1 /*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #ifndef NETD_SERVER_NETWORK_CONTROLLER_H
18 #define NETD_SERVER_NETWORK_CONTROLLER_H
19
20 #include <android/multinetwork.h>
21 #include "NetdConstants.h"
22 #include "Permission.h"
23
24 #include "utils/RWLock.h"
25
26 #include <list>
27 #include <map>
28 #include <set>
29 #include <sys/types.h>
30 #include <vector>
31
32 struct android_net_context;
33
34 namespace android {
35 namespace net {
36
37 // Utility to convert from netId to net_handle_t. Doing this here as opposed to exporting
38 // from net.c as it may have NDK implications. Besides no conversion available in net.c for
39 // obtaining handle given netId.
40 // TODO: Use getnetidfromhandle() in net.c.
netHandleToNetId(net_handle_t fromNetHandle)41 static inline unsigned netHandleToNetId(net_handle_t fromNetHandle) {
42 const uint32_t k32BitMask = 0xffffffff;
43 // This value MUST be kept in sync with the corresponding value in
44 // the android.net.Network#getNetworkHandle() implementation.
45 const uint32_t kHandleMagic = 0xfacade;
46
47 // Check for minimum acceptable version of the API in the low bits.
48 if (fromNetHandle != NETWORK_UNSPECIFIED &&
49 (fromNetHandle & k32BitMask) != kHandleMagic) {
50 return 0;
51 }
52
53 return ((fromNetHandle >> (CHAR_BIT * sizeof(k32BitMask))) & k32BitMask);
54 }
55
56 // Utility to convert from nethandle to netid, keep in sync with getNetworkHandle
57 // in Network.java.
netIdToNetHandle(unsigned fromNetId)58 static inline net_handle_t netIdToNetHandle(unsigned fromNetId) {
59 const net_handle_t HANDLE_MAGIC = 0xfacade;
60
61 if (!fromNetId) {
62 return NETWORK_UNSPECIFIED;
63 }
64 return (((net_handle_t)fromNetId << 32) | HANDLE_MAGIC);
65 }
66
67 class DumpWriter;
68 class Network;
69 class UidRanges;
70 class VirtualNetwork;
71
72 /*
73 * Keeps track of default, per-pid, and per-uid-range network selection, as
74 * well as the mark associated with each network. Networks are identified
75 * by netid. In all set* commands netid == 0 means "unspecified" and is
76 * equivalent to clearing the mapping.
77 */
78 class NetworkController {
79 public:
80 static const unsigned MIN_OEM_ID;
81 static const unsigned MAX_OEM_ID;
82 static const unsigned LOCAL_NET_ID;
83 static const unsigned DUMMY_NET_ID;
84
85 NetworkController();
86
87 unsigned getDefaultNetwork() const;
88 int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT;
89
90 // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId|
91 // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the
92 // fwmark value to set on the socket when performing the DNS request.
93 uint32_t getNetworkForDns(unsigned* netId, uid_t uid) const;
94 unsigned getNetworkForUser(uid_t uid) const;
95 unsigned getNetworkForConnect(uid_t uid) const;
96 void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const;
97 unsigned getNetworkForInterface(const char* interface) const;
98 bool isVirtualNetwork(unsigned netId) const;
99
100 int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
101 int createPhysicalOemNetwork(Permission permission, unsigned *netId) WARN_UNUSED_RESULT;
102 int createVirtualNetwork(unsigned netId, bool hasDns, bool secure) WARN_UNUSED_RESULT;
103 int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT;
104
105 int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
106 int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
107
108 Permission getPermissionForUser(uid_t uid) const;
109 void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
110 int checkUserNetworkAccess(uid_t uid, unsigned netId) const;
111 int setPermissionForNetworks(Permission permission,
112 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT;
113
114 int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
115 int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
116
117 // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
118 // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
119 //
120 // Routes are added to tables determined by the interface, so only |interface| is actually used.
121 // |netId| is given only to sanity check that the interface has the correct netId.
122 int addRoute(unsigned netId, const char* interface, const char* destination,
123 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
124 int removeRoute(unsigned netId, const char* interface, const char* destination,
125 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
126
127 bool canProtect(uid_t uid) const;
128 void allowProtect(const std::vector<uid_t>& uids);
129 void denyProtect(const std::vector<uid_t>& uids);
130
131 void dump(DumpWriter& dw);
132
133 private:
134 bool isValidNetwork(unsigned netId) const;
135 bool isValidNetworkLocked(unsigned netId) const;
136 Network* getNetworkLocked(unsigned netId) const;
137 VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const;
138 Permission getPermissionForUserLocked(uid_t uid) const;
139 int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const;
140 int createPhysicalNetworkLocked(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
141
142 int modifyRoute(unsigned netId, const char* interface, const char* destination,
143 const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
144 int modifyFallthroughLocked(unsigned vpnNetId, bool add) WARN_UNUSED_RESULT;
145
146 class DelegateImpl;
147 DelegateImpl* const mDelegateImpl;
148
149 // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers and mProtectableUsers.
150 mutable android::RWLock mRWLock;
151 unsigned mDefaultNetId;
152 std::map<unsigned, Network*> mNetworks; // Map keys are NetIds.
153 std::map<uid_t, Permission> mUsers;
154 std::set<uid_t> mProtectableUsers;
155 };
156
157 } // namespace net
158 } // namespace android
159
160 #endif // NETD_SERVER_NETWORK_CONTROLLER_H
161