/**
* Create a VPN interface using the parameters supplied to this
* builder. The interface works on IP packets, and a file descriptor
* is returned for the application to access them. Each read
* retrieves an outgoing packet which was routed to the interface.
* Each write injects an incoming packet just like it was received
* from the interface. The file descriptor is put into non-blocking
* mode by default to avoid blocking Java threads. To use the file
* descriptor completely in native space, see
* {@link ParcelFileDescriptor#detachFd()}. The application MUST
* close the file descriptor when the VPN connection is terminated.
* The VPN interface will be removed and the network will be
* restored by the system automatically.
*
* <p>To avoid conflicts, there can be only one active VPN interface
* at the same time. Usually network parameters are never changed
* during the lifetime of a VPN connection. It is also common for an
* application to create a new file descriptor after closing the
* previous one. However, it is rare but not impossible to have two
* interfaces while performing a seamless handover. In this case, the
* old interface will be deactivated when the new one is created
* successfully. Both file descriptors are valid but now outgoing
* packets will be routed to the new interface. Therefore, after
* draining the old file descriptor, the application MUST close it
* and start using the new file descriptor. If the new interface
* cannot be created, the existing interface and its file descriptor
* remain untouched.
*
* <p>An exception will be thrown if the interface cannot be created
* for any reason. However, this method returns {@code null} if the
* application is not prepared or is revoked. This helps solve
* possible race conditions between other VPN applications.
*
* @return {@link ParcelFileDescriptor} of the VPN interface, or
*         {@code null} if the application is not prepared.
* @throws IllegalArgumentException if a parameter is not accepted
*         by the operating system.
* @throws IllegalStateException if a parameter cannot be applied
*         by the operating system.
* @throws SecurityException if the service is not properly declared
*         in {@code AndroidManifest.xml}.
* @see VpnService
*/
@Nullable
public ParcelFileDescriptor establish() {
   mConfig.addresses = mAddresses;
   mConfig.routes = mRoutes;

   try {
       return getService().establishVpn(mConfig);
   } catch (RemoteException e) {
       throw new IllegalStateException(e);
   }
}


/**
* Use IConnectivityManager since those methods are hidden and not
* available in ConnectivityManager.
*/
private static IConnectivityManager getService() {
  return IConnectivityManager.Stub.asInterface(
          ServiceManager.getService(Context.CONNECTIVITY_SERVICE));
}

protected final SparseArray<Vpn> mVpns = new SparseArray<>();

/**
  * Configure a TUN interface and return its file descriptor. Parameters
  * are encoded and opaque to this class. This method is used by VpnBuilder
  * and not available in ConnectivityManager. Permissions are checked in
  * Vpn class.
  * @hide
  */
 @Override
 public ParcelFileDescriptor establishVpn(VpnConfig config) {
     int user = UserHandle.getUserId(Binder.getCallingUid());
     synchronized (mVpns) {
         throwIfLockdownEnabled();
         // mVpns其实是个Vpn数组
         return mVpns.get(user).establish(config);
     }
 }

/**
 * Establish a VPN network and return the file descriptor of the VPN interface. This methods
 * returns {@code null} if the application is revoked or not prepared.
 *
 * @param config The parameters to configure the network.
 * @return The file descriptor of the VPN interface.
 */
public synchronized ParcelFileDescriptor establish(VpnConfig config) {
    // Check if the caller is already prepared.
    UserManager mgr = UserManager.get(mContext);
    if (Binder.getCallingUid() != mOwnerUID) {
        return null;
    }
    // Check to ensure consent hasn't been revoked since we were prepared.
    if (!isVpnUserPreConsented(mPackage)) {
        return null;
    }
    // Check if the service is properly declared.
    Intent intent = new Intent(VpnConfig.SERVICE_INTERFACE);
    intent.setClassName(mPackage, config.user);
    long token = Binder.clearCallingIdentity();
    try {
        // Restricted users are not allowed to create VPNs, they are tied to Owner
        UserInfo user = mgr.getUserInfo(mUserHandle);
        if (user.isRestricted()) {
            throw new SecurityException("Restricted users cannot establish VPNs");
        }

        ResolveInfo info = AppGlobals.getPackageManager().resolveService(intent,
                null, 0, mUserHandle);
        if (info == null) {
            throw new SecurityException("Cannot find " + config.user);
        }
        if (!BIND_VPN_SERVICE.equals(info.serviceInfo.permission)) {
            throw new SecurityException(config.user + " does not require " + BIND_VPN_SERVICE);
        }
    } catch (RemoteException e) {
        throw new SecurityException("Cannot find " + config.user);
    } finally {
        Binder.restoreCallingIdentity(token);
    }

    // Save the old config in case we need to go back.
    VpnConfig oldConfig = mConfig;
    String oldInterface = mInterface;
    Connection oldConnection = mConnection;
    NetworkAgent oldNetworkAgent = mNetworkAgent;
    Set<UidRange> oldUsers = mNetworkCapabilities.getUids();

