blob: 20ae44b278713be04eaed4a8320edfe496ac3a72 [file] [log] [blame]
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -05001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Sreeram Ramachandran72604072014-05-21 13:19:43 -070017// THREAD-SAFETY
18// -------------
19// The methods in this file are called from multiple threads (from CommandListener, FwmarkServer
20// and DnsProxyListener). So, all accesses to shared state are guarded by a lock.
21//
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +090022// Public functions accessible by external callers should be thread-safe and are responsible for
23// acquiring the lock. Private functions in this file should call xxxLocked() methods and access
24// internal state directly.
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050025
Erik Kline2d3a1632016-03-15 16:33:48 +090026#define LOG_TAG "Netd"
Luke Huangcfd04b22019-03-18 15:53:21 +080027
28#include "NetworkController.h"
Erik Kline2d3a1632016-03-15 16:33:48 +090029
Rubin Xu6c00b612018-04-27 14:27:59 +010030#include <android-base/strings.h>
Bernie Innocenti34de3ba2019-02-19 18:08:36 +090031#include <cutils/misc.h> // FIRST_APPLICATION_UID
Bernie Innocenti189eb502018-10-01 23:10:18 +090032#include <netd_resolv/resolv.h>
Luke Huangcfd04b22019-03-18 15:53:21 +080033#include "log/log.h"
Rubin Xu6c00b612018-04-27 14:27:59 +010034
Pierre Imai3a272072016-04-19 16:17:07 +090035#include "Controllers.h"
Lorenzo Colitti36679362015-02-25 10:26:19 +090036#include "DummyNetwork.h"
Sreeram Ramachandran1011b492014-07-24 19:04:32 -070037#include "Fwmark.h"
Sreeram Ramachandran6a773532014-07-11 09:10:20 -070038#include "LocalNetwork.h"
Hungming Chen228cffa2020-02-18 17:11:18 +080039#include "OffloadUtils.h"
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070040#include "PhysicalNetwork.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070041#include "RouteController.h"
Sreeram Ramachandran4043f012014-06-23 12:41:37 -070042#include "VirtualNetwork.h"
Luke Huangb257d612019-03-14 21:19:13 +080043#include "netdutils/DumpWriter.h"
Bernie Innocenti189eb502018-10-01 23:10:18 +090044#include "netid_client.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070045
Erik Kline6d4669f2017-05-25 17:03:31 +090046#define DBG 0
47
Luke Huangb257d612019-03-14 21:19:13 +080048using android::netdutils::DumpWriter;
49
Bernie Innocenti762dcf42019-06-14 19:52:49 +090050namespace android::net {
Lorenzo Colitti7035f222017-02-13 18:29:00 +090051
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070052namespace {
53
54// Keep these in sync with ConnectivityService.java.
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -070055const unsigned MIN_NET_ID = 100;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070056const unsigned MAX_NET_ID = 65535;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070057
58} // namespace
59
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070060// All calls to methods here are made while holding a write lock on mRWLock.
Lorenzo Colitti2d014e72018-01-10 22:12:29 +090061// They are mostly not called directly from this class, but from methods in PhysicalNetwork.cpp.
62// However, we're the only user of that class, so all calls to those methods come from here and are
63// made under lock.
64// For example, PhysicalNetwork::setPermission ends up calling addFallthrough and removeFallthrough,
65// but it's only called from here under lock (specifically, from createPhysicalNetworkLocked and
66// setPermissionForNetworks).
67// TODO: use std::mutex and GUARDED_BY instead of manual inspection.
