blob: 0418f96b0b8b0286b352d9a4db6918af79dbf776 [file] [log] [blame]
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -05001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Sreeram Ramachandran72604072014-05-21 13:19:43 -070017#ifndef NETD_SERVER_NETWORK_CONTROLLER_H
18#define NETD_SERVER_NETWORK_CONTROLLER_H
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050019
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070020#include "NetdConstants.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070021#include "Permission.h"
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070022
Sreeram Ramachandran72604072014-05-21 13:19:43 -070023#include "utils/RWLock.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070024
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050025#include <list>
26#include <map>
Sreeram Ramachandran89dad012014-07-02 10:09:49 -070027#include <set>
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070028#include <sys/types.h>
Sreeram Ramachandran72604072014-05-21 13:19:43 -070029#include <vector>
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050030
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070031class Network;
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -070032class UidRanges;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070033
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050034/*
35 * Keeps track of default, per-pid, and per-uid-range network selection, as
36 * well as the mark associated with each network. Networks are identified
37 * by netid. In all set* commands netid == 0 means "unspecified" and is
38 * equivalent to clearing the mapping.
39 */
40class NetworkController {
41public:
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070042 NetworkController();
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050043
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050044 unsigned getDefaultNetwork() const;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070045 int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050046
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070047 bool setNetworkForUidRange(uid_t uidStart, uid_t uidEnd, unsigned netId, bool forwardDns);
48 bool clearNetworkForUidRange(uid_t uidStart, uid_t uidEnd, unsigned netId);
49
50 // Order of preference: UID-specific, requestedNetId, default.
51 // Specify NETID_UNSET for requestedNetId if the default network is preferred.
52 // forDns indicates if we're querying the netId for a DNS request. This avoids sending DNS
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050053 // requests to VPNs without DNS servers.
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070054 unsigned getNetwork(uid_t uid, unsigned requestedNetId, bool forDns) const;
Sreeram Ramachandran72604072014-05-21 13:19:43 -070055 unsigned getNetworkId(const char* interface) const;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070056 bool isValidNetwork(unsigned netId) const;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050057
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070058 int createNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
Sreeram Ramachandran89dad012014-07-02 10:09:49 -070059 int createVpn(unsigned netId) WARN_UNUSED_RESULT;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070060 int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070061
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070062 int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
63 int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
64
65 Permission getPermissionForUser(uid_t uid) const;
66 void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
67 bool isUserPermittedOnNetwork(uid_t uid, unsigned netId) const;
68 int setPermissionForNetworks(Permission permission,
69 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT;
Sreeram Ramachandran379bd332014-04-10 19:58:06 -070070
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -070071 int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
72 int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
73
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -070074 // Routes are added to tables determined by the interface, so only |interface| is actually used.
75 // |netId| is given only to sanity check that the interface has the correct netId.
Lorenzo Colittif7fc8ec2014-06-18 00:41:58 +090076 int addRoute(unsigned netId, const char* interface, const char* destination,
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070077 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
Lorenzo Colittif7fc8ec2014-06-18 00:41:58 +090078 int removeRoute(unsigned netId, const char* interface, const char* destination,
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070079 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
Sreeram Ramachandran72604072014-05-21 13:19:43 -070080
Sreeram Ramachandran89dad012014-07-02 10:09:49 -070081 void allowProtect(const std::vector<uid_t>& uids);
82 void denyProtect(const std::vector<uid_t>& uids);
83
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050084private:
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070085 Network* getNetworkLocked(unsigned netId) const;
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -070086 Permission getPermissionForUserLocked(uid_t uid) const;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -070087
Lorenzo Colittif7fc8ec2014-06-18 00:41:58 +090088 int modifyRoute(unsigned netId, const char* interface, const char* destination,
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070089 const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -070090
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050091 struct UidEntry {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070092 const uid_t uidStart;
93 const uid_t uidEnd;
94 const unsigned netId;
95 bool forwardDns;
96
97 UidEntry(uid_t uidStart, uid_t uidEnd, unsigned netId, bool forwardDns);
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050098 };
99
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700100 // mRWLock guards all accesses to mUidMap, mDefaultNetId, mNetworks, mUsers and
101 // mProtectableUsers.
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500102 mutable android::RWLock mRWLock;
103 std::list<UidEntry> mUidMap;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500104 unsigned mDefaultNetId;
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700105 std::map<unsigned, Network*> mNetworks; // Map keys are NetIds.
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700106 std::map<uid_t, Permission> mUsers;
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700107 std::set<uid_t> mProtectableUsers;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500108};
109
Sreeram Ramachandran72604072014-05-21 13:19:43 -0700110#endif // NETD_SERVER_NETWORK_CONTROLLER_H