Implement support for bypassable VPNs.
Bypassable VPNs grab all traffic by default (just like secure VPNs), but:
+ They allow all apps to choose other networks using the multinetwork APIs.
If these other networks are insecure ("untrusted"), they will enforce that the
app holds the necessary permissions, such as CHANGE_NETWORK_STATE.
+ They support consistent routing. If an app has an existing connection over
some other network when the bypassable VPN comes up, it's not interrupted.
Bug: 15347374
Change-Id: Iaee9c6f6fa8103215738570d2b65d3fcf10343f3
diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index 36be58c..ec9243f 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -74,6 +74,7 @@
import android.net.NetworkInfo;
import android.net.NetworkInfo.DetailedState;
import android.net.NetworkFactory;
+import android.net.NetworkMisc;
import android.net.NetworkQuotaInfo;
import android.net.NetworkRequest;
import android.net.NetworkState;
@@ -5259,12 +5260,13 @@
public void registerNetworkAgent(Messenger messenger, NetworkInfo networkInfo,
LinkProperties linkProperties, NetworkCapabilities networkCapabilities,
- int currentScore) {
+ int currentScore, NetworkMisc networkMisc) {
enforceConnectivityInternalPermission();
NetworkAgentInfo nai = new NetworkAgentInfo(messenger, new AsyncChannel(), nextNetId(),
new NetworkInfo(networkInfo), new LinkProperties(linkProperties),
- new NetworkCapabilities(networkCapabilities), currentScore, mContext, mTrackerHandler);
+ new NetworkCapabilities(networkCapabilities), currentScore, mContext, mTrackerHandler,
+ networkMisc);
if (VDBG) log("registerNetworkAgent " + nai);
mHandler.sendMessage(mHandler.obtainMessage(EVENT_REGISTER_NETWORK_AGENT, nai));
}
@@ -5665,7 +5667,9 @@
// to tell us whether we've already created this network or not.
if (networkAgent.isVPN()) {
mNetd.createVirtualNetwork(networkAgent.network.netId,
- !networkAgent.linkProperties.getDnsServers().isEmpty());
+ !networkAgent.linkProperties.getDnsServers().isEmpty(),
+ (networkAgent.networkMisc == null ||
+ !networkAgent.networkMisc.allowBypass));
} else {
mNetd.createPhysicalNetwork(networkAgent.network.netId);
}
diff --git a/services/core/java/com/android/server/NetworkManagementService.java b/services/core/java/com/android/server/NetworkManagementService.java
index db423b0..75a7878 100644
--- a/services/core/java/com/android/server/NetworkManagementService.java
+++ b/services/core/java/com/android/server/NetworkManagementService.java
@@ -1947,11 +1947,12 @@
}
@Override
- public void createVirtualNetwork(int netId, boolean hasDNS) {
+ public void createVirtualNetwork(int netId, boolean hasDNS, boolean secure) {
mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
try {
- mConnector.execute("network", "create", netId, "vpn", hasDNS ? "1" : "0");
+ mConnector.execute("network", "create", netId, "vpn", hasDNS ? "1" : "0",
+ secure ? "1" : "0");
} catch (NativeDaemonConnectorException e) {
throw e.rethrowAsParcelableException();
}
diff --git a/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java b/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java
index 10bdba0..403713d 100644
--- a/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java
+++ b/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java
@@ -21,6 +21,7 @@
import android.net.Network;
import android.net.NetworkCapabilities;
import android.net.NetworkInfo;
+import android.net.NetworkMisc;
import android.net.NetworkRequest;
import android.os.Handler;
import android.os.Messenger;
@@ -44,6 +45,7 @@
public NetworkCapabilities networkCapabilities;
public int currentScore;
public final NetworkMonitor networkMonitor;
+ public final NetworkMisc networkMisc;
// The list of NetworkRequests being satisfied by this Network.
public final SparseArray<NetworkRequest> networkRequests = new SparseArray<NetworkRequest>();
@@ -53,8 +55,8 @@
public final AsyncChannel asyncChannel;
public NetworkAgentInfo(Messenger messenger, AsyncChannel ac, int netId, NetworkInfo info,
- LinkProperties lp, NetworkCapabilities nc, int score, Context context,
- Handler handler) {
+ LinkProperties lp, NetworkCapabilities nc, int score, Context context, Handler handler,
+ NetworkMisc misc) {
this.messenger = messenger;
asyncChannel = ac;
network = new Network(netId);
@@ -63,6 +65,7 @@
networkCapabilities = nc;
currentScore = score;
networkMonitor = new NetworkMonitor(context, handler, this);
+ networkMisc = misc;
}
public void addRequest(NetworkRequest networkRequest) {
diff --git a/services/core/java/com/android/server/connectivity/Vpn.java b/services/core/java/com/android/server/connectivity/Vpn.java
index 4b5a2cb..ba9a183 100644
--- a/services/core/java/com/android/server/connectivity/Vpn.java
+++ b/services/core/java/com/android/server/connectivity/Vpn.java
@@ -48,6 +48,7 @@
import android.net.NetworkCapabilities;
import android.net.NetworkInfo;
import android.net.NetworkInfo.DetailedState;
+import android.net.NetworkMisc;
import android.net.NetworkUtils;
import android.net.RouteInfo;
import android.net.UidRange;
@@ -331,10 +332,14 @@
lp.setDomains(buffer.toString().trim());
mNetworkInfo.setIsAvailable(true);
mNetworkInfo.setDetailedState(DetailedState.CONNECTED, null, null);
+ NetworkMisc networkMisc = new NetworkMisc();
+ if (mConfig.allowBypass) {
+ networkMisc.allowBypass = true;
+ }
long token = Binder.clearCallingIdentity();
try {
mNetworkAgent = new NetworkAgent(mLooper, mContext, NETWORKTYPE,
- mNetworkInfo, mNetworkCapabilities, lp, 0) {
+ mNetworkInfo, mNetworkCapabilities, lp, 0, networkMisc) {
public void unwanted() {
// We are user controlled, not driven by NetworkRequest.
};