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070068class NetworkController::DelegateImpl : public PhysicalNetwork::Delegate {
Bernie Innocenti762dcf42019-06-14 19:52:49 +090069 public:
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070070 explicit DelegateImpl(NetworkController* networkController);
71 virtual ~DelegateImpl();
72
Bernie Innocenti762dcf42019-06-14 19:52:49 +090073 [[nodiscard]] int modifyFallthrough(unsigned vpnNetId, const std::string& physicalInterface,
74 Permission permission, bool add);
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070075
Bernie Innocenti762dcf42019-06-14 19:52:49 +090076 private:
77 [[nodiscard]] int addFallthrough(const std::string& physicalInterface,
78 Permission permission) override;
79 [[nodiscard]] int removeFallthrough(const std::string& physicalInterface,
80 Permission permission) override;
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070081
Bernie Innocenti762dcf42019-06-14 19:52:49 +090082 [[nodiscard]] int modifyFallthrough(const std::string& physicalInterface, Permission permission,
83 bool add);
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070084
85 NetworkController* const mNetworkController;
86};
87
88NetworkController::DelegateImpl::DelegateImpl(NetworkController* networkController) :
89 mNetworkController(networkController) {
90}
91
92NetworkController::DelegateImpl::~DelegateImpl() {
93}
94
95int NetworkController::DelegateImpl::modifyFallthrough(unsigned vpnNetId,
96 const std::string& physicalInterface,
97 Permission permission, bool add) {
98 if (add) {
99 if (int ret = RouteController::addVirtualNetworkFallthrough(vpnNetId,
100 physicalInterface.c_str(),
101 permission)) {
102 ALOGE("failed to add fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
103 vpnNetId);
104 return ret;
105 }
106 } else {
107 if (int ret = RouteController::removeVirtualNetworkFallthrough(vpnNetId,
108 physicalInterface.c_str(),
109 permission)) {
110 ALOGE("failed to remove fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
111 vpnNetId);
112 return ret;
113 }
114 }
115 return 0;
116}
117
118int NetworkController::DelegateImpl::addFallthrough(const std::string& physicalInterface,
119 Permission permission) {
120 return modifyFallthrough(physicalInterface, permission, true);
121}
122
123int NetworkController::DelegateImpl::removeFallthrough(const std::string& physicalInterface,
124 Permission permission) {
125 return modifyFallthrough(physicalInterface, permission, false);
126}
127
128int NetworkController::DelegateImpl::modifyFallthrough(const std::string& physicalInterface,
129 Permission permission, bool add) {
130 for (const auto& entry : mNetworkController->mNetworks) {
131 if (entry.second->getType() == Network::VIRTUAL) {
132 if (int ret = modifyFallthrough(entry.first, physicalInterface, permission, add)) {
133 return ret;
134 }
135 }
136 }
137 return 0;
138}
139
140NetworkController::NetworkController() :
Pierre Imai6be56192016-05-16 16:32:17 +0900141 mDelegateImpl(new NetworkController::DelegateImpl(this)), mDefaultNetId(NETID_UNSET),
142 mProtectableUsers({AID_VPN}) {
Sreeram Ramachandran87475a12014-07-15 16:20:28 -0700143 mNetworks[LOCAL_NET_ID] = new LocalNetwork(LOCAL_NET_ID);
Lorenzo Colitti36679362015-02-25 10:26:19 +0900144 mNetworks[DUMMY_NET_ID] = new DummyNetwork(DUMMY_NET_ID);
Hungming Chen228cffa2020-02-18 17:11:18 +0800145
146 // Clear all clsact stubs on all interfaces.
147 // TODO: perhaps only remove the clsact on the interface which is added by
148 // RouteController::addInterfaceToPhysicalNetwork. Currently, the netd only
149 // attach the clsact to the interface for the physical network.
150 if (bpf::isBpfSupported()) {
151 const auto& ifaces = InterfaceController::getIfaceNames();
152 if (isOk(ifaces)) {
153 for (const std::string& iface : ifaces.value()) {
154 if (int ifIndex = if_nametoindex(iface.c_str())) {
155 // Ignore the error because the interface might not have a clsact.
156 tcQdiscDelDevClsact(ifIndex);
157 }
158 }
159 }
160 }
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500161}
162
163unsigned NetworkController::getDefaultNetwork() const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800164 ScopedRLock lock(mRWLock);
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500165 return mDefaultNetId;
166}
167
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700168int NetworkController::setDefaultNetwork(unsigned netId) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800169 ScopedWLock lock(mRWLock);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700170
171 if (netId == mDefaultNetId) {
172 return 0;
Sreeram Ramachandran72604072014-05-21 13:19:43 -0700173 }
174
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700175 if (netId != NETID_UNSET) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700176 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900177 if (!network) {
178 ALOGE("no such netId %u", netId);
179 return -ENONET;
180 }
181 if (network->getType() != Network::PHYSICAL) {
182 ALOGE("cannot set default to non-physical network with netId %u", netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700183 return -EINVAL;
184 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700185 if (int ret = static_cast<PhysicalNetwork*>(network)->addAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700186 return ret;
Sreeram Ramachandran9c0d3132014-04-10 20:35:04 -0700187 }
188 }
189
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700190 if (mDefaultNetId != NETID_UNSET) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700191 Network* network = getNetworkLocked(mDefaultNetId);
192 if (!network || network->getType() != Network::PHYSICAL) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700193 ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
194 return -ESRCH;
195 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700196 if (int ret = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700197 return ret;
Sreeram Ramachandran9c0d3132014-04-10 20:35:04 -0700198 }
199 }
200
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700201 mDefaultNetId = netId;
202 return 0;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500203}
204
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900205uint32_t NetworkController::getNetworkForDnsLocked(unsigned* netId, uid_t uid) const {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700206 Fwmark fwmark;
207 fwmark.protectedFromVpn = true;
208 fwmark.permission = PERMISSION_SYSTEM;
Lorenzo Colitti95f1bcb2018-05-30 16:14:18 +0900209
210 // Common case: there is no VPN that applies to the user, and the query did not specify a netId.
211 // Therefore, it is safe to set the explicit bit on this query and skip all the complex logic
212 // below. While this looks like a special case, it is actually the one that handles the vast
213 // majority of DNS queries.
214 // TODO: untangle this code.
