Home | History | Annotate | Download | only in server 
      1 /*
      2  * Copyright (C) 2016 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #include <unistd.h>
     18 #include <sys/socket.h>
     19 
     20 #include <linux/netlink.h>
     21 #include <linux/sock_diag.h>
     22 #include <linux/inet_diag.h>
     23 
     24 #include <functional>
     25 #include <set>
     26 
     27 #include "Permission.h"
     28 #include "UidRanges.h"
     29 
     30 struct inet_diag_msg;
     31 class SockDiagTest;
     32 
     33 class SockDiag {
     34 
     35   public:
     36     static const int kBufferSize = 4096;
     37 
     38     // Callback function that is called once for every socket in the dump. A return value of true
     39     // means destroy the socket.
     40     typedef std::function<bool(uint8_t proto, const inet_diag_msg *)> DumpCallback;
     41 
     42     struct DestroyRequest {
     43         nlmsghdr nlh;
     44         inet_diag_req_v2 req;
     45     } __attribute__((__packed__));
     46 
     47     SockDiag() : mSock(-1), mWriteSock(-1), mSocketsDestroyed(0) {}
     48     bool open();
     49     virtual ~SockDiag() { closeSocks(); }
     50 
     51     int sendDumpRequest(uint8_t proto, uint8_t family, uint32_t states);
     52     int sendDumpRequest(uint8_t proto, uint8_t family, const char *addrstr);
     53     int readDiagMsg(uint8_t proto, DumpCallback callback);
     54     int sockDestroy(uint8_t proto, const inet_diag_msg *);
     55     // Destroys all sockets on the given IPv4 or IPv6 address.
     56     int destroySockets(const char *addrstr);
     57     // Destroys all sockets for the given protocol and UID.
     58     int destroySockets(uint8_t proto, uid_t uid, bool excludeLoopback);
     59     // Destroys all "live" (CONNECTED, SYN_SENT, SYN_RECV) TCP sockets for the given UID ranges.
     60     int destroySockets(const UidRanges& uidRanges, const std::set<uid_t>& skipUids,
     61                        bool excludeLoopback);
     62     // Destroys all "live" (CONNECTED, SYN_SENT, SYN_RECV) TCP sockets that no longer have
     63     // the permissions required by the specified network.
     64     int destroySocketsLackingPermission(unsigned netId, Permission permission,
     65                                         bool excludeLoopback);
     66 
     67   private:
     68     friend class SockDiagTest;
     69     int mSock;
     70     int mWriteSock;
     71     int mSocketsDestroyed;
     72     int sendDumpRequest(uint8_t proto, uint8_t family, uint32_t states, iovec *iov, int iovcnt);
     73     int destroySockets(uint8_t proto, int family, const char *addrstr);
     74     int destroyLiveSockets(DumpCallback destroy, const char *what, iovec *iov, int iovcnt);
     75     bool hasSocks() { return mSock != -1 && mWriteSock != -1; }
     76     void closeSocks() { close(mSock); close(mWriteSock); mSock = mWriteSock = -1; }
     77     static bool isLoopbackSocket(const inet_diag_msg *msg);
     78 };
     79