Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow passing the underlying network to startLegacyVpn.

Browse Source 
This will be used by a future change that makes the legacy
lockdown VPN pass the underlying network.

Bug: 173331190
Test: tests in subsequent CLs in stack
Change-Id: I09366a7f872ef3d4538962a75b0114a2ecb536e6
This commit is contained in:
Lorenzo Colitti
2021-01-29 20:34:38 +09:00
parent 96a8d7f990
commit 00aa2977b4
4 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
services/core/java/com/android/server/ConnectivityService.java
View File

@@ -4838,7 +4838,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
}
synchronized (mVpns) {
throwIfLockdownEnabled();
mVpns.get(user).startLegacyVpn(profile, mKeyStore, egress);
mVpns.get(user).startLegacyVpn(profile, mKeyStore, null /* underlying */, egress);
}
}

16
services/core/java/com/android/server/connectivity/Vpn.java
View File

@@ -1982,27 +1982,28 @@ public class Vpn {
* secondary thread to perform connection work, returning quickly.
*
* Should only be called to respond to Binder requests as this enforces caller permission. Use
* {@link #startLegacyVpnPrivileged(VpnProfile, KeyStore, LinkProperties)} to skip the
* {@link #startLegacyVpnPrivileged(VpnProfile, KeyStore, Network, LinkProperties)} to skip the
* permission check only when the caller is trusted (or the call is initiated by the system).
*/
public void startLegacyVpn(VpnProfile profile, KeyStore keyStore, LinkProperties egress) {
public void startLegacyVpn(VpnProfile profile, KeyStore keyStore, @Nullable Network underlying,
LinkProperties egress) {
enforceControlPermission();
final long token = Binder.clearCallingIdentity();
try {
startLegacyVpnPrivileged(profile, keyStore, egress);
startLegacyVpnPrivileged(profile, keyStore, underlying, egress);
} finally {
Binder.restoreCallingIdentity(token);
}
}
/**
* Like {@link #startLegacyVpn(VpnProfile, KeyStore, LinkProperties)}, but does not check
* permissions under the assumption that the caller is the system.
* Like {@link #startLegacyVpn(VpnProfile, KeyStore, Network, LinkProperties)}, but does not
* check permissions under the assumption that the caller is the system.
*
* Callers are responsible for checking permissions if needed.
*/
public void startLegacyVpnPrivileged(VpnProfile profile, KeyStore keyStore,
LinkProperties egress) {
@Nullable Network underlying, @NonNull LinkProperties egress) {
UserManager mgr = UserManager.get(mContext);
UserInfo user = mgr.getUserInfo(mUserId);
if (user.isRestricted() || mgr.hasUserRestriction(UserManager.DISALLOW_CONFIG_VPN,
@@ -2128,6 +2129,9 @@ public class Vpn {
config.session = profile.name;
config.isMetered = false;
config.proxyInfo = profile.proxy;
if (underlying != null) {
config.underlyingNetworks = new Network[] { underlying };
}
config.addLegacyRoutes(profile.routes);
if (!profile.dnsServers.isEmpty()) {

2
services/core/java/com/android/server/net/LockdownVpnTracker.java
View File

@@ -155,7 +155,7 @@ public class LockdownVpnTracker {
try {
// Use the privileged method because Lockdown VPN is initiated by the system, so
// no additional permission checks are necessary.
mVpn.startLegacyVpnPrivileged(mProfile, mKeyStore, egressProp);
mVpn.startLegacyVpnPrivileged(mProfile, mKeyStore, null, egressProp);
} catch (IllegalStateException e) {
mAcceptedEgressIface = null;
Log.e(TAG, "Failed to start VPN", e);

3
tests/net/java/com/android/server/connectivity/VpnTest.java
View File

@@ -148,6 +148,7 @@ public class VpnTest {
managedProfileA.profileGroupId = primaryUser.id;
}
static final Network EGRESS_NETWORK = new Network(101);
static final String EGRESS_IFACE = "wlan0";
static final String TEST_VPN_PKG = "com.testvpn.vpn";
private static final String TEST_VPN_SERVER = "1.2.3.4";
@@ -963,7 +964,7 @@ public class VpnTest {
InetAddresses.parseNumericAddress("192.0.2.0"), EGRESS_IFACE);
lp.addRoute(defaultRoute);
vpn.startLegacyVpn(vpnProfile, mKeyStore, lp);
vpn.startLegacyVpn(vpnProfile, mKeyStore, EGRESS_NETWORK, lp);
return vpn;
}