1 /*
2  * Copyright (C) 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #pragma once
18 
19 #include <android-base/thread_annotations.h>
20 #include <android/multinetwork.h>
21 
22 
23 #include "NetdConstants.h"
24 #include "Permission.h"
25 #include "android/net/INetd.h"
26 #include "netdutils/DumpWriter.h"
27 
28 #include <sys/types.h>
29 #include <list>
30 #include <map>
31 #include <set>
32 #include <shared_mutex>
33 #include <unordered_map>
34 #include <unordered_set>
35 #include <vector>
36 
37 struct android_net_context;
38 
39 namespace android::net {
40 
41 typedef std::shared_lock<std::shared_mutex> ScopedRLock;
42 typedef std::lock_guard<std::shared_mutex> ScopedWLock;
43 
44 constexpr uint32_t kHandleMagic = 0xcafed00d;
45 
46 // Utility to convert from netId to net_handle_t. Doing this here as opposed to exporting
47 // from net.c as it may have NDK implications. Besides no conversion available in net.c for
48 // obtaining handle given netId.
49 // TODO: Use getnetidfromhandle() in net.c.
netHandleToNetId(net_handle_t fromNetHandle)50 static inline unsigned netHandleToNetId(net_handle_t fromNetHandle) {
51     const uint32_t k32BitMask = 0xffffffff;
52     // This value MUST be kept in sync with the corresponding value in
53     // the android.net.Network#getNetworkHandle() implementation.
54 
55     // Check for minimum acceptable version of the API in the low bits.
56     if (fromNetHandle != NETWORK_UNSPECIFIED &&
57         (fromNetHandle & k32BitMask) != kHandleMagic) {
58         return 0;
59     }
60 
61     return ((fromNetHandle >> (CHAR_BIT * sizeof(k32BitMask))) & k32BitMask);
62 }
63 
64 // Utility to convert from nethandle to netid, keep in sync with getNetworkHandle
65 // in Network.java.
netIdToNetHandle(unsigned fromNetId)66 static inline net_handle_t netIdToNetHandle(unsigned fromNetId) {
67     if (!fromNetId) {
68         return NETWORK_UNSPECIFIED;
69     }
70     return (((net_handle_t)fromNetId << 32) | kHandleMagic);
71 }
72 
73 class Network;
74 class UidRanges;
75 class VirtualNetwork;
76 
77 /*
78  * Keeps track of default, per-pid, and per-uid-range network selection, as
79  * well as the mark associated with each network. Networks are identified
80  * by netid. In all set* commands netid == 0 means "unspecified" and is
81  * equivalent to clearing the mapping.
82  */
83 class NetworkController {
84 public:
85     // NetIds 52..98 are reserved for future use.
86     static constexpr int MIN_OEM_ID = 1;
87     static constexpr int MAX_OEM_ID = 50;
88     static constexpr int LOCAL_NET_ID = INetd::LOCAL_NET_ID;
89     static constexpr int DUMMY_NET_ID = 51;
90 
91     // Route mode for modify route
92     enum RouteOperation { ROUTE_ADD, ROUTE_UPDATE, ROUTE_REMOVE };
93 
94     NetworkController();
95 
96     unsigned getDefaultNetwork() const;
97     [[nodiscard]] int setDefaultNetwork(unsigned netId);
98 
99     unsigned getNetworkForUser(uid_t uid) const;
100     unsigned getNetworkForConnect(uid_t uid) const;
101     void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const;
102     unsigned getNetworkForInterface(const char* interface) const;
103     bool isVirtualNetwork(unsigned netId) const;
104 
105     [[nodiscard]] int createPhysicalNetwork(unsigned netId, Permission permission);
106     [[nodiscard]] int createPhysicalOemNetwork(Permission permission, unsigned* netId);
107     [[nodiscard]] int createVirtualNetwork(unsigned netId, bool secure);
108     [[nodiscard]] int destroyNetwork(unsigned netId);
109 
110     [[nodiscard]] int addInterfaceToNetwork(unsigned netId, const char* interface);
111     [[nodiscard]] int removeInterfaceFromNetwork(unsigned netId, const char* interface);
112 
113     Permission getPermissionForUser(uid_t uid) const;
114     void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
115     int checkUserNetworkAccess(uid_t uid, unsigned netId) const;
116     [[nodiscard]] int setPermissionForNetworks(Permission permission,
117                                                const std::vector<unsigned>& netIds);
118 
119     [[nodiscard]] int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges);
120     [[nodiscard]] int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges);
121 
122     // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
123     // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
124     //
125     // Routes are added to tables determined by the interface, so only |interface| is actually used.
