From cb8cc6cc5a64b2b313bc6c9308da5991ee293a78 Mon Sep 17 00:00:00 2001 From: Bernie Innocenti Date: Mon, 28 May 2018 22:04:37 +0900 Subject: [PATCH] vpn: allow IPSec traffic through Always-on VPN This won't leak any traffic outside the VPN as long as there are no processes owned by uid 0 which generate network traffic (which is currently the case). Bug: 69873852 Test: compared the output of 'adb shell ip rule show' before and after Test: runtest -x frameworks/base/tests/net/java/com/android/server/connectivity/VpnTest.java Test: local CTS tests run: android.net.cts.VpnServiceTest Test: local CTS tests run: com.android.cts.devicepolicy.MixedDeviceOwnerTest Change-Id: I8758e576c9d961d73f62bfcf0559dd7ecee6e8e6 Merged-In: I8758e576c9d961d73f62bfcf0559dd7ecee6e8e6 Merged-In: I1f9b78c8f828ec2df7aba71b39d62be0c4db2550 Merged-In: I8edeb0942e661c8385ff0cd3fdb72e6f62a8f218 (cherry picked from commit 00000fe55a4729f8339afdc7eab5c970b2549813) --- .../core/java/com/android/server/connectivity/Vpn.java | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/connectivity/Vpn.java b/services/core/java/com/android/server/connectivity/Vpn.java index d8de0bddcf74..10423ad46378 100644 --- a/services/core/java/com/android/server/connectivity/Vpn.java +++ b/services/core/java/com/android/server/connectivity/Vpn.java @@ -91,8 +91,6 @@ import com.android.server.DeviceIdleController; import com.android.server.LocalServices; import com.android.server.net.BaseNetworkObserver; -import libcore.io.IoUtils; - import java.io.File; import java.io.IOException; import java.io.InputStream; @@ -111,6 +109,8 @@ import java.util.SortedSet; import java.util.TreeSet; import java.util.concurrent.atomic.AtomicInteger; +import libcore.io.IoUtils; + /** * @hide */ @@ -1057,6 +1057,18 @@ public class Vpn { /* allowedApplications */ null, /* disallowedApplications */ Collections.singletonList(mPackage)); + // The UID range of the first user (0-99999) would block the IPSec traffic, which comes + // directly from the kernel and is marked as uid=0. So we adjust the range to allow + // it through (b/69873852). + for (UidRange range : addedRanges) { + if (range.start == 0) { + addedRanges.remove(range); + if (range.stop != 0) { + addedRanges.add(new UidRange(1, range.stop)); + } + } + } + removedRanges.removeAll(addedRanges); addedRanges.removeAll(mBlockedUsers); -- 2.11.0