Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Firewall: NMS inverts default rule behavior

Browse Source 
When setting a chain's firewall rules in NetworkManagementService, do
not submit supplied UIDs to ConnectivityManager#replaceFirewallChain
directly, as this does not consider what the actual rules are for those
UIDs. Instead, supply the keys from the rules chain, which deletes
default rules when it is updated via updateFirewallUidRuleLocked.

For example, if a given UID's rule is the default rule, and it is part
of the restricted chain, then the UID should be blocked, because the
restricted chain is an allowlist. Prior to this change, the rules for
UIDs are ignored when calling replaceFirewallChain, so the UID's mere
presence among the supplied UIDs causes it to be unexpectedly added
to the restricted mode allowlist.

Test: CtsHostsideNetworkTests
Change-Id: I0a71ad376bcfda05cea151144dfab9bec8e8b749
This commit is contained in:
Tommy Webb
2023-02-15 19:26:02 -05:00
committed by t-m-w
parent 1d2bead412
commit 89d79d2ff2
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/core/java/com/android/server/NetworkManagementService.java
View File

@@ -1483,6 +1483,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
public void setFirewallUidRules(int chain, int[] uids, int[] rules) {
enforceSystemUid();
synchronized (mQuotaLock) {
final int[] applicableUidsForChain;
synchronized (mRulesLock) {
SparseIntArray uidFirewallRules = getUidFirewallRulesLR(chain);
SparseIntArray newRules = new SparseIntArray();
@@ -1506,10 +1507,15 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
int uid = rulesToRemove.keyAt(index);
updateFirewallUidRuleLocked(chain, uid, FIREWALL_RULE_DEFAULT);
}
// Copy the keys for the firewall rules chain, which is guaranteed not to include
// default rules. We must not include default rules in the UIDs we send to
// ConnectivityManager#replaceFirewallChain, as this would have the opposite effect
// intended, leading such UIDs to be blocked or allowed erroneously.
applicableUidsForChain = uidFirewallRules.copyKeys();
}
final ConnectivityManager cm = mContext.getSystemService(ConnectivityManager.class);
try {
cm.replaceFirewallChain(chain, uids);
cm.replaceFirewallChain(chain, applicableUidsForChain);
} catch (RuntimeException e) {
Slog.w(TAG, "Error flushing firewall chain " + chain, e);
}