blob: ad9cfbe10e6287f97ff7bd22e99f46b4d2194b2f [file] [log] [blame]
Wayne Ma0ea3bdc2022-01-12 01:12:11 +08001/*
2 * Copyright (C) 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17package com.android.server;
18
Junyu Lai29b7b632023-08-23 17:35:17 +080019import static android.net.BpfNetMapsConstants.CONFIGURATION_MAP_PATH;
20import static android.net.BpfNetMapsConstants.COOKIE_TAG_MAP_PATH;
21import static android.net.BpfNetMapsConstants.CURRENT_STATS_MAP_CONFIGURATION_KEY;
Ken Chen24330172023-10-20 13:02:14 +080022import static android.net.BpfNetMapsConstants.DATA_SAVER_DISABLED;
23import static android.net.BpfNetMapsConstants.DATA_SAVER_ENABLED;
24import static android.net.BpfNetMapsConstants.DATA_SAVER_ENABLED_KEY;
25import static android.net.BpfNetMapsConstants.DATA_SAVER_ENABLED_MAP_PATH;
Junyu Lai29b7b632023-08-23 17:35:17 +080026import static android.net.BpfNetMapsConstants.HAPPY_BOX_MATCH;
27import static android.net.BpfNetMapsConstants.IIF_MATCH;
Motomu Utsumi77b49992023-10-23 17:06:12 +090028import static android.net.BpfNetMapsConstants.INGRESS_DISCARD_MAP_PATH;
Junyu Lai29b7b632023-08-23 17:35:17 +080029import static android.net.BpfNetMapsConstants.LOCKDOWN_VPN_MATCH;
30import static android.net.BpfNetMapsConstants.PENALTY_BOX_MATCH;
31import static android.net.BpfNetMapsConstants.UID_OWNER_MAP_PATH;
32import static android.net.BpfNetMapsConstants.UID_PERMISSION_MAP_PATH;
33import static android.net.BpfNetMapsConstants.UID_RULES_CONFIGURATION_KEY;
Junyu Lai626045a2023-08-28 18:49:44 +080034import static android.net.BpfNetMapsUtils.PRE_T;
Junyu Lai29b7b632023-08-23 17:35:17 +080035import static android.net.BpfNetMapsUtils.getMatchByFirewallChain;
Junyu Laie0031522023-08-29 18:32:57 +080036import static android.net.BpfNetMapsUtils.isFirewallAllowList;
Junyu Lai29b7b632023-08-23 17:35:17 +080037import static android.net.BpfNetMapsUtils.matchToString;
Motomu Utsumi40230be2022-07-05 03:27:35 +000038import static android.net.ConnectivityManager.FIREWALL_RULE_ALLOW;
39import static android.net.ConnectivityManager.FIREWALL_RULE_DENY;
Motomu Utsumi65271202022-07-05 08:21:41 +000040import static android.net.INetd.PERMISSION_INTERNET;
Motomu Utsumi310850f2022-09-02 12:48:20 +090041import static android.net.INetd.PERMISSION_NONE;
Motomu Utsumi65271202022-07-05 08:21:41 +000042import static android.net.INetd.PERMISSION_UNINSTALLED;
Motomu Utsumi310850f2022-09-02 12:48:20 +090043import static android.net.INetd.PERMISSION_UPDATE_DEVICE_STATS;
Motomu Utsumi18b287d2022-06-19 10:45:30 +000044import static android.system.OsConstants.EINVAL;
Motomu Utsumi5f52f4f2022-06-30 03:31:09 +000045import static android.system.OsConstants.ENODEV;
Motomu Utsumi60ed3be2022-06-24 10:38:57 +000046import static android.system.OsConstants.ENOENT;
Ken Chene6d511f2022-01-25 11:10:42 +080047import static android.system.OsConstants.EOPNOTSUPP;
48
Motomu Utsumi166f9662022-09-01 10:35:29 +090049import static com.android.server.ConnectivityStatsLog.NETWORK_BPF_MAP_INFO;
50
51import android.app.StatsManager;
Motomu Utsumif688eeb2022-07-22 03:47:35 +000052import android.content.Context;
Junyu Lai626045a2023-08-28 18:49:44 +080053import android.net.BpfNetMapsReader;
Wayne Ma2fde98c2022-01-17 18:04:05 +080054import android.net.INetd;
Junyu Lai626045a2023-08-28 18:49:44 +080055import android.net.UidOwnerValue;
Maciej Żenczykowskie7da6fd2023-07-18 14:19:19 +000056import android.os.Build;
Wayne Ma2fde98c2022-01-17 18:04:05 +080057import android.os.RemoteException;
Wayne Ma0ea3bdc2022-01-12 01:12:11 +080058import android.os.ServiceSpecificException;
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +000059import android.system.ErrnoException;
Wayne Ma0ea3bdc2022-01-12 01:12:11 +080060import android.system.Os;
Motomu Utsumi1a477b02022-08-23 15:14:56 +090061import android.util.ArraySet;
Motomu Utsumi310850f2022-09-02 12:48:20 +090062import android.util.IndentingPrintWriter;
Wayne Ma0ea3bdc2022-01-12 01:12:11 +080063import android.util.Log;
Motomu Utsumi310850f2022-09-02 12:48:20 +090064import android.util.Pair;
Motomu Utsumi166f9662022-09-01 10:35:29 +090065import android.util.StatsEvent;
Wayne Ma0ea3bdc2022-01-12 01:12:11 +080066
Maciej Żenczykowskie7da6fd2023-07-18 14:19:19 +000067import androidx.annotation.RequiresApi;
68
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +000069import com.android.internal.annotations.VisibleForTesting;
Motomu Utsumi166f9662022-09-01 10:35:29 +090070import com.android.modules.utils.BackgroundThread;
Motomu Utsumi310850f2022-09-02 12:48:20 +090071import com.android.net.module.util.BpfDump;
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +000072import com.android.net.module.util.BpfMap;
Motomu Utsumi73599a52022-08-24 11:59:21 +090073import com.android.net.module.util.IBpfMap;
Motomu Utsumi166f9662022-09-01 10:35:29 +090074import com.android.net.module.util.Struct;
Maciej Żenczykowski785793f2022-09-17 02:35:20 +000075import com.android.net.module.util.Struct.S32;
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +000076import com.android.net.module.util.Struct.U32;
Motomu Utsumi65271202022-07-05 08:21:41 +000077import com.android.net.module.util.Struct.U8;
Motomu Utsumib9548862022-09-06 16:30:05 +090078import com.android.net.module.util.bpf.CookieTagMapKey;
79import com.android.net.module.util.bpf.CookieTagMapValue;
Motomu Utsumi77b49992023-10-23 17:06:12 +090080import com.android.net.module.util.bpf.IngressDiscardKey;
81import com.android.net.module.util.bpf.IngressDiscardValue;
Ken Chenf5f51332022-01-28 10:08:16 +080082
Ken Chene6d511f2022-01-25 11:10:42 +080083import java.io.FileDescriptor;
84import java.io.IOException;
Motomu Utsumi77b49992023-10-23 17:06:12 +090085import java.net.InetAddress;
Motomu Utsumi310850f2022-09-02 12:48:20 +090086import java.util.Arrays;
Motomu Utsumi166f9662022-09-01 10:35:29 +090087import java.util.List;
Motomu Utsumi9be2ea02022-07-05 06:14:59 +000088import java.util.Set;
Motomu Utsumi310850f2022-09-02 12:48:20 +090089import java.util.StringJoiner;
Ken Chene6d511f2022-01-25 11:10:42 +080090
Wayne Ma0ea3bdc2022-01-12 01:12:11 +080091/**
92 * BpfNetMaps is responsible for providing traffic controller relevant functionality.
