joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge "[Refactor] Make uid owner match comparison logic into a function" into main am: 3897aaf7e9 am: d2229688a9 am: 0d32a59c4f am: ccd04c8594

Browse source 
Original change: https://android-review.googlesource.com/c/platform/packages/modules/Connectivity/+/2754265

Change-Id: I68bb236f68cb38b1642edca982fa739d8d91f519
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Maciej Żenczykowski 2023-09-21 14:02:22 +00:00 • committed by Automerger Merge Worker
commit 093eaea71e
2 changed files with 15 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

12
bpf_progs/netd.c
View file

@ -401,11 +401,6 @@ static __always_inline inline bool ingress_should_discard(struct __sk_buff* skb,
return true; // disallowed interface
}
// DROP_IF_SET is set of rules that DROP if rule is globally enabled, and per-uid bit is set
#define DROP_IF_SET (STANDBY_MATCH | OEM_DENY_1_MATCH | OEM_DENY_2_MATCH | OEM_DENY_3_MATCH)
// DROP_IF_UNSET is set of rules that should DROP if globally enabled, and per-uid bit is NOT set
#define DROP_IF_UNSET (DOZABLE_MATCH | POWERSAVE_MATCH | RESTRICTED_MATCH | LOW_POWER_STANDBY_MATCH)
static __always_inline inline int bpf_owner_match(struct __sk_buff* skb, uint32_t uid,
bool egress, const unsigned kver) {
if (is_system_uid(uid)) return PASS;
@ -418,12 +413,7 @@ static __always_inline inline int bpf_owner_match(struct __sk_buff* skb, uint32_
uint32_t uidRules = uidEntry ? uidEntry->rule : 0;
uint32_t allowed_iif = uidEntry ? uidEntry->iif : 0;
// Warning: funky bit-wise arithmetic: in parallel, for all DROP_IF_SET/UNSET rules
// check whether the rules are globally enabled, and if so whether the rules are
// set/unset for the specific uid. DROP if that is the case for ANY of the rules.
// We achieve this by masking out only the bits/rules we're interested in checking,
// and negating (via bit-wise xor) the bits/rules that should drop if unset.
if (enabledRules & (DROP_IF_SET | DROP_IF_UNSET) & (uidRules ^ DROP_IF_UNSET)) return DROP;
if (isBlockedByUidRules(enabledRules, uidRules)) return DROP;
if (!egress && skb->ifindex != 1) {
if (ingress_should_discard(skb, kver)) return DROP;

14
bpf_progs/netd.h
View file

@ -235,3 +235,17 @@ STRUCT_SIZE(IngressDiscardValue, 2 * 4); // 8
#define CURRENT_STATS_MAP_CONFIGURATION_KEY 1
#undef STRUCT_SIZE
// DROP_IF_SET is set of rules that DROP if rule is globally enabled, and per-uid bit is set
#define DROP_IF_SET (STANDBY_MATCH | OEM_DENY_1_MATCH | OEM_DENY_2_MATCH | OEM_DENY_3_MATCH)
// DROP_IF_UNSET is set of rules that should DROP if globally enabled, and per-uid bit is NOT set
#define DROP_IF_UNSET (DOZABLE_MATCH | POWERSAVE_MATCH | RESTRICTED_MATCH | LOW_POWER_STANDBY_MATCH)
// Warning: funky bit-wise arithmetic: in parallel, for all DROP_IF_SET/UNSET rules
// check whether the rules are globally enabled, and if so whether the rules are
// set/unset for the specific uid. DROP if that is the case for ANY of the rules.
// We achieve this by masking out only the bits/rules we're interested in checking,
// and negating (via bit-wise xor) the bits/rules that should drop if unset.
static inline bool isBlockedByUidRules(BpfConfig enabledRules, uint32_t uidRules) {
return enabledRules & (DROP_IF_SET | DROP_IF_UNSET) & (uidRules ^ DROP_IF_UNSET);
}