Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3dc6dbe8 authored by Lorenzo Colitti's avatar Lorenzo Colitti
Browse files

Move VPN code from ConnectivityService to VpnManagerService. 

ConnectivityService itself does not depend on mVpns or the Vpn
class any more. Most of this CL is simply moving code from one
class to another:

- Move the AIDL calls from IConnectivityManager to IVpnManager.
- Move the implementation from ConnectivityService to
  the new VpnManagerService.
- Move the APIs from ConnectivityManager to VpnManager, but
  temporarily maintain some shims in ConnectivityManager for the
  moved calls so that existing callers do not have to be modified
  in this CL.
- Update VpnService to call IVpnManager instead of
  IConnectivityManager.
- Move the code that registers the VpnManager service from
  ConnectivityFrameworkInitializer to SystemServiceRegistry.

Bug: 173331190
Test: atest HostsideVpnTests FrameworksNetTests CtsNetTestCases
Change-Id: I4911e2144df721a94fa00da9edf0dc372a7091c2
parent f83d22b7

core/java/android/app/SystemServiceRegistry.java

+11 −0
Original line number Diff line number Diff line
@@ -116,11 +116,13 @@ import android.net.EthernetManager; 
import android.net.IEthernetManager;

import android.net.IIpSecService;

import android.net.INetworkPolicyManager;

import android.net.IVpnManager;

import android.net.IpSecManager;

import android.net.NetworkPolicyManager;

import android.net.NetworkScoreManager;

import android.net.NetworkWatchlistManager;

import android.net.TetheringManager;

import android.net.VpnManager;

import android.net.lowpan.ILowpanManager;

import android.net.lowpan.LowpanManager;

import android.net.nsd.INsdManager;
@@ -358,6 +360,15 @@ public final class SystemServiceRegistry { 
                        ctx, () -> ServiceManager.getService(Context.TETHERING_SERVICE));

            }});



        registerService(Context.VPN_MANAGEMENT_SERVICE, VpnManager.class,

                new CachedServiceFetcher<VpnManager>() {

            @Override

            public VpnManager createService(ContextImpl ctx) throws ServiceNotFoundException {

                IBinder b = ServiceManager.getService(Context.VPN_MANAGEMENT_SERVICE);

                IVpnManager service = IVpnManager.Stub.asInterface(b);

                return new VpnManager(ctx, service);

            }});



        registerService(Context.VCN_MANAGEMENT_SERVICE, VcnManager.class,

                new CachedServiceFetcher<VcnManager>() {

            @Override

core/java/android/net/IVpnManager.aidl

+38 −0
Original line number Diff line number Diff line
@@ -16,9 +16,47 @@ 


package android.net;



import android.net.Network;



import com.android.internal.net.LegacyVpnInfo;

import com.android.internal.net.VpnConfig;

import com.android.internal.net.VpnProfile;



/**

 * Interface that manages VPNs.

 */

/** {@hide} */

interface IVpnManager {

    /** VpnService APIs */

    boolean prepareVpn(String oldPackage, String newPackage, int userId);

    void setVpnPackageAuthorization(String packageName, int userId, int vpnType);

    ParcelFileDescriptor establishVpn(in VpnConfig config);

    boolean addVpnAddress(String address, int prefixLength);

    boolean removeVpnAddress(String address, int prefixLength);

    boolean setUnderlyingNetworksForVpn(in Network[] networks);



    /** VpnManager APIs */

    boolean provisionVpnProfile(in VpnProfile profile, String packageName);

    void deleteVpnProfile(String packageName);

    void startVpnProfile(String packageName);

    void stopVpnProfile(String packageName);



    /** Always-on VPN APIs */

    boolean isAlwaysOnVpnPackageSupported(int userId, String packageName);

    boolean setAlwaysOnVpnPackage(int userId, String packageName, boolean lockdown,

            in List<String> lockdownAllowlist);

    String getAlwaysOnVpnPackage(int userId);

    boolean isVpnLockdownEnabled(int userId);

    List<String> getVpnLockdownAllowlist(int userId);

    boolean isCallerCurrentAlwaysOnVpnApp();

    boolean isCallerCurrentAlwaysOnVpnLockdownApp();



    /** Legacy VPN APIs */

    void startLegacyVpn(in VpnProfile profile);

    LegacyVpnInfo getLegacyVpnInfo(int userId);

    boolean updateLockdownVpn();



    /** General system APIs */

    VpnConfig getVpnConfig(int userId);

    void factoryReset();

}

packages/Connectivity/framework/src/android/net/ConnectivityFrameworkInitializer.java

+0 −11
Original line number Diff line number Diff line
@@ -49,17 +49,6 @@ public final class ConnectivityFrameworkInitializer { 
                }

        );



        // TODO: move outside of the connectivity JAR

        SystemServiceRegistry.registerContextAwareService(

                Context.VPN_MANAGEMENT_SERVICE,

                VpnManager.class,

                (context) -> {

                    final ConnectivityManager cm = context.getSystemService(

                            ConnectivityManager.class);

                    return cm.createVpnManager();

