Merge "Update usage of allowlist/denylist in some method names/comments." (771aa062) · Commits · e / os / android_frameworks_base

core/java/android/os/INetworkManagementService.aidl

+2 −2

Original line number	Diff line number	Diff line
		@@ -282,8 +282,8 @@ interface INetworkManagementService
		/**
		* Control network activity of a UID over interfaces with a quota limit.
		*/
		void setUidMeteredNetworkDenylist(int uid, boolean enable);
		void setUidMeteredNetworkAllowlist(int uid, boolean enable);
		void setUidOnMeteredNetworkDenylist(int uid, boolean enable);
		void setUidOnMeteredNetworkAllowlist(int uid, boolean enable);
		boolean setDataSaverModeEnabled(boolean enable);

		void setUidCleartextNetworkPolicy(int uid, int policy);

services/core/java/com/android/server/NetworkManagementService.java

+19 −19

Original line number	Diff line number	Diff line
		@@ -187,10 +187,10 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
		/** Set of interfaces with active alerts. */
		@GuardedBy("mQuotaLock")
		private HashMap<String, Long> mActiveAlerts = Maps.newHashMap();
		/** Set of UIDs denylisted on metered networks. */
		/** Set of UIDs denied on metered networks. */
		@GuardedBy("mRulesLock")
		private SparseBooleanArray mUidRejectOnMetered = new SparseBooleanArray();
		/** Set of UIDs allowlisted on metered networks. */
		/** Set of UIDs allowed on metered networks. */
		@GuardedBy("mRulesLock")
		private SparseBooleanArray mUidAllowOnMetered = new SparseBooleanArray();
		/** Set of UIDs with cleartext penalties. */
		@@ -561,13 +561,13 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
		}
		if (uidRejectOnQuota != null) {
		for (int i = 0; i < uidRejectOnQuota.size(); i++) {
		setUidMeteredNetworkDenylist(uidRejectOnQuota.keyAt(i),
		setUidOnMeteredNetworkDenylist(uidRejectOnQuota.keyAt(i),
		uidRejectOnQuota.valueAt(i));
		}
		}
		if (uidAcceptOnQuota != null) {
		for (int i = 0; i < uidAcceptOnQuota.size(); i++) {
		setUidMeteredNetworkAllowlist(uidAcceptOnQuota.keyAt(i),
		setUidOnMeteredNetworkAllowlist(uidAcceptOnQuota.keyAt(i),
		uidAcceptOnQuota.valueAt(i));
		}
		}
		@@ -1288,14 +1288,14 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
		}
		}

		private void setUidOnMeteredNetworkList(int uid, boolean denylist, boolean enable) {
		private void setUidOnMeteredNetworkList(int uid, boolean allowlist, boolean enable) {
		NetworkStack.checkNetworkStackPermission(mContext);

		synchronized (mQuotaLock) {
		boolean oldEnable;
		SparseBooleanArray quotaList;
		synchronized (mRulesLock) {
		quotaList = denylist ? mUidRejectOnMetered : mUidAllowOnMetered;
		quotaList = allowlist ? mUidAllowOnMetered : mUidRejectOnMetered;
		oldEnable = quotaList.get(uid, false);
		}
		if (oldEnable == enable) {
		@@ -1305,17 +1305,17 @@ public class NetworkManagementService extends INetworkManagementService.Stub {

		Trace.traceBegin(Trace.TRACE_TAG_NETWORK, "inetd bandwidth");
		try {
		if (denylist) {
		if (allowlist) {
		if (enable) {
		mNetdService.bandwidthAddNaughtyApp(uid);
		mNetdService.bandwidthAddNiceApp(uid);
		} else {
		mNetdService.bandwidthRemoveNaughtyApp(uid);
		mNetdService.bandwidthRemoveNiceApp(uid);
		}
		} else {
		if (enable) {
		mNetdService.bandwidthAddNiceApp(uid);
		mNetdService.bandwidthAddNaughtyApp(uid);
		} else {
		mNetdService.bandwidthRemoveNiceApp(uid);
		mNetdService.bandwidthRemoveNaughtyApp(uid);
		}
		}
		synchronized (mRulesLock) {
		@@ -1334,13 +1334,13 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
		}

		@Override
		public void setUidMeteredNetworkDenylist(int uid, boolean enable) {
		setUidOnMeteredNetworkList(uid, true, enable);
		public void setUidOnMeteredNetworkDenylist(int uid, boolean enable) {
		setUidOnMeteredNetworkList(uid, false, enable);
		}

