joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Treat new OEM VPN types like the corresponding non-OEM types.

Browse source 
Bug: 389829981
Test: new CTS tests
Change-Id: I9455a1e00db6fdca3706e83e26daa60db6c73d09
This commit is contained in:
Lorenzo Colitti 2025-03-18 13:13:45 +09:00
commit fd89cf529a
1 changed files with 63 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

29
service/src/com/android/server/ConnectivityService.java
View file

@ -7482,7 +7482,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
private boolean isLegacyLockdownNai(NetworkAgentInfo nai) {
return mLockdownEnabled
&& getVpnType(nai) == VpnManager.TYPE_VPN_LEGACY
&& isLegacyVpn(nai)
&& nai.networkCapabilities.appliesToUid(Process.FIRST_APPLICATION_UID);
}
@ -10116,8 +10116,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
* interfaces.
* Ingress discard rule is added to the address iff
* 1. The address is not a link local address
* 2. The address is used by a single interface of VPN whose VPN type is not TYPE_VPN_LEGACY
* or TYPE_VPN_OEM and the address is not used by any other interfaces even non-VPN ones
* 2. The address is used by a single interface of VPN whose VPN type is not LEGACY, OEM or
* OEM_LEGACY and the address is not used by any other interfaces even non-VPN ones
* Ingress discard rule is not be added to TYPE_VPN_LEGACY or TYPE_VPN_OEM VPN since these VPNs
* might need to receive packet to VPN address via non-VPN interface.
* This method can be called during network disconnects, when nai has already been removed from
@ -10155,9 +10155,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
final Set<Pair<InetAddress, String>> ingressDiscardRules = new ArraySet<>();
for (final NetworkAgentInfo agent : nais) {
final int vpnType = getVpnType(agent);
if (!agent.isVPN() || agent.isDestroyed()
|| vpnType == VpnManager.TYPE_VPN_LEGACY
|| vpnType == VpnManager.TYPE_VPN_OEM) {
if (!agent.isVPN() || agent.isDestroyed() || !vpnSupportsInterfaceFiltering(agent)) {
continue;
}
final LinkProperties agentLp = (nai == agent) ? lp : agent.linkProperties;
@ -12800,6 +12798,23 @@ public class ConnectivityService extends IConnectivityManager.Stub {
return ((VpnTransportInfo) ti).getType();
}
private boolean isVpnServiceVpn(NetworkAgentInfo nai) {
final int vpnType = getVpnType(nai);
return vpnType == VpnManager.TYPE_VPN_SERVICE || vpnType == VpnManager.TYPE_VPN_OEM_SERVICE;
}
private boolean isLegacyVpn(NetworkAgentInfo nai) {
final int vpnType = getVpnType(nai);
return vpnType == VpnManager.TYPE_VPN_LEGACY || vpnType == VpnManager.TYPE_VPN_OEM_LEGACY;
}
private boolean vpnSupportsInterfaceFiltering(NetworkAgentInfo vpn) {
final int vpnType = getVpnType(vpn);
return vpnType != VpnManager.TYPE_VPN_LEGACY
&& vpnType != VpnManager.TYPE_VPN_OEM
&& vpnType != VpnManager.TYPE_VPN_OEM_LEGACY;
}
private void maybeUpdateWifiRoamTimestamp(@NonNull NetworkAgentInfo nai,
@NonNull NetworkCapabilities nc) {
final TransportInfo prevInfo = nai.networkCapabilities.getTransportInfo();
@ -12833,7 +12848,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
if (hasNetworkStackPermission()) return uid;
final NetworkAgentInfo vpn = getVpnForUid(uid);
if (vpn == null || getVpnType(vpn) != VpnManager.TYPE_VPN_SERVICE
if (vpn == null || !isVpnServiceVpn(vpn)
|| vpn.networkCapabilities.getOwnerUid() != mDeps.getCallingUid()) {
return INVALID_UID;
}