NetworkController.h revision 36ed53e37b2639681055b2d3d8777241e7dd6982 
1/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef NETD_SERVER_NETWORK_CONTROLLER_H
18#define NETD_SERVER_NETWORK_CONTROLLER_H
19
20#include "NetdConstants.h"
21#include "Permission.h"
22
23#include "utils/RWLock.h"
24
25#include <list>
26#include <map>
27#include <sys/types.h>
28#include <vector>
29
30class Network;
31class UidRanges;
32
33/*
34 * Keeps track of default, per-pid, and per-uid-range network selection, as
35 * well as the mark associated with each network. Networks are identified
36 * by netid. In all set* commands netid == 0 means "unspecified" and is
37 * equivalent to clearing the mapping.
38 */
39class NetworkController {
40public:
41    NetworkController();
42
43    unsigned getDefaultNetwork() const;
44    int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT;
45
46    bool setNetworkForUidRange(uid_t uidStart, uid_t uidEnd, unsigned netId, bool forwardDns);
47    bool clearNetworkForUidRange(uid_t uidStart, uid_t uidEnd, unsigned netId);
48
49    // Order of preference: UID-specific, requestedNetId, default.
50    // Specify NETID_UNSET for requestedNetId if the default network is preferred.
51    // forDns indicates if we're querying the netId for a DNS request. This avoids sending DNS
52    // requests to VPNs without DNS servers.
53    unsigned getNetwork(uid_t uid, unsigned requestedNetId, bool forDns) const;
54    unsigned getNetworkId(const char* interface) const;
55    bool isValidNetwork(unsigned netId) const;
56
57    int createNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
58    int createVpn(unsigned netId, uid_t ownerUid) WARN_UNUSED_RESULT;
59    int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT;
60
61    int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
62    int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
63
64    Permission getPermissionForUser(uid_t uid) const;
65    void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
66    bool isUserPermittedOnNetwork(uid_t uid, unsigned netId) const;
67    int setPermissionForNetworks(Permission permission,
68                                 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT;
69
70    int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
71    int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
72
73    // Routes are added to tables determined by the interface, so only |interface| is actually used.
74    // |netId| is given only to sanity check that the interface has the correct netId.
75    int addRoute(unsigned netId, const char* interface, const char* destination,
76                 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
77    int removeRoute(unsigned netId, const char* interface, const char* destination,
78                    const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
79
80private:
81    Network* getNetworkLocked(unsigned netId) const;
82
83    int modifyRoute(unsigned netId, const char* interface, const char* destination,
84                    const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
85
86    struct UidEntry {
87        const uid_t uidStart;
88        const uid_t uidEnd;
89        const unsigned netId;
90        bool forwardDns;
91
92        UidEntry(uid_t uidStart, uid_t uidEnd, unsigned netId, bool forwardDns);
93    };
94
95    // mRWLock guards all accesses to mUidMap, mDefaultNetId, mNetworks and mUsers.
96    mutable android::RWLock mRWLock;
97    std::list<UidEntry> mUidMap;
98    unsigned mDefaultNetId;
99    std::map<unsigned, Network*> mNetworks;  // Map keys are NetIds.
100    std::map<uid_t, Permission> mUsers;
101};
102
103#endif  // NETD_SERVER_NETWORK_CONTROLLER_H
104