blob: ea0f4e2be7bff806211103874faa0331e87dbecd [file] [log] [blame]
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -05001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Sreeram Ramachandran72604072014-05-21 13:19:43 -070017// THREAD-SAFETY
18// -------------
19// The methods in this file are called from multiple threads (from CommandListener, FwmarkServer
20// and DnsProxyListener). So, all accesses to shared state are guarded by a lock.
21//
22// In some cases, a single non-const method acquires and releases the lock several times, like so:
23// if (isValidNetwork(...)) { // isValidNetwork() acquires and releases the lock.
24// setDefaultNetwork(...); // setDefaultNetwork() also acquires and releases the lock.
25//
26// It might seem that this allows races where the state changes between the two statements, but in
27// fact there are no races because:
28// 1. This pattern only occurs in non-const methods (i.e., those that mutate state).
29// 2. Only CommandListener calls these non-const methods. The others call only const methods.
30// 3. CommandListener only processes one command at a time. I.e., it's serialized.
31// Thus, no other mutation can occur in between the two statements above.
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050032
33#include "NetworkController.h"
34
Sreeram Ramachandran1011b492014-07-24 19:04:32 -070035#include "Fwmark.h"
Sreeram Ramachandran6a773532014-07-11 09:10:20 -070036#include "LocalNetwork.h"
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070037#include "PhysicalNetwork.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070038#include "RouteController.h"
Sreeram Ramachandran4043f012014-06-23 12:41:37 -070039#include "VirtualNetwork.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070040
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -070041#include "cutils/misc.h"
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070042#define LOG_TAG "Netd"
43#include "log/log.h"
Sreeram Ramachandran72604072014-05-21 13:19:43 -070044#include "resolv_netid.h"
45
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070046namespace {
47
48// Keep these in sync with ConnectivityService.java.
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070049const unsigned MIN_NET_ID = 10;
50const unsigned MAX_NET_ID = 65535;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070051
52} // namespace
53
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070054// All calls to methods here are made while holding a write lock on mRWLock.
55class NetworkController::DelegateImpl : public PhysicalNetwork::Delegate {
56public:
57 explicit DelegateImpl(NetworkController* networkController);
58 virtual ~DelegateImpl();
59
60 int modifyFallthrough(unsigned vpnNetId, const std::string& physicalInterface,
61 Permission permission, bool add) WARN_UNUSED_RESULT;
62
63private:
64 int addFallthrough(const std::string& physicalInterface,
65 Permission permission) override WARN_UNUSED_RESULT;
66 int removeFallthrough(const std::string& physicalInterface,
67 Permission permission) override WARN_UNUSED_RESULT;
68
69 int modifyFallthrough(const std::string& physicalInterface, Permission permission,
70 bool add) WARN_UNUSED_RESULT;
71
72 NetworkController* const mNetworkController;
73};
74
75NetworkController::DelegateImpl::DelegateImpl(NetworkController* networkController) :
76 mNetworkController(networkController) {
77}
78
79NetworkController::DelegateImpl::~DelegateImpl() {
80}
81
82int NetworkController::DelegateImpl::modifyFallthrough(unsigned vpnNetId,
83 const std::string& physicalInterface,
84 Permission permission, bool add) {
85 if (add) {
86 if (int ret = RouteController::addVirtualNetworkFallthrough(vpnNetId,
87 physicalInterface.c_str(),
88 permission)) {
89 ALOGE("failed to add fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
90 vpnNetId);
91 return ret;
92 }
93 } else {
94 if (int ret = RouteController::removeVirtualNetworkFallthrough(vpnNetId,
95 physicalInterface.c_str(),
96 permission)) {
97 ALOGE("failed to remove fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
98 vpnNetId);
99 return ret;
100 }
101 }
102 return 0;
103}
104
105int NetworkController::DelegateImpl::addFallthrough(const std::string& physicalInterface,
106 Permission permission) {
107 return modifyFallthrough(physicalInterface, permission, true);
108}
109
110int NetworkController::DelegateImpl::removeFallthrough(const std::string& physicalInterface,
111 Permission permission) {
112 return modifyFallthrough(physicalInterface, permission, false);
113}
114
115int NetworkController::DelegateImpl::modifyFallthrough(const std::string& physicalInterface,
116 Permission permission, bool add) {
117 for (const auto& entry : mNetworkController->mNetworks) {
118 if (entry.second->getType() == Network::VIRTUAL) {
119 if (int ret = modifyFallthrough(entry.first, physicalInterface, permission, add)) {
120 return ret;
121 }
122 }
123 }
124 return 0;
125}
126
127NetworkController::NetworkController() :
128 mDelegateImpl(new NetworkController::DelegateImpl(this)), mDefaultNetId(NETID_UNSET) {
Sreeram Ramachandran87475a12014-07-15 16:20:28 -0700129 mNetworks[LOCAL_NET_ID] = new LocalNetwork(LOCAL_NET_ID);
