blob: ac709a0bdaf0cf6216e6e055f29c655f8444dde4 [file] [log] [blame]
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -05001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Sreeram Ramachandran72604072014-05-21 13:19:43 -070017// THREAD-SAFETY
18// -------------
19// The methods in this file are called from multiple threads (from CommandListener, FwmarkServer
20// and DnsProxyListener). So, all accesses to shared state are guarded by a lock.
21//
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +090022// Public functions accessible by external callers should be thread-safe and are responsible for
23// acquiring the lock. Private functions in this file should call xxxLocked() methods and access
24// internal state directly.
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050025
26#include "NetworkController.h"
27
Erik Kline2d3a1632016-03-15 16:33:48 +090028#define LOG_TAG "Netd"
29#include "log/log.h"
30
Rubin Xu6c00b612018-04-27 14:27:59 +010031#include <android-base/strings.h>
32
Erik Kline2d3a1632016-03-15 16:33:48 +090033#include "cutils/misc.h"
34#include "resolv_netid.h"
35
Pierre Imai3a272072016-04-19 16:17:07 +090036#include "Controllers.h"
Lorenzo Colitti36679362015-02-25 10:26:19 +090037#include "DummyNetwork.h"
Erik Kline2d3a1632016-03-15 16:33:48 +090038#include "DumpWriter.h"
Sreeram Ramachandran1011b492014-07-24 19:04:32 -070039#include "Fwmark.h"
Sreeram Ramachandran6a773532014-07-11 09:10:20 -070040#include "LocalNetwork.h"
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070041#include "PhysicalNetwork.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070042#include "RouteController.h"
Sreeram Ramachandran4043f012014-06-23 12:41:37 -070043#include "VirtualNetwork.h"
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070044
Erik Kline6d4669f2017-05-25 17:03:31 +090045#define DBG 0
46
Lorenzo Colitti7035f222017-02-13 18:29:00 +090047namespace android {
48namespace net {
49
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070050namespace {
51
52// Keep these in sync with ConnectivityService.java.
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -070053const unsigned MIN_NET_ID = 100;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -070054const unsigned MAX_NET_ID = 65535;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -070055
56} // namespace
57
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -070058const unsigned NetworkController::MIN_OEM_ID = 1;
59const unsigned NetworkController::MAX_OEM_ID = 50;
Lorenzo Colitti36679362015-02-25 10:26:19 +090060const unsigned NetworkController::DUMMY_NET_ID = 51;
61// NetIds 52..98 are reserved for future use.
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -070062const unsigned NetworkController::LOCAL_NET_ID = 99;
63
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070064// All calls to methods here are made while holding a write lock on mRWLock.
Lorenzo Colitti2d014e72018-01-10 22:12:29 +090065// They are mostly not called directly from this class, but from methods in PhysicalNetwork.cpp.
66// However, we're the only user of that class, so all calls to those methods come from here and are
67// made under lock.
68// For example, PhysicalNetwork::setPermission ends up calling addFallthrough and removeFallthrough,
69// but it's only called from here under lock (specifically, from createPhysicalNetworkLocked and
70// setPermissionForNetworks).
71// TODO: use std::mutex and GUARDED_BY instead of manual inspection.
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -070072class NetworkController::DelegateImpl : public PhysicalNetwork::Delegate {
73public:
74 explicit DelegateImpl(NetworkController* networkController);
75 virtual ~DelegateImpl();
76
77 int modifyFallthrough(unsigned vpnNetId, const std::string& physicalInterface,
78 Permission permission, bool add) WARN_UNUSED_RESULT;
79
80private:
81 int addFallthrough(const std::string& physicalInterface,
82 Permission permission) override WARN_UNUSED_RESULT;
83 int removeFallthrough(const std::string& physicalInterface,
84 Permission permission) override WARN_UNUSED_RESULT;
85
86 int modifyFallthrough(const std::string& physicalInterface, Permission permission,
87 bool add) WARN_UNUSED_RESULT;
88
89 NetworkController* const mNetworkController;
90};
91
92NetworkController::DelegateImpl::DelegateImpl(NetworkController* networkController) :
93 mNetworkController(networkController) {
94}
95
96NetworkController::DelegateImpl::~DelegateImpl() {
97}
98
99int NetworkController::DelegateImpl::modifyFallthrough(unsigned vpnNetId,
100 const std::string& physicalInterface,
101 Permission permission, bool add) {
102 if (add) {
103 if (int ret = RouteController::addVirtualNetworkFallthrough(vpnNetId,
104 physicalInterface.c_str(),
105 permission)) {
106 ALOGE("failed to add fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
107 vpnNetId);
108 return ret;
109 }
110 } else {
111 if (int ret = RouteController::removeVirtualNetworkFallthrough(vpnNetId,
112 physicalInterface.c_str(),
113 permission)) {
114 ALOGE("failed to remove fallthrough to %s for VPN netId %u", physicalInterface.c_str(),
115 vpnNetId);
116 return ret;
117 }
118 }
119 return 0;
120}
121
