Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Allow VPN apps to ask for running the validation checks"

Browse Source
This commit is contained in:
Jean Chalard
2022-02-09 06:03:45 +00:00
committed by Gerrit Code Review
parent b845dbac21 3fc98d5ebd
commit cbb2fa2f00
6 changed files with 98 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/api/current.txt
View File

@@ -25227,6 +25227,7 @@ package android.net {
method @NonNull public android.net.Ikev2VpnProfile.Builder setMaxMtu(int);
method @NonNull public android.net.Ikev2VpnProfile.Builder setMetered(boolean);
method @NonNull public android.net.Ikev2VpnProfile.Builder setProxy(@Nullable android.net.ProxyInfo);
method @NonNull public android.net.Ikev2VpnProfile.Builder setRequiresInternetValidation(boolean);
}
public final class IpSecAlgorithm implements android.os.Parcelable {
@@ -25370,6 +25371,7 @@ package android.net {
public abstract class PlatformVpnProfile {
method public final boolean getExcludeLocalRoutes();
method public final boolean getRequiresInternetValidation();
method public final int getType();
method @NonNull public final String getTypeString();
field public static final int TYPE_IKEV2_IPSEC_PSK = 7; // 0x7

47
core/java/android/net/Ikev2VpnProfile.java
View File

@@ -159,8 +159,9 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
boolean isMetered,
int maxMtu,
boolean restrictToTestNetworks,
boolean excludeLocalRoutes) {
super(type, excludeLocalRoutes);
boolean excludeLocalRoutes,
boolean requiresInternetValidation) {
super(type, excludeLocalRoutes, requiresInternetValidation);
checkNotNull(serverAddr, MISSING_PARAM_MSG_TMPL, "Server address");
checkNotNull(userIdentity, MISSING_PARAM_MSG_TMPL, "User Identity");
@@ -181,7 +182,7 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
mAllowedAlgorithms = Collections.unmodifiableList(new ArrayList<>(allowedAlgorithms));
if (excludeLocalRoutes && !isBypassable) {
throw new IllegalArgumentException(
"Vpn should be byassable if excludeLocalRoutes is set");
"Vpn must be bypassable if excludeLocalRoutes is set");
}
mIsBypassable = isBypassable;
@@ -238,7 +239,7 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
* that provides Authentication, and one that provides Encryption. Authenticated Encryption with
* Associated Data (AEAD) algorithms are counted as providing Authentication and Encryption.
*
* @param allowedAlgorithms The list to be validated
* @param algorithmNames The list to be validated
*/
private static void validateAllowedAlgorithms(@NonNull List<String> algorithmNames) {
// First, make sure no insecure algorithms were proposed.
@@ -400,7 +401,9 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
mIsBypassable,
mIsMetered,
mMaxMtu,
mIsRestrictedToTestNetworks);
mIsRestrictedToTestNetworks,
mExcludeLocalRoutes,
mRequiresInternetValidation);
}
@Override
@@ -425,7 +428,8 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
&& mIsMetered == other.mIsMetered
&& mMaxMtu == other.mMaxMtu
&& mIsRestrictedToTestNetworks == other.mIsRestrictedToTestNetworks
&& mExcludeLocalRoutes == other.mExcludeLocalRoutes;
&& mExcludeLocalRoutes == other.mExcludeLocalRoutes
&& mRequiresInternetValidation == other.mRequiresInternetValidation;
}
/**
@@ -439,7 +443,7 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
@NonNull
public VpnProfile toVpnProfile() throws IOException, GeneralSecurityException {
final VpnProfile profile = new VpnProfile("" /* Key; value unused by IKEv2VpnProfile(s) */,
mIsRestrictedToTestNetworks, mExcludeLocalRoutes);
mIsRestrictedToTestNetworks, mExcludeLocalRoutes, mRequiresInternetValidation);
profile.type = mType;
profile.server = mServerAddr;
profile.ipsecIdentifier = mUserIdentity;
@@ -544,6 +548,7 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
Log.w(TAG, "ExcludeLocalRoutes should only be set in the bypassable VPN");
}
builder.setExcludeLocalRoutes(profile.excludeLocalRoutes && profile.isBypassable);
builder.setRequiresInternetValidation(profile.requiresInternetValidation);
return builder.build();
}
@@ -776,6 +781,7 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
@Nullable private ProxyInfo mProxyInfo;
@NonNull private List<String> mAllowedAlgorithms = DEFAULT_ALGORITHMS;
private boolean mRequiresInternetValidation = false;
private boolean mIsBypassable = false;
private boolean mIsMetered = true;
private int mMaxMtu = PlatformVpnProfile.MAX_MTU_DEFAULT;
@@ -987,6 +993,30 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
return this;
}
/**
* Request that this VPN undergoes Internet validation.
*
* If this is true, the platform will perform basic validation checks for Internet
* connectivity over this VPN. If and when they succeed, the VPN network capabilities will
* reflect this by gaining the {@link NetworkCapabilities#NET_CAPABILITY_VALIDATED}
* capability.
*
* If this is false, the platform assumes the VPN either is always capable of reaching the
* Internet or intends not to. In this case, the VPN network capabilities will
* always gain the {@link NetworkCapabilities#NET_CAPABILITY_VALIDATED} capability
* immediately after it connects, whether it can reach public Internet destinations or not.
*
* @param requiresInternetValidation {@code true} if the framework should attempt to
* validate this VPN for Internet connectivity. Defaults
* to {@code false}.
*/
@NonNull
@RequiresFeature(PackageManager.FEATURE_IPSEC_TUNNELS)
public Builder setRequiresInternetValidation(boolean requiresInternetValidation) {
mRequiresInternetValidation = requiresInternetValidation;
return this;
}
/**
* Marks the VPN network as metered.
*
@@ -1103,7 +1133,8 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
mIsMetered,
mMaxMtu,
mIsRestrictedToTestNetworks,
mExcludeLocalRoutes);
mExcludeLocalRoutes,
mRequiresInternetValidation);
}
}
}

