amigan/wireguard-tools
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

wg-quick: android: support application whitelist

Browse source 
Prior we only supported a blacklist, but actually a whitelist is an
easier algorithm because that's internally how netd considers it, so we
don't need to find range spans. This commit adds an IncludedApplications
key.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This commit is contained in:
Jason A. Donenfeld 2020-04-05 19:38:11 -06:00
parent 20e28d2b0f
commit e189f9942d
1 changed files with 48 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
src/wg-quick/android.c
View file

@ -782,21 +782,28 @@ static uid_t *get_uid_list(const char *selected_applications)
return uid_list; return uid_list;
} }
static void set_users(unsigned int netid, const char *excluded_applications) static void set_users(unsigned int netid, const char *excluded_applications, const char *included_applications)
{ {
_cleanup_free_ uid_t *excluded_uids = get_uid_list(excluded_applications); _cleanup_free_ uid_t *uids = NULL;
unsigned int args_per_command = 0; unsigned int args_per_command = 0;
_cleanup_free_ char *ranges = NULL; _cleanup_free_ char *ranges = NULL;
char range[22]; char range[22];
uid_t start; uid_t start;
for (start = 0; *excluded_uids; start = *excluded_uids + 1, ++excluded_uids) { if (excluded_applications && included_applications) {
if (start > *excluded_uids - 1) fprintf(stderr, "Error: only one of ExcludedApplications and IncludedApplications may be specified, but not both\n");
exit(EEXIST);
}
if (excluded_applications || !included_applications) {
uids = get_uid_list(excluded_applications);
for (start = 0; *uids; start = *uids + 1, ++uids) {
if (start > *uids - 1)
continue; continue;
else if (start == *excluded_uids - 1) else if (start == *uids - 1)
snprintf(range, sizeof(range), "%u", start); snprintf(range, sizeof(range), "%u", start);
else else
snprintf(range, sizeof(range), "%u-%u", start, *excluded_uids - 1); snprintf(range, sizeof(range), "%u-%u", start, *uids - 1);
ranges = concat_and_free(ranges, " ", range); ranges = concat_and_free(ranges, " ", range);
if (++args_per_command % 18 == 0) { if (++args_per_command % 18 == 0) {
cndc("network users add %u %s", netid, ranges); cndc("network users add %u %s", netid, ranges);
@ -808,6 +815,17 @@ static void set_users(unsigned int netid, const char *excluded_applications)
snprintf(range, sizeof(range), "%u-99999", start); snprintf(range, sizeof(range), "%u-99999", start);
ranges = concat_and_free(ranges, " ", range); ranges = concat_and_free(ranges, " ", range);
} }
} else {
for (uids = get_uid_list(included_applications); *uids; ++uids) {
snprintf(range, sizeof(range), "%u", *uids);
ranges = concat_and_free(ranges, " ", range);
if (++args_per_command % 18 == 0) {
cndc("network users add %u %s", netid, ranges);
free(ranges);
ranges = NULL;
}
}
}
if (ranges) if (ranges)
cndc("network users add %u %s", netid, ranges); cndc("network users add %u %s", netid, ranges);
@ -1063,7 +1081,8 @@ static void cmd_usage(const char *program)
" IP addresses (with an optional CIDR mask) to be set for the interface.\n" " IP addresses (with an optional CIDR mask) to be set for the interface.\n"
" - MTU: an optional MTU for the interface; if unspecified, auto-calculated.\n" " - MTU: an optional MTU for the interface; if unspecified, auto-calculated.\n"
" - DNS: an optional DNS server to use while the device is up.\n" " - DNS: an optional DNS server to use while the device is up.\n"
" - ExcludedApplications: optional applications to exclude from the tunnel.\n\n" " - ExcludedApplications: optional blacklist of applications to exclude from the tunnel.\n\n"
" - IncludedApplications: optional whitelist of applications to include in the tunnel.\n\n"
" See wg-quick(8) for more info and examples.\n"); " See wg-quick(8) for more info and examples.\n");
