LockdownVpnTracker.java revision ad4cd0c01966017e2f51ec3d23d06de3874f100c 
1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17package com.android.server.net;
18
19import static android.Manifest.permission.CONNECTIVITY_INTERNAL;
20
21import android.app.Notification;
22import android.app.NotificationManager;
23import android.app.PendingIntent;
24import android.content.BroadcastReceiver;
25import android.content.Context;
26import android.content.Intent;
27import android.content.IntentFilter;
28import android.net.ConnectivityManager;
29import android.net.LinkProperties;
30import android.net.LinkAddress;
31import android.net.NetworkInfo;
32import android.net.NetworkInfo.DetailedState;
33import android.net.NetworkInfo.State;
34import android.os.INetworkManagementService;
35import android.os.RemoteException;
36import android.security.Credentials;
37import android.security.KeyStore;
38import android.system.Os;
39import android.text.TextUtils;
40import android.util.Slog;
41
42import com.android.internal.R;
43import com.android.internal.net.VpnConfig;
44import com.android.internal.net.VpnProfile;
45import com.android.internal.util.Preconditions;
46import com.android.server.ConnectivityService;
47import com.android.server.EventLogTags;
48import com.android.server.connectivity.Vpn;
49
50import java.util.List;
51
52/**
53 * State tracker for lockdown mode. Watches for normal {@link NetworkInfo} to be
54 * connected and kicks off VPN connection, managing any required {@code netd}
55 * firewall rules.
56 */
57public class LockdownVpnTracker {
58    private static final String TAG = "LockdownVpnTracker";
59
60    /** Number of VPN attempts before waiting for user intervention. */
61    private static final int MAX_ERROR_COUNT = 4;
62
63    private static final String ACTION_LOCKDOWN_RESET = "com.android.server.action.LOCKDOWN_RESET";
64
65    private static final String ACTION_VPN_SETTINGS = "android.net.vpn.SETTINGS";
66    private static final String EXTRA_PICK_LOCKDOWN = "android.net.vpn.PICK_LOCKDOWN";
67
68    private static final int ROOT_UID = 0;
69
70    private final Context mContext;
71    private final INetworkManagementService mNetService;
72    private final ConnectivityService mConnService;
73    private final Vpn mVpn;
74    private final VpnProfile mProfile;
75
76    private final Object mStateLock = new Object();
77
78    private final PendingIntent mConfigIntent;
79    private final PendingIntent mResetIntent;
80
81    private String mAcceptedEgressIface;
82    private String mAcceptedIface;
83    private List<LinkAddress> mAcceptedSourceAddr;
84
85    private int mErrorCount;
86
87    public static boolean isEnabled() {
88        return KeyStore.getInstance().contains(Credentials.LOCKDOWN_VPN);
89    }
90
91    public LockdownVpnTracker(Context context, INetworkManagementService netService,
92            ConnectivityService connService, Vpn vpn, VpnProfile profile) {
93        mContext = Preconditions.checkNotNull(context);
94        mNetService = Preconditions.checkNotNull(netService);
95        mConnService = Preconditions.checkNotNull(connService);
96        mVpn = Preconditions.checkNotNull(vpn);
97        mProfile = Preconditions.checkNotNull(profile);
98
99        final Intent configIntent = new Intent(ACTION_VPN_SETTINGS);
100        configIntent.putExtra(EXTRA_PICK_LOCKDOWN, true);
101        mConfigIntent = PendingIntent.getActivity(mContext, 0, configIntent, 0);
102
103        final Intent resetIntent = new Intent(ACTION_LOCKDOWN_RESET);
104        resetIntent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
105        mResetIntent = PendingIntent.getBroadcast(mContext, 0, resetIntent, 0);
106    }
107
108    private BroadcastReceiver mResetReceiver = new BroadcastReceiver() {
109        @Override
110        public void onReceive(Context context, Intent intent) {
111            reset();
112        }
113    };
114
115    /**
116     * Watch for state changes to both active egress network, kicking off a VPN
117     * connection when ready, or setting firewall rules once VPN is connected.