		@Override
		public void setUidMeteredNetworkAllowlist(int uid, boolean enable) {
		setUidOnMeteredNetworkList(uid, false, enable);
		public void setUidOnMeteredNetworkAllowlist(int uid, boolean enable) {
		setUidOnMeteredNetworkList(uid, true, enable);
		}

		@Override
		@@ -1763,7 +1763,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
		} else {
		ruleName = "deny";
		}
		} else { // Denylist mode
		} else { // Deny mode
		if (rule == FIREWALL_RULE_DENY) {
		ruleName = "deny";
		} else {
		@@ -1850,8 +1850,8 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
		pw.print("Active alert ifaces: "); pw.println(mActiveAlerts.toString());
		pw.print("Data saver mode: "); pw.println(mDataSaverMode);
		synchronized (mRulesLock) {
		dumpUidRuleOnQuotaLocked(pw, "denylist", mUidRejectOnMetered);
		dumpUidRuleOnQuotaLocked(pw, "allowlist", mUidAllowOnMetered);
		dumpUidRuleOnQuotaLocked(pw, "denied UIDs", mUidRejectOnMetered);
		dumpUidRuleOnQuotaLocked(pw, "allowed UIDs", mUidAllowOnMetered);
		}
		}

		@@ -1904,7 +1904,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
		private void dumpUidRuleOnQuotaLocked(PrintWriter pw, String name, SparseBooleanArray list) {
		pw.print("UID bandwith control ");
		pw.print(name);
		pw.print(" rule: [");
		pw.print(": [");
		final int size = list.size();
		for (int i = 0; i < size; i++) {
		pw.print(list.keyAt(i));

services/core/java/com/android/server/net/NetworkPolicyManagerService.java

+51 −50

Original line number	Diff line number	Diff line
		@@ -686,7 +686,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		* Allows pre-defined apps for restrict background, but only if the user didn't already
		* revoked them.
		*
		* @return whether any uid has been allowlisted.
		* @return whether any uid has been added to allowlist.
		*/
		@GuardedBy("mUidRulesFirstLock")
		boolean addDefaultRestrictBackgroundAllowlistUidsUL() {
		@@ -710,7 +710,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		for (int i = 0; i < allowDataUsage.size(); i++) {
		final String pkg = allowDataUsage.valueAt(i);
		if (LOGD)
		Slog.d(TAG, "checking restricted background allowlisting for package " + pkg
		Slog.d(TAG, "checking restricted background exemption for package " + pkg
		+ " and user " + userId);
		final ApplicationInfo app;
		try {
		@@ -1027,7 +1027,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		// user resets app preferences.
		mMeteredRestrictedUids.remove(userId);
		if (action == ACTION_USER_ADDED) {
		// Add apps that are allowlisted by default.
		// Add apps that are allowed by default.
		addDefaultRestrictBackgroundAllowlistUidsUL(userId);
		}
		// Update global restrict for that user
		@@ -2233,8 +2233,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		in.setInput(fis, StandardCharsets.UTF_8.name());

		// Must save the <restrict-background> tags and convert them to <uid-policy> later,
		// to skip UIDs that were explicitly denylisted.
		final SparseBooleanArray allowlistedRestrictBackground = new SparseBooleanArray();
		// to skip UIDs that were explicitly denied.
		final SparseBooleanArray restrictBackgroundAllowedUids = new SparseBooleanArray();

		int type;
		int version = VERSION_INIT;
		@@ -2392,7 +2392,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		insideAllowlist = true;
		} else if (TAG_RESTRICT_BACKGROUND.equals(tag) && insideAllowlist) {
		final int uid = readIntAttribute(in, ATTR_UID);
		allowlistedRestrictBackground.append(uid, true);
		restrictBackgroundAllowedUids.append(uid, true);
		} else if (TAG_REVOKED_RESTRICT_BACKGROUND.equals(tag) && insideAllowlist) {
		final int uid = readIntAttribute(in, ATTR_UID);
		mRestrictBackgroundAllowlistRevokedUids.put(uid, true);
		@@ -2405,9 +2405,9 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		}
		}