93 *
94 * {@hide}
95 */
96public class BpfNetMaps {
Motomu Utsumi305975f2022-06-27 09:24:32 +000097 static {
98 if (!PRE_T) {
99 System.loadLibrary("service-connectivity");
100 }
101 }
102
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800103 private static final String TAG = "BpfNetMaps";
Wayne Ma2fde98c2022-01-17 18:04:05 +0800104 private final INetd mNetd;
Motomu Utsumi5f52f4f2022-06-30 03:31:09 +0000105 private final Dependencies mDeps;
Ken Chenf5f51332022-01-28 10:08:16 +0800106 // Use legacy netd for releases before T.
Ken Chenf5f51332022-01-28 10:08:16 +0800107 private static boolean sInitialized = false;
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800108
Motomu Utsumi18b287d2022-06-19 10:45:30 +0000109 // Lock for sConfigurationMap entry for UID_RULES_CONFIGURATION_KEY.
110 // This entry is not accessed by others.
111 // BpfNetMaps acquires this lock while sequence of read, modify, and write.
112 private static final Object sUidRulesConfigBpfMapLock = new Object();
113
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000114 // Lock for sConfigurationMap entry for CURRENT_STATS_MAP_CONFIGURATION_KEY.
115 // BpfNetMaps acquires this lock while sequence of read, modify, and write.
116 // BpfNetMaps is an only writer of this entry.
117 private static final Object sCurrentStatsMapConfigLock = new Object();
118
Motomu Utsumiba2fa152022-07-25 01:57:23 +0000119 private static final long UID_RULES_DEFAULT_CONFIGURATION = 0;
120 private static final long STATS_SELECT_MAP_A = 0;
121 private static final long STATS_SELECT_MAP_B = 1;
122
Maciej Żenczykowskidc886222022-09-17 06:09:22 +0000123 private static IBpfMap<S32, U32> sConfigurationMap = null;
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000124 // BpfMap for UID_OWNER_MAP_PATH. This map is not accessed by others.
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000125 private static IBpfMap<S32, UidOwnerValue> sUidOwnerMap = null;
126 private static IBpfMap<S32, U8> sUidPermissionMap = null;
Motomu Utsumib9548862022-09-06 16:30:05 +0900127 private static IBpfMap<CookieTagMapKey, CookieTagMapValue> sCookieTagMap = null;
Ken Chen24330172023-10-20 13:02:14 +0800128 // TODO: Add BOOL class and replace U8?
129 private static IBpfMap<S32, U8> sDataSaverEnabledMap = null;
Motomu Utsumi77b49992023-10-23 17:06:12 +0900130 private static IBpfMap<IngressDiscardKey, IngressDiscardValue> sIngressDiscardMap = null;
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000131
Motomu Utsumi310850f2022-09-02 12:48:20 +0900132 private static final List<Pair<Integer, String>> PERMISSION_LIST = Arrays.asList(
133 Pair.create(PERMISSION_INTERNET, "PERMISSION_INTERNET"),
134 Pair.create(PERMISSION_UPDATE_DEVICE_STATS, "PERMISSION_UPDATE_DEVICE_STATS")
135 );
136
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000137 /**
Motomu Utsumi305975f2022-06-27 09:24:32 +0000138 * Set configurationMap for test.
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000139 */
140 @VisibleForTesting
Maciej Żenczykowskidc886222022-09-17 06:09:22 +0000141 public static void setConfigurationMapForTest(IBpfMap<S32, U32> configurationMap) {
Motomu Utsumi305975f2022-06-27 09:24:32 +0000142 sConfigurationMap = configurationMap;
143 }
144
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000145 /**
146 * Set uidOwnerMap for test.
147 */
148 @VisibleForTesting
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000149 public static void setUidOwnerMapForTest(IBpfMap<S32, UidOwnerValue> uidOwnerMap) {
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000150 sUidOwnerMap = uidOwnerMap;
151 }
152
Motomu Utsumi65271202022-07-05 08:21:41 +0000153 /**
154 * Set uidPermissionMap for test.
155 */
156 @VisibleForTesting
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000157 public static void setUidPermissionMapForTest(IBpfMap<S32, U8> uidPermissionMap) {
Motomu Utsumi65271202022-07-05 08:21:41 +0000158 sUidPermissionMap = uidPermissionMap;
159 }
160
Motomu Utsumib9548862022-09-06 16:30:05 +0900161 /**
162 * Set cookieTagMap for test.
163 */
164 @VisibleForTesting
165 public static void setCookieTagMapForTest(
166 IBpfMap<CookieTagMapKey, CookieTagMapValue> cookieTagMap) {
167 sCookieTagMap = cookieTagMap;
168 }
169
Ken Chen24330172023-10-20 13:02:14 +0800170 /**
171 * Set dataSaverEnabledMap for test.
172 */
173 @VisibleForTesting
174 public static void setDataSaverEnabledMapForTest(IBpfMap<S32, U8> dataSaverEnabledMap) {
175 sDataSaverEnabledMap = dataSaverEnabledMap;
176 }
177
Motomu Utsumi77b49992023-10-23 17:06:12 +0900178 /**
179 * Set ingressDiscardMap for test.
180 */
181 @VisibleForTesting
182 public static void setIngressDiscardMapForTest(
183 IBpfMap<IngressDiscardKey, IngressDiscardValue> ingressDiscardMap) {
184 sIngressDiscardMap = ingressDiscardMap;
185 }
186
Maciej Żenczykowskidc886222022-09-17 06:09:22 +0000187 private static IBpfMap<S32, U32> getConfigurationMap() {
Motomu Utsumi305975f2022-06-27 09:24:32 +0000188 try {
189 return new BpfMap<>(
Maciej Żenczykowskidc886222022-09-17 06:09:22 +0000190 CONFIGURATION_MAP_PATH, BpfMap.BPF_F_RDWR, S32.class, U32.class);
Motomu Utsumi305975f2022-06-27 09:24:32 +0000191 } catch (ErrnoException e) {
192 throw new IllegalStateException("Cannot open netd configuration map", e);
193 }
194 }
195
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000196 private static IBpfMap<S32, UidOwnerValue> getUidOwnerMap() {
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000197 try {
198 return new BpfMap<>(
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000199 UID_OWNER_MAP_PATH, BpfMap.BPF_F_RDWR, S32.class, UidOwnerValue.class);
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000200 } catch (ErrnoException e) {
201 throw new IllegalStateException("Cannot open uid owner map", e);
202 }
203 }
204
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000205 private static IBpfMap<S32, U8> getUidPermissionMap() {
Motomu Utsumi65271202022-07-05 08:21:41 +0000206 try {
207 return new BpfMap<>(
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000208 UID_PERMISSION_MAP_PATH, BpfMap.BPF_F_RDWR, S32.class, U8.class);
Motomu Utsumi65271202022-07-05 08:21:41 +0000209 } catch (ErrnoException e) {
210 throw new IllegalStateException("Cannot open uid permission map", e);
211 }
212 }
213
Motomu Utsumib9548862022-09-06 16:30:05 +0900214 private static IBpfMap<CookieTagMapKey, CookieTagMapValue> getCookieTagMap() {
215 try {
216 return new BpfMap<>(COOKIE_TAG_MAP_PATH, BpfMap.BPF_F_RDWR,
217 CookieTagMapKey.class, CookieTagMapValue.class);
218 } catch (ErrnoException e) {
219 throw new IllegalStateException("Cannot open cookie tag map", e);
220 }
221 }
222
Ken Chen24330172023-10-20 13:02:14 +0800223 private static IBpfMap<S32, U8> getDataSaverEnabledMap() {
224 try {
225 return new BpfMap<>(
226 DATA_SAVER_ENABLED_MAP_PATH, BpfMap.BPF_F_RDWR, S32.class, U8.class);
227 } catch (ErrnoException e) {
228 throw new IllegalStateException("Cannot open data saver enabled map", e);
229 }
230 }
231
