Merge "Set owner and administrator UIDs for test networks." am: b54e6b4377 (9f622464) · Commits · e / os / android_frameworks_base

core/java/android/net/NetworkCapabilities.java

+12 −1

Original line number	Original line	Diff line number	Diff line
	@@ -677,16 +677,27 @@ public final class NetworkCapabilities implements Parcelable {
	* restrictions.		* restrictions.
	* @hide		* @hide
	*/		*/
	public void restrictCapabilitesForTestNetwork() {		public void restrictCapabilitesForTestNetwork(int creatorUid) {
	final long originalCapabilities = mNetworkCapabilities;		final long originalCapabilities = mNetworkCapabilities;
	final NetworkSpecifier originalSpecifier = mNetworkSpecifier;		final NetworkSpecifier originalSpecifier = mNetworkSpecifier;
	final int originalSignalStrength = mSignalStrength;		final int originalSignalStrength = mSignalStrength;
			final int originalOwnerUid = getOwnerUid();
			final int[] originalAdministratorUids = getAdministratorUids();
	clearAll();		clearAll();
	// Reset the transports to only contain TRANSPORT_TEST.		// Reset the transports to only contain TRANSPORT_TEST.
	mTransportTypes = (1 << TRANSPORT_TEST);		mTransportTypes = (1 << TRANSPORT_TEST);
	mNetworkCapabilities = originalCapabilities & TEST_NETWORKS_ALLOWED_CAPABILITIES;		mNetworkCapabilities = originalCapabilities & TEST_NETWORKS_ALLOWED_CAPABILITIES;
	mNetworkSpecifier = originalSpecifier;		mNetworkSpecifier = originalSpecifier;
	mSignalStrength = originalSignalStrength;		mSignalStrength = originalSignalStrength;

			// Only retain the owner and administrator UIDs if they match the app registering the remote
			// caller that registered the network.
			if (originalOwnerUid == creatorUid) {
			setOwnerUid(creatorUid);
			}
			if (ArrayUtils.contains(originalAdministratorUids, creatorUid)) {
			setAdministratorUids(new int[] {creatorUid});
			}
	}		}

	/**		/**

services/core/java/com/android/server/ConnectivityService.java

+3 −3

services/core/java/com/android/server/TestNetworkService.java

+28 −33

Original line number	Original line	Diff line number	Diff line
	@@ -317,18 +317,14 @@ class TestNetworkService extends ITestNetworkManager.Stub {
	"Cannot create network for non ipsec, non-testtun interface");		"Cannot create network for non ipsec, non-testtun interface");
	}		}

	// Setup needs to be done with NETWORK_STACK privileges.
	int callingUid = Binder.getCallingUid();
	Binder.withCleanCallingIdentity(
	() -> {
	try {		try {
	mNMS.setInterfaceUp(iface);		// This requires NETWORK_STACK privileges.
			Binder.withCleanCallingIdentity(() -> mNMS.setInterfaceUp(iface));

	// Synchronize all accesses to mTestNetworkTracker to prevent the case		// Synchronize all accesses to mTestNetworkTracker to prevent the case where:
	// where:
	// 1. TestNetworkAgent successfully binds to death of binder		// 1. TestNetworkAgent successfully binds to death of binder
	// 2. Before it is added to the mTestNetworkTracker, binder dies,		// 2. Before it is added to the mTestNetworkTracker, binder dies, binderDied() is called
	// binderDied() is called (on a different thread)		// (on a different thread)
	// 3. This thread is pre-empted, put() is called after remove()		// 3. This thread is pre-empted, put() is called after remove()
	synchronized (mTestNetworkTracker) {		synchronized (mTestNetworkTracker) {
	TestNetworkAgent agent =		TestNetworkAgent agent =
	@@ -338,7 +334,7 @@ class TestNetworkService extends ITestNetworkManager.Stub {
	iface,		iface,
	lp,		lp,
	isMetered,		isMetered,
	callingUid,		Binder.getCallingUid(),
	administratorUids,		administratorUids,
	binder);		binder);

	@@ -349,7 +345,6 @@ class TestNetworkService extends ITestNetworkManager.Stub {
	} catch (RemoteException e) {		} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();		throw e.rethrowFromSystemServer();
	}		}
	});
	}		}

	/** Teardown a test network */		/** Teardown a test network */

services/core/java/com/android/server/connectivity/NetworkAgentInfo.java

+6 −1

Original line number	Original line	Diff line number	Diff line
	@@ -168,6 +168,9 @@ public class NetworkAgentInfo implements Comparable<NetworkAgentInfo> {
	// Obtained by ConnectivityService and merged into NetworkAgent-provided information.		// Obtained by ConnectivityService and merged into NetworkAgent-provided information.
	public CaptivePortalData captivePortalData;		public CaptivePortalData captivePortalData;

