joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Add deny firewall chain for OEM

Browse source 
Bug: 207773349
Bug: 208371987
Test: atest
CtsNetTestCases:android.net.cts.ConnectivityManagerTest#testFirewallBlocking
--iterations 50 && atest ConnectivityServiceTest --iterations 10

Change-Id: I60d5540821abcced03356f366775f16ee369d7f9
This commit is contained in:
Motomu Utsumi 2022-06-01 13:57:27 +00:00
commit d980149817
1 changed files with 276 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
service/src/com/android/server/ConnectivityService.java
View file

@ -11359,6 +11359,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
final int defaultRule;
switch (chain) {
case ConnectivityManager.FIREWALL_CHAIN_STANDBY:
case ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_1:
case ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_2:
defaultRule = FIREWALL_RULE_ALLOW;
break;
case ConnectivityManager.FIREWALL_CHAIN_DOZABLE:
@ -11408,6 +11410,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
mBpfNetMaps.replaceUidChain("fw_low_power_standby", true /* isAllowList */,
uids);
break;
case ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_1:
mBpfNetMaps.replaceUidChain("fw_oem_deny_1", false /* isAllowList */, uids);
break;
case ConnectivityManager.FIREWALL_CHAIN_OEM_DENY_2:
mBpfNetMaps.replaceUidChain("fw_oem_deny_2", false /* isAllowList */, uids);
break;
default:
throw new IllegalArgumentException("replaceFirewallChain with invalid chain: "
+ chain);