Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 15978845 authored by Nathan Harold's avatar Nathan Harold
Browse files

Add MANAGE_IPSEC_TUNNELS Permission 

Add a new MANAGE_IPSEC_TUNNELS permission and
protect all IPsec Tunnel mode APIs with it.
This permission is only granted to the system or
through an AppOp.

Bug: 66955045
Test: compilation
Change-Id: I0f618373b500c493ef2211bece681f74652a1833
parent 8a047a0c

api/system-current.txt

+1 −0
Original line number Diff line number Diff line
@@ -100,6 +100,7 @@ package android { 
    field public static final java.lang.String MANAGE_CARRIER_OEM_UNLOCK_STATE = "android.permission.MANAGE_CARRIER_OEM_UNLOCK_STATE";

    field public static final java.lang.String MANAGE_CA_CERTIFICATES = "android.permission.MANAGE_CA_CERTIFICATES";

    field public static final java.lang.String MANAGE_DEVICE_ADMINS = "android.permission.MANAGE_DEVICE_ADMINS";

    field public static final java.lang.String MANAGE_IPSEC_TUNNELS = "android.permission.MANAGE_IPSEC_TUNNELS";

    field public static final java.lang.String MANAGE_SOUND_TRIGGER = "android.permission.MANAGE_SOUND_TRIGGER";

    field public static final java.lang.String MANAGE_SUBSCRIPTION_PLANS = "android.permission.MANAGE_SUBSCRIPTION_PLANS";

    field public static final java.lang.String MANAGE_USB = "android.permission.MANAGE_USB";

core/java/android/net/IpSecManager.java

+4 −2
Original line number Diff line number Diff line
@@ -658,6 +658,7 @@ public final class IpSecManager { 
         * @hide

         */

        @SystemApi

        @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS)

        public void addAddress(@NonNull LinkAddress address) throws IOException {

            try {

                mService.addAddressToTunnelInterface(mResourceId, address);
@@ -675,6 +676,7 @@ public final class IpSecManager { 
         * @hide

         */

        @SystemApi

        @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS)

        public void removeAddress(@NonNull LinkAddress address) throws IOException {

            try {

                mService.removeAddressFromTunnelInterface(mResourceId, address);
@@ -768,7 +770,7 @@ public final class IpSecManager { 
     */

    @SystemApi

    @NonNull

    @RequiresPermission(android.Manifest.permission.NETWORK_STACK)

    @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS)

    public IpSecTunnelInterface createIpSecTunnelInterface(@NonNull InetAddress localAddress,

            @NonNull InetAddress remoteAddress, @NonNull Network underlyingNetwork)

            throws ResourceUnavailableException, IOException {
@@ -793,7 +795,7 @@ public final class IpSecManager { 
     * @hide

     */

    @SystemApi

    @RequiresPermission(android.Manifest.permission.NETWORK_STACK)

    @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS)

    public void applyTunnelModeTransform(@NonNull IpSecTunnelInterface tunnel,

            @PolicyDirection int direction, @NonNull IpSecTransform transform) throws IOException {

        try {

core/java/android/net/IpSecTransform.java

+3 −3
Original line number Diff line number Diff line
@@ -282,7 +282,7 @@ public final class IpSecTransform implements AutoCloseable { 
     */

    @SystemApi

    @RequiresPermission(anyOf = {

            android.Manifest.permission.NETWORK_STACK,

            android.Manifest.permission.MANAGE_IPSEC_TUNNELS,

            android.Manifest.permission.PACKET_KEEPALIVE_OFFLOAD

    })

    public void startNattKeepalive(@NonNull NattKeepaliveCallback userCallback,
@@ -325,7 +325,7 @@ public final class IpSecTransform implements AutoCloseable { 
     */

    @SystemApi

    @RequiresPermission(anyOf = {

            android.Manifest.permission.NETWORK_STACK,

            android.Manifest.permission.MANAGE_IPSEC_TUNNELS,

            android.Manifest.permission.PACKET_KEEPALIVE_OFFLOAD

    })

    public void stopNattKeepalive() {
@@ -478,7 +478,7 @@ public final class IpSecTransform implements AutoCloseable { 
         */

        @SystemApi

        @NonNull

        @RequiresPermission(android.Manifest.permission.NETWORK_STACK)

        @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS)

        public IpSecTransform buildTunnelModeTransform(

                @NonNull InetAddress sourceAddress,

                @NonNull IpSecManager.SecurityParameterIndex spi)

core/res/AndroidManifest.xml

+7 −0
Original line number Diff line number Diff line
@@ -1341,6 +1341,13 @@ 
        android:label="@string/permlab_changeWifiState"

        android:protectionLevel="normal" />



    <!-- @SystemApi @hide Allows apps to create and manage IPsec tunnels.

         <p>Only granted to applications that are currently bound by the

         system for creating and managing IPsec-based interfaces.

    -->

    <permission android:name="android.permission.MANAGE_IPSEC_TUNNELS"

        android:protectionLevel="signature|appop" />



    <!-- @SystemApi @hide Allows applications to read Wi-Fi credential.

         <p>Not for use by third-party applications. -->

    <permission android:name="android.permission.READ_WIFI_CREDENTIAL"