215 if (*netId == NETID_UNSET && getVirtualNetworkForUserLocked(uid) == nullptr) {
216 *netId = mDefaultNetId;
217 fwmark.netId = *netId;
218 fwmark.explicitlySelected = true;
219 return fwmark.intValue;
220 }
221
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900222 if (checkUserNetworkAccessLocked(uid, *netId) == 0) {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700223 // If a non-zero NetId was explicitly specified, and the user has permission for that
Luke Huangd2861982019-05-17 19:47:28 +0800224 // network, use that network's DNS servers. (possibly falling through the to the default
225 // network if the VPN doesn't provide a route to them).
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700226 fwmark.explicitlySelected = true;
Lorenzo Colittic63059c2016-06-21 23:54:12 +0900227
228 // If the network is a VPN and it doesn't have DNS servers, use the default network's DNS
229 // servers (through the default network). Otherwise, the query is guaranteed to fail.
230 // http://b/29498052
231 Network *network = getNetworkLocked(*netId);
Jooyung Han3e64aa12019-11-27 15:36:29 +0900232 if (network && network->getType() == Network::VIRTUAL && !resolv_has_nameservers(*netId)) {
Lorenzo Colittic63059c2016-06-21 23:54:12 +0900233 *netId = mDefaultNetId;
234 }
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700235 } else {
236 // If the user is subject to a VPN and the VPN provides DNS servers, use those servers
237 // (possibly falling through to the default network if the VPN doesn't provide a route to
Luke Huangd2861982019-05-17 19:47:28 +0800238 // them). Otherwise, use the default network's DNS servers.
239 // TODO: Consider if we should set the explicit bit here.
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700240 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
Jooyung Han3e64aa12019-11-27 15:36:29 +0900241 if (virtualNetwork && resolv_has_nameservers(virtualNetwork->getNetId())) {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700242 *netId = virtualNetwork->getNetId();
243 } else {
Lorenzo Colittic63059c2016-06-21 23:54:12 +0900244 // TODO: return an error instead of silently doing the DNS lookup on the wrong network.
245 // http://b/27560555
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700246 *netId = mDefaultNetId;
247 }
248 }
249 fwmark.netId = *netId;
250 return fwmark.intValue;
251}
252
253// Returns the NetId that a given UID would use if no network is explicitly selected. Specifically,
254// the VPN that applies to the UID if any; otherwise, the default network.
255unsigned NetworkController::getNetworkForUser(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800256 ScopedRLock lock(mRWLock);
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700257 if (VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid)) {
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700258 return virtualNetwork->getNetId();
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500259 }
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700260 return mDefaultNetId;
261}
262
263// Returns the NetId that will be set when a socket connect()s. This is the bypassable VPN that
264// applies to the user if any; otherwise, the default network.
265//
266// In general, we prefer to always set the default network's NetId in connect(), so that if the VPN
267// is a split-tunnel and disappears later, the socket continues working (since the default network's
268// NetId is still valid). Secure VPNs will correctly grab the socket's traffic since they have a
269// high-priority routing rule that doesn't care what NetId the socket has.
270//
271// But bypassable VPNs have a very low priority rule, so we need to mark the socket with the
272// bypassable VPN's NetId if we expect it to get any traffic at all. If the bypassable VPN is a
273// split-tunnel, that's okay, because we have fallthrough rules that will direct the fallthrough
274// traffic to the default network. But it does mean that if the bypassable VPN goes away (and thus
275// the fallthrough rules also go away), the socket that used to fallthrough to the default network
276// will stop working.
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900277unsigned NetworkController::getNetworkForConnectLocked(uid_t uid) const {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700278 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
279 if (virtualNetwork && !virtualNetwork->isSecure()) {
280 return virtualNetwork->getNetId();
281 }
282 return mDefaultNetId;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500283}
284
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900285unsigned NetworkController::getNetworkForConnect(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800286 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900287 return getNetworkForConnectLocked(uid);
288}
289
Erik Klinecea2d342015-06-25 18:24:46 +0900290void NetworkController::getNetworkContext(
291 unsigned netId, uid_t uid, struct android_net_context* netcontext) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800292 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900293
Erik Klinecea2d342015-06-25 18:24:46 +0900294 struct android_net_context nc = {
295 .app_netid = netId,
296 .app_mark = MARK_UNSET,
297 .dns_netid = netId,
298 .dns_mark = MARK_UNSET,
299 .uid = uid,
300 };
301
Erik Kline492ca5b2016-03-09 14:56:00 +0900302 // |netId| comes directly (via dnsproxyd) from the value returned by netIdForResolv() in the
303 // client process. This value is nonzero iff.:
304 //
305 // 1. The app specified a netid/nethandle to a DNS resolution method such as:
306 // - [Java] android.net.Network#getAllByName()
307 // - [C/++] android_getaddrinfofornetwork()
308 // 2. The app specified a netid/nethandle to be used as a process default via:
309 // - [Java] android.net.ConnectivityManager#bindProcessToNetwork()
310 // - [C/++] android_setprocnetwork()
311 // 3. The app called android.net.ConnectivityManager#startUsingNetworkFeature().