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500130}
131
132unsigned NetworkController::getDefaultNetwork() const {
Sreeram Ramachandran9c0d3132014-04-10 20:35:04 -0700133 android::RWLock::AutoRLock lock(mRWLock);
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500134 return mDefaultNetId;
135}
136
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700137int NetworkController::setDefaultNetwork(unsigned netId) {
138 android::RWLock::AutoWLock lock(mRWLock);
139
140 if (netId == mDefaultNetId) {
141 return 0;
Sreeram Ramachandran72604072014-05-21 13:19:43 -0700142 }
143
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700144 if (netId != NETID_UNSET) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700145 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900146 if (!network) {
147 ALOGE("no such netId %u", netId);
148 return -ENONET;
149 }
150 if (network->getType() != Network::PHYSICAL) {
151 ALOGE("cannot set default to non-physical network with netId %u", netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700152 return -EINVAL;
153 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700154 if (int ret = static_cast<PhysicalNetwork*>(network)->addAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700155 return ret;
Sreeram Ramachandran9c0d3132014-04-10 20:35:04 -0700156 }
157 }
158
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700159 if (mDefaultNetId != NETID_UNSET) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700160 Network* network = getNetworkLocked(mDefaultNetId);
161 if (!network || network->getType() != Network::PHYSICAL) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700162 ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
163 return -ESRCH;
164 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700165 if (int ret = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700166 return ret;
Sreeram Ramachandran9c0d3132014-04-10 20:35:04 -0700167 }
168 }
169
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700170 mDefaultNetId = netId;
171 return 0;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500172}
173
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700174uint32_t NetworkController::getNetworkForDns(unsigned* netId, uid_t uid) const {
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500175 android::RWLock::AutoRLock lock(mRWLock);
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700176 Fwmark fwmark;
177 fwmark.protectedFromVpn = true;
178 fwmark.permission = PERMISSION_SYSTEM;
179 if (canUserSelectNetworkLocked(uid, *netId)) {
180 // If a non-zero NetId was explicitly specified, and the user has permission for that
181 // network, use that network's DNS servers. Do not fall through to the default network even
182 // if the explicitly selected network is a split tunnel VPN or a VPN without DNS servers.
183 fwmark.explicitlySelected = true;
184 } else {
185 // If the user is subject to a VPN and the VPN provides DNS servers, use those servers
186 // (possibly falling through to the default network if the VPN doesn't provide a route to
187 // them). Otherwise, use the default network's DNS servers.
188 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
189 if (virtualNetwork && virtualNetwork->getHasDns()) {
190 *netId = virtualNetwork->getNetId();
191 } else {
192 *netId = mDefaultNetId;
193 }
194 }
195 fwmark.netId = *netId;
196 return fwmark.intValue;
197}
198
199// Returns the NetId that a given UID would use if no network is explicitly selected. Specifically,
200// the VPN that applies to the UID if any; otherwise, the default network.
201unsigned NetworkController::getNetworkForUser(uid_t uid) const {
202 android::RWLock::AutoRLock lock(mRWLock);
203 if (VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid)) {
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700204 return virtualNetwork->getNetId();
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500205 }
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700206 return mDefaultNetId;
207}
208
209// Returns the NetId that will be set when a socket connect()s. This is the bypassable VPN that
210// applies to the user if any; otherwise, the default network.
211//
212// In general, we prefer to always set the default network's NetId in connect(), so that if the VPN
213// is a split-tunnel and disappears later, the socket continues working (since the default network's
214// NetId is still valid). Secure VPNs will correctly grab the socket's traffic since they have a
215// high-priority routing rule that doesn't care what NetId the socket has.
216//
217// But bypassable VPNs have a very low priority rule, so we need to mark the socket with the
218// bypassable VPN's NetId if we expect it to get any traffic at all. If the bypassable VPN is a
219// split-tunnel, that's okay, because we have fallthrough rules that will direct the fallthrough
220// traffic to the default network. But it does mean that if the bypassable VPN goes away (and thus
221// the fallthrough rules also go away), the socket that used to fallthrough to the default network
222// will stop working.