122int NetworkController::DelegateImpl::addFallthrough(const std::string& physicalInterface,
123 Permission permission) {
124 return modifyFallthrough(physicalInterface, permission, true);
125}
126
127int NetworkController::DelegateImpl::removeFallthrough(const std::string& physicalInterface,
128 Permission permission) {
129 return modifyFallthrough(physicalInterface, permission, false);
130}
131
132int NetworkController::DelegateImpl::modifyFallthrough(const std::string& physicalInterface,
133 Permission permission, bool add) {
134 for (const auto& entry : mNetworkController->mNetworks) {
135 if (entry.second->getType() == Network::VIRTUAL) {
136 if (int ret = modifyFallthrough(entry.first, physicalInterface, permission, add)) {
137 return ret;
138 }
139 }
140 }
141 return 0;
142}
143
144NetworkController::NetworkController() :
Pierre Imai6be56192016-05-16 16:32:17 +0900145 mDelegateImpl(new NetworkController::DelegateImpl(this)), mDefaultNetId(NETID_UNSET),
146 mProtectableUsers({AID_VPN}) {
Sreeram Ramachandran87475a12014-07-15 16:20:28 -0700147 mNetworks[LOCAL_NET_ID] = new LocalNetwork(LOCAL_NET_ID);
Lorenzo Colitti36679362015-02-25 10:26:19 +0900148 mNetworks[DUMMY_NET_ID] = new DummyNetwork(DUMMY_NET_ID);
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500149}
150
151unsigned NetworkController::getDefaultNetwork() const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800152 ScopedRLock lock(mRWLock);
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500153 return mDefaultNetId;
154}
155
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700156int NetworkController::setDefaultNetwork(unsigned netId) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800157 ScopedWLock lock(mRWLock);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700158
159 if (netId == mDefaultNetId) {
160 return 0;
Sreeram Ramachandran72604072014-05-21 13:19:43 -0700161 }
162
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700163 if (netId != NETID_UNSET) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700164 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900165 if (!network) {
166 ALOGE("no such netId %u", netId);
167 return -ENONET;
168 }
169 if (network->getType() != Network::PHYSICAL) {
170 ALOGE("cannot set default to non-physical network with netId %u", netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700171 return -EINVAL;
172 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700173 if (int ret = static_cast<PhysicalNetwork*>(network)->addAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700174 return ret;
Sreeram Ramachandran9c0d3132014-04-10 20:35:04 -0700175 }
176 }
177
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700178 if (mDefaultNetId != NETID_UNSET) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700179 Network* network = getNetworkLocked(mDefaultNetId);
180 if (!network || network->getType() != Network::PHYSICAL) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700181 ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
182 return -ESRCH;
183 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700184 if (int ret = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700185 return ret;
Sreeram Ramachandran9c0d3132014-04-10 20:35:04 -0700186 }
187 }
188
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700189 mDefaultNetId = netId;
190 return 0;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500191}
192
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900193uint32_t NetworkController::getNetworkForDnsLocked(unsigned* netId, uid_t uid) const {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700194 Fwmark fwmark;
195 fwmark.protectedFromVpn = true;
196 fwmark.permission = PERMISSION_SYSTEM;
Lorenzo Colitti95f1bcb2018-05-30 16:14:18 +0900197
198 // Common case: there is no VPN that applies to the user, and the query did not specify a netId.
199 // Therefore, it is safe to set the explicit bit on this query and skip all the complex logic
200 // below. While this looks like a special case, it is actually the one that handles the vast
201 // majority of DNS queries.
202 // TODO: untangle this code.
203 if (*netId == NETID_UNSET && getVirtualNetworkForUserLocked(uid) == nullptr) {
204 *netId = mDefaultNetId;
205 fwmark.netId = *netId;
206 fwmark.explicitlySelected = true;
207 return fwmark.intValue;
208 }
209
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900210 if (checkUserNetworkAccessLocked(uid, *netId) == 0) {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700211 // If a non-zero NetId was explicitly specified, and the user has permission for that
212 // network, use that network's DNS servers. Do not fall through to the default network even
Lorenzo Colittic63059c2016-06-21 23:54:12 +0900213 // if the explicitly selected network is a split tunnel VPN: the explicitlySelected bit
214 // ensures that the VPN fallthrough rule does not match.
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700215 fwmark.explicitlySelected = true;
Lorenzo Colittic63059c2016-06-21 23:54:12 +0900216
217 // If the network is a VPN and it doesn't have DNS servers, use the default network's DNS
218 // servers (through the default network). Otherwise, the query is guaranteed to fail.
