1 /*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #ifndef NETD_SERVER_NETWORK_CONTROLLER_H
18 #define NETD_SERVER_NETWORK_CONTROLLER_H
19
20 #include <android/multinetwork.h>
21 #include "NetdConstants.h"
22 #include "Permission.h"
23
24 #include "utils/RWLock.h"
25
26 #include <list>
27 #include <map>
28 #include <set>
29 #include <sys/types.h>
30 #include <unordered_map>
31 #include <unordered_set>
32 #include <vector>
33
34 struct android_net_context;
35
36 namespace android {
37 namespace net {
38
39 constexpr uint32_t kHandleMagic = 0xcafed00d;
40
41 // Utility to convert from netId to net_handle_t. Doing this here as opposed to exporting
42 // from net.c as it may have NDK implications. Besides no conversion available in net.c for
43 // obtaining handle given netId.
44 // TODO: Use getnetidfromhandle() in net.c.
netHandleToNetId(net_handle_t fromNetHandle)45 static inline unsigned netHandleToNetId(net_handle_t fromNetHandle) {
46 const uint32_t k32BitMask = 0xffffffff;
47 // This value MUST be kept in sync with the corresponding value in
48 // the android.net.Network#getNetworkHandle() implementation.
49
50 // Check for minimum acceptable version of the API in the low bits.
51 if (fromNetHandle != NETWORK_UNSPECIFIED &&
52 (fromNetHandle & k32BitMask) != kHandleMagic) {
53 return 0;
54 }
55
56 return ((fromNetHandle >> (CHAR_BIT * sizeof(k32BitMask))) & k32BitMask);
57 }
58
59 // Utility to convert from nethandle to netid, keep in sync with getNetworkHandle
60 // in Network.java.
netIdToNetHandle(unsigned fromNetId)61 static inline net_handle_t netIdToNetHandle(unsigned fromNetId) {
62 if (!fromNetId) {
63 return NETWORK_UNSPECIFIED;
64 }
65 return (((net_handle_t)fromNetId << 32) | kHandleMagic);
66 }
67
68 class DumpWriter;
69 class Network;
70 class UidRanges;
71 class VirtualNetwork;
72
73 /*
74 * Keeps track of default, per-pid, and per-uid-range network selection, as
75 * well as the mark associated with each network. Networks are identified
76 * by netid. In all set* commands netid == 0 means "unspecified" and is
77 * equivalent to clearing the mapping.
78 */
79 class NetworkController {
80 public:
81 static const unsigned MIN_OEM_ID;
82 static const unsigned MAX_OEM_ID;
83 static const unsigned LOCAL_NET_ID;
84 static const unsigned DUMMY_NET_ID;
85
86 NetworkController();
87
88 unsigned getDefaultNetwork() const;
89 int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT;
90
91 // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId|
92 // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the
93 // fwmark value to set on the socket when performing the DNS request.
94 uint32_t getNetworkForDns(unsigned* netId, uid_t uid) const;
95 unsigned getNetworkForUser(uid_t uid) const;
96 unsigned getNetworkForConnect(uid_t uid) const;
97 void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const;
98 unsigned getNetworkForInterface(const char* interface) const;
99 bool isVirtualNetwork(unsigned netId) const;
100
101 int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
102 int createPhysicalOemNetwork(Permission permission, unsigned *netId) WARN_UNUSED_RESULT;
103 int createVirtualNetwork(unsigned netId, bool hasDns, bool secure) WARN_UNUSED_RESULT;
104 int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT;
105
106 int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
107 int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
108
109 Permission getPermissionForUser(uid_t uid) const;
110 void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
111 int checkUserNetworkAccess(uid_t uid, unsigned netId) const;
112 int setPermissionForNetworks(Permission permission,
113 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT;
114
115 int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
116 int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
117
118 // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
119 // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
120 //
121 // Routes are added to tables determined by the interface, so only |interface| is actually used.
122 // |netId| is given only to sanity check that the interface has the correct netId.
123 int addRoute(unsigned netId, const char* interface, const char* destination,
124 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
125 int removeRoute(unsigned netId, const char* interface, const char* destination,
126 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
127
128 // Notes that the specified address has appeared on the specified interface.
129 void addInterfaceAddress(unsigned ifIndex, const char* address);
130 // Notes that the specified address has been removed from the specified interface.
131 // Returns true if we should destroy sockets on this address.
132 bool removeInterfaceAddress(unsigned ifIndex, const char* address);
133
134 bool canProtect(uid_t uid) const;
135 void allowProtect(const std::vector<uid_t>& uids);
136 void denyProtect(const std::vector<uid_t>& uids);
137
138 void dump(DumpWriter& dw);
139
140 private:
141 bool isValidNetworkLocked(unsigned netId) const;
142 Network* getNetworkLocked(unsigned netId) const;
143 uint32_t getNetworkForDnsLocked(unsigned* netId, uid_t uid) const;
144 unsigned getNetworkForUserLocked(uid_t uid) const;
145 unsigned getNetworkForConnectLocked(uid_t uid) const;
146 unsigned getNetworkForInterfaceLocked(const char* interface) const;
147 bool canProtectLocked(uid_t uid) const;
148 bool isVirtualNetworkLocked(unsigned netId) const;
149
150 VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const;
151 Permission getPermissionForUserLocked(uid_t uid) const;
152 int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const;
153 int createPhysicalNetworkLocked(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
154
155 int modifyRoute(unsigned netId, const char* interface, const char* destination,
156 const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
157 int modifyFallthroughLocked(unsigned vpnNetId, bool add) WARN_UNUSED_RESULT;
158 void updateTcpSocketMonitorPolling();
159
160 class DelegateImpl;
161 DelegateImpl* const mDelegateImpl;
162
163 // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers, mProtectableUsers,
164 // mIfindexToLastNetId and mAddressToIfindices.
165 mutable android::RWLock mRWLock;
166 unsigned mDefaultNetId;
167 std::map<unsigned, Network*> mNetworks; // Map keys are NetIds.
168 std::map<uid_t, Permission> mUsers;
169 std::set<uid_t> mProtectableUsers;
170 // Map interface (ifIndex) to its current NetId, or the last NetId if the interface was removed
171 // from the network and not added to another network. This state facilitates the interface to
172 // NetId lookup during RTM_DELADDR (NetworkController::removeInterfaceAddress), when the
173 // interface in question might already have been removed from the network.
174 // An interface is added to this map when it is added to a network and removed from this map
175 // when its network is destroyed.
176 std::unordered_map<unsigned, unsigned> mIfindexToLastNetId;
177 // Map IP address to the list of active interfaces (ifIndex) that have that address.
178 // Also contains IP addresses configured on interfaces that have not been added to any network.
179 // TODO: Does not track IP addresses present when netd is started or restarts after a crash.
180 // This is not a problem for its intended use (tracking IP addresses on VPN interfaces), but
181 // we should fix it.
182 std::unordered_map<std::string, std::unordered_set<unsigned>> mAddressToIfindices;
183
184 };
185
186 } // namespace net
187 } // namespace android
188
189 #endif // NETD_SERVER_NETWORK_CONTROLLER_H
190