Motomu Utsumi77b49992023-10-23 17:06:12 +0900232 private static IBpfMap<IngressDiscardKey, IngressDiscardValue> getIngressDiscardMap() {
233 try {
234 return new BpfMap<>(INGRESS_DISCARD_MAP_PATH, BpfMap.BPF_F_RDWR,
235 IngressDiscardKey.class, IngressDiscardValue.class);
236 } catch (ErrnoException e) {
237 throw new IllegalStateException("Cannot open ingress discard map", e);
238 }
239 }
240
Motomu Utsumiba2fa152022-07-25 01:57:23 +0000241 private static void initBpfMaps() {
Motomu Utsumi305975f2022-06-27 09:24:32 +0000242 if (sConfigurationMap == null) {
243 sConfigurationMap = getConfigurationMap();
244 }
Motomu Utsumiba2fa152022-07-25 01:57:23 +0000245 try {
246 sConfigurationMap.updateEntry(UID_RULES_CONFIGURATION_KEY,
247 new U32(UID_RULES_DEFAULT_CONFIGURATION));
248 } catch (ErrnoException e) {
249 throw new IllegalStateException("Failed to initialize uid rules configuration", e);
250 }
251 try {
252 sConfigurationMap.updateEntry(CURRENT_STATS_MAP_CONFIGURATION_KEY,
253 new U32(STATS_SELECT_MAP_A));
254 } catch (ErrnoException e) {
255 throw new IllegalStateException("Failed to initialize current stats configuration", e);
256 }
257
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000258 if (sUidOwnerMap == null) {
259 sUidOwnerMap = getUidOwnerMap();
260 }
Motomu Utsumiba2fa152022-07-25 01:57:23 +0000261 try {
262 sUidOwnerMap.clear();
263 } catch (ErrnoException e) {
264 throw new IllegalStateException("Failed to initialize uid owner map", e);
265 }
Motomu Utsumi65271202022-07-05 08:21:41 +0000266
267 if (sUidPermissionMap == null) {
268 sUidPermissionMap = getUidPermissionMap();
269 }
Motomu Utsumib9548862022-09-06 16:30:05 +0900270
271 if (sCookieTagMap == null) {
272 sCookieTagMap = getCookieTagMap();
273 }
Ken Chen24330172023-10-20 13:02:14 +0800274
275 if (sDataSaverEnabledMap == null) {
276 sDataSaverEnabledMap = getDataSaverEnabledMap();
277 }
278 try {
279 sDataSaverEnabledMap.updateEntry(DATA_SAVER_ENABLED_KEY, new U8(DATA_SAVER_DISABLED));
280 } catch (ErrnoException e) {
281 throw new IllegalStateException("Failed to initialize data saver configuration", e);
282 }
Motomu Utsumi77b49992023-10-23 17:06:12 +0900283
284 if (sIngressDiscardMap == null) {
285 sIngressDiscardMap = getIngressDiscardMap();
286 }
287 try {
288 sIngressDiscardMap.clear();
289 } catch (ErrnoException e) {
290 throw new IllegalStateException("Failed to initialize ingress discard map", e);
291 }
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000292 }
293
Ken Chenf5f51332022-01-28 10:08:16 +0800294 /**
295 * Initializes the class if it is not already initialized. This method will open maps but not
296 * cause any other effects. This method may be called multiple times on any thread.
297 */
Motomu Utsumif688eeb2022-07-22 03:47:35 +0000298 private static synchronized void ensureInitialized(final Context context) {
Ken Chenf5f51332022-01-28 10:08:16 +0800299 if (sInitialized) return;
Motomu Utsumiba2fa152022-07-25 01:57:23 +0000300 initBpfMaps();
Ken Chenf5f51332022-01-28 10:08:16 +0800301 sInitialized = true;
Wayne Ma2fde98c2022-01-17 18:04:05 +0800302 }
303
Motomu Utsumi5f52f4f2022-06-30 03:31:09 +0000304 /**
305 * Dependencies of BpfNetMaps, for injection in tests.
306 */
307 @VisibleForTesting
308 public static class Dependencies {
309 /**
310 * Get interface index.
311 */
312 public int getIfIndex(final String ifName) {
313 return Os.if_nametoindex(ifName);
314 }
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000315
316 /**
Motomu Utsumi77b49992023-10-23 17:06:12 +0900317 * Get interface name
318 */
319 public String getIfName(final int ifIndex) {
320 return Os.if_indextoname(ifIndex);
321 }
322
323 /**
Maciej Żenczykowski7b8f4752023-11-07 17:04:15 -0800324 * Synchronously call in to kernel to synchronize_rcu()
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000325 */
Maciej Żenczykowski7b8f4752023-11-07 17:04:15 -0800326 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000327 public int synchronizeKernelRCU() {
Maciej Żenczykowski7b8f4752023-11-07 17:04:15 -0800328 try {
Maciej Żenczykowskic350db72023-11-08 23:40:50 -0800329 BpfMap.synchronizeKernelRCU();
Maciej Żenczykowski7b8f4752023-11-07 17:04:15 -0800330 } catch (ErrnoException e) {
Maciej Żenczykowski7b8f4752023-11-07 17:04:15 -0800331 return -e.errno;
332 }
333 return 0;
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000334 }
Motomu Utsumi166f9662022-09-01 10:35:29 +0900335
336 /**
337 * Build Stats Event for NETWORK_BPF_MAP_INFO atom
338 */
339 public StatsEvent buildStatsEvent(final int cookieTagMapSize, final int uidOwnerMapSize,
340 final int uidPermissionMapSize) {
341 return ConnectivityStatsLog.buildStatsEvent(NETWORK_BPF_MAP_INFO, cookieTagMapSize,
342 uidOwnerMapSize, uidPermissionMapSize);
343 }
Motomu Utsumi5f52f4f2022-06-30 03:31:09 +0000344 }
345
markchien49e944c2022-03-01 15:22:20 +0800346 /** Constructor used after T that doesn't need to use netd anymore. */
Junyu Lai626045a2023-08-28 18:49:44 +0800347 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Motomu Utsumif688eeb2022-07-22 03:47:35 +0000348 public BpfNetMaps(final Context context) {
349 this(context, null);
markchien49e944c2022-03-01 15:22:20 +0800350
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000351 if (PRE_T) throw new IllegalArgumentException("BpfNetMaps need to use netd before T");
markchien49e944c2022-03-01 15:22:20 +0800352 }
353
Motomu Utsumif688eeb2022-07-22 03:47:35 +0000354 public BpfNetMaps(final Context context, final INetd netd) {
355 this(context, netd, new Dependencies());
Motomu Utsumi5f52f4f2022-06-30 03:31:09 +0000356 }
357
358 @VisibleForTesting
Motomu Utsumif688eeb2022-07-22 03:47:35 +0000359 public BpfNetMaps(final Context context, final INetd netd, final Dependencies deps) {
Motomu Utsumi305975f2022-06-27 09:24:32 +0000360 if (!PRE_T) {
Motomu Utsumif688eeb2022-07-22 03:47:35 +0000361 ensureInitialized(context);
Motomu Utsumi305975f2022-06-27 09:24:32 +0000362 }
Wayne Ma2fde98c2022-01-17 18:04:05 +0800363 mNetd = netd;
Motomu Utsumi5f52f4f2022-06-30 03:31:09 +0000364 mDeps = deps;
Wayne Ma790c83e2022-01-13 10:35:05 +0800365 }
366
Ken Chenf5f51332022-01-28 10:08:16 +0800367 private void maybeThrow(final int err, final String msg) {
368 if (err != 0) {
369 throw new ServiceSpecificException(err, msg + ": " + Os.strerror(err));
370 }
371 }
372
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000373 private void throwIfPreT(final String msg) {
374 if (PRE_T) {
Motomu Utsumi18b287d2022-06-19 10:45:30 +0000375 throw new UnsupportedOperationException(msg);
376 }
377 }
378
Motomu Utsumi60ed3be2022-06-24 10:38:57 +0000379 private void removeRule(final int uid, final long match, final String caller) {
380 try {
381 synchronized (sUidOwnerMap) {
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000382 final UidOwnerValue oldMatch = sUidOwnerMap.getValue(new S32(uid));
Motomu Utsumi60ed3be2022-06-24 10:38:57 +0000383
384 if (oldMatch == null) {
385 throw new ServiceSpecificException(ENOENT,
386 "sUidOwnerMap does not have entry for uid: " + uid);
387 }
388