219 // http://b/29498052
220 Network *network = getNetworkLocked(*netId);
221 if (network && network->getType() == Network::VIRTUAL &&
222 !static_cast<VirtualNetwork *>(network)->getHasDns()) {
223 *netId = mDefaultNetId;
224 }
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700225 } else {
226 // If the user is subject to a VPN and the VPN provides DNS servers, use those servers
227 // (possibly falling through to the default network if the VPN doesn't provide a route to
Lorenzo Colitti95f1bcb2018-05-30 16:14:18 +0900228 // them). Otherwise, use the default network's DNS servers. We cannot set the explicit bit
229 // because we need to be able to fall through a split tunnel to the default network.
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700230 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
231 if (virtualNetwork && virtualNetwork->getHasDns()) {
232 *netId = virtualNetwork->getNetId();
233 } else {
Lorenzo Colittic63059c2016-06-21 23:54:12 +0900234 // TODO: return an error instead of silently doing the DNS lookup on the wrong network.
235 // http://b/27560555
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700236 *netId = mDefaultNetId;
237 }
238 }
239 fwmark.netId = *netId;
240 return fwmark.intValue;
241}
242
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900243uint32_t NetworkController::getNetworkForDns(unsigned* netId, uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800244 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900245 return getNetworkForDnsLocked(netId, uid);
246}
247
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700248// Returns the NetId that a given UID would use if no network is explicitly selected. Specifically,
249// the VPN that applies to the UID if any; otherwise, the default network.
250unsigned NetworkController::getNetworkForUser(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800251 ScopedRLock lock(mRWLock);
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700252 if (VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid)) {
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700253 return virtualNetwork->getNetId();
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500254 }
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700255 return mDefaultNetId;
256}
257
258// Returns the NetId that will be set when a socket connect()s. This is the bypassable VPN that
259// applies to the user if any; otherwise, the default network.
260//
261// In general, we prefer to always set the default network's NetId in connect(), so that if the VPN
262// is a split-tunnel and disappears later, the socket continues working (since the default network's
263// NetId is still valid). Secure VPNs will correctly grab the socket's traffic since they have a
264// high-priority routing rule that doesn't care what NetId the socket has.
265//
266// But bypassable VPNs have a very low priority rule, so we need to mark the socket with the
267// bypassable VPN's NetId if we expect it to get any traffic at all. If the bypassable VPN is a
268// split-tunnel, that's okay, because we have fallthrough rules that will direct the fallthrough
269// traffic to the default network. But it does mean that if the bypassable VPN goes away (and thus
270// the fallthrough rules also go away), the socket that used to fallthrough to the default network
271// will stop working.
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900272unsigned NetworkController::getNetworkForConnectLocked(uid_t uid) const {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700273 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
274 if (virtualNetwork && !virtualNetwork->isSecure()) {
275 return virtualNetwork->getNetId();
276 }
277 return mDefaultNetId;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500278}
279
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900280unsigned NetworkController::getNetworkForConnect(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800281 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900282 return getNetworkForConnectLocked(uid);
283}
284
Erik Klinecea2d342015-06-25 18:24:46 +0900285void NetworkController::getNetworkContext(
286 unsigned netId, uid_t uid, struct android_net_context* netcontext) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800287 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900288
Erik Klinecea2d342015-06-25 18:24:46 +0900289 struct android_net_context nc = {
290 .app_netid = netId,
291 .app_mark = MARK_UNSET,
292 .dns_netid = netId,
293 .dns_mark = MARK_UNSET,
294 .uid = uid,
295 };
296
Erik Kline492ca5b2016-03-09 14:56:00 +0900297 // |netId| comes directly (via dnsproxyd) from the value returned by netIdForResolv() in the
298 // client process. This value is nonzero iff.:
299 //
300 // 1. The app specified a netid/nethandle to a DNS resolution method such as:
301 // - [Java] android.net.Network#getAllByName()
302 // - [C/++] android_getaddrinfofornetwork()
303 // 2. The app specified a netid/nethandle to be used as a process default via:
304 // - [Java] android.net.ConnectivityManager#bindProcessToNetwork()
305 // - [C/++] android_setprocnetwork()
306 // 3. The app called android.net.ConnectivityManager#startUsingNetworkFeature().
307 //
308 // In all these cases (with the possible exception of #3), the right thing to do is to treat
309 // such cases as explicitlySelected.
