Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93da655f authored by Sudheer Shanka's avatar Sudheer Shanka Committed by Automerger Merge Worker
Browse files

Merge "Fix: Firewall: NMS inverts default rule behavior" am: 627b6459 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2439712



Change-Id: I65ccc01b795fa53a51d211fabd2ea4063b0807d4
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 832afca2 627b6459

services/core/java/com/android/server/NetworkManagementService.java

+7 −1
Original line number Diff line number Diff line
@@ -1483,6 +1483,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub { 
    public void setFirewallUidRules(int chain, int[] uids, int[] rules) {

        enforceSystemUid();

        synchronized (mQuotaLock) {

            final int[] applicableUidsForChain;

            synchronized (mRulesLock) {

                SparseIntArray uidFirewallRules = getUidFirewallRulesLR(chain);

                SparseIntArray newRules = new SparseIntArray();
@@ -1506,10 +1507,15 @@ public class NetworkManagementService extends INetworkManagementService.Stub { 
                    int uid = rulesToRemove.keyAt(index);

                    updateFirewallUidRuleLocked(chain, uid, FIREWALL_RULE_DEFAULT);

                }

                // Copy the keys for the firewall rules chain, which is guaranteed not to include

                // default rules. We must not include default rules in the UIDs we send to

                // ConnectivityManager#replaceFirewallChain, as this would have the opposite effect

                // intended, leading such UIDs to be blocked or allowed erroneously.

                applicableUidsForChain = uidFirewallRules.copyKeys();

            }

            final ConnectivityManager cm = mContext.getSystemService(ConnectivityManager.class);

            try {

                cm.replaceFirewallChain(chain, uids);

                cm.replaceFirewallChain(chain, applicableUidsForChain);

            } catch (RuntimeException e) {

                Slog.w(TAG, "Error flushing firewall chain " + chain, e);

            }