389 final UidOwnerValue newMatch = new UidOwnerValue(
390 (match == IIF_MATCH) ? 0 : oldMatch.iif,
391 oldMatch.rule & ~match
392 );
393
394 if (newMatch.rule == 0) {
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000395 sUidOwnerMap.deleteEntry(new S32(uid));
Motomu Utsumi60ed3be2022-06-24 10:38:57 +0000396 } else {
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000397 sUidOwnerMap.updateEntry(new S32(uid), newMatch);
Motomu Utsumi60ed3be2022-06-24 10:38:57 +0000398 }
399 }
400 } catch (ErrnoException e) {
401 throw new ServiceSpecificException(e.errno,
402 caller + " failed to remove rule: " + Os.strerror(e.errno));
403 }
404 }
405
Maciej Żenczykowski6c1c6bb2022-09-16 06:55:33 +0000406 private void addRule(final int uid, final long match, final int iif, final String caller) {
Motomu Utsumi389278e2022-06-28 07:05:05 +0000407 if (match != IIF_MATCH && iif != 0) {
408 throw new ServiceSpecificException(EINVAL,
409 "Non-interface match must have zero interface index");
410 }
411
412 try {
413 synchronized (sUidOwnerMap) {
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000414 final UidOwnerValue oldMatch = sUidOwnerMap.getValue(new S32(uid));
Motomu Utsumi389278e2022-06-28 07:05:05 +0000415
416 final UidOwnerValue newMatch;
417 if (oldMatch != null) {
418 newMatch = new UidOwnerValue(
419 (match == IIF_MATCH) ? iif : oldMatch.iif,
420 oldMatch.rule | match
421 );
422 } else {
423 newMatch = new UidOwnerValue(
424 iif,
425 match
426 );
427 }
Maciej Żenczykowski785793f2022-09-17 02:35:20 +0000428 sUidOwnerMap.updateEntry(new S32(uid), newMatch);
Motomu Utsumi389278e2022-06-28 07:05:05 +0000429 }
430 } catch (ErrnoException e) {
431 throw new ServiceSpecificException(e.errno,
432 caller + " failed to add rule: " + Os.strerror(e.errno));
433 }
434 }
435
436 private void addRule(final int uid, final long match, final String caller) {
437 addRule(uid, match, 0 /* iif */, caller);
438 }
439
Ken Chenf5f51332022-01-28 10:08:16 +0800440 /**
441 * Add naughty app bandwidth rule for specific app
442 *
443 * @param uid uid of target app
Ken Chenf5f51332022-01-28 10:08:16 +0800444 * @throws ServiceSpecificException in case of failure, with an error code indicating the
445 * cause of the failure.
446 */
Junyu Lai626045a2023-08-28 18:49:44 +0800447 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Lorenzo Colitti82244fd2022-03-04 23:15:00 +0900448 public void addNaughtyApp(final int uid) {
Motomu Utsumi389278e2022-06-28 07:05:05 +0000449 throwIfPreT("addNaughtyApp is not available on pre-T devices");
Motomu Utsumi55c282e2022-08-03 06:25:33 +0000450
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900451 addRule(uid, PENALTY_BOX_MATCH, "addNaughtyApp");
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800452 }
453
Ken Chenf5f51332022-01-28 10:08:16 +0800454 /**
455 * Remove naughty app bandwidth rule for specific app
456 *
457 * @param uid uid of target app
Ken Chenf5f51332022-01-28 10:08:16 +0800458 * @throws ServiceSpecificException in case of failure, with an error code indicating the
459 * cause of the failure.
460 */
Junyu Lai626045a2023-08-28 18:49:44 +0800461 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Lorenzo Colitti82244fd2022-03-04 23:15:00 +0900462 public void removeNaughtyApp(final int uid) {
Motomu Utsumi60ed3be2022-06-24 10:38:57 +0000463 throwIfPreT("removeNaughtyApp is not available on pre-T devices");
Motomu Utsumi878ce0d2022-08-03 06:22:42 +0000464
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900465 removeRule(uid, PENALTY_BOX_MATCH, "removeNaughtyApp");
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800466 }
467
Ken Chenf5f51332022-01-28 10:08:16 +0800468 /**
469 * Add nice app bandwidth rule for specific app
470 *
471 * @param uid uid of target app
Ken Chenf5f51332022-01-28 10:08:16 +0800472 * @throws ServiceSpecificException in case of failure, with an error code indicating the
473 * cause of the failure.
474 */
Junyu Lai626045a2023-08-28 18:49:44 +0800475 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Lorenzo Colitti82244fd2022-03-04 23:15:00 +0900476 public void addNiceApp(final int uid) {
Motomu Utsumi55630d02022-06-29 07:46:52 +0000477 throwIfPreT("addNiceApp is not available on pre-T devices");
Motomu Utsumi7f19df92022-08-03 06:29:59 +0000478
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900479 addRule(uid, HAPPY_BOX_MATCH, "addNiceApp");
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800480 }
481
Ken Chenf5f51332022-01-28 10:08:16 +0800482 /**
483 * Remove nice app bandwidth rule for specific app
484 *
485 * @param uid uid of target app
Ken Chenf5f51332022-01-28 10:08:16 +0800486 * @throws ServiceSpecificException in case of failure, with an error code indicating the
487 * cause of the failure.
488 */
Junyu Lai626045a2023-08-28 18:49:44 +0800489 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Lorenzo Colitti82244fd2022-03-04 23:15:00 +0900490 public void removeNiceApp(final int uid) {
Motomu Utsumi7392eb42022-06-29 03:53:03 +0000491 throwIfPreT("removeNiceApp is not available on pre-T devices");
Motomu Utsumi5f15f752022-08-03 06:27:51 +0000492
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900493 removeRule(uid, HAPPY_BOX_MATCH, "removeNiceApp");
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800494 }
495
Ken Chenf5f51332022-01-28 10:08:16 +0800496 /**
497 * Set target firewall child chain
498 *
499 * @param childChain target chain to enable
500 * @param enable whether to enable or disable child chain.
Motomu Utsumi18b287d2022-06-19 10:45:30 +0000501 * @throws UnsupportedOperationException if called on pre-T devices.
Ken Chenf5f51332022-01-28 10:08:16 +0800502 * @throws ServiceSpecificException in case of failure, with an error code indicating the
503 * cause of the failure.
504 */
Junyu Lai626045a2023-08-28 18:49:44 +0800505 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Lorenzo Colitti82244fd2022-03-04 23:15:00 +0900506 public void setChildChain(final int childChain, final boolean enable) {
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000507 throwIfPreT("setChildChain is not available on pre-T devices");
Motomu Utsumi18b287d2022-06-19 10:45:30 +0000508
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900509 final long match = getMatchByFirewallChain(childChain);
510 try {
511 synchronized (sUidRulesConfigBpfMapLock) {
512 final U32 config = sConfigurationMap.getValue(UID_RULES_CONFIGURATION_KEY);
513 final long newConfig = enable ? (config.val | match) : (config.val & ~match);
514 sConfigurationMap.updateEntry(UID_RULES_CONFIGURATION_KEY, new U32(newConfig));
Motomu Utsumi18b287d2022-06-19 10:45:30 +0000515 }
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900516 } catch (ErrnoException e) {
517 throw new ServiceSpecificException(e.errno,
518 "Unable to set child chain: " + Os.strerror(e.errno));
Motomu Utsumi18b287d2022-06-19 10:45:30 +0000519 }
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800520 }
521
522 /**
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000523 * Get the specified firewall chain's status.
