375 lines
16 KiB
Java
375 lines
16 KiB
Java
/*
|
|
* Copyright (C) 2023 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
package android.net;
|
|
|
|
import static android.net.BpfNetMapsConstants.ALLOW_CHAINS;
|
|
import static android.net.BpfNetMapsConstants.BACKGROUND_MATCH;
|
|
import static android.net.BpfNetMapsConstants.DATA_SAVER_ENABLED;
|
|
import static android.net.BpfNetMapsConstants.DATA_SAVER_ENABLED_KEY;
|
|
import static android.net.BpfNetMapsConstants.DENY_CHAINS;
|
|
import static android.net.BpfNetMapsConstants.DOZABLE_MATCH;
|
|
import static android.net.BpfNetMapsConstants.HAPPY_BOX_MATCH;
|
|
import static android.net.BpfNetMapsConstants.LOW_POWER_STANDBY_MATCH;
|
|
import static android.net.BpfNetMapsConstants.MATCH_LIST;
|
|
import static android.net.BpfNetMapsConstants.METERED_ALLOW_CHAINS;
|
|
import static android.net.BpfNetMapsConstants.METERED_DENY_CHAINS;
|
|
import static android.net.BpfNetMapsConstants.NO_MATCH;
|
|
import static android.net.BpfNetMapsConstants.OEM_DENY_1_MATCH;
|
|
import static android.net.BpfNetMapsConstants.OEM_DENY_2_MATCH;
|
|
import static android.net.BpfNetMapsConstants.OEM_DENY_3_MATCH;
|
|
import static android.net.BpfNetMapsConstants.PENALTY_BOX_ADMIN_MATCH;
|
|
import static android.net.BpfNetMapsConstants.PENALTY_BOX_USER_MATCH;
|
|
import static android.net.BpfNetMapsConstants.POWERSAVE_MATCH;
|
|
import static android.net.BpfNetMapsConstants.RESTRICTED_MATCH;
|
|
import static android.net.BpfNetMapsConstants.STANDBY_MATCH;
|
|
import static android.net.BpfNetMapsConstants.UID_RULES_CONFIGURATION_KEY;
|
|
import static android.net.ConnectivityManager.BLOCKED_METERED_REASON_ADMIN_DISABLED;
|
|
import static android.net.ConnectivityManager.BLOCKED_METERED_REASON_DATA_SAVER;
|
|
import static android.net.ConnectivityManager.BLOCKED_METERED_REASON_MASK;
|
|
import static android.net.ConnectivityManager.BLOCKED_METERED_REASON_USER_RESTRICTED;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_APP_BACKGROUND;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_APP_STANDBY;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_BATTERY_SAVER;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_DOZE;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_LOW_POWER_STANDBY;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_NONE;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_OEM_DENY;
|
|
import static android.net.ConnectivityManager.BLOCKED_REASON_RESTRICTED_MODE;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_BACKGROUND;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_DOZABLE;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_LOW_POWER_STANDBY;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_METERED_ALLOW;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_METERED_DENY_ADMIN;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_METERED_DENY_USER;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_1;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_2;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_3;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_POWERSAVE;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_RESTRICTED;
|
|
import static android.net.ConnectivityManager.FIREWALL_CHAIN_STANDBY;
|
|
import static android.net.ConnectivityManager.FIREWALL_RULE_ALLOW;
|
|
import static android.net.ConnectivityManager.FIREWALL_RULE_DENY;
|
|
import static android.system.OsConstants.EINVAL;
|
|
|
|
import android.os.Build;
|
|
import android.os.Process;
|
|
import android.os.ServiceSpecificException;
|
|
import android.system.ErrnoException;
|
|
import android.system.Os;
|
|
import android.util.Pair;
|
|
|
|
import androidx.annotation.RequiresApi;
|
|
|
|
import com.android.modules.utils.build.SdkLevel;
|
|
import com.android.net.module.util.IBpfMap;
|
|
import com.android.net.module.util.Struct;
|
|
import com.android.net.module.util.Struct.S32;
|
|
import com.android.net.module.util.Struct.U32;
|
|
import com.android.net.module.util.Struct.U8;
|
|
|
|
import java.util.StringJoiner;
|
|
|
|
/**
|
|
* The classes and the methods for BpfNetMaps utilization.
|
|
*
|
|
* @hide
|
|
*/
|
|
// Note that this class should be put into bootclasspath instead of static libraries.
