joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Revert "Always drop non-VPN ingress in lockdown mode"

Browse source 
This reverts commit 19f95c26ad.

Reason for revert: Conflicts with BP4A.

Change-Id: I9900859136d643bafce00e85c818714bc4e139ef
This commit is contained in:
Michael Bestas 2025-12-09 06:39:07 +02:00
commit f7f117c4b2
No known key found for this signature in database
2 changed files with 5 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

31
service/src/com/android/server/ConnectivityService.java
View file

@ -8207,10 +8207,6 @@ public class ConnectivityService extends IConnectivityManager.Stub
final boolean curMetered = nai.networkCapabilities.isMetered();
maybeNotifyNetworkBlocked(nai, curMetered, curMetered,
mVpnBlockedUidRanges, newVpnBlockedUidRanges);
if (nai.isVPN()) {
updateVpnFiltering(nai.linkProperties, nai.linkProperties, nai, true /* force */);
}
});
mVpnBlockedUidRanges = newVpnBlockedUidRanges;
@ -10374,16 +10370,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
// the LinkProperties for the network are accurate.
networkAgent.clatd.fixupLinkProperties(oldLp, newLp);
final boolean anyIfaceChanges =
updateInterfaces(newLp, oldLp, netId, networkAgent);
// If any interface names changed, ensure VPN filtering is updated so that ingress filtering
// uses the most up-to-date allowed interface.
final boolean shouldForceUpdateVpnFiltering = networkAgent.isVPN() && anyIfaceChanges;
updateInterfaces(newLp, oldLp, netId, networkAgent);
// update filtering rules, need to happen after the interface update so netd knows about the
// new interface (the interface name -> index map becomes initialized)
updateVpnFiltering(newLp, oldLp, networkAgent, shouldForceUpdateVpnFiltering);
updateVpnFiltering(newLp, oldLp, networkAgent);
updateIngressToVpnAddressFiltering(newLp, oldLp, networkAgent);
@ -10628,8 +10619,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
}
}
/** Return whether there were any added or removed interface names. */
private boolean updateInterfaces(final @NonNull LinkProperties newLp,
private void updateInterfaces(final @NonNull LinkProperties newLp,
final @Nullable LinkProperties oldLp, final int netId,
final @NonNull NetworkAgentInfo nai) {
final CompareResult<String> interfaceDiff = new CompareResult<>(
@ -10663,7 +10653,6 @@ public class ConnectivityService extends IConnectivityManager.Stub
loge("Exception removing interface: " + e);
}
}
return !(interfaceDiff.added.isEmpty() && interfaceDiff.removed.isEmpty());
}
/**
@ -10952,7 +10941,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
}
private void updateVpnFiltering(@NonNull LinkProperties newLp, @Nullable LinkProperties oldLp,
@NonNull NetworkAgentInfo nai, boolean force) {
@NonNull NetworkAgentInfo nai) {
final String oldIface = getVpnIsolationInterface(nai, nai.networkCapabilities, oldLp);
final String newIface = getVpnIsolationInterface(nai, nai.networkCapabilities, newLp);
final boolean wasFiltering = requiresVpnAllowRule(nai, oldLp, oldIface);
@ -10963,7 +10952,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
return;
}
if (!force && Objects.equals(oldIface, newIface) && (wasFiltering == needsFiltering)) {
if (Objects.equals(oldIface, newIface) && (wasFiltering == needsFiltering)) {
// Nothing changed.
return;
}
@ -10980,13 +10969,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
// old rules are being removed.
if (wasFiltering) {
mPermissionMonitor.onVpnUidRangesRemoved(oldIface, ranges, vpnAppUid);
mPermissionMonitor.updateVpnLockdownUidInterfaceRules(oldLp.getInterfaceName(), ranges,
vpnAppUid, false /* add */);
}
if (needsFiltering) {
mPermissionMonitor.onVpnUidRangesAdded(newIface, ranges, vpnAppUid);
mPermissionMonitor.updateVpnLockdownUidInterfaceRules(newLp.getInterfaceName(), ranges,
vpnAppUid, true /* add */);
}
}
@ -11731,15 +11716,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
if (wasFiltering && !prevRanges.isEmpty()) {
mPermissionMonitor.onVpnUidRangesRemoved(oldIface, prevRanges,
prevNc.getOwnerUid());
mPermissionMonitor.updateVpnLockdownUidInterfaceRules(
nai.linkProperties.getInterfaceName(), prevRanges, prevNc.getOwnerUid(),
false /* add */);
}
if (shouldFilter && !newRanges.isEmpty()) {
mPermissionMonitor.onVpnUidRangesAdded(newIface, newRanges, newNc.getOwnerUid());
mPermissionMonitor.updateVpnLockdownUidInterfaceRules(
nai.linkProperties.getInterfaceName(), newRanges, newNc.getOwnerUid(),
true /* add */);
}
} catch (Exception e) {
// Never crash!