223unsigned NetworkController::getNetworkForConnect(uid_t uid) const {
224 android::RWLock::AutoRLock lock(mRWLock);
225 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
226 if (virtualNetwork && !virtualNetwork->isSecure()) {
227 return virtualNetwork->getNetId();
228 }
229 return mDefaultNetId;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500230}
231
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700232unsigned NetworkController::getNetworkForInterface(const char* interface) const {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700233 android::RWLock::AutoRLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700234 for (const auto& entry : mNetworks) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700235 if (entry.second->hasInterface(interface)) {
236 return entry.first;
237 }
238 }
Paul Jensen35c77e32014-04-10 14:57:54 -0400239 return NETID_UNSET;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500240}
241
Sreeram Ramachandran070b2d22014-07-11 17:06:12 -0700242bool NetworkController::isVirtualNetwork(unsigned netId) const {
243 android::RWLock::AutoRLock lock(mRWLock);
244 Network* network = getNetworkLocked(netId);
245 return network && network->getType() == Network::VIRTUAL;
246}
247
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700248int NetworkController::createPhysicalNetwork(unsigned netId, Permission permission) {
Sreeram Ramachandran72604072014-05-21 13:19:43 -0700249 if (netId < MIN_NET_ID || netId > MAX_NET_ID) {
Paul Jensenae37e8a2014-04-28 10:35:51 -0400250 ALOGE("invalid netId %u", netId);
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900251 return -EINVAL;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700252 }
253
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700254 if (isValidNetwork(netId)) {
255 ALOGE("duplicate netId %u", netId);
256 return -EEXIST;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700257 }
258
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700259 PhysicalNetwork* physicalNetwork = new PhysicalNetwork(netId, mDelegateImpl);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700260 if (int ret = physicalNetwork->setPermission(permission)) {
261 ALOGE("inconceivable! setPermission cannot fail on an empty network");
262 delete physicalNetwork;
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900263 return ret;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700264 }
265
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700266 android::RWLock::AutoWLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700267 mNetworks[netId] = physicalNetwork;
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900268 return 0;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700269}
270
Sreeram Ramachandran95684ba2014-07-23 13:27:31 -0700271int NetworkController::createVirtualNetwork(unsigned netId, bool hasDns, bool secure) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700272 if (netId < MIN_NET_ID || netId > MAX_NET_ID) {
273 ALOGE("invalid netId %u", netId);
274 return -EINVAL;
275 }
276
277 if (isValidNetwork(netId)) {
278 ALOGE("duplicate netId %u", netId);
279 return -EEXIST;
280 }
281
282 android::RWLock::AutoWLock lock(mRWLock);
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700283 if (int ret = modifyFallthroughLocked(netId, true)) {
284 return ret;
285 }
Sreeram Ramachandran95684ba2014-07-23 13:27:31 -0700286 mNetworks[netId] = new VirtualNetwork(netId, hasDns, secure);
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700287 return 0;
288}
289
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700290int NetworkController::destroyNetwork(unsigned netId) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900291 if (netId == LOCAL_NET_ID) {
292 ALOGE("cannot destroy local network");
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700293 return -EINVAL;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700294 }
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900295 if (!isValidNetwork(netId)) {
296 ALOGE("no such netId %u", netId);
297 return -ENONET;
298 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700299
Sreeram Ramachandran379bd332014-04-10 19:58:06 -0700300 // TODO: ioctl(SIOCKILLADDR, ...) to kill all sockets on the old network.
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700301
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700302 android::RWLock::AutoWLock lock(mRWLock);
303 Network* network = getNetworkLocked(netId);
304 if (int ret = network->clearInterfaces()) {
305 return ret;
306 }
307 if (mDefaultNetId == netId) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700308 if (int ret = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700309 ALOGE("inconceivable! removeAsDefault cannot fail on an empty network");
310 return ret;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700311 }
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700312 mDefaultNetId = NETID_UNSET;
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700313 } else if (network->getType() == Network::VIRTUAL) {
314 if (int ret = modifyFallthroughLocked(netId, false)) {
315 return ret;
316 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700317 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700318 mNetworks.erase(netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700319 delete network;
Sreeram Ramachandran3ced0692014-04-18 09:49:13 -0700320 _resolv_delete_cache_for_net(netId);
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900321 return 0;
Sreeram Ramachandran379bd332014-04-10 19:58:06 -0700322}
323
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700324int NetworkController::addInterfaceToNetwork(unsigned netId, const char* interface) {
Sreeram Ramachandran72604072014-05-21 13:19:43 -0700325 if (!isValidNetwork(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900326 ALOGE("no such netId %u", netId);
327 return -ENONET;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700328 }
329
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700330 unsigned existingNetId = getNetworkForInterface(interface);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700331 if (existingNetId != NETID_UNSET && existingNetId != netId) {
332 ALOGE("interface %s already assigned to netId %u", interface, existingNetId);
333 return -EBUSY;
334 }
335
336 android::RWLock::AutoWLock lock(mRWLock);
337 return getNetworkLocked(netId)->addInterface(interface);
338}
339
340int NetworkController::removeInterfaceFromNetwork(unsigned netId, const char* interface) {
341 if (!isValidNetwork(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900342 ALOGE("no such netId %u", netId);
343 return -ENONET;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700344 }