312 //
313 // In all these cases (with the possible exception of #3), the right thing to do is to treat
314 // such cases as explicitlySelected.
315 const bool explicitlySelected = (nc.app_netid != NETID_UNSET);
316 if (!explicitlySelected) {
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900317 nc.app_netid = getNetworkForConnectLocked(uid);
Erik Klinecea2d342015-06-25 18:24:46 +0900318 }
Erik Kline492ca5b2016-03-09 14:56:00 +0900319
Erik Klinecea2d342015-06-25 18:24:46 +0900320 Fwmark fwmark;
321 fwmark.netId = nc.app_netid;
Erik Kline492ca5b2016-03-09 14:56:00 +0900322 fwmark.explicitlySelected = explicitlySelected;
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900323 fwmark.protectedFromVpn = explicitlySelected && canProtectLocked(uid);
324 fwmark.permission = getPermissionForUserLocked(uid);
Erik Klinecea2d342015-06-25 18:24:46 +0900325 nc.app_mark = fwmark.intValue;
326
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900327 nc.dns_mark = getNetworkForDnsLocked(&(nc.dns_netid), uid);
Erik Klinecea2d342015-06-25 18:24:46 +0900328
Erik Kline6d4669f2017-05-25 17:03:31 +0900329 if (DBG) {
330 ALOGD("app_netid:0x%x app_mark:0x%x dns_netid:0x%x dns_mark:0x%x uid:%d",
331 nc.app_netid, nc.app_mark, nc.dns_netid, nc.dns_mark, uid);
332 }
333
Erik Klinecea2d342015-06-25 18:24:46 +0900334 if (netcontext) {
335 *netcontext = nc;
336 }
337}
338
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900339unsigned NetworkController::getNetworkForInterfaceLocked(const char* interface) const {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700340 for (const auto& entry : mNetworks) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700341 if (entry.second->hasInterface(interface)) {
342 return entry.first;
343 }
344 }
Paul Jensen35c77e32014-04-10 14:57:54 -0400345 return NETID_UNSET;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500346}
347
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900348unsigned NetworkController::getNetworkForInterface(const char* interface) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800349 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900350 return getNetworkForInterfaceLocked(interface);
351}
352
Sreeram Ramachandran070b2d22014-07-11 17:06:12 -0700353bool NetworkController::isVirtualNetwork(unsigned netId) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800354 ScopedRLock lock(mRWLock);
Rubin Xu6c00b612018-04-27 14:27:59 +0100355 return isVirtualNetworkLocked(netId);
356}
357
358bool NetworkController::isVirtualNetworkLocked(unsigned netId) const {
Sreeram Ramachandran070b2d22014-07-11 17:06:12 -0700359 Network* network = getNetworkLocked(netId);
360 return network && network->getType() == Network::VIRTUAL;
361}
362
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700363int NetworkController::createPhysicalNetworkLocked(unsigned netId, Permission permission) {
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -0700364 if (!((MIN_NET_ID <= netId && netId <= MAX_NET_ID) ||
365 (MIN_OEM_ID <= netId && netId <= MAX_OEM_ID))) {
Paul Jensenae37e8a2014-04-28 10:35:51 -0400366 ALOGE("invalid netId %u", netId);
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900367 return -EINVAL;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700368 }
369
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700370 if (isValidNetworkLocked(netId)) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700371 ALOGE("duplicate netId %u", netId);
372 return -EEXIST;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700373 }
374
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700375 PhysicalNetwork* physicalNetwork = new PhysicalNetwork(netId, mDelegateImpl);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700376 if (int ret = physicalNetwork->setPermission(permission)) {
377 ALOGE("inconceivable! setPermission cannot fail on an empty network");
378 delete physicalNetwork;
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900379 return ret;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700380 }
381
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700382 mNetworks[netId] = physicalNetwork;
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900383
384 updateTcpSocketMonitorPolling();
385
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900386 return 0;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700387}
388
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700389int NetworkController::createPhysicalNetwork(unsigned netId, Permission permission) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800390 ScopedWLock lock(mRWLock);
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700391 return createPhysicalNetworkLocked(netId, permission);
392}
393
394int NetworkController::createPhysicalOemNetwork(Permission permission, unsigned *pNetId) {
Yi Kongbdfd57e2018-07-25 13:26:10 -0700395 if (pNetId == nullptr) {
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700396 return -EINVAL;
397 }
398
Luke Huangd1ee4622018-06-29 13:49:58 +0800399 ScopedWLock lock(mRWLock);
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700400 for (*pNetId = MIN_OEM_ID; *pNetId <= MAX_OEM_ID; (*pNetId)++) {
401 if (!isValidNetworkLocked(*pNetId)) {
402 break;
403 }
404 }
405
406 if (*pNetId > MAX_OEM_ID) {
407 ALOGE("No free network ID");
408 *pNetId = 0;
409 return -ENONET;
410 }
411
412 int ret = createPhysicalNetworkLocked(*pNetId, permission);
413 if (ret) {
414 *pNetId = 0;
415 }
416
417 return ret;
418}
419
cken67cd14c2018-12-05 17:26:59 +0900420int NetworkController::createVirtualNetwork(unsigned netId, bool secure) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800421 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900422
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -0700423 if (!(MIN_NET_ID <= netId && netId <= MAX_NET_ID)) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700424 ALOGE("invalid netId %u", netId);
425 return -EINVAL;
426 }
427
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900428 if (isValidNetworkLocked(netId)) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700429 ALOGE("duplicate netId %u", netId);
430 return -EEXIST;
431 }
432
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700433 if (int ret = modifyFallthroughLocked(netId, true)) {
434 return ret;
435 }
cken67cd14c2018-12-05 17:26:59 +0900436 mNetworks[netId] = new VirtualNetwork(netId, secure);
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700437 return 0;
438}
439
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700440int NetworkController::destroyNetwork(unsigned netId) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800441 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900442
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900443 if (netId == LOCAL_NET_ID) {
444 ALOGE("cannot destroy local network");
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700445 return -EINVAL;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700446 }
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900447 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900448 ALOGE("no such netId %u", netId);
449 return -ENONET;
450 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700451
Sreeram Ramachandran379bd332014-04-10 19:58:06 -0700452 // TODO: ioctl(SIOCKILLADDR, ...) to kill all sockets on the old network.
