From 914dca36eec8fed05d9c07523425a2411cfa60cc Mon Sep 17 00:00:00 2001 From: Remi NGUYEN VAN Date: Thu, 18 Feb 2021 00:03:53 +0900 Subject: [PATCH] Move SocketUtils out of the connectivity module SocketUtils contains system APIs for modules to interact for sockets, wrapping internal APIs. It should be part of the platform to keep access to the internal APIs. This involves splitting NetworkUtils.protectVpn to NetworkUtilsInternal, since SocketUtils and VpnService are the only users of that method. The @UnsupportedAppUsage NetworkUtils.protectVpn has low usage count, and is already available through VpnService.protect. Bug: 181512874 Test: boots, VPN working Change-Id: I7028d334975f7536c06afac7a22200c33db707ac --- core/api/system-current.txt | 13 +++++++++++++ core/java/android/net/VpnService.java | 3 ++- .../java}/android/net/util/SocketUtils.java | 5 +++-- .../internal/net/NetworkUtilsInternal.java | 16 ++++++++++++++++ core/jni/Android.bp | 2 +- ...NetUtils.cpp => android_net_NetworkUtils.cpp} | 13 +------------ ...android_internal_net_NetworkUtilsInternal.cpp | 13 +++++++++++++ .../framework/api/system-current.txt | 13 ------------- .../framework/src/android/net/NetworkUtils.java | 16 ---------------- 9 files changed, 49 insertions(+), 45 deletions(-) rename {packages/Connectivity/framework/src => core/java}/android/net/util/SocketUtils.java (97%) rename core/jni/{android_net_NetUtils.cpp => android_net_NetworkUtils.cpp} (95%) diff --git a/core/api/system-current.txt b/core/api/system-current.txt index afdf3356201de..302a92a674c41 100644 --- a/core/api/system-current.txt +++ b/core/api/system-current.txt @@ -6449,6 +6449,19 @@ package android.net.sip { } +package android.net.util { + + public final class SocketUtils { + method public static void bindSocketToInterface(@NonNull java.io.FileDescriptor, @NonNull String) throws android.system.ErrnoException; + method public static void closeSocket(@Nullable java.io.FileDescriptor) throws java.io.IOException; + method @NonNull public static java.net.SocketAddress makeNetlinkSocketAddress(int, int); + method @NonNull public static java.net.SocketAddress makePacketSocketAddress(int, int); + method @Deprecated @NonNull public static java.net.SocketAddress makePacketSocketAddress(int, @NonNull byte[]); + method @NonNull public static java.net.SocketAddress makePacketSocketAddress(int, int, @NonNull byte[]); + } + +} + package android.net.vcn { public class VcnManager { diff --git a/core/java/android/net/VpnService.java b/core/java/android/net/VpnService.java index f90fbaf1e0fb7..fa3ff8a26862a 100644 --- a/core/java/android/net/VpnService.java +++ b/core/java/android/net/VpnService.java @@ -41,6 +41,7 @@ import android.os.RemoteException; import android.os.ServiceManager; import android.os.UserHandle; +import com.android.internal.net.NetworkUtilsInternal; import com.android.internal.net.VpnConfig; import java.net.DatagramSocket; @@ -254,7 +255,7 @@ public class VpnService extends Service { * @return {@code true} on success. */ public boolean protect(int socket) { - return NetworkUtils.protectFromVpn(socket); + return NetworkUtilsInternal.protectFromVpn(socket); } /** diff --git a/packages/Connectivity/framework/src/android/net/util/SocketUtils.java b/core/java/android/net/util/SocketUtils.java similarity index 97% rename from packages/Connectivity/framework/src/android/net/util/SocketUtils.java rename to core/java/android/net/util/SocketUtils.java index e64060f1b220e..69edc757ce8a1 100644 --- a/packages/Connectivity/framework/src/android/net/util/SocketUtils.java +++ b/core/java/android/net/util/SocketUtils.java @@ -22,12 +22,13 @@ import static android.system.OsConstants.SO_BINDTODEVICE; import android.annotation.NonNull; import android.annotation.Nullable; import android.annotation.SystemApi; -import android.net.NetworkUtils; import android.system.ErrnoException; import