Merge "Rework Exception Handling for IpSecManager" into pi-dev am: 16c671dc9a (37baab43) · Commits · e / os / android_frameworks_base

core/java/android/net/IpSecManager.java

+134 −13

Original line number	Original line	Diff line number	Diff line
	@@ -27,6 +27,9 @@ import android.content.Context;
	import android.os.Binder;		import android.os.Binder;
	import android.os.ParcelFileDescriptor;		import android.os.ParcelFileDescriptor;
	import android.os.RemoteException;		import android.os.RemoteException;
			import android.os.ServiceSpecificException;
			import android.system.ErrnoException;
			import android.system.OsConstants;
	import android.util.AndroidException;		import android.util.AndroidException;
	import android.util.Log;		import android.util.Log;

	@@ -173,12 +176,17 @@ public final class IpSecManager {
	public void close() {		public void close() {
	try {		try {
	mService.releaseSecurityParameterIndex(mResourceId);		mService.releaseSecurityParameterIndex(mResourceId);
	mResourceId = INVALID_RESOURCE_ID;
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		} catch (Exception e) {
			// On close we swallow all random exceptions since failure to close is not
			// actionable by the user.
			Log.e(TAG, "Failed to close " + this + ", Exception=" + e);
			} finally {
			mResourceId = INVALID_RESOURCE_ID;
	mCloseGuard.close();		mCloseGuard.close();
	}		}
			}

	/** Check that the SPI was closed properly. */		/** Check that the SPI was closed properly. */
	@Override		@Override
	@@ -228,7 +236,6 @@ public final class IpSecManager {
	throw new RuntimeException(		throw new RuntimeException(
	"Invalid Resource ID returned by IpSecService: " + status);		"Invalid Resource ID returned by IpSecService: " + status);
	}		}

	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	@@ -240,6 +247,17 @@ public final class IpSecManager {
	public int getResourceId() {		public int getResourceId() {
	return mResourceId;		return mResourceId;
	}		}

			@Override
			public String toString() {
			return new StringBuilder()
			.append("SecurityParameterIndex{spi=")
			.append(mSpi)
			.append(",resourceId=")
			.append(mResourceId)
			.append("}")
			.toString();
			}
	}		}

	/**		/**
	@@ -262,7 +280,11 @@ public final class IpSecManager {
	mService,		mService,
	destinationAddress,		destinationAddress,
	IpSecManager.INVALID_SECURITY_PARAMETER_INDEX);		IpSecManager.INVALID_SECURITY_PARAMETER_INDEX);
			} catch (ServiceSpecificException e) {
			throw rethrowUncheckedExceptionFromServiceSpecificException(e);
	} catch (SpiUnavailableException unlikely) {		} catch (SpiUnavailableException unlikely) {
			// Because this function allocates a totally random SPI, it really shouldn't ever
			// fail to allocate an SPI; we simply need this because the exception is checked.
	throw new ResourceUnavailableException("No SPIs available");		throw new ResourceUnavailableException("No SPIs available");
	}		}
	}		}
	@@ -275,8 +297,8 @@ public final class IpSecManager {
	*		*
	* @param destinationAddress the destination address for traffic bearing the requested SPI.		* @param destinationAddress the destination address for traffic bearing the requested SPI.
	* For inbound traffic, the destination should be an address currently assigned on-device.		* For inbound traffic, the destination should be an address currently assigned on-device.
	* @param requestedSpi the requested SPI, or '0' to allocate a random SPI. The range 1-255 is		* @param requestedSpi the requested SPI. The range 1-255 is reserved and may not be used. See
	* reserved and may not be used. See RFC 4303 Section 2.1.		* RFC 4303 Section 2.1.
	* @return the reserved SecurityParameterIndex		* @return the reserved SecurityParameterIndex
	* @throws {@link #ResourceUnavailableException} indicating that too many SPIs are		* @throws {@link #ResourceUnavailableException} indicating that too many SPIs are
	* currently allocated for this user		* currently allocated for this user
	@@ -290,7 +312,11 @@ public final class IpSecManager {
	if (requestedSpi == IpSecManager.INVALID_SECURITY_PARAMETER_INDEX) {		if (requestedSpi == IpSecManager.INVALID_SECURITY_PARAMETER_INDEX) {
	throw new IllegalArgumentException("Requested SPI must be a valid (non-zero) SPI");		throw new IllegalArgumentException("Requested SPI must be a valid (non-zero) SPI");
	}		}
			try {
	return new SecurityParameterIndex(mService, destinationAddress, requestedSpi);		return new SecurityParameterIndex(mService, destinationAddress, requestedSpi);
			} catch (ServiceSpecificException e) {
			throw rethrowUncheckedExceptionFromServiceSpecificException(e);
			}
	}		}