		final int size = allowlistedRestrictBackground.size();
		final int size = restrictBackgroundAllowedUids.size();
		for (int i = 0; i < size; i++) {
		final int uid = allowlistedRestrictBackground.keyAt(i);
		final int uid = restrictBackgroundAllowedUids.keyAt(i);
		final int policy = mUidPolicy.get(uid, POLICY_NONE);
		if ((policy & POLICY_REJECT_METERED_BACKGROUND) != 0) {
		Slog.w(TAG, "ignoring restrict-background-allowlist for " + uid
		@@ -2674,13 +2674,13 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		if (!isUidValidForAllowlistRulesUL(uid)) {
		notifyApp = false;
		} else {
		final boolean wasDenylisted = oldPolicy == POLICY_REJECT_METERED_BACKGROUND;
		final boolean isDenylisted = policy == POLICY_REJECT_METERED_BACKGROUND;
		final boolean wasAllowlisted = oldPolicy == POLICY_ALLOW_METERED_BACKGROUND;
		final boolean isAllowlisted = policy == POLICY_ALLOW_METERED_BACKGROUND;
		final boolean wasBlocked = wasDenylisted \|\| (mRestrictBackground && !wasAllowlisted);
		final boolean isBlocked = isDenylisted \|\| (mRestrictBackground && !isAllowlisted);
		if ((wasAllowlisted && (!isAllowlisted \|\| isDenylisted))
		final boolean wasDenied = oldPolicy == POLICY_REJECT_METERED_BACKGROUND;
		final boolean isDenied = policy == POLICY_REJECT_METERED_BACKGROUND;
		final boolean wasAllowed = oldPolicy == POLICY_ALLOW_METERED_BACKGROUND;
		final boolean isAllowed = policy == POLICY_ALLOW_METERED_BACKGROUND;
		final boolean wasBlocked = wasDenied \|\| (mRestrictBackground && !wasAllowed);
		final boolean isBlocked = isDenied \|\| (mRestrictBackground && !isAllowed);
		if ((wasAllowed && (!isAllowed \|\| isDenied))
		&& mDefaultRestrictBackgroundAllowlistUids.get(uid)
		&& !mRestrictBackgroundAllowlistRevokedUids.get(uid)) {
		if (LOGD)
		@@ -2965,7 +2965,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		Slog.d(TAG, "setRestrictBackgroundUL(): " + restrictBackground + "; reason: " + reason);
		final boolean oldRestrictBackground = mRestrictBackground;
		mRestrictBackground = restrictBackground;
		// Must allowlist foreground apps before turning data saver mode on.
		// Must allow foreground apps before turning data saver mode on.
		// TODO: there is no need to iterate through all apps here, just those in the foreground,
		// so it could call AM to get the UIDs of such apps, and iterate through them instead.
		updateRulesForRestrictBackgroundUL();
		@@ -3018,7 +3018,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		Binder.restoreCallingIdentity(token);
		}
		if (policy == POLICY_REJECT_METERED_BACKGROUND) {
		// App is denylisted.
		// App is restricted.
		return RESTRICT_BACKGROUND_STATUS_ENABLED;
		}
		if (!mRestrictBackground) {
		@@ -4310,9 +4310,9 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		* <ul>
		* <li>@{code bw_penalty_box}: UIDs added to this chain do not have access (denylist).
		* <li>@{code bw_happy_box}: UIDs added to this chain have access (allowlist), unless they're
		* also denylisted.
		* also in denylist.
		* <li>@{code bw_data_saver}: when enabled (through {@link #setRestrictBackground(boolean)}),
		* no UIDs other than those allowlisted will have access.
		* no UIDs other than those in allowlist will have access.
		* <ul>
		*
		* <p>The @{code bw_penalty_box} and @{code bw_happy_box} are primarily managed through the
		@@ -4327,7 +4327,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		* <ul>
		* <li>When Data Saver mode is on, the foreground app should be temporarily added to
		* {@code bw_happy_box} before the @{code bw_data_saver} chain is enabled.
		* <li>If the foreground app is denylisted by the user, it should be temporarily removed from
		* <li>If the foreground app was restricted by the user (i.e. has the policy
		* {@code POLICY_REJECT_METERED_BACKGROUND}), it should be temporarily removed from
		* {@code bw_penalty_box}.
		* <li>When the app leaves foreground state, the temporary changes above should be reverted.
		* </ul>
		@@ -4362,8 +4363,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		final boolean isForeground = isUidForegroundOnRestrictBackgroundUL(uid);
		final boolean isRestrictedByAdmin = isRestrictedByAdminUL(uid);

		final boolean isDenylisted = (uidPolicy & POLICY_REJECT_METERED_BACKGROUND) != 0;
		final boolean isAllowlisted = (uidPolicy & POLICY_ALLOW_METERED_BACKGROUND) != 0;
		final boolean isDenied = (uidPolicy & POLICY_REJECT_METERED_BACKGROUND) != 0;
		final boolean isAllowed = (uidPolicy & POLICY_ALLOW_METERED_BACKGROUND) != 0;
		final int oldRule = oldUidRules & MASK_METERED_NETWORKS;
		int newRule = RULE_NONE;

