server/NetworkController.cpp

/*
 * Copyright (C) 2014 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

// THREAD-SAFETY
// -------------
// The methods in this file are called from multiple threads (from CommandListener, FwmarkServer
// and DnsProxyListener). So, all accesses to shared state are guarded by a lock.
//
// In some cases, a single non-const method acquires and releases the lock several times, like so:
//     if (isValidNetwork(...)) {  // isValidNetwork() acquires and releases the lock.
//        setDefaultNetwork(...);  // setDefaultNetwork() also acquires and releases the lock.
//
// It might seem that this allows races where the state changes between the two statements, but in
// fact there are no races because:
//     1. This pattern only occurs in non-const methods (i.e., those that mutate state).
//     2. Only CommandListener calls these non-const methods. The others call only const methods.
//     3. CommandListener only processes one command at a time. I.e., it's serialized.
// Thus, no other mutation can occur in between the two statements above.

#include "NetworkController.h"

#include "PermissionsController.h"
#include "RouteController.h"

#define LOG_TAG "NetworkController"

#include <sys/socket.h>
#include <linux/if.h>

#include "cutils/log.h"
#include "resolv_netid.h"

namespace {

// Keep these in sync with ConnectivityService.java.
const unsigned int MIN_NET_ID = 10;
const unsigned int MAX_NET_ID = 65535;

}  // namespace

NetworkController::NetworkController(PermissionsController* permissionsController,
                                     RouteController* routeController)
        : mDefaultNetId(NETID_UNSET),
          mPermissionsController(permissionsController),
          mRouteController(routeController) {
}

void NetworkController::clearNetworkPreference() {
    android::RWLock::AutoWLock lock(mRWLock);
    mUidMap.clear();
}

unsigned NetworkController::getDefaultNetwork() const {
    android::RWLock::AutoRLock lock(mRWLock);
    return mDefaultNetId;
}

bool NetworkController::setDefaultNetwork(unsigned newNetId) {
    // newNetId must be either NETID_UNSET or a valid network. If it's NETID_UNSET, the caller is
    // asking for there to be no default network, which is a request we support.
    if (newNetId != NETID_UNSET && !isValidNetwork(newNetId)) {
        ALOGE("invalid netId %u", newNetId);
        errno = EINVAL;
        return false;
    }

    unsigned oldNetId;
    {
        android::RWLock::AutoWLock lock(mRWLock);
        oldNetId = mDefaultNetId;
        mDefaultNetId = newNetId;
    }

    if (oldNetId == newNetId) {
        return true;
    }

    bool status = true;
    Permission permission;
    InterfaceRange range;

    // Add default network rules for the new netId.
    permission = mPermissionsController->getPermissionForNetwork(newNetId);
    range = mNetIdToInterfaces.equal_range(newNetId);
    for (InterfaceIteratorConst iter = range.first; iter != range.second; ++iter) {
        if (!mRouteController->addToDefaultNetwork(iter->second.c_str(), permission)) {
            ALOGE("failed to add interface %s to default netId %u", iter->second.c_str(), newNetId);
            status = false;
        }
    }

    // Remove the old default network rules.
    permission = mPermissionsController->getPermissionForNetwork(oldNetId);
    range = mNetIdToInterfaces.equal_range(oldNetId);
    for (InterfaceIteratorConst iter = range.first; iter != range.second; ++iter) {
        if (!mRouteController->removeFromDefaultNetwork(iter->second.c_str(), permission)) {
            ALOGE("failed to remove interface %s from default netId %u", iter->second.c_str(),
                  oldNetId);
            status = false;
        }
    }

    return status;
}

bool NetworkController::setNetworkForUidRange(int uid_start, int uid_end, unsigned netId,
                                              bool forward_dns) {
    if (uid_start > uid_end || !isValidNetwork(netId)) {
        errno = EINVAL;
        return false;
    }

    android::RWLock::AutoWLock lock(mRWLock);
    for (std::list<UidEntry>::iterator it = mUidMap.begin(); it != mUidMap.end(); ++it) {
        if (it->uid_start != uid_start || it->uid_end != uid_end || it->netId != netId)
            continue;
        it->forward_dns = forward_dns;
        return true;
    }

    mUidMap.push_front(UidEntry(uid_start, uid_end, netId, forward_dns));
    return true;
}

