Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Remove NetdService usage from IpSecService"

Browse Source
This commit is contained in:
Aaron Huang
2021-12-16 12:32:41 +00:00
committed by Gerrit Code Review
parent 55f030225b 7d17a103c8
commit da5df1a9d8
1 changed files with 78 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

194
packages/ConnectivityT/service/src/com/android/server/IpSecService.java
View File

@@ -45,7 +45,6 @@ import android.net.LinkAddress;
import android.net.LinkProperties; import android.net.LinkProperties;
import android.net.Network; import android.net.Network;
import android.net.TrafficStats; import android.net.TrafficStats;
import android.net.util.NetdService;
import android.os.Binder; import android.os.Binder;
import android.os.IBinder; import android.os.IBinder;
import android.os.ParcelFileDescriptor; import android.os.ParcelFileDescriptor;
@@ -96,8 +95,6 @@ import java.util.Objects;
public class IpSecService extends IIpSecService.Stub { public class IpSecService extends IIpSecService.Stub {
private static final String TAG = "IpSecService"; private static final String TAG = "IpSecService";
private static final boolean DBG = Log.isLoggable(TAG, Log.DEBUG); private static final boolean DBG = Log.isLoggable(TAG, Log.DEBUG);
private static final String NETD_SERVICE_NAME = "netd";
private static final int[] ADDRESS_FAMILIES = private static final int[] ADDRESS_FAMILIES =
new int[] {OsConstants.AF_INET, OsConstants.AF_INET6}; new int[] {OsConstants.AF_INET, OsConstants.AF_INET6};
@@ -106,6 +103,8 @@ public class IpSecService extends IIpSecService.Stub {
@VisibleForTesting static final int MAX_PORT_BIND_ATTEMPTS = 10; @VisibleForTesting static final int MAX_PORT_BIND_ATTEMPTS = 10;
private final INetd mNetd;
static { static {
try { try {
INADDR_ANY = InetAddress.getByAddress(new byte[] {0, 0, 0, 0}); INADDR_ANY = InetAddress.getByAddress(new byte[] {0, 0, 0, 0});
@@ -627,16 +626,14 @@ public class IpSecService extends IIpSecService.Stub {
public void freeUnderlyingResources() { public void freeUnderlyingResources() {
int spi = mSpi.getSpi(); int spi = mSpi.getSpi();
try { try {
mDeps mNetd.ipSecDeleteSecurityAssociation(
.getNetdInstance(mContext) mUid,
.ipSecDeleteSecurityAssociation( mConfig.getSourceAddress(),
mUid, mConfig.getDestinationAddress(),
mConfig.getSourceAddress(), spi,
mConfig.getDestinationAddress(), mConfig.getMarkValue(),
spi, mConfig.getMarkMask(),
mConfig.getMarkValue(), mConfig.getXfrmInterfaceId());
mConfig.getMarkMask(),
mConfig.getXfrmInterfaceId());
} catch (RemoteException | ServiceSpecificException e) { } catch (RemoteException | ServiceSpecificException e) {
Log.e(TAG, "Failed to delete SA with ID: " + mResourceId, e); Log.e(TAG, "Failed to delete SA with ID: " + mResourceId, e);
} }
@@ -680,14 +677,12 @@ public class IpSecService extends IIpSecService.Stub {
private final String mSourceAddress; private final String mSourceAddress;
private final String mDestinationAddress; private final String mDestinationAddress;
private int mSpi; private int mSpi;
private final Context mContext;
private boolean mOwnedByTransform = false; private boolean mOwnedByTransform = false;
SpiRecord(Context context, int resourceId, String sourceAddress, SpiRecord(int resourceId, String sourceAddress,
String destinationAddress, int spi) { String destinationAddress, int spi) {
