Android M：多个应用连接wifi热点的切换问题 WifiConfiguration的添加
一、版本适配问题。在android6.0上，app无法更新保存过的、不是由当前app创建的wifi配置。
1、现象：
在测试过程中，发现了一个bug。场景是：在android6.0的机器上，连接一个系统保存过的wifi，输入了正确的密码后，却始终无法连接成功，即updatenetwork始终返回-1.
2、分析：
首先简要说一下wifi的连接过程。我们使用系统api对当前要连接的wifi进行判断：(1)如果系统未保存过，则创建一个wificonfiguration，调用wifimanager的addnetwork方法去创建新的wifi连接；(2)如果是系统保存过的，就更新wificonfiguration的参数(密码等参数)，调用wifimanager的updatenetwork方法去更新这个wifi。上面两种方式，都会返回一个int值（the id of the network），如果大于0，则表示操作成功；小于0表示操作失败。
第一步，查看google官方的6.0 changes文档，看是否能找出很直观的原因。android 6.0 changes链接
wi-fi and networking changes
this release introduces the following behavior changes to the wi-fi and networking apis.
your apps can now change the state of wificonfiguration objects only if you created these objects. you are not permitted to modify or delete wificonfiguration objects created by the user or by other apps.
google已经明确的告诉开发者，app是不能修改或者删除不是自己创建的wifi的。接下来，从源代码层面深入分析一下原理。
第二步，对比android6.0和5.0以及7.0的源代码，查看版本之间的差异。
wifimanager里，都会调用到wifiserviceimpl的addorupdatenetwork方法。
private int addorupdatenetwork(wificonfiguration config) {
try {
return mservice.addorupdatenetwork(config);
} catch (remoteexception e) {
return -1;
}
}
然后，进入到wifiserviceimpl里面，进行一系列的权限验证后，为方法参数config设置当前uid的信息后，才开始链接
if (config.networkid == wificonfiguration.invalid_network_id) {
config.creatoruid = binder.getcallinguid();
} else {
config.lastupdateuid = binder.getcallinguid();
}
if (mwifistatemachinechannel != null) {
return mwifistatemachine.syncaddorupdatenetwork(mwifistatemachinechannel, config);
} else {
slog.e(tag, "mwifistatemachinechannel is not initialized");
return -1;
}
继续往状态机wifistatemachine里走–
public int syncaddorupdatenetwork(asyncchannel channel, wificonfiguration config) {
message resultmsg = channel.sendmessagesynchronously(cmd_add_or_update_network, config);
int result = resultmsg.arg1;
resultmsg.recycle();
return result;
}
在内部类connectmodestate的processmessage(message message)方法里，开始处理消息cmd_add_or_update_network，也就是这里，开始出现了版本代码的差异。
下面是6.0代码比5.0新增的代码片段
case cmd_add_or_update_network:
config = (wificonfiguration) message.obj;
// difference begin（6.0新增代码开始位置）
if (!recorduidifauthorized(config, message.sendinguid,
/* onlyannotate */ false)) {
logw("not authorized to update network "
+ " config=" + config.ssid
+ " cnid=" + config.networkid
+ " uid=" + message.sendinguid);
replytomessage(message, message.what, failure);
break;
}
// difference end（6.0新增代码结束位置）
//......
重点看一下recorduidifauthorized()方法–
/**
* save the uid correctly depending on if this is a new or existing network.
* @return true if operation is authorized, false otherwise
*/
boolean recorduidifauthorized(wificonfiguration config, int uid, boolean onlyannotate) {
if (!mwificonfigstore.isnetworkconfigured(config)) {
config.creatoruid = uid;
config.creatorname = mcontext.getpackagemanager().getnameforuid(uid);
} else if (!mwificonfigstore.canmodifynetwork(uid, config, onlyannotate)) {
return false;
}
config.lastupdateuid = uid;
config.lastupdatename = mcontext.getpackagemanager().getnameforuid(uid);
return true;
}
1、首先通过wificonfigstore对象判断如果这个wifi还没有被存储过，则记录creatoruid为当前的app id，这个比较好理解。
2、然后继续判断当前app有没有权限修改这个wifi，就是canmodifynetwork()方法。继续跟进去，最终会执行到wificonfigstore的canmodifynetwork()方法–
/**
* checks if uid has access to modify the configuration corresponding to networkid.
*
* factors involved in modifiability of a config are as follows.
* if uid is a device owner app then it has full control over the device, including wifi
* configs.
* if the modification is only for administrative annotation (e.g. when connecting) or the
* config is not lockdown eligible (currently that means any config not last updated by the do)
* then the creator of config or an app holding override_config_wifi can modify the config.
* if the config is lockdown eligible and the modification is substantial (not annotation)
* then the requirement to be able to modify the config by the uid is as follows:
* a) the uid has to hold override_config_wifi and
* b) the lockdown feature should be disabled.
*/
boolean canmodifynetwork(int uid, int networkid, boolean onlyannotate) {
wificonfiguration config = mconfigurednetworks.get(networkid);
if (config == null) {
loge("canmodifynetwork: cannot find config networkid " + networkid);
return false;
}
final devicepolicymanagerinternal dpmi = localservices.getservice(
devicepolicymanagerinternal.class);
final boolean isuiddeviceowner = dpmi != null && dpmi.isactiveadminwithpolicy(uid,
deviceadmininfo.uses_policy_device_owner);
if (isuiddeviceowner) {
// device owner has full control over the device, including wifi configs
return true;
}
final boolean iscreator = (config.creatoruid == uid);
if (onlyannotate) {
return iscreator || checkconfigoverridepermission(uid);
}
// check if device has dpm capability. if it has and dpmi is still null, then we
// treat this case with suspicion and bail out.
if (mcontext.getpackagemanager().hassystemfeature(packagemanager.feature_device_admin)
&& dpmi == null) {
return false;
}
// wifi config lockdown related logic. at this point we know uid not to be a device owner.
final boolean isconfigeligibleforlockdown = dpmi != null && dpmi.isactiveadminwithpolicy(
config.creatoruid, deviceadmininfo.uses_policy_device_owner);
if (!isconfigeligibleforlockdown) {
return iscreator || checkconfigoverridepermission(uid);
}
final contentresolver resolver = mcontext.getcontentresolver();
final boolean islockdownfeatureenabled = settings.global.getint(resolver,
settings.global.wifi_device_owner_configs_lockdown, 0) != 0;
return !islockdownfeatureenabled && checkconfigoverridepermission(uid);
}
这里面会先判断当前app是否是device owner，然后判断是否有权限override_wifi_config，这个app都不符合，所以会返回false，分析到这里得以验证。
3、结语：
用google的原话：your apps can now change the state of wificonfiguration objects only if you created these objects. you are not permitted to modify or delete wificonfiguration objects created by the user or by other apps.
4、备注：google在6.0上增加了这个逻辑，然后又在7.0去掉了。所以这个问题只存在于6.0的系统上。
上一篇： sql注入基础