310 const bool explicitlySelected = (nc.app_netid != NETID_UNSET);
311 if (!explicitlySelected) {
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900312 nc.app_netid = getNetworkForConnectLocked(uid);
Erik Klinecea2d342015-06-25 18:24:46 +0900313 }
Erik Kline492ca5b2016-03-09 14:56:00 +0900314
Erik Klinecea2d342015-06-25 18:24:46 +0900315 Fwmark fwmark;
316 fwmark.netId = nc.app_netid;
Erik Kline492ca5b2016-03-09 14:56:00 +0900317 fwmark.explicitlySelected = explicitlySelected;
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900318 fwmark.protectedFromVpn = explicitlySelected && canProtectLocked(uid);
319 fwmark.permission = getPermissionForUserLocked(uid);
Erik Klinecea2d342015-06-25 18:24:46 +0900320 nc.app_mark = fwmark.intValue;
321
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900322 nc.dns_mark = getNetworkForDnsLocked(&(nc.dns_netid), uid);
Erik Klinecea2d342015-06-25 18:24:46 +0900323
Erik Kline6d4669f2017-05-25 17:03:31 +0900324 if (DBG) {
325 ALOGD("app_netid:0x%x app_mark:0x%x dns_netid:0x%x dns_mark:0x%x uid:%d",
326 nc.app_netid, nc.app_mark, nc.dns_netid, nc.dns_mark, uid);
327 }
328
Erik Klinecea2d342015-06-25 18:24:46 +0900329 if (netcontext) {
330 *netcontext = nc;
331 }
332}
333
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900334unsigned NetworkController::getNetworkForInterfaceLocked(const char* interface) const {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700335 for (const auto& entry : mNetworks) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700336 if (entry.second->hasInterface(interface)) {
337 return entry.first;
338 }
339 }
Paul Jensen35c77e32014-04-10 14:57:54 -0400340 return NETID_UNSET;
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500341}
342
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900343unsigned NetworkController::getNetworkForInterface(const char* interface) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800344 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900345 return getNetworkForInterfaceLocked(interface);
346}
347
Sreeram Ramachandran070b2d22014-07-11 17:06:12 -0700348bool NetworkController::isVirtualNetwork(unsigned netId) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800349 ScopedRLock lock(mRWLock);
Rubin Xu6c00b612018-04-27 14:27:59 +0100350 return isVirtualNetworkLocked(netId);
351}
352
353bool NetworkController::isVirtualNetworkLocked(unsigned netId) const {
Sreeram Ramachandran070b2d22014-07-11 17:06:12 -0700354 Network* network = getNetworkLocked(netId);
355 return network && network->getType() == Network::VIRTUAL;
356}
357
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700358int NetworkController::createPhysicalNetworkLocked(unsigned netId, Permission permission) {
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -0700359 if (!((MIN_NET_ID <= netId && netId <= MAX_NET_ID) ||
360 (MIN_OEM_ID <= netId && netId <= MAX_OEM_ID))) {
Paul Jensenae37e8a2014-04-28 10:35:51 -0400361 ALOGE("invalid netId %u", netId);
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900362 return -EINVAL;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700363 }
364
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700365 if (isValidNetworkLocked(netId)) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700366 ALOGE("duplicate netId %u", netId);
367 return -EEXIST;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700368 }
369
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700370 PhysicalNetwork* physicalNetwork = new PhysicalNetwork(netId, mDelegateImpl);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700371 if (int ret = physicalNetwork->setPermission(permission)) {
372 ALOGE("inconceivable! setPermission cannot fail on an empty network");
373 delete physicalNetwork;
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900374 return ret;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700375 }
376
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700377 mNetworks[netId] = physicalNetwork;
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900378
379 updateTcpSocketMonitorPolling();
380
Lorenzo Colitti96f261e2014-06-23 15:09:54 +0900381 return 0;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700382}
383
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700384int NetworkController::createPhysicalNetwork(unsigned netId, Permission permission) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800385 ScopedWLock lock(mRWLock);
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700386 return createPhysicalNetworkLocked(netId, permission);
387}
388
389int NetworkController::createPhysicalOemNetwork(Permission permission, unsigned *pNetId) {
390 if (pNetId == NULL) {
391 return -EINVAL;
392 }
393
Luke Huangd1ee4622018-06-29 13:49:58 +0800394 ScopedWLock lock(mRWLock);
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700395 for (*pNetId = MIN_OEM_ID; *pNetId <= MAX_OEM_ID; (*pNetId)++) {
396 if (!isValidNetworkLocked(*pNetId)) {
397 break;
398 }
399 }
400
401 if (*pNetId > MAX_OEM_ID) {
402 ALOGE("No free network ID");
403 *pNetId = 0;
404 return -ENONET;
405 }
406
407 int ret = createPhysicalNetworkLocked(*pNetId, permission);
408 if (ret) {
409 *pNetId = 0;
410 }
411
412 return ret;
413}
414
Sreeram Ramachandran95684ba2014-07-23 13:27:31 -0700415int NetworkController::createVirtualNetwork(unsigned netId, bool hasDns, bool secure) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800416 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900417
Sreeram Ramachandranbbdde992014-09-05 16:05:03 -0700418 if (!(MIN_NET_ID <= netId && netId <= MAX_NET_ID)) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700419 ALOGE("invalid netId %u", netId);
420 return -EINVAL;
421 }
422
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900423 if (isValidNetworkLocked(netId)) {
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700424 ALOGE("duplicate netId %u", netId);
425 return -EEXIST;
426 }
427
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700428 if (int ret = modifyFallthroughLocked(netId, true)) {
429 return ret;
430 }
Sreeram Ramachandran95684ba2014-07-23 13:27:31 -0700431 mNetworks[netId] = new VirtualNetwork(netId, hasDns, secure);
Sreeram Ramachandran4043f012014-06-23 12:41:37 -0700432 return 0;
433}
434
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700435int NetworkController::destroyNetwork(unsigned netId) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800436 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900437
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900438 if (netId == LOCAL_NET_ID) {
439 ALOGE("cannot destroy local network");
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700440 return -EINVAL;
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700441 }
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900442 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900443 ALOGE("no such netId %u", netId);
444 return -ENONET;
445 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700446
Sreeram Ramachandran379bd332014-04-10 19:58:06 -0700447 // TODO: ioctl(SIOCKILLADDR, ...) to kill all sockets on the old network.
