* limitations under the License.
*/
-#include <resolv_netid.h>
-
-#define LOG_TAG "NetworkController"
-#include <cutils/log.h>
+// THREAD-SAFETY
+// -------------
+// The methods in this file are called from multiple threads (from CommandListener, FwmarkServer
+// and DnsProxyListener). So, all accesses to shared state are guarded by a lock.
+//
+// In some cases, a single non-const method acquires and releases the lock several times, like so:
+// if (isValidNetwork(...)) { // isValidNetwork() acquires and releases the lock.
+// setDefaultNetwork(...); // setDefaultNetwork() also acquires and releases the lock.
+//
+// It might seem that this allows races where the state changes between the two statements, but in
+// fact there are no races because:
+// 1. This pattern only occurs in non-const methods (i.e., those that mutate state).
+// 2. Only CommandListener calls these non-const methods. The others call only const methods.
+// 3. CommandListener only processes one command at a time. I.e., it's serialized.
+// Thus, no other mutation can occur in between the two statements above.
#include "NetworkController.h"
-#include "PermissionsController.h"
+#include "DummyNetwork.h"
+#include "Fwmark.h"
+#include "LocalNetwork.h"
+#include "PhysicalNetwork.h"
#include "RouteController.h"
+#include "VirtualNetwork.h"
+
+#include "cutils/misc.h"
+#define LOG_TAG "Netd"
+#include "log/log.h"
+#include "resolv_netid.h"
namespace {
// Keep these in sync with ConnectivityService.java.
-const unsigned int MIN_NET_ID = 10;
-const unsigned int MAX_NET_ID = 65535;
+const unsigned MIN_NET_ID = 100;
+const unsigned MAX_NET_ID = 65535;
} // namespace
-bool NetworkController::isNetIdValid(unsigned netId) {
- return MIN_NET_ID <= netId && netId <= MAX_NET_ID;
+const unsigned NetworkController::MIN_OEM_ID = 1;
+const unsigned NetworkController::MAX_OEM_ID = 50;
+const unsigned NetworkController::DUMMY_NET_ID = 51;
+// NetIds 52..98 are reserved for future use.
+const unsigned NetworkController::LOCAL_NET_ID = 99;
+
+// All calls to methods here are made while holding a write lock on mRWLock.
+class NetworkController::DelegateImpl : public PhysicalNetwork::Delegate {
+public:
+ explicit DelegateImpl(NetworkController* networkController);
+ virtual ~DelegateImpl();
+
+ int modifyFallthrough(unsigned vpnNetId, const std::string& physicalInterface,
+ Permission permission, bool add) WARN_UNUSED_RESULT;
+
+private:
+ int addFallthrough(const std::string& physicalInterface,
+ Permission permission) override WARN_UNUSED_RESULT;
+ int removeFallthrough(const std::string& physicalInterface,
+ Permission permission) override WARN_UNUSED_RESULT;
+
+ int modifyFallthrough(const std::string& physicalInterface, Permission permission,
+ bool add) WARN_UNUSED_RESULT;
+
+ NetworkController* const mNetworkController;
+};
+
+NetworkController::DelegateImpl::DelegateImpl(NetworkController* networkController) :
+ mNetworkController(networkController) {
}
-NetworkController::NetworkController(PermissionsController* permissionsController,
- RouteController* routeController)
- : mDefaultNetId(NETID_UNSET),
- mPermissionsController(permissionsController),
- mRouteController(routeController) {
+NetworkController::DelegateImpl::~DelegateImpl() {
}
-void NetworkController::clearNetworkPreference() {
- android::RWLock::AutoWLock lock(mRWLock);
- mUidMap.clear();
+int NetworkController::DelegateImpl::modifyFallthrough(unsigned vpnNetId,
+ const std::string& physicalInterface,
+ Permission permission, bool add) {
+ if (add) {
+ if (int ret = RouteController::addVirtualNetworkFallthrough(vpnNetId,
+ physicalInterface.c_str(),
+ permission)) {
+ ALOGE("failed to add fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
+ vpnNetId);
+ return ret;
+ }
+ } else {
+ if (int ret = RouteController::removeVirtualNetworkFallthrough(vpnNetId,
+ physicalInterface.c_str(),
+ permission)) {
+ ALOGE("failed to remove fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
+ vpnNetId);
+ return ret;
+ }
+ }
+ return 0;
+}
+
