1/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef NETD_SERVER_NETWORK_CONTROLLER_H
18#define NETD_SERVER_NETWORK_CONTROLLER_H
19
20#include "NetdConstants.h"
21#include "Permission.h"
22
23#include "utils/RWLock.h"
24
25#include <list>
26#include <map>
27#include <set>
28#include <sys/types.h>
29#include <vector>
30
31struct android_net_context;
32
33namespace android {
34namespace net {
35
36class DumpWriter;
37class Network;
38class UidRanges;
39class VirtualNetwork;
40
41/*
42 * Keeps track of default, per-pid, and per-uid-range network selection, as
43 * well as the mark associated with each network. Networks are identified
44 * by netid. In all set* commands netid == 0 means "unspecified" and is
45 * equivalent to clearing the mapping.
46 */
47class NetworkController {
48public:
49    static const unsigned MIN_OEM_ID;
50    static const unsigned MAX_OEM_ID;
51    static const unsigned LOCAL_NET_ID;
52    static const unsigned DUMMY_NET_ID;
53
54    NetworkController();
55
56    unsigned getDefaultNetwork() const;
57    int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT;
58
59    // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId|
60    // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the
61    // fwmark value to set on the socket when performing the DNS request.
62    uint32_t getNetworkForDns(unsigned* netId, uid_t uid) const;
63    unsigned getNetworkForUser(uid_t uid) const;
64    unsigned getNetworkForConnect(uid_t uid) const;
65    void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const;
66    unsigned getNetworkForInterface(const char* interface) const;
67    bool isVirtualNetwork(unsigned netId) const;
68
69    int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
70    int createVirtualNetwork(unsigned netId, bool hasDns, bool secure) WARN_UNUSED_RESULT;
71    int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT;
72
73    int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
74    int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
75
76    Permission getPermissionForUser(uid_t uid) const;
77    void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
78    int checkUserNetworkAccess(uid_t uid, unsigned netId) const;
79    int setPermissionForNetworks(Permission permission,
80                                 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT;
81
82    int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
83    int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
84
85    // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
86    // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
87    //
88    // Routes are added to tables determined by the interface, so only |interface| is actually used.
89    // |netId| is given only to sanity check that the interface has the correct netId.
90    int addRoute(unsigned netId, const char* interface, const char* destination,
91                 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
92    int removeRoute(unsigned netId, const char* interface, const char* destination,
93                    const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
94
95    bool canProtect(uid_t uid) const;
96    void allowProtect(const std::vector<uid_t>& uids);
97    void denyProtect(const std::vector<uid_t>& uids);
98
99    void dump(DumpWriter& dw);
100
101private:
102    bool isValidNetwork(unsigned netId) const;
103    Network* getNetworkLocked(unsigned netId) const;
104    VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const;
105    Permission getPermissionForUserLocked(uid_t uid) const;
106    int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const;
107
108    int modifyRoute(unsigned netId, const char* interface, const char* destination,
109                    const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
110    int modifyFallthroughLocked(unsigned vpnNetId, bool add) WARN_UNUSED_RESULT;
111
112    class DelegateImpl;
113    DelegateImpl* const mDelegateImpl;
114
115    // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers and mProtectableUsers.
116    mutable android::RWLock mRWLock;
117    unsigned mDefaultNetId;
118    std::map<unsigned, Network*> mNetworks;  // Map keys are NetIds.
119    std::map<uid_t, Permission> mUsers;
120    std::set<uid_t> mProtectableUsers;
121};
122
123}  // namespace net
124}  // namespace android
125
126#endif  // NETD_SERVER_NETWORK_CONTROLLER_H
127