		@@ -4371,15 +4372,15 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		if (isRestrictedByAdmin) {
		newRule = RULE_REJECT_METERED;
		} else if (isForeground) {
		if (isDenylisted \|\| (mRestrictBackground && !isAllowlisted)) {
		if (isDenied \|\| (mRestrictBackground && !isAllowed)) {
		newRule = RULE_TEMPORARY_ALLOW_METERED;
		} else if (isAllowlisted) {
		} else if (isAllowed) {
		newRule = RULE_ALLOW_METERED;
		}
		} else {
		if (isDenylisted) {
		if (isDenied) {
		newRule = RULE_REJECT_METERED;
		} else if (mRestrictBackground && isAllowlisted) {
		} else if (mRestrictBackground && isAllowed) {
		newRule = RULE_ALLOW_METERED;
		}
		}
		@@ -4388,8 +4389,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		if (LOGV) {
		Log.v(TAG, "updateRuleForRestrictBackgroundUL(" + uid + ")"
		+ ": isForeground=" +isForeground
		+ ", isDenylisted=" + isDenylisted
		+ ", isAllowlisted=" + isAllowlisted
		+ ", isDenied=" + isDenied
		+ ", isAllowed=" + isAllowed
		+ ", isRestrictedByAdmin=" + isRestrictedByAdmin
		+ ", oldRule=" + uidRulesToString(oldRule)
		+ ", newRule=" + uidRulesToString(newRule)
		@@ -4406,49 +4407,49 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		// Second step: apply bw changes based on change of state.
		if (newRule != oldRule) {
		if (hasRule(newRule, RULE_TEMPORARY_ALLOW_METERED)) {
		// Temporarily allowlist foreground app, removing from denylist if necessary
		// Temporarily allow foreground app, removing from denylist if necessary
		// (since bw_penalty_box prevails over bw_happy_box).

		setMeteredNetworkAllowlist(uid, true);
		// TODO: if statement below is used to avoid an unnecessary call to netd / iptables,
		// but ideally it should be just:
		// setMeteredNetworkDenylist(uid, isDenylisted);
		if (isDenylisted) {
		// setMeteredNetworkDenylist(uid, isDenied);
		if (isDenied) {
		setMeteredNetworkDenylist(uid, false);
		}
		} else if (hasRule(oldRule, RULE_TEMPORARY_ALLOW_METERED)) {
		// Remove temporary allowlist from app that is not on foreground anymore.
		// Remove temporary exemption from app that is not on foreground anymore.

