joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Add firewall chains for HAPPY_BOX and user/admin PENALTY_BOX

Browse source 
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.

However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.

This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.

Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
This commit is contained in:
Motomu Utsumi 2024-04-02 18:29:08 +09:00
commit 11d3345daa
1 changed files with 300 additions and 307 deletions
Download patch file Download diff file Expand all files Collapse all files

48
service/src/com/android/server/ConnectivityService.java
View file

@ -24,6 +24,8 @@ import static android.content.pm.PackageManager.FEATURE_WATCH;
import static android.content.pm.PackageManager.FEATURE_WIFI;
import static android.content.pm.PackageManager.FEATURE_WIFI_DIRECT;
import static android.content.pm.PackageManager.PERMISSION_GRANTED;
import static android.net.BpfNetMapsConstants.METERED_ALLOW_CHAINS;
import static android.net.BpfNetMapsConstants.METERED_DENY_CHAINS;
import static android.net.ConnectivityDiagnosticsManager.ConnectivityReport.KEY_NETWORK_PROBES_ATTEMPTED_BITMASK;
import static android.net.ConnectivityDiagnosticsManager.ConnectivityReport.KEY_NETWORK_PROBES_SUCCEEDED_BITMASK;
import static android.net.ConnectivityDiagnosticsManager.ConnectivityReport.KEY_NETWORK_VALIDATION_RESULT;
@ -13474,36 +13476,6 @@ public class ConnectivityService extends IConnectivityManager.Stub
}
}
@Override
public void updateMeteredNetworkAllowList(final int uid, final boolean add) {
enforceNetworkStackOrSettingsPermission();
try {
if (add) {
mBpfNetMaps.addNiceApp(uid);
} else {
mBpfNetMaps.removeNiceApp(uid);
}
} catch (ServiceSpecificException e) {
throw new IllegalStateException(e);
}
}
@Override
public void updateMeteredNetworkDenyList(final int uid, final boolean add) {
enforceNetworkStackOrSettingsPermission();
try {
if (add) {
mBpfNetMaps.addNaughtyApp(uid);
} else {
mBpfNetMaps.removeNaughtyApp(uid);
}
} catch (ServiceSpecificException e) {
throw new IllegalStateException(e);
}
}
private int setPackageFirewallRule(final int chain, final String packageName, final int rule)
throws PackageManager.NameNotFoundException {
final PackageManager pm = mContext.getPackageManager();
@ -13563,6 +13535,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
case ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_1:
case ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_2:
case ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_3:
case ConnectivityManager.FIREWALL_CHAIN_METERED_DENY_USER:
case ConnectivityManager.FIREWALL_CHAIN_METERED_DENY_ADMIN:
defaultRule = FIREWALL_RULE_ALLOW;
break;
case ConnectivityManager.FIREWALL_CHAIN_DOZABLE:
@ -13570,6 +13544,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
case ConnectivityManager.FIREWALL_CHAIN_RESTRICTED:
case ConnectivityManager.FIREWALL_CHAIN_LOW_POWER_STANDBY:
case ConnectivityManager.FIREWALL_CHAIN_BACKGROUND:
case ConnectivityManager.FIREWALL_CHAIN_METERED_ALLOW:
defaultRule = FIREWALL_RULE_DENY;
break;
default:
@ -13606,6 +13581,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
+ " the feature is disabled.");
return;
}
if (METERED_ALLOW_CHAINS.contains(chain) || METERED_DENY_CHAINS.contains(chain)) {
// Metered chains are used from a separate bpf program that is triggered by iptables
// and can not be controlled by setFirewallChainEnabled.
throw new UnsupportedOperationException(
"Chain (" + chain + ") can not be controlled by setFirewallChainEnabled");
}
try {
mBpfNetMaps.setChildChain(chain, enable);
@ -13626,6 +13607,13 @@ public class ConnectivityService extends IConnectivityManager.Stub
public boolean getFirewallChainEnabled(final int chain) {
enforceNetworkStackOrSettingsPermission();
if (METERED_ALLOW_CHAINS.contains(chain) || METERED_DENY_CHAINS.contains(chain)) {
// Metered chains are used from a separate bpf program that is triggered by iptables
// and can not be controlled by setFirewallChainEnabled.
throw new UnsupportedOperationException(
"getFirewallChainEnabled can not return status of chain (" + chain + ")");
}
return mBpfNetMaps.isChainEnabled(chain);
}