                }

        );



        SystemServiceRegistry.registerContextAwareService(

                Context.CONNECTIVITY_DIAGNOSTICS_SERVICE,

                ConnectivityDiagnosticsManager.class,

packages/Connectivity/framework/src/android/net/ConnectivityManager.java

+39 −90
Original line number Diff line number Diff line
@@ -824,6 +824,7 @@ public class ConnectivityManager { 


    @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 130143562)

    private final IConnectivityManager mService;



    /**

     * A kludge to facilitate static access where a Context pointer isn't available, like in the

     * case of the static set/getProcessDefaultNetwork methods and from the Network class.
@@ -1069,106 +1070,55 @@ public class ConnectivityManager { 
    }



    /**

     * Checks if a VPN app supports always-on mode.

     *

     * In order to support the always-on feature, an app has to

     * <ul>

     *     <li>target {@link VERSION_CODES#N API 24} or above, and

     *     <li>not opt out through the {@link VpnService#SERVICE_META_DATA_SUPPORTS_ALWAYS_ON}

     *         meta-data field.

     * </ul>

     *

     * @param userId The identifier of the user for whom the VPN app is installed.

     * @param vpnPackage The canonical package name of the VPN app.

     * @return {@code true} if and only if the VPN app exists and supports always-on mode.

     * Calls VpnManager#isAlwaysOnVpnPackageSupportedForUser.

     * @deprecated TODO: remove when callers have migrated to VpnManager.

     * @hide

     */

    @Deprecated

    public boolean isAlwaysOnVpnPackageSupportedForUser(int userId, @Nullable String vpnPackage) {

        try {

            return mService.isAlwaysOnVpnPackageSupported(userId, vpnPackage);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

        return getVpnManager().isAlwaysOnVpnPackageSupportedForUser(userId, vpnPackage);

    }



    /**

     * Configures an always-on VPN connection through a specific application.

     * This connection is automatically granted and persisted after a reboot.

     *

     * <p>The designated package should declare a {@link VpnService} in its

     *    manifest guarded by {@link android.Manifest.permission.BIND_VPN_SERVICE},

     *    otherwise the call will fail.

     *

     * @param userId The identifier of the user to set an always-on VPN for.

     * @param vpnPackage The package name for an installed VPN app on the device, or {@code null}

     *                   to remove an existing always-on VPN configuration.

     * @param lockdownEnabled {@code true} to disallow networking when the VPN is not connected or

     *        {@code false} otherwise.

     * @param lockdownAllowlist The list of packages that are allowed to access network directly

     *         when VPN is in lockdown mode but is not running. Non-existent packages are ignored so

     *         this method must be called when a package that should be allowed is installed or

     *         uninstalled.

     * @return {@code true} if the package is set as always-on VPN controller;

     *         {@code false} otherwise.

    * Calls VpnManager#setAlwaysOnVpnPackageForUser.

     * @deprecated TODO: remove when callers have migrated to VpnManager.

     * @hide

     */

    @RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)

    @Deprecated

    public boolean setAlwaysOnVpnPackageForUser(int userId, @Nullable String vpnPackage,

            boolean lockdownEnabled, @Nullable List<String> lockdownAllowlist) {

        try {

            return mService.setAlwaysOnVpnPackage(

                    userId, vpnPackage, lockdownEnabled, lockdownAllowlist);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

        return getVpnManager().setAlwaysOnVpnPackageForUser(userId, vpnPackage, lockdownEnabled,

                lockdownAllowlist);

    }



    /**

     * Returns the package name of the currently set always-on VPN application.

     * If there is no always-on VPN set, or the VPN is provided by the system instead

     * of by an app, {@code null} will be returned.

     *

     * @return Package name of VPN controller responsible for always-on VPN,

     *         or {@code null} if none is set.

     * Calls VpnManager#getAlwaysOnVpnPackageForUser.

     * @deprecated TODO: remove when callers have migrated to VpnManager.

     * @hide

     */

    @RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)

    @Deprecated

    public String getAlwaysOnVpnPackageForUser(int userId) {

        try {

            return mService.getAlwaysOnVpnPackage(userId);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

        return getVpnManager().getAlwaysOnVpnPackageForUser(userId);

    }



    /**

     * @return whether always-on VPN is in lockdown mode.

     *

     * Calls VpnManager#isVpnLockdownEnabled.

     * @deprecated TODO: remove when callers have migrated to VpnManager.

     * @hide

     **/

    @RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)

     */

    @Deprecated

    public boolean isVpnLockdownEnabled(int userId) {

        try {

            return mService.isVpnLockdownEnabled(userId);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }



        return getVpnManager().isVpnLockdownEnabled(userId);

    }



    /**

     * @return the list of packages that are allowed to access network when always-on VPN is in

     * lockdown mode but not connected. Returns {@code null} when VPN lockdown is not active.