30
core/java/android/net/PlatformVpnProfile.java
View File

@@ -16,10 +16,6 @@
package android.net;
import static android.net.PlatformVpnProfile.TYPE_IKEV2_IPSEC_PSK;
import static android.net.PlatformVpnProfile.TYPE_IKEV2_IPSEC_RSA;
import static android.net.PlatformVpnProfile.TYPE_IKEV2_IPSEC_USER_PASS;
import android.annotation.IntDef;
import android.annotation.NonNull;
@@ -67,11 +63,15 @@ public abstract class PlatformVpnProfile {
/** @hide */
protected final boolean mExcludeLocalRoutes;
/** @hide */
protected final boolean mRequiresInternetValidation;
/** @hide */
PlatformVpnProfile(@PlatformVpnType int type, boolean excludeLocalRoutes) {
PlatformVpnProfile(@PlatformVpnType int type, boolean excludeLocalRoutes,
boolean requiresValidation) {
mType = type;
mExcludeLocalRoutes = excludeLocalRoutes;
mRequiresInternetValidation = requiresValidation;
}
/** Returns the profile integer type. */
@@ -80,14 +80,30 @@ public abstract class PlatformVpnProfile {
return mType;
}
/**
* Returns if the local traffic is exempted from the VPN.
* Returns whether the local traffic is exempted from the VPN.
*/
public final boolean getExcludeLocalRoutes() {
return mExcludeLocalRoutes;
}
/**
* Returns whether this VPN should undergo Internet validation.
*
* If this is true, the platform will perform basic validation checks for Internet
* connectivity over this VPN. If and when they succeed, the VPN network capabilities will
* reflect this by gaining the {@link NetworkCapabilities#NET_CAPABILITY_VALIDATED}
* capability.
*
* If this is false, the platform assumes the VPN either is always capable of reaching the
* Internet or intends not to. In this case, the VPN network capabilities will
* always gain the {@link NetworkCapabilities#NET_CAPABILITY_VALIDATED} capability
* immediately after it connects, whether it can reach public Internet destinations or not.
*/
public final boolean getRequiresInternetValidation() {
return mRequiresInternetValidation;
}
/** Returns a type string describing the VPN profile type */
@NonNull
public final String getTypeString() {

