1 /*
2  * Copyright (C) 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef NETD_SERVER_NETWORK_CONTROLLER_H
18 #define NETD_SERVER_NETWORK_CONTROLLER_H
19 
20 #include "NetdConstants.h"
21 #include "Permission.h"
22 
23 #include "utils/RWLock.h"
24 
25 #include <list>
26 #include <map>
27 #include <set>
28 #include <sys/types.h>
29 #include <vector>
30 
31 struct android_net_context;
32 
33 namespace android {
34 namespace net {
35 
36 class DumpWriter;
37 class Network;
38 class UidRanges;
39 class VirtualNetwork;
40 
41 /*
42  * Keeps track of default, per-pid, and per-uid-range network selection, as
43  * well as the mark associated with each network. Networks are identified
44  * by netid. In all set* commands netid == 0 means "unspecified" and is
45  * equivalent to clearing the mapping.
46  */
47 class NetworkController {
48 public:
49     static const unsigned MIN_OEM_ID;
50     static const unsigned MAX_OEM_ID;
51     static const unsigned LOCAL_NET_ID;
52     static const unsigned DUMMY_NET_ID;
53 
54     NetworkController();
55 
56     unsigned getDefaultNetwork() const;
57     int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT;
58 
59     // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId|
60     // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the
61     // fwmark value to set on the socket when performing the DNS request.
62     uint32_t getNetworkForDns(unsigned* netId, uid_t uid) const;
63     unsigned getNetworkForUser(uid_t uid) const;
64     unsigned getNetworkForConnect(uid_t uid) const;
65     void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const;
66     unsigned getNetworkForInterface(const char* interface) const;
67     bool isVirtualNetwork(unsigned netId) const;
68 
69     int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
70     int createVirtualNetwork(unsigned netId, bool hasDns, bool secure) WARN_UNUSED_RESULT;
71     int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT;
72 
73     int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
74     int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
75 
76     Permission getPermissionForUser(uid_t uid) const;
77     void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
78     int checkUserNetworkAccess(uid_t uid, unsigned netId) const;
79     int setPermissionForNetworks(Permission permission,
80                                  const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT;
81 
82     int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
83     int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
84 
85     // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
86     // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
87     //
88     // Routes are added to tables determined by the interface, so only |interface| is actually used.
89     // |netId| is given only to sanity check that the interface has the correct netId.
90     int addRoute(unsigned netId, const char* interface, const char* destination,
91                  const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
92     int removeRoute(unsigned netId, const char* interface, const char* destination,
93                     const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
94 
95     bool canProtect(uid_t uid) const;
96     void allowProtect(const std::vector<uid_t>& uids);
97     void denyProtect(const std::vector<uid_t>& uids);
98 
99     void dump(DumpWriter& dw);
100 
101 private:
102     bool isValidNetwork(unsigned netId) const;
103     Network* getNetworkLocked(unsigned netId) const;
104     VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const;
105     Permission getPermissionForUserLocked(uid_t uid) const;
106     int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const;
107 
108     int modifyRoute(unsigned netId, const char* interface, const char* destination,
109                     const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
110     int modifyFallthroughLocked(unsigned vpnNetId, bool add) WARN_UNUSED_RESULT;
111 
112     class DelegateImpl;
113     DelegateImpl* const mDelegateImpl;
114 
115     // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers and mProtectableUsers.
116     mutable android::RWLock mRWLock;
117     unsigned mDefaultNetId;
118     std::map<unsigned, Network*> mNetworks;  // Map keys are NetIds.
119     std::map<uid_t, Permission> mUsers;
120     std::set<uid_t> mProtectableUsers;
121 };
122 
123 }  // namespace net
124 }  // namespace android
125 
126 #endif  // NETD_SERVER_NETWORK_CONTROLLER_H
127