Always-on VPN.

Adds support for always-on VPN profiles, also called "lockdown." When
enabled, LockdownVpnTracker manages the netd firewall to prevent
unencrypted traffic from leaving the device. It creates narrow rules
to only allow traffic to the selected VPN server. When an egress
network becomes available, LockdownVpnTracker will try bringing up
the VPN connection, and will reconnect if disconnected.

ConnectivityService augments any NetworkInfo based on the lockdown
VPN status to help apps wait until the VPN is connected.

This feature requires that VPN profiles use an IP address for both
VPN server and DNS. It also blocks non-default APN access when
enabled. Waits for USER_PRESENT after boot to check KeyStore status.

Bug: 5756357
Change-Id: If615f206b1634000d78a8350a17e88bfcac8e0d0

1 files changed, 15 insertions, 0 deletions

diff --git a/services/java/com/android/server/connectivity/Vpn.java b/services/java/com/android/server/connectivity/Vpn.java
index d96bd0d..b3cbb84 100644
--- a/services/java/com/android/server/connectivity/Vpn.java
+++ b/services/java/com/android/server/connectivity/Vpn.java
@@ -90,6 +90,7 @@ public class Vpn extends BaseNetworkStateTracker {
     private Connection mConnection;
     private LegacyVpnRunner mLegacyVpnRunner;
     private PendingIntent mStatusIntent;
+    private boolean mEnableNotif = true;
 
     public Vpn(Context context, VpnCallback callback, INetworkManagementService netService) {
         // TODO: create dedicated TYPE_VPN network type
@@ -104,6 +105,10 @@ public class Vpn extends BaseNetworkStateTracker {
         }
     }
 
+    public void setEnableNotifications(boolean enableNotif) {
+        mEnableNotif = enableNotif;
+    }
+
     @Override
     protected void startMonitoringInternal() {
         // Ignored; events are sent through callbacks for now
@@ -394,6 +399,7 @@ public class Vpn extends BaseNetworkStateTracker {
     }
 
     private void showNotification(VpnConfig config, String label, Bitmap icon) {
+        if (!mEnableNotif) return;
         mStatusIntent = VpnConfig.getIntentForStatusPanel(mContext, config);
 
         NotificationManager nm = (NotificationManager)
@@ -420,6 +426,7 @@ public class Vpn extends BaseNetworkStateTracker {
     }
 
     private void hideNotification() {
+        if (!mEnableNotif) return;
         mStatusIntent = null;
 
         NotificationManager nm = (NotificationManager)
@@ -598,6 +605,14 @@ public class Vpn extends BaseNetworkStateTracker {
         return info;
     }
 
+    public VpnConfig getLegacyVpnConfig() {
+        if (mLegacyVpnRunner != null) {
+            return mLegacyVpnRunner.mConfig;
+        } else {
+            return null;
+        }
+    }
+
     /**
      * Bringing up a VPN connection takes time, and that is all this thread
      * does. Here we have plenty of time. The only thing we need to take