NetdNativeService.cpp revision 563d98b27d02a1d694fc4ed82b5554fd534c9daf
1e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti/** 2e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * Copyright (c) 2016, The Android Open Source Project 3e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * 4e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * Licensed under the Apache License, Version 2.0 (the "License"); 5e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * you may not use this file except in compliance with the License. 6e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * You may obtain a copy of the License at 7e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * 8e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * http://www.apache.org/licenses/LICENSE-2.0 9e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * 10e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * Unless required by applicable law or agreed to in writing, software 11e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * distributed under the License is distributed on an "AS IS" BASIS, 12e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * See the License for the specific language governing permissions and 14e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti * limitations under the License. 15e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti */ 16e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 17e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#define LOG_TAG "Netd" 18e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 1989faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti#include <vector> 2089faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti 21e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include <android-base/stringprintf.h> 22e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include <cutils/log.h> 23e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include <utils/Errors.h> 24e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 25e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include <binder/IPCThreadState.h> 26e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include <binder/IServiceManager.h> 27e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include "android/net/BnNetd.h" 28e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 2989faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti#include "Controllers.h" 302d3a163433c435ff053402ae8965f8602c7ac6daErik Kline#include "DumpWriter.h" 31e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include "NetdConstants.h" 32e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#include "NetdNativeService.h" 33b8087363143050d214d48e5620a330776ca95a69Robin Lee#include "RouteController.h" 34563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti#include "SockDiag.h" 35b8087363143050d214d48e5620a330776ca95a69Robin Lee#include "UidRanges.h" 36e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 37e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colittiusing android::base::StringPrintf; 38e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 39e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colittinamespace android { 40e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colittinamespace net { 41e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 42e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colittinamespace { 43e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 44e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitticonst char CONNECTIVITY_INTERNAL[] = "android.permission.CONNECTIVITY_INTERNAL"; 452d3a163433c435ff053402ae8965f8602c7ac6daErik Klineconst char DUMP[] = "android.permission.DUMP"; 46e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 47e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colittibinder::Status checkPermission(const char *permission) { 48e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti pid_t pid; 49e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti uid_t uid; 50e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 51e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti if (checkCallingPermission(String16(permission), (int32_t *) &pid, (int32_t *) &uid)) { 52e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti return binder::Status::ok(); 53e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti } else { 54e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti auto err = StringPrintf("UID %d / PID %d lacks permission %s", uid, pid, permission); 55e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti return binder::Status::fromExceptionCode(binder::Status::EX_SECURITY, String8(err.c_str())); 56e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti } 57e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti} 58e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 59e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti#define ENFORCE_PERMISSION(permission) { \ 60e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti binder::Status status = checkPermission((permission)); \ 61e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti if (!status.isOk()) { \ 62e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti return status; \ 63e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti } \ 64e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti} 65e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 6689faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti#define NETD_LOCKING_RPC(permission, lock) \ 6789faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti ENFORCE_PERMISSION(permission); \ 6889faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti android::RWLock::AutoWLock _lock(lock); 6989faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti 7089faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti#define NETD_BIG_LOCK_RPC(permission) NETD_LOCKING_RPC((permission), gBigNetdLock) 71e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti} // namespace 72e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 73e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 74e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colittistatus_t NetdNativeService::start() { 75e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti IPCThreadState::self()->disableBackgroundScheduling(true); 76e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti status_t ret = BinderService<NetdNativeService>::publish(); 77e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti if (ret != android::OK) { 78e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti return ret; 79e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti } 80e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti sp<ProcessState> ps(ProcessState::self()); 81e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti ps->startThreadPool(); 82e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti ps->giveThreadPoolName(); 83e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti return android::OK; 84e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti} 85e4851dede1dd24bbd80ffd30c4e89c7753fed121Lorenzo Colitti 862d3a163433c435ff053402ae8965f8602c7ac6daErik Klinestatus_t NetdNativeService::dump(int fd, const Vector<String16> & /* args */) { 872d3a163433c435ff053402ae8965f8602c7ac6daErik Kline const binder::Status dump_permission = checkPermission(DUMP); 882d3a163433c435ff053402ae8965f8602c7ac6daErik Kline if (!dump_permission.isOk()) { 892d3a163433c435ff053402ae8965f8602c7ac6daErik Kline const String8 msg(dump_permission.toString8()); 902d3a163433c435ff053402ae8965f8602c7ac6daErik Kline write(fd, msg.string(), msg.size()); 912d3a163433c435ff053402ae8965f8602c7ac6daErik Kline return PERMISSION_DENIED; 922d3a163433c435ff053402ae8965f8602c7ac6daErik Kline } 932d3a163433c435ff053402ae8965f8602c7ac6daErik Kline 942d3a163433c435ff053402ae8965f8602c7ac6daErik Kline // This method does not grab any locks. If individual classes need locking 952d3a163433c435ff053402ae8965f8602c7ac6daErik Kline // their dump() methods MUST handle locking appropriately. 