Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2014 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Sreeram Ramachandran | 7260407 | 2014-05-21 13:19:43 -0700 | [diff] [blame] | 17 | #ifndef NETD_SERVER_NETWORK_CONTROLLER_H |
| 18 | #define NETD_SERVER_NETWORK_CONTROLLER_H |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 19 | |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 20 | #include "NetdConstants.h" |
Sreeram Ramachandran | 5c181bf | 2014-04-07 14:10:04 -0700 | [diff] [blame] | 21 | #include "Permission.h" |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 22 | |
Sreeram Ramachandran | 7260407 | 2014-05-21 13:19:43 -0700 | [diff] [blame] | 23 | #include "utils/RWLock.h" |
Sreeram Ramachandran | 5c181bf | 2014-04-07 14:10:04 -0700 | [diff] [blame] | 24 | |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 25 | #include <list> |
| 26 | #include <map> |
Sreeram Ramachandran | 89dad01 | 2014-07-02 10:09:49 -0700 | [diff] [blame] | 27 | #include <set> |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 28 | #include <sys/types.h> |
Sreeram Ramachandran | 7260407 | 2014-05-21 13:19:43 -0700 | [diff] [blame] | 29 | #include <vector> |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 30 | |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 31 | class Network; |
Sreeram Ramachandran | b1425cc | 2014-06-23 18:54:27 -0700 | [diff] [blame] | 32 | class UidRanges; |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 33 | class VirtualNetwork; |
Sreeram Ramachandran | 5c181bf | 2014-04-07 14:10:04 -0700 | [diff] [blame] | 34 | |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 35 | /* |
| 36 | * Keeps track of default, per-pid, and per-uid-range network selection, as |
| 37 | * well as the mark associated with each network. Networks are identified |
| 38 | * by netid. In all set* commands netid == 0 means "unspecified" and is |
| 39 | * equivalent to clearing the mapping. |
| 40 | */ |
| 41 | class NetworkController { |
| 42 | public: |
Sreeram Ramachandran | 87475a1 | 2014-07-15 16:20:28 -0700 | [diff] [blame^] | 43 | static const int LOCAL_NET_ID = 9; |
| 44 | |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 45 | NetworkController(); |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 46 | |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 47 | unsigned getDefaultNetwork() const; |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 48 | int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT; |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 49 | |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 50 | // Order of preference: UID-specific, requestedNetId, default. |
| 51 | // Specify NETID_UNSET for requestedNetId if the default network is preferred. |
| 52 | // forDns indicates if we're querying the netId for a DNS request. This avoids sending DNS |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 53 | // requests to VPNs without DNS servers. |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 54 | unsigned getNetworkForUser(uid_t uid, unsigned requestedNetId, bool forDns) const; |
| 55 | unsigned getNetworkForInterface(const char* interface) const; |
Sreeram Ramachandran | 070b2d2 | 2014-07-11 17:06:12 -0700 | [diff] [blame] | 56 | bool isVirtualNetwork(unsigned netId) const; |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 57 | |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 58 | int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT; |
| 59 | int createVirtualNetwork(unsigned netId, bool hasDns) WARN_UNUSED_RESULT; |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 60 | int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT; |
Sreeram Ramachandran | 5c181bf | 2014-04-07 14:10:04 -0700 | [diff] [blame] | 61 | |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 62 | int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; |
| 63 | int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT; |
| 64 | |
| 65 | Permission getPermissionForUser(uid_t uid) const; |
| 66 | void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids); |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 67 | bool canUserSelectNetwork(uid_t uid, unsigned netId) const; |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 68 | int setPermissionForNetworks(Permission permission, |
| 69 | const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT; |
Sreeram Ramachandran | 379bd33 | 2014-04-10 19:58:06 -0700 | [diff] [blame] | 70 | |
Sreeram Ramachandran | b1425cc | 2014-06-23 18:54:27 -0700 | [diff] [blame] | 71 | int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT; |
| 72 | int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT; |
| 73 | |
Sreeram Ramachandran | 7619e1b | 2014-04-15 14:23:08 -0700 | [diff] [blame] | 74 | // Routes are added to tables determined by the interface, so only |interface| is actually used. |
| 75 | // |netId| is given only to sanity check that the interface has the correct netId. |
Lorenzo Colitti | f7fc8ec | 2014-06-18 00:41:58 +0900 | [diff] [blame] | 76 | int addRoute(unsigned netId, const char* interface, const char* destination, |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 77 | const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT; |
Lorenzo Colitti | f7fc8ec | 2014-06-18 00:41:58 +0900 | [diff] [blame] | 78 | int removeRoute(unsigned netId, const char* interface, const char* destination, |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 79 | const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT; |
Sreeram Ramachandran | 7260407 | 2014-05-21 13:19:43 -0700 | [diff] [blame] | 80 | |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 81 | bool canProtect(uid_t uid) const; |
Sreeram Ramachandran | 89dad01 | 2014-07-02 10:09:49 -0700 | [diff] [blame] | 82 | void allowProtect(const std::vector<uid_t>& uids); |
| 83 | void denyProtect(const std::vector<uid_t>& uids); |
| 84 | |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 85 | private: |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 86 | bool isValidNetwork(unsigned netId) const; |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 87 | Network* getNetworkLocked(unsigned netId) const; |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 88 | VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const; |
Sreeram Ramachandran | ed4bd1f | 2014-07-05 12:31:05 -0700 | [diff] [blame] | 89 | Permission getPermissionForUserLocked(uid_t uid) const; |
Sreeram Ramachandran | 7619e1b | 2014-04-15 14:23:08 -0700 | [diff] [blame] | 90 | |
Lorenzo Colitti | f7fc8ec | 2014-06-18 00:41:58 +0900 | [diff] [blame] | 91 | int modifyRoute(unsigned netId, const char* interface, const char* destination, |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 92 | const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT; |
Sreeram Ramachandran | 7619e1b | 2014-04-15 14:23:08 -0700 | [diff] [blame] | 93 | |
Sreeram Ramachandran | e09b20a | 2014-07-05 17:15:14 -0700 | [diff] [blame] | 94 | // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers and mProtectableUsers. |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 95 | mutable android::RWLock mRWLock; |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 96 | unsigned mDefaultNetId; |
Sreeram Ramachandran | 36ed53e | 2014-07-01 19:01:56 -0700 | [diff] [blame] | 97 | std::map<unsigned, Network*> mNetworks; // Map keys are NetIds. |
Sreeram Ramachandran | f4f6c8d | 2014-06-23 09:54:06 -0700 | [diff] [blame] | 98 | std::map<uid_t, Permission> mUsers; |
Sreeram Ramachandran | 89dad01 | 2014-07-02 10:09:49 -0700 | [diff] [blame] | 99 | std::set<uid_t> mProtectableUsers; |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 100 | }; |
| 101 | |
Sreeram Ramachandran | 7260407 | 2014-05-21 13:19:43 -0700 | [diff] [blame] | 102 | #endif // NETD_SERVER_NETWORK_CONTROLLER_H |