Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3e18b0e9 authored by Benedict Wong's avatar Benedict Wong Committed by Chalard Jean
Browse files

Restart Bypassable VPNs when changing lockdown mode state 

This change ensures that VPNs are restarted when the lockdown mode
changes. Lockdown VPNs can't be bypassable, and the stack doesn't
treat bypassable an non-bypassable VPNs the same way so the agent
has to be restarted when lockdown mode changes.

Bug: 246162564
Test: atest FrameworksNetTests:VpnTest
Change-Id: Ia0eec71310848ac20c98cf2b16f55ca5b7f8ff7f
parent a3019071

services/core/java/com/android/server/connectivity/Vpn.java

+39 −18
Original line number Diff line number Diff line
@@ -679,6 +679,14 @@ public class Vpn { 
                boolean isIpv4) {

            return MtuUtils.getMtu(childProposals, maxMtu, underlyingMtu, isIpv4);

        }



        /** Verify the binder calling UID is the one passed in arguments */

        public void verifyCallingUidAndPackage(Context context, String packageName, int userId) {

            final int callingUid = Binder.getCallingUid();

            if (getAppUid(context, packageName, userId) != callingUid) {

                throw new SecurityException(packageName + " does not belong to uid " + callingUid);

            }

        }

    }



    @VisibleForTesting
@@ -726,7 +734,7 @@ public class Vpn { 
        mUserManager = mContext.getSystemService(UserManager.class);



        mPackage = VpnConfig.LEGACY_VPN;

        mOwnerUID = getAppUid(mPackage, mUserId);

        mOwnerUID = getAppUid(mContext, mPackage, mUserId);

        mIsPackageTargetingAtLeastQ = doesPackageTargetAtLeastQ(mPackage);



        try {
@@ -823,7 +831,7 @@ public class Vpn { 
    }



    /**

     * Chooses whether to force all connections to go though VPN.

     * Chooses whether to force all connections to go through VPN.

     *

     * Used to enable/disable legacy VPN lockdown.

     *
@@ -831,7 +839,7 @@ public class Vpn { 
     * {@link #setAlwaysOnPackage(String, boolean, List<String>)}; previous settings from calling

     * that function will be replaced and saved with the always-on state.

     *

     * @param lockdown whether to prevent all traffic outside of a VPN.

     * @param lockdown whether to prevent all traffic outside of the VPN.

     */

    public synchronized void setLockdown(boolean lockdown) {

        enforceControlPermissionOrInternalCaller();
@@ -1102,6 +1110,7 @@ public class Vpn { 
            mAlwaysOn = false;

        }



        final boolean oldLockdownState = mLockdown;

        mLockdown = (mAlwaysOn && lockdown);

        mLockdownAllowlist = (mLockdown && lockdownAllowlist != null)

                ? Collections.unmodifiableList(new ArrayList<>(lockdownAllowlist))
@@ -1112,6 +1121,13 @@ public class Vpn { 
        if (isCurrentPreparedPackage(packageName)) {

            updateAlwaysOnNotification(mNetworkInfo.getDetailedState());

            setVpnForcedLocked(mLockdown);



            // Lockdown forces the VPN to be non-bypassable (see #agentConnect) because it makes

            // no sense for a VPN to be bypassable when connected but not when not connected.

            // As such, changes in lockdown need to restart the agent.

            if (mNetworkAgent != null && oldLockdownState != mLockdown) {

                startNewNetworkAgent(mNetworkAgent, "Lockdown mode changed");

            }

        } else {

            // Prepare this app. The notification will update as a side-effect of updateState().

            // It also calls setVpnForcedLocked().
@@ -1349,7 +1365,8 @@ public class Vpn { 
        // We can't just check that packageName matches mPackage, because if the app was uninstalled

        // and reinstalled it will no longer be prepared. Similarly if there is a shared UID, the

        // calling package may not be the same as the prepared package. Check both UID and package.

        return getAppUid(packageName, mUserId) == mOwnerUID && mPackage.equals(packageName);

        return getAppUid(mContext, packageName, mUserId) == mOwnerUID

                && mPackage.equals(packageName);

    }



    /** Prepare the VPN for the given package. Does not perform permission checks. */
@@ -1390,7 +1407,7 @@ public class Vpn { 


            Log.i(TAG, "Switched from " + mPackage + " to " + newPackage);

            mPackage = newPackage;

            mOwnerUID = getAppUid(newPackage, mUserId);

            mOwnerUID = getAppUid(mContext, newPackage, mUserId);

            mIsPackageTargetingAtLeastQ = doesPackageTargetAtLeastQ(newPackage);

            try {

                mNms.allowProtect(mOwnerUID);
@@ -1411,7 +1428,7 @@ public class Vpn { 
        // Check if the caller is authorized.

        enforceControlPermissionOrInternalCaller();



        final int uid = getAppUid(packageName, mUserId);

        final int uid = getAppUid(mContext, packageName, mUserId);

        if (uid == -1 || VpnConfig.LEGACY_VPN.equals(packageName)) {

            // Authorization for nonexistent packages (or fake ones) can't be updated.

