LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add AppOps Checks for MANAGE_IPSEC_TUNNELS

Browse Source 
Adds support for a new AppOp to permit services to
use IpSec tunnel mode. The IpSecService now needs
a context so change the service mode to a cached
service rather than a static service.

Bug: 66955045
Test: runtest frameworks-net
Change-Id: I17a4a286225b432c3e15ea1587d946189931b4f4
This commit is contained in:
Nathan Harold
2018-03-15 18:06:06 -07:00
parent 78452f1b8d
commit 65ef843176
4 changed files with 76 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
core/java/android/net/IIpSecService.aidl
View File

@@ -45,25 +45,31 @@ interface IIpSecService
in String localAddr, in String localAddr,
in String remoteAddr, in String remoteAddr,
in Network underlyingNetwork, in Network underlyingNetwork,
in IBinder binder); in IBinder binder,
in String callingPackage);
void addAddressToTunnelInterface( void addAddressToTunnelInterface(
int tunnelResourceId, int tunnelResourceId,
in LinkAddress localAddr); in LinkAddress localAddr,
in String callingPackage);
void removeAddressFromTunnelInterface( void removeAddressFromTunnelInterface(
int tunnelResourceId, int tunnelResourceId,
in LinkAddress localAddr); in LinkAddress localAddr,
in String callingPackage);
void deleteTunnelInterface(int resourceId); void deleteTunnelInterface(int resourceId, in String callingPackage);
IpSecTransformResponse createTransform(in IpSecConfig c, in IBinder binder); IpSecTransformResponse createTransform(
in IpSecConfig c, in IBinder binder, in String callingPackage);
void deleteTransform(int transformId); void deleteTransform(int transformId);
void applyTransportModeTransform(in ParcelFileDescriptor socket, int direction, int transformId); void applyTransportModeTransform(
in ParcelFileDescriptor socket, int direction, int transformId);
void applyTunnelModeTransform(int tunnelResourceId, int direction, int transformResourceId); void applyTunnelModeTransform(
int tunnelResourceId, int direction, int transformResourceId, in String callingPackage);
void removeTransportModeTransforms(in ParcelFileDescriptor socket); void removeTransportModeTransforms(in ParcelFileDescriptor socket);
} }

25
core/java/android/net/IpSecManager.java
View File

@@ -140,6 +140,7 @@ public final class IpSecManager {
} }
} }
private final Context mContext;
private final IIpSecService mService; private final IIpSecService mService;
/** /**
@@ -661,6 +662,7 @@ public final class IpSecManager {
*/ */
@SystemApi @SystemApi
public static final class IpSecTunnelInterface implements AutoCloseable { public static final class IpSecTunnelInterface implements AutoCloseable {
private final String mOpPackageName;
private final IIpSecService mService; private final IIpSecService mService;
private final InetAddress mRemoteAddress; private final InetAddress mRemoteAddress;
private final InetAddress mLocalAddress; private final InetAddress mLocalAddress;
@@ -688,7 +690,8 @@ public final class IpSecManager {
@RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS) @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS)
public void addAddress(@NonNull LinkAddress address) throws IOException { public void addAddress(@NonNull LinkAddress address) throws IOException {
try { try {
mService.addAddressToTunnelInterface(mResourceId, address); mService.addAddressToTunnelInterface(
mResourceId, address, mOpPackageName);
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
} }
@@ -706,16 +709,18 @@ public final class IpSecManager {
@RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS) @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS)
public void removeAddress(@NonNull LinkAddress address) throws IOException { public void removeAddress(@NonNull LinkAddress address) throws IOException {
try { try {
mService.removeAddressFromTunnelInterface(mResourceId, address); mService.removeAddressFromTunnelInterface(
mResourceId, address, mOpPackageName);
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
} }
} }
private IpSecTunnelInterface(@NonNull IIpSecService service, private IpSecTunnelInterface(@NonNull Context ctx, @NonNull IIpSecService service,
@NonNull InetAddress localAddress, @NonNull InetAddress remoteAddress, @NonNull InetAddress localAddress, @NonNull InetAddress remoteAddress,
@NonNull Network underlyingNetwork) @NonNull Network underlyingNetwork)
throws ResourceUnavailableException, IOException { throws ResourceUnavailableException, IOException {
mOpPackageName = ctx.getOpPackageName();
mService = service; mService = service;
mLocalAddress = localAddress; mLocalAddress = localAddress;
mRemoteAddress = remoteAddress; mRemoteAddress = remoteAddress;
@@ -727,7 +732,8 @@ public final class IpSecManager {
localAddress.getHostAddress(), localAddress.getHostAddress(),
remoteAddress.getHostAddress(), remoteAddress.getHostAddress(),
underlyingNetwork, underlyingNetwork,
new Binder()); new Binder(),
mOpPackageName);
switch (result.status) { switch (result.status) {
case Status.OK: case Status.OK:
break; break;
@@ -756,7 +762,7 @@ public final class IpSecManager {
@Override @Override
public void close() { public void close() {
try { try {
mService.deleteTunnelInterface(mResourceId); mService.deleteTunnelInterface(mResourceId, mOpPackageName);
mResourceId = INVALID_RESOURCE_ID; mResourceId = INVALID_RESOURCE_ID;
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
@@ -801,7 +807,8 @@ public final class IpSecManager {
public IpSecTunnelInterface createIpSecTunnelInterface(@NonNull InetAddress localAddress, public IpSecTunnelInterface createIpSecTunnelInterface(@NonNull InetAddress localAddress,
@NonNull InetAddress remoteAddress, @NonNull Network underlyingNetwork) @NonNull InetAddress remoteAddress, @NonNull Network underlyingNetwork)
throws ResourceUnavailableException, IOException { throws ResourceUnavailableException, IOException {
return new IpSecTunnelInterface(mService, localAddress, remoteAddress, underlyingNetwork); return new IpSecTunnelInterface(
mContext, mService, localAddress, remoteAddress, underlyingNetwork);
} }
/** /**
@@ -827,7 +834,8 @@ public final class IpSecManager {
@PolicyDirection int direction, @NonNull IpSecTransform transform) throws IOException { @PolicyDirection int direction, @NonNull IpSecTransform transform) throws IOException {
try { try {
mService.applyTunnelModeTransform( mService.applyTunnelModeTransform(
tunnel.getResourceId(), direction, transform.getResourceId()); tunnel.getResourceId(), direction,
transform.getResourceId(), mContext.getOpPackageName());
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
} }
@@ -839,7 +847,8 @@ public final class IpSecManager {
* @param context the application context for this manager * @param context the application context for this manager
* @hide * @hide
*/ */
public IpSecManager(IIpSecService service) { public IpSecManager(Context ctx, IIpSecService service) {
mContext = ctx;
mService = checkNotNull(service, "missing service"); mService = checkNotNull(service, "missing service");
} }
} }