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700448
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700449 Network* network = getNetworkLocked(netId);
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900450
451 // If we fail to destroy a network, things will get stuck badly. Therefore, unlike most of the
452 // other network code, ignore failures and attempt to clear out as much state as possible, even
453 // if we hit an error on the way. Return the first error that we see.
454 int ret = network->clearInterfaces();
455
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700456 if (mDefaultNetId == netId) {
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900457 if (int err = static_cast<PhysicalNetwork*>(network)->removeAsDefault()) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700458 ALOGE("inconceivable! removeAsDefault cannot fail on an empty network");
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900459 if (!ret) {
460 ret = err;
461 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700462 }
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700463 mDefaultNetId = NETID_UNSET;
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700464 } else if (network->getType() == Network::VIRTUAL) {
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900465 if (int err = modifyFallthroughLocked(netId, false)) {
466 if (!ret) {
467 ret = err;
468 }
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700469 }
Sreeram Ramachandran5c181bf2014-04-07 14:10:04 -0700470 }
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700471 mNetworks.erase(netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700472 delete network;
Sreeram Ramachandran3ced0692014-04-18 09:49:13 -0700473 _resolv_delete_cache_for_net(netId);
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900474
Rubin Xu6c00b612018-04-27 14:27:59 +0100475 for (auto iter = mIfindexToLastNetId.begin(); iter != mIfindexToLastNetId.end();) {
476 if (iter->second == netId) {
477 iter = mIfindexToLastNetId.erase(iter);
478 } else {
479 ++iter;
480 }
481 }
482
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900483 updateTcpSocketMonitorPolling();
484
Lorenzo Colitti99286fe2014-08-12 15:08:00 +0900485 return ret;
Sreeram Ramachandran379bd332014-04-10 19:58:06 -0700486}
487
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700488int NetworkController::addInterfaceToNetwork(unsigned netId, const char* interface) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800489 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900490
491 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900492 ALOGE("no such netId %u", netId);
493 return -ENONET;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700494 }
495
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900496 unsigned existingNetId = getNetworkForInterfaceLocked(interface);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700497 if (existingNetId != NETID_UNSET && existingNetId != netId) {
498 ALOGE("interface %s already assigned to netId %u", interface, existingNetId);
499 return -EBUSY;
500 }
Rubin Xu6c00b612018-04-27 14:27:59 +0100501 if (int ret = getNetworkLocked(netId)->addInterface(interface)) {
502 return ret;
503 }
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700504
Rubin Xu6c00b612018-04-27 14:27:59 +0100505 int ifIndex = RouteController::getIfIndex(interface);
506 if (ifIndex) {
507 mIfindexToLastNetId[ifIndex] = netId;
508 } else {
509 // Cannot happen, since addInterface() above will have failed.