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700453
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700454 Network* network = getNetworkLocked(netId);
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900455
456 // If we fail to destroy a network, things will get stuck badly. Therefore, unlike most of the
457 // other network code, ignore failures and attempt to clear out as much state as possible, even
458 // if we hit an error on the way. Return the first error that we see.
459 int ret = network->clearInterfaces();
460
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700461 if (mDefaultNetId == netId) {
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900462 if (int err = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700463 ALOGE("inconceivable! removeAsDefault cannot fail on an empty network");
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900464 if (!ret) {
465 ret = err;
466 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700467 }
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700468 mDefaultNetId = NETID_UNSET;
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700469 } else if (network->getType() == Network::VIRTUAL) {
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900470 if (int err = modifyFallthroughLocked(netId, false)) {
471 if (!ret) {
472 ret = err;
473 }
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700474 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700475 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700476 mNetworks.erase(netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700477 delete network;
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900478
Rubin Xu6c00b612018-04-27 14:27:59 +0100479 for (auto iter = mIfindexToLastNetId.begin(); iter != mIfindexToLastNetId.end();) {
480 if (iter->second == netId) {
481 iter = mIfindexToLastNetId.erase(iter);
482 } else {
483 ++iter;
484 }
485 }
486
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900487 updateTcpSocketMonitorPolling();
488
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900489 return ret;
Sreeram Ramachandran379bd332014-04-10 19:58:06 -0700490}
491
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700492int NetworkController::addInterfaceToNetwork(unsigned netId, const char* interface) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800493 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900494
495 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900496 ALOGE("no such netId %u", netId);
497 return -ENONET;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700498 }
499
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900500 unsigned existingNetId = getNetworkForInterfaceLocked(interface);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700501 if (existingNetId != NETID_UNSET && existingNetId != netId) {
502 ALOGE("interface %s already assigned to netId %u", interface, existingNetId);
503 return -EBUSY;
504 }
Rubin Xu6c00b612018-04-27 14:27:59 +0100505 if (int ret = getNetworkLocked(netId)->addInterface(interface)) {
506 return ret;
507 }
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700508
Treehugger Robot484d02e2020-04-29 14:55:21 +0000509 // Only populate mIfindexToLastNetId for non-local networks, because for these getIfIndex will
510 // return 0. That's fine though, because that map is only used to prevent force-closing sockets
511 // when the same IP address is handed over from one interface to another interface that is in
512 // the same network but not in the same netId (for now this is done only on VPNs). That is not
513 // useful for the local network because IP addresses in the local network are always assigned by
514 // the device itself and never meaningful on any other network.
515 if (netId != LOCAL_NET_ID) {
516 int ifIndex = RouteController::getIfIndex(interface);
517 if (ifIndex) {
518 mIfindexToLastNetId[ifIndex] = netId;
519 } else {
520 // Cannot happen, since addInterface() above will have failed.