6
core/java/com/android/internal/net/VpnConfig.java
View File

@@ -105,6 +105,7 @@ public class VpnConfig implements Parcelable {
public boolean allowIPv4;
public boolean allowIPv6;
public boolean isMetered = true;
public boolean requiresInternetValidation = false;
public Network[] underlyingNetworks;
public ProxyInfo proxyInfo;
@@ -131,6 +132,7 @@ public class VpnConfig implements Parcelable {
allowIPv4 = other.allowIPv4;
allowIPv6 = other.allowIPv6;
isMetered = other.isMetered;
requiresInternetValidation = other.requiresInternetValidation;
underlyingNetworks = other.underlyingNetworks != null ? Arrays.copyOf(
other.underlyingNetworks, other.underlyingNetworks.length) : null;
proxyInfo = other.proxyInfo;
@@ -189,6 +191,7 @@ public class VpnConfig implements Parcelable {
out.writeInt(allowIPv4 ? 1 : 0);
out.writeInt(allowIPv6 ? 1 : 0);
out.writeInt(isMetered ? 1 : 0);
out.writeInt(requiresInternetValidation ? 1 : 0);
out.writeTypedArray(underlyingNetworks, flags);
out.writeParcelable(proxyInfo, flags);
}
@@ -216,6 +219,7 @@ public class VpnConfig implements Parcelable {
config.allowIPv4 = in.readInt() != 0;
config.allowIPv6 = in.readInt() != 0;
config.isMetered = in.readInt() != 0;
config.requiresInternetValidation = in.readInt() != 0;
config.underlyingNetworks = in.createTypedArray(Network.CREATOR);
config.proxyInfo = in.readParcelable(null);
return config;
@@ -248,6 +252,8 @@ public class VpnConfig implements Parcelable {
.append(", allowBypass=").append(allowBypass)
.append(", allowIPv4=").append(allowIPv4)
.append(", allowIPv6=").append(allowIPv6)
.append(", isMetered=").append(isMetered)
.append(", requiresInternetValidation").append(requiresInternetValidation)
.append(", underlyingNetworks=").append(Arrays.toString(underlyingNetworks))
.append(", proxyInfo=").append(proxyInfo)
.append("}")