     *

     * Calls VpnManager#getVpnLockdownAllowlist.

     * @deprecated TODO: remove when callers have migrated to VpnManager.

     * @hide

     **/

    @RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)

     */

    @Deprecated

    public List<String> getVpnLockdownWhitelist(int userId) {

        try {

            return mService.getVpnLockdownWhitelist(userId);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

        return getVpnManager().getVpnLockdownAllowlist(userId);

    }



    /**
@@ -3219,20 +3169,13 @@ public class ConnectivityManager { 
    }



    /**

     * If the LockdownVpn mechanism is enabled, updates the vpn

     * with a reload of its profile.

     *

     * @return a boolean with {@code} indicating success

     *

     * <p>This method can only be called by the system UID

     * {@hide}

     * Calls VpnManager#updateLockdownVpn.

     * @deprecated TODO: remove when callers have migrated to VpnManager.

     * @hide

     */

    @Deprecated

    public boolean updateLockdownVpn() {

        try {

            return mService.updateLockdownVpn();

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

        return getVpnManager().updateLockdownVpn();

    }



    /**
@@ -4596,6 +4539,8 @@ public class ConnectivityManager { 
        try {

            mService.factoryReset();

            mTetheringManager.stopAllTethering();

            // TODO: Migrate callers to VpnManager#factoryReset.

            getVpnManager().factoryReset();

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }
@@ -4889,9 +4834,13 @@ public class ConnectivityManager { 
        return new TestNetworkManager(ITestNetworkManager.Stub.asInterface(tnBinder));

    }



    /** @hide */

    public VpnManager createVpnManager() {

        return new VpnManager(mContext, mService);

    /**

     * Temporary hack to shim calls from ConnectivityManager to VpnManager. We cannot store a

     * private final mVpnManager because ConnectivityManager is initialized before VpnManager.

     * @hide TODO: remove.

     */

    public VpnManager getVpnManager() {

        return mContext.getSystemService(VpnManager.class);

    }



    /** @hide */

packages/Connectivity/framework/src/android/net/IConnectivityManager.aidl

+0 −37
Original line number Diff line number Diff line
@@ -42,9 +42,6 @@ import android.os.PersistableBundle; 
import android.os.ResultReceiver;



import com.android.connectivity.aidl.INetworkAgent;

import com.android.internal.net.LegacyVpnInfo;

import com.android.internal.net.VpnConfig;

import com.android.internal.net.VpnProfile;



/**

 * Interface that answers queries about, and allows changing, the
@@ -122,34 +119,6 @@ interface IConnectivityManager 


    ProxyInfo getProxyForNetwork(in Network nework);



    boolean prepareVpn(String oldPackage, String newPackage, int userId);



    void setVpnPackageAuthorization(String packageName, int userId, int vpnType);



    ParcelFileDescriptor establishVpn(in VpnConfig config);



    boolean provisionVpnProfile(in VpnProfile profile, String packageName);



    void deleteVpnProfile(String packageName);



    void startVpnProfile(String packageName);



    void stopVpnProfile(String packageName);



    VpnConfig getVpnConfig(int userId);



    @UnsupportedAppUsage(maxTargetSdk = 30, trackingBug = 170729553)

    void startLegacyVpn(in VpnProfile profile);



    LegacyVpnInfo getLegacyVpnInfo(int userId);



    boolean updateLockdownVpn();

    boolean isAlwaysOnVpnPackageSupported(int userId, String packageName);

    boolean setAlwaysOnVpnPackage(int userId, String packageName, boolean lockdown,

            in List<String> lockdownWhitelist);

    String getAlwaysOnVpnPackage(int userId);

    boolean isVpnLockdownEnabled(int userId);

    List<String> getVpnLockdownWhitelist(int userId);

    void setRequireVpnForUids(boolean requireVpn, in UidRange[] ranges);

    void setLegacyLockdownVpnEnabled(boolean enabled);
@@ -200,10 +169,6 @@ interface IConnectivityManager 


    int getRestoreDefaultNetworkDelay(int networkType);



    boolean addVpnAddress(String address, int prefixLength);

    boolean removeVpnAddress(String address, int prefixLength);

    boolean setUnderlyingNetworksForVpn(in Network[] networks);



    void factoryReset();



    void startNattKeepalive(in Network network, int intervalSeconds,
@@ -223,8 +188,6 @@ interface IConnectivityManager 
    byte[] getNetworkWatchlistConfigHash();



    int getConnectionOwnerUid(in ConnectionInfo connectionInfo);

    boolean isCallerCurrentAlwaysOnVpnApp();

    boolean isCallerCurrentAlwaysOnVpnLockdownApp();



    void registerConnectivityDiagnosticsCallback(in IConnectivityDiagnosticsCallback callback,

            in NetworkRequest request, String callingPackageName);