VPN: avoid leaking file descriptors.
Change-Id: If70f5af3529d79bddb9d72675cf6eb038ff3ff70
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index a8aff37..47902a8 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -91,6 +91,8 @@
<protected-broadcast android:name="android.hardware.usb.action.USB_DEVICE_ATTACHED" />
<protected-broadcast android:name="android.hardware.usb.action.USB_DEVICE_DETACHED" />
+ <protected-broadcast android:name="android.net.vpn.action.REVOKED" />
+
<protected-broadcast android:name="android.nfc.action.LLCP_LINK_STATE_CHANGED" />
<protected-broadcast android:name="com.android.nfc_extras.action.RF_FIELD_ON_DETECTED" />
<protected-broadcast android:name="com.android.nfc_extras.action.RF_FIELD_OFF_DETECTED" />
diff --git a/services/java/com/android/server/connectivity/Vpn.java b/services/java/com/android/server/connectivity/Vpn.java
index 035a6679..47813f8 100644
--- a/services/java/com/android/server/connectivity/Vpn.java
+++ b/services/java/com/android/server/connectivity/Vpn.java
@@ -102,14 +102,22 @@
/**
* Protect a socket from routing changes by binding it to the given
- * interface. The socket is NOT closed by this method.
+ * interface. The socket IS closed by this method.
*
* @param socket The socket to be bound.
* @param name The name of the interface.
*/
public void protect(ParcelFileDescriptor socket, String name) {
- mContext.enforceCallingPermission(VPN, "protect");
- nativeProtect(socket.getFd(), name);
+ try {
+ mContext.enforceCallingPermission(VPN, "protect");
+ nativeProtect(socket.getFd(), name);
+ } finally {
+ try {
+ socket.close();
+ } catch (Exception e) {
+ // ignore
+ }
+ }
}
/**