Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit afc7dde3 authored by Oliver Scott's avatar Oliver Scott Committed by Michael Bestas
Browse files

Firewall: Transport-based toggle support (1/3) 



Update Connectivity with the network transports that UIDs are allowed
to use, e.g. Wi-Fi or Cellular.

Needs corresponding Connectivity and netd changes.

Co-authored-by: default avatarTommy Webb <tommy@calyxinstitute.org>
Requires: I79342edbec92090cca20853ba50ea7fd48ec81c2
Change-Id: Ifeb8342698a8ba4ce2453d64dc32590aebca5fe5
parent 175e4084

core/api/module-lib-current.txt

+7 −0
Original line number Diff line number Diff line
@@ -272,12 +272,19 @@ package android.net { 
    method @Nullable @RequiresPermission(anyOf={android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK, android.Manifest.permission.NETWORK_STACK}) public android.telephony.SubscriptionPlan getSubscriptionPlan(@NonNull android.net.NetworkTemplate);

    method @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY) public boolean isUidNetworkingBlocked(int, boolean);

    method @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY) public boolean isUidRestrictedOnMeteredNetworks(int);

    method @RequiresPermission(android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK) public void notifyDenylistChanged(@NonNull int[], @NonNull int[]);

    method @RequiresPermission(anyOf={android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK, android.Manifest.permission.NETWORK_STACK}) public void notifyStatsProviderLimitReached();

    method @RequiresPermission(anyOf={android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK, android.Manifest.permission.NETWORK_STACK}) public void notifyStatsProviderWarningReached();

    method @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY) public void registerAllowedTransportsCallback(@Nullable java.util.concurrent.Executor, @NonNull android.net.NetworkPolicyManager.AllowedTransportsCallback);

    method @Deprecated @FlaggedApi("android.net.platform.flags.deprecate_network_policy_callback") @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY) public void registerNetworkPolicyCallback(@Nullable java.util.concurrent.Executor, @NonNull android.net.NetworkPolicyManager.NetworkPolicyCallback);

    method @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY) public void unregisterAllowedTransportsCallback(@NonNull android.net.NetworkPolicyManager.AllowedTransportsCallback);

    method @Deprecated @FlaggedApi("android.net.platform.flags.deprecate_network_policy_callback") @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY) public void unregisterNetworkPolicyCallback(@NonNull android.net.NetworkPolicyManager.NetworkPolicyCallback);

  }



  public static interface NetworkPolicyManager.AllowedTransportsCallback {

    method public default void onUidsAllowedTransportsChanged(@NonNull int[], @NonNull long[]);

  }



  @Deprecated @FlaggedApi("android.net.platform.flags.deprecate_network_policy_callback") public static interface NetworkPolicyManager.NetworkPolicyCallback {

    method @Deprecated public default void onUidBlockedReasonChanged(int, int);

  }

core/api/module-lib-lint-baseline.txt

+10 −0
Original line number Diff line number Diff line
@@ -1773,6 +1773,16 @@ UnflaggedApi: android.companion.CompanionDeviceManager.OnTransportsChangedListen 
    New API must be flagged with @FlaggedApi: method android.companion.CompanionDeviceManager.OnTransportsChangedListener.onTransportsChanged(java.util.List<android.companion.AssociationInfo>)

UnflaggedApi: android.content.Context#REMOTE_AUTH_SERVICE:

    New API must be flagged with @FlaggedApi: field android.content.Context.REMOTE_AUTH_SERVICE

UnflaggedApi: android.net.NetworkPolicyManager#notifyDenylistChanged(int[], int[]):

    New API must be flagged with @FlaggedApi: method android.net.NetworkPolicyManager.notifyDenylistChanged(int[],int[])

UnflaggedApi: android.net.NetworkPolicyManager#registerAllowedTransportsCallback(java.util.concurrent.Executor, android.net.NetworkPolicyManager.AllowedTransportsCallback):

    New API must be flagged with @FlaggedApi: method android.net.NetworkPolicyManager.registerAllowedTransportsCallback(java.util.concurrent.Executor,android.net.NetworkPolicyManager.AllowedTransportsCallback)

UnflaggedApi: android.net.NetworkPolicyManager#unregisterAllowedTransportsCallback(android.net.NetworkPolicyManager.AllowedTransportsCallback):

    New API must be flagged with @FlaggedApi: method android.net.NetworkPolicyManager.unregisterAllowedTransportsCallback(android.net.NetworkPolicyManager.AllowedTransportsCallback)

UnflaggedApi: android.net.NetworkPolicyManager.AllowedTransportsCallback:

    New API must be flagged with @FlaggedApi: class android.net.NetworkPolicyManager.AllowedTransportsCallback

UnflaggedApi: android.net.NetworkPolicyManager.AllowedTransportsCallback#onUidsAllowedTransportsChanged(int[], long[]):

    New API must be flagged with @FlaggedApi: method android.net.NetworkPolicyManager.AllowedTransportsCallback.onUidsAllowedTransportsChanged(int[],long[])

UnflaggedApi: android.os.IpcDataCache#MODULE_TELEPHONY:

    New API must be flagged with @FlaggedApi: field android.os.IpcDataCache.MODULE_TELEPHONY

