Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 605eb79c authored by Jeff Sharkey's avatar Jeff Sharkey
Browse files

Offer to detect non-SSL/TLS network traffic. 

Introduces new module that provides network-related features for
the StrictMode developer API.  The first feature offers to detect
sockets sending data not wrapped inside a layer of SSL/TLS
encryption.

When a developer enables, we ask netd to watch all outgoing traffic
from our UID, and penalize us accordingly if cleartext sockets are
detected.  When enabled, netd captures the offending packet and
passes it back to the owning process to aid investigations.  When
death penalty is requested, all future traffic on the socket is
blocked, which usually results in a useful stacktrace before the
app is actually killed.

Bug: 18335678
Change-Id: I3adbc974efd8d3766b4b1a23257563bb82d53c29
parent 41ef80e7

core/java/android/app/ActivityManagerNative.java

+22 −0
Original line number Diff line number Diff line
@@ -2330,6 +2330,15 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM 
            reply.writeNoException();

            return true;

        }



        case NOTIFY_CLEARTEXT_NETWORK_TRANSACTION: {

            data.enforceInterface(IActivityManager.descriptor);

            final int uid = data.readInt();

            final byte[] firstPacket = data.createByteArray();

            notifyCleartextNetwork(uid, firstPacket);

            reply.writeNoException();

            return true;

        }

        }



        return super.onTransact(code, data, reply, flags);
@@ -5381,5 +5390,18 @@ class ActivityManagerProxy implements IActivityManager 
        reply.recycle();

    }



    @Override

    public void notifyCleartextNetwork(int uid, byte[] firstPacket) throws RemoteException {

        Parcel data = Parcel.obtain();

        Parcel reply = Parcel.obtain();

        data.writeInterfaceToken(IActivityManager.descriptor);

        data.writeInt(uid);

        data.writeByteArray(firstPacket);

        mRemote.transact(NOTIFY_CLEARTEXT_NETWORK_TRANSACTION, data, reply, 0);

        reply.readException();

        data.recycle();

        reply.recycle();

    }



    private IBinder mRemote;

}

core/java/android/app/ActivityThread.java

+8 −0
Original line number Diff line number Diff line
@@ -1168,9 +1168,17 @@ public final class ActivityThread { 
            sendMessage(H.BACKGROUND_VISIBLE_BEHIND_CHANGED, token, visible ? 1 : 0);

        }



        @Override

        public void scheduleEnterAnimationComplete(IBinder token) {

            sendMessage(H.ENTER_ANIMATION_COMPLETE, token);

        }



        @Override

        public void notifyCleartextNetwork(byte[] firstPacket) {

            if (StrictMode.vmCleartextNetworkEnabled()) {

                StrictMode.onCleartextNetworkDetected(firstPacket);

            }

        }

    }



    private class H extends Handler {

core/java/android/app/ApplicationThreadNative.java

+18 −0
Original line number Diff line number Diff line
@@ -667,6 +667,15 @@ public abstract class ApplicationThreadNative extends Binder 
            reply.writeNoException();

            return true;

        }



        case NOTIFY_CLEARTEXT_NETWORK_TRANSACTION:

        {

            data.enforceInterface(IApplicationThread.descriptor);

            final byte[] firstPacket = data.createByteArray();

            notifyCleartextNetwork(firstPacket);

            reply.writeNoException();

            return true;

        }

        }



        return super.onTransact(code, data, reply, flags);
@@ -1346,4 +1355,13 @@ class ApplicationThreadProxy implements IApplicationThread { 
        mRemote.transact(ENTER_ANIMATION_COMPLETE_TRANSACTION, data, null, IBinder.FLAG_ONEWAY);

        data.recycle();

    }



    @Override

    public void notifyCleartextNetwork(byte[] firstPacket) throws RemoteException {

        Parcel data = Parcel.obtain();

        data.writeInterfaceToken(IApplicationThread.descriptor);

        data.writeByteArray(firstPacket);

        mRemote.transact(NOTIFY_CLEARTEXT_NETWORK_TRANSACTION, data, null, IBinder.FLAG_ONEWAY);

        data.recycle();

    }

}

core/java/android/app/IActivityManager.java

+5 −0
Original line number Diff line number Diff line
@@ -464,6 +464,8 @@ public interface IActivityManager extends IInterface { 
    public void notifyLaunchTaskBehindComplete(IBinder token) throws RemoteException;

    public void notifyEnterAnimationComplete(IBinder token) throws RemoteException;



    public void notifyCleartextNetwork(int uid, byte[] firstPacket) throws RemoteException;



    /*

     * Private non-Binder interfaces

     */
@@ -782,4 +784,7 @@ public interface IActivityManager extends IInterface { 
    int BOOT_ANIMATION_COMPLETE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+237;

    int GET_TASK_DESCRIPTION_ICON_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+238;

    int LAUNCH_ASSIST_INTENT_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+239;



    // Start of M transactions

    int NOTIFY_CLEARTEXT_NETWORK_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+280;

}

core/java/android/app/IApplicationThread.java

+2 −0
Original line number Diff line number Diff line
@@ -146,6 +146,7 @@ public interface IApplicationThread extends IInterface { 
    void scheduleCancelVisibleBehind(IBinder token) throws RemoteException;

    void scheduleBackgroundVisibleBehindChanged(IBinder token, boolean enabled) throws RemoteException;

    void scheduleEnterAnimationComplete(IBinder token) throws RemoteException;

    void notifyCleartextNetwork(byte[] firstPacket) throws RemoteException;



    String descriptor = "android.app.IApplicationThread";
@@ -203,4 +204,5 @@ public interface IApplicationThread extends IInterface { 
    int CANCEL_VISIBLE_BEHIND_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+52;

    int BACKGROUND_VISIBLE_BEHIND_CHANGED_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+53;

    int ENTER_ANIMATION_COMPLETE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+54;

    int NOTIFY_CLEARTEXT_NETWORK_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+55;

}