super(resourceId); super(resourceId);
mContext = context;
mSourceAddress = sourceAddress; mSourceAddress = sourceAddress;
mDestinationAddress = destinationAddress; mDestinationAddress = destinationAddress;
mSpi = spi; mSpi = spi;
@@ -698,11 +693,9 @@ public class IpSecService extends IIpSecService.Stub {
public void freeUnderlyingResources() { public void freeUnderlyingResources() {
try { try {
if (!mOwnedByTransform) { if (!mOwnedByTransform) {
mDeps mNetd.ipSecDeleteSecurityAssociation(
.getNetdInstance(mContext) mUid, mSourceAddress, mDestinationAddress, mSpi, 0 /* mark */,
.ipSecDeleteSecurityAssociation( 0 /* mask */, 0 /* if_id */);
mUid, mSourceAddress, mDestinationAddress, mSpi, 0 /* mark */,
0 /* mask */, 0 /* if_id */);
} }
} catch (ServiceSpecificException | RemoteException e) { } catch (ServiceSpecificException | RemoteException e) {
Log.e(TAG, "Failed to delete SPI reservation with ID: " + mResourceId, e); Log.e(TAG, "Failed to delete SPI reservation with ID: " + mResourceId, e);
@@ -821,10 +814,8 @@ public class IpSecService extends IIpSecService.Stub {
private final int mIfId; private final int mIfId;
private Network mUnderlyingNetwork; private Network mUnderlyingNetwork;
private final Context mContext;
TunnelInterfaceRecord( TunnelInterfaceRecord(
Context context,
int resourceId, int resourceId,
String interfaceName, String interfaceName,
Network underlyingNetwork, Network underlyingNetwork,
@@ -835,7 +826,6 @@ public class IpSecService extends IIpSecService.Stub {
int intfId) { int intfId) {
super(resourceId); super(resourceId);
mContext = context;
mInterfaceName = interfaceName; mInterfaceName = interfaceName;
mUnderlyingNetwork = underlyingNetwork; mUnderlyingNetwork = underlyingNetwork;
mLocalAddress = localAddr; mLocalAddress = localAddr;
@@ -852,18 +842,17 @@ public class IpSecService extends IIpSecService.Stub {
// Teardown VTI // Teardown VTI
// Delete global policies // Delete global policies
try { try {
final INetd netd = mDeps.getNetdInstance(mContext); mNetd.ipSecRemoveTunnelInterface(mInterfaceName);
netd.ipSecRemoveTunnelInterface(mInterfaceName);
for (int selAddrFamily : ADDRESS_FAMILIES) { for (int selAddrFamily : ADDRESS_FAMILIES) {
netd.ipSecDeleteSecurityPolicy( mNetd.ipSecDeleteSecurityPolicy(
mUid, mUid,
selAddrFamily, selAddrFamily,
IpSecManager.DIRECTION_OUT, IpSecManager.DIRECTION_OUT,
mOkey, mOkey,
0xffffffff, 0xffffffff,
mIfId); mIfId);
netd.ipSecDeleteSecurityPolicy( mNetd.ipSecDeleteSecurityPolicy(
mUid, mUid,
selAddrFamily, selAddrFamily,
IpSecManager.DIRECTION_IN, IpSecManager.DIRECTION_IN,
@@ -1026,7 +1015,6 @@ public class IpSecService extends IIpSecService.Stub {
static IpSecService create(Context context) static IpSecService create(Context context)
throws InterruptedException { throws InterruptedException {
final IpSecService service = new IpSecService(context); final IpSecService service = new IpSecService(context);
service.connectNativeNetdService();
return service; return service;
} }
@@ -1057,8 +1045,13 @@ public class IpSecService extends IIpSecService.Stub {
@VisibleForTesting @VisibleForTesting
public IpSecService(Context context, Dependencies deps, UidFdTagger uidFdTagger) { public IpSecService(Context context, Dependencies deps, UidFdTagger uidFdTagger) {
mContext = context; mContext = context;
