From 8cd33ed84e94036a5e1201485af7603dc6fb0d9b Mon Sep 17 00:00:00 2001 From: Sreeram Ramachandran Date: Wed, 23 Jul 2014 15:23:15 -0700 Subject: [PATCH] Implement support for bypassable VPNs. Bypassable VPNs grab all traffic by default (just like secure VPNs), but: + They allow all apps to choose other networks using the multinetwork APIs. If these other networks are insecure ("untrusted"), they will enforce that the app holds the necessary permissions, such as CHANGE_NETWORK_STATE. + They support consistent routing. If an app has an existing connection over some other network when the bypassable VPN comes up, it's not interrupted. Bug: 15347374 Change-Id: Iaee9c6f6fa8103215738570d2b65d3fcf10343f3 --- .../java/android/net/ConnectivityManager.java | 4 +- .../android/net/IConnectivityManager.aidl | 3 +- core/java/android/net/NetworkAgent.java | 7 ++- core/java/android/net/NetworkMisc.aidl | 19 +++++++ core/java/android/net/NetworkMisc.java | 57 +++++++++++++++++++ core/java/android/net/VpnService.java | 2 +- .../android/os/INetworkManagementService.aidl | 2 +- .../com/android/internal/net/VpnConfig.java | 3 + .../android/server/ConnectivityService.java | 10 +++- .../server/NetworkManagementService.java | 5 +- .../server/connectivity/NetworkAgentInfo.java | 7 ++- .../com/android/server/connectivity/Vpn.java | 7 ++- 12 files changed, 112 insertions(+), 14 deletions(-) create mode 100644 core/java/android/net/NetworkMisc.aidl create mode 100644 core/java/android/net/NetworkMisc.java diff --git a/core/java/android/net/ConnectivityManager.java b/core/java/android/net/ConnectivityManager.java index 0df4d45a85aeb..30be4da5191fd 100644 --- a/core/java/android/net/ConnectivityManager.java +++ b/core/java/android/net/ConnectivityManager.java @@ -2068,9 +2068,9 @@ public class ConnectivityManager { /** {@hide} */ public void registerNetworkAgent(Messenger messenger, NetworkInfo ni, LinkProperties lp, - NetworkCapabilities nc, int score) { + NetworkCapabilities nc, int score, NetworkMisc misc) { try { - mService.registerNetworkAgent(messenger, ni, lp, nc, score); + mService.registerNetworkAgent(messenger, ni, lp, nc, score, misc); } catch (RemoteException e) { } } diff --git a/core/java/android/net/IConnectivityManager.aidl b/core/java/android/net/IConnectivityManager.aidl index 8b12fb84273a2..35f1305f56e9e 100644 --- a/core/java/android/net/IConnectivityManager.aidl +++ b/core/java/android/net/IConnectivityManager.aidl @@ -22,6 +22,7 @@ import android.net.LinkProperties; import android.net.Network; import android.net.NetworkCapabilities; import android.net.NetworkInfo; +import android.net.NetworkMisc; import android.net.NetworkQuotaInfo; import android.net.NetworkRequest; import android.net.NetworkState; @@ -150,7 +151,7 @@ interface IConnectivityManager void unregisterNetworkFactory(in Messenger messenger); void registerNetworkAgent(in Messenger messenger, in NetworkInfo ni, in LinkProperties lp, - in NetworkCapabilities nc, int score); + in NetworkCapabilities nc, int score, in NetworkMisc misc); NetworkRequest requestNetwork(in NetworkCapabilities networkCapabilities, in Messenger messenger, int timeoutSec, in IBinder binder, int legacy); diff --git a/core/java/android/net/NetworkAgent.java b/core/java/android/net/NetworkAgent.java index 41eab021ee67a..a365af0f4796a 100644 --- a/core/java/android/net/NetworkAgent.java +++ b/core/java/android/net/NetworkAgent.java @@ -108,6 +108,11 @@ public abstract class NetworkAgent extends Handler { public NetworkAgent(Looper looper, Context context, String logTag, NetworkInfo ni, NetworkCapabilities nc, LinkProperties lp, int score) { + this(looper, context, logTag, ni, nc, lp, score, null); + } + + public NetworkAgent(Looper looper, Context context, String logTag, NetworkInfo ni, + NetworkCapabilities nc, LinkProperties lp, int score, NetworkMisc misc) { super(looper); LOG_TAG = logTag; mContext = context; @@ -119,7 +124,7 @@ public abstract class NetworkAgent extends Handler { ConnectivityManager cm = (ConnectivityManager)mContext.getSystemService( Context.CONNECTIVITY_SERVICE); cm.registerNetworkAgent(new Messenger(this), new NetworkInfo(ni), - new LinkProperties(lp), new NetworkCapabilities(nc), score); + new LinkProperties(lp), new NetworkCapabilities(nc), score, misc); } @Override diff --git a/core/java/android/net/NetworkMisc.aidl b/core/java/android/net/NetworkMisc.aidl new file mode 100644 index 0000000000000..c65583fb530a1 --- /dev/null +++ b/core/java/android/net/NetworkMisc.aidl @@ -0,0 +1,19 @@ +/* + * Copyright (C) 2014 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.net; + +parcelable NetworkMisc; diff --git a/core/java/android/net/NetworkMisc.java b/core/java/android/net/NetworkMisc.java new file mode 100644 index 0000000000000..34f6cf45638bf --- /dev/null +++ b/core/java/android/net/NetworkMisc.java @@ -0,0 +1,57 @@ +/* + * Copyright (C) 2014 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.net; + +import android.os.Parcel; +import android.os.Parcelable; + +/** + * A grab-bag of information (metadata, policies, properties, etc) about a {@link Network}. + * + * @hide + */ +public class NetworkMisc implements Parcelable { + /** + * If the {@link Network} is a VPN, whether apps are allowed to bypass the VPN. This is set by + * a {@link VpnService} and used by {@link ConnectivityService} when creating a VPN. + */ + public boolean allowBypass; + + @Override + public int describeContents() { + return 0; + } + + @Override + public void writeToParcel(Parcel out, int flags) { + out.writeInt(allowBypass ? 1 : 0); + } + + public static final Creator CREATOR = new Creator() { + @Override + public NetworkMisc createFromParcel(Parcel in) { + NetworkMisc networkMisc = new NetworkMisc(); + networkMisc.allowBypass = in.readInt() != 0; + return networkMisc; + } + + @Override + public NetworkMisc[] newArray(int size) { + return new NetworkMisc[size]; + } + }; +} diff --git a/core/java/android/net/VpnService.java b/core/java/android/net/VpnService.java index 3fd415fc9f6a1..4b07e3fa3b915 100644 --- a/core/java/android/net/VpnService.java +++ b/core/java/android/net/VpnService.java @@ -563,7 +563,7 @@ public class VpnService extends Service { * @return this {@link Builder} object to facilitate chaining of method calls. */ public Builder allowBypass() { - // TODO + mConfig.allowBypass = true; return this; } diff --git a/core/java/android/os/INetworkManagementService.aidl b/core/java/android/os/INetworkManagementService.aidl index c1e6664f54874..c467d4ad7bc08 100644 --- a/core/java/android/os/INetworkManagementService.aidl +++ b/core/java/android/os/INetworkManagementService.aidl @@ -367,7 +367,7 @@ interface INetworkManagementService /** * Setup a new VPN. */ - void createVirtualNetwork(int netId, boolean hasDNS); + void createVirtualNetwork(int netId, boolean hasDNS, boolean secure); /** * Remove a network. diff --git a/core/java/com/android/internal/net/VpnConfig.java b/core/java/com/android/internal/net/VpnConfig.java index c552a41cd447a..dac59f929fd52 100644 --- a/core/java/com/android/internal/net/VpnConfig.java +++ b/core/java/com/android/internal/net/VpnConfig.java @@ -74,6 +74,7 @@ public class VpnConfig implements Parcelable { public long startTime = -1; public boolean legacy; public boolean blocking; + public boolean allowBypass; public void addLegacyRoutes(String routesStr) { if (routesStr.trim().equals("")) { @@ -122,6 +123,7 @@ public class VpnConfig implements Parcelable { out.writeLong(startTime); out.writeInt(legacy ? 1 : 0); out.writeInt(blocking ? 1 : 0); + out.writeInt(allowBypass ? 1 : 0); } public static final Parcelable.Creator CREATOR = @@ -141,6 +143,7 @@ public class VpnConfig implements Parcelable { config.startTime = in.readLong(); config.legacy = in.readInt() != 0; config.blocking = in.readInt() != 0; + config.allowBypass = in.readInt() != 0; return config; } diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java index 36be58cf494c9..ec9243fea7bc5 100644 --- a/services/core/java/com/android/server/ConnectivityService.java +++ b/services/core/java/com/android/server/ConnectivityService.java @@ -74,6 +74,7 @@ import android.net.NetworkConfig; import android.net.NetworkInfo; import android.net.NetworkInfo.DetailedState; import android.net.NetworkFactory; +import android.net.NetworkMisc; import android.net.NetworkQuotaInfo; import android.net.NetworkRequest; import android.net.NetworkState; @@ -5259,12 +5260,13 @@ public class ConnectivityService extends IConnectivityManager.Stub { public void registerNetworkAgent(Messenger messenger, NetworkInfo networkInfo, LinkProperties linkProperties, NetworkCapabilities networkCapabilities, - int currentScore) { + int currentScore, NetworkMisc networkMisc) { enforceConnectivityInternalPermission(); NetworkAgentInfo nai = new NetworkAgentInfo(messenger, new AsyncChannel(), nextNetId(), new NetworkInfo(networkInfo), new LinkProperties(linkProperties), - new NetworkCapabilities(networkCapabilities), currentScore, mContext, mTrackerHandler); + new