Merge "Check if we\'re connected before marking a UID blocked" into nyc-dev am: 33154deb70

am: 6c3cb2c392

* commit '6c3cb2c3926182245a0e80a7e3c95ff04d032b06':
  Check if we're connected before marking a UID blocked

Change-Id: Ib2b6ddd0d5a6e7a4b825a3113d275d753c5c08b0

services/core/java/com/android/server/connectivity/Vpn.java

@@ -1055,18 +1055,27 @@ public class Vpn {
     }
 
     /**
-     * @return {@code true} if the set of users blocked whilst waiting for VPN to connect includes
-     *         the UID {@param uid}, {@code false} otherwise.
+     * @return {@code true} if {@param uid} is blocked by an always-on VPN.
+     *         A UID is blocked if it's included in one of the mBlockedUsers ranges and the VPN is
+     *         not connected, or if the VPN is connected but does not apply to the UID.
      *
      * @see #mBlockedUsers
      */
     public synchronized boolean isBlockingUid(int uid) {
-        for (UidRange uidRange : mBlockedUsers) {
-            if (uidRange.contains(uid)) {
-                return true;
-            }
+        if (!mLockdown) {
+            return false;
+        }
+
+        if (mNetworkInfo.isConnected()) {
+            return !appliesToUid(uid);
+        } else {
+            for (UidRange uidRange : mBlockedUsers) {
+                if (uidRange.contains(uid)) {
+                    return true;
+                }
+            }
+            return false;
         }
-        return false;
     }
 
     private native int jniCreate(int mtu);