Create a new API to make a set of UIDs use only VPN by default
Create a new API - setVpnNetworkPreference() for the caller to
set VPN as the preference network.
VPN will be disconnected when its underlying network is gone.
To prevent packets going through an underlying network when the
underlying network is back but VPN is not connected yet, set VPN
as the only preferred network for specific apps.
Bug: 231749077
Test: 1. atest FrameworksNetTests
2. Create a test app to register default network and check if
the VPN is the only default network for the test app.
Change-Id: Iabcd38e2fec2aefedbf78d20e338f222d83a9e7f
diff --git a/framework/api/module-lib-current.txt b/framework/api/module-lib-current.txt
index 752c347..7669e0e 100644
--- a/framework/api/module-lib-current.txt
+++ b/framework/api/module-lib-current.txt
@@ -31,6 +31,7 @@
method @RequiresPermission(android.Manifest.permission.NETWORK_STACK) public void setProfileNetworkPreferences(@NonNull android.os.UserHandle, @NonNull java.util.List<android.net.ProfileNetworkPreference>, @Nullable java.util.concurrent.Executor, @Nullable Runnable);
method @RequiresPermission(anyOf={android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK, android.Manifest.permission.NETWORK_STACK, android.Manifest.permission.NETWORK_SETTINGS}) public void setRequireVpnForUids(boolean, @NonNull java.util.Collection<android.util.Range<java.lang.Integer>>);
method @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.NETWORK_STACK, android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK}) public void setUidFirewallRule(int, int, int);
+ method @RequiresPermission(anyOf={android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK, android.Manifest.permission.NETWORK_STACK, android.Manifest.permission.NETWORK_SETTINGS}) public void setVpnDefaultForUids(@NonNull String, @NonNull java.util.Collection<android.util.Range<java.lang.Integer>>);
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_TEST_NETWORKS, android.Manifest.permission.NETWORK_STACK}) public void simulateDataStall(int, long, @NonNull android.net.Network, @NonNull android.os.PersistableBundle);
method @RequiresPermission(anyOf={android.Manifest.permission.NETWORK_SETTINGS, android.Manifest.permission.NETWORK_STACK, android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK}) public void startCaptivePortalApp(@NonNull android.net.Network);
method public void systemReady();
diff --git a/framework/src/android/net/ConnectivityManager.java b/framework/src/android/net/ConnectivityManager.java
index 1b4b42f..60bc68c 100644
--- a/framework/src/android/net/ConnectivityManager.java
+++ b/framework/src/android/net/ConnectivityManager.java
@@ -1378,6 +1378,17 @@
}
}
+ private static UidRange[] getUidRangeArray(@NonNull Collection<Range<Integer>> ranges) {
+ Objects.requireNonNull(ranges);
+ final UidRange[] rangesArray = new UidRange[ranges.size()];
+ int index = 0;
+ for (Range<Integer> range : ranges) {
+ rangesArray[index++] = new UidRange(range.getLower(), range.getUpper());
+ }
+
+ return rangesArray;
+ }
+
/**
* Adds or removes a requirement for given UID ranges to use the VPN.
*
@@ -1397,6 +1408,12 @@
* {@link NetworkCallback#onBlockedStatusChanged} callbacks called after the changes take
* effect.
* <p>
+ * This method will block the specified UIDs from accessing non-VPN networks, but does not
+ * affect what the UIDs get as their default network.
+ * Compare {@link #setVpnDefaultForUids(String, Collection)}, which declares that the UIDs
+ * should only have a VPN as their default network, but does not block them from accessing other
+ * networks if they request them explicitly with the {@link Network} API.
+ * <p>
* This method should be called only by the VPN code.
*
* @param ranges the UID ranges to restrict
@@ -1416,11 +1433,7 @@
// This method is not necessarily expected to be used outside the system server, so
// parceling may not be necessary, but it could be used out-of-process, e.g., by the network
// stack process, or by tests.
- UidRange[] rangesArray = new UidRange[ranges.size()];
- int index = 0;
- for (Range<Integer> range : ranges) {
- rangesArray[index++] = new UidRange(range.getLower(), range.getUpper());
- }
+ final UidRange[] rangesArray = getUidRangeArray(ranges);
try {
mService.setRequireVpnForUids(requireVpn, rangesArray);
} catch (RemoteException e) {
@@ -1429,6 +1442,41 @@
}
/**
+ * Inform the system that this VPN session should manage the passed UIDs.
+ *
+ * A VPN with the specified session ID may call this method to inform the system that the UIDs
+ * in the specified range are subject to a VPN.
+ * When this is called, the system will only choose a VPN for the default network of the UIDs in
+ * the specified ranges.
+ *
+ * This method declares that the UIDs in the range will only have a VPN for their default
+ * network, but does not block the UIDs from accessing other networks (permissions allowing) by
+ * explicitly requesting it with the {@link Network} API.
+ * Compare {@link #setRequireVpnForUids(boolean, Collection)}, which does not affect what
+ * network the UIDs get as default, but will block them from accessing non-VPN networks.
+ *
+ * @param session The VPN session which manages the passed UIDs.
+ * @param ranges The uid ranges which will treat VPN as their only default network.
+ *
+ * @hide
+ */
+ @RequiresPermission(anyOf = {
+ NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK,
+ android.Manifest.permission.NETWORK_STACK,
+ android.Manifest.permission.NETWORK_SETTINGS})
+ @SystemApi(client = MODULE_LIBRARIES)
+ public void setVpnDefaultForUids(@NonNull String session,
+ @NonNull Collection<Range<Integer>> ranges) {
+ Objects.requireNonNull(ranges);
+ final UidRange[] rangesArray = getUidRangeArray(ranges);
+ try {
+ mService.setVpnNetworkPreference(session, rangesArray);
+ } catch (RemoteException e) {
+ throw e.rethrowFromSystemServer();
+ }
+ }
+
+ /**
* Informs ConnectivityService of whether the legacy lockdown VPN, as implemented by
* LockdownVpnTracker, is in use. This is deprecated for new devices starting from Android 12
* but is still supported for backwards compatibility.
diff --git a/framework/src/android/net/IConnectivityManager.aidl b/framework/src/android/net/IConnectivityManager.aidl
index 43d2f07..7b6e769 100644
--- a/framework/src/android/net/IConnectivityManager.aidl
+++ b/framework/src/android/net/IConnectivityManager.aidl
@@ -249,4 +249,6 @@
void replaceFirewallChain(int chain, in int[] uids);
IBinder getCompanionDeviceManagerProxyService();
+
+ void setVpnNetworkPreference(String session, in UidRange[] ranges);
}