bool NetworkController::clearNetworkForUidRange(int uid_start, int uid_end, unsigned netId) {
    if (uid_start > uid_end || !isValidNetwork(netId)) {
        errno = EINVAL;
        return false;
    }

    android::RWLock::AutoWLock lock(mRWLock);
    for (std::list<UidEntry>::iterator it = mUidMap.begin(); it != mUidMap.end(); ++it) {
        if (it->uid_start != uid_start || it->uid_end != uid_end || it->netId != netId)
            continue;
        mUidMap.erase(it);
        return true;
    }

    errno = ENOENT;
    return false;
}

unsigned NetworkController::getNetwork(int uid, unsigned requested_netId, bool for_dns) const {
    android::RWLock::AutoRLock lock(mRWLock);
    for (std::list<UidEntry>::const_iterator it = mUidMap.begin(); it != mUidMap.end(); ++it) {
        if (uid < it->uid_start || it->uid_end < uid)
            continue;
        if (for_dns && !it->forward_dns)
            break;
        return it->netId;
    }
    if (mValidNetworks.find(requested_netId) != mValidNetworks.end())
        return requested_netId;
    return mDefaultNetId;
}

unsigned NetworkController::getNetworkId(const char* interface) const {
    for (InterfaceIteratorConst iter = mNetIdToInterfaces.begin(); iter != mNetIdToInterfaces.end();
         ++iter) {
        if (iter->second == interface) {
            return iter->first;
        }
    }
    return NETID_UNSET;
}

bool NetworkController::createNetwork(unsigned netId, Permission permission) {
    if (netId < MIN_NET_ID || netId > MAX_NET_ID) {
        ALOGE("invalid netId %u", netId);
        errno = EINVAL;
        return false;
    }

    {
        android::RWLock::AutoWLock lock(mRWLock);
        if (!mValidNetworks.insert(netId).second) {
            ALOGE("duplicate netId %u", netId);
            errno = EEXIST;
            return false;
        }
    }

    mPermissionsController->setPermissionForNetwork(permission, netId);
    return true;
}

int NetworkController::addInterfaceToNetwork(unsigned netId, const char* interface) {
    if (!isValidNetwork(netId) || !interface) {
        ALOGE("invalid netId %u or interface null", netId);
        return -EINVAL;
    }

    unsigned existingNetId = getNetworkId(interface);
    if (existingNetId != NETID_UNSET) {
        ALOGE("interface %s already assigned to netId %u", interface, existingNetId);
        return -EBUSY;
    }

    int ret;
    Permission permission = mPermissionsController->getPermissionForNetwork(netId);
    if ((ret = mRouteController->addInterfaceToNetwork(netId, interface, permission)) != 0) {
        ALOGE("failed to add interface %s to netId %u", interface, netId);
        return ret;
    }

    mNetIdToInterfaces.insert(std::pair<unsigned, std::string>(netId, interface));

    if (netId == getDefaultNetwork() &&
            (ret = mRouteController->addToDefaultNetwork(interface, permission)) != 0) {
        ALOGE("failed to add interface %s to default netId %u", interface, netId);
        return ret;
    }

    return 0;
}

int NetworkController::removeInterfaceFromNetwork(unsigned netId, const char* interface) {
    if (!isValidNetwork(netId) || !interface) {
        ALOGE("invalid netId %u or interface null", netId);
        return -EINVAL;
    }

    int ret = -ENOENT;
    InterfaceRange range = mNetIdToInterfaces.equal_range(netId);
    for (InterfaceIterator iter = range.first; iter != range.second; ++iter) {
        if (iter->second == interface) {
            mNetIdToInterfaces.erase(iter);
            ret = 0;
            break;
        }
    }

    if (ret) {
        ALOGE("interface %s not assigned to netId %u", interface, netId);
        return ret;
    }

    Permission permission = mPermissionsController->getPermissionForNetwork(netId);
    if (netId == getDefaultNetwork() &&
            (ret = mRouteController->removeFromDefaultNetwork(interface, permission)) != 0) {
        ALOGE("failed to remove interface %s from default netId %u", interface, netId);
        return ret;
    }

    if ((ret = mRouteController->removeInterfaceFromNetwork(netId, interface, permission)) != 0) {
        ALOGE("failed to remove interface %s from netId %u", interface, netId);
        return ret;
    }

    return 0;
}

bool NetworkController::destroyNetwork(unsigned netId) {
    if (!isValidNetwork(netId)) {
        ALOGE("invalid netId %u", netId);
        errno = EINVAL;
        return false;
    }