    // 调用jniCreate方法创建了一个FD
    // Configure the interface. Abort if any of these steps fails.
    ParcelFileDescriptor tun = ParcelFileDescriptor.adoptFd(jniCreate(config.mtu));
    try {
        String interfaze = jniGetName(tun.getFd());

        // TEMP use the old jni calls until there is support for netd address setting
        StringBuilder builder = new StringBuilder();
        for (LinkAddress address : config.addresses) {
            builder.append(" ");
            builder.append(address);
        }
        if (jniSetAddresses(interfaze, builder.toString()) < 1) {
            throw new IllegalArgumentException("At least one address must be specified");
        }
        Connection connection = new Connection();
        if (!mContext.bindServiceAsUser(intent, connection,
                Context.BIND_AUTO_CREATE | Context.BIND_FOREGROUND_SERVICE,
                new UserHandle(mUserHandle))) {
            throw new IllegalStateException("Cannot bind " + config.user);
        }

        mConnection = connection;
        mInterface = interfaze;

        // Fill more values.
        config.user = mPackage;
        config.interfaze = mInterface;
        config.startTime = SystemClock.elapsedRealtime();
        mConfig = config;

        // Set up forwarding and DNS rules.
        // First attempt to do a seamless handover that only changes the interface name and
        // parameters. If that fails, disconnect.
        if (oldConfig != null
                && updateLinkPropertiesInPlaceIfPossible(mNetworkAgent, oldConfig)) {
            // Keep mNetworkAgent unchanged
        } else {
            mNetworkAgent = null;
            updateState(DetailedState.CONNECTING, "establish");
            // Set up forwarding and DNS rules.
            agentConnect();
            // Remove the old tun's user forwarding rules
            // The new tun's user rules have already been added above so they will take over
            // as rules are deleted. This prevents data leakage as the rules are moved over.
            agentDisconnect(oldNetworkAgent);
        }

        if (oldConnection != null) {
            mContext.unbindService(oldConnection);
        }

        if (oldInterface != null && !oldInterface.equals(interfaze)) {
            jniReset(oldInterface);
        }

        try {
            IoUtils.setBlocking(tun.getFileDescriptor(), config.blocking);
        } catch (IOException e) {
            throw new IllegalStateException(
                    "Cannot set tunnel's fd as blocking=" + config.blocking, e);
        }
    } catch (RuntimeException e) {
        IoUtils.closeQuietly(tun);
        // If this is not seamless handover, disconnect partially-established network when error
        // occurs.
        if (oldNetworkAgent != mNetworkAgent) {
            agentDisconnect();
        }
        // restore old state
        mConfig = oldConfig;
        mConnection = oldConnection;
        mNetworkCapabilities.setUids(oldUsers);
        mNetworkAgent = oldNetworkAgent;
        mInterface = oldInterface;
        throw e;
    }
    Log.i(TAG, "Established by " + config.user + " on " + mInterface);
    return tun;
}

private native int jniCreate(int mtu);
private native String jniGetName(int tun);
private native int jniSetAddresses(String interfaze, String addresses);
private native void jniReset(String interfaze);
private native int jniCheck(String interfaze);
private native boolean jniAddAddress(String interfaze, String address, int prefixLen);
private native boolean jniDelAddress(String interfaze, String address, int prefixLen);

+----------------------------------------------------------------+
|                                                                |
|  +--------------------+      +--------------------+            |
|  | User Application A |      | User Application B |<-----+     |
|  +--------------------+      +--------------------+      |     |
|               | 1                    | 5                 |     |
|...............|......................|...................|.....|
|               ↓                      ↓                   |     |
|         +----------+           +----------+              |     |
|         | socket A |           | socket B |              |     |
|         +----------+           +----------+              |     |
|                 | 2               | 6                    |     |
|.................|.................|......................|.....|
|                 ↓                 ↓                      |     |
|             +------------------------+                 4 |     |
|             | Newwork Protocol Stack |                   |     |
|             +------------------------+                   |     |
|                | 7                 | 3                   |     |
|................|...................|.....................|.....|
|                ↓                   ↓                     |     |
|        +----------------+    +----------------+          |     |
|        |      eth0      |    |      tun0      |          |     |
|        +----------------+    +----------------+          |     |
|    10.32.0.11  |                   |   192.168.3.11      |     |
|                | 8                 +---------------------+     |
|                |                                               |
+----------------|-----------------------------------------------+
                 ↓
         Physical Network

int[][] array = new int[64 * 1024][1024];

// 横向遍历
for(int i = 0; i < 64 * 1024; i ++)
    for(int j = 0; j < 1024; j ++)
        array[i][j] ++;

// 纵向遍历
for(int i = 0; i < 1024; i ++)
    for(int j = 0; j < 64 * 1024; j ++)
        array[j][i] ++;