35
service/src/com/android/server/connectivity/PermissionMonitor.java
View file

@ -1062,7 +1062,6 @@ public class PermissionMonitor {
// packets to that UID is fine.
final Set<Integer> changedUids = intersectUids(rangesToAdd, mAllApps);
removeBypassingUids(changedUids, vpnAppUid);
removeVpnLockdownUids(iface, changedUids);
updateVpnUidsInterfaceRules(iface, changedUids, true /* add */);
if (mVpnInterfaceUidRanges.containsKey(iface)) {
mVpnInterfaceUidRanges.get(iface).addAll(rangesToAdd);
@ -1085,7 +1084,6 @@ public class PermissionMonitor {
// ranges and update Netd about them.
final Set<Integer> changedUids = intersectUids(rangesToRemove, mAllApps);
removeBypassingUids(changedUids, vpnAppUid);
removeVpnLockdownUids(iface, changedUids);
updateVpnUidsInterfaceRules(iface, changedUids, false /* add */);
Set<UidRange> existingRanges = mVpnInterfaceUidRanges.getOrDefault(iface, null);
if (existingRanges == null) {
@ -1098,27 +1096,6 @@ public class PermissionMonitor {
}
}
/**
* Called when a set of UID ranges are added/removed from an active VPN network and when
* UID ranges under VPN Lockdown are updated
*
* @param iface The VPN network's interface name. Null iface indicates that the interface is not
* available.
* @param rangesToModify Existing UID ranges to be modified on the VPN network
* @param add {@code true} to add the UID rules, {@code false} to remove them.
* @param vpnAppUid The uid of the VPN app
*/
public synchronized void updateVpnLockdownUidInterfaceRules(@Nullable String iface,
Set<UidRange> rangesToModify, int vpnAppUid, boolean add) {
if (iface != null) {
Set<Integer> uidsToModify = intersectUids(rangesToModify, mAllApps);
removeBypassingUids(uidsToModify, vpnAppUid);
Set<Integer> vpnLockdownUids = intersectUids(mVpnLockdownUidRanges.getSet(), mAllApps);
uidsToModify.retainAll(vpnLockdownUids);
updateVpnUidsInterfaceRules(iface, uidsToModify, add);
}
}
/**
* Called when UID ranges under VPN Lockdown are updated
*
@ -1207,18 +1184,6 @@ public class PermissionMonitor {
uids.removeIf(this::hasRestrictedNetworksPermission);
}
/**
* Remove all apps which are under VPN Lockdown from the list of uids
*
* @param iface The interface name of the active VPN connection
* @param uids The list of uids to operate on
*/
private void removeVpnLockdownUids(@Nullable String iface, Set<Integer> uids) {
if (iface == null) {
uids.removeAll(intersectUids(mVpnLockdownUidRanges.getSet(), mAllApps));
}
}
/**
* Update netd about the list of uids that are under an active VPN connection which they cannot
* bypass.