+int NetworkController::DelegateImpl::addFallthrough(const std::string& physicalInterface,
+ Permission permission) {
+ return modifyFallthrough(physicalInterface, permission, true);
+}
+
+int NetworkController::DelegateImpl::removeFallthrough(const std::string& physicalInterface,
+ Permission permission) {
+ return modifyFallthrough(physicalInterface, permission, false);
+}
+
+int NetworkController::DelegateImpl::modifyFallthrough(const std::string& physicalInterface,
+ Permission permission, bool add) {
+ for (const auto& entry : mNetworkController->mNetworks) {
+ if (entry.second->getType() == Network::VIRTUAL) {
+ if (int ret = modifyFallthrough(entry.first, physicalInterface, permission, add)) {
+ return ret;
+ }
+ }
+ }
+ return 0;
+}
+
+NetworkController::NetworkController() :
+ mDelegateImpl(new NetworkController::DelegateImpl(this)), mDefaultNetId(NETID_UNSET) {
+ mNetworks[LOCAL_NET_ID] = new LocalNetwork(LOCAL_NET_ID);
+ mNetworks[DUMMY_NET_ID] = new DummyNetwork(DUMMY_NET_ID);
}
unsigned NetworkController::getDefaultNetwork() const {
return mDefaultNetId;
}
-bool NetworkController::setDefaultNetwork(unsigned newNetId) {
- unsigned oldNetId;
- {
- android::RWLock::AutoWLock lock(mRWLock);
- oldNetId = mDefaultNetId;
- mDefaultNetId = newNetId;
- }
+int NetworkController::setDefaultNetwork(unsigned netId) {
+ android::RWLock::AutoWLock lock(mRWLock);
- if (oldNetId == newNetId) {
- return true;
+ if (netId == mDefaultNetId) {
+ return 0;
}
- bool status = true;
-
- // Add default network rules for the new netId.
- if (isNetIdValid(newNetId)) {
- Permission permission = mPermissionsController->getPermissionForNetwork(newNetId);
- InterfaceRange range = interfacesForNetId(newNetId, &status);
- for (InterfaceIterator iter = range.first; iter != range.second; ++iter) {
- if (!mRouteController->addDefaultNetwork(iter->second.c_str(), permission)) {
- status = false;
- }
+ if (netId != NETID_UNSET) {
+ Network* network = getNetworkLocked(netId);
+ if (!network) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
+ }
+ if (network->getType() != Network::PHYSICAL) {
+ ALOGE("cannot set default to non-physical network with netId %u", netId);
+ return -EINVAL;
+ }
+ if (int ret = static_cast<PhysicalNetwork*>(network)->addAsDefault()) {
+ return ret;
}
}
- // Remove the old default network rules.
- if (isNetIdValid(oldNetId)) {
- Permission permission = mPermissionsController->getPermissionForNetwork(oldNetId);
- InterfaceRange range = interfacesForNetId(oldNetId, &status);
- for (InterfaceIterator iter = range.first; iter != range.second; ++iter) {
- if (!mRouteController->removeDefaultNetwork(iter->second.c_str(), permission)) {
- status = false;
- }
+ if (mDefaultNetId != NETID_UNSET) {
+ Network* network = getNetworkLocked(mDefaultNetId);
+ if (!network || network->getType() != Network::PHYSICAL) {
+ ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
+ return -ESRCH;
+ }
+ if (int ret = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
+ return ret;
}
}
- return status;
+ mDefaultNetId = netId;
+ return 0;
}
-bool NetworkController::setNetworkForUidRange(int uid_start, int uid_end, unsigned netId,
- bool forward_dns) {
- android::RWLock::AutoWLock lock(mRWLock);
- if (uid_start > uid_end || !isNetIdValid(netId))
- return false;
-
- for (std::list<UidEntry>::iterator it = mUidMap.begin(); it != mUidMap.end(); ++it) {
- if (it->uid_start != uid_start || it->uid_end != uid_end || it->netId != netId)
- continue;
- it->forward_dns = forward_dns;
- return true;
+uint32_t NetworkController::getNetworkForDns(unsigned* netId, uid_t uid) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ Fwmark fwmark;
+ fwmark.protectedFromVpn = true;
+ fwmark.permission = PERMISSION_SYSTEM;
+ if (checkUserNetworkAccessLocked(uid, *netId) == 0) {
+ // If a non-zero NetId was explicitly specified, and the user has permission for that
+ // network, use that network's DNS servers. Do not fall through to the default network even
+ // if the explicitly selected network is a split tunnel VPN or a VPN without DNS servers.
