Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix: Firewall: NMS inverts default rule behavior"

Browse Source
This commit is contained in:
Sudheer Shanka
2023-03-13 19:40:48 +00:00
committed by Gerrit Code Review
parent 9c6a8eb60a 89d79d2ff2
commit 627b64593d
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/core/java/com/android/server/NetworkManagementService.java
View File

@@ -1483,6 +1483,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
public void setFirewallUidRules(int chain, int[] uids, int[] rules) { public void setFirewallUidRules(int chain, int[] uids, int[] rules) {
enforceSystemUid(); enforceSystemUid();
synchronized (mQuotaLock) { synchronized (mQuotaLock) {
final int[] applicableUidsForChain;
synchronized (mRulesLock) { synchronized (mRulesLock) {
SparseIntArray uidFirewallRules = getUidFirewallRulesLR(chain); SparseIntArray uidFirewallRules = getUidFirewallRulesLR(chain);
SparseIntArray newRules = new SparseIntArray(); SparseIntArray newRules = new SparseIntArray();
@@ -1506,10 +1507,15 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
int uid = rulesToRemove.keyAt(index); int uid = rulesToRemove.keyAt(index);
updateFirewallUidRuleLocked(chain, uid, FIREWALL_RULE_DEFAULT); updateFirewallUidRuleLocked(chain, uid, FIREWALL_RULE_DEFAULT);
} }
// Copy the keys for the firewall rules chain, which is guaranteed not to include
// default rules. We must not include default rules in the UIDs we send to
// ConnectivityManager#replaceFirewallChain, as this would have the opposite effect
// intended, leading such UIDs to be blocked or allowed erroneously.
applicableUidsForChain = uidFirewallRules.copyKeys();
} }
final ConnectivityManager cm = mContext.getSystemService(ConnectivityManager.class); final ConnectivityManager cm = mContext.getSystemService(ConnectivityManager.class);
try { try {
cm.replaceFirewallChain(chain, uids); cm.replaceFirewallChain(chain, applicableUidsForChain);
} catch (RuntimeException e) { } catch (RuntimeException e) {
Slog.w(TAG, "Error flushing firewall chain " + chain, e); Slog.w(TAG, "Error flushing firewall chain " + chain, e);
} }