} }
@ -1077,7 +1096,7 @@ static void cmd_up_cleanup(void)
free(cleanup_iface); free(cleanup_iface);
} }
static void cmd_up(const char *iface, const char *config, unsigned int mtu, const char *addrs, const char *dnses, const char *excluded_applications) static void cmd_up(const char *iface, const char *config, unsigned int mtu, const char *addrs, const char *dnses, const char *excluded_applications, const char *included_applications)
{ {
DEFINE_CMD(c); DEFINE_CMD(c);
unsigned int netid = 0; unsigned int netid = 0;
@ -1099,7 +1118,7 @@ static void cmd_up(const char *iface, const char *config, unsigned int mtu, cons
set_dnses(netid, dnses); set_dnses(netid, dnses);
set_routes(iface, netid); set_routes(iface, netid);
set_mtu(iface, mtu); set_mtu(iface, mtu);
set_users(netid, excluded_applications); set_users(netid, excluded_applications, included_applications);
broadcast_change(); broadcast_change();
free(cleanup_iface); free(cleanup_iface);
@ -1131,7 +1150,7 @@ static void cmd_down(const char *iface)
exit(EXIT_SUCCESS); exit(EXIT_SUCCESS);
} }
static void parse_options(char **iface, char **config, unsigned int *mtu, char **addrs, char **dnses, char **excluded_applications, const char *arg) static void parse_options(char **iface, char **config, unsigned int *mtu, char **addrs, char **dnses, char **excluded_applications, char **included_applications, const char *arg)
{ {
_cleanup_fclose_ FILE *file = NULL; _cleanup_fclose_ FILE *file = NULL;
_cleanup_free_ char *line = NULL; _cleanup_free_ char *line = NULL;
@ -1215,6 +1234,9 @@ static void parse_options(char **iface, char **config, unsigned int *mtu, char *
} else if (!strncasecmp(clean, "ExcludedApplications=", 21) && j > 4) { } else if (!strncasecmp(clean, "ExcludedApplications=", 21) && j > 4) {
*excluded_applications = concat_and_free(*excluded_applications, ",", clean + 21); *excluded_applications = concat_and_free(*excluded_applications, ",", clean + 21);
continue; continue;
} else if (!strncasecmp(clean, "IncludedApplications=", 21) && j > 4) {
*included_applications = concat_and_free(*included_applications, ",", clean + 21);
continue;
} else if (!strncasecmp(clean, "MTU=", 4) && j > 4) { } else if (!strncasecmp(clean, "MTU=", 4) && j > 4) {
*mtu = atoi(clean + 4); *mtu = atoi(clean + 4);
continue; continue;
@ -1240,17 +1262,18 @@ int main(int argc, char *argv[])
_cleanup_free_ char *addrs = NULL; _cleanup_free_ char *addrs = NULL;
_cleanup_free_ char *dnses = NULL; _cleanup_free_ char *dnses = NULL;
_cleanup_free_ char *excluded_applications = NULL; _cleanup_free_ char *excluded_applications = NULL;
_cleanup_free_ char *included_applications = NULL;
unsigned int mtu; unsigned int mtu;
if (argc == 2 && (!strcmp(argv[1], "help") || !strcmp(argv[1], "--help") || !strcmp(argv[1], "-h"))) if (argc == 2 && (!strcmp(argv[1], "help") || !strcmp(argv[1], "--help") || !strcmp(argv[1], "-h")))
cmd_usage(argv[0]); cmd_usage(argv[0]);
else if (argc == 3 && !strcmp(argv[1], "up")) { else if (argc == 3 && !strcmp(argv[1], "up")) {
auto_su(argc, argv); auto_su(argc, argv);
parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, argv[2]); parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, &included_applications, argv[2]);
cmd_up(iface, config, mtu, addrs, dnses, excluded_applications); cmd_up(iface, config, mtu, addrs, dnses, excluded_applications, included_applications);
} else if (argc == 3 && !strcmp(argv[1], "down")) { } else if (argc == 3 && !strcmp(argv[1], "down")) {
auto_su(argc, argv); auto_su(argc, argv);
parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, argv[2]); parse_options(&iface, &config, &mtu, &addrs, &dnses, &excluded_applications, &included_applications, argv[2]);
cmd_down(iface); cmd_down(iface);
} else { } else {
cmd_usage(argv[0]); cmd_usage(argv[0]);