+ fwmark.explicitlySelected = true;
+ } else {
+ // If the user is subject to a VPN and the VPN provides DNS servers, use those servers
+ // (possibly falling through to the default network if the VPN doesn't provide a route to
+ // them). Otherwise, use the default network's DNS servers.
+ VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
+ if (virtualNetwork && virtualNetwork->getHasDns()) {
+ *netId = virtualNetwork->getNetId();
+ } else {
+ *netId = mDefaultNetId;
+ }
}
-
- mUidMap.push_front(UidEntry(uid_start, uid_end, netId, forward_dns));
- return true;
+ fwmark.netId = *netId;
+ return fwmark.intValue;
}
-bool NetworkController::clearNetworkForUidRange(int uid_start, int uid_end, unsigned netId) {
- android::RWLock::AutoWLock lock(mRWLock);
- if (uid_start > uid_end || !isNetIdValid(netId))
- return false;
-
- for (std::list<UidEntry>::iterator it = mUidMap.begin(); it != mUidMap.end(); ++it) {
- if (it->uid_start != uid_start || it->uid_end != uid_end || it->netId != netId)
- continue;
- mUidMap.erase(it);
- return true;
+// Returns the NetId that a given UID would use if no network is explicitly selected. Specifically,
+// the VPN that applies to the UID if any; otherwise, the default network.
+unsigned NetworkController::getNetworkForUser(uid_t uid) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ if (VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid)) {
+ return virtualNetwork->getNetId();
}
- return false;
+ return mDefaultNetId;
}
-unsigned NetworkController::getNetwork(int uid, unsigned requested_netId, bool for_dns) const {
+// Returns the NetId that will be set when a socket connect()s. This is the bypassable VPN that
+// applies to the user if any; otherwise, the default network.
+//
+// In general, we prefer to always set the default network's NetId in connect(), so that if the VPN
+// is a split-tunnel and disappears later, the socket continues working (since the default network's
+// NetId is still valid). Secure VPNs will correctly grab the socket's traffic since they have a
+// high-priority routing rule that doesn't care what NetId the socket has.
+//
+// But bypassable VPNs have a very low priority rule, so we need to mark the socket with the
+// bypassable VPN's NetId if we expect it to get any traffic at all. If the bypassable VPN is a
+// split-tunnel, that's okay, because we have fallthrough rules that will direct the fallthrough
+// traffic to the default network. But it does mean that if the bypassable VPN goes away (and thus
+// the fallthrough rules also go away), the socket that used to fallthrough to the default network
+// will stop working.
+unsigned NetworkController::getNetworkForConnect(uid_t uid) const {
android::RWLock::AutoRLock lock(mRWLock);
- for (std::list<UidEntry>::const_iterator it = mUidMap.begin(); it != mUidMap.end(); ++it) {
- if (uid < it->uid_start || it->uid_end < uid)
- continue;
- if (for_dns && !it->forward_dns)
- break;
- return it->netId;
- }
- if (isNetIdValid(requested_netId))
- return requested_netId;
+ VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
+ if (virtualNetwork && !virtualNetwork->isSecure()) {
+ return virtualNetwork->getNetId();
+ }
return mDefaultNetId;
}
-unsigned NetworkController::getNetworkId(const char* interface) {
- std::map<std::string, unsigned>::const_iterator it = mIfaceNetidMap.find(interface);
- if (it != mIfaceNetidMap.end())
- return it->second;
+unsigned NetworkController::getNetworkForInterface(const char* interface) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ for (const auto& entry : mNetworks) {
+ if (entry.second->hasInterface(interface)) {
+ return entry.first;
+ }
+ }
return NETID_UNSET;
}
-bool NetworkController::createNetwork(unsigned netId, Permission permission) {
