NetworkSecurityPolicy.java revision 6a2a541fb1f63a2fb45b09210307a3e639e49e5d 
1/**
2 * Copyright (c) 2015, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *     http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17package android.security;
18
19import android.content.Context;
20import android.content.pm.PackageManager;
21import android.security.net.config.ApplicationConfig;
22import android.security.net.config.ManifestConfigSource;
23
24/**
25 * Network security policy.
26 *
27 * <p>Network stacks/components should honor this policy to make it possible to centrally control
28 * the relevant aspects of network security behavior.
29 *
30 * <p>The policy currently consists of a single flag: whether cleartext network traffic is
31 * permitted. See {@link #isCleartextTrafficPermitted()}.
32 */
33public class NetworkSecurityPolicy {
34
35    private static final NetworkSecurityPolicy INSTANCE = new NetworkSecurityPolicy();
36
37    private NetworkSecurityPolicy() {}
38
39    /**
40     * Gets the policy for this process.
41     *
42     * <p>It's fine to cache this reference. Any changes to the policy will be immediately visible
43     * through the reference.
44     */
45    public static NetworkSecurityPolicy getInstance() {
46        return INSTANCE;
47    }
48
49    /**
50     * Returns whether cleartext network traffic (e.g. HTTP, FTP, WebSockets, XMPP, IMAP, SMTP --
51     * without TLS or STARTTLS) is permitted for all network communication from this process.
52     *
53     * <p>When cleartext network traffic is not permitted, the platform's components (e.g. HTTP and
54     * FTP stacks, {@link android.app.DownloadManager}, {@link android.media.MediaPlayer}) will
55     * refuse this process's requests to use cleartext traffic. Third-party libraries are strongly
56     * encouraged to honor this setting as well.
57     *
58     * <p>This flag is honored on a best effort basis because it's impossible to prevent all
59     * cleartext traffic from Android applications given the level of access provided to them. For
60     * example, there's no expectation that the {@link java.net.Socket} API will honor this flag
61     * because it cannot determine whether its traffic is in cleartext. However, most network
62     * traffic from applications is handled by higher-level network stacks/components which can
63     * honor this aspect of the policy.
64     *
65     * <p>NOTE: {@link android.webkit.WebView} honors this flag for applications targeting API level
66     * 26 and up.
67     */
68    public boolean isCleartextTrafficPermitted() {
69        return libcore.net.NetworkSecurityPolicy.getInstance().isCleartextTrafficPermitted();
70    }
71
72    /**
73     * Returns whether cleartext network traffic (e.g. HTTP, FTP, XMPP, IMAP, SMTP -- without
74     * TLS or STARTTLS) is permitted for communicating with {@code hostname} for this process.
75     *
76     * @see #isCleartextTrafficPermitted()
77     */
78    public boolean isCleartextTrafficPermitted(String hostname) {
79        return libcore.net.NetworkSecurityPolicy.getInstance()
80                .isCleartextTrafficPermitted(hostname);
81    }
82
83    /**
84     * Sets whether cleartext network traffic is permitted for this process.
85     *
86     * <p>This method is used by the platform early on in the application's initialization to set
87     * the policy.
88     *
89     * @hide
90     */
91    public void setCleartextTrafficPermitted(boolean permitted) {
92        FrameworkNetworkSecurityPolicy policy = new FrameworkNetworkSecurityPolicy(permitted);
93        libcore.net.NetworkSecurityPolicy.setInstance(policy);
94    }
95
96    /**
97     * Handle an update to the system or user certificate stores.
98     * @hide
99     */
100    public void handleTrustStorageUpdate() {
101        ApplicationConfig config = ApplicationConfig.getDefaultInstance();
102        if (config != null) {
103            config.handleTrustStorageUpdate();
104        }
105    }
106
107    /**
108     * Returns an {@link ApplicationConfig} based on the configuration for {@code packageName}.
109     *
110     * @hide
111     */
112    public static ApplicationConfig getApplicationConfigForPackage(Context context,
113            String packageName) throws PackageManager.NameNotFoundException {
114        Context appContext = context.createPackageContext(packageName, 0);
115        ManifestConfigSource source = new ManifestConfigSource(appContext);
116        return new ApplicationConfig(source);
117    }
118}
119