From 97e690169779f9790aa8d6026fca6bdc3d61e1b3 Mon Sep 17 00:00:00 2001 From: Chalard Jean Date: Fri, 11 Apr 2025 14:56:35 +0900 Subject: [PATCH] Fix a bug where non-VPN networks would update VPN uids. Previously, non VPNs would not be created when updateVpnUids() is called inside handleRegisterNetworkAgent. Because the network is not created, netd would refuse to set the UIDs with an error. Now that networks are created immediately with the QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER flag, the network is created and netd does set the UID for any network as if they were a VPN. This results in the UID having the wrong default network, which in turns prevents it from accessing Internet. Test: new test in this patch Bug: 408717088 Flag: EXEMPT bugfix Change-Id: If68ea7d60919c0c7e177480f6167196381e00f35 --- .../android/server/ConnectivityService.java | 2 +- .../connectivityservice/CSNetworkAgentTest.kt | 92 +++++++++++++++++++ 2 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java index 4021a82eff..647455611c 100644 --- a/service/src/com/android/server/ConnectivityService.java +++ b/service/src/com/android/server/ConnectivityService.java @@ -9573,7 +9573,7 @@ public class ConnectivityService extends IConnectivityManager.Stub { nai.notifyRegistered(networkMonitor); NetworkInfo networkInfo = nai.networkInfo; updateNetworkInfo(nai, networkInfo); - updateVpnUids(nai, null, nai.networkCapabilities); + if (nai.isVPN()) updateVpnUids(nai, null, nai.networkCapabilities); nai.processEnqueuedMessages(mTrackerHandler::handleMessage); } diff --git a/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt new file mode 100644 index 0000000000..547a4cccf2 --- /dev/null +++ b/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt @@ -0,0 +1,92 @@ +/* + * Copyright (C) 2025 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.android.server + +import android.net.NativeNetworkConfig +import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN +import android.net.NetworkCapabilities.TRANSPORT_VPN +import android.net.NetworkCapabilities.TRANSPORT_WIFI +import android.net.VpnManager +import android.net.VpnTransportInfo +import android.net.netd.aidl.NativeUidRangeConfig +import android.os.Build +import android.os.Process +import android.util.Range +import com.android.testutils.ConnectivityModuleTest +import com.android.testutils.DevSdkIgnoreRule +import com.android.testutils.DevSdkIgnoreRunner +import org.junit.Test +import org.junit.runner.RunWith +import org.mockito.ArgumentMatchers.anyInt +import org.mockito.ArgumentMatchers.argThat +import org.mockito.Mockito.inOrder +import org.mockito.Mockito.never + +@DevSdkIgnoreRunner.MonitorThreadLeak +@RunWith(DevSdkIgnoreRunner::class) +@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S) +class CSNetworkAgentTest : CSTest() { + @Test fun testVpnUidAgent() = testUidAgent( + TRANSPORT_VPN, + expectAddUidRanges = true + ) + @ConnectivityModuleTest + @Test fun testWifiUidAgent() = testUidAgent(TRANSPORT_WIFI, expectAddUidRanges = false) + + fun testUidAgent(transport: Int, expectAddUidRanges: Boolean) { + val netdInOrder = inOrder(netd) + val uid = Process.myUid() + + val nc = defaultNc() + .addTransportType(transport) + .setUids(setOf(Range(uid, uid))) + if (TRANSPORT_VPN == transport) { + nc.removeCapability(NET_CAPABILITY_NOT_VPN) + nc.setTransportInfo( + VpnTransportInfo( + VpnManager.TYPE_VPN_SERVICE, + "MySession12345", + true /* bypassable */, + false /* longLivedTcpConnectionsExpensive */ + ) + ) + } + val agent = Agent(nc) + agent.connect() + + netdInOrder.verify(netd).networkCreate(argThat { it: NativeNetworkConfig -> + it.netId == agent.network.netId + }) + if (deps.isAtLeastU()) { + // The call to setNetworkAllowlist was added in U. + netdInOrder.verify(netd).setNetworkAllowlist(any()) + } + if (expectAddUidRanges) { + netdInOrder.verify(netd).networkAddUidRangesParcel(argThat { it: NativeUidRangeConfig -> + it.netId == agent.network.netId && + it.uidRanges.size == 1 && + it.uidRanges[0].start == uid && + it.uidRanges[0].stop == uid && + it.subPriority == 0 // VPN priority + }) + } else { + netdInOrder.verify(netd, never()).networkAddUidRangesParcel(any()) + } + // The old method should never be called in any case + netdInOrder.verify(netd, never()).networkAddUidRanges(anyInt(), any()) + } +}