		// TODO: if statements below are used to avoid unnecessary calls to netd / iptables,
		// but ideally they should be just:
		// setMeteredNetworkAllowlist(uid, isAllowlisted);
		// setMeteredNetworkDenylist(uid, isDenylisted);
		if (!isAllowlisted) {
		// setMeteredNetworkAllowlist(uid, isAllowed);
		// setMeteredNetworkDenylist(uid, isDenied);
		if (!isAllowed) {
		setMeteredNetworkAllowlist(uid, false);
		}
		if (isDenylisted \|\| isRestrictedByAdmin) {
		if (isDenied \|\| isRestrictedByAdmin) {
		setMeteredNetworkDenylist(uid, true);
		}
		} else if (hasRule(newRule, RULE_REJECT_METERED)
		\|\| hasRule(oldRule, RULE_REJECT_METERED)) {
		// Flip state because app was explicitly added or removed to denylist.
		setMeteredNetworkDenylist(uid, (isDenylisted \|\| isRestrictedByAdmin));
		if (hasRule(oldRule, RULE_REJECT_METERED) && isAllowlisted) {
		// Since denylist prevails over allowlist, we need to handle the special case
		// where app is allowlisted and denylisted at the same time (although such
		// scenario should be blocked by the UI), then denylist is removed.
		setMeteredNetworkAllowlist(uid, isAllowlisted);
		setMeteredNetworkDenylist(uid, (isDenied \|\| isRestrictedByAdmin));
		if (hasRule(oldRule, RULE_REJECT_METERED) && isAllowed) {
		// Since denial prevails over allowance, we need to handle the special case
		// where app is allowed and denied at the same time (although such
		// scenario should be blocked by the UI), then it is removed from the denylist.
		setMeteredNetworkAllowlist(uid, isAllowed);
		}
		} else if (hasRule(newRule, RULE_ALLOW_METERED)
		\|\| hasRule(oldRule, RULE_ALLOW_METERED)) {
		// Flip state because app was explicitly added or removed to allowlist.
		setMeteredNetworkAllowlist(uid, isAllowlisted);
		setMeteredNetworkAllowlist(uid, isAllowed);
		} else {
		// All scenarios should have been covered above.
		Log.wtf(TAG, "Unexpected change of metered UID state for " + uid
		+ ": foreground=" + isForeground
		+ ", allowlisted=" + isAllowlisted
		+ ", denylisted=" + isDenylisted
		+ ", allowlisted=" + isAllowed
		+ ", denylisted=" + isDenied
		+ ", isRestrictedByAdmin=" + isRestrictedByAdmin
		+ ", newRule=" + uidRulesToString(newUidRules)
		+ ", oldRule=" + uidRulesToString(oldUidRules));
		@@ -4464,7 +4465,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		* listeners in case of change.
		* <p>
		* There are 3 power-related rules that affects whether an app has background access on
		* non-metered networks, and when the condition applies and the UID is not allowlisted for power
		* non-metered networks, and when the condition applies and the UID is not allowed for power
		* restriction, it's added to the equivalent firewall chain:
		* <ul>
		* <li>App is idle: {@code fw_standby} firewall chain.
		@@ -4929,7 +4930,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		private void setMeteredNetworkDenylist(int uid, boolean enable) {
		if (LOGV) Slog.v(TAG, "setMeteredNetworkDenylist " + uid + ": " + enable);
		try {
		mNetworkManager.setUidMeteredNetworkDenylist(uid, enable);
		mNetworkManager.setUidOnMeteredNetworkDenylist(uid, enable);
		} catch (IllegalStateException e) {
		Log.wtf(TAG, "problem setting denylist (" + enable + ") rules for " + uid, e);
		} catch (RemoteException e) {
		@@ -4940,7 +4941,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		private void setMeteredNetworkAllowlist(int uid, boolean enable) {
		if (LOGV) Slog.v(TAG, "setMeteredNetworkAllowlist " + uid + ": " + enable);
		try {
		mNetworkManager.setUidMeteredNetworkAllowlist(uid, enable);
		mNetworkManager.setUidOnMeteredNetworkAllowlist(uid, enable);
		} catch (IllegalStateException e) {
		Log.wtf(TAG, "problem setting allowlist (" + enable + ") rules for " + uid, e);
		} catch (RemoteException e) {
		@@ -5062,8 +5063,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
		mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_STANDBY, uid, FIREWALL_RULE_DEFAULT);
		mNetworkManager
		.setFirewallUidRule(FIREWALL_CHAIN_POWERSAVE, uid, FIREWALL_RULE_DEFAULT);
		mNetworkManager.setUidMeteredNetworkAllowlist(uid, false);
		mNetworkManager.setUidMeteredNetworkDenylist(uid, false);
		mNetworkManager.setUidOnMeteredNetworkAllowlist(uid, false);
		mNetworkManager.setUidOnMeteredNetworkDenylist(uid, false);
		} catch (IllegalStateException e) {
		Log.wtf(TAG, "problem resetting firewall uid rules for " + uid, e);
		} catch (RemoteException e) {

services/tests/servicestests/assets/NetworkPolicyManagerServiceTest/netpolicy/uidA-allowlisted-restrict-background-off.xml→services/tests/servicestests/assets/NetworkPolicyManagerServiceTest/netpolicy/uidA-allowed-restrict-background-off.xml

+0 −0

File moved.

View file

services/tests/servicestests/assets/NetworkPolicyManagerServiceTest/netpolicy/uidA-allowlisted-restrict-background-on.xml→services/tests/servicestests/assets/NetworkPolicyManagerServiceTest/netpolicy/uidA-allowed-restrict-background-on.xml

+0 −0

File moved.

View file