NetworkCapabilities(networkCapabilities), currentScore, mContext, mTrackerHandler, + networkMisc); if (VDBG) log("registerNetworkAgent " + nai); mHandler.sendMessage(mHandler.obtainMessage(EVENT_REGISTER_NETWORK_AGENT, nai)); } @@ -5665,7 +5667,9 @@ public class ConnectivityService extends IConnectivityManager.Stub { // to tell us whether we've already created this network or not. if (networkAgent.isVPN()) { mNetd.createVirtualNetwork(networkAgent.network.netId, - !networkAgent.linkProperties.getDnsServers().isEmpty()); + !networkAgent.linkProperties.getDnsServers().isEmpty(), + (networkAgent.networkMisc == null || + !networkAgent.networkMisc.allowBypass)); } else { mNetd.createPhysicalNetwork(networkAgent.network.netId); } diff --git a/services/core/java/com/android/server/NetworkManagementService.java b/services/core/java/com/android/server/NetworkManagementService.java index db423b02b7025..75a7878b99c4f 100644 --- a/services/core/java/com/android/server/NetworkManagementService.java +++ b/services/core/java/com/android/server/NetworkManagementService.java @@ -1947,11 +1947,12 @@ public class NetworkManagementService extends INetworkManagementService.Stub } @Override - public void createVirtualNetwork(int netId, boolean hasDNS) { + public void createVirtualNetwork(int netId, boolean hasDNS, boolean secure) { mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG); try { - mConnector.execute("network", "create", netId, "vpn", hasDNS ? "1" : "0"); + mConnector.execute("network", "create", netId, "vpn", hasDNS ? "1" : "0", + secure ? "1" : "0"); } catch (NativeDaemonConnectorException e) { throw e.rethrowAsParcelableException(); } diff --git a/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java b/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java index 10bdba060e809..403713d6d0f9e 100644 --- a/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java +++ b/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java @@ -21,6 +21,7 @@ import android.net.LinkProperties; import android.net.Network; import android.net.NetworkCapabilities; import android.net.NetworkInfo; +import android.net.NetworkMisc; import android.net.NetworkRequest; import android.os.Handler; import android.os.Messenger; @@ -44,6 +45,7 @@ public class NetworkAgentInfo { public NetworkCapabilities networkCapabilities; public int currentScore; public final NetworkMonitor networkMonitor; + public final NetworkMisc networkMisc; // The list of NetworkRequests being satisfied by this Network. public final SparseArray networkRequests = new SparseArray(); @@ -53,8 +55,8 @@ public class NetworkAgentInfo { public final AsyncChannel asyncChannel; public NetworkAgentInfo(Messenger messenger, AsyncChannel ac, int netId, NetworkInfo info, - LinkProperties lp, NetworkCapabilities nc, int score, Context context, - Handler handler) { + LinkProperties lp, NetworkCapabilities nc, int score, Context context, Handler handler, + NetworkMisc misc) { this.messenger = messenger; asyncChannel = ac; network = new Network(netId); @@ -63,6 +65,7 @@ public class NetworkAgentInfo { networkCapabilities = nc; currentScore = score; networkMonitor = new NetworkMonitor(context, handler, this); + networkMisc = misc; } public void addRequest(NetworkRequest networkRequest) { diff --git a/services/core/java/com/android/server/connectivity/Vpn.java b/services/core/java/com/android/server/connectivity/Vpn.java index 4b5a2cb0eb1a7..ba9a1837a9768 100644 --- a/services/core/java/com/android/server/connectivity/Vpn.java +++ b/services/core/java/com/android/server/connectivity/Vpn.java @@ -48,6 +48,7 @@ import android.net.NetworkAgent; import android.net.NetworkCapabilities; import android.net.NetworkInfo; import android.net.NetworkInfo.DetailedState; +import android.net.NetworkMisc; import android.net.NetworkUtils; import android.net.RouteInfo; import android.net.UidRange; @@ -331,10 +332,14 @@ public class Vpn { lp.setDomains(buffer.toString().trim()); mNetworkInfo.setIsAvailable(true); mNetworkInfo.setDetailedState(DetailedState.CONNECTED, null, null); + NetworkMisc networkMisc = new NetworkMisc(); + if (mConfig.allowBypass) { + networkMisc.allowBypass = true; + } long token = Binder.clearCallingIdentity(); try { mNetworkAgent = new NetworkAgent(mLooper, mContext, NETWORKTYPE, - mNetworkInfo, mNetworkCapabilities, lp, 0) { + mNetworkInfo, mNetworkCapabilities, lp, 0, networkMisc) { public void unwanted() { // We are user controlled, not driven by NetworkRequest. };