Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1a6e667c authored by Ricky Wai's avatar Ricky Wai
Browse files

Add Network security watchlist service 

Network security watchlist service is a service to monitor all potential
harmful network traffic. By setting a network watchlist, any connections
that visit any site from watchlist will be logged.

Logs will be aggregated everyday and encoded using differential
privacy before exporting it from framework.

This feature is disabled now, run "setprop ro.network_watchlist_enabled true" to enable it.

All network events are handled in an async bg thread, it should not
cause any delay in netd. Also, it uses the hooks in enterprise network logging,
so we can run netd_benchmark to measure the impact to netd.

Here are the things not included in this CL:
- ConfigUpdater to get and set watchlist
- Differential privacy encoding logic and reporting
- CTS
- Memory and performance optimization for internal watchlist data structure

Test: manual - turn on the feature, hard code a watchlist xml, process
that visited that domain is being logged in sqlite.
Test: run netd_benchmark - seems no obvious performance change.
Test: bit FrameworksCoreTests:android.net.NetworkWatchlistManagerTests
Test: runtest frameworks-net
Test: runtest frameworks-services -p com.android.server.net.watchlist

Bug: 63908748

Change-Id: I09595178bac0070a867bc5e0501a7bf2c840e398
parent 7c0abe19

Android.mk

+1 −0
Original line number Diff line number Diff line
@@ -398,6 +398,7 @@ LOCAL_SRC_FILES += \ 
	core/java/com/android/internal/backup/IObbBackupService.aidl \

	core/java/com/android/internal/car/ICarServiceHelper.aidl \

	core/java/com/android/internal/inputmethod/IInputContentUriToken.aidl \

	core/java/com/android/internal/net/INetworkWatchlistManager.aidl \

	core/java/com/android/internal/policy/IKeyguardDrawnCallback.aidl \

	core/java/com/android/internal/policy/IKeyguardDismissCallback.aidl \

	core/java/com/android/internal/policy/IKeyguardExitCallback.aidl \

core/java/android/app/SystemServiceRegistry.java

+13 −0
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ import android.net.INetworkPolicyManager; 
import android.net.IpSecManager;

import android.net.NetworkPolicyManager;

import android.net.NetworkScoreManager;

import android.net.NetworkWatchlistManager;

import android.net.lowpan.ILowpanManager;

import android.net.lowpan.LowpanManager;

import android.net.nsd.INsdManager;
@@ -150,6 +151,7 @@ import com.android.internal.app.IAppOpsService; 
import com.android.internal.app.IBatteryStats;

import com.android.internal.app.ISoundTriggerService;

import com.android.internal.appwidget.IAppWidgetService;

import com.android.internal.net.INetworkWatchlistManager;

import com.android.internal.os.IDropBoxManagerService;

import com.android.internal.policy.PhoneLayoutInflater;
@@ -862,6 +864,17 @@ final class SystemServiceRegistry { 
                return new ShortcutManager(ctx, IShortcutService.Stub.asInterface(b));

            }});



        registerService(Context.NETWORK_WATCHLIST_SERVICE, NetworkWatchlistManager.class,

                new CachedServiceFetcher<NetworkWatchlistManager>() {

                    @Override

                    public NetworkWatchlistManager createService(ContextImpl ctx)

                            throws ServiceNotFoundException {

                        IBinder b =

                                ServiceManager.getServiceOrThrow(Context.NETWORK_WATCHLIST_SERVICE);

                        return new NetworkWatchlistManager(ctx,

                                INetworkWatchlistManager.Stub.asInterface(b));

                    }});



        registerService(Context.SYSTEM_HEALTH_SERVICE, SystemHealthManager.class,

                new CachedServiceFetcher<SystemHealthManager>() {

            @Override

core/java/android/content/Context.java

+2 −0
Original line number Diff line number Diff line
@@ -3413,6 +3413,8 @@ public abstract class Context { 
    public static final String NETWORK_STATS_SERVICE = "netstats";

    /** {@hide} */

    public static final String NETWORK_POLICY_SERVICE = "netpolicy";

    /** {@hide} */

    public static final String NETWORK_WATCHLIST_SERVICE = "network_watchlist";



    /**

     * Use with {@link #getSystemService} to retrieve a {@link

core/java/android/net/IIpConnectivityMetrics.aidl

+3 −3
Original line number Diff line number Diff line
@@ -30,11 +30,11 @@ interface IIpConnectivityMetrics { 
    int logEvent(in ConnectivityMetricsEvent event);



    /**

     * At most one callback can be registered (by DevicePolicyManager).

     * Callback can be registered by DevicePolicyManager or NetworkWatchlistService only.

     * @return status {@code true} if registering/unregistering of the callback was successful,

     *         {@code false} otherwise (might happen if IIpConnectivityMetrics is not available,

     *         if it happens make sure you call it when the service is up in the caller)

     */

    boolean registerNetdEventCallback(in INetdEventCallback callback);

    boolean unregisterNetdEventCallback();

    boolean addNetdEventCallback(in int callerType, in INetdEventCallback callback);

    boolean removeNetdEventCallback(in int callerType);

}

core/java/android/net/INetdEventCallback.aidl

+4 −0
Original line number Diff line number Diff line
@@ -19,6 +19,10 @@ package android.net; 
/** {@hide} */

oneway interface INetdEventCallback {



    // Possible addNetdEventCallback callers.

    const int CALLBACK_CALLER_DEVICE_POLICY = 0;

    const int CALLBACK_CALLER_NETWORK_WATCHLIST = 1;



    /**

     * Reports a single DNS lookup function call.

     * This method must not block or perform long-running operations.