LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Whitelist packages from VPN lockdown.

Browse Source 
Bug: 77468593
Test: atest com.android.server.connectivity.VpnTest
Test: atest MixedDeviceOwnerTest#testAlwaysOnVpn
Test: MixedDeviceOwnerTest#testAlwaysOnVpnAcrossReboot
Change-Id: I7f6c5b9172063b588feacd6b9930a6cb88f764ab
This commit is contained in:
Pavel Grafov
2018-12-05 10:40:23 +00:00
parent 230fad7923
commit 58e8be00ee
4 changed files with 186 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
core/java/android/net/ConnectivityManager.java
View File

@@ -1007,14 +1007,20 @@ public class ConnectivityManager {
* to remove an existing always-on VPN configuration.
* @param lockdownEnabled {@code true} to disallow networking when the VPN is not connected or
* {@code false} otherwise.
* @param lockdownWhitelist The list of packages that are allowed to access network directly
* when VPN is in lockdown mode but is not running. Non-existent packages are ignored so
* this method must be called when a package that should be whitelisted is installed or
* uninstalled.
* @return {@code true} if the package is set as always-on VPN controller;
* {@code false} otherwise.
* @hide
*/
@RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)
public boolean setAlwaysOnVpnPackageForUser(int userId, @Nullable String vpnPackage,
boolean lockdownEnabled) {
boolean lockdownEnabled, @Nullable List<String> lockdownWhitelist) {
try {
return mService.setAlwaysOnVpnPackage(userId, vpnPackage, lockdownEnabled);
return mService.setAlwaysOnVpnPackage(
userId, vpnPackage, lockdownEnabled, lockdownWhitelist);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
@@ -1029,6 +1035,7 @@ public class ConnectivityManager {
* or {@code null} if none is set.
* @hide
*/
@RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)
public String getAlwaysOnVpnPackageForUser(int userId) {
try {
return mService.getAlwaysOnVpnPackage(userId);
@@ -1037,6 +1044,36 @@ public class ConnectivityManager {
}
}
/**
* @return whether always-on VPN is in lockdown mode.
*
* @hide
**/
@RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)
public boolean isVpnLockdownEnabled(int userId) {
try {
return mService.isVpnLockdownEnabled(userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
/**
* @return the list of packages that are allowed to access network when always-on VPN is in
* lockdown mode but not connected. Returns {@code null} when VPN lockdown is not active.
*
* @hide
**/
@RequiresPermission(android.Manifest.permission.CONTROL_ALWAYS_ON_VPN)
public List<String> getVpnLockdownWhitelist(int userId) {
try {
return mService.getVpnLockdownWhitelist(userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
/**
* Returns details about the currently active default data network
* for a given uid. This is for internal use only to avoid spying

5
core/java/android/net/IConnectivityManager.aidl
View File

@@ -125,8 +125,11 @@ interface IConnectivityManager
boolean updateLockdownVpn();
boolean isAlwaysOnVpnPackageSupported(int userId, String packageName);
boolean setAlwaysOnVpnPackage(int userId, String packageName, boolean lockdown);
boolean setAlwaysOnVpnPackage(int userId, String packageName, boolean lockdown,
in List<String> lockdownWhitelist);
String getAlwaysOnVpnPackage(int userId);
boolean isVpnLockdownEnabled(int userId);
List<String> getVpnLockdownWhitelist(int userId);
int checkMobileProvisioning(int suggestedTimeOutMs);