1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <unistd.h> 18 #include <sys/socket.h> 19 20 #include <linux/netlink.h> 21 #include <linux/sock_diag.h> 22 #include <linux/inet_diag.h> 23 24 #include <functional> 25 #include <set> 26 27 #include "Permission.h" 28 #include "UidRanges.h" 29 30 struct inet_diag_msg; 31 class SockDiagTest; 32 33 class SockDiag { 34 35 public: 36 static const int kBufferSize = 4096; 37 38 // Callback function that is called once for every socket in the dump. A return value of true 39 // means destroy the socket. 40 typedef std::function<bool(uint8_t proto, const inet_diag_msg *)> DumpCallback; 41 42 struct DestroyRequest { 43 nlmsghdr nlh; 44 inet_diag_req_v2 req; 45 } __attribute__((__packed__)); 46 47 SockDiag() : mSock(-1), mWriteSock(-1), mSocketsDestroyed(0) {} 48 bool open(); 49 virtual ~SockDiag() { closeSocks(); } 50 51 int sendDumpRequest(uint8_t proto, uint8_t family, uint32_t states); 52 int sendDumpRequest(uint8_t proto, uint8_t family, const char *addrstr); 53 int readDiagMsg(uint8_t proto, DumpCallback callback); 54 int sockDestroy(uint8_t proto, const inet_diag_msg *); 55 // Destroys all sockets on the given IPv4 or IPv6 address. 56 int destroySockets(const char *addrstr); 57 // Destroys all sockets for the given protocol and UID. 58 int destroySockets(uint8_t proto, uid_t uid, bool excludeLoopback); 59 // Destroys all "live" (CONNECTED, SYN_SENT, SYN_RECV) TCP sockets for the given UID ranges. 60 int destroySockets(const UidRanges& uidRanges, const std::set<uid_t>& skipUids, 61 bool excludeLoopback); 62 // Destroys all "live" (CONNECTED, SYN_SENT, SYN_RECV) TCP sockets that no longer have 63 // the permissions required by the specified network. 64 int destroySocketsLackingPermission(unsigned netId, Permission permission, 65 bool excludeLoopback); 66 67 private: 68 friend class SockDiagTest; 69 int mSock; 70 int mWriteSock; 71 int mSocketsDestroyed; 72 int sendDumpRequest(uint8_t proto, uint8_t family, uint32_t states, iovec *iov, int iovcnt); 73 int destroySockets(uint8_t proto, int family, const char *addrstr); 74 int destroyLiveSockets(DumpCallback destroy, const char *what, iovec *iov, int iovcnt); 75 bool hasSocks() { return mSock != -1 && mWriteSock != -1; } 76 void closeSocks() { close(mSock); close(mWriteSock); mSock = mWriteSock = -1; } 77 static bool isLoopbackSocket(const inet_diag_msg *msg); 78 }; 79