Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Address API review comments for VPN changes."

Browse Source
This commit is contained in:
Lorenzo Colitti
2019-03-19 02:16:58 +00:00
committed by Gerrit Code Review
parent abe16aff07 50d17cfa07
commit bbfee2b427
3 changed files with 34 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/current.txt
View File

@@ -6451,7 +6451,7 @@ package android.app.admin {
method @Nullable public String[] getAccountTypesWithManagementDisabled();
method @Nullable public java.util.List<android.content.ComponentName> getActiveAdmins();
method @NonNull public java.util.Set<java.lang.String> getAffiliationIds(@NonNull android.content.ComponentName);
method @Nullable public java.util.List<java.lang.String> getAlwaysOnVpnLockdownWhitelist(@NonNull android.content.ComponentName);
method @Nullable public java.util.Set<java.lang.String> getAlwaysOnVpnLockdownWhitelist(@NonNull android.content.ComponentName);
method @Nullable public String getAlwaysOnVpnPackage(@NonNull android.content.ComponentName);
method @WorkerThread @NonNull public android.os.Bundle getApplicationRestrictions(@Nullable android.content.ComponentName, String);
method @Deprecated @Nullable public String getApplicationRestrictionsManagingPackage(@NonNull android.content.ComponentName);
@@ -6559,7 +6559,7 @@ package android.app.admin {
method public void setAccountManagementDisabled(@NonNull android.content.ComponentName, String, boolean);
method public void setAffiliationIds(@NonNull android.content.ComponentName, @NonNull java.util.Set<java.lang.String>);
method public void setAlwaysOnVpnPackage(@NonNull android.content.ComponentName, @Nullable String, boolean) throws android.content.pm.PackageManager.NameNotFoundException;
method public void setAlwaysOnVpnPackage(@NonNull android.content.ComponentName, @Nullable String, boolean, @Nullable java.util.List<java.lang.String>) throws android.content.pm.PackageManager.NameNotFoundException;
method public void setAlwaysOnVpnPackage(@NonNull android.content.ComponentName, @Nullable String, boolean, @Nullable java.util.Set<java.lang.String>) throws android.content.pm.PackageManager.NameNotFoundException;
method public boolean setApplicationHidden(@NonNull android.content.ComponentName, String, boolean);
method @WorkerThread public void setApplicationRestrictions(@Nullable android.content.ComponentName, String, android.os.Bundle);
method @Deprecated public void setApplicationRestrictionsManagingPackage(@NonNull android.content.ComponentName, @Nullable String) throws android.content.pm.PackageManager.NameNotFoundException;