345
346 android::RWLock::AutoWLock lock(mRWLock);
347 return getNetworkLocked(netId)->removeInterface(interface);
348}
349
350Permission NetworkController::getPermissionForUser(uid_t uid) const {
351 android::RWLock::AutoRLock lock(mRWLock);
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700352 return getPermissionForUserLocked(uid);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700353}
354
355void NetworkController::setPermissionForUsers(Permission permission,
356 const std::vector<uid_t>& uids) {
357 android::RWLock::AutoWLock lock(mRWLock);
358 for (uid_t uid : uids) {
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700359 mUsers[uid] = permission;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700360 }
361}
362
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700363bool NetworkController::canUserSelectNetwork(uid_t uid, unsigned netId) const {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700364 android::RWLock::AutoRLock lock(mRWLock);
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700365 return canUserSelectNetworkLocked(uid, netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700366}
367
368int NetworkController::setPermissionForNetworks(Permission permission,
369 const std::vector<unsigned>& netIds) {
370 android::RWLock::AutoWLock lock(mRWLock);
371 for (unsigned netId : netIds) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700372 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900373 if (!network) {
374 ALOGE("no such netId %u", netId);
375 return -ENONET;
376 }
377 if (network->getType() != Network::PHYSICAL) {
378 ALOGE("cannot set permissions on non-physical network with netId %u", netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700379 return -EINVAL;
380 }
381
382 // TODO: ioctl(SIOCKILLADDR, ...) to kill socets on the network that don't have permission.
383
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700384 if (int ret = static_cast<PhysicalNetwork*>(network)->setPermission(permission)) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700385 return ret;
386 }
387 }
388 return 0;
389}
390
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700391int NetworkController::addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) {
392 android::RWLock::AutoWLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700393 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900394 if (!network) {
395 ALOGE("no such netId %u", netId);
396 return -ENONET;
397 }
398 if (network->getType() != Network::VIRTUAL) {
399 ALOGE("cannot add users to non-virtual network with netId %u", netId);
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700400 return -EINVAL;
401 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700402 if (int ret = static_cast<VirtualNetwork*>(network)->addUsers(uidRanges)) {
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700403 return ret;
404 }
405 return 0;
406}
407
408int NetworkController::removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) {
409 android::RWLock::AutoWLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700410 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900411 if (!network) {
412 ALOGE("no such netId %u", netId);
413 return -ENONET;
414 }
415 if (network->getType() != Network::VIRTUAL) {
416 ALOGE("cannot remove users from non-virtual network with netId %u", netId);
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700417 return -EINVAL;
418 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700419 if (int ret = static_cast<VirtualNetwork*>(network)->removeUsers(uidRanges)) {
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700420 return ret;
421 }
422 return 0;
423}
424
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700425int NetworkController::addRoute(unsigned netId, const char* interface, const char* destination,
426 const char* nexthop, bool legacy, uid_t uid) {
427 return modifyRoute(netId, interface, destination, nexthop, true, legacy, uid);
428}
429
430int NetworkController::removeRoute(unsigned netId, const char* interface, const char* destination,
431 const char* nexthop, bool legacy, uid_t uid) {
432 return modifyRoute(netId, interface, destination, nexthop, false, legacy, uid);
433}
434
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700435bool NetworkController::canProtect(uid_t uid) const {
436 android::RWLock::AutoRLock lock(mRWLock);
437 return ((getPermissionForUserLocked(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) ||
438 mProtectableUsers.find(uid) != mProtectableUsers.end();
439}
440
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700441void NetworkController::allowProtect(const std::vector<uid_t>& uids) {
442 android::RWLock::AutoWLock lock(mRWLock);
443 mProtectableUsers.insert(uids.begin(), uids.end());
444}
445
446void NetworkController::denyProtect(const std::vector<uid_t>& uids) {
447 android::RWLock::AutoWLock lock(mRWLock);
448 for (uid_t uid : uids) {
449 mProtectableUsers.erase(uid);
450 }
451}
452
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700453bool NetworkController::isValidNetwork(unsigned netId) const {
454 android::RWLock::AutoRLock lock(mRWLock);
455 return getNetworkLocked(netId);
456}
457
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700458Network* NetworkController::getNetworkLocked(unsigned netId) const {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700459 auto iter = mNetworks.find(netId);
460 return iter == mNetworks.end() ? NULL : iter->second;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700461}
462
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700463VirtualNetwork* NetworkController::getVirtualNetworkForUserLocked(uid_t uid) const {
464 for (const auto& entry : mNetworks) {
465 if (entry.second->getType() == Network::VIRTUAL) {
466 VirtualNetwork* virtualNetwork = static_cast<VirtualNetwork*>(entry.second);
467 if (virtualNetwork->appliesToUser(uid)) {
468 return virtualNetwork;
469 }
470 }
471 }
472 return NULL;
473}
474
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700475Permission NetworkController::getPermissionForUserLocked(uid_t uid) const {
476 auto iter = mUsers.find(uid);
477 if (iter != mUsers.end()) {
478 return iter->second;
479 }
480 return uid < FIRST_APPLICATION_UID ? PERMISSION_SYSTEM : PERMISSION_NONE;
481}
482
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700483bool NetworkController::canUserSelectNetworkLocked(uid_t uid, unsigned netId) const {
484 Network* network = getNetworkLocked(netId);
485 // If uid is INVALID_UID, this likely means that we were unable to retrieve the UID of the peer
486 // (using SO_PEERCRED). Be safe and deny access to the network, even if it's valid.