510 ALOGE("inconceivable! added interface %s with no index", interface);
511 }
512 return 0;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700513}
514
515int NetworkController::removeInterfaceFromNetwork(unsigned netId, const char* interface) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800516 ScopedWLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900517
518 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900519 ALOGE("no such netId %u", netId);
520 return -ENONET;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700521 }
522
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700523 return getNetworkLocked(netId)->removeInterface(interface);
524}
525
526Permission NetworkController::getPermissionForUser(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800527 ScopedRLock lock(mRWLock);
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700528 return getPermissionForUserLocked(uid);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700529}
530
531void NetworkController::setPermissionForUsers(Permission permission,
532 const std::vector<uid_t>& uids) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800533 ScopedWLock lock(mRWLock);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700534 for (uid_t uid : uids) {
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700535 mUsers[uid] = permission;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700536 }
537}
538
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900539int NetworkController::checkUserNetworkAccess(uid_t uid, unsigned netId) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800540 ScopedRLock lock(mRWLock);
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900541 return checkUserNetworkAccessLocked(uid, netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700542}
543
544int NetworkController::setPermissionForNetworks(Permission permission,
545 const std::vector<unsigned>& netIds) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800546 ScopedWLock lock(mRWLock);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700547 for (unsigned netId : netIds) {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700548 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900549 if (!network) {
550 ALOGE("no such netId %u", netId);
551 return -ENONET;
552 }
553 if (network->getType() != Network::PHYSICAL) {
554 ALOGE("cannot set permissions on non-physical network with netId %u", netId);
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700555 return -EINVAL;
556 }
557
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700558 if (int ret = static_cast<PhysicalNetwork*>(network)->setPermission(permission)) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700559 return ret;
560 }
561 }
562 return 0;
563}
564
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700565int NetworkController::addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800566 ScopedWLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700567 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900568 if (!network) {
569 ALOGE("no such netId %u", netId);
570 return -ENONET;
571 }
572 if (network->getType() != Network::VIRTUAL) {
573 ALOGE("cannot add users to non-virtual network with netId %u", netId);
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700574 return -EINVAL;
575 }
Lorenzo Colittifff4bd32016-04-14 00:56:01 +0900576 if (int ret = static_cast<VirtualNetwork*>(network)->addUsers(uidRanges, mProtectableUsers)) {
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700577 return ret;
578 }
579 return 0;
580}
581
582int NetworkController::removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800583 ScopedWLock lock(mRWLock);
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700584 Network* network = getNetworkLocked(netId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900585 if (!network) {
586 ALOGE("no such netId %u", netId);
587 return -ENONET;
588 }
589 if (network->getType() != Network::VIRTUAL) {
590 ALOGE("cannot remove users from non-virtual network with netId %u", netId);
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700591 return -EINVAL;
592 }
Lorenzo Colittifff4bd32016-04-14 00:56:01 +0900593 if (int ret = static_cast<VirtualNetwork*>(network)->removeUsers(uidRanges,
594 mProtectableUsers)) {
Sreeram Ramachandranb1425cc2014-06-23 18:54:27 -0700595 return ret;
596 }
597 return 0;
598}
599
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700600int NetworkController::addRoute(unsigned netId, const char* interface, const char* destination,
601 const char* nexthop, bool legacy, uid_t uid) {
602 return modifyRoute(netId, interface, destination, nexthop, true, legacy, uid);
603}
604
605int NetworkController::removeRoute(unsigned netId, const char* interface, const char* destination,
606 const char* nexthop, bool legacy, uid_t uid) {
607 return modifyRoute(netId, interface, destination, nexthop, false, legacy, uid);
608}
609
Rubin Xu6c00b612018-04-27 14:27:59 +0100610void NetworkController::addInterfaceAddress(unsigned ifIndex, const char* address) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800611 ScopedWLock lock(mRWLock);
Rubin Xu6c00b612018-04-27 14:27:59 +0100612 if (ifIndex == 0) {
613 ALOGE("Attempting to add address %s without ifindex", address);
614 return;
615 }
616 mAddressToIfindices[address].insert(ifIndex);
617}
618
619// Returns whether we should call SOCK_DESTROY on the removed address.
620bool NetworkController::removeInterfaceAddress(unsigned ifindex, const char* address) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800621 ScopedWLock lock(mRWLock);
Rubin Xu6c00b612018-04-27 14:27:59 +0100622 // First, update mAddressToIfindices map
623 auto ifindicesIter = mAddressToIfindices.find(address);
624 if (ifindicesIter == mAddressToIfindices.end()) {
625 ALOGE("Removing unknown address %s from ifindex %u", address, ifindex);
626 return true;
627 }
628 std::unordered_set<unsigned>& ifindices = ifindicesIter->second;
629 if (ifindices.erase(ifindex) > 0) {
630 if (ifindices.size() == 0) {
631 mAddressToIfindices.erase(ifindicesIter);
632 }
633 } else {
634 ALOGE("No record of address %s on interface %u", address, ifindex);
635 return true;
636 }
637 // Then, check for VPN handover condition
638 if (mIfindexToLastNetId.find(ifindex) == mIfindexToLastNetId.end()) {
639 ALOGE("Interface index %u was never in a currently-connected netId", ifindex);
640 return true;
641 }
642 unsigned lastNetId = mIfindexToLastNetId[ifindex];
643 for (unsigned idx : ifindices) {
644 unsigned activeNetId = mIfindexToLastNetId[idx];
645 // If this IP address is still assigned to another interface in the same network,
646 // then we don't need to destroy sockets on it because they are likely still valid.
647 // For now we do this only on VPNs.
648 // TODO: evaluate extending this to all network types.