521 ALOGE("inconceivable! added interface %s with no index", interface);
522 }
Rubin Xu6c00b612018-04-27 14:27:59 +0100523 }
524 return 0;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700525}
526
527int NetworkController::removeInterfaceFromNetwork(unsigned netId, const char* interface) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800528 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900529
530 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900531 ALOGE("no such netId %u", netId);
532 return -ENONET;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700533 }
534
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700535 return getNetworkLocked(netId)->removeInterface(interface);
536}
537
538Permission NetworkController::getPermissionForUser(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800539 ScopedRLock lock(mRWLock);
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700540 return getPermissionForUserLocked(uid);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700541}
542
543void NetworkController::setPermissionForUsers(Permission permission,
544 const std::vector<uid_t>& uids) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800545 ScopedWLock lock(mRWLock);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700546 for (uid_t uid : uids) {
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700547 mUsers[uid] = permission;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700548 }
549}
550
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900551int NetworkController::checkUserNetworkAccess(uid_t uid, unsigned netId) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800552 ScopedRLock lock(mRWLock);
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900553 return checkUserNetworkAccessLocked(uid, netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700554}
555
556int NetworkController::setPermissionForNetworks(Permission permission,
557 const std::vector<unsigned>& netIds) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800558 ScopedWLock lock(mRWLock);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700559 for (unsigned netId : netIds) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700560 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900561 if (!network) {
562 ALOGE("no such netId %u", netId);
563 return -ENONET;
564 }
565 if (network->getType() != Network::PHYSICAL) {
566 ALOGE("cannot set permissions on non-physical network with netId %u", netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700567 return -EINVAL;
568 }
569
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700570 if (int ret = static_cast<PhysicalNetwork*>(network)->setPermission(permission)) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700571 return ret;
572 }
573 }
574 return 0;
575}
576
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700577int NetworkController::addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800578 ScopedWLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700579 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900580 if (!network) {
581 ALOGE("no such netId %u", netId);
582 return -ENONET;
583 }
584 if (network->getType() != Network::VIRTUAL) {
585 ALOGE("cannot add users to non-virtual network with netId %u", netId);
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700586 return -EINVAL;
587 }
Lorenzo Colittifff4bd32016-04-14 00:56:01 +0900588 if (int ret = static_cast<VirtualNetwork*>(network)->addUsers(uidRanges, mProtectableUsers)) {
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700589 return ret;
590 }
591 return 0;
592}
593
594int NetworkController::removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800595 ScopedWLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700596 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900597 if (!network) {
598 ALOGE("no such netId %u", netId);
599 return -ENONET;
600 }
601 if (network->getType() != Network::VIRTUAL) {
602 ALOGE("cannot remove users from non-virtual network with netId %u", netId);
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700603 return -EINVAL;
604 }
Lorenzo Colittifff4bd32016-04-14 00:56:01 +0900605 if (int ret = static_cast<VirtualNetwork*>(network)->removeUsers(uidRanges,
606 mProtectableUsers)) {
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700607 return ret;
608 }
609 return 0;
610}
611
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700612int NetworkController::addRoute(unsigned netId, const char* interface, const char* destination,
Tyler Wearfa94a272019-12-05 15:01:48 -0800613 const char* nexthop, bool legacy, uid_t uid, int mtu) {
614 return modifyRoute(netId, interface, destination, nexthop, ROUTE_ADD, legacy, uid, mtu);
615}
616
617int NetworkController::updateRoute(unsigned netId, const char* interface, const char* destination,
618 const char* nexthop, bool legacy, uid_t uid, int mtu) {
619 return modifyRoute(netId, interface, destination, nexthop, ROUTE_UPDATE, legacy, uid, mtu);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700620}
621
622int NetworkController::removeRoute(unsigned netId, const char* interface, const char* destination,
623 const char* nexthop, bool legacy, uid_t uid) {
Tyler Wearfa94a272019-12-05 15:01:48 -0800624 return modifyRoute(netId, interface, destination, nexthop, ROUTE_REMOVE, legacy, uid, 0);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700625}
626
Rubin Xu6c00b612018-04-27 14:27:59 +0100627void NetworkController::addInterfaceAddress(unsigned ifIndex, const char* address) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800628 ScopedWLock lock(mRWLock);
Rubin Xu6c00b612018-04-27 14:27:59 +0100629 if (ifIndex == 0) {
630 ALOGE("Attempting to add address %s without ifindex", address);
631 return;
632 }
633 mAddressToIfindices[address].insert(ifIndex);
634}
635
636// Returns whether we should call SOCK_DESTROY on the removed address.
637bool NetworkController::removeInterfaceAddress(unsigned ifindex, const char* address) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800638 ScopedWLock lock(mRWLock);
Rubin Xu6c00b612018-04-27 14:27:59 +0100639 // First, update mAddressToIfindices map
640 auto ifindicesIter = mAddressToIfindices.find(address);
641 if (ifindicesIter == mAddressToIfindices.end()) {
642 ALOGE("Removing unknown address %s from ifindex %u", address, ifindex);
643 return true;
644 }
645 std::unordered_set<unsigned>& ifindices = ifindicesIter->second;
646 if (ifindices.erase(ifindex) > 0) {
647 if (ifindices.size() == 0) {
Bernie Innocentidd5a4f02018-07-19 18:06:52 +0900648 mAddressToIfindices.erase(ifindicesIter); // Invalidates ifindices
649 // The address is no longer configured on any interface.
