Merge "Enforce permissions check for WifiScanner#getAvailableChannels()"

2 files changed, 74 insertions, 13 deletions

diff --git a/service/java/com/android/server/wifi/scanner/WifiScanningServiceImpl.java b/service/java/com/android/server/wifi/scanner/WifiScanningServiceImpl.java
index 30ead5960..4d21ac655 100644
--- a/service/java/com/android/server/wifi/scanner/WifiScanningServiceImpl.java
+++ b/service/java/com/android/server/wifi/scanner/WifiScanningServiceImpl.java
@@ -29,6 +29,7 @@ import android.net.wifi.WifiScanner.ChannelSpec;
 import android.net.wifi.WifiScanner.PnoSettings;
 import android.net.wifi.WifiScanner.ScanData;
 import android.net.wifi.WifiScanner.ScanSettings;
+import android.net.wifi.WifiScanner.WifiBand;
 import android.net.wifi.WifiStackClient;
 import android.os.Binder;
 import android.os.Bundle;
@@ -110,10 +111,12 @@ public class WifiScanningServiceImpl extends IWifiScanner.Stub {
     }
 
     @Override
-    public Bundle getAvailableChannels(int band) {
+    public Bundle getAvailableChannels(@WifiBand int band, String packageName) {
+        enforcePermission(Binder.getCallingUid(), packageName, false, false, false);
+
         mChannelHelper.updateChannels();
         ChannelSpec[] channelSpecs = mChannelHelper.getAvailableScanChannels(band);
-        ArrayList<Integer> list = new ArrayList<Integer>(channelSpecs.length);
+        ArrayList<Integer> list = new ArrayList<>(channelSpecs.length);
         for (ChannelSpec channelSpec : channelSpecs) {
             list.add(channelSpec.frequency);
         }
@@ -173,29 +176,39 @@ public class WifiScanningServiceImpl extends IWifiScanner.Stub {
     }
 
     /**
+     * @see #enforcePermission(int, String, boolean, boolean, boolean)
+     */
+    private void enforcePermission(int uid, Message msg) throws SecurityException {
+        enforcePermission(uid, getPackageName(msg), isPrivilegedMessage(msg.what),
+                shouldIgnoreLocationSettingsForSingleScan(msg),
+                shouldHideFromAppsForSingleScan(msg));
+    }
+
+    /**
      * Enforce the necessary client permissions for WifiScanner.
      * If the client has NETWORK_STACK permission, then it can "always" send "any" request.
      * If the client has only LOCATION_HARDWARE permission, then it can
      *    a) Only make scan related requests when location is turned on.
      *    b) Can never make one of the privileged requests.
-     *
-     * @param uid Uid of the client.
-     * @param msg {@link Message} of the incoming request.
-     * @throws {@link SecurityException} if the client does not have the necessary permissions.
+     * @param uid uid of the client
+     * @param packageName package name of the client
+     * @param isPrivilegedRequest whether we are checking for a privileged request
+     * @param shouldIgnoreLocationSettings override to ignore location settings
+     * @param shouldHideFromApps override to hide request from AppOps
      */
-    private void enforcePermission(int uid, Message msg) throws SecurityException {
+    private void enforcePermission(int uid, String packageName, boolean isPrivilegedRequest,
+            boolean shouldIgnoreLocationSettings, boolean shouldHideFromApps) {
         try {
-            /** Wifi stack issued requests.*/
+            // Wifi stack issued requests.
             enforceWifiStackPermission(uid);
         } catch (SecurityException e) {
-            /** System-app issued requests. */
-            if (isPrivilegedMessage(msg.what)) {
+            // System-app issued requests
+            if (isPrivilegedRequest) {
                 // Privileged message, only requests from clients with NETWORK_STACK allowed!
                 throw e;
             }
-            mWifiPermissionsUtil.enforceCanAccessScanResultsForWifiScanner(
-                    getPackageName(msg), uid, shouldIgnoreLocationSettingsForSingleScan(msg),
-                    shouldHideFromAppsForSingleScan(msg));
+            mWifiPermissionsUtil.enforceCanAccessScanResultsForWifiScanner(packageName, uid,
+                    shouldIgnoreLocationSettings, shouldHideFromApps);
         }
     }
 