UnflaggedApi: android.provider.Settings.Config#getAllStrings():

core/java/android/net/INetworkPolicyListener.aidl

+1 −0
Original line number Diff line number Diff line
@@ -26,4 +26,5 @@ oneway interface INetworkPolicyListener { 
    void onSubscriptionOverride(int subId, int overrideMask, int overrideValue, in int[] networkTypes);

    void onSubscriptionPlansChanged(int subId, in SubscriptionPlan[] plans);

    void onBlockedReasonChanged(int uid, int oldBlockedReason, int newBlockedReason);

    void onAllowedTransportsChanged(in int[] uids, in long[] allowedTransports);

}

core/java/android/net/INetworkPolicyManager.aidl

+2 −0
Original line number Diff line number Diff line
@@ -97,4 +97,6 @@ interface INetworkPolicyManager { 


    byte[] getBackupPayload(int user);

    void applyRestore(in byte[] payload, int user);



    void notifyDenylistChanged(in int[] uidsAdded, in int[] uidsRemoved);

}

core/java/android/net/NetworkPolicyManager.java

+92 −0
Original line number Diff line number Diff line
@@ -88,6 +88,18 @@ public class NetworkPolicyManager { 
     * @hide

     */

    public static final int POLICY_ALLOW_METERED_BACKGROUND = 0x4;

    /** Reject network usage on cellular network

     * @hide

     */

    public static final int POLICY_REJECT_CELLULAR = 0x10000;

    /** Reject network usage on virtual private network

     * @hide

     */

    public static final int POLICY_REJECT_VPN = 0x20000;

    /** Reject network usage on wifi network

     * @hide

     */

    public static final int POLICY_REJECT_WIFI = 0x8000;

    /** Reject network usage on all networks

     * @hide

     */
@@ -325,6 +337,8 @@ public class NetworkPolicyManager { 
            mSubscriptionCallbackMap = new ConcurrentHashMap<>();

    private final Map<NetworkPolicyCallback, NetworkPolicyCallbackProxy>

            mNetworkPolicyCallbackMap = new ConcurrentHashMap<>();

    private final Map<AllowedTransportsCallback, AllowedTransportsCallbackProxy>

            mAllowedTransportsCallbackMap = new ConcurrentHashMap<>();



    /** @hide */

    public NetworkPolicyManager(Context context, INetworkPolicyManager service) {
@@ -411,6 +425,17 @@ public class NetworkPolicyManager { 
        }

    }



    /** @hide */

    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)

    @RequiresPermission(NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK)

    public void notifyDenylistChanged(@NonNull int[] uidsAdded, @NonNull int[] uidsRemoved) {

        try {

            mService.notifyDenylistChanged(uidsAdded, uidsRemoved);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

    }



    /** @hide */

    @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)

    public void registerListener(INetworkPolicyListener listener) {
@@ -1123,6 +1148,72 @@ public class NetworkPolicyManager { 
        }

    }



    /** @hide */

    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)

    @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY)

    public void registerAllowedTransportsCallback(@Nullable Executor executor,

            @NonNull AllowedTransportsCallback callback) {

        if (callback == null) {

            throw new NullPointerException("Callback cannot be null.");

        }



        final AllowedTransportsCallbackProxy callbackProxy = new AllowedTransportsCallbackProxy(

                executor, callback);

        registerListener(callbackProxy);

        mAllowedTransportsCallbackMap.put(callback, callbackProxy);

    }



    /** @hide */

    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)

    @RequiresPermission(android.Manifest.permission.OBSERVE_NETWORK_POLICY)

    public void unregisterAllowedTransportsCallback(@NonNull AllowedTransportsCallback callback) {

        if (callback == null) {

            throw new NullPointerException("Callback cannot be null.");

        }



        final AllowedTransportsCallbackProxy callbackProxy =

                mAllowedTransportsCallbackMap.remove(callback);

        if (callbackProxy == null) return;

        unregisterListener(callbackProxy);

    }



    /** @hide */

    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)

    public interface AllowedTransportsCallback {

        /** @hide */

        @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)

        default void onUidsAllowedTransportsChanged(@NonNull int[] uids,

                @NonNull long[] allowedTransports) {}

    }



    /** @hide */

    public static class AllowedTransportsCallbackProxy extends Listener {

        private final Executor mExecutor;

        private final AllowedTransportsCallback mCallback;



        AllowedTransportsCallbackProxy(@Nullable Executor executor,

                @NonNull AllowedTransportsCallback callback) {

            mExecutor = executor;

            mCallback = callback;

        }



        @Override

        public void onAllowedTransportsChanged(int[] uids, long[] allowedTransports) {

            dispatchOnUidsAllowedTransportsChanged(mExecutor, mCallback, uids, allowedTransports);

        }

    }



    private static void dispatchOnUidsAllowedTransportsChanged(@Nullable Executor executor,

            @NonNull AllowedTransportsCallback callback, int[] uids, long[] allowedTransports) {

        if (executor == null) {

            callback.onUidsAllowedTransportsChanged(uids, allowedTransports);

        } else {

            executor.execute(PooledLambda.obtainRunnable(

                    AllowedTransportsCallback::onUidsAllowedTransportsChanged,

                    callback, uids, allowedTransports).recycleOnUse());

        }

    }



    /** {@hide} */

    public static class Listener extends INetworkPolicyListener.Stub {

        @Override public void onUidRulesChanged(int uid, int uidRules) { }
@@ -1134,5 +1225,6 @@ public class NetworkPolicyManager { 
        @Override public void onSubscriptionPlansChanged(int subId, SubscriptionPlan[] plans) { }

        @Override public void onBlockedReasonChanged(int uid,

                int oldBlockedReasons, int newBlockedReasons) { }

        @Override public void onAllowedTransportsChanged(int[] uids, long[] allowedTransports) { }

    }

}