 @@ static void cmd_down(const char *iface)
exit(EXIT_SUCCESS);
}
-static void parse_options(char **iface, char **config, unsigned int *mtu, char **addrs, char **dnses, char **excluded_applications, const char *arg)
+static void parse_options(char **iface, char **config, unsigned int *mtu, char **addrs, char **dnses, char **excluded_applications, char **included_applications, const char *arg)
{
_cleanup_fclose_ FILE *file = NULL;
_cleanup_free_ char *line = NULL;
@@ -1215,6 +1250,9 @@ static void parse_options(char **iface, char **config, unsigned int *mtu, char *
} else if (!strncasecmp(clean, "ExcludedApplications=", 21) && j > 4) {
*excluded_applications = concat_and_free(*excluded_applications, ",", clean + 21);
continue;
+ } else if (!strncasecmp(clean, "IncludedApplications=", 21) && j > 4) {
+ *included_applications = concat_and_free(*included_applications, ",", clean + 21);
+ continue;
} else if (!strncasecmp(clean, "MTU=", 4) && j > 4) {
*mtu = atoi(clean + 4);
continue;
@@ -1240,17 +1278,22 @@ int main(int argc, char *argv[])
_cleanup_free_ char *addrs = NULL;
_cleanup_free_ char *dnses = NULL;
_cleanup_free_ char *excluded_applications = NULL;
+ _cleanup_free_ char *included_applications = NULL;
unsigned int mtu;
+ char prop[PROP_VALUE_MAX + 1];
+
+ if (__system_property_get("ro.build.version.sdk", prop))
+ sdk_version = atoi(prop);
if (argc == 2 && (!strcmp(argv[1], "help") || !strcmp(argv[1], "--help") || !strcmp(argv[1], "-h")))
cmd_usage(argv[0]);
else if (argc == 3 && !strcmp(argv[1], "up")) {
auto_su(argc, argv);
- parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, argv[2]);
- cmd_up(iface, config, mtu, addrs, dnses, excluded_applications);
+ parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, &included_applications, argv[2]);
+ cmd_up(iface, config, mtu, addrs, dnses, excluded_applications, included_applications);
} else if (argc == 3 && !strcmp(argv[1], "down")) {
auto_su(argc, argv);
- parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, argv[2]);
+ parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, &included_applications, argv[2]);
cmd_down(iface);
} else {
cmd_usage(argv[0]);
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.