	/**		/**
	@@ -425,6 +451,8 @@ public final class IpSecManager {
	// constructor takes control and closes the user's FD when we exit the method.		// constructor takes control and closes the user's FD when we exit the method.
	try (ParcelFileDescriptor pfd = ParcelFileDescriptor.dup(socket)) {		try (ParcelFileDescriptor pfd = ParcelFileDescriptor.dup(socket)) {
	mService.applyTransportModeTransform(pfd, direction, transform.getResourceId());		mService.applyTransportModeTransform(pfd, direction, transform.getResourceId());
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	@@ -483,6 +511,8 @@ public final class IpSecManager {
	public void removeTransportModeTransforms(@NonNull FileDescriptor socket) throws IOException {		public void removeTransportModeTransforms(@NonNull FileDescriptor socket) throws IOException {
	try (ParcelFileDescriptor pfd = ParcelFileDescriptor.dup(socket)) {		try (ParcelFileDescriptor pfd = ParcelFileDescriptor.dup(socket)) {
	mService.removeTransportModeTransforms(pfd);		mService.removeTransportModeTransforms(pfd);
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	@@ -576,6 +606,13 @@ public final class IpSecManager {
	mResourceId = INVALID_RESOURCE_ID;		mResourceId = INVALID_RESOURCE_ID;
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
			} catch (Exception e) {
			// On close we swallow all random exceptions since failure to close is not
			// actionable by the user.
			Log.e(TAG, "Failed to close " + this + ", Exception=" + e);
			} finally {
			mResourceId = INVALID_RESOURCE_ID;
			mCloseGuard.close();
	}		}

	try {		try {
	@@ -584,7 +621,6 @@ public final class IpSecManager {
	Log.e(TAG, "Failed to close UDP Encapsulation Socket with Port= " + mPort);		Log.e(TAG, "Failed to close UDP Encapsulation Socket with Port= " + mPort);
	throw e;		throw e;
	}		}
	mCloseGuard.close();
	}		}

	/** Check that the socket was closed properly. */		/** Check that the socket was closed properly. */
	@@ -601,6 +637,17 @@ public final class IpSecManager {
	public int getResourceId() {		public int getResourceId() {
	return mResourceId;		return mResourceId;
	}		}

			@Override
			public String toString() {
			return new StringBuilder()
			.append("UdpEncapsulationSocket{port=")
			.append(mPort)
			.append(",resourceId=")
			.append(mResourceId)
			.append("}")
			.toString();
			}
	};		};

	/**		/**
	@@ -628,7 +675,11 @@ public final class IpSecManager {
	if (port == 0) {		if (port == 0) {
	throw new IllegalArgumentException("Specified port must be a valid port number!");		throw new IllegalArgumentException("Specified port must be a valid port number!");
	}		}
			try {
	return new UdpEncapsulationSocket(mService, port);		return new UdpEncapsulationSocket(mService, port);
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
			}
	}		}

	/**		/**
	@@ -651,7 +702,11 @@ public final class IpSecManager {
	@NonNull		@NonNull
	public UdpEncapsulationSocket openUdpEncapsulationSocket()		public UdpEncapsulationSocket openUdpEncapsulationSocket()
	throws IOException, ResourceUnavailableException {		throws IOException, ResourceUnavailableException {
			try {
	return new UdpEncapsulationSocket(mService, 0);		return new UdpEncapsulationSocket(mService, 0);
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
			}
	}		}

