1 /* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef NETD_SERVER_NETWORK_CONTROLLER_H 18 #define NETD_SERVER_NETWORK_CONTROLLER_H 19 20 #include <android/multinetwork.h> 21 #include "NetdConstants.h" 22 #include "Permission.h" 23 24 #include "utils/RWLock.h" 25 26 #include <list> 27 #include <map> 28 #include <set> 29 #include <sys/types.h> 30 #include <vector> 31 32 struct android_net_context; 33 34 namespace android { 35 namespace net { 36 37 // Utility to convert from netId to net_handle_t. Doing this here as opposed to exporting 38 // from net.c as it may have NDK implications. Besides no conversion available in net.c for 39 // obtaining handle given netId. 40 // TODO: Use getnetidfromhandle() in net.c. 41 static inline unsigned netHandleToNetId(net_handle_t fromNetHandle) { 42 const uint32_t k32BitMask = 0xffffffff; 43 // This value MUST be kept in sync with the corresponding value in 44 // the android.net.Network#getNetworkHandle() implementation. 45 const uint32_t kHandleMagic = 0xfacade; 46 47 // Check for minimum acceptable version of the API in the low bits. 48 if (fromNetHandle != NETWORK_UNSPECIFIED && 49 (fromNetHandle & k32BitMask) != kHandleMagic) { 50 return 0; 51 } 52 53 return ((fromNetHandle >> (CHAR_BIT * sizeof(k32BitMask))) & k32BitMask); 54 } 55 56 // Utility to convert from nethandle to netid, keep in sync with getNetworkHandle 57 // in Network.java. 58 static inline net_handle_t netIdToNetHandle(unsigned fromNetId) { 59 const net_handle_t HANDLE_MAGIC = 0xfacade; 60 61 if (!fromNetId) { 62 return NETWORK_UNSPECIFIED; 63 } 64 return (((net_handle_t)fromNetId << 32) | HANDLE_MAGIC); 65 } 66 67 class DumpWriter; 68 class Network; 69 class UidRanges; 70 class VirtualNetwork; 71 72 /* 73 * Keeps track of default, per-pid, and per-uid-range network selection, as 74 * well as the mark associated with each network. Networks are identified 75 * by netid. In all set* commands netid == 0 means "unspecified" and is 76 * equivalent to clearing the mapping. 77 */ 78 class NetworkController { 79 public: 80 static const unsigned MIN_OEM_ID; 81 static const unsigned MAX_OEM_ID; 82 static const unsigned LOCAL_NET_ID; 83 static const unsigned DUMMY_NET_ID; 84 85 NetworkController(); 86 87 unsigned getDefaultNetwork() const; 88 int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT; 89 90 // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId| 91 // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the 92 // fwmark value to set on the socket when performing the DNS request. 93 uint32_t getNetworkForDns(unsigned* netId, uid_t uid) const; 94 unsigned getNetworkForUser(uid_t uid) const; 95 unsigned getNetworkForConnect(uid_t uid) const; 96 void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const; 97 unsigned getNetworkForInterface(const char* interface) const; 98 bool isVirtualNetwork(unsigned netId) const; 99 100 int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT; 101 int createPhysicalOemNetwork(Permission permission, unsigned *netId) WARN_UNUSED_RESULT; 102 int createVirtualNetwork(unsigned netId, bool hasDns, bool secure) WARN_UNUSED_RESULT; 103 int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT; 104 105 int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; 106 int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; 107 108 Permission getPermissionForUser(uid_t uid) const; 109 void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids); 110 int checkUserNetworkAccess(uid_t uid, unsigned netId) const; 111 int setPermissionForNetworks(Permission permission, 112 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT; 113 114 int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT; 115 int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT; 116 117 // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a 118 // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address. 119 // 120 // Routes are added to tables determined by the interface, so only |interface| is actually used. 121 // |netId| is given only to sanity check that the interface has the correct netId. 122 int addRoute(unsigned netId, const char* interface, const char* destination, 123 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT; 124 int removeRoute(unsigned netId, const char* interface, const char* destination, 125 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT; 126 127 bool canProtect(uid_t uid) const; 128 void allowProtect(const std::vector<uid_t>& uids); 129 void denyProtect(const std::vector<uid_t>& uids); 130 131 void dump(DumpWriter& dw); 132 133 private: 134 bool isValidNetwork(unsigned netId) const; 135 bool isValidNetworkLocked(unsigned netId) const; 136 Network* getNetworkLocked(unsigned netId) const; 137 VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const; 138 Permission getPermissionForUserLocked(uid_t uid) const; 139 int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const; 140 int createPhysicalNetworkLocked(unsigned netId, Permission permission) WARN_UNUSED_RESULT; 141 142 int modifyRoute(unsigned netId, const char* interface, const char* destination, 143 const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT; 144 int modifyFallthroughLocked(unsigned vpnNetId, bool add) WARN_UNUSED_RESULT; 145 146 class DelegateImpl; 147 DelegateImpl* const mDelegateImpl; 148 149 // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers and mProtectableUsers. 150 mutable android::RWLock mRWLock; 151 unsigned mDefaultNetId; 152 std::map<unsigned, Network*> mNetworks; // Map keys are NetIds. 153 std::map<uid_t, Permission> mUsers; 154 std::set<uid_t> mProtectableUsers; 155 }; 156 157 } // namespace net 158 } // namespace android 159 160 #endif // NETD_SERVER_NETWORK_CONTROLLER_H 161
