Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am a9e98343: Merge "Fix NOT_RESTRICTED network capability and enforce it." into lmp-dev

Browse Source 
* commit 'a9e98343146244b71e236d82c95a8d0fa30a41c1':
  Fix NOT_RESTRICTED network capability and enforce it.
This commit is contained in:
Paul Jensen
2015-09-23 11:06:27 +00:00
committed by Android Git Automerger
parent b2b3cecbd3 a9e9834314
commit 635f871132
6 changed files with 109 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
core/java/android/net/ConnectivityManager.java
View File

@@ -941,41 +941,6 @@ public class ConnectivityManager {
return 1;
}
/**
* Removes the NET_CAPABILITY_NOT_RESTRICTED capability from the given
* NetworkCapabilities object if all the capabilities it provides are
* typically provided by restricted networks.
*
* TODO: consider:
* - Moving to NetworkCapabilities
* - Renaming it to guessRestrictedCapability and make it set the
* restricted capability bit in addition to clearing it.
* @hide
*/
public static void maybeMarkCapabilitiesRestricted(NetworkCapabilities nc) {
for (int capability : nc.getCapabilities()) {
switch (capability) {
case NetworkCapabilities.NET_CAPABILITY_CBS:
case NetworkCapabilities.NET_CAPABILITY_DUN:
case NetworkCapabilities.NET_CAPABILITY_EIMS:
case NetworkCapabilities.NET_CAPABILITY_FOTA:
case NetworkCapabilities.NET_CAPABILITY_IA:
case NetworkCapabilities.NET_CAPABILITY_IMS:
case NetworkCapabilities.NET_CAPABILITY_RCS:
case NetworkCapabilities.NET_CAPABILITY_XCAP:
case NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED: //there by default
continue;
default:
// At least one capability usually provided by unrestricted
// networks. Conclude that this network is unrestricted.
return;
}
}
// All the capabilities are typically provided by restricted networks.
// Conclude that this network is restricted.
nc.removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED);
}
private NetworkCapabilities networkCapabilitiesForFeature(int networkType, String feature) {
if (networkType == TYPE_MOBILE) {
int cap = -1;
@@ -998,14 +963,14 @@ public class ConnectivityManager {
}
NetworkCapabilities netCap = new NetworkCapabilities();
netCap.addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR).addCapability(cap);
maybeMarkCapabilitiesRestricted(netCap);
netCap.maybeMarkCapabilitiesRestricted();
return netCap;
} else if (networkType == TYPE_WIFI) {
if ("p2p".equals(feature)) {
NetworkCapabilities netCap = new NetworkCapabilities();
netCap.addTransportType(NetworkCapabilities.TRANSPORT_WIFI);
netCap.addCapability(NetworkCapabilities.NET_CAPABILITY_WIFI_P2P);
maybeMarkCapabilitiesRestricted(netCap);
netCap.maybeMarkCapabilitiesRestricted();
return netCap;
}
}