	/**		/**
	@@ -699,6 +754,8 @@ public final class IpSecManager {
	try {		try {
	mService.addAddressToTunnelInterface(		mService.addAddressToTunnelInterface(
	mResourceId, new LinkAddress(address, prefixLen), mOpPackageName);		mResourceId, new LinkAddress(address, prefixLen), mOpPackageName);
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	@@ -719,6 +776,8 @@ public final class IpSecManager {
	try {		try {
	mService.removeAddressFromTunnelInterface(		mService.removeAddressFromTunnelInterface(
	mResourceId, new LinkAddress(address, prefixLen), mOpPackageName);		mResourceId, new LinkAddress(address, prefixLen), mOpPackageName);
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	@@ -771,12 +830,17 @@ public final class IpSecManager {
	public void close() {		public void close() {
	try {		try {
	mService.deleteTunnelInterface(mResourceId, mOpPackageName);		mService.deleteTunnelInterface(mResourceId, mOpPackageName);
	mResourceId = INVALID_RESOURCE_ID;
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		} catch (Exception e) {
			// On close we swallow all random exceptions since failure to close is not
			// actionable by the user.
			Log.e(TAG, "Failed to close " + this + ", Exception=" + e);
			} finally {
			mResourceId = INVALID_RESOURCE_ID;
	mCloseGuard.close();		mCloseGuard.close();
	}		}
			}

	/** Check that the Interface was closed properly. */		/** Check that the Interface was closed properly. */
	@Override		@Override
	@@ -792,6 +856,17 @@ public final class IpSecManager {
	public int getResourceId() {		public int getResourceId() {
	return mResourceId;		return mResourceId;
	}		}

			@Override
			public String toString() {
			return new StringBuilder()
			.append("IpSecTunnelInterface{ifname=")
			.append(mInterfaceName)
			.append(",resourceId=")
			.append(mResourceId)
			.append("}")
			.toString();
			}
	}		}

	/**		/**
	@@ -815,8 +890,12 @@ public final class IpSecManager {
	public IpSecTunnelInterface createIpSecTunnelInterface(@NonNull InetAddress localAddress,		public IpSecTunnelInterface createIpSecTunnelInterface(@NonNull InetAddress localAddress,
	@NonNull InetAddress remoteAddress, @NonNull Network underlyingNetwork)		@NonNull InetAddress remoteAddress, @NonNull Network underlyingNetwork)
	throws ResourceUnavailableException, IOException {		throws ResourceUnavailableException, IOException {
			try {
	return new IpSecTunnelInterface(		return new IpSecTunnelInterface(
	mContext, mService, localAddress, remoteAddress, underlyingNetwork);		mContext, mService, localAddress, remoteAddress, underlyingNetwork);
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
			}
	}		}

	/**		/**
	@@ -844,6 +923,8 @@ public final class IpSecManager {
	mService.applyTunnelModeTransform(		mService.applyTunnelModeTransform(
	tunnel.getResourceId(), direction,		tunnel.getResourceId(), direction,
	transform.getResourceId(), mContext.getOpPackageName());		transform.getResourceId(), mContext.getOpPackageName());
			} catch (ServiceSpecificException e) {
			throw rethrowCheckedExceptionFromServiceSpecificException(e);
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	@@ -859,4 +940,44 @@ public final class IpSecManager {
	mContext = ctx;		mContext = ctx;
	mService = checkNotNull(service, "missing service");		mService = checkNotNull(service, "missing service");
	}		}

			private static void maybeHandleServiceSpecificException(ServiceSpecificException sse) {
			// OsConstants are late binding, so switch statements can't be used.
			if (sse.errorCode == OsConstants.EINVAL) {
			throw new IllegalArgumentException(sse);
			} else if (sse.errorCode == OsConstants.EAGAIN) {
			throw new IllegalStateException(sse);
			} else if (sse.errorCode == OsConstants.EOPNOTSUPP) {
			throw new UnsupportedOperationException(sse);
			}
			}

			/**
			* Convert an Errno SSE to the correct Unchecked exception type.
			*
			* This method never actually returns.
			*/
			// package
			static RuntimeException
			rethrowUncheckedExceptionFromServiceSpecificException(ServiceSpecificException sse) {
			maybeHandleServiceSpecificException(sse);
			throw new RuntimeException(sse);
			}