android.system.NetlinkSocketAddress; import android.system.Os; import android.system.PacketSocketAddress; +import com.android.internal.net.NetworkUtilsInternal; + import libcore.io.IoBridge; import java.io.FileDescriptor; @@ -51,7 +52,7 @@ public final class SocketUtils { // of struct ifreq is a NULL-terminated interface name. // TODO: add a setsockoptString() Os.setsockoptIfreq(socket, SOL_SOCKET, SO_BINDTODEVICE, iface); - NetworkUtils.protectFromVpn(socket); + NetworkUtilsInternal.protectFromVpn(socket); } /** diff --git a/core/java/com/android/internal/net/NetworkUtilsInternal.java b/core/java/com/android/internal/net/NetworkUtilsInternal.java index 571d7e721094c..052959abff690 100644 --- a/core/java/com/android/internal/net/NetworkUtilsInternal.java +++ b/core/java/com/android/internal/net/NetworkUtilsInternal.java @@ -22,6 +22,8 @@ import static android.system.OsConstants.AF_INET6; import android.annotation.NonNull; import android.system.Os; +import java.io.FileDescriptor; + /** @hide */ public class NetworkUtilsInternal { @@ -35,6 +37,20 @@ public class NetworkUtilsInternal { */ public static native void setAllowNetworkingForProcess(boolean allowNetworking); + /** + * Protect {@code fd} from VPN connections. After protecting, data sent through + * this socket will go directly to the underlying network, so its traffic will not be + * forwarded through the VPN. + */ + public static native boolean protectFromVpn(FileDescriptor fd); + + /** + * Protect {@code socketfd} from VPN connections. After protecting, data sent through + * this socket will go directly to the underlying network, so its traffic will not be + * forwarded through the VPN. + */ + public static native boolean protectFromVpn(int socketfd); + /** * Returns true if the hostname is weakly validated. * @param hostname Name of host to validate. diff --git a/core/jni/Android.bp b/core/jni/Android.bp index e58ad79de89e2..afd19b63bc71e 100644 --- a/core/jni/Android.bp +++ b/core/jni/Android.bp @@ -149,7 +149,7 @@ cc_library_shared { "android_os_VintfRuntimeInfo.cpp", "android_os_incremental_IncrementalManager.cpp", "android_net_LocalSocketImpl.cpp", - "android_net_NetUtils.cpp", + "android_net_NetworkUtils.cpp", "android_service_DataLoaderService.cpp", "android_util_AssetManager.cpp", "android_util_Binder.cpp", diff --git a/core/jni/android_net_NetUtils.cpp b/core/jni/android_net_NetworkUtils.cpp similarity index 95% rename from core/jni/android_net_NetUtils.cpp rename to core/jni/android_net_NetworkUtils.cpp index e2af87ee1adf5..750810840bde3 100644 --- a/core/jni/android_net_NetUtils.cpp +++ b/core/jni/android_net_NetworkUtils.cpp @@ -14,7 +14,7 @@ * limitations under the License. */ -#define LOG_TAG "NetUtils" +#define LOG_TAG "NetworkUtils" #include @@ -123,15 +123,6 @@ static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, job return setNetworkForSocket(netId, AFileDescriptor_getFD(env, javaFd)); } -static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket) -{ - return (jboolean) !protectFromVpn(socket); -} - -static jboolean android_net_utils_protectFromVpnWithFd(JNIEnv *env, jobject thiz, jobject javaFd) { - return android_net_utils_protectFromVpn(env, thiz, AFileDescriptor_getFD(env, javaFd)); -} - static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId) { return (jboolean) !queryUserAccess(uid, netId); @@ -276,8 +267,6 @@ static const JNINativeMethod gNetworkUtilMethods[] = { { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess }, { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution }, { "bindSocketToNetwork", "(Ljava/io/FileDescriptor;I)I", (void*) android_net_utils_bindSocketToNetwork }, - { "protectFromVpn", "(I)Z", (void*) android_net_utils_protectFromVpn }, - { "protectFromVpn", "(Ljava/io/FileDescriptor;)Z", (void*) android_net_utils_protectFromVpnWithFd }, { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess }, { "attachDropAllBPFFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDropAllBPFFilter }, { "detachBPFFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_detachBPFFilter }, diff --git a/core/jni/com_android_internal_net_NetworkUtilsInternal.cpp b/core/jni/com_android_internal_net_NetworkUtilsInternal.cpp index 10fc18dcd3863..980e12d0bb40c 100644 --- a/core/jni/com_android_internal_net_NetworkUtilsInternal.cpp +++ b/core/jni/com_android_internal_net_NetworkUtilsInternal.cpp @@ -14,6 +14,8 @@ * limitations under the License. */ +#include + #include "NetdClient.h" #include "core_jni_helpers.h" #include "jni.h" @@ -24,9 +26,20 @@ static void android_net_utils_setAllowNetworkingForProcess(JNIEnv *env, jobject setAllowNetworkingForProcess(hasConnectivity == JNI_TRUE); } +static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket) { + return (jboolean)!protectFromVpn(socket); +} + +static jboolean android_net_utils_protectFromVpnWithFd(JNIEnv *env, jobject thiz, jobject javaFd) { + return android_net_utils_protectFromVpn(env, thiz, AFileDescriptor_getFD(env, javaFd)); +} + static const JNINativeMethod gNetworkUtilMethods[] = { {"setAllowNetworkingForProcess", "(Z)V", (void *)android_net_utils_setAllowNetworkingForProcess}, + {"protectFromVpn", "(I)Z", (void *)android_net_utils_protectFromVpn}, + {"protectFromVpn", "(Ljava/io/FileDescriptor;)Z", + (void *)android_net_utils_protectFromVpnWithFd}, }; int register_com_android_internal_net_NetworkUtilsInternal(JNIEnv *env) { diff --git a/packages/Connectivity/framework/api/system-current.txt b/packages/Connectivity/framework/api/system-current.txt index 41ebc5774f3d4..b541e5238ffcf 100644 --- a/packages/Connectivity/framework/api/system-current.txt +++ b/packages/Connectivity/framework/api/system-current.txt @@ -392,16 +392,3 @@ package android.net.apf { } -package android.net.util { - - public final class SocketUtils { - method public static void bindSocketToInterface(@NonNull java.io.FileDescriptor, @NonNull String) throws android.system.ErrnoException; - method public static void closeSocket(@Nullable java.io.FileDescriptor) throws java.io.IOException; - method @NonNull public static java.net.SocketAddress makeNetlinkSocketAddress(int, int); - method @NonNull public static java.net.SocketAddress makePacketSocketAddress(int, int); - method @Deprecated @NonNull public static java.net.SocketAddress makePacketSocketAddress(int, @NonNull byte[]); - method @NonNull public static java.net.SocketAddress makePacketSocketAddress(int, int, @NonNull byte[]); - } - -} - diff --git a/packages/Connectivity/framework/src/android/net/NetworkUtils.java b/packages/Connectivity/framework/src/android/net/NetworkUtils.java index b5e8a614b8ea6..9e42bbecbe9d8 100644 --- a/packages/Connectivity/framework/src/android/net/NetworkUtils.java +++ b/packages/Connectivity/framework/src/android/net/NetworkUtils.java @@ -86,22 +86,6 @@ public class NetworkUtils { */ public static native int bindSocketToNetwork(FileDescriptor fd, int netId); - /** - * Protect {@code fd} from VPN connections. After protecting, data sent through - * this socket will go directly to the underlying network, so its traffic will not be - * forwarded through the VPN. - */ - @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553, - publicAlternatives = "Use {@link android.net.VpnService#protect} instead.") - public static native boolean protectFromVpn(FileDescriptor fd); - - /** - * Protect {@code socketfd} from VPN connections. After protecting, data sent through - * this socket will go directly to the underlying network, so its traffic will not be - * forwarded through the VPN. - */ - public native static boolean protectFromVpn(int socketfd); - /** * Determine if {@code uid} can access network designated by {@code netId}. * @return {@code true} if {@code uid} can access network, {@code false} otherwise.