42
core/java/android/net/NetworkCapabilities.java
View File

@@ -37,6 +37,7 @@ public final class NetworkCapabilities implements Parcelable {
* @hide
*/
public NetworkCapabilities() {
mNetworkCapabilities = DEFAULT_CAPABILITIES;
}
public NetworkCapabilities(NetworkCapabilities nc) {
@@ -53,8 +54,7 @@ public final class NetworkCapabilities implements Parcelable {
* Represents the network's capabilities. If any are specified they will be satisfied
* by any Network that matches all of them.
*/
private long mNetworkCapabilities = (1 << NET_CAPABILITY_NOT_RESTRICTED) |
(1 << NET_CAPABILITY_TRUSTED) | (1 << NET_CAPABILITY_NOT_VPN);
private long mNetworkCapabilities;
/**
* Indicates this is a network that has the ability to reach the
@@ -158,6 +158,28 @@ public final class NetworkCapabilities implements Parcelable {
private static final int MIN_NET_CAPABILITY = NET_CAPABILITY_MMS;
private static final int MAX_NET_CAPABILITY = NET_CAPABILITY_NOT_VPN;
/**
* Capabilities that are set by default when the object is constructed.
*/
private static final long DEFAULT_CAPABILITIES =
(1 << NET_CAPABILITY_NOT_RESTRICTED) |
(1 << NET_CAPABILITY_TRUSTED) |
(1 << NET_CAPABILITY_NOT_VPN);
/**
* Capabilities that suggest that a network is restricted.
* {@see #maybeMarkCapabilitiesRestricted}.
*/
private static final long RESTRICTED_CAPABILITIES =
(1 << NET_CAPABILITY_CBS) |
(1 << NET_CAPABILITY_DUN) |
(1 << NET_CAPABILITY_EIMS) |
(1 << NET_CAPABILITY_FOTA) |
(1 << NET_CAPABILITY_IA) |
(1 << NET_CAPABILITY_IMS) |
(1 << NET_CAPABILITY_RCS) |
(1 << NET_CAPABILITY_XCAP);
/**
* Adds the given capability to this {@code NetworkCapability} instance.
* Multiple capabilities may be applied sequentially. Note that when searching
@@ -239,6 +261,22 @@ public final class NetworkCapabilities implements Parcelable {
return (nc.mNetworkCapabilities == this.mNetworkCapabilities);
}
/**
* Removes the NET_CAPABILITY_NOT_RESTRICTED capability if all the capabilities it provides are
* typically provided by restricted networks.
*
* TODO: consider:
* - Renaming it to guessRestrictedCapability and make it set the
* restricted capability bit in addition to clearing it.
* @hide
*/
public void maybeMarkCapabilitiesRestricted() {
// If all the capabilities are typically provided by restricted networks, conclude that this
// network is restricted.
if ((mNetworkCapabilities & ~(DEFAULT_CAPABILITIES | RESTRICTED_CAPABILITIES)) == 0)
removeCapability(NET_CAPABILITY_NOT_RESTRICTED);
}
/**
* Representing the transport type. Apps should generally not care about transport. A
* request for a fast internet connection could be satisfied by a number of different

8
core/java/android/net/NetworkRequest.java
View File

@@ -85,7 +85,13 @@ public class NetworkRequest implements Parcelable {
* Build {@link NetworkRequest} give the current set of capabilities.
*/
public NetworkRequest build() {
return new NetworkRequest(mNetworkCapabilities, ConnectivityManager.TYPE_NONE,
// Make a copy of mNetworkCapabilities so we don't inadvertently remove NOT_RESTRICTED
// when later an unrestricted capability could be added to mNetworkCapabilities, in
// which case NOT_RESTRICTED should be returned to mNetworkCapabilities, which
// maybeMarkCapabilitiesRestricted() doesn't add back.
final NetworkCapabilities nc = new NetworkCapabilities(mNetworkCapabilities);
nc.maybeMarkCapabilitiesRestricted();
return new NetworkRequest(nc, ConnectivityManager.TYPE_NONE,
ConnectivityManager.REQUEST_ID_UNSET);
}

11
core/java/android/os/INetworkManagementService.aidl
View File

@@ -367,8 +367,10 @@ interface INetworkManagementService
/**
* Setup a new physical network.
* @param permission null if no permissions required to access this network. PERMISSION_NETWORK
* or PERMISSION_SYSTEM to set respective permission.
*/
void createPhysicalNetwork(int netId);
void createPhysicalNetwork(int netId, String permission);
/**
* Setup a new VPN.
@@ -395,6 +397,13 @@ interface INetworkManagementService
void setDefaultNetId(int netId);
void clearDefaultNetId();
/**
* Set permission for a network.
* @param permission null to clear permissions. PERMISSION_NETWORK or PERMISSION_SYSTEM to set
* permission.
*/
void setNetworkPermission(int netId, String permission);
void setPermission(String permission, in int[] uids);
void clearPermission(in int[] uids);