649 if (lastNetId == activeNetId && isVirtualNetworkLocked(activeNetId)) {
650 return false;
651 }
652 }
653 return true;
654}
655
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900656bool NetworkController::canProtectLocked(uid_t uid) const {
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700657 return ((getPermissionForUserLocked(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) ||
658 mProtectableUsers.find(uid) != mProtectableUsers.end();
659}
660
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900661bool NetworkController::canProtect(uid_t uid) const {
Luke Huangd1ee4622018-06-29 13:49:58 +0800662 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900663 return canProtectLocked(uid);
664}
665
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700666void NetworkController::allowProtect(const std::vector<uid_t>& uids) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800667 ScopedWLock lock(mRWLock);
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700668 mProtectableUsers.insert(uids.begin(), uids.end());
669}
670
671void NetworkController::denyProtect(const std::vector<uid_t>& uids) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800672 ScopedWLock lock(mRWLock);
Sreeram Ramachandran89dad012014-07-02 10:09:49 -0700673 for (uid_t uid : uids) {
674 mProtectableUsers.erase(uid);
675 }
676}
677
Erik Kline2d3a1632016-03-15 16:33:48 +0900678void NetworkController::dump(DumpWriter& dw) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800679 ScopedRLock lock(mRWLock);
Erik Kline2d3a1632016-03-15 16:33:48 +0900680
681 dw.incIndent();
682 dw.println("NetworkController");
683
684 dw.incIndent();
685 dw.println("Default network: %u", mDefaultNetId);
686
687 dw.blankline();
688 dw.println("Networks:");
689 dw.incIndent();
690 for (const auto& i : mNetworks) {
Lorenzo Colittid1029652016-09-26 17:17:40 +0900691 Network* network = i.second;
Erik Klineb31fd692018-06-06 20:50:11 +0900692 dw.println(network->toString());
Lorenzo Colittid1029652016-09-26 17:17:40 +0900693 if (network->getType() == Network::PHYSICAL) {
694 dw.incIndent();
695 Permission permission = reinterpret_cast<PhysicalNetwork*>(network)->getPermission();
696 dw.println("Required permission: %s", permissionToName(permission));
697 dw.decIndent();
698 }
Pierre Imai3a272072016-04-19 16:17:07 +0900699 android::net::gCtls->resolverCtrl.dump(dw, i.first);
700 dw.blankline();
Erik Kline2d3a1632016-03-15 16:33:48 +0900701 }
702 dw.decIndent();
703
Rubin Xu6c00b612018-04-27 14:27:59 +0100704 dw.blankline();
705 dw.println("Interface <-> last network map:");
706 dw.incIndent();
707 for (const auto& i : mIfindexToLastNetId) {
708 dw.println("Ifindex: %u NetId: %u", i.first, i.second);
709 }
710 dw.decIndent();
711
712 dw.blankline();
713 dw.println("Interface addresses:");
714 dw.incIndent();
715 for (const auto& i : mAddressToIfindices) {
716 dw.println("address: %s ifindices: [%s]", i.first.c_str(),
717 android::base::Join(i.second, ", ").c_str());
718 }
719 dw.decIndent();
720
Erik Kline2d3a1632016-03-15 16:33:48 +0900721 dw.decIndent();
722
723 dw.decIndent();
724}
725
Niranjan Pendharkar7e08f852017-07-24 11:40:05 -0700726bool NetworkController::isValidNetworkLocked(unsigned netId) const {
727 return getNetworkLocked(netId);
728}
729
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700730Network* NetworkController::getNetworkLocked(unsigned netId) const {
Sreeram Ramachandran36ed53e2014-07-01 19:01:56 -0700731 auto iter = mNetworks.find(netId);
732 return iter == mNetworks.end() ? NULL : iter->second;
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700733}
734
Sreeram Ramachandrane09b20a2014-07-05 17:15:14 -0700735VirtualNetwork* NetworkController::getVirtualNetworkForUserLocked(uid_t uid) const {
736 for (const auto& entry : mNetworks) {
737 if (entry.second->getType() == Network::VIRTUAL) {
738 VirtualNetwork* virtualNetwork = static_cast<VirtualNetwork*>(entry.second);
739 if (virtualNetwork->appliesToUser(uid)) {
740 return virtualNetwork;
741 }
742 }
743 }
744 return NULL;
745}
746
Sreeram Ramachandraned4bd1f2014-07-05 12:31:05 -0700747Permission NetworkController::getPermissionForUserLocked(uid_t uid) const {
748 auto iter = mUsers.find(uid);
749 if (iter != mUsers.end()) {
750 return iter->second;
751 }
752 return uid < FIRST_APPLICATION_UID ? PERMISSION_SYSTEM : PERMISSION_NONE;
753}
754
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900755int NetworkController::checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const {
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700756 Network* network = getNetworkLocked(netId);
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900757 if (!network) {
758 return -ENONET;
759 }
760
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700761 // If uid is INVALID_UID, this likely means that we were unable to retrieve the UID of the peer
762 // (using SO_PEERCRED). Be safe and deny access to the network, even if it's valid.