			// The UID of the remote entity that created this Network.
			public final int creatorUid;

	// Networks are lingered when they become unneeded as a result of their NetworkRequests being		// Networks are lingered when they become unneeded as a result of their NetworkRequests being
	// satisfied by a higher-scoring network. so as to allow communication to wrap up before the		// satisfied by a higher-scoring network. so as to allow communication to wrap up before the
	// network is taken down. This usually only happens to the default network. Lingering ends with		// network is taken down. This usually only happens to the default network. Lingering ends with
	@@ -268,7 +271,8 @@ public class NetworkAgentInfo implements Comparable<NetworkAgentInfo> {
	public NetworkAgentInfo(Messenger messenger, AsyncChannel ac, Network net, NetworkInfo info,		public NetworkAgentInfo(Messenger messenger, AsyncChannel ac, Network net, NetworkInfo info,
	LinkProperties lp, NetworkCapabilities nc, int score, Context context,		LinkProperties lp, NetworkCapabilities nc, int score, Context context,
	Handler handler, NetworkAgentConfig config, ConnectivityService connService, INetd netd,		Handler handler, NetworkAgentConfig config, ConnectivityService connService, INetd netd,
	IDnsResolver dnsResolver, INetworkManagementService nms, int factorySerialNumber) {		IDnsResolver dnsResolver, INetworkManagementService nms, int factorySerialNumber,
			int creatorUid) {
	this.messenger = messenger;		this.messenger = messenger;
	asyncChannel = ac;		asyncChannel = ac;
	network = net;		network = net;
	@@ -282,6 +286,7 @@ public class NetworkAgentInfo implements Comparable<NetworkAgentInfo> {
	mHandler = handler;		mHandler = handler;
	networkAgentConfig = config;		networkAgentConfig = config;
	this.factorySerialNumber = factorySerialNumber;		this.factorySerialNumber = factorySerialNumber;
			this.creatorUid = creatorUid;
	}		}

	/**		/**

tests/net/java/com/android/server/ConnectivityServiceTest.java

+7 −6

Original line number	Original line	Diff line number	Diff line
	@@ -2732,7 +2732,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
	// the Messenger, but if this ever changes, not making a defensive copy		// the Messenger, but if this ever changes, not making a defensive copy
	// here will give attack vectors to clients using this code path.		// here will give attack vectors to clients using this code path.
	networkCapabilities = new NetworkCapabilities(networkCapabilities);		networkCapabilities = new NetworkCapabilities(networkCapabilities);
	networkCapabilities.restrictCapabilitesForTestNetwork();		networkCapabilities.restrictCapabilitesForTestNetwork(nai.creatorUid);
	}		}
	updateCapabilities(nai.getCurrentScore(), nai, networkCapabilities);		updateCapabilities(nai.getCurrentScore(), nai, networkCapabilities);
	break;		break;
	@@ -5855,7 +5855,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
	// the call to mixInCapabilities below anyway, but sanitizing here means the NAI never		// the call to mixInCapabilities below anyway, but sanitizing here means the NAI never
	// sees capabilities that may be malicious, which might prevent mistakes in the future.		// sees capabilities that may be malicious, which might prevent mistakes in the future.
	networkCapabilities = new NetworkCapabilities(networkCapabilities);		networkCapabilities = new NetworkCapabilities(networkCapabilities);
	networkCapabilities.restrictCapabilitesForTestNetwork();		networkCapabilities.restrictCapabilitesForTestNetwork(Binder.getCallingUid());
	} else {		} else {
	enforceNetworkFactoryPermission();		enforceNetworkFactoryPermission();
	}		}
	@@ -5868,7 +5868,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
	final NetworkAgentInfo nai = new NetworkAgentInfo(messenger, new AsyncChannel(),		final NetworkAgentInfo nai = new NetworkAgentInfo(messenger, new AsyncChannel(),
	new Network(mNetIdManager.reserveNetId()), new NetworkInfo(networkInfo), lp, nc,		new Network(mNetIdManager.reserveNetId()), new NetworkInfo(networkInfo), lp, nc,
	currentScore, mContext, mTrackerHandler, new NetworkAgentConfig(networkAgentConfig),		currentScore, mContext, mTrackerHandler, new NetworkAgentConfig(networkAgentConfig),
	this, mNetd, mDnsResolver, mNMS, providerId);		this, mNetd, mDnsResolver, mNMS, providerId, Binder.getCallingUid());