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000524 *
525 * @param childChain target chain
526 * @return {@code true} if chain is enabled, {@code false} if chain is not enabled.
527 * @throws UnsupportedOperationException if called on pre-T devices.
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000528 * @throws ServiceSpecificException in case of failure, with an error code indicating the
529 * cause of the failure.
Junyu Lai626045a2023-08-28 18:49:44 +0800530 *
531 * @deprecated Use {@link BpfNetMapsReader#isChainEnabled} instead.
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000532 */
Junyu Lai626045a2023-08-28 18:49:44 +0800533 // TODO: Migrate the callers to use {@link BpfNetMapsReader#isChainEnabled} instead.
534 @Deprecated
535 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000536 public boolean isChainEnabled(final int childChain) {
Junyu Lai626045a2023-08-28 18:49:44 +0800537 return BpfNetMapsReader.isChainEnabled(sConfigurationMap, childChain);
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000538 }
539
Motomu Utsumi1a477b02022-08-23 15:14:56 +0900540 private Set<Integer> asSet(final int[] uids) {
541 final Set<Integer> uidSet = new ArraySet<>();
Motomu Utsumi77b49992023-10-23 17:06:12 +0900542 for (final int uid : uids) {
Motomu Utsumi1a477b02022-08-23 15:14:56 +0900543 uidSet.add(uid);
544 }
545 return uidSet;
546 }
547
Motomu Utsumibe3ff1e2022-06-08 10:05:07 +0000548 /**
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800549 * Replaces the contents of the specified UID-based firewall chain.
Motomu Utsumi9be2ea02022-07-05 06:14:59 +0000550 * Enables the chain for specified uids and disables the chain for non-specified uids.
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800551 *
Motomu Utsumi9be2ea02022-07-05 06:14:59 +0000552 * @param chain Target chain.
Ken Chenf5f51332022-01-28 10:08:16 +0800553 * @param uids The list of UIDs to allow/deny.
Motomu Utsumi9be2ea02022-07-05 06:14:59 +0000554 * @throws UnsupportedOperationException if called on pre-T devices.
555 * @throws IllegalArgumentException if {@code chain} is not a valid chain.
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800556 */
Junyu Lai626045a2023-08-28 18:49:44 +0800557 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Motomu Utsumi9be2ea02022-07-05 06:14:59 +0000558 public void replaceUidChain(final int chain, final int[] uids) {
559 throwIfPreT("replaceUidChain is not available on pre-T devices");
560
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900561 final long match;
562 try {
563 match = getMatchByFirewallChain(chain);
564 } catch (ServiceSpecificException e) {
565 // Throws IllegalArgumentException to keep the behavior of
566 // ConnectivityManager#replaceFirewallChain API
567 throw new IllegalArgumentException("Invalid firewall chain: " + chain);
568 }
569 final Set<Integer> uidSet = asSet(uids);
570 final Set<Integer> uidSetToRemoveRule = new ArraySet<>();
571 try {
572 synchronized (sUidOwnerMap) {
573 sUidOwnerMap.forEach((uid, config) -> {
574 // config could be null if there is a concurrent entry deletion.
575 // http://b/220084230. But sUidOwnerMap update must be done while holding a
576 // lock, so this should not happen.
577 if (config == null) {
578 Log.wtf(TAG, "sUidOwnerMap entry was deleted while holding a lock");
579 } else if (!uidSet.contains((int) uid.val) && (config.rule & match) != 0) {
580 uidSetToRemoveRule.add((int) uid.val);
581 }
582 });
Motomu Utsumic7c16852022-08-03 06:51:41 +0000583
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900584 for (final int uid : uidSetToRemoveRule) {
585 removeRule(uid, match, "replaceUidChain");
Motomu Utsumic7c16852022-08-03 06:51:41 +0000586 }
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900587 for (final int uid : uids) {
588 addRule(uid, match, "replaceUidChain");
589 }
Motomu Utsumic7c16852022-08-03 06:51:41 +0000590 }
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900591 } catch (ErrnoException | ServiceSpecificException e) {
592 Log.e(TAG, "replaceUidChain failed: " + e);
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800593 }
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800594 }
595
Ken Chenf5f51332022-01-28 10:08:16 +0800596 /**
597 * Set firewall rule for uid
598 *
599 * @param childChain target chain
600 * @param uid uid to allow/deny
601 * @param firewallRule either FIREWALL_RULE_ALLOW or FIREWALL_RULE_DENY
Ken Chenf5f51332022-01-28 10:08:16 +0800602 * @throws ServiceSpecificException in case of failure, with an error code indicating the
603 * cause of the failure.
604 */
Junyu Lai626045a2023-08-28 18:49:44 +0800605 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Lorenzo Colitti82244fd2022-03-04 23:15:00 +0900606 public void setUidRule(final int childChain, final int uid, final int firewallRule) {
Motomu Utsumi40230be2022-07-05 03:27:35 +0000607 throwIfPreT("setUidRule is not available on pre-T devices");
608
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900609 final long match = getMatchByFirewallChain(childChain);
610 final boolean isAllowList = isFirewallAllowList(childChain);
611 final boolean add = (firewallRule == FIREWALL_RULE_ALLOW && isAllowList)
612 || (firewallRule == FIREWALL_RULE_DENY && !isAllowList);
Motomu Utsumi40230be2022-07-05 03:27:35 +0000613
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900614 if (add) {
615 addRule(uid, match, "setUidRule");
Motomu Utsumi40230be2022-07-05 03:27:35 +0000616 } else {
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900617 removeRule(uid, match, "setUidRule");
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000618 }
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800619 }
620
621 /**
Motomu Utsumi56c412a2023-01-19 15:58:39 +0900622 * Get firewall rule of specified firewall chain on specified uid.
623 *
624 * @param childChain target chain
625 * @param uid target uid
626 * @return either FIREWALL_RULE_ALLOW or FIREWALL_RULE_DENY
627 * @throws UnsupportedOperationException if called on pre-T devices.
628 * @throws ServiceSpecificException in case of failure, with an error code indicating the
629 * cause of the failure.
Junyu Lai626045a2023-08-28 18:49:44 +0800630 *
631 * @deprecated use {@link BpfNetMapsReader#getUidRule} instead.
Motomu Utsumi56c412a2023-01-19 15:58:39 +0900632 */
Junyu Lai626045a2023-08-28 18:49:44 +0800633 // TODO: Migrate the callers to use {@link BpfNetMapsReader#getUidRule} instead.
Motomu Utsumi56c412a2023-01-19 15:58:39 +0900634 public int getUidRule(final int childChain, final int uid) {
Junyu Lai626045a2023-08-28 18:49:44 +0800635 return BpfNetMapsReader.getUidRule(sUidOwnerMap, childChain, uid);
Motomu Utsumi56c412a2023-01-19 15:58:39 +0900636 }
637
Motomu Utsumid44a33a2023-03-28 18:08:12 +0900638 private Set<Integer> getUidsMatchEnabled(final int childChain) throws ErrnoException {
639 final long match = getMatchByFirewallChain(childChain);
640 Set<Integer> uids = new ArraySet<>();
641 synchronized (sUidOwnerMap) {
642 sUidOwnerMap.forEach((uid, val) -> {
643 if (val == null) {
644 Log.wtf(TAG, "sUidOwnerMap entry was deleted while holding a lock");
645 } else {
646 if ((val.rule & match) != 0) {
647 uids.add(uid.val);
648 }
649 }
650 });
651 }
652 return uids;
653 }
654
655 /**
656 * Get uids that has FIREWALL_RULE_ALLOW on allowlist chain.