            return false;
@@ -1491,11 +1508,11 @@ public class Vpn { 
                || isVpnServicePreConsented(context, packageName);

    }



    private int getAppUid(final String app, final int userId) {

    private static int getAppUid(final Context context, final String app, final int userId) {

        if (VpnConfig.LEGACY_VPN.equals(app)) {

            return Process.myUid();

        }

        PackageManager pm = mContext.getPackageManager();

        PackageManager pm = context.getPackageManager();

        final long token = Binder.clearCallingIdentity();

        try {

            return pm.getPackageUidAsUser(app, userId);
@@ -1624,6 +1641,10 @@ public class Vpn { 
     */

    private boolean updateLinkPropertiesInPlaceIfPossible(NetworkAgent agent, VpnConfig oldConfig) {

        // NetworkAgentConfig cannot be updated without registering a new NetworkAgent.

        // Strictly speaking, bypassability is affected by lockdown and therefore it's possible

        // it doesn't actually change even if mConfig.allowBypass changed. It might be theoretically

        // possible to do handover in this case, but this is far from obvious to VPN authors and

        // it's simpler if the rule is just "can't update in place if you change allow bypass".

        if (oldConfig.allowBypass != mConfig.allowBypass) {

            Log.i(TAG, "Handover not possible due to changes to allowBypass");

            return false;
@@ -1665,10 +1686,11 @@ public class Vpn { 
        mLegacyState = LegacyVpnInfo.STATE_CONNECTING;

        updateState(DetailedState.CONNECTING, "agentConnect");



        final boolean bypassable = mConfig.allowBypass && !mLockdown;

        final NetworkAgentConfig networkAgentConfig = new NetworkAgentConfig.Builder()

                .setLegacyType(ConnectivityManager.TYPE_VPN)

                .setLegacyTypeName("VPN")

                .setBypassableVpn(mConfig.allowBypass && !mLockdown)

                .setBypassableVpn(bypassable)

                .setVpnRequiresValidation(mConfig.requiresInternetValidation)

                .setLocalRoutesExcludedForVpn(mConfig.excludeLocalRoutes)

                .build();
@@ -1682,7 +1704,7 @@ public class Vpn { 
        capsBuilder.setTransportInfo(new VpnTransportInfo(

                getActiveVpnType(),

                mConfig.session,

                mConfig.allowBypass,

                bypassable,

                expensive));



        // Only apps targeting Q and above can explicitly declare themselves as metered.
@@ -1713,6 +1735,10 @@ public class Vpn { 
            Binder.restoreCallingIdentity(token);

        }

        updateState(DetailedState.CONNECTED, "agentConnect");

        if (isIkev2VpnRunner()) {

            final IkeSessionWrapper session = ((IkeV2VpnRunner) mVpnRunner).mSession;

            if (null != session) session.setUnderpinnedNetwork(mNetworkAgent.getNetwork());

        }

    }



    private static boolean areLongLivedTcpConnectionsExpensive(@NonNull VpnRunner runner) {
@@ -1907,7 +1933,7 @@ public class Vpn { 
    private SortedSet<Integer> getAppsUids(List<String> packageNames, int userId) {

        SortedSet<Integer> uids = new TreeSet<>();

        for (String app : packageNames) {

            int uid = getAppUid(app, userId);

            int uid = getAppUid(mContext, app, userId);

            if (uid != -1) uids.add(uid);

            // TODO(b/230548427): Remove SDK check once VPN related stuff are decoupled from

            // ConnectivityServiceTest.
@@ -3226,7 +3252,6 @@ public class Vpn { 
                            prepareStatusIntent();

                        }

                        agentConnect(this::onValidationStatus);

                        mSession.setUnderpinnedNetwork(mNetworkAgent.getNetwork());

                        return; // Link properties are already sent.

                    } else {

                        // Underlying networks also set in agentConnect()
@@ -3343,7 +3368,6 @@ public class Vpn { 
                    if (!removedAddrs.isEmpty()) {

                        startNewNetworkAgent(

                                mNetworkAgent, "MTU too low for IPv6; restarting network agent");

                        mSession.setUnderpinnedNetwork(mNetworkAgent.getNetwork());



                        for (LinkAddress removed : removedAddrs) {

                            mTunnelIface.removeAddress(
@@ -3622,7 +3646,7 @@ public class Vpn { 
            final VpnTransportInfo info = new VpnTransportInfo(

                    getActiveVpnType(),

                    mConfig.session,

                    mConfig.allowBypass,

                    mConfig.allowBypass && !mLockdown,

                    areLongLivedTcpConnectionsExpensive(keepaliveDelaySec));

            final boolean ncUpdateRequired = !info.equals(mNetworkCapabilities.getTransportInfo());

            if (ncUpdateRequired) {
@@ -4466,10 +4490,7 @@ public class Vpn { 
    }



    private void verifyCallingUidAndPackage(String packageName) {

        final int callingUid = Binder.getCallingUid();

        if (getAppUid(packageName, mUserId) != callingUid) {

            throw new SecurityException(packageName + " does not belong to uid " + callingUid);

        }

        mDeps.verifyCallingUidAndPackage(mContext, packageName, mUserId);

    }



    @VisibleForTesting