962d3a163433c435ff053402ae8965f8602c7ac6daErik Kline DumpWriter dw(fd); 972d3a163433c435ff053402ae8965f8602c7ac6daErik Kline dw.blankline(); 982d3a163433c435ff053402ae8965f8602c7ac6daErik Kline gCtls->netCtrl.dump(dw); 992d3a163433c435ff053402ae8965f8602c7ac6daErik Kline dw.blankline(); 1002d3a163433c435ff053402ae8965f8602c7ac6daErik Kline 1012d3a163433c435ff053402ae8965f8602c7ac6daErik Kline return NO_ERROR; 1022d3a163433c435ff053402ae8965f8602c7ac6daErik Kline} 1032d3a163433c435ff053402ae8965f8602c7ac6daErik Kline 104e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colittibinder::Status NetdNativeService::isAlive(bool *alive) { 10589faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti NETD_BIG_LOCK_RPC(CONNECTIVITY_INTERNAL); 106e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 107e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti *alive = true; 108e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti return binder::Status::ok(); 109e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti} 110e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti 11189faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colittibinder::Status NetdNativeService::firewallReplaceUidChain(const android::String16& chainName, 11289faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti bool isWhitelist, const std::vector<int32_t>& uids, bool *ret) { 11389faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti NETD_LOCKING_RPC(CONNECTIVITY_INTERNAL, gCtls->firewallCtrl.lock); 11489faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti 11589faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti android::String8 name = android::String8(chainName); 11689faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti int err = gCtls->firewallCtrl.replaceUidChain(name.string(), isWhitelist, uids); 11789faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti *ret = (err == 0); 11889faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti return binder::Status::ok(); 119dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colitti} 120dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colitti 121dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colittibinder::Status NetdNativeService::bandwidthEnableDataSaver(bool enable, bool *ret) { 122dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colitti NETD_LOCKING_RPC(CONNECTIVITY_INTERNAL, gCtls->bandwidthCtrl.lock); 12389faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti 124dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colitti int err = gCtls->bandwidthCtrl.enableDataSaver(enable); 125dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colitti *ret = (err == 0); 126dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colitti return binder::Status::ok(); 12789faa349525ad1110b6fa3f2149e6ef825c65662Lorenzo Colitti} 128dedd271d9961dbe8b99ffa7d54ffd63ac326f866Lorenzo Colitti 129b8087363143050d214d48e5620a330776ca95a69Robin Leebinder::Status NetdNativeService::networkRejectNonSecureVpn(bool add, 130b8087363143050d214d48e5620a330776ca95a69Robin Lee const std::vector<UidRange>& uidRangeArray) { 131b8087363143050d214d48e5620a330776ca95a69Robin Lee // TODO: elsewhere RouteController is only used from the tethering and network controllers, so 132b8087363143050d214d48e5620a330776ca95a69Robin Lee // it should be possible to use the same lock as NetworkController. However, every call through 133b8087363143050d214d48e5620a330776ca95a69Robin Lee // the CommandListener "network" command will need to hold this lock too, not just the ones that 134b8087363143050d214d48e5620a330776ca95a69Robin Lee // read/modify network internal state (that is sufficient for ::dump() because it doesn't 135b8087363143050d214d48e5620a330776ca95a69Robin Lee // look at routes, but it's not enough here). 136b8087363143050d214d48e5620a330776ca95a69Robin Lee NETD_BIG_LOCK_RPC(CONNECTIVITY_INTERNAL); 137b8087363143050d214d48e5620a330776ca95a69Robin Lee 138563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti UidRanges uidRanges(uidRangeArray); 139b8087363143050d214d48e5620a330776ca95a69Robin Lee 140b8087363143050d214d48e5620a330776ca95a69Robin Lee int err; 141b8087363143050d214d48e5620a330776ca95a69Robin Lee if (add) { 142b8087363143050d214d48e5620a330776ca95a69Robin Lee err = RouteController::addUsersToRejectNonSecureNetworkRule(uidRanges); 143b8087363143050d214d48e5620a330776ca95a69Robin Lee } else { 144b8087363143050d214d48e5620a330776ca95a69Robin Lee err = RouteController::removeUsersFromRejectNonSecureNetworkRule(uidRanges); 145b8087363143050d214d48e5620a330776ca95a69Robin Lee } 146b8087363143050d214d48e5620a330776ca95a69Robin Lee 147b8087363143050d214d48e5620a330776ca95a69Robin Lee if (err != 0) { 148b8087363143050d214d48e5620a330776ca95a69Robin Lee return binder::Status::fromServiceSpecificError(-err, 149b8087363143050d214d48e5620a330776ca95a69Robin Lee String8::format("RouteController error: %s", strerror(-err))); 150b8087363143050d214d48e5620a330776ca95a69Robin Lee } 151b8087363143050d214d48e5620a330776ca95a69Robin Lee return binder::Status::ok(); 152b8087363143050d214d48e5620a330776ca95a69Robin Lee} 153b8087363143050d214d48e5620a330776ca95a69Robin Lee 154563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colittibinder::Status NetdNativeService::socketDestroy(const std::vector<UidRange>& uids, 155563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti const std::vector<int32_t>& skipUids) { 156563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti 157563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti ENFORCE_PERMISSION(CONNECTIVITY_INTERNAL); 158563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti 159563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti SockDiag sd; 160563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti if (!sd.open()) { 161563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti return binder::Status::fromServiceSpecificError(EIO, 162563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti String8("Could not open SOCK_DIAG socket")); 163563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti } 164563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti 165563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti UidRanges uidRanges(uids); 166563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti int err = sd.destroySockets(uidRanges, std::set<uid_t>(skipUids.begin(), skipUids.end())); 167563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti 168563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti if (err) { 169563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti return binder::Status::fromServiceSpecificError(-err, 170563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti String8::format("destroySockets: %s", strerror(-err))); 171563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti } 172563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti 173563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti return binder::Status::ok(); 174563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti} 175563d98b27d02a1d694fc4ed82b5554fd534c9dafLorenzo Colitti 176e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti} // namespace net 177e4d626ea35b7a402388b524e2feafc81e6387697Lorenzo Colitti} // namespace android 178