657 * Allowlist means the firewall denies all by default, uids must be explicitly allowed.
658 *
659 * Note that uids that has FIREWALL_RULE_DENY on allowlist chain can not be computed from the
660 * bpf map, since all the uids that does not have explicit FIREWALL_RULE_ALLOW rule in bpf map
661 * are determined to have FIREWALL_RULE_DENY.
662 *
663 * @param childChain target chain
664 * @return Set of uids
665 */
666 public Set<Integer> getUidsWithAllowRuleOnAllowListChain(final int childChain)
667 throws ErrnoException {
668 if (!isFirewallAllowList(childChain)) {
669 throw new IllegalArgumentException("getUidsWithAllowRuleOnAllowListChain is called with"
670 + " denylist chain:" + childChain);
671 }
672 // Corresponding match is enabled for uids that has FIREWALL_RULE_ALLOW on allowlist chain.
673 return getUidsMatchEnabled(childChain);
674 }
675
676 /**
677 * Get uids that has FIREWALL_RULE_DENY on denylist chain.
678 * Denylist means the firewall allows all by default, uids must be explicitly denyed
679 *
680 * Note that uids that has FIREWALL_RULE_ALLOW on denylist chain can not be computed from the
681 * bpf map, since all the uids that does not have explicit FIREWALL_RULE_DENY rule in bpf map
682 * are determined to have the FIREWALL_RULE_ALLOW.
683 *
684 * @param childChain target chain
685 * @return Set of uids
686 */
687 public Set<Integer> getUidsWithDenyRuleOnDenyListChain(final int childChain)
688 throws ErrnoException {
689 if (isFirewallAllowList(childChain)) {
690 throw new IllegalArgumentException("getUidsWithDenyRuleOnDenyListChain is called with"
691 + " allowlist chain:" + childChain);
692 }
693 // Corresponding match is enabled for uids that has FIREWALL_RULE_DENY on denylist chain.
694 return getUidsMatchEnabled(childChain);
695 }
696
Motomu Utsumi56c412a2023-01-19 15:58:39 +0900697 /**
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800698 * Add ingress interface filtering rules to a list of UIDs
699 *
700 * For a given uid, once a filtering rule is added, the kernel will only allow packets from the
701 * allowed interface and loopback to be sent to the list of UIDs.
702 *
703 * Calling this method on one or more UIDs with an existing filtering rule but a different
704 * interface name will result in the filtering rule being updated to allow the new interface
705 * instead. Otherwise calling this method will not affect existing rules set on other UIDs.
706 *
707 * @param ifName the name of the interface on which the filtering rules will allow packets to
Ken Chenf5f51332022-01-28 10:08:16 +0800708 * be received.
709 * @param uids an array of UIDs which the filtering rules will be set
710 * @throws RemoteException when netd has crashed.
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800711 * @throws ServiceSpecificException in case of failure, with an error code indicating the
Ken Chenf5f51332022-01-28 10:08:16 +0800712 * cause of the failure.
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800713 */
Ken Chenf5f51332022-01-28 10:08:16 +0800714 public void addUidInterfaceRules(final String ifName, final int[] uids) throws RemoteException {
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000715 if (PRE_T) {
Ken Chenf5f51332022-01-28 10:08:16 +0800716 mNetd.firewallAddUidInterfaceRules(ifName, uids);
Wayne Ma2fde98c2022-01-17 18:04:05 +0800717 return;
718 }
Motomu Utsumif794e7d2022-08-03 06:38:43 +0000719
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900720 // Null ifName is a wildcard to allow apps to receive packets on all interfaces and
721 // ifIndex is set to 0.
722 final int ifIndex;
723 if (ifName == null) {
724 ifIndex = 0;
Motomu Utsumi5f52f4f2022-06-30 03:31:09 +0000725 } else {
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900726 ifIndex = mDeps.getIfIndex(ifName);
727 if (ifIndex == 0) {
728 throw new ServiceSpecificException(ENODEV,
729 "Failed to get index of interface " + ifName);
730 }
731 }
732 for (final int uid : uids) {
733 try {
734 addRule(uid, IIF_MATCH, ifIndex, "addUidInterfaceRules");
735 } catch (ServiceSpecificException e) {
736 Log.e(TAG, "addRule failed uid=" + uid + " ifName=" + ifName + ", " + e);
737 }
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000738 }
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800739 }
740
741 /**
742 * Remove ingress interface filtering rules from a list of UIDs
743 *
744 * Clear the ingress interface filtering rules from the list of UIDs which were previously set
745 * by addUidInterfaceRules(). Ignore any uid which does not have filtering rule.
746 *
747 * @param uids an array of UIDs from which the filtering rules will be removed
Ken Chenf5f51332022-01-28 10:08:16 +0800748 * @throws RemoteException when netd has crashed.
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800749 * @throws ServiceSpecificException in case of failure, with an error code indicating the
Ken Chenf5f51332022-01-28 10:08:16 +0800750 * cause of the failure.
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800751 */
Ken Chenf5f51332022-01-28 10:08:16 +0800752 public void removeUidInterfaceRules(final int[] uids) throws RemoteException {
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000753 if (PRE_T) {
Ken Chenf5f51332022-01-28 10:08:16 +0800754 mNetd.firewallRemoveUidInterfaceRules(uids);
Wayne Ma2fde98c2022-01-17 18:04:05 +0800755 return;
756 }
Motomu Utsumi7dc657d2022-08-03 06:40:46 +0000757
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900758 for (final int uid : uids) {
759 try {
760 removeRule(uid, IIF_MATCH, "removeUidInterfaceRules");
761 } catch (ServiceSpecificException e) {
762 Log.e(TAG, "removeRule failed uid=" + uid + ", " + e);
Motomu Utsumi599c4e52022-06-30 03:37:18 +0000763 }
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000764 }
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800765 }
766
Ken Chenf5f51332022-01-28 10:08:16 +0800767 /**
Motomu Utsumi8b42e6d2022-05-19 06:23:40 +0000768 * Update lockdown rule for uid
769 *
770 * @param uid target uid to add/remove the rule
771 * @param add {@code true} to add the rule, {@code false} to remove the rule.
772 * @throws ServiceSpecificException in case of failure, with an error code indicating the
773 * cause of the failure.
774 */
Junyu Lai626045a2023-08-28 18:49:44 +0800775 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Motomu Utsumi8b42e6d2022-05-19 06:23:40 +0000776 public void updateUidLockdownRule(final int uid, final boolean add) {
Motomu Utsumi697b2992022-06-30 02:25:29 +0000777 throwIfPreT("updateUidLockdownRule is not available on pre-T devices");
Motomu Utsumib2d32b72022-08-03 06:31:58 +0000778
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900779 if (add) {
780 addRule(uid, LOCKDOWN_VPN_MATCH, "updateUidLockdownRule");
Motomu Utsumi697b2992022-06-30 02:25:29 +0000781 } else {
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900782 removeRule(uid, LOCKDOWN_VPN_MATCH, "updateUidLockdownRule");
Motomu Utsumi5a68a212022-06-24 10:14:31 +0000783 }
Motomu Utsumi8b42e6d2022-05-19 06:23:40 +0000784 }
785
786 /**
Ken Chenf5f51332022-01-28 10:08:16 +0800787 * Request netd to change the current active network stats map.
788 *
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000789 * @throws UnsupportedOperationException if called on pre-T devices.
Ken Chenf5f51332022-01-28 10:08:16 +0800790 * @throws ServiceSpecificException in case of failure, with an error code indicating the
791 * cause of the failure.