650 return true;
Rubin Xu6c00b612018-04-27 14:27:59 +0100651 }
652 } else {
653 ALOGE("No record of address %s on interface %u", address, ifindex);
654 return true;
655 }
656 // Then, check for VPN handover condition
657 if (mIfindexToLastNetId.find(ifindex) == mIfindexToLastNetId.end()) {
Treehugger Robot484d02e2020-04-29 14:55:21 +0000658 ALOGW("Interface index %u was never in a currently-connected non-local netId", ifindex);
Rubin Xu6c00b612018-04-27 14:27:59 +0100659 return true;
660 }
661 unsigned lastNetId = mIfindexToLastNetId[ifindex];
662 for (unsigned idx : ifindices) {
663 unsigned activeNetId = mIfindexToLastNetId[idx];
664 // If this IP address is still assigned to another interface in the same network,
665 // then we don't need to destroy sockets on it because they are likely still valid.
666 // For now we do this only on VPNs.
667 // TODO: evaluate extending this to all network types.
668 if (lastNetId == activeNetId && isVirtualNetworkLocked(activeNetId)) {
669 return false;
670 }
671 }
672 return true;
673}
674
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900675bool NetworkController::canProtectLocked(uid_t uid) const {
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700676 return ((getPermissionForUserLocked(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) ||
677 mProtectableUsers.find(uid) != mProtectableUsers.end();
678}
679
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900680bool NetworkController::canProtect(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800681 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900682 return canProtectLocked(uid);
683}
684
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700685void NetworkController::allowProtect(const std::vector<uid_t>& uids) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800686 ScopedWLock lock(mRWLock);
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700687 mProtectableUsers.insert(uids.begin(), uids.end());
688}
689
690void NetworkController::denyProtect(const std::vector<uid_t>& uids) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800691 ScopedWLock lock(mRWLock);
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700692 for (uid_t uid : uids) {
693 mProtectableUsers.erase(uid);
694 }
695}
696
Erik Kline2d3a1632016-03-15 16:33:48 +0900697void NetworkController::dump(DumpWriter& dw) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800698 ScopedRLock lock(mRWLock);
Erik Kline2d3a1632016-03-15 16:33:48 +0900699
700 dw.incIndent();
701 dw.println("NetworkController");
702
703 dw.incIndent();
704 dw.println("Default network: %u", mDefaultNetId);
705
706 dw.blankline();
707 dw.println("Networks:");
708 dw.incIndent();
709 for (const auto& i : mNetworks) {
Lorenzo Colittid1029652016-09-26 17:17:40 +0900710 Network* network = i.second;
Erik Klineb31fd692018-06-06 20:50:11 +0900711 dw.println(network->toString());
Lorenzo Colittid1029652016-09-26 17:17:40 +0900712 if (network->getType() == Network::PHYSICAL) {
713 dw.incIndent();
714 Permission permission = reinterpret_cast<PhysicalNetwork*>(network)->getPermission();
715 dw.println("Required permission: %s", permissionToName(permission));
716 dw.decIndent();
717 }
Pierre Imai3a272072016-04-19 16:17:07 +0900718 dw.blankline();
Erik Kline2d3a1632016-03-15 16:33:48 +0900719 }
720 dw.decIndent();
721
Rubin Xu6c00b612018-04-27 14:27:59 +0100722 dw.blankline();
723 dw.println("Interface <-> last network map:");
724 dw.incIndent();
725 for (const auto& i : mIfindexToLastNetId) {
726 dw.println("Ifindex: %u NetId: %u", i.first, i.second);
727 }
728 dw.decIndent();
729
730 dw.blankline();
731 dw.println("Interface addresses:");
732 dw.incIndent();
733 for (const auto& i : mAddressToIfindices) {
734 dw.println("address: %s ifindices: [%s]", i.first.c_str(),
735 android::base::Join(i.second, ", ").c_str());
736 }
737 dw.decIndent();
738
Erik Kline2d3a1632016-03-15 16:33:48 +0900739 dw.decIndent();
740
741 dw.decIndent();
742}
743
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700744bool NetworkController::isValidNetworkLocked(unsigned netId) const {
745 return getNetworkLocked(netId);
746}
747
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700748Network* NetworkController::getNetworkLocked(unsigned netId) const {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700749 auto iter = mNetworks.find(netId);
Yi Kongbdfd57e2018-07-25 13:26:10 -0700750 return iter == mNetworks.end() ? nullptr : iter->second;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700751}
752
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700753VirtualNetwork* NetworkController::getVirtualNetworkForUserLocked(uid_t uid) const {
754 for (const auto& entry : mNetworks) {
755 if (entry.second->getType() == Network::VIRTUAL) {
756 VirtualNetwork* virtualNetwork = static_cast<VirtualNetwork*>(entry.second);
757 if (virtualNetwork->appliesToUser(uid)) {
758 return virtualNetwork;
759 }
760 }
761 }
Yi Kongbdfd57e2018-07-25 13:26:10 -0700762 return nullptr;
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700763}
764
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700765Permission NetworkController::getPermissionForUserLocked(uid_t uid) const {
766 auto iter = mUsers.find(uid);
767 if (iter != mUsers.end()) {
768 return iter->second;
769 }
770 return uid < FIRST_APPLICATION_UID ? PERMISSION_SYSTEM : PERMISSION_NONE;
771}
772
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900773int NetworkController::checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700774 Network* network = getNetworkLocked(netId);
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900775 if (!network) {
776 return -ENONET;
777 }
778
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700779 // If uid is INVALID_UID, this likely means that we were unable to retrieve the UID of the peer
780 // (using SO_PEERCRED). Be safe and deny access to the network, even if it's valid.
