Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3fccac57 authored by Danesh M's avatar Danesh M Committed by Danny Baumann
Browse files

NetworkManagement : Add ability to restrict app data/wifi usage 

CYAN-3976
CRACKLING-834

Changes in cm-14.1:

*) Substitute marshmallow LISTEN_DATA_CONNECTION_REAL_TIME_INFO
   PhoneStateListener() for a CONNECTIVITY_ACTION broadcast
   receiver that unregisters itself once mDataInterfaceName
   has been set.
*) Convert usage of Map<Integer, Boolean> into SparseBooleanArray

Change-Id: Iaa0483d0ad64511184f0f31d93552a93fbab6dd0
parent 4329b46c

core/java/android/net/NetworkPolicyManager.java

+4 −0
Original line number Diff line number Diff line
@@ -48,6 +48,10 @@ public class NetworkPolicyManager { 
    public static final int POLICY_REJECT_METERED_BACKGROUND = 0x1;

    /** Allow network use (metered or not) in the background in battery save mode. */

    public static final int POLICY_ALLOW_BACKGROUND_BATTERY_SAVE = 0x2;

    /** Reject application network traffic on wifi network **/

    public static final int POLICY_REJECT_ON_WIFI = 0x8000;

    /** Reject application network traffic on cellular network **/

    public static final int POLICY_REJECT_ON_DATA = 0x10000;



    /*

     * Rules defining whether an uid has access to a network given its type (metered / non-metered).

core/java/android/os/INetworkManagementService.aidl

+6 −0
Original line number Diff line number Diff line
@@ -455,4 +455,10 @@ interface INetworkManagementService 
    int removeRoutesFromLocalNetwork(in List<RouteInfo> routes);



    void setAllowOnlyVpnForUids(boolean enable, in UidRange[] uidRanges);



    /**

     * Restrict UID from accessing data/wifi

     */

    void restrictAppOnData(int uid, boolean restrict);

    void restrictAppOnWifi(int uid, boolean restrict);

}

services/core/java/com/android/server/NetworkManagementService.java

+111 −0
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ import android.net.INetworkManagementEventObserver; 
import android.net.InterfaceConfiguration;

import android.net.IpPrefix;

import android.net.LinkAddress;

import android.net.LinkProperties;

import android.net.Network;

import android.net.NetworkPolicyManager;

import android.net.NetworkStats;
@@ -85,6 +86,7 @@ import android.telephony.DataConnectionRealTimeInfo; 
import android.telephony.PhoneStateListener;

import android.telephony.SubscriptionManager;

import android.telephony.TelephonyManager;

import android.text.TextUtils;

import android.util.Log;

import android.util.Slog;

import android.util.SparseBooleanArray;
@@ -216,6 +218,9 @@ public class NetworkManagementService extends INetworkManagementService.Stub 


    private INetd mNetdService;



    private String mWifiInterfaceName, mDataInterfaceName;

    private BroadcastReceiver mPendingDataRestrictReceiver;



    private IBatteryStats mBatteryStats;



    private final Thread mThread;
@@ -267,6 +272,10 @@ public class NetworkManagementService extends INetworkManagementService.Stub 
    /** Set of states for the child firewall chains. True if the chain is active. */

    @GuardedBy("mQuotaLock")

    final SparseBooleanArray mFirewallChainStates = new SparseBooleanArray();

    @GuardedBy("mQuotaLock")

    final SparseBooleanArray mWifiBlacklist = new SparseBooleanArray();

    @GuardedBy("mQuotaLock")

    final SparseBooleanArray mDataBlacklist = new SparseBooleanArray();



    @GuardedBy("mQuotaLock")

    private boolean mDataSaverMode;
@@ -297,6 +306,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub 
    private final RemoteCallbackList<INetworkActivityListener> mNetworkActivityListeners =

            new RemoteCallbackList<INetworkActivityListener>();

    private boolean mNetworkActive;

    private SparseBooleanArray mPendingRestrictOnData = new SparseBooleanArray();



    /**

     * Constructs a new NetworkManagementService instance
@@ -321,6 +331,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub 
                FgThread.get().getLooper());

        mThread = new Thread(mConnector, NETD_TAG);



        mWifiInterfaceName = SystemProperties.get("wifi.interface");

        mDaemonHandler = new Handler(FgThread.get().getLooper());



        // Add ourself to the Watchdog monitors.
@@ -361,6 +372,19 @@ public class NetworkManagementService extends INetworkManagementService.Stub 
            mContext.registerReceiver(mZeroBalanceReceiver, restrictFilter);

        }

        if (DBG) Slog.d(TAG, "ZeroBalance registering receiver");



        // Note: processPendingDataRestrictRequests() will unregister

        // mPendingDataRestrictReceiver once it has been able to determine

        // the cellular network interface name.

        mPendingDataRestrictReceiver = new BroadcastReceiver() {

            @Override

            public void onReceive(Context context, Intent intent) {

                processPendingDataRestrictRequests();