118     */
119    private void handleStateChangedLocked() {
120
121        final NetworkInfo egressInfo = mConnService.getActiveNetworkInfoUnfiltered();
122        final LinkProperties egressProp = mConnService.getActiveLinkProperties();
123
124        final NetworkInfo vpnInfo = mVpn.getNetworkInfo();
125        final VpnConfig vpnConfig = mVpn.getLegacyVpnConfig();
126
127        // Restart VPN when egress network disconnected or changed
128        final boolean egressDisconnected = egressInfo == null
129                || State.DISCONNECTED.equals(egressInfo.getState());
130        final boolean egressChanged = egressProp == null
131                || !TextUtils.equals(mAcceptedEgressIface, egressProp.getInterfaceName());
132
133        final String egressTypeName = (egressInfo == null) ?
134                null : ConnectivityManager.getNetworkTypeName(egressInfo.getType());
135        final String egressIface = (egressProp == null) ?
136                null : egressProp.getInterfaceName();
137        Slog.d(TAG, "handleStateChanged: egress=" + egressTypeName +
138                " " + mAcceptedEgressIface + "->" + egressIface);
139
140        if (egressDisconnected || egressChanged) {
141            clearSourceRulesLocked();
142            mAcceptedEgressIface = null;
143            mVpn.stopLegacyVpn();
144        }
145        if (egressDisconnected) {
146            hideNotification();
147            return;
148        }
149
150        final int egressType = egressInfo.getType();
151        if (vpnInfo.getDetailedState() == DetailedState.FAILED) {
152            EventLogTags.writeLockdownVpnError(egressType);
153        }
154
155        if (mErrorCount > MAX_ERROR_COUNT) {
156            showNotification(R.string.vpn_lockdown_error, R.drawable.vpn_disconnected);
157
158        } else if (egressInfo.isConnected() && !vpnInfo.isConnectedOrConnecting()) {
159            if (mProfile.isValidLockdownProfile()) {
160                Slog.d(TAG, "Active network connected; starting VPN");
161                EventLogTags.writeLockdownVpnConnecting(egressType);
162                showNotification(R.string.vpn_lockdown_connecting, R.drawable.vpn_disconnected);
163
164                mAcceptedEgressIface = egressProp.getInterfaceName();
165                try {
166                    mVpn.startLegacyVpn(mProfile, KeyStore.getInstance(), egressProp);
167                } catch (IllegalStateException e) {
168                    mAcceptedEgressIface = null;
169                    Slog.e(TAG, "Failed to start VPN", e);
170                    showNotification(R.string.vpn_lockdown_error, R.drawable.vpn_disconnected);
171                }
172            } else {
173                Slog.e(TAG, "Invalid VPN profile; requires IP-based server and DNS");
174                showNotification(R.string.vpn_lockdown_error, R.drawable.vpn_disconnected);
175            }
176
177        } else if (vpnInfo.isConnected() && vpnConfig != null) {
178            final String iface = vpnConfig.interfaze;
179            final List<LinkAddress> sourceAddrs = vpnConfig.addresses;
180
181            if (TextUtils.equals(iface, mAcceptedIface)
182                  && sourceAddrs.equals(mAcceptedSourceAddr)) {
183                return;
184            }
185
186            Slog.d(TAG, "VPN connected using iface=" + iface +
187                    ", sourceAddr=" + sourceAddrs.toString());
188            EventLogTags.writeLockdownVpnConnected(egressType);
189            showNotification(R.string.vpn_lockdown_connected, R.drawable.vpn_connected);
190
191            try {
192                clearSourceRulesLocked();
193
194                mNetService.setFirewallInterfaceRule(iface, true);
195                for (LinkAddress addr : sourceAddrs) {
196                    setFirewallEgressSourceRule(addr, true);
197                }
198
199                mNetService.setFirewallUidRule(ROOT_UID, true);
200                mNetService.setFirewallUidRule(Os.getuid(), true);
201
202                mErrorCount = 0;
203                mAcceptedIface = iface;
204                mAcceptedSourceAddr = sourceAddrs;
205            } catch (RemoteException e) {
206                throw new RuntimeException("Problem setting firewall rules", e);
207            }
208
209            mConnService.sendConnectedBroadcast(augmentNetworkInfo(egressInfo));
210        }
211    }
212
213    public void init() {
214        synchronized (mStateLock) {
215            initLocked();
216        }
217    }
218
219    private void initLocked() {
220        Slog.d(TAG, "initLocked()");
221
222        mVpn.setEnableTeardown(false);
223
224        final IntentFilter resetFilter = new IntentFilter(ACTION_LOCKDOWN_RESET);
225        mContext.registerReceiver(mResetReceiver, resetFilter, CONNECTIVITY_INTERNAL, null);