diff --git a/tests/wifitests/src/com/android/server/wifi/scanner/WifiScanningServiceTest.java b/tests/wifitests/src/com/android/server/wifi/scanner/WifiScanningServiceTest.java
index c61ceb4a9..ea1fb51d5 100644
--- a/tests/wifitests/src/com/android/server/wifi/scanner/WifiScanningServiceTest.java
+++ b/tests/wifitests/src/com/android/server/wifi/scanner/WifiScanningServiceTest.java
@@ -18,6 +18,7 @@ package com.android.server.wifi.scanner;
 
 import static android.content.pm.PackageManager.PERMISSION_DENIED;
 import static android.content.pm.PackageManager.PERMISSION_GRANTED;
+import static android.net.wifi.WifiScanner.GET_AVAILABLE_CHANNELS_EXTRA;
 
 import static com.android.server.wifi.ScanTestUtil.NativeScanSettingsBuilder;
 import static com.android.server.wifi.ScanTestUtil.assertNativePnoSettingsEquals;
@@ -3490,4 +3491,51 @@ public class WifiScanningServiceTest extends WifiBaseTest {
 
         verifyPnoNetworkFoundReceived(order, handler, requestId, scanResults.getRawScanResults());
     }
+
+    /**
+     * Tests that {@link WifiScanningServiceImpl#getAvailableChannels(int, String)} throws a
+     * {@link SecurityException} if the caller doesn't hold the required permissions.
+     */
+    @Test(expected = SecurityException.class)
+    public void getAvailableChannels_noPermission_throwsException() throws Exception {
+        startServiceAndLoadDriver();
+
+        // no MAINLINE_WIFI_STACK permission
+        doThrow(new SecurityException()).when(mContext).enforcePermission(
+                eq(WifiStackClient.PERMISSION_MAINLINE_WIFI_STACK), anyInt(),
+                eq(Binder.getCallingUid()), any());
+
+        // Location permission or mode check fail.
+        doThrow(new SecurityException())
+                .when(mWifiPermissionsUtil).enforceCanAccessScanResultsForWifiScanner(
+                        TEST_PACKAGE_NAME, Binder.getCallingUid(), false, false);
+
+        mWifiScanningServiceImpl.getAvailableChannels(WifiScanner.WIFI_BAND_24_GHZ,
+                TEST_PACKAGE_NAME);
+    }
+
+    /**
+     * Tests that {@link WifiScanningServiceImpl#getAvailableChannels(int, String)} returns
+     * the expected result if the caller does hold the required permissions.
+     */
+    @Test
+    public void getAvailableChannels_hasPermission_returnsSuccessfully() throws Exception {
+        startServiceAndLoadDriver();
+
+        // has MAINLINE_WIFI_STACK permission
+        doNothing().when(mContext).enforcePermission(
+                eq(WifiStackClient.PERMISSION_MAINLINE_WIFI_STACK), anyInt(),
+                eq(Binder.getCallingUid()), any());
+
+        // has access scan results permission
+        doNothing().when(mWifiPermissionsUtil).enforceCanAccessScanResultsForWifiScanner(
+                TEST_PACKAGE_NAME, Binder.getCallingUid(), false, false);
+
+        Bundle bundle = mWifiScanningServiceImpl.getAvailableChannels(
+                WifiScanner.WIFI_BAND_24_GHZ, TEST_PACKAGE_NAME);
+        List<Integer> actual = bundle.getIntegerArrayList(GET_AVAILABLE_CHANNELS_EXTRA);
+
+        List<Integer> expected = Arrays.asList(2400, 2450);
+        assertEquals(expected, actual);
+    }
 }