           }

        };

        final IntentFilter filter = new IntentFilter();

        filter.addAction(ConnectivityManager.CONNECTIVITY_ACTION);

        mContext.registerReceiver(mPendingDataRestrictReceiver, filter);

    }



    private IBatteryStats getBatteryStats() {
@@ -1913,6 +1937,81 @@ public class NetworkManagementService extends INetworkManagementService.Stub 
        }

    }



    private void processPendingDataRestrictRequests() {

        initDataInterface();

        if (TextUtils.isEmpty(mDataInterfaceName)) {

            return;

        }

        if (mPendingDataRestrictReceiver != null) {

            mContext.unregisterReceiver(mPendingDataRestrictReceiver);

            mPendingDataRestrictReceiver = null;

        }

        int count = mPendingRestrictOnData.size();

        for (int i = 0; i < count; i++) {

            restrictAppOnData(mPendingRestrictOnData.keyAt(i),

                    mPendingRestrictOnData.valueAt(i));

        }

        mPendingRestrictOnData.clear();

    }



    @Override

    public void restrictAppOnData(int uid, boolean restrict) {

        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);

        // silently discard when control disabled

        // TODO: eventually migrate to be always enabled

        if (!mBandwidthControlEnabled) return;



        initDataInterface();

        if (TextUtils.isEmpty(mDataInterfaceName)) {

            // We don't have an interface name since data is not active

            // yet, so queue up the request for when it comes up alive

            mPendingRestrictOnData.put(uid, restrict);

            return;

        }



        synchronized (mQuotaLock) {

            boolean oldValue = mDataBlacklist.get(uid, false);

            if (oldValue == restrict) {

                return;

            }

            mDataBlacklist.put(uid, restrict);

        }



        try {

            final String action = restrict ? "add" : "remove";

            mConnector.execute("bandwidth", action + "restrictappsondata",

                    mDataInterfaceName, uid);

        } catch (NativeDaemonConnectorException e) {

            throw e.rethrowAsParcelableException();

        }

    }



    @Override

    public void restrictAppOnWifi(int uid, boolean restrict) {

        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);



        // silently discard when control disabled

        // TODO: eventually migrate to be always enabled

        if (!mBandwidthControlEnabled) return;



        synchronized (mQuotaLock) {

            boolean oldValue = mWifiBlacklist.get(uid, false);

            if (oldValue == restrict) {

                return;

            }

            mWifiBlacklist.put(uid, restrict);

        }





        try {

            final String action = restrict ? "add" : "remove";

            mConnector.execute("bandwidth", action + "restrictappsonwlan",

                    mWifiInterfaceName, uid);

        } catch (NativeDaemonConnectorException e) {

            throw e.rethrowAsParcelableException();

        }

    }



    @Override

    public void setUidMeteredNetworkBlacklist(int uid, boolean enable) {

        setUidOnMeteredNetworkList(mUidRejectOnMetered, uid, true, enable);
@@ -2900,4 +2999,16 @@ public class NetworkManagementService extends INetworkManagementService.Stub 


        return failures;

    }



    private void initDataInterface() {

        if (!TextUtils.isEmpty(mDataInterfaceName)) {

            return;

        }

        ConnectivityManager cm = (ConnectivityManager) mContext.getSystemService(

                Context.CONNECTIVITY_SERVICE);

        LinkProperties linkProperties = cm.getLinkProperties(ConnectivityManager.TYPE_MOBILE);

        if (linkProperties != null) {

            mDataInterfaceName = linkProperties.getInterfaceName();

        }

    }

}

services/core/java/com/android/server/net/NetworkPolicyManagerService.java

+9 −0
Original line number Diff line number Diff line
@@ -48,6 +48,8 @@ import static android.net.NetworkPolicyManager.FIREWALL_RULE_DEFAULT; 
import static android.net.NetworkPolicyManager.FIREWALL_RULE_DENY;

import static android.net.NetworkPolicyManager.POLICY_NONE;

import static android.net.NetworkPolicyManager.POLICY_REJECT_METERED_BACKGROUND;

import static android.net.NetworkPolicyManager.POLICY_REJECT_ON_DATA;

import static android.net.NetworkPolicyManager.POLICY_REJECT_ON_WIFI;

import static android.net.NetworkPolicyManager.RULE_ALLOW_ALL;

import static android.net.NetworkPolicyManager.RULE_ALLOW_METERED;

import static android.net.NetworkPolicyManager.MASK_METERED_NETWORKS;
@@ -3001,6 +3003,13 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { 
        final int oldRule = oldUidRules & MASK_METERED_NETWORKS;

        int newRule = RULE_NONE;



        try {

            mNetworkManager.restrictAppOnWifi(uid, (uidPolicy & POLICY_REJECT_ON_WIFI) != 0);

            mNetworkManager.restrictAppOnData(uid, (uidPolicy & POLICY_REJECT_ON_DATA) != 0);

        } catch (RemoteException e) {

            // ignored; service lives in system_server

        }



        // First step: define the new rule based on user restrictions and foreground state.

        if (isForeground) {

            if (isBlacklisted || (mRestrictBackground && !isWhitelisted)) {