Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix: Firewall: NMS inverts default rule behavior" am: 627b64593d

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2439712

Change-Id: I65ccc01b795fa53a51d211fabd2ea4063b0807d4
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Sudheer Shanka
2023-03-13 20:03:27 +00:00
committed by Automerger Merge Worker
parent 832afca2df 627b64593d
commit 93da655f63
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/core/java/com/android/server/NetworkManagementService.java
View File

@@ -1483,6 +1483,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
public void setFirewallUidRules(int chain, int[] uids, int[] rules) { public void setFirewallUidRules(int chain, int[] uids, int[] rules) {
enforceSystemUid(); enforceSystemUid();
synchronized (mQuotaLock) { synchronized (mQuotaLock) {
final int[] applicableUidsForChain;
synchronized (mRulesLock) { synchronized (mRulesLock) {
SparseIntArray uidFirewallRules = getUidFirewallRulesLR(chain); SparseIntArray uidFirewallRules = getUidFirewallRulesLR(chain);
SparseIntArray newRules = new SparseIntArray(); SparseIntArray newRules = new SparseIntArray();
@@ -1506,10 +1507,15 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
int uid = rulesToRemove.keyAt(index); int uid = rulesToRemove.keyAt(index);
updateFirewallUidRuleLocked(chain, uid, FIREWALL_RULE_DEFAULT); updateFirewallUidRuleLocked(chain, uid, FIREWALL_RULE_DEFAULT);
} }
// Copy the keys for the firewall rules chain, which is guaranteed not to include
// default rules. We must not include default rules in the UIDs we send to
// ConnectivityManager#replaceFirewallChain, as this would have the opposite effect
// intended, leading such UIDs to be blocked or allowed erroneously.
applicableUidsForChain = uidFirewallRules.copyKeys();
} }
final ConnectivityManager cm = mContext.getSystemService(ConnectivityManager.class); final ConnectivityManager cm = mContext.getSystemService(ConnectivityManager.class);
try { try {
cm.replaceFirewallChain(chain, uids); cm.replaceFirewallChain(chain, applicableUidsForChain);
} catch (RuntimeException e) { } catch (RuntimeException e) {
Slog.w(TAG, "Error flushing firewall chain " + chain, e); Slog.w(TAG, "Error flushing firewall chain " + chain, e);
} }