mDeps = deps; mDeps = Objects.requireNonNull(deps, "Missing dependencies.");
mUidFdTagger = uidFdTagger; mUidFdTagger = uidFdTagger;
try {
mNetd = mDeps.getNetdInstance(mContext);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
} }
/** Called by system server when system is ready. */ /** Called by system server when system is ready. */
@@ -1070,25 +1063,12 @@ public class IpSecService extends IIpSecService.Stub {
} }
} }
private void connectNativeNetdService() {
// Avoid blocking the system server to do this
new Thread() {
@Override
public void run() {
synchronized (IpSecService.this) {
NetdService.get(NETD_FETCH_TIMEOUT_MS);
}
}
}.start();
}
synchronized boolean isNetdAlive() { synchronized boolean isNetdAlive() {
try { try {
final INetd netd = mDeps.getNetdInstance(mContext); if (mNetd == null) {
if (netd == null) {
return false; return false;
} }
return netd.isAlive(); return mNetd.isAlive();
} catch (RemoteException re) { } catch (RemoteException re) {
return false; return false;
} }
@@ -1149,15 +1129,12 @@ public class IpSecService extends IIpSecService.Stub {
IpSecManager.Status.RESOURCE_UNAVAILABLE, INVALID_RESOURCE_ID, spi); IpSecManager.Status.RESOURCE_UNAVAILABLE, INVALID_RESOURCE_ID, spi);
} }
spi = spi = mNetd.ipSecAllocateSpi(callingUid, "", destinationAddress, requestedSpi);
mDeps
.getNetdInstance(mContext)
.ipSecAllocateSpi(callingUid, "", destinationAddress, requestedSpi);
Log.d(TAG, "Allocated SPI " + spi); Log.d(TAG, "Allocated SPI " + spi);
userRecord.mSpiRecords.put( userRecord.mSpiRecords.put(
resourceId, resourceId,
new RefcountedResource<SpiRecord>( new RefcountedResource<SpiRecord>(
new SpiRecord(mContext, resourceId, "", new SpiRecord(resourceId, "",
destinationAddress, spi), binder)); destinationAddress, spi), binder));
} catch (ServiceSpecificException e) { } catch (ServiceSpecificException e) {
if (e.errorCode == OsConstants.ENOENT) { if (e.errorCode == OsConstants.ENOENT) {
@@ -1275,8 +1252,7 @@ public class IpSecService extends IIpSecService.Stub {
OsConstants.UDP_ENCAP, OsConstants.UDP_ENCAP,
OsConstants.UDP_ENCAP_ESPINUDP); OsConstants.UDP_ENCAP_ESPINUDP);
mDeps.getNetdInstance(mContext).ipSecSetEncapSocketOwner( mNetd.ipSecSetEncapSocketOwner(new ParcelFileDescriptor(sockFd), callingUid);
new ParcelFileDescriptor(sockFd), callingUid);
if (port != 0) { if (port != 0) {
Log.v(TAG, "Binding to port " + port); Log.v(TAG, "Binding to port " + port);
Os.bind(sockFd, INADDR_ANY, port); Os.bind(sockFd, INADDR_ANY, port);
@@ -1338,16 +1314,15 @@ public class IpSecService extends IIpSecService.Stub {
// Create VTI // Create VTI
// Add inbound/outbound global policies // Add inbound/outbound global policies
// (use reqid = 0) // (use reqid = 0)
final INetd netd = mDeps.getNetdInstance(mContext); mNetd.ipSecAddTunnelInterface(intfName, localAddr, remoteAddr, ikey, okey, resourceId);
netd.ipSecAddTunnelInterface(intfName, localAddr, remoteAddr, ikey, okey, resourceId);
BinderUtils.withCleanCallingIdentity(() -> { BinderUtils.withCleanCallingIdentity(() -> {
NetdUtils.setInterfaceUp(netd, intfName); NetdUtils.setInterfaceUp(mNetd, intfName);
}); });
for (int selAddrFamily : ADDRESS_FAMILIES) { for (int selAddrFamily : ADDRESS_FAMILIES) {
// Always send down correct local/remote addresses for template. // Always send down correct local/remote addresses for template.