			/**
			* Convert an Errno SSE to the correct Checked or Unchecked exception type.
			*
			* This method may throw IOException, or it may throw an unchecked exception; it will never
			* actually return.
			*/
			// package
			static IOException rethrowCheckedExceptionFromServiceSpecificException(
			ServiceSpecificException sse) throws IOException {
			// First see if this is an unchecked exception of a type we know.
			// If so, then we prefer the unchecked (specific) type of exception.
			maybeHandleServiceSpecificException(sse);
			// If not, then all we can do is provide the SSE in the form of an IOException.
			throw new ErrnoException(
			"IpSec encountered errno=" + sse.errorCode, sse.errorCode).rethrowAsIOException();
			}
	}		}

core/java/android/net/IpSecTransform.java

+16 −0

Original line number	Original line	Diff line number	Diff line
	@@ -29,6 +29,7 @@ import android.os.Handler;
	import android.os.IBinder;		import android.os.IBinder;
	import android.os.RemoteException;		import android.os.RemoteException;
	import android.os.ServiceManager;		import android.os.ServiceManager;
			import android.os.ServiceSpecificException;
	import android.util.Log;		import android.util.Log;

	import com.android.internal.annotations.VisibleForTesting;		import com.android.internal.annotations.VisibleForTesting;
	@@ -137,6 +138,8 @@ public final class IpSecTransform implements AutoCloseable {
	mResourceId = result.resourceId;		mResourceId = result.resourceId;
	Log.d(TAG, "Added Transform with Id " + mResourceId);		Log.d(TAG, "Added Transform with Id " + mResourceId);
	mCloseGuard.open("build");		mCloseGuard.open("build");
			} catch (ServiceSpecificException e) {
			throw IpSecManager.rethrowUncheckedExceptionFromServiceSpecificException(e);
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowAsRuntimeException();		throw e.rethrowAsRuntimeException();
	}		}
	@@ -181,6 +184,10 @@ public final class IpSecTransform implements AutoCloseable {
	stopNattKeepalive();		stopNattKeepalive();
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowAsRuntimeException();		throw e.rethrowAsRuntimeException();
			} catch (Exception e) {
			// On close we swallow all random exceptions since failure to close is not
			// actionable by the user.
			Log.e(TAG, "Failed to close " + this + ", Exception=" + e);
	} finally {		} finally {
	mResourceId = INVALID_RESOURCE_ID;		mResourceId = INVALID_RESOURCE_ID;
	mCloseGuard.close();		mCloseGuard.close();
	@@ -507,4 +514,13 @@ public final class IpSecTransform implements AutoCloseable {
	mConfig = new IpSecConfig();		mConfig = new IpSecConfig();
	}		}
	}		}

			@Override
			public String toString() {
			return new StringBuilder()
			.append("IpSecTransform{resourceId=")
			.append(mResourceId)
			.append("}")
			.toString();
			}
	}		}

services/core/java/com/android/server/IpSecService.java

+23 −48

Original line number	Original line	Diff line number	Diff line
	@@ -1101,9 +1101,11 @@ public class IpSecService extends IIpSecService.Stub {
	new RefcountedResource<SpiRecord>(		new RefcountedResource<SpiRecord>(
	new SpiRecord(resourceId, "", destinationAddress, spi), binder));		new SpiRecord(resourceId, "", destinationAddress, spi), binder));
	} catch (ServiceSpecificException e) {		} catch (ServiceSpecificException e) {
	// TODO: Add appropriate checks when other ServiceSpecificException types are supported		if (e.errorCode == OsConstants.ENOENT) {
	return new IpSecSpiResponse(		return new IpSecSpiResponse(
	IpSecManager.Status.SPI_UNAVAILABLE, INVALID_RESOURCE_ID, spi);		IpSecManager.Status.SPI_UNAVAILABLE, INVALID_RESOURCE_ID, spi);
			}
			throw e;
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	@@ -1115,7 +1117,6 @@ public class IpSecService extends IIpSecService.Stub {
	*/		*/
	private void releaseResource(RefcountedResourceArray resArray, int resourceId)		private void releaseResource(RefcountedResourceArray resArray, int resourceId)
	throws RemoteException {		throws RemoteException {

	resArray.getRefcountedResourceOrThrow(resourceId).userRelease();		resArray.getRefcountedResourceOrThrow(resourceId).userRelease();
	}		}

