commit 3912b21cbfaab3c8a705f61965c201b7522a42a2
author lucaslin <lucaslin@google.com> Mon Jul 25 15:07:52 2022 +0800
committer Lucas Lin <lucaslin@google.com> Wed Jul 27 01:30:22 2022 +0000
tree d3f4637dc64cf216d3a23ce95201f684b9f927b1
parent 326af90470e4ccf0c66e8c7def9fa4a1ca1e55fd

Skip sending VpnManager events for Settings VPNs

This change early-exits from the sendEventToVpnManagerApp()
method if the profile was not a VPN app.

Otherwise the sendEventToVpnManagerApp() will call
getRedactedNetworkCapabilities() which will call
AppOpsManager#checkPackage() eventually.
And AppOpsManager#checkPackage() will check if the given package
is the same as the given uid. In this case, VPN sends
"[Legacy VPN]" as the package and sends 1000 as the uid, but
there is no package named "[Legacy VPN], so the SecurityException
is thrown.

Bug: 236315805
Test: atest FrameworksNetTests:VpnTest
Change-Id: I486398111106b1a9551fb29f92ba7b4fe85f68c1
Merged-In: I228f62a5e09017dbf985a614f2e42434238a220c

services/core/java/com/android/server/connectivity/Vpn.java

diff --git a/services/core/java/com/android/server/connectivity/Vpn.java b/services/core/java/com/android/server/connectivity/Vpn.java
index f526960..86b8d32 100644
--- a/services/core/java/com/android/server/connectivity/Vpn.java
+++ b/services/core/java/com/android/server/connectivity/Vpn.java
@@ -3281,7 +3281,7 @@
                             // All the above failures are configuration errors, and are terminal
                             // TODO(b/230548427): Remove SDK check once VPN related stuff are
                             //  decoupled from ConnectivityServiceTest.
-                            if (SdkLevel.isAtLeastT()) {
+                            if (SdkLevel.isAtLeastT() && isVpnApp(mPackage)) {
                                 sendEventToVpnManagerApp(VpnManager.CATEGORY_EVENT_IKE_ERROR,
                                         VpnManager.ERROR_CLASS_NOT_RECOVERABLE,
                                         ikeException.getErrorType(),
@@ -3299,7 +3299,7 @@
                             // All the above failures are configuration errors, and are terminal
                             // TODO(b/230548427): Remove SDK check once VPN related stuff are
                             //  decoupled from ConnectivityServiceTest.
-                            if (SdkLevel.isAtLeastT()) {
+                            if (SdkLevel.isAtLeastT() && isVpnApp(mPackage)) {
                                 sendEventToVpnManagerApp(VpnManager.CATEGORY_EVENT_IKE_ERROR,
                                         VpnManager.ERROR_CLASS_RECOVERABLE,
                                         ikeException.getErrorType(),
@@ -3318,7 +3318,7 @@
                 } else if (exception instanceof IkeNetworkLostException) {
                     // TODO(b/230548427): Remove SDK check once VPN related stuff are
                     //  decoupled from ConnectivityServiceTest.
-                    if (SdkLevel.isAtLeastT()) {
+                    if (SdkLevel.isAtLeastT() && isVpnApp(mPackage)) {
                         sendEventToVpnManagerApp(VpnManager.CATEGORY_EVENT_NETWORK_ERROR,
                                 VpnManager.ERROR_CLASS_RECOVERABLE,
                                 VpnManager.ERROR_CODE_NETWORK_LOST,
@@ -3333,7 +3333,7 @@
                     if (exception.getCause() instanceof UnknownHostException) {
                         // TODO(b/230548427): Remove SDK check once VPN related stuff are
                         //  decoupled from ConnectivityServiceTest.
-                        if (SdkLevel.isAtLeastT()) {
+                        if (SdkLevel.isAtLeastT() && isVpnApp(mPackage)) {
                             sendEventToVpnManagerApp(VpnManager.CATEGORY_EVENT_NETWORK_ERROR,
                                     VpnManager.ERROR_CLASS_RECOVERABLE,
                                     VpnManager.ERROR_CODE_NETWORK_UNKNOWN_HOST,
@@ -3347,7 +3347,7 @@
                     } else if (exception.getCause() instanceof IkeTimeoutException) {
                         // TODO(b/230548427): Remove SDK check once VPN related stuff are
                         //  decoupled from ConnectivityServiceTest.
-                        if (SdkLevel.isAtLeastT()) {
+                        if (SdkLevel.isAtLeastT() && isVpnApp(mPackage)) {
                             sendEventToVpnManagerApp(VpnManager.CATEGORY_EVENT_NETWORK_ERROR,
                                     VpnManager.ERROR_CLASS_RECOVERABLE,
                                     VpnManager.ERROR_CODE_NETWORK_PROTOCOL_TIMEOUT,
@@ -3361,7 +3361,7 @@
                     } else if (exception.getCause() instanceof IOException) {
                         // TODO(b/230548427): Remove SDK check once VPN related stuff are
                         //  decoupled from ConnectivityServiceTest.
-                        if (SdkLevel.isAtLeastT()) {
+                        if (SdkLevel.isAtLeastT() && isVpnApp(mPackage)) {
                             sendEventToVpnManagerApp(VpnManager.CATEGORY_EVENT_NETWORK_ERROR,
                                     VpnManager.ERROR_CLASS_RECOVERABLE,
                                     VpnManager.ERROR_CODE_NETWORK_IO,