Merge changes If2201f39,Ia1c366c5 (6ec2a154) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/ConnectivityService.java

+6 −22

Original line number	Diff line number	Diff line
		@@ -4821,15 +4821,6 @@ public class ConnectivityService extends IConnectivityManager.Stub
		}
		}

		private void updateVpnCapabilities(Vpn vpn, @Nullable NetworkCapabilities nc) {
		ensureRunningOnConnectivityServiceThread();
		NetworkAgentInfo vpnNai = getNetworkAgentInfoForNetId(vpn.getNetId());
		if (vpnNai == null \|\| nc == null) {
		return;
		}
		updateCapabilities(vpnNai.getCurrentScore(), vpnNai, nc);
		}

		@Override
		public boolean updateLockdownVpn() {
		if (Binder.getCallingUid() != Process.SYSTEM_UID) {
		@@ -5169,28 +5160,22 @@ public class ConnectivityService extends IConnectivityManager.Stub

		private void onUserAdded(int userId) {
		mPermissionMonitor.onUserAdded(userId);
		Network defaultNetwork = getNetwork(getDefaultNetwork());
		synchronized (mVpns) {
		final int vpnsSize = mVpns.size();
		for (int i = 0; i < vpnsSize; i++) {
		Vpn vpn = mVpns.valueAt(i);
		vpn.onUserAdded(userId);
		NetworkCapabilities nc = vpn.updateCapabilities(defaultNetwork);
		updateVpnCapabilities(vpn, nc);
		}
		}
		}

		private void onUserRemoved(int userId) {
		mPermissionMonitor.onUserRemoved(userId);
		Network defaultNetwork = getNetwork(getDefaultNetwork());
		synchronized (mVpns) {
		final int vpnsSize = mVpns.size();
		for (int i = 0; i < vpnsSize; i++) {
		Vpn vpn = mVpns.valueAt(i);
		vpn.onUserRemoved(userId);
		NetworkCapabilities nc = vpn.updateCapabilities(defaultNetwork);
		updateVpnCapabilities(vpn, nc);
		}
		}
		}
		@@ -8276,13 +8261,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
		return false;
		}

		final Network[] underlyingNetworks;
		synchronized (mVpns) {
		final Vpn vpn = getVpnIfOwner(callbackUid);
		underlyingNetworks = (vpn == null) ? null : vpn.getUnderlyingNetworks();
		for (NetworkAgentInfo virtual : mNetworkAgentInfos.values()) {
		if (virtual.supportsUnderlyingNetworks()
		&& virtual.networkCapabilities.getOwnerUid() == callbackUid
		&& ArrayUtils.contains(virtual.declaredUnderlyingNetworks, nai.network)) {
		return true;
		}
		if (underlyingNetworks != null) {
		if (Arrays.asList(underlyingNetworks).contains(nai.network)) return true;
		}

		// Administrator UIDs also contains the Owner UID

services/core/java/com/android/server/connectivity/Vpn.java

+6 −5

Original line number	Diff line number	Diff line
		@@ -408,7 +408,6 @@ public class Vpn {
		mNetworkCapabilities = new NetworkCapabilities();
		mNetworkCapabilities.addTransportType(NetworkCapabilities.TRANSPORT_VPN);
		mNetworkCapabilities.removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN);
		updateCapabilities(null /* defaultNetwork */);