- if (!isNetIdValid(netId)) {
- ALOGE("invalid netId %u", netId);
- return false;
- }
-
- mPermissionsController->setPermissionForNetwork(permission, netId);
- return true;
+bool NetworkController::isVirtualNetwork(unsigned netId) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ Network* network = getNetworkLocked(netId);
+ return network && network->getType() == Network::VIRTUAL;
}
-bool NetworkController::addInterfaceToNetwork(unsigned netId, const char* interface) {
- if (!isNetIdValid(netId) || !interface) {
- ALOGE("invalid netId %u or interface null", netId);
- return false;
+int NetworkController::createPhysicalNetwork(unsigned netId, Permission permission) {
+ if (!((MIN_NET_ID <= netId && netId <= MAX_NET_ID) ||
+ (MIN_OEM_ID <= netId && netId <= MAX_OEM_ID))) {
+ ALOGE("invalid netId %u", netId);
+ return -EINVAL;
}
- unsigned existingNetId = netIdForInterface(interface);
- if (existingNetId != NETID_UNSET) {
- ALOGE("interface %s already assigned to netId %u", interface, existingNetId);
- return false;
+ if (isValidNetwork(netId)) {
+ ALOGE("duplicate netId %u", netId);
+ return -EEXIST;
}
- Permission permission = mPermissionsController->getPermissionForNetwork(netId);
- if (!mRouteController->addInterfaceToNetwork(netId, interface, permission)) {
- ALOGE("failed to add rules for interface %s to netId %u", interface, netId);
- return false;
+ PhysicalNetwork* physicalNetwork = new PhysicalNetwork(netId, mDelegateImpl);
+ if (int ret = physicalNetwork->setPermission(permission)) {
+ ALOGE("inconceivable! setPermission cannot fail on an empty network");
+ delete physicalNetwork;
+ return ret;
}
- mNetIdToInterfaces.insert(std::pair<unsigned, std::string>(netId, interface));
- mIfaceNetidMap[interface] = netId;
+ android::RWLock::AutoWLock lock(mRWLock);
+ mNetworks[netId] = physicalNetwork;
+ return 0;
+}
+
+int NetworkController::createVirtualNetwork(unsigned netId, bool hasDns, bool secure) {
+ if (!(MIN_NET_ID <= netId && netId <= MAX_NET_ID)) {
+ ALOGE("invalid netId %u", netId);
+ return -EINVAL;
+ }
- if (netId == getDefaultNetwork() &&
- !mRouteController->addDefaultNetwork(interface, permission)) {
- ALOGE("failed to add interface %s to default network %u", interface, netId);
- return false;
+ if (isValidNetwork(netId)) {
+ ALOGE("duplicate netId %u", netId);
+ return -EEXIST;
}
- return true;
+ android::RWLock::AutoWLock lock(mRWLock);
+ if (int ret = modifyFallthroughLocked(netId, true)) {
+ return ret;
+ }
+ mNetworks[netId] = new VirtualNetwork(netId, hasDns, secure);
+ return 0;
}
-bool NetworkController::removeInterfaceFromNetwork(unsigned netId, const char* interface) {
- if (!isNetIdValid(netId) || !interface) {
- ALOGE("invalid netId %u or interface null", netId);
- return false;
+int NetworkController::destroyNetwork(unsigned netId) {
+ if (netId == LOCAL_NET_ID) {
+ ALOGE("cannot destroy local network");
+ return -EINVAL;
+ }
+ if (!isValidNetwork(netId)) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
}
- bool status = true;
- bool found = false;
- InterfaceRange range = interfacesForNetId(netId, &status);
- for (InterfaceIterator iter = range.first; iter != range.second; ++iter) {
- if (iter->second == interface) {
- mNetIdToInterfaces.erase(iter);
- found = true;
- break;
+ // TODO: ioctl(SIOCKILLADDR, ...) to kill all sockets on the old network.
+
+ android::RWLock::AutoWLock lock(mRWLock);
+ Network* network = getNetworkLocked(netId);
+
+ // If we fail to destroy a network, things will get stuck badly. Therefore, unlike most of the
+ // other network code, ignore failures and attempt to clear out as much state as possible, even
+ // if we hit an error on the way. Return the first error that we see.
