LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add updateFirewallRule API

Browse Source 
To deprecated firewallSetUidRule netd binder and move the functionality to
tethering (connectivity) mainline module, expose updateFirewallRule to
support the caller outside the module. Currently the API are still call
to netd. Will replace with the implementation inside tethering
(connectivity) module.

Bug: 209935649
Test: atest CtsHostsideNetworkTests
Change-Id: I0b53c999e06c2378afec0eb491815ec398c91b0b
This commit is contained in:
markchien
2021-12-09 22:00:56 +08:00
parent 136f2d2d91
commit e1561fa800
4 changed files with 91 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
framework/src/android/net/ConnectivityManager.java
View File

@@ -930,6 +930,48 @@ public class ConnectivityManager {
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 130143562)
private final IConnectivityManager mService;
/**
* Firewall chain for device idle (doze mode).
* Allowlist of apps that have network access in device idle.
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
public static final int FIREWALL_CHAIN_DOZABLE = 1;
/**
* Firewall chain used for app standby.
* Denylist of apps that do not have network access.
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
public static final int FIREWALL_CHAIN_STANDBY = 2;
/**
* Firewall chain used for battery saver.
* Allowlist of apps that have network access when battery saver is on.
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
public static final int FIREWALL_CHAIN_POWERSAVE = 3;
/**
* Firewall chain used for restricted networking mode.
* Allowlist of apps that have access in restricted networking mode.
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
public static final int FIREWALL_CHAIN_RESTRICTED = 4;
/** @hide */
@Retention(RetentionPolicy.SOURCE)
@IntDef(flag = false, prefix = "FIREWALL_CHAIN_", value = {
FIREWALL_CHAIN_DOZABLE,
FIREWALL_CHAIN_STANDBY,
FIREWALL_CHAIN_POWERSAVE,
FIREWALL_CHAIN_RESTRICTED
})
public @interface FirewallChain {}
/**
* A kludge to facilitate static access where a Context pointer isn't available, like in the
* case of the static set/getProcessDefaultNetwork methods and from the Network class.
@@ -5552,9 +5594,11 @@ public class ConnectivityManager {
}
/**
* Allow target application using metered network.
* Sets whether the specified UID is allowed to use data on metered networks even when
* background data is restricted.
*
* @param uid uid of target app
* @throws IllegalStateException if update allow list failed.
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
@@ -5568,15 +5612,15 @@ public class ConnectivityManager {
mService.updateMeteredNetworkAllowList(uid, add);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
} catch (IllegalStateException ie) {
throw ie;
}
}
/**
* Disallow target application using metered network.
* Sets whether the specified UID is prevented from using background data on metered networks.
* Takes precedence over {@link #updateMeteredNetworkAllowList}.
*
* @param uid uid of target app
* @throws IllegalStateException if update deny list failed.
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
@@ -5590,8 +5634,30 @@ public class ConnectivityManager {
mService.updateMeteredNetworkDenyList(uid, add);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
} catch (IllegalStateException ie) {
throw ie;
}
}
/**
* Sets a firewall rule for the specified UID on the specified chain.
*
* @param chain target chain.
* @param uid uid to allow/deny.
* @param allow either add or remove rule.
* @throws IllegalStateException if update firewall rule failed.
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
@RequiresPermission(anyOf = {
android.Manifest.permission.NETWORK_SETTINGS,
android.Manifest.permission.NETWORK_STACK,
NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK
})
public void updateFirewallRule(@FirewallChain final int chain, final int uid,
final boolean allow) {
try {
mService.updateFirewallRule(chain, uid, allow);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}