|
|
// Because modules could have different copies of this class if this is statically linked,
|
|
// which would be problematic if the definitions in these modules are not synchronized.
|
|
// Note that NetworkStack can not use this before U due to b/326143935
|
|
@RequiresApi(Build.VERSION_CODES.TIRAMISU)
|
|
public class BpfNetMapsUtils {
|
|
// Bitmaps for calculating whether a given uid is blocked by firewall chains.
|
|
private static final long sMaskDropIfSet;
|
|
private static final long sMaskDropIfUnset;
|
|
|
|
static {
|
|
long maskDropIfSet = 0L;
|
|
long maskDropIfUnset = 0L;
|
|
|
|
for (int chain : BpfNetMapsConstants.ALLOW_CHAINS) {
|
|
final long match = getMatchByFirewallChain(chain);
|
|
maskDropIfUnset |= match;
|
|
}
|
|
for (int chain : BpfNetMapsConstants.DENY_CHAINS) {
|
|
final long match = getMatchByFirewallChain(chain);
|
|
maskDropIfSet |= match;
|
|
}
|
|
sMaskDropIfSet = maskDropIfSet;
|
|
sMaskDropIfUnset = maskDropIfUnset;
|
|
}
|
|
|
|
// Prevent this class from being accidental instantiated.
|
|
private BpfNetMapsUtils() {}
|
|
|
|
/**
|
|
* Get corresponding match from firewall chain.
|
|
*/
|
|
public static long getMatchByFirewallChain(final int chain) {
|
|
switch (chain) {
|
|
case FIREWALL_CHAIN_DOZABLE:
|
|
return DOZABLE_MATCH;
|
|
case FIREWALL_CHAIN_STANDBY:
|
|
return STANDBY_MATCH;
|
|
case FIREWALL_CHAIN_POWERSAVE:
|
|
return POWERSAVE_MATCH;
|
|
case FIREWALL_CHAIN_RESTRICTED:
|
|
return RESTRICTED_MATCH;
|
|
case FIREWALL_CHAIN_BACKGROUND:
|
|
return BACKGROUND_MATCH;
|
|
case FIREWALL_CHAIN_LOW_POWER_STANDBY:
|
|
return LOW_POWER_STANDBY_MATCH;
|
|
case FIREWALL_CHAIN_OEM_DENY_1:
|
|
return OEM_DENY_1_MATCH;
|
|
case FIREWALL_CHAIN_OEM_DENY_2:
|
|
return OEM_DENY_2_MATCH;
|
|
case FIREWALL_CHAIN_OEM_DENY_3:
|
|
return OEM_DENY_3_MATCH;
|
|
case FIREWALL_CHAIN_METERED_ALLOW:
|
|
return HAPPY_BOX_MATCH;
|
|
case FIREWALL_CHAIN_METERED_DENY_USER:
|
|
return PENALTY_BOX_USER_MATCH;
|
|
case FIREWALL_CHAIN_METERED_DENY_ADMIN:
|
|
return PENALTY_BOX_ADMIN_MATCH;
|
|
default:
|
|
throw new ServiceSpecificException(EINVAL, "Invalid firewall chain: " + chain);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get whether the chain is an allow-list or a deny-list.
|
|
*
|
|
* ALLOWLIST means the firewall denies all by default, uids must be explicitly allowed
|
|
* DENYLIST means the firewall allows all by default, uids must be explicitly denied
|
|
*/
|
|
public static boolean isFirewallAllowList(final int chain) {
|
|
if (ALLOW_CHAINS.contains(chain) || METERED_ALLOW_CHAINS.contains(chain)) {
|
|
return true;
|
|
} else if (DENY_CHAINS.contains(chain) || METERED_DENY_CHAINS.contains(chain)) {
|
|
return false;
|
|
}
|
|
throw new ServiceSpecificException(EINVAL, "Invalid firewall chain: " + chain);
|
|
}
|
|
|
|
/**
|
|
* Get match string representation from the given match bitmap.
|
|
*/
|
|
public static String matchToString(long matchMask) {
|
|
if (matchMask == NO_MATCH) {
|
|
return "NO_MATCH";
|
|
}
|
|
|
|
final StringJoiner sj = new StringJoiner(" ");
|
|
for (final Pair<Long, String> match : MATCH_LIST) {
|
|
final long matchFlag = match.first;
|
|
final String matchName = match.second;
|
|
if ((matchMask & matchFlag) != 0) {
|
|
sj.add(matchName);
|
|
matchMask &= ~matchFlag;
|
|
}
|
|
}
|
|
if (matchMask != 0) {
|
|
sj.add("UNKNOWN_MATCH(" + matchMask + ")");
|
|
}
|
|
return sj.toString();
|
|
}
|
|
|
|
/**
|
|
* Throw UnsupportedOperationException if SdkLevel is before T.