16
services/core/java/com/android/server/ConnectivityService.java
View File

@@ -37,6 +37,7 @@ import static android.net.ConnectivityManager.TYPE_WIMAX;
import static android.net.ConnectivityManager.TYPE_PROXY;
import static android.net.ConnectivityManager.getNetworkTypeName;
import static android.net.ConnectivityManager.isNetworkTypeValid;
import static android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED;
import static android.net.NetworkPolicyManager.RULE_ALLOW_ALL;
import static android.net.NetworkPolicyManager.RULE_REJECT_METERED;
@@ -3707,6 +3708,16 @@ public class ConnectivityService extends IConnectivityManager.Stub {
// TODO - turn this on in MR1 when we have more dogfooding time.
// rematchAllNetworksAndRequests();
if (!Objects.equals(networkAgent.networkCapabilities, networkCapabilities)) {
if (networkAgent.networkCapabilities.hasCapability(NET_CAPABILITY_NOT_RESTRICTED) !=
networkCapabilities.hasCapability(NET_CAPABILITY_NOT_RESTRICTED)) {
try {
mNetd.setNetworkPermission(networkAgent.network.netId,
networkCapabilities.hasCapability(NET_CAPABILITY_NOT_RESTRICTED) ?
null : NetworkManagementService.PERMISSION_SYSTEM);
} catch (RemoteException e) {
loge("Exception in setNetworkPermission: " + e);
}
}
synchronized (networkAgent) {
networkAgent.networkCapabilities = networkCapabilities;
}
@@ -4075,7 +4086,10 @@ public class ConnectivityService extends IConnectivityManager.Stub {
(networkAgent.networkMisc == null ||
!networkAgent.networkMisc.allowBypass));
} else {
mNetd.createPhysicalNetwork(networkAgent.network.netId);
mNetd.createPhysicalNetwork(networkAgent.network.netId,
networkAgent.networkCapabilities.hasCapability(
NET_CAPABILITY_NOT_RESTRICTED) ?
null : NetworkManagementService.PERMISSION_SYSTEM);
}
} catch (Exception e) {
loge("Error creating network " + networkAgent.network.netId + ": "

37
services/core/java/com/android/server/NetworkManagementService.java
View File

@@ -120,6 +120,19 @@ public class NetworkManagementService extends INetworkManagementService.Stub
*/
public static final String LIMIT_GLOBAL_ALERT = "globalAlert";
/**
* String to pass to netd to indicate that a network is only accessible
* to apps that have the CHANGE_NETWORK_STATE permission.
*/
public static final String PERMISSION_NETWORK = "NETWORK";
/**
* String to pass to netd to indicate that a network is only
* accessible to system apps and those with the CONNECTIVITY_INTERNAL
* permission.
*/
public static final String PERMISSION_SYSTEM = "SYSTEM";
class NetdResponseCode {
/* Keep in sync with system/netd/server/ResponseCode.h */
public static final int InterfaceListResult = 110;
@@ -1962,11 +1975,15 @@ public class NetworkManagementService extends INetworkManagementService.Stub
}
@Override
public void createPhysicalNetwork(int netId) {
public void createPhysicalNetwork(int netId, String permission) {
mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
try {
mConnector.execute("network", "create", netId);
if (permission != null) {
mConnector.execute("network", "create", netId, permission);
} else {
mConnector.execute("network", "create", netId);
}
} catch (NativeDaemonConnectorException e) {
throw e.rethrowAsParcelableException();
}
@@ -2057,6 +2074,22 @@ public class NetworkManagementService extends INetworkManagementService.Stub
}
}
@Override
public void setNetworkPermission(int netId, String permission) {
mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
try {
if (permission != null) {
mConnector.execute("network", "permission", "network", "set", permission, netId);
} else {
mConnector.execute("network", "permission", "network", "clear", netId);
}
} catch (NativeDaemonConnectorException e) {
throw e.rethrowAsParcelableException();
}
}
@Override
public void setPermission(String permission, int[] uids) {
mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);