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900781 if (uid == INVALID_UID) {
782 return -EREMOTEIO;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700783 }
784 Permission userPermission = getPermissionForUserLocked(uid);
785 if ((userPermission & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900786 return 0;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700787 }
788 if (network->getType() == Network::VIRTUAL) {
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900789 return static_cast<VirtualNetwork*>(network)->appliesToUser(uid) ? 0 : -EPERM;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700790 }
791 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
792 if (virtualNetwork && virtualNetwork->isSecure() &&
793 mProtectableUsers.find(uid) == mProtectableUsers.end()) {
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900794 return -EPERM;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700795 }
796 Permission networkPermission = static_cast<PhysicalNetwork*>(network)->getPermission();
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900797 return ((userPermission & networkPermission) == networkPermission) ? 0 : -EACCES;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700798}
799
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700800int NetworkController::modifyRoute(unsigned netId, const char* interface, const char* destination,
Tyler Wearfa94a272019-12-05 15:01:48 -0800801 const char* nexthop, enum RouteOperation op, bool legacy,
802 uid_t uid, int mtu) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800803 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900804
805 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900806 ALOGE("no such netId %u", netId);
807 return -ENONET;
808 }
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900809 unsigned existingNetId = getNetworkForInterfaceLocked(interface);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900810 if (existingNetId == NETID_UNSET) {
811 ALOGE("interface %s not assigned to any netId", interface);
812 return -ENODEV;
813 }
814 if (existingNetId != netId) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700815 ALOGE("interface %s assigned to netId %u, not %u", interface, existingNetId, netId);
Lorenzo Colittif7fc8ec2014-06-18 00:41:58 +0900816 return -ENOENT;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700817 }
818
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700819 RouteController::TableType tableType;
Sreeram Ramachandran87475a12014-07-15 16:20:28 -0700820 if (netId == LOCAL_NET_ID) {
821 tableType = RouteController::LOCAL_NETWORK;
822 } else if (legacy) {
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900823 if ((getPermissionForUserLocked(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
Sreeram Ramachandran5009d5e2014-07-03 12:20:48 -0700824 tableType = RouteController::LEGACY_SYSTEM;
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700825 } else {
Sreeram Ramachandran5009d5e2014-07-03 12:20:48 -0700826 tableType = RouteController::LEGACY_NETWORK;
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700827 }
828 } else {
829 tableType = RouteController::INTERFACE;
830 }
831
Tyler Wearfa94a272019-12-05 15:01:48 -0800832 switch (op) {
833 case ROUTE_ADD:
834 return RouteController::addRoute(interface, destination, nexthop, tableType, mtu);
835 case ROUTE_UPDATE:
836 return RouteController::updateRoute(interface, destination, nexthop, tableType, mtu);
837 case ROUTE_REMOVE:
838 return RouteController::removeRoute(interface, destination, nexthop, tableType);
839 }
840 return -EINVAL;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700841}
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700842
843int NetworkController::modifyFallthroughLocked(unsigned vpnNetId, bool add) {
844 if (mDefaultNetId == NETID_UNSET) {
845 return 0;
846 }
847 Network* network = getNetworkLocked(mDefaultNetId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900848 if (!network) {
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700849 ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
850 return -ESRCH;
851 }
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900852 if (network->getType() != Network::PHYSICAL) {
853 ALOGE("inconceivable! default network must be a physical network");
854 return -EINVAL;
855 }
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700856 Permission permission = static_cast<PhysicalNetwork*>(network)->getPermission();
857 for (const auto& physicalInterface : network->getInterfaces()) {
858 if (int ret = mDelegateImpl->modifyFallthrough(vpnNetId, physicalInterface, permission,
859 add)) {
860 return ret;
861 }
862 }
863 return 0;
864}
Lorenzo Colitti7035f222017-02-13 18:29:00 +0900865
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900866void NetworkController::updateTcpSocketMonitorPolling() {
867 bool physicalNetworkExists = false;
868 for (const auto& entry : mNetworks) {
869 const auto& network = entry.second;
870 if (network->getType() == Network::PHYSICAL && network->getNetId() >= MIN_NET_ID) {
871 physicalNetworkExists = true;
872 break;
873 }
874 }
875
876 if (physicalNetworkExists) {
877 android::net::gCtls->tcpSocketMonitor.resumePolling();
878 } else {
879 android::net::gCtls->tcpSocketMonitor.suspendPolling();
880 }
881}
882
Bernie Innocenti762dcf42019-06-14 19:52:49 +0900883} // namespace android::net