29
core/java/android/app/admin/DevicePolicyManager.java
View File

@@ -104,6 +104,7 @@ import java.security.spec.PKCS8EncodedKeySpec;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.concurrent.Executor;
@@ -4488,7 +4489,8 @@ public class DevicePolicyManager {
* </ul>
* The call will fail if called with the package name of an unsupported VPN app.
* <p> Enabling lockdown via {@code lockdownEnabled} argument carries the risk that any failure
* of the VPN provider could break networking for all apps.
* of the VPN provider could break networking for all apps. This method clears any lockdown
* whitelist set by {@link #setAlwaysOnVpnPackage(ComponentName, String, boolean, Set)}.
*
* @param vpnPackage The package name for an installed VPN app on the device, or {@code null} to
* remove an existing always-on VPN configuration.
@@ -4498,11 +4500,11 @@ public class DevicePolicyManager {
* @throws NameNotFoundException if {@code vpnPackage} is not installed.
* @throws UnsupportedOperationException if {@code vpnPackage} exists but does not support being
* set as always-on, or if always-on VPN is not available.
* @see #setAlwaysOnVpnPackage(ComponentName, String, boolean, List)
* @see #setAlwaysOnVpnPackage(ComponentName, String, boolean, Set)
*/
public void setAlwaysOnVpnPackage(@NonNull ComponentName admin, @Nullable String vpnPackage,
boolean lockdownEnabled) throws NameNotFoundException {
setAlwaysOnVpnPackage(admin, vpnPackage, lockdownEnabled, Collections.emptyList());
setAlwaysOnVpnPackage(admin, vpnPackage, lockdownEnabled, Collections.emptySet());
}
/**
@@ -4512,6 +4514,11 @@ public class DevicePolicyManager {
* System apps can always bypass VPN.
* <p> Note that the system doesn't update the whitelist when packages are installed or
* uninstalled, the admin app must call this method to keep the list up to date.
* <p> When {@code lockdownEnabled} is false {@code lockdownWhitelist} is ignored . When
* {@code lockdownEnabled} is {@code true} and {@code lockdownWhitelist} is {@code null} or
* empty, only system apps can bypass VPN.
* <p> Setting always-on VPN package to {@code null} or using
* {@link #setAlwaysOnVpnPackage(ComponentName, String, boolean)} clears lockdown whitelist.
*
* @param vpnPackage package name for an installed VPN app on the device, or {@code null}
* to remove an existing always-on VPN configuration
@@ -4528,13 +4535,13 @@ public class DevicePolicyManager {
* available.
*/
public void setAlwaysOnVpnPackage(@NonNull ComponentName admin, @Nullable String vpnPackage,
boolean lockdownEnabled, @Nullable List<String> lockdownWhitelist)
boolean lockdownEnabled, @Nullable Set<String> lockdownWhitelist)
throws NameNotFoundException {
throwIfParentInstance("setAlwaysOnVpnPackage");
if (mService != null) {
try {
mService.setAlwaysOnVpnPackage(
admin, vpnPackage, lockdownEnabled, lockdownWhitelist);
mService.setAlwaysOnVpnPackage(admin, vpnPackage, lockdownEnabled,
lockdownWhitelist == null ? null : new ArrayList<>(lockdownWhitelist));
} catch (ServiceSpecificException e) {
switch (e.errorCode) {
case ERROR_VPN_PACKAGE_NOT_FOUND:
@@ -4572,7 +4579,7 @@ public class DevicePolicyManager {
}
/**
* Called by device or profile owner to query the list of packages that are allowed to access
* Called by device or profile owner to query the set of packages that are allowed to access
* the network directly when always-on VPN is in lockdown mode but not connected. Returns
* {@code null} when always-on VPN is not active or not in lockdown mode.
*
@@ -4580,13 +4587,15 @@ public class DevicePolicyManager {
*
* @throws SecurityException if {@code admin} is not a device or a profile owner.
*
* @see #setAlwaysOnVpnPackage(ComponentName, String, boolean, List)
* @see #setAlwaysOnVpnPackage(ComponentName, String, boolean, Set)
*/
public @Nullable List<String> getAlwaysOnVpnLockdownWhitelist(@NonNull ComponentName admin) {
public @Nullable Set<String> getAlwaysOnVpnLockdownWhitelist(@NonNull ComponentName admin) {
throwIfParentInstance("getAlwaysOnVpnLockdownWhitelist");
if (mService != null) {
try {
return mService.getAlwaysOnVpnLockdownWhitelist(admin);
final List<String> whitelist =
mService.getAlwaysOnVpnLockdownWhitelist(admin);
return whitelist == null ? null : new HashSet<>(whitelist);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}

17
core/java/android/net/VpnService.java
View File

@@ -27,6 +27,8 @@ import android.annotation.UnsupportedAppUsage;
import android.app.Activity;
import android.app.PendingIntent;
import android.app.Service;
import android.app.admin.DevicePolicyManager;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.pm.IPackageManager;
@@ -48,6 +50,7 @@ import java.net.InetAddress;
import java.net.Socket;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
/**
* VpnService is a base class for applications to extend and build their
@@ -138,7 +141,7 @@ public class VpnService extends Service {
* provides users with the ability to set it as always-on, so that VPN connection is
* persisted after device reboot and app upgrade. Always-on VPN can also be enabled by device
* owner and profile owner apps through
* {@link android.app.admin.DevicePolicyManager#setAlwaysOnVpnPackage}.
* {@link DevicePolicyManager#setAlwaysOnVpnPackage}.
*
* <p>VPN apps not supporting this feature should opt out by adding this meta-data field to the
* {@code VpnService} component of {@code AndroidManifest.xml}. In case there is more than one
@@ -370,7 +373,10 @@ public class VpnService extends Service {
}
/**
* Returns whether the service is running in always-on VPN mode.
* Returns whether the service is running in always-on VPN mode. In this mode the system ensures
* that the service is always running by restarting it when necessary, e.g. after reboot.
*
* @see DevicePolicyManager#setAlwaysOnVpnPackage(ComponentName, String, boolean, Set)
*/
public final boolean isAlwaysOn() {
try {
@@ -381,8 +387,11 @@ public class VpnService extends Service {
}
/**
* Returns whether the service is running in always-on VPN mode blocking connections without
* VPN.
* Returns whether the service is running in always-on VPN lockdown mode. In this mode the
* system ensures that the service is always running and that the apps aren't allowed to bypass
* the VPN.
*
* @see DevicePolicyManager#setAlwaysOnVpnPackage(ComponentName, String, boolean, Set)
*/
public final boolean isLockdownEnabled() {
try {