LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use java BpfMap in updateUidLockdownRule

Browse Source 
Bug: 217624062
Test: atest BpfNetMapsTest HostsideVpnTests#testBlockIncomingPacket
Change-Id: I58cd614575a98c4b5a8f9c34d47dd2dfff187b26
This commit is contained in:
Motomu Utsumi
2022-06-30 02:25:29 +00:00
parent 55630d0dc8
commit 697b299e3a
2 changed files with 60 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
service/src/com/android/server/BpfNetMaps.java
View File

@@ -456,9 +456,11 @@ public class BpfNetMaps {
* cause of the failure.
*/
public void updateUidLockdownRule(final int uid, final boolean add) {
synchronized (sUidOwnerMap) {
final int err = native_updateUidLockdownRule(uid, add);
maybeThrow(err, "Unable to update lockdown rule");
throwIfPreT("updateUidLockdownRule is not available on pre-T devices");
if (add) {
addRule(uid, LOCKDOWN_VPN_MATCH, "updateUidLockdownRule");
} else {
removeRule(uid, LOCKDOWN_VPN_MATCH, "updateUidLockdownRule");
}
}

55
tests/unit/java/com/android/server/BpfNetMapsTest.java
View File

@@ -29,6 +29,7 @@ import static android.net.INetd.PERMISSION_INTERNET;
import static com.android.server.BpfNetMaps.DOZABLE_MATCH;
import static com.android.server.BpfNetMaps.HAPPY_BOX_MATCH;
import static com.android.server.BpfNetMaps.IIF_MATCH;
import static com.android.server.BpfNetMaps.LOCKDOWN_VPN_MATCH;
import static com.android.server.BpfNetMaps.NO_MATCH;
import static com.android.server.BpfNetMaps.PENALTY_BOX_MATCH;
import static com.android.server.BpfNetMaps.POWERSAVE_MATCH;
@@ -403,4 +404,58 @@ public final class BpfNetMapsTest {
assertThrows(UnsupportedOperationException.class,
() -> mBpfNetMaps.addNiceApp(TEST_UID));
}
private void doTestUpdateUidLockdownRule(final long iif, final long match, final boolean add)
throws Exception {
if (match != NO_MATCH) {
mUidOwnerMap.updateEntry(new U32(TEST_UID), new UidOwnerValue(iif, match));
}
mBpfNetMaps.updateUidLockdownRule(TEST_UID, add);
final long expectedMatch = add ? match | LOCKDOWN_VPN_MATCH : match & ~LOCKDOWN_VPN_MATCH;
checkUidOwnerValue(TEST_UID, iif, expectedMatch);
}
private static final boolean ADD = true;
private static final boolean REMOVE = false;
@Test
@IgnoreUpTo(Build.VERSION_CODES.S_V2)
public void testUpdateUidLockdownRuleAddLockdown() throws Exception {
doTestUpdateUidLockdownRule(NO_IIF, NO_MATCH, ADD);
// Other matches are enabled
doTestUpdateUidLockdownRule(
NO_IIF, DOZABLE_MATCH | POWERSAVE_MATCH | RESTRICTED_MATCH, ADD);
// IIF_MATCH is enabled
doTestUpdateUidLockdownRule(TEST_IF_INDEX, DOZABLE_MATCH, ADD);
// LOCKDOWN_VPN_MATCH is already enabled
doTestUpdateUidLockdownRule(NO_IIF, LOCKDOWN_VPN_MATCH | DOZABLE_MATCH, ADD);
}
@Test
@IgnoreUpTo(Build.VERSION_CODES.S_V2)
public void testUpdateUidLockdownRuleRemoveLockdown() throws Exception {
doTestUpdateUidLockdownRule(NO_IIF, LOCKDOWN_VPN_MATCH, REMOVE);
// LOCKDOWN_VPN_MATCH with other matches
doTestUpdateUidLockdownRule(
NO_IIF, LOCKDOWN_VPN_MATCH | POWERSAVE_MATCH | RESTRICTED_MATCH, REMOVE);
// LOCKDOWN_VPN_MATCH with IIF_MATCH
doTestUpdateUidLockdownRule(TEST_IF_INDEX, LOCKDOWN_VPN_MATCH | IIF_MATCH, REMOVE);
// LOCKDOWN_VPN_MATCH is not enabled
doTestUpdateUidLockdownRule(NO_IIF, POWERSAVE_MATCH | RESTRICTED_MATCH, REMOVE);
}
@Test
@IgnoreAfter(Build.VERSION_CODES.S_V2)
public void testUpdateUidLockdownRuleBeforeT() {
assertThrows(UnsupportedOperationException.class,
() -> mBpfNetMaps.updateUidLockdownRule(TEST_UID, true /* add */));
}
}