Xamarin Android - VpnService is blocking all apps

问题

An app I'm designing uses the VpnService, along with the VpnService.Builder, classes to generate a VPN in order to block traffic from specific apps. According to the documentation over at developer.android.com, all apps should be allowed through the VPN until Builder.AddAllowedApplication or Builder.AddDisallowedApplication is called.

When my VPN service starts up, for some reason, all apps are being disallowed which is strange. As soon as I disconnect from the VPN, all apps become available again. I need to to allow all, unless otherwise specified (which is what the documentation says should be happening). I start the VPN by calling the following:

    private string _sTag = typeof(VpnService).Name;
    private VpnServiceBinder _objBinder;
    private ParcelFileDescriptor _objVpnInterface = null;
    private PendingIntent _objPendingIntent = null;
    ...

        if (_objVpnInterface == null)
        {
            Builder objVpnBuilder = new Builder(this);
            objVpnBuilder.AddAddress("10.0.0.2", 32);
            objVpnBuilder.AddRoute("0.0.0.0", 0);

            // Form the interface
            _objVpnInterface = objVpnBuilder.SetSession("Squelch").SetConfigureIntent(_objPendingIntent).Establish();

            // Disallow instagram as a test
            objVpnBuilder.AddDisallowedApplication("com.instagram.android");

            // Set flag
            _bVpnIsRunning = true;
        }

So in the above instance, instagram should be the only blocked app, but all traffic appears to be blocked (can't use the chrome app, facebook, etc). Is there something I am missing in regards to this? Should I be specifying something before/after establishing the interface? Any help or direction would be greatly appreciated!

Note: In case it matters, I am targeting android 6.0 and higher. I can provide more source if required.

回答1:

addDisallowedApplication:

By default, all applications are allowed access, except for those denied through this method. Denied applications will use networking as if the VPN wasn't running.

AddDisallowedApplication excludes the application from your VPNService and allows it to continue to use the "non-VPN" networking stack.

addAllowedApplication:

Adds an application that's allowed to access the VPN connection

Note: You can use an allowed or disallowed list, but not both at the same time.

So lets say we want to "block" any Chrome package from accessing the normal networking stack and redirect any Chrome apps from accessing the network via our "blocking" VPN, we can add all Chrome app package names to our VPNService implementation.

Note: there are 4(?) different Chrome apps, alpha, beta, etc.... so lets just block any package that has the name chrome in it, not really ideal, but for an example it works.

using (var pm = Application.Context.PackageManager)
{
    var packageList = pm.GetInstalledPackages(0);
    foreach (var package in packageList)
    {
        if (package.PackageName.Contains("chrome"))
        {
            Log.Debug(TAG, package.PackageName);
            builder.AddAllowedApplication(package.PackageName);
        }
    }
}

After you .Establish() the VPN connection, all Chrome applications networking will be redirected to your VPNService and thus blocked.

来源：https://stackoverflow.com/questions/50456088/xamarin-android-vpnservice-is-blocking-all-apps

标签

android

Xamarin

xamarin.android