226
227        try {
228            // TODO: support non-standard port numbers
229            mNetService.setFirewallEgressDestRule(mProfile.server, 500, true);
230            mNetService.setFirewallEgressDestRule(mProfile.server, 4500, true);
231            mNetService.setFirewallEgressDestRule(mProfile.server, 1701, true);
232        } catch (RemoteException e) {
233            throw new RuntimeException("Problem setting firewall rules", e);
234        }
235
236        synchronized (mStateLock) {
237            handleStateChangedLocked();
238        }
239    }
240
241    public void shutdown() {
242        synchronized (mStateLock) {
243            shutdownLocked();
244        }
245    }
246
247    private void shutdownLocked() {
248        Slog.d(TAG, "shutdownLocked()");
249
250        mAcceptedEgressIface = null;
251        mErrorCount = 0;
252
253        mVpn.stopLegacyVpn();
254        try {
255            mNetService.setFirewallEgressDestRule(mProfile.server, 500, false);
256            mNetService.setFirewallEgressDestRule(mProfile.server, 4500, false);
257            mNetService.setFirewallEgressDestRule(mProfile.server, 1701, false);
258        } catch (RemoteException e) {
259            throw new RuntimeException("Problem setting firewall rules", e);
260        }
261        clearSourceRulesLocked();
262        hideNotification();
263
264        mContext.unregisterReceiver(mResetReceiver);
265        mVpn.setEnableTeardown(true);
266    }
267
268    public void reset() {
269        Slog.d(TAG, "reset()");
270        synchronized (mStateLock) {
271            // cycle tracker, reset error count, and trigger retry
272            shutdownLocked();
273            initLocked();
274            handleStateChangedLocked();
275        }
276    }
277
278    private void clearSourceRulesLocked() {
279        try {
280            if (mAcceptedIface != null) {
281                mNetService.setFirewallInterfaceRule(mAcceptedIface, false);
282                mAcceptedIface = null;
283            }
284            if (mAcceptedSourceAddr != null) {
285                for (LinkAddress addr : mAcceptedSourceAddr) {
286                    setFirewallEgressSourceRule(addr, false);
287                }
288
289                mNetService.setFirewallUidRule(ROOT_UID, false);
290                mNetService.setFirewallUidRule(Os.getuid(), false);
291
292                mAcceptedSourceAddr = null;
293            }
294        } catch (RemoteException e) {
295            throw new RuntimeException("Problem setting firewall rules", e);
296        }
297    }
298
299    private void setFirewallEgressSourceRule(
300            LinkAddress address, boolean allow) throws RemoteException {
301        // Our source address based firewall rules must only cover our own source address, not the
302        // whole subnet
303        final String addrString = address.getAddress().getHostAddress();
304        mNetService.setFirewallEgressSourceRule(addrString, allow);
305    }
306
307    public void onNetworkInfoChanged() {
308        synchronized (mStateLock) {
309            handleStateChangedLocked();
310        }
311    }
312
313    public void onVpnStateChanged(NetworkInfo info) {
314        if (info.getDetailedState() == DetailedState.FAILED) {
315            mErrorCount++;
316        }
317        synchronized (mStateLock) {
318            handleStateChangedLocked();
319        }
320    }
321
322    public NetworkInfo augmentNetworkInfo(NetworkInfo info) {
323        if (info.isConnected()) {
324            final NetworkInfo vpnInfo = mVpn.getNetworkInfo();
325            info = new NetworkInfo(info);
326            info.setDetailedState(vpnInfo.getDetailedState(), vpnInfo.getReason(), null);
327        }
328        return info;
329    }
330
331    private void showNotification(int titleRes, int iconRes) {
332        final Notification.Builder builder = new Notification.Builder(mContext)
333                .setWhen(0)
334                .setSmallIcon(iconRes)
335                .setContentTitle(mContext.getString(titleRes))
336                .setContentText(mContext.getString(R.string.vpn_lockdown_config))
337                .setContentIntent(mConfigIntent)
338                .setPriority(Notification.PRIORITY_LOW)
339                .setOngoing(true)
340                .addAction(R.drawable.ic_menu_refresh, mContext.getString(R.string.reset),
341                        mResetIntent)
342                .setColor(mContext.getResources().getColor(
343                        com.android.internal.R.color.system_notification_accent_color));
344
345        NotificationManager.from(mContext).notify(TAG, 0, builder.build());
346    }
347
348    private void hideNotification() {
349        NotificationManager.from(mContext).cancel(TAG, 0);
350    }
351}
352