487 if (!network || uid == INVALID_UID) {
488 return false;
489 }
490 Permission userPermission = getPermissionForUserLocked(uid);
491 if ((userPermission & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
492 return true;
493 }
494 if (network->getType() == Network::VIRTUAL) {
495 return static_cast<VirtualNetwork*>(network)->appliesToUser(uid);
496 }
497 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
498 if (virtualNetwork && virtualNetwork->isSecure() &&
499 mProtectableUsers.find(uid) == mProtectableUsers.end()) {
500 return false;
501 }
502 Permission networkPermission = static_cast<PhysicalNetwork*>(network)->getPermission();
503 return (userPermission & networkPermission) == networkPermission;
504}
505
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700506int NetworkController::modifyRoute(unsigned netId, const char* interface, const char* destination,
507 const char* nexthop, bool add, bool legacy, uid_t uid) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900508 if (!isValidNetwork(netId)) {
509 ALOGE("no such netId %u", netId);
510 return -ENONET;
511 }
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700512 unsigned existingNetId = getNetworkForInterface(interface);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900513 if (existingNetId == NETID_UNSET) {
514 ALOGE("interface %s not assigned to any netId", interface);
515 return -ENODEV;
516 }
517 if (existingNetId != netId) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700518 ALOGE("interface %s assigned to netId %u, not %u", interface, existingNetId, netId);
Lorenzo Colittif7fc8ec2014-06-18 00:41:58 +0900519 return -ENOENT;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700520 }
521
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700522 RouteController::TableType tableType;
Sreeram Ramachandran87475a12014-07-15 16:20:28 -0700523 if (netId == LOCAL_NET_ID) {
524 tableType = RouteController::LOCAL_NETWORK;
525 } else if (legacy) {
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700526 if ((getPermissionForUser(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
Sreeram Ramachandran5009d5e2014-07-03 12:20:48 -0700527 tableType = RouteController::LEGACY_SYSTEM;
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700528 } else {
Sreeram Ramachandran5009d5e2014-07-03 12:20:48 -0700529 tableType = RouteController::LEGACY_NETWORK;
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700530 }
531 } else {
532 tableType = RouteController::INTERFACE;
533 }
534
Sreeram Ramachandraneb27b7e2014-07-01 14:30:30 -0700535 return add ? RouteController::addRoute(interface, destination, nexthop, tableType) :
536 RouteController::removeRoute(interface, destination, nexthop, tableType);
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700537}
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700538
539int NetworkController::modifyFallthroughLocked(unsigned vpnNetId, bool add) {
540 if (mDefaultNetId == NETID_UNSET) {
541 return 0;
542 }
543 Network* network = getNetworkLocked(mDefaultNetId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900544 if (!network) {
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700545 ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
546 return -ESRCH;
547 }
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900548 if (network->getType() != Network::PHYSICAL) {
549 ALOGE("inconceivable! default network must be a physical network");
550 return -EINVAL;
551 }
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700552 Permission permission = static_cast<PhysicalNetwork*>(network)->getPermission();
553 for (const auto& physicalInterface : network->getInterfaces()) {
554 if (int ret = mDelegateImpl->modifyFallthrough(vpnNetId, physicalInterface, permission,
555 add)) {
556 return ret;
557 }
558 }
559 return 0;
560}