|
|
*/
|
|
public static void throwIfPreT(final String msg) {
|
|
if (!SdkLevel.isAtLeastT()) {
|
|
throw new UnsupportedOperationException(msg);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get the specified firewall chain's status.
|
|
*
|
|
* @param configurationMap target configurationMap
|
|
* @param chain target chain
|
|
* @return {@code true} if chain is enabled, {@code false} if chain is not enabled.
|
|
* @throws UnsupportedOperationException if called on pre-T devices.
|
|
* @throws ServiceSpecificException in case of failure, with an error code indicating the
|
|
* cause of the failure.
|
|
*/
|
|
public static boolean isChainEnabled(
|
|
final IBpfMap<S32, U32> configurationMap, final int chain) {
|
|
throwIfPreT("isChainEnabled is not available on pre-T devices");
|
|
|
|
final long match = getMatchByFirewallChain(chain);
|
|
try {
|
|
final U32 config = configurationMap.getValue(UID_RULES_CONFIGURATION_KEY);
|
|
return (config.val & match) != 0;
|
|
} catch (ErrnoException e) {
|
|
throw new ServiceSpecificException(e.errno,
|
|
"Unable to get firewall chain status: " + Os.strerror(e.errno));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get firewall rule of specified firewall chain on specified uid.
|
|
*
|
|
* @param uidOwnerMap target uidOwnerMap.
|
|
* @param chain target chain.
|
|
* @param uid target uid.
|
|
* @return either FIREWALL_RULE_ALLOW or FIREWALL_RULE_DENY
|
|
* @throws UnsupportedOperationException if called on pre-T devices.
|
|
* @throws ServiceSpecificException in case of failure, with an error code indicating the
|
|
* cause of the failure.
|
|
*/
|
|
public static int getUidRule(final IBpfMap<S32, UidOwnerValue> uidOwnerMap,
|
|
final int chain, final int uid) {
|
|
throwIfPreT("getUidRule is not available on pre-T devices");
|
|
|
|
final long match = getMatchByFirewallChain(chain);
|
|
final boolean isAllowList = isFirewallAllowList(chain);
|
|
try {
|
|
final UidOwnerValue uidMatch = uidOwnerMap.getValue(new S32(uid));
|
|
final boolean isMatchEnabled = uidMatch != null && (uidMatch.rule & match) != 0;
|
|
return isMatchEnabled == isAllowList ? FIREWALL_RULE_ALLOW : FIREWALL_RULE_DENY;
|
|
} catch (ErrnoException e) {
|
|
throw new ServiceSpecificException(e.errno,
|
|
"Unable to get uid rule status: " + Os.strerror(e.errno));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get blocked reasons for specified uid
|
|
*
|
|
* @param uid Target Uid
|
|
* @return Reasons of network access blocking for an UID
|
|
*/
|
|
public static int getUidNetworkingBlockedReasons(final int uid,
|
|
IBpfMap<S32, U32> configurationMap,
|
|
IBpfMap<S32, UidOwnerValue> uidOwnerMap,
|
|
IBpfMap<S32, U8> dataSaverEnabledMap
|
|
) {
|
|
final long uidRuleConfig;
|
|
final long uidMatch;
|
|
try {
|
|
uidRuleConfig = configurationMap.getValue(UID_RULES_CONFIGURATION_KEY).val;
|
|
final UidOwnerValue value = uidOwnerMap.getValue(new Struct.S32(uid));
|
|
uidMatch = (value != null) ? value.rule : 0L;
|
|
} catch (ErrnoException e) {
|
|
throw new ServiceSpecificException(e.errno,
|
|
"Unable to get firewall chain status: " + Os.strerror(e.errno));
|
|
}
|
|
final long blockingMatches = (uidRuleConfig & ~uidMatch & sMaskDropIfUnset)
|
|
| (uidRuleConfig & uidMatch & sMaskDropIfSet);
|
|
|
|
int blockedReasons = BLOCKED_REASON_NONE;
|
|
if ((blockingMatches & POWERSAVE_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_REASON_BATTERY_SAVER;
|
|
}
|
|
if ((blockingMatches & DOZABLE_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_REASON_DOZE;
|
|
}
|
|
if ((blockingMatches & STANDBY_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_REASON_APP_STANDBY;
|
|
}
|
|
if ((blockingMatches & RESTRICTED_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_REASON_RESTRICTED_MODE;
|
|
}
|
|
if ((blockingMatches & LOW_POWER_STANDBY_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_REASON_LOW_POWER_STANDBY;
|
|
}
|
|
if ((blockingMatches & BACKGROUND_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_REASON_APP_BACKGROUND;
|
|
}
|
|
if ((blockingMatches & (OEM_DENY_1_MATCH | OEM_DENY_2_MATCH | OEM_DENY_3_MATCH)) != 0) {
|
|
blockedReasons |= BLOCKED_REASON_OEM_DENY;
|
|
}
|
|
|
|
// Metered chains are not enabled by configuration map currently.