netd.ipSecAddSecurityPolicy( mNetd.ipSecAddSecurityPolicy(
callerUid, callerUid,
selAddrFamily, selAddrFamily,
IpSecManager.DIRECTION_OUT, IpSecManager.DIRECTION_OUT,
@@ -1357,7 +1332,7 @@ public class IpSecService extends IIpSecService.Stub {
okey, okey,
0xffffffff, 0xffffffff,
resourceId); resourceId);
netd.ipSecAddSecurityPolicy( mNetd.ipSecAddSecurityPolicy(
callerUid, callerUid,
selAddrFamily, selAddrFamily,
IpSecManager.DIRECTION_IN, IpSecManager.DIRECTION_IN,
@@ -1377,7 +1352,7 @@ public class IpSecService extends IIpSecService.Stub {
// //
// This is necessary only on the tunnel interface, and not any the interface to // This is necessary only on the tunnel interface, and not any the interface to
// which traffic will be forwarded to. // which traffic will be forwarded to.
netd.ipSecAddSecurityPolicy( mNetd.ipSecAddSecurityPolicy(
callerUid, callerUid,
selAddrFamily, selAddrFamily,
IpSecManager.DIRECTION_FWD, IpSecManager.DIRECTION_FWD,
@@ -1393,7 +1368,6 @@ public class IpSecService extends IIpSecService.Stub {
resourceId, resourceId,
new RefcountedResource<TunnelInterfaceRecord>( new RefcountedResource<TunnelInterfaceRecord>(
new TunnelInterfaceRecord( new TunnelInterfaceRecord(
mContext,
resourceId, resourceId,
intfName, intfName,
underlyingNetwork, underlyingNetwork,
@@ -1435,12 +1409,10 @@ public class IpSecService extends IIpSecService.Stub {
try { try {
// We can assume general validity of the IP address, since we get them as a // We can assume general validity of the IP address, since we get them as a
// LinkAddress, which does some validation. // LinkAddress, which does some validation.
mDeps mNetd.interfaceAddAddress(
.getNetdInstance(mContext) tunnelInterfaceInfo.mInterfaceName,
.interfaceAddAddress( localAddr.getAddress().getHostAddress(),
tunnelInterfaceInfo.mInterfaceName, localAddr.getPrefixLength());
localAddr.getAddress().getHostAddress(),
localAddr.getPrefixLength());
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
} }
@@ -1464,9 +1436,7 @@ public class IpSecService extends IIpSecService.Stub {
try { try {
// We can assume general validity of the IP address, since we get them as a // We can assume general validity of the IP address, since we get them as a
// LinkAddress, which does some validation. // LinkAddress, which does some validation.