	@@ -1315,15 +1316,12 @@ public class IpSecService extends IIpSecService.Stub {
	releaseNetId(ikey);		releaseNetId(ikey);
	releaseNetId(okey);		releaseNetId(okey);
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	} catch (ServiceSpecificException e) {		} catch (Throwable t) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception		// Release keys if we got an error.
	}

	// If we make it to here, then something has gone wrong and we couldn't create a VTI.
	// Release the keys that we reserved, and return an error status.
	releaseNetId(ikey);		releaseNetId(ikey);
	releaseNetId(okey);		releaseNetId(okey);
	return new IpSecTunnelInterfaceResponse(IpSecManager.Status.RESOURCE_UNAVAILABLE);		throw t;
			}
	}		}

	/**		/**
	@@ -1352,9 +1350,6 @@ public class IpSecService extends IIpSecService.Stub {
	localAddr.getPrefixLength());		localAddr.getPrefixLength());
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	} catch (ServiceSpecificException e) {
	// If we get here, one of the arguments provided was invalid. Wrap the SSE, and throw.
	throw new IllegalArgumentException(e);
	}		}
	}		}

	@@ -1384,9 +1379,6 @@ public class IpSecService extends IIpSecService.Stub {
	localAddr.getPrefixLength());		localAddr.getPrefixLength());
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	} catch (ServiceSpecificException e) {
	// If we get here, one of the arguments provided was invalid. Wrap the SSE, and throw.
	throw new IllegalArgumentException(e);
	}		}
	}		}

	@@ -1590,12 +1582,7 @@ public class IpSecService extends IIpSecService.Stub {
	dependencies.add(refcountedSpiRecord);		dependencies.add(refcountedSpiRecord);
	SpiRecord spiRecord = refcountedSpiRecord.getResource();		SpiRecord spiRecord = refcountedSpiRecord.getResource();

	try {
	createOrUpdateTransform(c, resourceId, spiRecord, socketRecord);		createOrUpdateTransform(c, resourceId, spiRecord, socketRecord);
	} catch (ServiceSpecificException e) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception
	return new IpSecTransformResponse(IpSecManager.Status.RESOURCE_UNAVAILABLE);
	}

	// SA was created successfully, time to construct a record and lock it away		// SA was created successfully, time to construct a record and lock it away
	userRecord.mTransformRecords.put(		userRecord.mTransformRecords.put(
	@@ -1642,7 +1629,6 @@ public class IpSecService extends IIpSecService.Stub {
	c.getMode() == IpSecTransform.MODE_TRANSPORT,		c.getMode() == IpSecTransform.MODE_TRANSPORT,
	"Transform mode was not Transport mode; cannot be applied to a socket");		"Transform mode was not Transport mode; cannot be applied to a socket");

	try {
	mSrvConfig		mSrvConfig
	.getNetdInstance()		.getNetdInstance()
	.ipSecApplyTransportModeTransform(		.ipSecApplyTransportModeTransform(
	@@ -1652,13 +1638,6 @@ public class IpSecService extends IIpSecService.Stub {
	c.getSourceAddress(),		c.getSourceAddress(),
	c.getDestinationAddress(),		c.getDestinationAddress(),
	info.getSpiRecord().getSpi());		info.getSpiRecord().getSpi());
	} catch (ServiceSpecificException e) {
	if (e.errorCode == EINVAL) {
	throw new IllegalArgumentException(e.toString());
	} else {
	throw e;
	}
	}
	}		}

	/**		/**
	@@ -1670,13 +1649,9 @@ public class IpSecService extends IIpSecService.Stub {
	@Override		@Override
	public synchronized void removeTransportModeTransforms(ParcelFileDescriptor socket)		public synchronized void removeTransportModeTransforms(ParcelFileDescriptor socket)
	throws RemoteException {		throws RemoteException {
	try {
	mSrvConfig		mSrvConfig
	.getNetdInstance()		.getNetdInstance()
	.ipSecRemoveTransportModeTransform(socket.getFileDescriptor());		.ipSecRemoveTransportModeTransform(socket.getFileDescriptor());
	} catch (ServiceSpecificException e) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception
	}
	}		}

	/**		/**