3
core/java/android/net/IpSecTransform.java
View File

@@ -130,7 +130,8 @@ public final class IpSecTransform implements AutoCloseable {
synchronized (this) { synchronized (this) {
try { try {
IIpSecService svc = getIpSecService(); IIpSecService svc = getIpSecService();
IpSecTransformResponse result = svc.createTransform(mConfig, new Binder()); IpSecTransformResponse result = svc.createTransform(
mConfig, new Binder(), mContext.getOpPackageName());
int status = result.status; int status = result.status;
checkResultStatus(status); checkResultStatus(status);
mResourceId = result.resourceId; mResourceId = result.resourceId;

59
services/core/java/com/android/server/IpSecService.java
View File

@@ -24,6 +24,8 @@ import static android.system.OsConstants.IPPROTO_UDP;
import static android.system.OsConstants.SOCK_DGRAM; import static android.system.OsConstants.SOCK_DGRAM;
import static com.android.internal.util.Preconditions.checkNotNull; import static com.android.internal.util.Preconditions.checkNotNull;
import android.annotation.NonNull;
import android.app.AppOpsManager;
import android.content.Context; import android.content.Context;
import android.net.ConnectivityManager; import android.net.ConnectivityManager;
import android.net.IIpSecService; import android.net.IIpSecService;
@@ -42,6 +44,7 @@ import android.net.NetworkUtils;
import android.net.TrafficStats; import android.net.TrafficStats;
import android.net.util.NetdService; import android.net.util.NetdService;
import android.os.Binder; import android.os.Binder;
import android.os.DeadSystemException;
import android.os.IBinder; import android.os.IBinder;
import android.os.ParcelFileDescriptor; import android.os.ParcelFileDescriptor;
import android.os.RemoteException; import android.os.RemoteException;
@@ -974,6 +977,13 @@ public class IpSecService extends IIpSecService.Stub {
return service; return service;
} }
@NonNull
private AppOpsManager getAppOpsManager() {
AppOpsManager appOps = (AppOpsManager) mContext.getSystemService(Context.APP_OPS_SERVICE);
if(appOps == null) throw new RuntimeException("System Server couldn't get AppOps");
return appOps;
}
/** @hide */ /** @hide */
@VisibleForTesting @VisibleForTesting
public IpSecService(Context context, IpSecServiceConfiguration config) { public IpSecService(Context context, IpSecServiceConfiguration config) {
@@ -1240,7 +1250,9 @@ public class IpSecService extends IIpSecService.Stub {
*/ */
@Override @Override
public synchronized IpSecTunnelInterfaceResponse createTunnelInterface( public synchronized IpSecTunnelInterfaceResponse createTunnelInterface(
String localAddr, String remoteAddr, Network underlyingNetwork, IBinder binder) { String localAddr, String remoteAddr, Network underlyingNetwork, IBinder binder,
String callingPackage) {
enforceTunnelPermissions(callingPackage);
checkNotNull(binder, "Null Binder passed to createTunnelInterface"); checkNotNull(binder, "Null Binder passed to createTunnelInterface");
checkNotNull(underlyingNetwork, "No underlying network was specified"); checkNotNull(underlyingNetwork, "No underlying network was specified");
checkInetAddress(localAddr); checkInetAddress(localAddr);
@@ -1320,8 +1332,8 @@ public class IpSecService extends IIpSecService.Stub {
*/ */
@Override @Override
public synchronized void addAddressToTunnelInterface( public synchronized void addAddressToTunnelInterface(
int tunnelResourceId, LinkAddress localAddr) { int tunnelResourceId, LinkAddress localAddr, String callingPackage) {
enforceNetworkStackPermission(); enforceTunnelPermissions(callingPackage);
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid()); UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());
// Get tunnelInterface record; if no such interface is found, will throw // Get tunnelInterface record; if no such interface is found, will throw
@@ -1352,10 +1364,10 @@ public class IpSecService extends IIpSecService.Stub {
*/ */
@Override @Override