mDeps mNetd.interfaceDelAddress(
.getNetdInstance(mContext)
.interfaceDelAddress(
tunnelInterfaceInfo.mInterfaceName, tunnelInterfaceInfo.mInterfaceName,
localAddr.getAddress().getHostAddress(), localAddr.getAddress().getHostAddress(),
localAddr.getPrefixLength()); localAddr.getPrefixLength());
@@ -1679,30 +1649,28 @@ public class IpSecService extends IIpSecService.Stub {
cryptName = crypt.getName(); cryptName = crypt.getName();
} }
mDeps mNetd.ipSecAddSecurityAssociation(
.getNetdInstance(mContext) Binder.getCallingUid(),
.ipSecAddSecurityAssociation( c.getMode(),
Binder.getCallingUid(), c.getSourceAddress(),
c.getMode(), c.getDestinationAddress(),
c.getSourceAddress(), (c.getNetwork() != null) ? c.getNetwork().getNetId() : 0,
c.getDestinationAddress(), spiRecord.getSpi(),
(c.getNetwork() != null) ? c.getNetwork().getNetId() : 0, c.getMarkValue(),
spiRecord.getSpi(), c.getMarkMask(),
c.getMarkValue(), (auth != null) ? auth.getName() : "",
c.getMarkMask(), (auth != null) ? auth.getKey() : new byte[] {},
(auth != null) ? auth.getName() : "", (auth != null) ? auth.getTruncationLengthBits() : 0,
(auth != null) ? auth.getKey() : new byte[] {}, cryptName,
(auth != null) ? auth.getTruncationLengthBits() : 0, (crypt != null) ? crypt.getKey() : new byte[] {},
cryptName, (crypt != null) ? crypt.getTruncationLengthBits() : 0,
(crypt != null) ? crypt.getKey() : new byte[] {}, (authCrypt != null) ? authCrypt.getName() : "",
(crypt != null) ? crypt.getTruncationLengthBits() : 0, (authCrypt != null) ? authCrypt.getKey() : new byte[] {},
(authCrypt != null) ? authCrypt.getName() : "", (authCrypt != null) ? authCrypt.getTruncationLengthBits() : 0,
(authCrypt != null) ? authCrypt.getKey() : new byte[] {}, encapType,
(authCrypt != null) ? authCrypt.getTruncationLengthBits() : 0, encapLocalPort,
encapType, encapRemotePort,
encapLocalPort, c.getXfrmInterfaceId());
encapRemotePort,
c.getXfrmInterfaceId());
} }
/** /**
@@ -1791,15 +1759,13 @@ public class IpSecService extends IIpSecService.Stub {
c.getMode() == IpSecTransform.MODE_TRANSPORT, c.getMode() == IpSecTransform.MODE_TRANSPORT,
"Transform mode was not Transport mode; cannot be applied to a socket"); "Transform mode was not Transport mode; cannot be applied to a socket");
mDeps mNetd.ipSecApplyTransportModeTransform(
.getNetdInstance(mContext) socket,
.ipSecApplyTransportModeTransform( callingUid,
socket, direction,
callingUid, c.getSourceAddress(),
direction, c.getDestinationAddress(),
c.getSourceAddress(), info.getSpiRecord().getSpi());
c.getDestinationAddress(),
info.getSpiRecord().getSpi());
} }
/** /**
@@ -1811,9 +1777,7 @@ public class IpSecService extends IIpSecService.Stub {
@Override @Override
public synchronized void removeTransportModeTransforms(ParcelFileDescriptor socket) public synchronized void removeTransportModeTransforms(ParcelFileDescriptor socket)
throws RemoteException { throws RemoteException {
mDeps mNetd.ipSecRemoveTransportModeTransform(socket);
.getNetdInstance(mContext)
.ipSecRemoveTransportModeTransform(socket);
} }
/** /**
@@ -1888,18 +1852,16 @@ public class IpSecService extends IIpSecService.Stub {
// Always update the policy with the relevant XFRM_IF_ID // Always update the policy with the relevant XFRM_IF_ID
for (int selAddrFamily : ADDRESS_FAMILIES) { for (int selAddrFamily : ADDRESS_FAMILIES) {
mDeps mNetd.ipSecUpdateSecurityPolicy(
.getNetdInstance(mContext) callingUid,
.ipSecUpdateSecurityPolicy( selAddrFamily,
callingUid, direction,
selAddrFamily, transformInfo.getConfig().getSourceAddress(),
direction, transformInfo.getConfig().getDestinationAddress(),
transformInfo.getConfig().getSourceAddress(), spi, // If outbound, also add SPI to the policy.
transformInfo.getConfig().getDestinationAddress(), mark, // Must always set policy mark; ikey/okey for VTIs
spi, // If outbound, also add SPI to the policy. 0xffffffff,
mark, // Must always set policy mark; ikey/okey for VTIs c.getXfrmInterfaceId());
0xffffffff,
c.getXfrmInterfaceId());
} }
// Update SA with tunnel mark (ikey or okey based on direction) // Update SA with tunnel mark (ikey or okey based on direction)