+ int ret = network->clearInterfaces();
+
+ if (mDefaultNetId == netId) {
+ if (int err = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
+ ALOGE("inconceivable! removeAsDefault cannot fail on an empty network");
+ if (!ret) {
+ ret = err;
+ }
+ }
+ mDefaultNetId = NETID_UNSET;
+ } else if (network->getType() == Network::VIRTUAL) {
+ if (int err = modifyFallthroughLocked(netId, false)) {
+ if (!ret) {
+ ret = err;
+ }
}
}
- if (!found) {
- ALOGE("interface %s not a member of netId %u", interface, netId);
- status = false;
+ mNetworks.erase(netId);
+ delete network;
+ _resolv_delete_cache_for_net(netId);
+ return ret;
+}
+
+int NetworkController::addInterfaceToNetwork(unsigned netId, const char* interface) {
+ if (!isValidNetwork(netId)) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
}
- Permission permission = mPermissionsController->getPermissionForNetwork(netId);
- if (!mRouteController->removeInterfaceFromNetwork(netId, interface, permission)) {
- ALOGE("failed to remove rules for interface %s from netId %u", interface, netId);
- status = false;
+ unsigned existingNetId = getNetworkForInterface(interface);
+ if (existingNetId != NETID_UNSET && existingNetId != netId) {
+ ALOGE("interface %s already assigned to netId %u", interface, existingNetId);
+ return -EBUSY;
}
- if (netId == getDefaultNetwork() &&
- !mRouteController->removeDefaultNetwork(interface, permission)) {
- ALOGE("failed to remove interface %s from default network %u", interface, netId);
- status = false;
+ android::RWLock::AutoWLock lock(mRWLock);
+ return getNetworkLocked(netId)->addInterface(interface);
+}
+
+int NetworkController::removeInterfaceFromNetwork(unsigned netId, const char* interface) {
+ if (!isValidNetwork(netId)) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
}
- mIfaceNetidMap.erase(interface);
+ android::RWLock::AutoWLock lock(mRWLock);
+ return getNetworkLocked(netId)->removeInterface(interface);
+}
- return status;
+Permission NetworkController::getPermissionForUser(uid_t uid) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ return getPermissionForUserLocked(uid);
}
-bool NetworkController::destroyNetwork(unsigned netId) {
- if (!isNetIdValid(netId)) {
- ALOGE("invalid netId %u", netId);
- return false;
+void NetworkController::setPermissionForUsers(Permission permission,
+ const std::vector<uid_t>& uids) {
+ android::RWLock::AutoWLock lock(mRWLock);
+ for (uid_t uid : uids) {
+ mUsers[uid] = permission;
}
+}
- // TODO: ioctl(SIOCKILLADDR, ...) to kill all sockets on the old network.
+int NetworkController::checkUserNetworkAccess(uid_t uid, unsigned netId) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ return checkUserNetworkAccessLocked(uid, netId);
+}
- bool status = true;
+int NetworkController::setPermissionForNetworks(Permission permission,
+ const std::vector<unsigned>& netIds) {
+ android::RWLock::AutoWLock lock(mRWLock);
+ for (unsigned netId : netIds) {
+ Network* network = getNetworkLocked(netId);
+ if (!network) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
+ }
+ if (network->getType() != Network::PHYSICAL) {
+ ALOGE("cannot set permissions on non-physical network with netId %u", netId);
+ return -EINVAL;
+ }
+
+ // TODO: ioctl(SIOCKILLADDR, ...) to kill socets on the network that don't have permission.
- InterfaceRange range = interfacesForNetId(netId, &status);
- for (InterfaceIterator iter = range.first; iter != range.second; ) {
- InterfaceIterator toErase = iter;
- ++iter;
- if (!removeInterfaceFromNetwork(netId, toErase->second.c_str())) {
- status = false;
+ if (int ret = static_cast<PhysicalNetwork*>(network)->setPermission(permission)) {
+ return ret;
}
}
+ return 0;
+}
- if (netId == getDefaultNetwork()) {
- // Could the default network have changed from below us, after we evaluated the 'if', making
- // it wrong to call setDefaultNetwork() now? No, because the default can only change due to
- // a command from CommandListener; but commands are serialized, I.e., we are processing the
- // destroyNetwork() command here, so a setDefaultNetwork() command can't happen in parallel.