    // TODO: ioctl(SIOCKILLADDR, ...) to kill all sockets on the old network.

    bool status = true;

    InterfaceRange range = mNetIdToInterfaces.equal_range(netId);
    for (InterfaceIteratorConst iter = range.first; iter != range.second; ) {
        char interface[IFNAMSIZ];
        strncpy(interface, iter->second.c_str(), sizeof(interface));
        interface[sizeof(interface) - 1] = 0;
        ++iter;
        if (!removeInterfaceFromNetwork(netId, interface)) {
            status = false;
        }
    }

    if (netId == getDefaultNetwork()) {
        setDefaultNetwork(NETID_UNSET);
    }

    {
        android::RWLock::AutoWLock lock(mRWLock);
        mValidNetworks.erase(netId);
    }

    mPermissionsController->setPermissionForNetwork(PERMISSION_NONE, netId);

    _resolv_delete_cache_for_net(netId);
    return status;
}

void NetworkController::setPermissionForUser(Permission permission,
                                             const std::vector<unsigned>& uid) {
    for (size_t i = 0; i < uid.size(); ++i) {
        mPermissionsController->setPermissionForUser(permission, uid[i]);
    }
}

int NetworkController::setPermissionForNetwork(Permission newPermission,
                                               const std::vector<unsigned>& netId) {
    for (size_t i = 0; i < netId.size(); ++i) {
        if (!isValidNetwork(netId[i])) {
            ALOGE("invalid netId %u", netId[i]);
            return -EINVAL;
        }

        Permission oldPermission = mPermissionsController->getPermissionForNetwork(netId[i]);
        if (oldPermission == newPermission) {
            continue;
        }

        // TODO: ioctl(SIOCKILLADDR, ...) to kill sockets on the network that don't have
        // newPermission.

        InterfaceRange range = mNetIdToInterfaces.equal_range(netId[i]);
        for (InterfaceIteratorConst iter = range.first; iter != range.second; ++iter) {
            int ret = mRouteController->modifyNetworkPermission(netId[i], iter->second.c_str(),
                                                                oldPermission, newPermission);
            if (ret) {
                ALOGE("failed to change permission on interface %s of netId %u from %x to %x",
                      iter->second.c_str(), netId[i], oldPermission, newPermission);
                return ret;
            }
        }

        mPermissionsController->setPermissionForNetwork(newPermission, netId[i]);
    }

    return 0;
}

int NetworkController::addRoute(unsigned netId, const char* interface, const char* destination,
                                const char* nexthop, bool legacy, unsigned uid) {
    return modifyRoute(netId, interface, destination, nexthop, true, legacy, uid);
}

int NetworkController::removeRoute(unsigned netId, const char* interface, const char* destination,
                                   const char* nexthop, bool legacy, unsigned uid) {
    return modifyRoute(netId, interface, destination, nexthop, false, legacy, uid);
}

bool NetworkController::isValidNetwork(unsigned netId) const {
    if (netId == NETID_UNSET) {
        return false;
    }

    android::RWLock::AutoRLock lock(mRWLock);
    return mValidNetworks.find(netId) != mValidNetworks.end();
}

int NetworkController::modifyRoute(unsigned netId, const char* interface, const char* destination,
                                   const char* nexthop, bool add, bool legacy, unsigned uid) {
    if (!isValidNetwork(netId)) {
        ALOGE("invalid netId %u", netId);
        return -EINVAL;
    }

    if (getNetworkId(interface) != netId) {
        ALOGE("netId %u has no such interface %s", netId, interface);
        return -ENOENT;
    }

    RouteController::TableType tableType;
    if (legacy) {
        if (mPermissionsController->getPermissionForUser(uid) & PERMISSION_CONNECTIVITY_INTERNAL) {
            tableType = RouteController::PRIVILEGED_LEGACY;
        } else {
            tableType = RouteController::LEGACY;
        }
    } else {
        tableType = RouteController::INTERFACE;
    }

    return add ? mRouteController->addRoute(interface, destination, nexthop, tableType, uid) :
                 mRouteController->removeRoute(interface, destination, nexthop, tableType, uid);
}

NetworkController::UidEntry::UidEntry(int start, int end, unsigned netId, bool forward_dns)
    : uid_start(start), uid_end(end), netId(netId), forward_dns(forward_dns) {
}