|
|
if ((uidMatch & PENALTY_BOX_USER_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_METERED_REASON_USER_RESTRICTED;
|
|
}
|
|
if ((uidMatch & PENALTY_BOX_ADMIN_MATCH) != 0) {
|
|
blockedReasons |= BLOCKED_METERED_REASON_ADMIN_DISABLED;
|
|
}
|
|
if ((uidMatch & HAPPY_BOX_MATCH) == 0 && getDataSaverEnabled(dataSaverEnabledMap)) {
|
|
blockedReasons |= BLOCKED_METERED_REASON_DATA_SAVER;
|
|
}
|
|
|
|
return blockedReasons;
|
|
}
|
|
|
|
/**
|
|
* Return whether the network is blocked by firewall chains for the given uid.
|
|
*
|
|
* Note that {@link #getDataSaverEnabled(IBpfMap)} has a latency before V.
|
|
*
|
|
* @param uid The target uid.
|
|
* @param isNetworkMetered Whether the target network is metered.
|
|
*
|
|
* @return True if the network is blocked. Otherwise, false.
|
|
* @throws ServiceSpecificException if the read fails.
|
|
*
|
|
* @hide
|
|
*/
|
|
public static boolean isUidNetworkingBlocked(final int uid, boolean isNetworkMetered,
|
|
IBpfMap<S32, U32> configurationMap,
|
|
IBpfMap<S32, UidOwnerValue> uidOwnerMap,
|
|
IBpfMap<S32, U8> dataSaverEnabledMap
|
|
) {
|
|
throwIfPreT("isUidBlockedByFirewallChains is not available on pre-T devices");
|
|
|
|
// System uid is not blocked by firewall chains, see bpf_progs/netd.c
|
|
// TODO: use UserHandle.isCore() once it is accessible
|
|
if (uid < Process.FIRST_APPLICATION_UID) {
|
|
return false;
|
|
}
|
|
|
|
final int blockedReasons = getUidNetworkingBlockedReasons(
|
|
uid,
|
|
configurationMap,
|
|
uidOwnerMap,
|
|
dataSaverEnabledMap);
|
|
if (isNetworkMetered) {
|
|
return blockedReasons != BLOCKED_REASON_NONE;
|
|
} else {
|
|
return (blockedReasons & ~BLOCKED_METERED_REASON_MASK) != BLOCKED_REASON_NONE;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get Data Saver enabled or disabled
|
|
*
|
|
* Note that before V, the data saver status in bpf is written by ConnectivityService
|
|
* when receiving {@link ConnectivityManager#ACTION_RESTRICT_BACKGROUND_CHANGED}. Thus,
|
|
* the status is not synchronized.
|
|
* On V+, the data saver status is set by platform code when enabling/disabling
|
|
* data saver, which is synchronized.
|
|
*
|
|
* @return whether Data Saver is enabled or disabled.
|
|
* @throws ServiceSpecificException in case of failure, with an error code indicating the
|
|
* cause of the failure.
|
|
*/
|
|
public static boolean getDataSaverEnabled(IBpfMap<S32, U8> dataSaverEnabledMap) {
|
|
throwIfPreT("getDataSaverEnabled is not available on pre-T devices");
|
|
|
|
try {
|
|
return dataSaverEnabledMap.getValue(DATA_SAVER_ENABLED_KEY).val == DATA_SAVER_ENABLED;
|
|
} catch (ErrnoException e) {
|
|
throw new ServiceSpecificException(e.errno, "Unable to get data saver: "
|
|
+ Os.strerror(e.errno));
|
|
}
|
|
}
|
|
}
|