Kill sockets when a VPN comes up.

1. Change the SockDiag callback function to be a filter that
   returns a bool instead of a function that optionally kills a
   socket. All existing callbacks basically only existed to kill
   sockets under certain conditions, and making them return a
   boolean allows reusing the same callback function signature
   to filter sockets as well.
2. Add a new SockDiag method to kill sockets based on a UidRanges
   object (which contains a number of UID ranges) and a list of
   users to skip.
3. Add a new UIDRANGE mode to SockDiagTest to test the above.
4. When UID ranges are added or removed from the VPN, kill
   sockets in those UID ranges unless the socket UIDs are in
   mProtectableUsers and thus their creator might have set the
   protect bit on their mark.  Short of actually being
   able to see the socket mark on each socket and basing our
   decision on that, this is the best we can do.

Bug: 26976388
Change-Id: I53a30df3feb63254a6451a29fa6041c9b679f9bb

1 files changed, 3 insertions, 2 deletions

diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp
index 8ae03242..7c2a8266 100644
--- a/server/NetworkController.cpp
+++ b/server/NetworkController.cpp
@@ -459,7 +459,7 @@ int NetworkController::addUsersToNetwork(unsigned netId, const UidRanges& uidRan
         ALOGE("cannot add users to non-virtual network with netId %u", netId);
         return -EINVAL;
     }
-    if (int ret = static_cast<VirtualNetwork*>(network)->addUsers(uidRanges)) {
+    if (int ret = static_cast<VirtualNetwork*>(network)->addUsers(uidRanges, mProtectableUsers)) {
         return ret;
     }
     return 0;
@@ -476,7 +476,8 @@ int NetworkController::removeUsersFromNetwork(unsigned netId, const UidRanges& u
         ALOGE("cannot remove users from non-virtual network with netId %u", netId);
         return -EINVAL;
     }
-    if (int ret = static_cast<VirtualNetwork*>(network)->removeUsers(uidRanges)) {
+    if (int ret = static_cast<VirtualNetwork*>(network)->removeUsers(uidRanges,
+                                                                     mProtectableUsers)) {
         return ret;
     }
     return 0;