126     // |netId| is given only to sanity check that the interface has the correct netId.
127     [[nodiscard]] int addRoute(unsigned netId, const char* interface, const char* destination,
128                                const char* nexthop, bool legacy, uid_t uid, int mtu);
129     [[nodiscard]] int updateRoute(unsigned netId, const char* interface, const char* destination,
130                                   const char* nexthop, bool legacy, uid_t uid, int mtu);
131     [[nodiscard]] int removeRoute(unsigned netId, const char* interface, const char* destination,
132                                   const char* nexthop, bool legacy, uid_t uid);
133 
134     // Notes that the specified address has appeared on the specified interface.
135     void addInterfaceAddress(unsigned ifIndex, const char* address);
136     // Notes that the specified address has been removed from the specified interface.
137     // Returns true if we should destroy sockets on this address.
138     bool removeInterfaceAddress(unsigned ifIndex, const char* address);
139 
140     bool canProtect(uid_t uid) const;
141     void allowProtect(const std::vector<uid_t>& uids);
142     void denyProtect(const std::vector<uid_t>& uids);
143 
144     void dump(netdutils::DumpWriter& dw);
145 
146   private:
147     bool isValidNetworkLocked(unsigned netId) const;
148     Network* getNetworkLocked(unsigned netId) const;
149 
150     // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId|
151     // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the
152     // fwmark value to set on the socket when performing the DNS request.
153     uint32_t getNetworkForDnsLocked(unsigned* netId, uid_t uid) const;
154 
155     unsigned getNetworkForUserLocked(uid_t uid) const;
156     unsigned getNetworkForConnectLocked(uid_t uid) const;
157     unsigned getNetworkForInterfaceLocked(const char* interface) const;
158     bool canProtectLocked(uid_t uid) const;
159     bool isVirtualNetworkLocked(unsigned netId) const;
160     VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const;
161     Permission getPermissionForUserLocked(uid_t uid) const;
162     int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const;
163     [[nodiscard]] int createPhysicalNetworkLocked(unsigned netId, Permission permission);
164 
165     [[nodiscard]] int modifyRoute(unsigned netId, const char* interface, const char* destination,
166                                   const char* nexthop, RouteOperation op, bool legacy, uid_t uid,
167                                   int mtu);
168     [[nodiscard]] int modifyFallthroughLocked(unsigned vpnNetId, bool add);
169     void updateTcpSocketMonitorPolling();
170 
171     class DelegateImpl;
172     DelegateImpl* const mDelegateImpl;
173 
174     // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers, mProtectableUsers,
175     // mIfindexToLastNetId and mAddressToIfindices.
176     mutable std::shared_mutex mRWLock;
177     unsigned mDefaultNetId;
178     std::map<unsigned, Network*> mNetworks;  // Map keys are NetIds.
179     std::map<uid_t, Permission> mUsers;
180     std::set<uid_t> mProtectableUsers;
181     // Map interface (ifIndex) to its current NetId, or the last NetId if the interface was removed
182     // from the network and not added to another network. This state facilitates the interface to
183     // NetId lookup during RTM_DELADDR (NetworkController::removeInterfaceAddress), when the
184     // interface in question might already have been removed from the network.
185     // An interface is added to this map when it is added to a network and removed from this map
186     // when its network is destroyed.
187     std::unordered_map<unsigned, unsigned> mIfindexToLastNetId;
188     // Map IP address to the list of active interfaces (ifIndex) that have that address.
189     // Also contains IP addresses configured on interfaces that have not been added to any network.
190     // TODO: Does not track IP addresses present when netd is started or restarts after a crash.
191     // This is not a problem for its intended use (tracking IP addresses on VPN interfaces), but
192     // we should fix it.
193     std::unordered_map<std::string, std::unordered_set<unsigned>> mAddressToIfindices;
194 
195 };
196 
197 }  // namespace android::net
198