joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Enforce restricted user, getConnectionOwnerUid checks

Browse source 
This CL adds checks to ensure restricted users cannot change or
start/stop platform VPNs. In addition, this also adds checks to the
ConnectivityManager#getConnectionOwnerUid() to ensure that only
VpnService based VPNs can identify connections

Bug: 148040659
Test: FrameworksNetTests run
Change-Id: Id47ada5766036bfc84f3ba47f66f2d2683af916d
This commit is contained in:
Benedict Wong 2020-01-20 22:14:59 -08:00
commit 0bd4bba07a
1 changed files with 187 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

18
core/java/android/net/ConnectivityManager.java
View file

@ -4716,19 +4716,19 @@ public class ConnectivityManager {
/**
* Returns the {@code uid} of the owner of a network connection.
*
* @param protocol The protocol of the connection. Only {@code IPPROTO_TCP} and
* {@code IPPROTO_UDP} currently supported.
* @param protocol The protocol of the connection. Only {@code IPPROTO_TCP} and {@code
* IPPROTO_UDP} currently supported.
* @param local The local {@link InetSocketAddress} of a connection.
* @param remote The remote {@link InetSocketAddress} of a connection.
*
* @return {@code uid} if the connection is found and the app has permission to observe it
* (e.g., if it is associated with the calling VPN app's tunnel) or
* {@link android.os.Process#INVALID_UID} if the connection is not found.
* Throws {@link SecurityException} if the caller is not the active VPN for the current user.
* Throws {@link IllegalArgumentException} if an unsupported protocol is requested.
* (e.g., if it is associated with the calling VPN app's VpnService tunnel) or {@link
* android.os.Process#INVALID_UID} if the connection is not found.
* @throws {@link SecurityException} if the caller is not the active VpnService for the current
* user.
* @throws {@link IllegalArgumentException} if an unsupported protocol is requested.
*/
public int getConnectionOwnerUid(int protocol, @NonNull InetSocketAddress local,
@NonNull InetSocketAddress remote) {
public int getConnectionOwnerUid(
int protocol, @NonNull InetSocketAddress local, @NonNull InetSocketAddress remote) {
ConnectionInfo connectionInfo = new ConnectionInfo(protocol, local, remote);
try {
return mService.getConnectionOwnerUid(connectionInfo);