		loadAlwaysOnPackage(keyStore);
		}
		@@ -1593,12 +1592,13 @@ public class Vpn {
		try {
		addUserToRanges(existingRanges, userId, mConfig.allowedApplications,
		mConfig.disallowedApplications);
		// ConnectivityService will call {@link #updateCapabilities} and apply
		// those for VPN network.
		mNetworkCapabilities.setUids(existingRanges);
		} catch (Exception e) {
		Log.wtf(TAG, "Failed to add restricted user to owner", e);
		}
		if (mNetworkAgent != null) {
		mNetworkAgent.sendNetworkCapabilities(mNetworkCapabilities);
		}
		}
		setVpnForcedLocked(mLockdown);
		}
		@@ -1621,12 +1621,13 @@ public class Vpn {
		final List<UidRange> removedRanges =
		uidRangesForUser(userId, existingRanges);
		existingRanges.removeAll(removedRanges);
		// ConnectivityService will call {@link #updateCapabilities} and
		// apply those for VPN network.
		mNetworkCapabilities.setUids(existingRanges);
		} catch (Exception e) {
		Log.wtf(TAG, "Failed to remove restricted user to owner", e);
		}
		if (mNetworkAgent != null) {
		mNetworkAgent.sendNetworkCapabilities(mNetworkCapabilities);
		}
		}
		setVpnForcedLocked(mLockdown);
		}

tests/net/java/com/android/server/ConnectivityServiceTest.java

+7 −32

Original line number	Diff line number	Diff line
		@@ -1058,7 +1058,9 @@ public class ConnectivityServiceTest {

		public void setUids(Set<UidRange> uids) {
		mNetworkCapabilities.setUids(uids);
		updateCapabilitiesInternal(null /* defaultNetwork */, true);
		if (mAgentRegistered) {
		mMockNetworkAgent.setNetworkCapabilities(mNetworkCapabilities, true);
		}
		}

		public void setVpnType(int vpnType) {
		@@ -1147,28 +1149,6 @@ public class ConnectivityServiceTest {
		mMockNetworkAgent.sendLinkProperties(lp);
		}

		private NetworkCapabilities updateCapabilitiesInternal(Network defaultNetwork,
		boolean sendToConnectivityService) {
		if (!mAgentRegistered) return null;
		super.updateCapabilities(defaultNetwork);
		// Because super.updateCapabilities will update the capabilities of the agent but
		// not the mock agent, the mock agent needs to know about them.
		copyCapabilitiesToNetworkAgent(sendToConnectivityService);
		return new NetworkCapabilities(mNetworkCapabilities);
		}

		private void copyCapabilitiesToNetworkAgent(boolean sendToConnectivityService) {
		if (null != mMockNetworkAgent) {
		mMockNetworkAgent.setNetworkCapabilities(mNetworkCapabilities,
		sendToConnectivityService);
		}
		}

		@Override
		public NetworkCapabilities updateCapabilities(Network defaultNetwork) {
		return updateCapabilitiesInternal(defaultNetwork, false);
		}

		public void disconnect() {
		if (mMockNetworkAgent != null) mMockNetworkAgent.disconnect();
		mAgentRegistered = false;
		@@ -7442,20 +7422,14 @@ public class ConnectivityServiceTest {
		setupLocationPermissions(Build.VERSION_CODES.Q, true, AppOpsManager.OPSTR_FINE_LOCATION,
		Manifest.permission.ACCESS_FINE_LOCATION);

		// setUp() calls mockVpn() which adds a VPN with the Test Runner's uid. Configure it to be
		// active
		final VpnInfo info = new VpnInfo();
		info.ownerUid = Process.myUid();
		info.vpnIface = VPN_IFNAME;
		mMockVpn.setVpnInfo(info);

		mMockVpn.establishForMyUid();
		waitForIdle();

		// Wait for networks to connect and broadcasts to be sent before removing permissions.
		waitForIdle();
		mServiceContext.setPermission(android.Manifest.permission.NETWORK_STACK, PERMISSION_DENIED);


		assertTrue(mService.setUnderlyingNetworksForVpn(new Network[] {network}));
		waitForIdle();
		assertTrue(
		"Active VPN permission not applied",
		mService.checkConnectivityDiagnosticsPermissions(
		@@ -7463,6 +7437,7 @@ public class ConnectivityServiceTest {
		mContext.getOpPackageName()));

		assertTrue(mService.setUnderlyingNetworksForVpn(null));
		waitForIdle();
		assertFalse(
		"VPN shouldn't receive callback on non-underlying network",
		mService.checkConnectivityDiagnosticsPermissions(