Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e6aeea3 authored by Remi NGUYEN VAN's avatar Remi NGUYEN VAN
Browse files

Add TestNetworkStackService to NetworkStack 

TestNetworkStackService allows (test) applications to bind to the
NetworkStack using NETWORK_SETTINGS permissions (instead of
MAINLINE_NETWORK_STACK), only on debuggable builds.

On such builds, also allow applications to perform binder calls to the
NetworkStack if their UID/PID was allowed by root. Such applications
must also have NETWORK_SETTINGS permissions when they are being
allowed: typically they will obtain it via adoptShellPermissionIdentity.

Effectively, this patch allows tests to communicate with the
NetworkStack binder interface if they have root access, can use
shell permissions, and the device has a debuggable build. This could be
used on userdebug devices, or on devices booting with the debug ramdisk.

Bug: 160541918
Test: m; prototype tests based on this change
Change-Id: I0453e309037fad52aed6cab9b4cf39110eeacf61
parent 3abcdcbf

AndroidManifest.xml

+11 −0
Original line number Diff line number Diff line
@@ -50,6 +50,17 @@ 
                <action android:name="android.net.INetworkStackConnector"/>

            </intent-filter>

        </service>

        <!-- Test instrumentation service, only usable on debuggable builds.

             The service is protected by NETWORK_SETTINGS permissions as there is no better

             networking-related permission that exists on Q, is sufficiently protected (signature),

             and can be obtained via shell permissions. -->

        <service android:name="com.android.server.TestNetworkStackService"

                 android:permission="android.permission.NETWORK_SETTINGS"

                 android:exported="true">

            <intent-filter>

                <action android:name="android.net.INetworkStackConnector.Test"/>

            </intent-filter>

        </service>

        <service android:name="com.android.server.connectivity.ipmemorystore.RegularMaintenanceJobService"

                 android:permission="android.permission.BIND_JOB_SERVICE" >

        </service>

common/networkstackclient/Android.bp

+2 −0
Original line number Diff line number Diff line
@@ -86,6 +86,8 @@ aidl_interface { 
        "src/android/net/dhcp/IDhcpServerCallbacks.aidl",

        "src/android/net/ip/IIpClient.aidl",

        "src/android/net/ip/IIpClientCallbacks.aidl",

        // New AIDL classes should go into android.net.networkstack.aidl so they can be clearly

        // identified

    ],

    backend: {

        java: {

common/networkstackclient/aidl_api/networkstack-aidl-interfaces/current/android/net/INetworkStackConnector.aidl

+1 −0
Original line number Diff line number Diff line
@@ -22,4 +22,5 @@ interface INetworkStackConnector { 
  oneway void makeNetworkMonitor(in android.net.Network network, String name, in android.net.INetworkMonitorCallbacks cb);

  oneway void makeIpClient(in String ifName, in android.net.ip.IIpClientCallbacks callbacks);

  oneway void fetchIpMemoryStore(in android.net.IIpMemoryStoreCallbacks cb);

  oneway void allowTestUid(int uid, in android.net.INetworkStackStatusCallback cb);

}

common/networkstackclient/src/android/net/INetworkStackConnector.aidl

+18 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ package android.net; 


import android.net.IIpMemoryStoreCallbacks;

import android.net.INetworkMonitorCallbacks;

import android.net.INetworkStackStatusCallback;

import android.net.Network;

import android.net.dhcp.DhcpServingParamsParcel;

import android.net.dhcp.IDhcpServerCallbacks;
@@ -29,4 +30,21 @@ oneway interface INetworkStackConnector { 
    void makeNetworkMonitor(in Network network, String name, in INetworkMonitorCallbacks cb);

    void makeIpClient(in String ifName, in IIpClientCallbacks callbacks);

    void fetchIpMemoryStore(in IIpMemoryStoreCallbacks cb);

    /**

     * Mark a UID as test UID, allowing it to use the TestNetworkStackService.

     *

     * TestNetworkStackService is a binder service identical to NetworkStackService, but only

     * available on userdebug builds, and only usable by the test UID. It does not require the

     * MAINLINE_NETWORK_STACK signature permission like NetworkStackService does, so it allows the

     * test UID to use other methods in this interface even though it would otherwise not have

     * permission to.

     *

     * This method must be called as root and can only be used on debuggable builds. It only affects

     * the NetworkStack until it is restarted.

     * Callers should pass in -1 to reset after use.

     *

     * @param cb Callback that will be called with a status of 0 if the call succeeds. Calls without

     *           sufficient permissions may be dropped without generating a callback.

     */

    oneway void allowTestUid(int uid, in INetworkStackStatusCallback cb);

}

src/com/android/server/NetworkStackService.java

+10 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ import android.net.INetd; 
import android.net.INetworkMonitor;

import android.net.INetworkMonitorCallbacks;

import android.net.INetworkStackConnector;

import android.net.INetworkStackStatusCallback;

import android.net.LinkProperties;

import android.net.Network;

import android.net.NetworkCapabilities;
@@ -410,6 +411,15 @@ public class NetworkStackService extends Service { 
            cb.onIpMemoryStoreFetched(mIpMemoryStoreService);

        }



        @Override

        public void allowTestUid(int uid, @Nullable INetworkStackStatusCallback cb)

                throws RemoteException {

            // setTestUid does its own permission checks

            PermissionUtil.setTestUid(mContext, uid);

            mLog.i("Allowing test uid " + uid);

            if (cb != null) cb.onStatusAvailable(0);

        }



        @Override

        protected void dump(@NonNull FileDescriptor fd, @NonNull PrintWriter fout,

                @Nullable String[] args) {