	// Make sure the LinkProperties and NetworkCapabilities reflect what the agent info says.		// Make sure the LinkProperties and NetworkCapabilities reflect what the agent info says.
	nai.getAndSetNetworkCapabilities(mixInCapabilities(nai, nc));		nai.getAndSetNetworkCapabilities(mixInCapabilities(nai, nc));

Original line number	Original line	Diff line number	Diff line
	@@ -75,6 +75,7 @@ import static android.net.NetworkPolicyManager.RULE_NONE;
	import static android.net.NetworkPolicyManager.RULE_REJECT_ALL;		import static android.net.NetworkPolicyManager.RULE_REJECT_ALL;
	import static android.net.NetworkPolicyManager.RULE_REJECT_METERED;		import static android.net.NetworkPolicyManager.RULE_REJECT_METERED;
	import static android.net.RouteInfo.RTN_UNREACHABLE;		import static android.net.RouteInfo.RTN_UNREACHABLE;
			import static android.os.Process.INVALID_UID;
	import static android.system.OsConstants.IPPROTO_TCP;		import static android.system.OsConstants.IPPROTO_TCP;

	import static com.android.server.ConnectivityServiceTestUtilsKt.transportToLegacyType;		import static com.android.server.ConnectivityServiceTestUtilsKt.transportToLegacyType;
	@@ -7046,7 +7047,7 @@ public class ConnectivityServiceTest {
	final NetworkAgentInfo naiWithoutUid =		final NetworkAgentInfo naiWithoutUid =
	new NetworkAgentInfo(		new NetworkAgentInfo(
	null, null, null, null, null, new NetworkCapabilities(), 0,		null, null, null, null, null, new NetworkCapabilities(), 0,
	mServiceContext, null, null, mService, null, null, null, 0);		mServiceContext, null, null, mService, null, null, null, 0, INVALID_UID);

	mServiceContext.setPermission(		mServiceContext.setPermission(
	android.Manifest.permission.NETWORK_STACK, PERMISSION_GRANTED);		android.Manifest.permission.NETWORK_STACK, PERMISSION_GRANTED);
	@@ -7062,7 +7063,7 @@ public class ConnectivityServiceTest {
	final NetworkAgentInfo naiWithoutUid =		final NetworkAgentInfo naiWithoutUid =
	new NetworkAgentInfo(		new NetworkAgentInfo(
	null, null, null, null, null, new NetworkCapabilities(), 0,		null, null, null, null, null, new NetworkCapabilities(), 0,
	mServiceContext, null, null, mService, null, null, null, 0);		mServiceContext, null, null, mService, null, null, null, 0, INVALID_UID);

	mServiceContext.setPermission(android.Manifest.permission.NETWORK_STACK, PERMISSION_DENIED);		mServiceContext.setPermission(android.Manifest.permission.NETWORK_STACK, PERMISSION_DENIED);

	@@ -7078,7 +7079,7 @@ public class ConnectivityServiceTest {
	final NetworkAgentInfo naiWithoutUid =		final NetworkAgentInfo naiWithoutUid =
	new NetworkAgentInfo(		new NetworkAgentInfo(
	null, null, null, null, null, new NetworkCapabilities(), 0,		null, null, null, null, null, new NetworkCapabilities(), 0,
	mServiceContext, null, null, mService, null, null, null, 0);		mServiceContext, null, null, mService, null, null, null, 0, INVALID_UID);

	mServiceContext.setPermission(android.Manifest.permission.NETWORK_STACK, PERMISSION_DENIED);		mServiceContext.setPermission(android.Manifest.permission.NETWORK_STACK, PERMISSION_DENIED);

	@@ -7095,7 +7096,7 @@ public class ConnectivityServiceTest {
	final NetworkAgentInfo naiWithoutUid =		final NetworkAgentInfo naiWithoutUid =
	new NetworkAgentInfo(		new NetworkAgentInfo(
	null, null, network, null, null, new NetworkCapabilities(), 0,		null, null, network, null, null, new NetworkCapabilities(), 0,
	mServiceContext, null, null, mService, null, null, null, 0);		mServiceContext, null, null, mService, null, null, null, 0, INVALID_UID);

	setupLocationPermissions(Build.VERSION_CODES.Q, true, AppOpsManager.OPSTR_FINE_LOCATION,		setupLocationPermissions(Build.VERSION_CODES.Q, true, AppOpsManager.OPSTR_FINE_LOCATION,
	Manifest.permission.ACCESS_FINE_LOCATION);		Manifest.permission.ACCESS_FINE_LOCATION);