792 */
Junyu Lai626045a2023-08-28 18:49:44 +0800793 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
markchien49e944c2022-03-01 15:22:20 +0800794 public void swapActiveStatsMap() {
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000795 throwIfPreT("swapActiveStatsMap is not available on pre-T devices");
796
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900797 try {
798 synchronized (sCurrentStatsMapConfigLock) {
799 final long config = sConfigurationMap.getValue(
800 CURRENT_STATS_MAP_CONFIGURATION_KEY).val;
801 final long newConfig = (config == STATS_SELECT_MAP_A)
802 ? STATS_SELECT_MAP_B : STATS_SELECT_MAP_A;
803 sConfigurationMap.updateEntry(CURRENT_STATS_MAP_CONFIGURATION_KEY,
804 new U32(newConfig));
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000805 }
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900806 } catch (ErrnoException e) {
807 throw new ServiceSpecificException(e.errno, "Failed to swap active stats map");
Motomu Utsumi7abeaa42022-07-20 07:54:18 +0000808 }
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900809
810 // After changing the config, it's needed to make sure all the current running eBPF
811 // programs are finished and all the CPUs are aware of this config change before the old
812 // map is modified. So special hack is needed here to wait for the kernel to do a
813 // synchronize_rcu(). Once the kernel called synchronize_rcu(), the updated config will
814 // be available to all cores and the next eBPF programs triggered inside the kernel will
815 // use the new map configuration. So once this function returns it is safe to modify the
816 // old stats map without concerning about race between the kernel and userspace.
817 final int err = mDeps.synchronizeKernelRCU();
818 maybeThrow(err, "synchronizeKernelRCU failed");
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800819 }
820
Ken Chenf5f51332022-01-28 10:08:16 +0800821 /**
822 * Assigns android.permission.INTERNET and/or android.permission.UPDATE_DEVICE_STATS to the uids
823 * specified. Or remove all permissions from the uids.
824 *
825 * @param permissions The permission to grant, it could be either PERMISSION_INTERNET and/or
826 * PERMISSION_UPDATE_DEVICE_STATS. If the permission is NO_PERMISSIONS, then
827 * revoke all permissions for the uids.
828 * @param uids uid of users to grant permission
829 * @throws RemoteException when netd has crashed.
830 */
831 public void setNetPermForUids(final int permissions, final int[] uids) throws RemoteException {
Motomu Utsumi25cf86f2022-06-27 08:50:19 +0000832 if (PRE_T) {
Ken Chenf5f51332022-01-28 10:08:16 +0800833 mNetd.trafficSetNetPermForUids(permissions, uids);
Wayne Ma2fde98c2022-01-17 18:04:05 +0800834 return;
835 }
Motomu Utsumi65271202022-07-05 08:21:41 +0000836
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900837 // Remove the entry if package is uninstalled or uid has only INTERNET permission.
838 if (permissions == PERMISSION_UNINSTALLED || permissions == PERMISSION_INTERNET) {
Motomu Utsumi65271202022-07-05 08:21:41 +0000839 for (final int uid : uids) {
840 try {
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900841 sUidPermissionMap.deleteEntry(new S32(uid));
Motomu Utsumi65271202022-07-05 08:21:41 +0000842 } catch (ErrnoException e) {
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900843 Log.e(TAG, "Failed to remove uid " + uid + " from permission map: " + e);
Motomu Utsumi65271202022-07-05 08:21:41 +0000844 }
845 }
Motomu Utsumi96b6c392023-11-07 15:45:54 +0900846 return;
847 }
848
849 for (final int uid : uids) {
850 try {
851 sUidPermissionMap.updateEntry(new S32(uid), new U8((short) permissions));
852 } catch (ErrnoException e) {
853 Log.e(TAG, "Failed to set permission "
854 + permissions + " to uid " + uid + ": " + e);
855 }
Motomu Utsumi65271202022-07-05 08:21:41 +0000856 }
Wayne Ma0ea3bdc2022-01-12 01:12:11 +0800857 }
858
Ken Chen24330172023-10-20 13:02:14 +0800859 /**
860 * Set Data Saver enabled or disabled
861 *
862 * @param enable whether Data Saver is enabled or disabled.
863 * @throws UnsupportedOperationException if called on pre-T devices.
864 * @throws ServiceSpecificException in case of failure, with an error code indicating the
865 * cause of the failure.
866 */
867 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
868 public void setDataSaverEnabled(boolean enable) {
869 throwIfPreT("setDataSaverEnabled is not available on pre-T devices");
870
871 try {
872 final short config = enable ? DATA_SAVER_ENABLED : DATA_SAVER_DISABLED;
873 sDataSaverEnabledMap.updateEntry(DATA_SAVER_ENABLED_KEY, new U8(config));
874 } catch (ErrnoException e) {
875 throw new ServiceSpecificException(e.errno, "Unable to set data saver: "
876 + Os.strerror(e.errno));
877 }
878 }
879
Motomu Utsumi77b49992023-10-23 17:06:12 +0900880 /**
881 * Set ingress discard rule
882 *
883 * @param address target address to set the ingress discard rule
884 * @param iface allowed interface
885 */
886 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
887 public void setIngressDiscardRule(final InetAddress address, final String iface) {
888 throwIfPreT("setIngressDiscardRule is not available on pre-T devices");
889 final int ifIndex = mDeps.getIfIndex(iface);
890 if (ifIndex == 0) {
891 Log.e(TAG, "Failed to get if index, skip setting ingress discard rule for " + address
892 + "(" + iface + ")");
893 return;
894 }
895 try {
896 sIngressDiscardMap.updateEntry(new IngressDiscardKey(address),
897 new IngressDiscardValue(ifIndex, ifIndex));
898 } catch (ErrnoException e) {
899 Log.e(TAG, "Failed to set ingress discard rule for " + address + "("
900 + iface + "), " + e);
901 }
902 }
903
904 /**
905 * Remove ingress discard rule
906 *
907 * @param address target address to remove the ingress discard rule
908 */
909 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
910 public void removeIngressDiscardRule(final InetAddress address) {
911 throwIfPreT("removeIngressDiscardRule is not available on pre-T devices");
912 try {
913 sIngressDiscardMap.deleteEntry(new IngressDiscardKey(address));
914 } catch (ErrnoException e) {
915 Log.e(TAG, "Failed to remove ingress discard rule for " + address + ", " + e);
916 }
917 }
918
Motomu Utsumi166f9662022-09-01 10:35:29 +0900919 /** Register callback for statsd to pull atom. */
Junyu Lai626045a2023-08-28 18:49:44 +0800920 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Motomu Utsumi166f9662022-09-01 10:35:29 +0900921 public void setPullAtomCallback(final Context context) {
922 throwIfPreT("setPullAtomCallback is not available on pre-T devices");
923
924 final StatsManager statsManager = context.getSystemService(StatsManager.class);
925 statsManager.setPullAtomCallback(NETWORK_BPF_MAP_INFO, null /* metadata */,
926 BackgroundThread.getExecutor(), this::pullBpfMapInfoAtom);
927 }
928
929 private <K extends Struct, V extends Struct> int getMapSize(IBpfMap<K, V> map)
930 throws ErrnoException {
931 // forEach could restart iteration from the beginning if there is a concurrent entry
932 // deletion. netd and skDestroyListener could delete CookieTagMap entry concurrently.
933 // So using Set to count the number of entry in the map.