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900763 if (uid == INVALID_UID) {
764 return -EREMOTEIO;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700765 }
766 Permission userPermission = getPermissionForUserLocked(uid);
767 if ((userPermission & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900768 return 0;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700769 }
770 if (network->getType() == Network::VIRTUAL) {
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900771 return static_cast<VirtualNetwork*>(network)->appliesToUser(uid) ? 0 : -EPERM;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700772 }
773 VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
774 if (virtualNetwork && virtualNetwork->isSecure() &&
775 mProtectableUsers.find(uid) == mProtectableUsers.end()) {
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900776 return -EPERM;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700777 }
778 Permission networkPermission = static_cast<PhysicalNetwork*>(network)->getPermission();
Lorenzo Colittia1067c82014-10-02 22:47:41 +0900779 return ((userPermission & networkPermission) == networkPermission) ? 0 : -EACCES;
Sreeram Ramachandran1011b492014-07-24 19:04:32 -0700780}
781
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700782int NetworkController::modifyRoute(unsigned netId, const char* interface, const char* destination,
783 const char* nexthop, bool add, bool legacy, uid_t uid) {
Luke Huangd1ee4622018-06-29 13:49:58 +0800784 ScopedRLock lock(mRWLock);
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900785
786 if (!isValidNetworkLocked(netId)) {
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900787 ALOGE("no such netId %u", netId);
788 return -ENONET;
789 }
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900790 unsigned existingNetId = getNetworkForInterfaceLocked(interface);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900791 if (existingNetId == NETID_UNSET) {
792 ALOGE("interface %s not assigned to any netId", interface);
793 return -ENODEV;
794 }
795 if (existingNetId != netId) {
Sreeram Ramachandranf4f6c8d2014-06-23 09:54:06 -0700796 ALOGE("interface %s assigned to netId %u, not %u", interface, existingNetId, netId);
Lorenzo Colittif7fc8ec2014-06-18 00:41:58 +0900797 return -ENOENT;
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700798 }
799
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700800 RouteController::TableType tableType;
Sreeram Ramachandran87475a12014-07-15 16:20:28 -0700801 if (netId == LOCAL_NET_ID) {
802 tableType = RouteController::LOCAL_NETWORK;
803 } else if (legacy) {
Lorenzo Colittibbd0aff2016-12-15 22:53:24 +0900804 if ((getPermissionForUserLocked(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) {
Sreeram Ramachandran5009d5e2014-07-03 12:20:48 -0700805 tableType = RouteController::LEGACY_SYSTEM;
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700806 } else {
Sreeram Ramachandran5009d5e2014-07-03 12:20:48 -0700807 tableType = RouteController::LEGACY_NETWORK;
Sreeram Ramachandran38b7af12014-05-22 14:21:49 -0700808 }
809 } else {
810 tableType = RouteController::INTERFACE;
811 }
812
Sreeram Ramachandraneb27b7e2014-07-01 14:30:30 -0700813 return add ? RouteController::addRoute(interface, destination, nexthop, tableType) :
814 RouteController::removeRoute(interface, destination, nexthop, tableType);
Sreeram Ramachandran7619e1b2014-04-15 14:23:08 -0700815}
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700816
817int NetworkController::modifyFallthroughLocked(unsigned vpnNetId, bool add) {
818 if (mDefaultNetId == NETID_UNSET) {
819 return 0;
820 }
821 Network* network = getNetworkLocked(mDefaultNetId);
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900822 if (!network) {
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700823 ALOGE("cannot find previously set default network with netId %u", mDefaultNetId);
824 return -ESRCH;
825 }
Lorenzo Colitti738c93e2014-07-30 17:46:08 +0900826 if (network->getType() != Network::PHYSICAL) {
827 ALOGE("inconceivable! default network must be a physical network");
828 return -EINVAL;
829 }
Sreeram Ramachandran48e19b02014-07-22 22:23:20 -0700830 Permission permission = static_cast<PhysicalNetwork*>(network)->getPermission();
831 for (const auto& physicalInterface : network->getInterfaces()) {
832 if (int ret = mDelegateImpl->modifyFallthrough(vpnNetId, physicalInterface, permission,
833 add)) {
834 return ret;
835 }
836 }
837 return 0;
838}
Lorenzo Colitti7035f222017-02-13 18:29:00 +0900839
Hugo Benichia9e3c5d2018-01-18 10:33:22 +0900840void NetworkController::updateTcpSocketMonitorPolling() {
841 bool physicalNetworkExists = false;
842 for (const auto& entry : mNetworks) {
843 const auto& network = entry.second;
844 if (network->getType() == Network::PHYSICAL && network->getNetId() >= MIN_NET_ID) {
845 physicalNetworkExists = true;
846 break;
847 }
848 }
849
850 if (physicalNetworkExists) {
851 android::net::gCtls->tcpSocketMonitor.resumePolling();
852 } else {
853 android::net::gCtls->tcpSocketMonitor.suspendPolling();
854 }
855}
856
Lorenzo Colitti7035f222017-02-13 18:29:00 +0900857} // namespace net
858} // namespace android