public synchronized void removeAddressFromTunnelInterface( public synchronized void removeAddressFromTunnelInterface(
int tunnelResourceId, LinkAddress localAddr) { int tunnelResourceId, LinkAddress localAddr, String callingPackage) {
enforceNetworkStackPermission(); enforceTunnelPermissions(callingPackage);
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());
// Get tunnelInterface record; if no such interface is found, will throw // Get tunnelInterface record; if no such interface is found, will throw
// IllegalArgumentException // IllegalArgumentException
TunnelInterfaceRecord tunnelInterfaceInfo = TunnelInterfaceRecord tunnelInterfaceInfo =
@@ -1383,7 +1395,9 @@ public class IpSecService extends IIpSecService.Stub {
* server * server
*/ */
@Override @Override
public synchronized void deleteTunnelInterface(int resourceId) throws RemoteException { public synchronized void deleteTunnelInterface(
int resourceId, String callingPackage) throws RemoteException {
enforceTunnelPermissions(callingPackage);
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid()); UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());
releaseResource(userRecord.mTunnelInterfaceRecords, resourceId); releaseResource(userRecord.mTunnelInterfaceRecords, resourceId);
} }
@@ -1469,7 +1483,6 @@ public class IpSecService extends IIpSecService.Stub {
case IpSecTransform.MODE_TRANSPORT: case IpSecTransform.MODE_TRANSPORT:
break; break;
case IpSecTransform.MODE_TUNNEL: case IpSecTransform.MODE_TUNNEL:
enforceNetworkStackPermission();
break; break;
default: default:
throw new IllegalArgumentException( throw new IllegalArgumentException(
@@ -1477,9 +1490,20 @@ public class IpSecService extends IIpSecService.Stub {
} }
} }
private void enforceNetworkStackPermission() { private void enforceTunnelPermissions(String callingPackage) {
mContext.enforceCallingOrSelfPermission(android.Manifest.permission.NETWORK_STACK, checkNotNull(callingPackage, "Null calling package cannot create IpSec tunnels");
"IpSecService"); switch (getAppOpsManager().noteOp(
AppOpsManager.OP_MANAGE_IPSEC_TUNNELS,
Binder.getCallingUid(), callingPackage)) {
case AppOpsManager.MODE_DEFAULT:
mContext.enforceCallingOrSelfPermission(
android.Manifest.permission.MANAGE_IPSEC_TUNNELS, "IpSecService");
break;
case AppOpsManager.MODE_ALLOWED:
return;
default:
throw new SecurityException("Request to ignore AppOps for non-legacy API");
}
} }
private void createOrUpdateTransform( private void createOrUpdateTransform(
@@ -1535,8 +1559,12 @@ public class IpSecService extends IIpSecService.Stub {
* result in all of those sockets becoming unable to send or receive data. * result in all of those sockets becoming unable to send or receive data.
*/ */
@Override @Override
public synchronized IpSecTransformResponse createTransform(IpSecConfig c, IBinder binder) public synchronized IpSecTransformResponse createTransform(
throws RemoteException { IpSecConfig c, IBinder binder, String callingPackage) throws RemoteException {
checkNotNull(c);
if (c.getMode() == IpSecTransform.MODE_TUNNEL) {
enforceTunnelPermissions(callingPackage);
}
checkIpSecConfig(c); checkIpSecConfig(c);
checkNotNull(binder, "Null Binder passed to createTransform"); checkNotNull(binder, "Null Binder passed to createTransform");
final int resourceId = mNextResourceId++; final int resourceId = mNextResourceId++;
@@ -1657,8 +1685,9 @@ public class IpSecService extends IIpSecService.Stub {
*/ */
@Override @Override
public synchronized void applyTunnelModeTransform( public synchronized void applyTunnelModeTransform(
int tunnelResourceId, int direction, int transformResourceId) throws RemoteException { int tunnelResourceId, int direction,
enforceNetworkStackPermission(); int transformResourceId, String callingPackage) throws RemoteException {
enforceTunnelPermissions(callingPackage);
checkDirection(direction); checkDirection(direction);
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid()); UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());