934 Set<K> keySet = new ArraySet<>();
935 map.forEach((k, v) -> keySet.add(k));
936 return keySet.size();
937 }
938
939 /** Callback for StatsManager#setPullAtomCallback */
940 @VisibleForTesting
941 public int pullBpfMapInfoAtom(final int atomTag, final List<StatsEvent> data) {
942 if (atomTag != NETWORK_BPF_MAP_INFO) {
943 Log.e(TAG, "Unexpected atom tag: " + atomTag);
944 return StatsManager.PULL_SKIP;
945 }
946
947 try {
948 data.add(mDeps.buildStatsEvent(getMapSize(sCookieTagMap), getMapSize(sUidOwnerMap),
949 getMapSize(sUidPermissionMap)));
950 } catch (ErrnoException e) {
951 Log.e(TAG, "Failed to pull NETWORK_BPF_MAP_INFO atom: " + e);
952 return StatsManager.PULL_SKIP;
953 }
954 return StatsManager.PULL_SUCCESS;
955 }
956
Motomu Utsumi310850f2022-09-02 12:48:20 +0900957 private String permissionToString(int permissionMask) {
958 if (permissionMask == PERMISSION_NONE) {
959 return "PERMISSION_NONE";
960 }
961 if (permissionMask == PERMISSION_UNINSTALLED) {
962 // PERMISSION_UNINSTALLED should never appear in the map
963 return "PERMISSION_UNINSTALLED error!";
964 }
965
966 final StringJoiner sj = new StringJoiner(" ");
967 for (Pair<Integer, String> permission: PERMISSION_LIST) {
968 final int permissionFlag = permission.first;
969 final String permissionName = permission.second;
970 if ((permissionMask & permissionFlag) != 0) {
971 sj.add(permissionName);
972 permissionMask &= ~permissionFlag;
973 }
974 }
975 if (permissionMask != 0) {
976 sj.add("PERMISSION_UNKNOWN(" + permissionMask + ")");
977 }
978 return sj.toString();
979 }
980
Motomu Utsumi372c9b42022-09-02 19:02:56 +0900981 private void dumpOwnerMatchConfig(final IndentingPrintWriter pw) {
982 try {
983 final long match = sConfigurationMap.getValue(UID_RULES_CONFIGURATION_KEY).val;
984 pw.println("current ownerMatch configuration: " + match + " " + matchToString(match));
985 } catch (ErrnoException e) {
986 pw.println("Failed to read ownerMatch configuration: " + e);
987 }
988 }
989
Motomu Utsumic675d6f2022-09-02 18:15:25 +0900990 private void dumpCurrentStatsMapConfig(final IndentingPrintWriter pw) {
991 try {
992 final long config = sConfigurationMap.getValue(CURRENT_STATS_MAP_CONFIGURATION_KEY).val;
993 final String currentStatsMap =
994 (config == STATS_SELECT_MAP_A) ? "SELECT_MAP_A" : "SELECT_MAP_B";
995 pw.println("current statsMap configuration: " + config + " " + currentStatsMap);
996 } catch (ErrnoException e) {
997 pw.println("Falied to read current statsMap configuration: " + e);
998 }
999 }
1000
Ken Chen24330172023-10-20 13:02:14 +08001001 private void dumpDataSaverConfig(final IndentingPrintWriter pw) {
1002 try {
1003 final short config = sDataSaverEnabledMap.getValue(DATA_SAVER_ENABLED_KEY).val;
1004 // Any non-zero value converted from short to boolean is true by convention.
1005 pw.println("sDataSaverEnabledMap: " + (config != DATA_SAVER_DISABLED));
1006 } catch (ErrnoException e) {
1007 pw.println("Failed to read data saver configuration: " + e);
1008 }
1009 }
Ken Chene6d511f2022-01-25 11:10:42 +08001010 /**
1011 * Dump BPF maps
1012 *
Motomu Utsumi310850f2022-09-02 12:48:20 +09001013 * @param pw print writer
Ken Chene6d511f2022-01-25 11:10:42 +08001014 * @param fd file descriptor to output
Motomu Utsumi310850f2022-09-02 12:48:20 +09001015 * @param verbose verbose dump flag, if true dump the BpfMap contents
Ken Chene6d511f2022-01-25 11:10:42 +08001016 * @throws IOException when file descriptor is invalid.
1017 * @throws ServiceSpecificException when the method is called on an unsupported device.
1018 */
Junyu Lai626045a2023-08-28 18:49:44 +08001019 @RequiresApi(Build.VERSION_CODES.TIRAMISU)
Motomu Utsumi310850f2022-09-02 12:48:20 +09001020 public void dump(final IndentingPrintWriter pw, final FileDescriptor fd, boolean verbose)
Ken Chene6d511f2022-01-25 11:10:42 +08001021 throws IOException, ServiceSpecificException {
Motomu Utsumi25cf86f2022-06-27 08:50:19 +00001022 if (PRE_T) {
Ken Chene6d511f2022-01-25 11:10:42 +08001023 throw new ServiceSpecificException(
1024 EOPNOTSUPP, "dumpsys connectivity trafficcontroller dump not available on pre-T"
1025 + " devices, use dumpsys netd trafficcontroller instead.");
1026 }
Maciej Żenczykowskid70a3302023-09-06 16:45:25 +00001027
1028 pw.println("TrafficController"); // required by CTS testDumpBpfNetMaps
Motomu Utsumi310850f2022-09-02 12:48:20 +09001029
Motomu Utsumi316d0572022-09-15 13:24:48 +09001030 pw.println();
Motomu Utsumi310850f2022-09-02 12:48:20 +09001031 if (verbose) {
Motomu Utsumief546a92022-10-05 16:42:29 +09001032 pw.println();
1033 pw.println("BPF map content:");
1034 pw.increaseIndent();
1035
Motomu Utsumi372c9b42022-09-02 19:02:56 +09001036 dumpOwnerMatchConfig(pw);
Motomu Utsumic675d6f2022-09-02 18:15:25 +09001037 dumpCurrentStatsMapConfig(pw);
1038 pw.println();
1039
Motomu Utsumief546a92022-10-05 16:42:29 +09001040 // TODO: Remove CookieTagMap content dump
1041 // NetworkStatsService also dumps CookieTagMap and NetworkStatsService is a right place
1042 // to dump CookieTagMap. But the TagSocketTest in CTS depends on this dump so the tests
1043 // need to be updated before remove the dump from BpfNetMaps.
1044 BpfDump.dumpMap(sCookieTagMap, pw, "sCookieTagMap",
1045 (key, value) -> "cookie=" + key.socketCookie
1046 + " tag=0x" + Long.toHexString(value.tag)
1047 + " uid=" + value.uid);
Motomu Utsumi956d86c2022-09-02 17:01:25 +09001048 BpfDump.dumpMap(sUidOwnerMap, pw, "sUidOwnerMap",
1049 (uid, match) -> {
1050 if ((match.rule & IIF_MATCH) != 0) {
1051 // TODO: convert interface index to interface name by IfaceIndexNameMap
1052 return uid.val + " " + matchToString(match.rule) + " " + match.iif;
1053 } else {
1054 return uid.val + " " + matchToString(match.rule);
1055 }
1056 });
Motomu Utsumi310850f2022-09-02 12:48:20 +09001057 BpfDump.dumpMap(sUidPermissionMap, pw, "sUidPermissionMap",
1058 (uid, permission) -> uid.val + " " + permissionToString(permission.val));
Motomu Utsumi77b49992023-10-23 17:06:12 +09001059 BpfDump.dumpMap(sIngressDiscardMap, pw, "sIngressDiscardMap",
1060 (key, value) -> "[" + key.dstAddr + "]: "
1061 + value.iif1 + "(" + mDeps.getIfName(value.iif1) + "), "
1062 + value.iif2 + "(" + mDeps.getIfName(value.iif2) + ")");
Ken Chen24330172023-10-20 13:02:14 +08001063 dumpDataSaverConfig(pw);
Motomu Utsumief546a92022-10-05 16:42:29 +09001064 pw.decreaseIndent();
Motomu Utsumi310850f2022-09-02 12:48:20 +09001065 }
Ken Chene6d511f2022-01-25 11:10:42 +08001066 }
Wayne Ma0ea3bdc2022-01-12 01:12:11 +08001067}