- setDefaultNetwork(NETID_UNSET);
+int NetworkController::addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) {
+ android::RWLock::AutoWLock lock(mRWLock);
+ Network* network = getNetworkLocked(netId);
+ if (!network) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
}
-
- mPermissionsController->setPermissionForNetwork(PERMISSION_NONE, netId);
-
- _resolv_delete_cache_for_net(netId);
- return status;
+ if (network->getType() != Network::VIRTUAL) {
+ ALOGE("cannot add users to non-virtual network with netId %u", netId);
+ return -EINVAL;
+ }
+ if (int ret = static_cast<VirtualNetwork*>(network)->addUsers(uidRanges)) {
+ return ret;
+ }
+ return 0;
}
-bool NetworkController::setPermissionForUser(Permission permission,
- const std::vector<unsigned>& uid) {
- for (size_t i = 0; i < uid.size(); ++i) {
- mPermissionsController->setPermissionForUser(permission, uid[i]);
+int NetworkController::removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) {
+ android::RWLock::AutoWLock lock(mRWLock);
+ Network* network = getNetworkLocked(netId);
+ if (!network) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
}
- return true;
+ if (network->getType() != Network::VIRTUAL) {
+ ALOGE("cannot remove users from non-virtual network with netId %u", netId);
+ return -EINVAL;
+ }
+ if (int ret = static_cast<VirtualNetwork*>(network)->removeUsers(uidRanges)) {
+ return ret;
+ }
+ return 0;
}
-bool NetworkController::setPermissionForNetwork(Permission newPermission,
- const std::vector<unsigned>& netId) {
- bool status = true;
-
- for (size_t i = 0; i < netId.size(); ++i) {
- if (!isNetIdValid(netId[i])) {
- ALOGE("invalid netId %u", netId[i]);
- status = false;
- continue;
- }
-
- InterfaceRange range = interfacesForNetId(netId[i], &status);
+int NetworkController::addRoute(unsigned netId, const char* interface, const char* destination,
+ const char* nexthop, bool legacy, uid_t uid) {
+ return modifyRoute(netId, interface, destination, nexthop, true, legacy, uid);
+}
- Permission oldPermission = mPermissionsController->getPermissionForNetwork(netId[i]);
- if (oldPermission == newPermission) {
- continue;
- }
+int NetworkController::removeRoute(unsigned netId, const char* interface, const char* destination,
+ const char* nexthop, bool legacy, uid_t uid) {
+ return modifyRoute(netId, interface, destination, nexthop, false, legacy, uid);
+}
- // TODO: ioctl(SIOCKILLADDR, ...) to kill sockets on the network that don't have
- // newPermission.
+bool NetworkController::canProtect(uid_t uid) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ return ((getPermissionForUserLocked(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) ||
+ mProtectableUsers.find(uid) != mProtectableUsers.end();
+}
- for (InterfaceIterator iter = range.first; iter != range.second; ++iter) {
- if (!mRouteController->modifyNetworkPermission(netId[i], iter->second.c_str(),
- oldPermission, newPermission)) {
- status = false;
- }
- }
+void NetworkController::allowProtect(const std::vector<uid_t>& uids) {
+ android::RWLock::AutoWLock lock(mRWLock);
+ mProtectableUsers.insert(uids.begin(), uids.end());
+}
- mPermissionsController->setPermissionForNetwork(newPermission, netId[i]);
+void NetworkController::denyProtect(const std::vector<uid_t>& uids) {
+ android::RWLock::AutoWLock lock(mRWLock);
+ for (uid_t uid : uids) {
+ mProtectableUsers.erase(uid);
}
-
- return status;
}
-bool NetworkController::addRoute(unsigned netId, const char* interface, const char* destination,
- const char* nexthop) {
- return modifyRoute(netId, interface, destination, nexthop, true);
+bool NetworkController::isValidNetwork(unsigned netId) const {
+ android::RWLock::AutoRLock lock(mRWLock);
+ return getNetworkLocked(netId);
}
-bool NetworkController::removeRoute(unsigned netId, const char* interface, const char* destination,
- const char* nexthop) {
- return modifyRoute(netId, interface, destination, nexthop, false);
+Network* NetworkController::getNetworkLocked(unsigned netId) const {
+ auto iter = mNetworks.find(netId);
+ return iter == mNetworks.end() ? NULL : iter->second;
}
-unsigned NetworkController::netIdForInterface(const char* interface) {
- for (InterfaceIterator iter = mNetIdToInterfaces.begin(); iter != mNetIdToInterfaces.end();
- ++iter) {
- if (iter->second == interface) {
- return iter->first;
+VirtualNetwork* NetworkController::getVirtualNetworkForUserLocked(uid_t uid) const {
+ for (const auto& entry : mNetworks) {
+ if (entry.second->getType() == Network::VIRTUAL) {
+ VirtualNetwork* virtualNetwork = static_cast<VirtualNetwork*>(entry.second);
+ if (virtualNetwork->appliesToUser(uid)) {
+ return virtualNetwork;
+ }
}
}
- return NETID_UNSET;
+ return NULL;
}
-NetworkController::InterfaceRange NetworkController::interfacesForNetId(unsigned netId,
- bool* status) {
- InterfaceRange range = mNetIdToInterfaces.equal_range(netId);
- if (range.first == range.second) {
- ALOGE("unknown netId %u", netId);
- *status = false;
+Permission NetworkController::getPermissionForUserLocked(uid_t uid) const {
+ auto iter = mUsers.find(uid);
+ if (iter != mUsers.end()) {
+ return iter->second;
}
- return range;
+ return uid < FIRST_APPLICATION_UID ? PERMISSION_SYSTEM : PERMISSION_NONE;
}
-bool NetworkController::modifyRoute(unsigned netId, const char* interface, const char* destination,
- const char* nexthop, bool add) {
- if (!isNetIdValid(netId)) {
- ALOGE("invalid netId %u", netId);
- return false;
+int NetworkController::checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const {
+ Network* network = getNetworkLocked(netId);
+ if (!network) {
+ return -ENONET;
}
- if (netIdForInterface(interface) != netId) {
- ALOGE("netId %u has no such interface %s", netId, interface);
- return false;
+ // If uid is INVALID_UID, this likely means that we were unable to retrieve the UID of the peer
+ // (using SO_PEERCRED). Be safe and deny access to the network, even if it's valid.