36
core/java/com/android/internal/net/VpnProfile.java
View File

@@ -144,23 +144,26 @@ public final class VpnProfile implements Cloneable, Parcelable {
public final boolean isRestrictedToTestNetworks; // 24
public final boolean excludeLocalRoutes; // 25
public final boolean requiresInternetValidation; // 26
// Helper fields.
@UnsupportedAppUsage
public transient boolean saveLogin = false;
public VpnProfile(String key) {
this(key, false, false);
this(key, false, false, false);
}
public VpnProfile(String key, boolean isRestrictedToTestNetworks) {
this(key, isRestrictedToTestNetworks, false);
this(key, isRestrictedToTestNetworks, false, false);
}
public VpnProfile(String key, boolean isRestrictedToTestNetworks, boolean excludeLocalRoutes) {
public VpnProfile(String key, boolean isRestrictedToTestNetworks, boolean excludeLocalRoutes,
boolean requiresInternetValidation) {
this.key = key;
this.isRestrictedToTestNetworks = isRestrictedToTestNetworks;
this.excludeLocalRoutes = excludeLocalRoutes;
this.requiresInternetValidation = requiresInternetValidation;
}
@UnsupportedAppUsage
@@ -191,6 +194,7 @@ public final class VpnProfile implements Cloneable, Parcelable {
areAuthParamsInline = in.readBoolean();
isRestrictedToTestNetworks = in.readBoolean();
excludeLocalRoutes = in.readBoolean();
requiresInternetValidation = in.readBoolean();
}
/**
@@ -239,6 +243,7 @@ public final class VpnProfile implements Cloneable, Parcelable {
out.writeBoolean(areAuthParamsInline);
out.writeBoolean(isRestrictedToTestNetworks);
out.writeBoolean(excludeLocalRoutes);
out.writeBoolean(requiresInternetValidation);
}
/**
@@ -258,9 +263,11 @@ public final class VpnProfile implements Cloneable, Parcelable {
// 14-19: Standard profile, with option for serverCert, proxy
// 24: Standard profile with serverCert, proxy and platform-VPN parameters
// 25: Standard profile with platform-VPN parameters and isRestrictedToTestNetworks
// 26: Standard profile with platform-VPN parameters and excludeLocalRoutes
if ((values.length < 14 || values.length > 19)
&& values.length != 24 && values.length != 25 && values.length != 26) {
// 26: ...and excludeLocalRoutes
// (26 can only be found on dogfood devices)
// 27: ...and requiresInternetValidation
if ((values.length < 14 || (values.length > 19 && values.length < 24)
|| values.length > 27)) {
return null;
}
@@ -278,8 +285,15 @@ public final class VpnProfile implements Cloneable, Parcelable {
excludeLocalRoutes = false;
}
final boolean requiresInternetValidation;
if (values.length >= 27) {
requiresInternetValidation = Boolean.parseBoolean(values[26]);
} else {
requiresInternetValidation = false;
}
VpnProfile profile = new VpnProfile(key, isRestrictedToTestNetworks,
excludeLocalRoutes);
excludeLocalRoutes, requiresInternetValidation);
profile.name = values[0];
profile.type = Integer.parseInt(values[1]);
if (profile.type < 0 || profile.type > TYPE_MAX) {
@@ -390,6 +404,7 @@ public final class VpnProfile implements Cloneable, Parcelable {
builder.append(VALUE_DELIMITER).append(isRestrictedToTestNetworks);
builder.append(VALUE_DELIMITER).append(excludeLocalRoutes);
builder.append(VALUE_DELIMITER).append(requiresInternetValidation);
return builder.toString().getBytes(StandardCharsets.UTF_8);
}
@@ -471,7 +486,7 @@ public final class VpnProfile implements Cloneable, Parcelable {
key, type, server, username, password, dnsServers, searchDomains, routes, mppe,
l2tpSecret, ipsecIdentifier, ipsecSecret, ipsecUserCert, ipsecCaCert, ipsecServerCert,
proxy, mAllowedAlgorithms, isBypassable, isMetered, maxMtu, areAuthParamsInline,
isRestrictedToTestNetworks, excludeLocalRoutes);
isRestrictedToTestNetworks, excludeLocalRoutes, requiresInternetValidation);
}
/** Checks VPN profiles for interior equality. */
@@ -505,11 +520,12 @@ public final class VpnProfile implements Cloneable, Parcelable {
&& maxMtu == other.maxMtu
&& areAuthParamsInline == other.areAuthParamsInline
&& isRestrictedToTestNetworks == other.isRestrictedToTestNetworks
&& excludeLocalRoutes == other.excludeLocalRoutes;
&& excludeLocalRoutes == other.excludeLocalRoutes
&& requiresInternetValidation == other.requiresInternetValidation;
}
@NonNull
public static final Creator<VpnProfile> CREATOR = new Creator<VpnProfile>() {
public static final Creator<VpnProfile> CREATOR = new Creator<>() {
@Override
public VpnProfile createFromParcel(Parcel in) {
return new VpnProfile(in);

2
services/core/java/com/android/server/connectivity/Vpn.java
View File

@@ -1304,6 +1304,7 @@ public class Vpn {
.setLegacyType(ConnectivityManager.TYPE_VPN)
.setLegacyTypeName("VPN")
.setBypassableVpn(mConfig.allowBypass && !mLockdown)
.setVpnRequiresValidation(mConfig.requiresInternetValidation)
.build();
capsBuilder.setOwnerUid(mOwnerUID);
@@ -3368,6 +3369,7 @@ public class Vpn {
}
mConfig.startTime = SystemClock.elapsedRealtime();
mConfig.proxyInfo = profile.proxy;
mConfig.requiresInternetValidation = profile.requiresInternetValidation;
switch (profile.type) {
case VpnProfile.TYPE_IKEV2_IPSEC_USER_PASS: