1 /* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef NETD_SERVER_NETWORK_CONTROLLER_H 18 #define NETD_SERVER_NETWORK_CONTROLLER_H 19 20 #include "NetdConstants.h" 21 #include "Permission.h" 22 23 #include "utils/RWLock.h" 24 25 #include <list> 26 #include <map> 27 #include <set> 28 #include <sys/types.h> 29 #include <vector> 30 31 class DumpWriter; 32 class Network; 33 class UidRanges; 34 class VirtualNetwork; 35 36 /* 37 * Keeps track of default, per-pid, and per-uid-range network selection, as 38 * well as the mark associated with each network. Networks are identified 39 * by netid. In all set* commands netid == 0 means "unspecified" and is 40 * equivalent to clearing the mapping. 41 */ 42 class NetworkController { 43 public: 44 static const unsigned MIN_OEM_ID; 45 static const unsigned MAX_OEM_ID; 46 static const unsigned LOCAL_NET_ID; 47 static const unsigned DUMMY_NET_ID; 48 49 NetworkController(); 50 51 unsigned getDefaultNetwork() const; 52 int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT; 53 54 // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId| 55 // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the 56 // fwmark value to set on the socket when performing the DNS request. 57 uint32_t getNetworkForDns(unsigned* netId, uid_t uid) const; 58 unsigned getNetworkForUser(uid_t uid) const; 59 unsigned getNetworkForConnect(uid_t uid) const; 60 void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const; 61 unsigned getNetworkForInterface(const char* interface) const; 62 bool isVirtualNetwork(unsigned netId) const; 63 64 int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT; 65 int createVirtualNetwork(unsigned netId, bool hasDns, bool secure) WARN_UNUSED_RESULT; 66 int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT; 67 68 int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; 69 int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; 70 71 Permission getPermissionForUser(uid_t uid) const; 72 void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids); 73 int checkUserNetworkAccess(uid_t uid, unsigned netId) const; 74 int setPermissionForNetworks(Permission permission, 75 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT; 76 77 int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT; 78 int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT; 79 80 // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a 81 // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address. 82 // 83 // Routes are added to tables determined by the interface, so only |interface| is actually used. 84 // |netId| is given only to sanity check that the interface has the correct netId. 85 int addRoute(unsigned netId, const char* interface, const char* destination, 86 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT; 87 int removeRoute(unsigned netId, const char* interface, const char* destination, 88 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT; 89 90 bool canProtect(uid_t uid) const; 91 void allowProtect(const std::vector<uid_t>& uids); 92 void denyProtect(const std::vector<uid_t>& uids); 93 94 void dump(DumpWriter& dw); 95 96 private: 97 bool isValidNetwork(unsigned netId) const; 98 Network* getNetworkLocked(unsigned netId) const; 99 VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const; 100 Permission getPermissionForUserLocked(uid_t uid) const; 101 int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const; 102 103 int modifyRoute(unsigned netId, const char* interface, const char* destination, 104 const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT; 105 int modifyFallthroughLocked(unsigned vpnNetId, bool add) WARN_UNUSED_RESULT; 106 107 class DelegateImpl; 108 DelegateImpl* const mDelegateImpl; 109 110 // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers and mProtectableUsers. 111 mutable android::RWLock mRWLock; 112 unsigned mDefaultNetId; 113 std::map<unsigned, Network*> mNetworks; // Map keys are NetIds. 114 std::map<uid_t, Permission> mUsers; 115 std::set<uid_t> mProtectableUsers; 116 117 }; 118 119 #endif // NETD_SERVER_NETWORK_CONTROLLER_H 120