+ if (uid == INVALID_UID) {
+ return -EREMOTEIO;
+ }
+ Permission userPermission = getPermissionForUserLocked(uid);
+ if ((userPermission & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
+ return 0;
+ }
+ if (network->getType() == Network::VIRTUAL) {
+ return static_cast<VirtualNetwork*>(network)->appliesToUser(uid) ? 0 : -EPERM;
+ }
+ VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
+ if (virtualNetwork && virtualNetwork->isSecure() &&
+ mProtectableUsers.find(uid) == mProtectableUsers.end()) {
+ return -EPERM;
+ }
+ Permission networkPermission = static_cast<PhysicalNetwork*>(network)->getPermission();
+ return ((userPermission & networkPermission) == networkPermission) ? 0 : -EACCES;
+}
+
+int NetworkController::modifyRoute(unsigned netId, const char* interface, const char* destination,
+ const char* nexthop, bool add, bool legacy, uid_t uid) {
+ if (!isValidNetwork(netId)) {
+ ALOGE("no such netId %u", netId);
+ return -ENONET;
+ }
+ unsigned existingNetId = getNetworkForInterface(interface);
+ if (existingNetId == NETID_UNSET) {
+ ALOGE("interface %s not assigned to any netId", interface);
+ return -ENODEV;
+ }
+ if (existingNetId != netId) {
+ ALOGE("interface %s assigned to netId %u, not %u", interface, existingNetId, netId);
+ return -ENOENT;
}
- return add ? mRouteController->addRoute(interface, destination, nexthop) :
- mRouteController->removeRoute(interface, destination, nexthop);
+ RouteController::TableType tableType;
+ if (netId == LOCAL_NET_ID) {
+ tableType = RouteController::LOCAL_NETWORK;
+ } else if (legacy) {
+ if ((getPermissionForUser(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
+ tableType = RouteController::LEGACY_SYSTEM;
+ } else {
+ tableType = RouteController::LEGACY_NETWORK;
+ }
+ } else {
+ tableType = RouteController::INTERFACE;
+ }
+
+ return add ? RouteController::addRoute(interface, destination, nexthop, tableType) :
+ RouteController::removeRoute(interface, destination, nexthop, tableType);
}
-NetworkController::UidEntry::UidEntry(
- int start, int end, unsigned netId, bool forward_dns)
- : uid_start(start),
- uid_end(end),
- netId(netId),
- forward_dns(forward_dns) {
+int NetworkController::modifyFallthroughLocked(unsigned vpnNetId, bool add) {
+ if (mDefaultNetId == NETID_UNSET) {
+ return 0;
+ }
+ Network* network = getNetworkLocked(mDefaultNetId);
+ if (!network) {
+ ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
+ return -ESRCH;
+ }
+ if (network->getType() != Network::PHYSICAL) {
+ ALOGE("inconceivable! default network must be a physical network");
+ return -EINVAL;
+ }
+ Permission permission = static_cast<PhysicalNetwork*>(network)->getPermission();
+ for (const auto& physicalInterface : network->getInterfaces()) {
+ if (int ret = mDelegateImpl->modifyFallthrough(vpnNetId, physicalInterface, permission,
+ add)) {
+ return ret;
+ }
+ }
+ return 0;
}
OSDN Git Service
